* [PATCH 6.1 001/591] drm: use mgr->dev in drm_dbg_kms in drm_dp_add_payload_part2
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 002/591] fs: pipe: reveal missing function protoypes Greg Kroah-Hartman
` (593 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jani Nikula, Jeff Layton,
Jani Nikula, Lyude Paul, Limonciello, Mario
From: Jeff Layton <jlayton@kernel.org>
commit 54d217406afe250d7a768783baaa79a035f21d38 upstream.
I've been experiencing some intermittent crashes down in the display
driver code. The symptoms are ususally a line like this in dmesg:
amdgpu 0000:30:00.0: [drm] Failed to create MST payload for port 000000006d3a3885: -5
...followed by an Oops due to a NULL pointer dereference.
Switch to using mgr->dev instead of state->dev since "state" can be
NULL in some cases.
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2184855
Suggested-by: Jani Nikula <jani.nikula@linux.intel.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230419112447.18471-1-jlayton@kernel.org
Cc: "Limonciello, Mario" <mario.limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/display/drm_dp_mst_topology.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
@@ -3404,7 +3404,7 @@ int drm_dp_add_payload_part2(struct drm_
/* Skip failed payloads */
if (payload->vc_start_slot == -1) {
- drm_dbg_kms(state->dev, "Part 1 of payload creation for %s failed, skipping part 2\n",
+ drm_dbg_kms(mgr->dev, "Part 1 of payload creation for %s failed, skipping part 2\n",
payload->port->connector->name);
return -EIO;
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 002/591] fs: pipe: reveal missing function protoypes
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 001/591] drm: use mgr->dev in drm_dbg_kms in drm_dp_add_payload_part2 Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 003/591] block: Fix the type of the second bdev_op_is_zoned_write() argument Greg Kroah-Hartman
` (592 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Christian Brauner,
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 247c8d2f9837a3e29e3b6b7a4aa9c36c37659dd4 ]
A couple of functions from fs/pipe.c are used both internally
and for the watch queue code, but the declaration is only
visible when the latter is enabled:
fs/pipe.c:1254:5: error: no previous prototype for 'pipe_resize_ring'
fs/pipe.c:758:15: error: no previous prototype for 'account_pipe_buffers'
fs/pipe.c:764:6: error: no previous prototype for 'too_many_pipe_buffers_soft'
fs/pipe.c:771:6: error: no previous prototype for 'too_many_pipe_buffers_hard'
fs/pipe.c:777:6: error: no previous prototype for 'pipe_is_unprivileged_user'
Make the visible unconditionally to avoid these warnings.
Fixes: c73be61cede5 ("pipe: Add general notification queue support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Message-Id: <20230516195629.551602-1-arnd@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/pipe_fs_i.h | 4 ----
1 file changed, 4 deletions(-)
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 6cb65df3e3ba5..28b3c6a673975 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -241,18 +241,14 @@ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);
extern const struct pipe_buf_operations nosteal_pipe_buf_ops;
-#ifdef CONFIG_WATCH_QUEUE
unsigned long account_pipe_buffers(struct user_struct *user,
unsigned long old, unsigned long new);
bool too_many_pipe_buffers_soft(unsigned long user_bufs);
bool too_many_pipe_buffers_hard(unsigned long user_bufs);
bool pipe_is_unprivileged_user(void);
-#endif
/* for F_SETPIPE_SZ and F_GETPIPE_SZ */
-#ifdef CONFIG_WATCH_QUEUE
int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int nr_slots);
-#endif
long pipe_fcntl(struct file *, unsigned int, unsigned long arg);
struct pipe_inode_info *get_pipe_info(struct file *file, bool for_splice);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 003/591] block: Fix the type of the second bdev_op_is_zoned_write() argument
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 001/591] drm: use mgr->dev in drm_dbg_kms in drm_dp_add_payload_part2 Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 002/591] fs: pipe: reveal missing function protoypes Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 004/591] erofs: clean up cached I/O strategies Greg Kroah-Hartman
` (591 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn, Pankaj Raghav,
Christoph Hellwig, Damien Le Moal, Hannes Reinecke, Ming Lei,
Bart Van Assche, Jens Axboe, Sasha Levin
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit 3ddbe2a7e0d4a155a805f69c906c9beed30d4cc4 ]
Change the type of the second argument of bdev_op_is_zoned_write() from
blk_opf_t into enum req_op because this function expects an operation
without flags as second argument.
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Pankaj Raghav <p.raghav@samsung.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Cc: Ming Lei <ming.lei@redhat.com>
Fixes: 8cafdb5ab94c ("block: adapt blk_mq_plug() to not plug for writes that require a zone lock")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20230517174230.897144-4-bvanassche@acm.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/blkdev.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 891f8cbcd0436..427e79ac72194 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1305,7 +1305,7 @@ static inline bool bdev_is_zoned(struct block_device *bdev)
}
static inline bool bdev_op_is_zoned_write(struct block_device *bdev,
- blk_opf_t op)
+ enum req_op op)
{
if (!bdev_is_zoned(bdev))
return false;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 004/591] erofs: clean up cached I/O strategies
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 003/591] block: Fix the type of the second bdev_op_is_zoned_write() argument Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 005/591] erofs: avoid tagged pointers to mark sync decompression Greg Kroah-Hartman
` (590 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yue Hu, Chao Yu, Gao Xiang,
Sasha Levin
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit 1282dea37b09087b8aec59f0774572c16b52276a ]
After commit 4c7e42552b3a ("erofs: remove useless cache strategy of
DELAYEDALLOC"), only one cached I/O allocation strategy is supported:
When cached I/O is preferred, page allocation is applied without
direct reclaim. If allocation fails, fall back to inplace I/O.
Let's get rid of z_erofs_cache_alloctype. No logical changes.
Reviewed-by: Yue Hu <huyue2@coolpad.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Yue Hu <huyue2@coolpad.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20221206060352.152830-1-xiang@kernel.org
Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/zdata.c | 77 +++++++++++++++++++-----------------------------
1 file changed, 31 insertions(+), 46 deletions(-)
diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index cf4871834ebb2..ccf7c55d477fe 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -175,16 +175,6 @@ static void z_erofs_free_pcluster(struct z_erofs_pcluster *pcl)
DBG_BUGON(1);
}
-/* how to allocate cached pages for a pcluster */
-enum z_erofs_cache_alloctype {
- DONTALLOC, /* don't allocate any cached pages */
- /*
- * try to use cached I/O if page allocation succeeds or fallback
- * to in-place I/O instead to avoid any direct reclaim.
- */
- TRYALLOC,
-};
-
/*
* tagged pointer with 1-bit tag for all compressed pages
* tag 0 - the page is just found with an extra page reference
@@ -292,12 +282,29 @@ struct z_erofs_decompress_frontend {
.inode = __i, .owned_head = Z_EROFS_PCLUSTER_TAIL, \
.mode = Z_EROFS_PCLUSTER_FOLLOWED, .backmost = true }
+static bool z_erofs_should_alloc_cache(struct z_erofs_decompress_frontend *fe)
+{
+ unsigned int cachestrategy = EROFS_I_SB(fe->inode)->opt.cache_strategy;
+
+ if (cachestrategy <= EROFS_ZIP_CACHE_DISABLED)
+ return false;
+
+ if (fe->backmost)
+ return true;
+
+ if (cachestrategy >= EROFS_ZIP_CACHE_READAROUND &&
+ fe->map.m_la < fe->headoffset)
+ return true;
+
+ return false;
+}
+
static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe,
- enum z_erofs_cache_alloctype type,
struct page **pagepool)
{
struct address_space *mc = MNGD_MAPPING(EROFS_I_SB(fe->inode));
struct z_erofs_pcluster *pcl = fe->pcl;
+ bool shouldalloc = z_erofs_should_alloc_cache(fe);
bool standalone = true;
/*
* optimistic allocation without direct reclaim since inplace I/O
@@ -326,18 +333,19 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe,
} else {
/* I/O is needed, no possible to decompress directly */
standalone = false;
- switch (type) {
- case TRYALLOC:
- newpage = erofs_allocpage(pagepool, gfp);
- if (!newpage)
- continue;
- set_page_private(newpage,
- Z_EROFS_PREALLOCATED_PAGE);
- t = tag_compressed_page_justfound(newpage);
- break;
- default: /* DONTALLOC */
+ if (!shouldalloc)
continue;
- }
+
+ /*
+ * try to use cached I/O if page allocation
+ * succeeds or fallback to in-place I/O instead
+ * to avoid any direct reclaim.
+ */
+ newpage = erofs_allocpage(pagepool, gfp);
+ if (!newpage)
+ continue;
+ set_page_private(newpage, Z_EROFS_PREALLOCATED_PAGE);
+ t = tag_compressed_page_justfound(newpage);
}
if (!cmpxchg_relaxed(&pcl->compressed_bvecs[i].page, NULL,
@@ -638,20 +646,6 @@ static bool z_erofs_collector_end(struct z_erofs_decompress_frontend *fe)
return true;
}
-static bool should_alloc_managed_pages(struct z_erofs_decompress_frontend *fe,
- unsigned int cachestrategy,
- erofs_off_t la)
-{
- if (cachestrategy <= EROFS_ZIP_CACHE_DISABLED)
- return false;
-
- if (fe->backmost)
- return true;
-
- return cachestrategy >= EROFS_ZIP_CACHE_READAROUND &&
- la < fe->headoffset;
-}
-
static int z_erofs_read_fragment(struct inode *inode, erofs_off_t pos,
struct page *page, unsigned int pageofs,
unsigned int len)
@@ -688,12 +682,9 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
struct page *page, struct page **pagepool)
{
struct inode *const inode = fe->inode;
- struct erofs_sb_info *const sbi = EROFS_I_SB(inode);
struct erofs_map_blocks *const map = &fe->map;
const loff_t offset = page_offset(page);
bool tight = true, exclusive;
-
- enum z_erofs_cache_alloctype cache_strategy;
unsigned int cur, end, spiltted;
int err = 0;
@@ -747,13 +738,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
fe->mode = Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE;
} else {
/* bind cache first when cached decompression is preferred */
- if (should_alloc_managed_pages(fe, sbi->opt.cache_strategy,
- map->m_la))
- cache_strategy = TRYALLOC;
- else
- cache_strategy = DONTALLOC;
-
- z_erofs_bind_cache(fe, cache_strategy, pagepool);
+ z_erofs_bind_cache(fe, pagepool);
}
hitted:
/*
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 005/591] erofs: avoid tagged pointers to mark sync decompression
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 004/591] erofs: clean up cached I/O strategies Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 006/591] erofs: remove tagged pointer helpers Greg Kroah-Hartman
` (589 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yue Hu, Chao Yu, Gao Xiang,
Sasha Levin
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit cdba55067f2f9fdc7870ffcb6aef912d3468cff8 ]
We could just use a boolean in z_erofs_decompressqueue for sync
decompression to simplify the code.
Reviewed-by: Yue Hu <huyue2@coolpad.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20230204093040.97967-2-hsiangkao@linux.alibaba.com
Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/zdata.c | 42 ++++++++++++++++--------------------------
fs/erofs/zdata.h | 2 +-
2 files changed, 17 insertions(+), 27 deletions(-)
diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index ccf7c55d477fe..8e80871a8c1d7 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -1157,12 +1157,12 @@ static void z_erofs_decompressqueue_work(struct work_struct *work)
}
static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io,
- bool sync, int bios)
+ int bios)
{
struct erofs_sb_info *const sbi = EROFS_SB(io->sb);
/* wake up the caller thread for sync decompression */
- if (sync) {
+ if (io->sync) {
if (!atomic_add_return(bios, &io->pending_bios))
complete(&io->u.done);
return;
@@ -1294,9 +1294,8 @@ static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl,
return page;
}
-static struct z_erofs_decompressqueue *
-jobqueue_init(struct super_block *sb,
- struct z_erofs_decompressqueue *fgq, bool *fg)
+static struct z_erofs_decompressqueue *jobqueue_init(struct super_block *sb,
+ struct z_erofs_decompressqueue *fgq, bool *fg)
{
struct z_erofs_decompressqueue *q;
@@ -1313,6 +1312,7 @@ jobqueue_init(struct super_block *sb,
init_completion(&fgq->u.done);
atomic_set(&fgq->pending_bios, 0);
q->eio = false;
+ q->sync = true;
}
q->sb = sb;
q->head = Z_EROFS_PCLUSTER_TAIL_CLOSED;
@@ -1326,20 +1326,6 @@ enum {
NR_JOBQUEUES,
};
-static void *jobqueueset_init(struct super_block *sb,
- struct z_erofs_decompressqueue *q[],
- struct z_erofs_decompressqueue *fgq, bool *fg)
-{
- /*
- * if managed cache is enabled, bypass jobqueue is needed,
- * no need to read from device for all pclusters in this queue.
- */
- q[JQ_BYPASS] = jobqueue_init(sb, fgq + JQ_BYPASS, NULL);
- q[JQ_SUBMIT] = jobqueue_init(sb, fgq + JQ_SUBMIT, fg);
-
- return tagptr_cast_ptr(tagptr_fold(tagptr1_t, q[JQ_SUBMIT], *fg));
-}
-
static void move_to_bypass_jobqueue(struct z_erofs_pcluster *pcl,
z_erofs_next_pcluster_t qtail[],
z_erofs_next_pcluster_t owned_head)
@@ -1361,8 +1347,7 @@ static void move_to_bypass_jobqueue(struct z_erofs_pcluster *pcl,
static void z_erofs_decompressqueue_endio(struct bio *bio)
{
- tagptr1_t t = tagptr_init(tagptr1_t, bio->bi_private);
- struct z_erofs_decompressqueue *q = tagptr_unfold_ptr(t);
+ struct z_erofs_decompressqueue *q = bio->bi_private;
blk_status_t err = bio->bi_status;
struct bio_vec *bvec;
struct bvec_iter_all iter_all;
@@ -1381,7 +1366,7 @@ static void z_erofs_decompressqueue_endio(struct bio *bio)
}
if (err)
q->eio = true;
- z_erofs_decompress_kickoff(q, tagptr_unfold_tags(t), -1);
+ z_erofs_decompress_kickoff(q, -1);
bio_put(bio);
}
@@ -1394,7 +1379,6 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
struct address_space *mc = MNGD_MAPPING(EROFS_SB(sb));
z_erofs_next_pcluster_t qtail[NR_JOBQUEUES];
struct z_erofs_decompressqueue *q[NR_JOBQUEUES];
- void *bi_private;
z_erofs_next_pcluster_t owned_head = f->owned_head;
/* bio is NULL initially, so no need to initialize last_{index,bdev} */
pgoff_t last_index;
@@ -1404,7 +1388,13 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
unsigned long pflags;
int memstall = 0;
- bi_private = jobqueueset_init(sb, q, fgq, force_fg);
+ /*
+ * if managed cache is enabled, bypass jobqueue is needed,
+ * no need to read from device for all pclusters in this queue.
+ */
+ q[JQ_BYPASS] = jobqueue_init(sb, fgq + JQ_BYPASS, NULL);
+ q[JQ_SUBMIT] = jobqueue_init(sb, fgq + JQ_SUBMIT, force_fg);
+
qtail[JQ_BYPASS] = &q[JQ_BYPASS]->head;
qtail[JQ_SUBMIT] = &q[JQ_SUBMIT]->head;
@@ -1473,7 +1463,7 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
last_bdev = mdev.m_bdev;
bio->bi_iter.bi_sector = (sector_t)cur <<
LOG_SECTORS_PER_BLOCK;
- bio->bi_private = bi_private;
+ bio->bi_private = q[JQ_SUBMIT];
if (f->readahead)
bio->bi_opf |= REQ_RAHEAD;
++nr_bios;
@@ -1506,7 +1496,7 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
kvfree(q[JQ_SUBMIT]);
return;
}
- z_erofs_decompress_kickoff(q[JQ_SUBMIT], *force_fg, nr_bios);
+ z_erofs_decompress_kickoff(q[JQ_SUBMIT], nr_bios);
}
static void z_erofs_runqueue(struct z_erofs_decompress_frontend *f,
diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h
index d98c952129852..b139de5473a97 100644
--- a/fs/erofs/zdata.h
+++ b/fs/erofs/zdata.h
@@ -110,7 +110,7 @@ struct z_erofs_decompressqueue {
struct work_struct work;
} u;
- bool eio;
+ bool eio, sync;
};
static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 006/591] erofs: remove tagged pointer helpers
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 005/591] erofs: avoid tagged pointers to mark sync decompression Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 007/591] erofs: move zdata.h into zdata.c Greg Kroah-Hartman
` (588 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yue Hu, Chao Yu, Gao Xiang,
Sasha Levin
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit b1ed220c6262bff63cdcb53692e492be0b05206c ]
Just open-code the remaining one to simplify the code.
Reviewed-by: Yue Hu <huyue2@coolpad.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20230204093040.97967-3-hsiangkao@linux.alibaba.com
Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/tagptr.h | 107 ----------------------------------------------
fs/erofs/zdata.c | 26 +++--------
fs/erofs/zdata.h | 1 -
3 files changed, 6 insertions(+), 128 deletions(-)
delete mode 100644 fs/erofs/tagptr.h
diff --git a/fs/erofs/tagptr.h b/fs/erofs/tagptr.h
deleted file mode 100644
index 64ceb7270b5c1..0000000000000
--- a/fs/erofs/tagptr.h
+++ /dev/null
@@ -1,107 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
-/*
- * A tagged pointer implementation
- */
-#ifndef __EROFS_FS_TAGPTR_H
-#define __EROFS_FS_TAGPTR_H
-
-#include <linux/types.h>
-#include <linux/build_bug.h>
-
-/*
- * the name of tagged pointer types are tagptr{1, 2, 3...}_t
- * avoid directly using the internal structs __tagptr{1, 2, 3...}
- */
-#define __MAKE_TAGPTR(n) \
-typedef struct __tagptr##n { \
- uintptr_t v; \
-} tagptr##n##_t;
-
-__MAKE_TAGPTR(1)
-__MAKE_TAGPTR(2)
-__MAKE_TAGPTR(3)
-__MAKE_TAGPTR(4)
-
-#undef __MAKE_TAGPTR
-
-extern void __compiletime_error("bad tagptr tags")
- __bad_tagptr_tags(void);
-
-extern void __compiletime_error("bad tagptr type")
- __bad_tagptr_type(void);
-
-/* fix the broken usage of "#define tagptr2_t tagptr3_t" by users */
-#define __tagptr_mask_1(ptr, n) \
- __builtin_types_compatible_p(typeof(ptr), struct __tagptr##n) ? \
- (1UL << (n)) - 1 :
-
-#define __tagptr_mask(ptr) (\
- __tagptr_mask_1(ptr, 1) ( \
- __tagptr_mask_1(ptr, 2) ( \
- __tagptr_mask_1(ptr, 3) ( \
- __tagptr_mask_1(ptr, 4) ( \
- __bad_tagptr_type(), 0)))))
-
-/* generate a tagged pointer from a raw value */
-#define tagptr_init(type, val) \
- ((typeof(type)){ .v = (uintptr_t)(val) })
-
-/*
- * directly cast a tagged pointer to the native pointer type, which
- * could be used for backward compatibility of existing code.
- */
-#define tagptr_cast_ptr(tptr) ((void *)(tptr).v)
-
-/* encode tagged pointers */
-#define tagptr_fold(type, ptr, _tags) ({ \
- const typeof(_tags) tags = (_tags); \
- if (__builtin_constant_p(tags) && (tags & ~__tagptr_mask(type))) \
- __bad_tagptr_tags(); \
-tagptr_init(type, (uintptr_t)(ptr) | tags); })
-
-/* decode tagged pointers */
-#define tagptr_unfold_ptr(tptr) \
- ((void *)((tptr).v & ~__tagptr_mask(tptr)))
-
-#define tagptr_unfold_tags(tptr) \
- ((tptr).v & __tagptr_mask(tptr))
-
-/* operations for the tagger pointer */
-#define tagptr_eq(_tptr1, _tptr2) ({ \
- typeof(_tptr1) tptr1 = (_tptr1); \
- typeof(_tptr2) tptr2 = (_tptr2); \
- (void)(&tptr1 == &tptr2); \
-(tptr1).v == (tptr2).v; })
-
-/* lock-free CAS operation */
-#define tagptr_cmpxchg(_ptptr, _o, _n) ({ \
- typeof(_ptptr) ptptr = (_ptptr); \
- typeof(_o) o = (_o); \
- typeof(_n) n = (_n); \
- (void)(&o == &n); \
- (void)(&o == ptptr); \
-tagptr_init(o, cmpxchg(&ptptr->v, o.v, n.v)); })
-
-/* wrap WRITE_ONCE if atomic update is needed */
-#define tagptr_replace_tags(_ptptr, tags) ({ \
- typeof(_ptptr) ptptr = (_ptptr); \
- *ptptr = tagptr_fold(*ptptr, tagptr_unfold_ptr(*ptptr), tags); \
-*ptptr; })
-
-#define tagptr_set_tags(_ptptr, _tags) ({ \
- typeof(_ptptr) ptptr = (_ptptr); \
- const typeof(_tags) tags = (_tags); \
- if (__builtin_constant_p(tags) && (tags & ~__tagptr_mask(*ptptr))) \
- __bad_tagptr_tags(); \
- ptptr->v |= tags; \
-*ptptr; })
-
-#define tagptr_clear_tags(_ptptr, _tags) ({ \
- typeof(_ptptr) ptptr = (_ptptr); \
- const typeof(_tags) tags = (_tags); \
- if (__builtin_constant_p(tags) && (tags & ~__tagptr_mask(*ptptr))) \
- __bad_tagptr_tags(); \
- ptptr->v &= ~tags; \
-*ptptr; })
-
-#endif /* __EROFS_FS_TAGPTR_H */
diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index 8e80871a8c1d7..3b5f73224c22a 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -175,15 +175,6 @@ static void z_erofs_free_pcluster(struct z_erofs_pcluster *pcl)
DBG_BUGON(1);
}
-/*
- * tagged pointer with 1-bit tag for all compressed pages
- * tag 0 - the page is just found with an extra page reference
- */
-typedef tagptr1_t compressed_page_t;
-
-#define tag_compressed_page_justfound(page) \
- tagptr_fold(compressed_page_t, page, 1)
-
static struct workqueue_struct *z_erofs_workqueue __read_mostly;
void z_erofs_exit_zip_subsystem(void)
@@ -319,7 +310,7 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe,
for (i = 0; i < pcl->pclusterpages; ++i) {
struct page *page;
- compressed_page_t t;
+ void *t; /* mark pages just found for debugging */
struct page *newpage = NULL;
/* the compressed page was loaded before */
@@ -329,7 +320,7 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe,
page = find_get_page(mc, pcl->obj.index + i);
if (page) {
- t = tag_compressed_page_justfound(page);
+ t = (void *)((unsigned long)page | 1);
} else {
/* I/O is needed, no possible to decompress directly */
standalone = false;
@@ -345,11 +336,10 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe,
if (!newpage)
continue;
set_page_private(newpage, Z_EROFS_PREALLOCATED_PAGE);
- t = tag_compressed_page_justfound(newpage);
+ t = (void *)((unsigned long)newpage | 1);
}
- if (!cmpxchg_relaxed(&pcl->compressed_bvecs[i].page, NULL,
- tagptr_cast_ptr(t)))
+ if (!cmpxchg_relaxed(&pcl->compressed_bvecs[i].page, NULL, t))
continue;
if (page)
@@ -1192,8 +1182,6 @@ static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl,
struct address_space *mapping;
struct page *oldpage, *page;
-
- compressed_page_t t;
int justfound;
repeat:
@@ -1203,10 +1191,8 @@ static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl,
if (!page)
goto out_allocpage;
- /* process the target tagged pointer */
- t = tagptr_init(compressed_page_t, page);
- justfound = tagptr_unfold_tags(t);
- page = tagptr_unfold_ptr(t);
+ justfound = (unsigned long)page & 1UL;
+ page = (struct page *)((unsigned long)page & ~1UL);
/*
* preallocated cached pages, which is used to avoid direct reclaim
diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h
index b139de5473a97..f196a729c7e85 100644
--- a/fs/erofs/zdata.h
+++ b/fs/erofs/zdata.h
@@ -7,7 +7,6 @@
#define __EROFS_FS_ZDATA_H
#include "internal.h"
-#include "tagptr.h"
#define Z_EROFS_PCLUSTER_MAX_PAGES (Z_EROFS_PCLUSTER_MAX_SIZE / PAGE_SIZE)
#define Z_EROFS_INLINE_BVECS 2
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 007/591] erofs: move zdata.h into zdata.c
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 006/591] erofs: remove tagged pointer helpers Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 008/591] erofs: kill hooked chains to avoid loops on deduplicated compressed images Greg Kroah-Hartman
` (587 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yue Hu, Chao Yu, Gao Xiang,
Sasha Levin
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit a9a94d9373349e1a53f149d2015eb6f03a8517cf ]
Definitions in zdata.h are only used in zdata.c and for internal
use only. No logic changes.
Reviewed-by: Yue Hu <huyue2@coolpad.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20230204093040.97967-4-hsiangkao@linux.alibaba.com
Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/zdata.c | 166 +++++++++++++++++++++++++++++++++++++++++++-
fs/erofs/zdata.h | 177 -----------------------------------------------
2 files changed, 165 insertions(+), 178 deletions(-)
delete mode 100644 fs/erofs/zdata.h
diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index 3b5f73224c22a..aaddb6781465e 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -4,13 +4,177 @@
* https://www.huawei.com/
* Copyright (C) 2022 Alibaba Cloud
*/
-#include "zdata.h"
#include "compress.h"
#include <linux/prefetch.h>
#include <linux/psi.h>
#include <trace/events/erofs.h>
+#define Z_EROFS_PCLUSTER_MAX_PAGES (Z_EROFS_PCLUSTER_MAX_SIZE / PAGE_SIZE)
+#define Z_EROFS_INLINE_BVECS 2
+
+/*
+ * let's leave a type here in case of introducing
+ * another tagged pointer later.
+ */
+typedef void *z_erofs_next_pcluster_t;
+
+struct z_erofs_bvec {
+ struct page *page;
+ int offset;
+ unsigned int end;
+};
+
+#define __Z_EROFS_BVSET(name, total) \
+struct name { \
+ /* point to the next page which contains the following bvecs */ \
+ struct page *nextpage; \
+ struct z_erofs_bvec bvec[total]; \
+}
+__Z_EROFS_BVSET(z_erofs_bvset,);
+__Z_EROFS_BVSET(z_erofs_bvset_inline, Z_EROFS_INLINE_BVECS);
+
+/*
+ * Structure fields follow one of the following exclusion rules.
+ *
+ * I: Modifiable by initialization/destruction paths and read-only
+ * for everyone else;
+ *
+ * L: Field should be protected by the pcluster lock;
+ *
+ * A: Field should be accessed / updated in atomic for parallelized code.
+ */
+struct z_erofs_pcluster {
+ struct erofs_workgroup obj;
+ struct mutex lock;
+
+ /* A: point to next chained pcluster or TAILs */
+ z_erofs_next_pcluster_t next;
+
+ /* L: the maximum decompression size of this round */
+ unsigned int length;
+
+ /* L: total number of bvecs */
+ unsigned int vcnt;
+
+ /* I: page offset of start position of decompression */
+ unsigned short pageofs_out;
+
+ /* I: page offset of inline compressed data */
+ unsigned short pageofs_in;
+
+ union {
+ /* L: inline a certain number of bvec for bootstrap */
+ struct z_erofs_bvset_inline bvset;
+
+ /* I: can be used to free the pcluster by RCU. */
+ struct rcu_head rcu;
+ };
+
+ union {
+ /* I: physical cluster size in pages */
+ unsigned short pclusterpages;
+
+ /* I: tailpacking inline compressed size */
+ unsigned short tailpacking_size;
+ };
+
+ /* I: compression algorithm format */
+ unsigned char algorithmformat;
+
+ /* L: whether partial decompression or not */
+ bool partial;
+
+ /* L: indicate several pageofs_outs or not */
+ bool multibases;
+
+ /* A: compressed bvecs (can be cached or inplaced pages) */
+ struct z_erofs_bvec compressed_bvecs[];
+};
+
+/* let's avoid the valid 32-bit kernel addresses */
+
+/* the chained workgroup has't submitted io (still open) */
+#define Z_EROFS_PCLUSTER_TAIL ((void *)0x5F0ECAFE)
+/* the chained workgroup has already submitted io */
+#define Z_EROFS_PCLUSTER_TAIL_CLOSED ((void *)0x5F0EDEAD)
+
+#define Z_EROFS_PCLUSTER_NIL (NULL)
+
+struct z_erofs_decompressqueue {
+ struct super_block *sb;
+ atomic_t pending_bios;
+ z_erofs_next_pcluster_t head;
+
+ union {
+ struct completion done;
+ struct work_struct work;
+ } u;
+ bool eio, sync;
+};
+
+static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl)
+{
+ return !pcl->obj.index;
+}
+
+static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *pcl)
+{
+ if (z_erofs_is_inline_pcluster(pcl))
+ return 1;
+ return pcl->pclusterpages;
+}
+
+/*
+ * bit 30: I/O error occurred on this page
+ * bit 0 - 29: remaining parts to complete this page
+ */
+#define Z_EROFS_PAGE_EIO (1 << 30)
+
+static inline void z_erofs_onlinepage_init(struct page *page)
+{
+ union {
+ atomic_t o;
+ unsigned long v;
+ } u = { .o = ATOMIC_INIT(1) };
+
+ set_page_private(page, u.v);
+ smp_wmb();
+ SetPagePrivate(page);
+}
+
+static inline void z_erofs_onlinepage_split(struct page *page)
+{
+ atomic_inc((atomic_t *)&page->private);
+}
+
+static inline void z_erofs_page_mark_eio(struct page *page)
+{
+ int orig;
+
+ do {
+ orig = atomic_read((atomic_t *)&page->private);
+ } while (atomic_cmpxchg((atomic_t *)&page->private, orig,
+ orig | Z_EROFS_PAGE_EIO) != orig);
+}
+
+static inline void z_erofs_onlinepage_endio(struct page *page)
+{
+ unsigned int v;
+
+ DBG_BUGON(!PagePrivate(page));
+ v = atomic_dec_return((atomic_t *)&page->private);
+ if (!(v & ~Z_EROFS_PAGE_EIO)) {
+ set_page_private(page, 0);
+ ClearPagePrivate(page);
+ if (!(v & Z_EROFS_PAGE_EIO))
+ SetPageUptodate(page);
+ unlock_page(page);
+ }
+}
+
+#define Z_EROFS_ONSTACK_PAGES 32
+
/*
* since pclustersize is variable for big pcluster feature, introduce slab
* pools implementation for different pcluster sizes.
diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h
deleted file mode 100644
index f196a729c7e85..0000000000000
--- a/fs/erofs/zdata.h
+++ /dev/null
@@ -1,177 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
-/*
- * Copyright (C) 2018 HUAWEI, Inc.
- * https://www.huawei.com/
- */
-#ifndef __EROFS_FS_ZDATA_H
-#define __EROFS_FS_ZDATA_H
-
-#include "internal.h"
-
-#define Z_EROFS_PCLUSTER_MAX_PAGES (Z_EROFS_PCLUSTER_MAX_SIZE / PAGE_SIZE)
-#define Z_EROFS_INLINE_BVECS 2
-
-/*
- * let's leave a type here in case of introducing
- * another tagged pointer later.
- */
-typedef void *z_erofs_next_pcluster_t;
-
-struct z_erofs_bvec {
- struct page *page;
- int offset;
- unsigned int end;
-};
-
-#define __Z_EROFS_BVSET(name, total) \
-struct name { \
- /* point to the next page which contains the following bvecs */ \
- struct page *nextpage; \
- struct z_erofs_bvec bvec[total]; \
-}
-__Z_EROFS_BVSET(z_erofs_bvset,);
-__Z_EROFS_BVSET(z_erofs_bvset_inline, Z_EROFS_INLINE_BVECS);
-
-/*
- * Structure fields follow one of the following exclusion rules.
- *
- * I: Modifiable by initialization/destruction paths and read-only
- * for everyone else;
- *
- * L: Field should be protected by the pcluster lock;
- *
- * A: Field should be accessed / updated in atomic for parallelized code.
- */
-struct z_erofs_pcluster {
- struct erofs_workgroup obj;
- struct mutex lock;
-
- /* A: point to next chained pcluster or TAILs */
- z_erofs_next_pcluster_t next;
-
- /* L: the maximum decompression size of this round */
- unsigned int length;
-
- /* L: total number of bvecs */
- unsigned int vcnt;
-
- /* I: page offset of start position of decompression */
- unsigned short pageofs_out;
-
- /* I: page offset of inline compressed data */
- unsigned short pageofs_in;
-
- union {
- /* L: inline a certain number of bvec for bootstrap */
- struct z_erofs_bvset_inline bvset;
-
- /* I: can be used to free the pcluster by RCU. */
- struct rcu_head rcu;
- };
-
- union {
- /* I: physical cluster size in pages */
- unsigned short pclusterpages;
-
- /* I: tailpacking inline compressed size */
- unsigned short tailpacking_size;
- };
-
- /* I: compression algorithm format */
- unsigned char algorithmformat;
-
- /* L: whether partial decompression or not */
- bool partial;
-
- /* L: indicate several pageofs_outs or not */
- bool multibases;
-
- /* A: compressed bvecs (can be cached or inplaced pages) */
- struct z_erofs_bvec compressed_bvecs[];
-};
-
-/* let's avoid the valid 32-bit kernel addresses */
-
-/* the chained workgroup has't submitted io (still open) */
-#define Z_EROFS_PCLUSTER_TAIL ((void *)0x5F0ECAFE)
-/* the chained workgroup has already submitted io */
-#define Z_EROFS_PCLUSTER_TAIL_CLOSED ((void *)0x5F0EDEAD)
-
-#define Z_EROFS_PCLUSTER_NIL (NULL)
-
-struct z_erofs_decompressqueue {
- struct super_block *sb;
- atomic_t pending_bios;
- z_erofs_next_pcluster_t head;
-
- union {
- struct completion done;
- struct work_struct work;
- } u;
-
- bool eio, sync;
-};
-
-static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl)
-{
- return !pcl->obj.index;
-}
-
-static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *pcl)
-{
- if (z_erofs_is_inline_pcluster(pcl))
- return 1;
- return pcl->pclusterpages;
-}
-
-/*
- * bit 30: I/O error occurred on this page
- * bit 0 - 29: remaining parts to complete this page
- */
-#define Z_EROFS_PAGE_EIO (1 << 30)
-
-static inline void z_erofs_onlinepage_init(struct page *page)
-{
- union {
- atomic_t o;
- unsigned long v;
- } u = { .o = ATOMIC_INIT(1) };
-
- set_page_private(page, u.v);
- smp_wmb();
- SetPagePrivate(page);
-}
-
-static inline void z_erofs_onlinepage_split(struct page *page)
-{
- atomic_inc((atomic_t *)&page->private);
-}
-
-static inline void z_erofs_page_mark_eio(struct page *page)
-{
- int orig;
-
- do {
- orig = atomic_read((atomic_t *)&page->private);
- } while (atomic_cmpxchg((atomic_t *)&page->private, orig,
- orig | Z_EROFS_PAGE_EIO) != orig);
-}
-
-static inline void z_erofs_onlinepage_endio(struct page *page)
-{
- unsigned int v;
-
- DBG_BUGON(!PagePrivate(page));
- v = atomic_dec_return((atomic_t *)&page->private);
- if (!(v & ~Z_EROFS_PAGE_EIO)) {
- set_page_private(page, 0);
- ClearPagePrivate(page);
- if (!(v & Z_EROFS_PAGE_EIO))
- SetPageUptodate(page);
- unlock_page(page);
- }
-}
-
-#define Z_EROFS_ONSTACK_PAGES 32
-
-#endif
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 008/591] erofs: kill hooked chains to avoid loops on deduplicated compressed images
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 007/591] erofs: move zdata.h into zdata.c Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 009/591] x86/resctrl: Only show tasks pid in current pid namespace Greg Kroah-Hartman
` (586 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gao Xiang, Yue Hu, Sasha Levin
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit 967c28b23f6c89bb8eef6a046ea88afe0d7c1029 ]
After heavily stressing EROFS with several images which include a
hand-crafted image of repeated patterns for more than 46 days, I found
two chains could be linked with each other almost simultaneously and
form a loop so that the entire loop won't be submitted. As a
consequence, the corresponding file pages will remain locked forever.
It can be _only_ observed on data-deduplicated compressed images.
For example, consider two chains with five pclusters in total:
Chain 1: 2->3->4->5 -- The tail pcluster is 5;
Chain 2: 5->1->2 -- The tail pcluster is 2.
Chain 2 could link to Chain 1 with pcluster 5; and Chain 1 could link
to Chain 2 at the same time with pcluster 2.
Since hooked chains are all linked locklessly now, I have no idea how
to simply avoid the race. Instead, let's avoid hooked chains completely
until I could work out a proper way to fix this and end users finally
tell us that it's needed to add it back.
Actually, this optimization can be found with multi-threaded workloads
(especially even more often on deduplicated compressed images), yet I'm
not sure about the overall system impacts of not having this compared
with implementation complexity.
Fixes: 267f2492c8f7 ("erofs: introduce multi-reference pclusters (fully-referenced)")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Reviewed-by: Yue Hu <huyue2@coolpad.com>
Link: https://lore.kernel.org/r/20230526201459.128169-4-hsiangkao@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/zdata.c | 72 ++++++++----------------------------------------
1 file changed, 11 insertions(+), 61 deletions(-)
diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index aaddb6781465e..92b2e4ddb7ce9 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -94,11 +94,8 @@ struct z_erofs_pcluster {
/* let's avoid the valid 32-bit kernel addresses */
-/* the chained workgroup has't submitted io (still open) */
+/* the end of a chain of pclusters */
#define Z_EROFS_PCLUSTER_TAIL ((void *)0x5F0ECAFE)
-/* the chained workgroup has already submitted io */
-#define Z_EROFS_PCLUSTER_TAIL_CLOSED ((void *)0x5F0EDEAD)
-
#define Z_EROFS_PCLUSTER_NIL (NULL)
struct z_erofs_decompressqueue {
@@ -375,20 +372,6 @@ int __init z_erofs_init_zip_subsystem(void)
enum z_erofs_pclustermode {
Z_EROFS_PCLUSTER_INFLIGHT,
- /*
- * The current pclusters was the tail of an exist chain, in addition
- * that the previous processed chained pclusters are all decided to
- * be hooked up to it.
- * A new chain will be created for the remaining pclusters which are
- * not processed yet, so different from Z_EROFS_PCLUSTER_FOLLOWED,
- * the next pcluster cannot reuse the whole page safely for inplace I/O
- * in the following scenario:
- * ________________________________________________________________
- * | tail (partial) page | head (partial) page |
- * | (belongs to the next pcl) | (belongs to the current pcl) |
- * |_______PCLUSTER_FOLLOWED______|________PCLUSTER_HOOKED__________|
- */
- Z_EROFS_PCLUSTER_HOOKED,
/*
* a weak form of Z_EROFS_PCLUSTER_FOLLOWED, the difference is that it
* could be dispatched into bypass queue later due to uptodated managed
@@ -406,8 +389,8 @@ enum z_erofs_pclustermode {
* ________________________________________________________________
* | tail (partial) page | head (partial) page |
* | (of the current cl) | (of the previous collection) |
- * | PCLUSTER_FOLLOWED or | |
- * |_____PCLUSTER_HOOKED__|___________PCLUSTER_FOLLOWED____________|
+ * | | |
+ * |__PCLUSTER_FOLLOWED___|___________PCLUSTER_FOLLOWED____________|
*
* [ (*) the above page can be used as inplace I/O. ]
*/
@@ -420,7 +403,7 @@ struct z_erofs_decompress_frontend {
struct z_erofs_bvec_iter biter;
struct page *candidate_bvpage;
- struct z_erofs_pcluster *pcl, *tailpcl;
+ struct z_erofs_pcluster *pcl;
z_erofs_next_pcluster_t owned_head;
enum z_erofs_pclustermode mode;
@@ -626,19 +609,7 @@ static void z_erofs_try_to_claim_pcluster(struct z_erofs_decompress_frontend *f)
return;
}
- /*
- * type 2, link to the end of an existing open chain, be careful
- * that its submission is controlled by the original attached chain.
- */
- if (*owned_head != &pcl->next && pcl != f->tailpcl &&
- cmpxchg(&pcl->next, Z_EROFS_PCLUSTER_TAIL,
- *owned_head) == Z_EROFS_PCLUSTER_TAIL) {
- *owned_head = Z_EROFS_PCLUSTER_TAIL;
- f->mode = Z_EROFS_PCLUSTER_HOOKED;
- f->tailpcl = NULL;
- return;
- }
- /* type 3, it belongs to a chain, but it isn't the end of the chain */
+ /* type 2, it belongs to an ongoing chain */
f->mode = Z_EROFS_PCLUSTER_INFLIGHT;
}
@@ -699,9 +670,6 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)
goto err_out;
}
}
- /* used to check tail merging loop due to corrupted images */
- if (fe->owned_head == Z_EROFS_PCLUSTER_TAIL)
- fe->tailpcl = pcl;
fe->owned_head = &pcl->next;
fe->pcl = pcl;
return 0;
@@ -722,7 +690,6 @@ static int z_erofs_collector_begin(struct z_erofs_decompress_frontend *fe)
/* must be Z_EROFS_PCLUSTER_TAIL or pointed to previous pcluster */
DBG_BUGON(fe->owned_head == Z_EROFS_PCLUSTER_NIL);
- DBG_BUGON(fe->owned_head == Z_EROFS_PCLUSTER_TAIL_CLOSED);
if (!(map->m_flags & EROFS_MAP_META)) {
grp = erofs_find_workgroup(fe->inode->i_sb,
@@ -741,10 +708,6 @@ static int z_erofs_collector_begin(struct z_erofs_decompress_frontend *fe)
if (ret == -EEXIST) {
mutex_lock(&fe->pcl->lock);
- /* used to check tail merging loop due to corrupted images */
- if (fe->owned_head == Z_EROFS_PCLUSTER_TAIL)
- fe->tailpcl = fe->pcl;
-
z_erofs_try_to_claim_pcluster(fe);
} else if (ret) {
return ret;
@@ -901,8 +864,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
* those chains are handled asynchronously thus the page cannot be used
* for inplace I/O or bvpage (should be processed in a strict order.)
*/
- tight &= (fe->mode >= Z_EROFS_PCLUSTER_HOOKED &&
- fe->mode != Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE);
+ tight &= (fe->mode > Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE);
cur = end - min_t(unsigned int, offset + end - map->m_la, end);
if (!(map->m_flags & EROFS_MAP_MAPPED)) {
@@ -1283,10 +1245,7 @@ static void z_erofs_decompress_queue(const struct z_erofs_decompressqueue *io,
};
z_erofs_next_pcluster_t owned = io->head;
- while (owned != Z_EROFS_PCLUSTER_TAIL_CLOSED) {
- /* impossible that 'owned' equals Z_EROFS_WORK_TPTR_TAIL */
- DBG_BUGON(owned == Z_EROFS_PCLUSTER_TAIL);
- /* impossible that 'owned' equals Z_EROFS_PCLUSTER_NIL */
+ while (owned != Z_EROFS_PCLUSTER_TAIL) {
DBG_BUGON(owned == Z_EROFS_PCLUSTER_NIL);
be.pcl = container_of(owned, struct z_erofs_pcluster, next);
@@ -1303,7 +1262,7 @@ static void z_erofs_decompressqueue_work(struct work_struct *work)
container_of(work, struct z_erofs_decompressqueue, u.work);
struct page *pagepool = NULL;
- DBG_BUGON(bgq->head == Z_EROFS_PCLUSTER_TAIL_CLOSED);
+ DBG_BUGON(bgq->head == Z_EROFS_PCLUSTER_TAIL);
z_erofs_decompress_queue(bgq, &pagepool);
erofs_release_pages(&pagepool);
@@ -1465,7 +1424,7 @@ static struct z_erofs_decompressqueue *jobqueue_init(struct super_block *sb,
q->sync = true;
}
q->sb = sb;
- q->head = Z_EROFS_PCLUSTER_TAIL_CLOSED;
+ q->head = Z_EROFS_PCLUSTER_TAIL;
return q;
}
@@ -1483,11 +1442,7 @@ static void move_to_bypass_jobqueue(struct z_erofs_pcluster *pcl,
z_erofs_next_pcluster_t *const submit_qtail = qtail[JQ_SUBMIT];
z_erofs_next_pcluster_t *const bypass_qtail = qtail[JQ_BYPASS];
- DBG_BUGON(owned_head == Z_EROFS_PCLUSTER_TAIL_CLOSED);
- if (owned_head == Z_EROFS_PCLUSTER_TAIL)
- owned_head = Z_EROFS_PCLUSTER_TAIL_CLOSED;
-
- WRITE_ONCE(pcl->next, Z_EROFS_PCLUSTER_TAIL_CLOSED);
+ WRITE_ONCE(pcl->next, Z_EROFS_PCLUSTER_TAIL);
WRITE_ONCE(*submit_qtail, owned_head);
WRITE_ONCE(*bypass_qtail, &pcl->next);
@@ -1558,15 +1513,10 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
unsigned int i = 0;
bool bypass = true;
- /* no possible 'owned_head' equals the following */
- DBG_BUGON(owned_head == Z_EROFS_PCLUSTER_TAIL_CLOSED);
DBG_BUGON(owned_head == Z_EROFS_PCLUSTER_NIL);
-
pcl = container_of(owned_head, struct z_erofs_pcluster, next);
+ owned_head = READ_ONCE(pcl->next);
- /* close the main owned chain at first */
- owned_head = cmpxchg(&pcl->next, Z_EROFS_PCLUSTER_TAIL,
- Z_EROFS_PCLUSTER_TAIL_CLOSED);
if (z_erofs_is_inline_pcluster(pcl)) {
move_to_bypass_jobqueue(pcl, qtail, owned_head);
continue;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 009/591] x86/resctrl: Only show tasks pid in current pid namespace
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 008/591] erofs: kill hooked chains to avoid loops on deduplicated compressed images Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 010/591] blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost Greg Kroah-Hartman
` (585 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shawn Wang, Borislav Petkov (AMD),
Reinette Chatre, Fenghua Yu, Sasha Levin
From: Shawn Wang <shawnwang@linux.alibaba.com>
[ Upstream commit 2997d94b5dd0e8b10076f5e0b6f18410c73e28bd ]
When writing a task id to the "tasks" file in an rdtgroup,
rdtgroup_tasks_write() treats the pid as a number in the current pid
namespace. But when reading the "tasks" file, rdtgroup_tasks_show() shows
the list of global pids from the init namespace, which is confusing and
incorrect.
To be more robust, let the "tasks" file only show pids in the current pid
namespace.
Fixes: e02737d5b826 ("x86/intel_rdt: Add tasks files")
Signed-off-by: Shawn Wang <shawnwang@linux.alibaba.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Reinette Chatre <reinette.chatre@intel.com>
Acked-by: Fenghua Yu <fenghua.yu@intel.com>
Tested-by: Reinette Chatre <reinette.chatre@intel.com>
Link: https://lore.kernel.org/all/20230116071246.97717-1-shawnwang@linux.alibaba.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/cpu/resctrl/rdtgroup.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
index c7f1c7cb1963b..15ee89ce8c68c 100644
--- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c
+++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
@@ -731,11 +731,15 @@ static ssize_t rdtgroup_tasks_write(struct kernfs_open_file *of,
static void show_rdt_tasks(struct rdtgroup *r, struct seq_file *s)
{
struct task_struct *p, *t;
+ pid_t pid;
rcu_read_lock();
for_each_process_thread(p, t) {
- if (is_closid_match(t, r) || is_rmid_match(t, r))
- seq_printf(s, "%d\n", t->pid);
+ if (is_closid_match(t, r) || is_rmid_match(t, r)) {
+ pid = task_pid_vnr(t);
+ if (pid)
+ seq_printf(s, "%d\n", pid);
+ }
}
rcu_read_unlock();
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 010/591] blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 009/591] x86/resctrl: Only show tasks pid in current pid namespace Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 011/591] x86/sev: Fix calculation of end address based on number of pages Greg Kroah-Hartman
` (584 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Nan, Tejun Heo, Yu Kuai,
Jens Axboe, Sasha Levin
From: Li Nan <linan122@huawei.com>
[ Upstream commit 8d211554679d0b23702bd32ba04aeac0c1c4f660 ]
adjust_inuse_and_calc_cost() use spin_lock_irq() and IRQ will be enabled
when unlock. DEADLOCK might happen if we have held other locks and disabled
IRQ before invoking it.
Fix it by using spin_lock_irqsave() instead, which can keep IRQ state
consistent with before when unlock.
================================
WARNING: inconsistent lock state
5.10.0-02758-g8e5f91fd772f #26 Not tainted
--------------------------------
inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
kworker/2:3/388 [HC0[0]:SC0[0]:HE0:SE1] takes:
ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq
ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390
{IN-HARDIRQ-W} state was registered at:
__lock_acquire+0x3d7/0x1070
lock_acquire+0x197/0x4a0
__raw_spin_lock_irqsave
_raw_spin_lock_irqsave+0x3b/0x60
bfq_idle_slice_timer_body
bfq_idle_slice_timer+0x53/0x1d0
__run_hrtimer+0x477/0xa70
__hrtimer_run_queues+0x1c6/0x2d0
hrtimer_interrupt+0x302/0x9e0
local_apic_timer_interrupt
__sysvec_apic_timer_interrupt+0xfd/0x420
run_sysvec_on_irqstack_cond
sysvec_apic_timer_interrupt+0x46/0xa0
asm_sysvec_apic_timer_interrupt+0x12/0x20
irq event stamp: 837522
hardirqs last enabled at (837521): [<ffffffff84b9419d>] __raw_spin_unlock_irqrestore
hardirqs last enabled at (837521): [<ffffffff84b9419d>] _raw_spin_unlock_irqrestore+0x3d/0x40
hardirqs last disabled at (837522): [<ffffffff84b93fa3>] __raw_spin_lock_irq
hardirqs last disabled at (837522): [<ffffffff84b93fa3>] _raw_spin_lock_irq+0x43/0x50
softirqs last enabled at (835852): [<ffffffff84e00558>] __do_softirq+0x558/0x8ec
softirqs last disabled at (835845): [<ffffffff84c010ff>] asm_call_irq_on_stack+0xf/0x20
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&bfqd->lock);
<Interrupt>
lock(&bfqd->lock);
*** DEADLOCK ***
3 locks held by kworker/2:3/388:
#0: ffff888107af0f38 ((wq_completion)kthrotld){+.+.}-{0:0}, at: process_one_work+0x742/0x13f0
#1: ffff8881176bfdd8 ((work_completion)(&td->dispatch_work)){+.+.}-{0:0}, at: process_one_work+0x777/0x13f0
#2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq
#2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390
stack backtrace:
CPU: 2 PID: 388 Comm: kworker/2:3 Not tainted 5.10.0-02758-g8e5f91fd772f #26
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: kthrotld blk_throtl_dispatch_work_fn
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x107/0x167
print_usage_bug
valid_state
mark_lock_irq.cold+0x32/0x3a
mark_lock+0x693/0xbc0
mark_held_locks+0x9e/0xe0
__trace_hardirqs_on_caller
lockdep_hardirqs_on_prepare.part.0+0x151/0x360
trace_hardirqs_on+0x5b/0x180
__raw_spin_unlock_irq
_raw_spin_unlock_irq+0x24/0x40
spin_unlock_irq
adjust_inuse_and_calc_cost+0x4fb/0x970
ioc_rqos_merge+0x277/0x740
__rq_qos_merge+0x62/0xb0
rq_qos_merge
bio_attempt_back_merge+0x12c/0x4a0
blk_mq_sched_try_merge+0x1b6/0x4d0
bfq_bio_merge+0x24a/0x390
__blk_mq_sched_bio_merge+0xa6/0x460
blk_mq_sched_bio_merge
blk_mq_submit_bio+0x2e7/0x1ee0
__submit_bio_noacct_mq+0x175/0x3b0
submit_bio_noacct+0x1fb/0x270
blk_throtl_dispatch_work_fn+0x1ef/0x2b0
process_one_work+0x83e/0x13f0
process_scheduled_works
worker_thread+0x7e3/0xd80
kthread+0x353/0x470
ret_from_fork+0x1f/0x30
Fixes: b0853ab4a238 ("blk-iocost: revamp in-period donation snapbacks")
Signed-off-by: Li Nan <linan122@huawei.com>
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20230527091904.3001833-1-linan666@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-iocost.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index 00d59d2288f00..7dd6a33e1d6a8 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -2437,6 +2437,7 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime,
u32 hwi, adj_step;
s64 margin;
u64 cost, new_inuse;
+ unsigned long flags;
current_hweight(iocg, NULL, &hwi);
old_hwi = hwi;
@@ -2455,11 +2456,11 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime,
iocg->inuse == iocg->active)
return cost;
- spin_lock_irq(&ioc->lock);
+ spin_lock_irqsave(&ioc->lock, flags);
/* we own inuse only when @iocg is in the normal active state */
if (iocg->abs_vdebt || list_empty(&iocg->active_list)) {
- spin_unlock_irq(&ioc->lock);
+ spin_unlock_irqrestore(&ioc->lock, flags);
return cost;
}
@@ -2480,7 +2481,7 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime,
} while (time_after64(vtime + cost, now->vnow) &&
iocg->inuse != iocg->active);
- spin_unlock_irq(&ioc->lock);
+ spin_unlock_irqrestore(&ioc->lock, flags);
TRACE_IOCG_PATH(inuse_adjust, iocg, now,
old_inuse, iocg->inuse, old_hwi, hwi);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 011/591] x86/sev: Fix calculation of end address based on number of pages
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 010/591] blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 012/591] virt: sevguest: Add CONFIG_CRYPTO dependency Greg Kroah-Hartman
` (583 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Lendacky, Borislav Petkov (AMD),
Sasha Levin
From: Tom Lendacky <thomas.lendacky@amd.com>
[ Upstream commit 5dee19b6b2b194216919b99a1f5af2949a754016 ]
When calculating an end address based on an unsigned int number of pages,
any value greater than or equal to 0x100000 that is shift PAGE_SHIFT bits
results in a 0 value, resulting in an invalid end address. Change the
number of pages variable in various routines from an unsigned int to an
unsigned long to calculate the end address correctly.
Fixes: 5e5ccff60a29 ("x86/sev: Add helper for validating pages in early enc attribute changes")
Fixes: dc3f3d2474b8 ("x86/mm: Validate memory when changing the C-bit")
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/6a6e4eea0e1414402bac747744984fa4e9c01bb6.1686063086.git.thomas.lendacky@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/sev.h | 16 ++++++++--------
arch/x86/kernel/sev.c | 14 +++++++-------
2 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h
index ebc271bb6d8ed..a0a58c4122ec3 100644
--- a/arch/x86/include/asm/sev.h
+++ b/arch/x86/include/asm/sev.h
@@ -187,12 +187,12 @@ static inline int pvalidate(unsigned long vaddr, bool rmp_psize, bool validate)
}
void setup_ghcb(void);
void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr,
- unsigned int npages);
+ unsigned long npages);
void __init early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr,
- unsigned int npages);
+ unsigned long npages);
void __init snp_prep_memory(unsigned long paddr, unsigned int sz, enum psc_op op);
-void snp_set_memory_shared(unsigned long vaddr, unsigned int npages);
-void snp_set_memory_private(unsigned long vaddr, unsigned int npages);
+void snp_set_memory_shared(unsigned long vaddr, unsigned long npages);
+void snp_set_memory_private(unsigned long vaddr, unsigned long npages);
void snp_set_wakeup_secondary_cpu(void);
bool snp_init(struct boot_params *bp);
void __init __noreturn snp_abort(void);
@@ -207,12 +207,12 @@ static inline int pvalidate(unsigned long vaddr, bool rmp_psize, bool validate)
static inline int rmpadjust(unsigned long vaddr, bool rmp_psize, unsigned long attrs) { return 0; }
static inline void setup_ghcb(void) { }
static inline void __init
-early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr, unsigned int npages) { }
+early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr, unsigned long npages) { }
static inline void __init
-early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr, unsigned int npages) { }
+early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr, unsigned long npages) { }
static inline void __init snp_prep_memory(unsigned long paddr, unsigned int sz, enum psc_op op) { }
-static inline void snp_set_memory_shared(unsigned long vaddr, unsigned int npages) { }
-static inline void snp_set_memory_private(unsigned long vaddr, unsigned int npages) { }
+static inline void snp_set_memory_shared(unsigned long vaddr, unsigned long npages) { }
+static inline void snp_set_memory_private(unsigned long vaddr, unsigned long npages) { }
static inline void snp_set_wakeup_secondary_cpu(void) { }
static inline bool snp_init(struct boot_params *bp) { return false; }
static inline void snp_abort(void) { }
diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c
index c680ac6342bb3..afda719dd7253 100644
--- a/arch/x86/kernel/sev.c
+++ b/arch/x86/kernel/sev.c
@@ -643,7 +643,7 @@ static u64 __init get_jump_table_addr(void)
return ret;
}
-static void pvalidate_pages(unsigned long vaddr, unsigned int npages, bool validate)
+static void pvalidate_pages(unsigned long vaddr, unsigned long npages, bool validate)
{
unsigned long vaddr_end;
int rc;
@@ -660,7 +660,7 @@ static void pvalidate_pages(unsigned long vaddr, unsigned int npages, bool valid
}
}
-static void __init early_set_pages_state(unsigned long paddr, unsigned int npages, enum psc_op op)
+static void __init early_set_pages_state(unsigned long paddr, unsigned long npages, enum psc_op op)
{
unsigned long paddr_end;
u64 val;
@@ -699,7 +699,7 @@ static void __init early_set_pages_state(unsigned long paddr, unsigned int npage
}
void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr,
- unsigned int npages)
+ unsigned long npages)
{
/*
* This can be invoked in early boot while running identity mapped, so
@@ -721,7 +721,7 @@ void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long padd
}
void __init early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr,
- unsigned int npages)
+ unsigned long npages)
{
/*
* This can be invoked in early boot while running identity mapped, so
@@ -877,7 +877,7 @@ static void __set_pages_state(struct snp_psc_desc *data, unsigned long vaddr,
sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_PSC);
}
-static void set_pages_state(unsigned long vaddr, unsigned int npages, int op)
+static void set_pages_state(unsigned long vaddr, unsigned long npages, int op)
{
unsigned long vaddr_end, next_vaddr;
struct snp_psc_desc *desc;
@@ -902,7 +902,7 @@ static void set_pages_state(unsigned long vaddr, unsigned int npages, int op)
kfree(desc);
}
-void snp_set_memory_shared(unsigned long vaddr, unsigned int npages)
+void snp_set_memory_shared(unsigned long vaddr, unsigned long npages)
{
if (!cc_platform_has(CC_ATTR_GUEST_SEV_SNP))
return;
@@ -912,7 +912,7 @@ void snp_set_memory_shared(unsigned long vaddr, unsigned int npages)
set_pages_state(vaddr, npages, SNP_PAGE_STATE_SHARED);
}
-void snp_set_memory_private(unsigned long vaddr, unsigned int npages)
+void snp_set_memory_private(unsigned long vaddr, unsigned long npages)
{
if (!cc_platform_has(CC_ATTR_GUEST_SEV_SNP))
return;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 012/591] virt: sevguest: Add CONFIG_CRYPTO dependency
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 011/591] x86/sev: Fix calculation of end address based on number of pages Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 013/591] blk-mq: fix potential io hang by wrong wake_batch Greg Kroah-Hartman
` (582 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Borislav Petkov (AMD),
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 84b9b44b99780d35fe72ac63c4724f158771e898 ]
This driver fails to link when CRYPTO is disabled, or in a loadable
module:
WARNING: unmet direct dependencies detected for CRYPTO_GCM
WARNING: unmet direct dependencies detected for CRYPTO_AEAD2
Depends on [m]: CRYPTO [=m]
Selected by [y]:
- SEV_GUEST [=y] && VIRT_DRIVERS [=y] && AMD_MEM_ENCRYPT [=y]
x86_64-linux-ld: crypto/aead.o: in function `crypto_register_aeads':
Fixes: fce96cf04430 ("virt: Add SEV-SNP guest driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230117171416.2715125-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/virt/coco/sev-guest/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/virt/coco/sev-guest/Kconfig b/drivers/virt/coco/sev-guest/Kconfig
index f9db0799ae67c..da2d7ca531f0f 100644
--- a/drivers/virt/coco/sev-guest/Kconfig
+++ b/drivers/virt/coco/sev-guest/Kconfig
@@ -2,6 +2,7 @@ config SEV_GUEST
tristate "AMD SEV Guest driver"
default m
depends on AMD_MEM_ENCRYPT
+ select CRYPTO
select CRYPTO_AEAD2
select CRYPTO_GCM
help
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 013/591] blk-mq: fix potential io hang by wrong wake_batch
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 012/591] virt: sevguest: Add CONFIG_CRYPTO dependency Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 014/591] lockd: drop inappropriate svc_get() from locked_get() Greg Kroah-Hartman
` (581 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Jan Kara, Jens Axboe,
Sasha Levin
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 4f1731df60f9033669f024d06ae26a6301260b55 ]
In __blk_mq_tag_busy/idle(), updating 'active_queues' and calculating
'wake_batch' is not atomic:
t1: t2:
_blk_mq_tag_busy blk_mq_tag_busy
inc active_queues
// assume 1->2
inc active_queues
// 2 -> 3
blk_mq_update_wake_batch
// calculate based on 3
blk_mq_update_wake_batch
/* calculate based on 2, while active_queues is actually 3. */
Fix this problem by protecting them wih 'tags->lock', this is not a hot
path, so performance should not be concerned. And now that all writers
are inside the lock, switch 'actives_queues' from atomic to unsigned
int.
Fixes: 180dccb0dba4 ("blk-mq: fix tag_get wait task can't be awakened")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230610023043.2559121-1-yukuai1@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq-debugfs.c | 2 +-
block/blk-mq-tag.c | 15 ++++++++++-----
block/blk-mq.h | 3 +--
include/linux/blk-mq.h | 3 +--
4 files changed, 13 insertions(+), 10 deletions(-)
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index bd942341b6382..7675e663df365 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -427,7 +427,7 @@ static void blk_mq_debugfs_tags_show(struct seq_file *m,
seq_printf(m, "nr_tags=%u\n", tags->nr_tags);
seq_printf(m, "nr_reserved_tags=%u\n", tags->nr_reserved_tags);
seq_printf(m, "active_queues=%d\n",
- atomic_read(&tags->active_queues));
+ READ_ONCE(tags->active_queues));
seq_puts(m, "\nbitmap_tags:\n");
sbitmap_queue_show(&tags->bitmap_tags, m);
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index a80d7c62bdfe6..100889c276c3f 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -40,6 +40,7 @@ static void blk_mq_update_wake_batch(struct blk_mq_tags *tags,
void __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx)
{
unsigned int users;
+ struct blk_mq_tags *tags = hctx->tags;
/*
* calling test_bit() prior to test_and_set_bit() is intentional,
@@ -57,9 +58,11 @@ void __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx)
return;
}
- users = atomic_inc_return(&hctx->tags->active_queues);
-
- blk_mq_update_wake_batch(hctx->tags, users);
+ spin_lock_irq(&tags->lock);
+ users = tags->active_queues + 1;
+ WRITE_ONCE(tags->active_queues, users);
+ blk_mq_update_wake_batch(tags, users);
+ spin_unlock_irq(&tags->lock);
}
/*
@@ -92,9 +95,11 @@ void __blk_mq_tag_idle(struct blk_mq_hw_ctx *hctx)
return;
}
- users = atomic_dec_return(&tags->active_queues);
-
+ spin_lock_irq(&tags->lock);
+ users = tags->active_queues - 1;
+ WRITE_ONCE(tags->active_queues, users);
blk_mq_update_wake_batch(tags, users);
+ spin_unlock_irq(&tags->lock);
blk_mq_tag_wakeup_all(tags, false);
}
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 0b2870839cdd6..c6eca452ea2a2 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -362,8 +362,7 @@ static inline bool hctx_may_queue(struct blk_mq_hw_ctx *hctx,
return true;
}
- users = atomic_read(&hctx->tags->active_queues);
-
+ users = READ_ONCE(hctx->tags->active_queues);
if (!users)
return true;
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index a9764cbf7f8d2..e4f676e1042b5 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -745,8 +745,7 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
struct blk_mq_tags {
unsigned int nr_tags;
unsigned int nr_reserved_tags;
-
- atomic_t active_queues;
+ unsigned int active_queues;
struct sbitmap_queue bitmap_tags;
struct sbitmap_queue breserved_tags;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 014/591] lockd: drop inappropriate svc_get() from locked_get()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 013/591] blk-mq: fix potential io hang by wrong wake_batch Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 015/591] nvme-auth: rename __nvme_auth_[reset|free] to nvme_auth[reset|free]_dhchap Greg Kroah-Hartman
` (580 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, NeilBrown,
Ido Schimmel, Chuck Lever, Sasha Levin
From: NeilBrown <neilb@suse.de>
[ Upstream commit 665e89ab7c5af1f2d260834c861a74b01a30f95f ]
The below-mentioned patch was intended to simplify refcounting on the
svc_serv used by locked. The goal was to only ever have a single
reference from the single thread. To that end we dropped a call to
lockd_start_svc() (except when creating thread) which would take a
reference, and dropped the svc_put(serv) that would drop that reference.
Unfortunately we didn't also remove the svc_get() from
lockd_create_svc() in the case where the svc_serv already existed.
So after the patch:
- on the first call the svc_serv was allocated and the one reference
was given to the thread, so there are no extra references
- on subsequent calls svc_get() was called so there is now an extra
reference.
This is clearly not consistent.
The inconsistency is also clear in the current code in lockd_get()
takes *two* references, one on nlmsvc_serv and one by incrementing
nlmsvc_users. This clearly does not match lockd_put().
So: drop that svc_get() from lockd_get() (which used to be in
lockd_create_svc().
Reported-by: Ido Schimmel <idosch@idosch.org>
Closes: https://lore.kernel.org/linux-nfs/ZHsI%2FH16VX9kJQX1@shredder/T/#u
Fixes: b73a2972041b ("lockd: move lockd_start_svc() call into lockd_create_svc()")
Signed-off-by: NeilBrown <neilb@suse.de>
Tested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/lockd/svc.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index 59ef8a1f843f3..5579e67da17db 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -355,7 +355,6 @@ static int lockd_get(void)
int error;
if (nlmsvc_serv) {
- svc_get(nlmsvc_serv);
nlmsvc_users++;
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 015/591] nvme-auth: rename __nvme_auth_[reset|free] to nvme_auth[reset|free]_dhchap
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 014/591] lockd: drop inappropriate svc_get() from locked_get() Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 016/591] nvme-auth: rename authentication work elements Greg Kroah-Hartman
` (579 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sagi Grimberg, Chaitanya Kulkarni,
Hannes Reinecke, Christoph Hellwig, Sasha Levin
From: Sagi Grimberg <sagi@grimberg.me>
[ Upstream commit 0a7ce375f83f4ade7c2a835444093b6870fb8257 ]
nvme_auth_[reset|free] operate on the controller while
__nvme_auth_[reset|free] operate on a chap struct (which maps to a queue
context). Rename it for clarity.
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/auth.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index c8a6db7c44980..d45333268fcf6 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -654,7 +654,7 @@ static int nvme_auth_dhchap_exponential(struct nvme_ctrl *ctrl,
return 0;
}
-static void __nvme_auth_reset(struct nvme_dhchap_queue_context *chap)
+static void nvme_auth_reset_dhchap(struct nvme_dhchap_queue_context *chap)
{
kfree_sensitive(chap->host_response);
chap->host_response = NULL;
@@ -676,9 +676,9 @@ static void __nvme_auth_reset(struct nvme_dhchap_queue_context *chap)
memset(chap->c2, 0, sizeof(chap->c2));
}
-static void __nvme_auth_free(struct nvme_dhchap_queue_context *chap)
+static void nvme_auth_free_dhchap(struct nvme_dhchap_queue_context *chap)
{
- __nvme_auth_reset(chap);
+ nvme_auth_reset_dhchap(chap);
if (chap->shash_tfm)
crypto_free_shash(chap->shash_tfm);
if (chap->dh_tfm)
@@ -868,7 +868,7 @@ int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid)
dev_dbg(ctrl->device, "qid %d: re-using context\n", qid);
mutex_unlock(&ctrl->dhchap_auth_mutex);
flush_work(&chap->auth_work);
- __nvme_auth_reset(chap);
+ nvme_auth_reset_dhchap(chap);
queue_work(nvme_wq, &chap->auth_work);
return 0;
}
@@ -928,7 +928,7 @@ void nvme_auth_reset(struct nvme_ctrl *ctrl)
list_for_each_entry(chap, &ctrl->dhchap_auth_list, entry) {
mutex_unlock(&ctrl->dhchap_auth_mutex);
flush_work(&chap->auth_work);
- __nvme_auth_reset(chap);
+ nvme_auth_reset_dhchap(chap);
}
mutex_unlock(&ctrl->dhchap_auth_mutex);
}
@@ -1002,7 +1002,7 @@ void nvme_auth_free(struct nvme_ctrl *ctrl)
list_for_each_entry_safe(chap, tmp, &ctrl->dhchap_auth_list, entry) {
list_del_init(&chap->entry);
flush_work(&chap->auth_work);
- __nvme_auth_free(chap);
+ nvme_auth_free_dhchap(chap);
}
mutex_unlock(&ctrl->dhchap_auth_mutex);
if (ctrl->host_key) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 016/591] nvme-auth: rename authentication work elements
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 015/591] nvme-auth: rename __nvme_auth_[reset|free] to nvme_auth[reset|free]_dhchap Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 017/591] nvme-auth: remove symbol export from nvme_auth_reset Greg Kroah-Hartman
` (578 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sagi Grimberg, Chaitanya Kulkarni,
Hannes Reinecke, Christoph Hellwig, Sasha Levin
From: Sagi Grimberg <sagi@grimberg.me>
[ Upstream commit 0c999e69c40a87285f910c400b550fad866e99d0 ]
Use nvme_ctrl_auth_work and nvme_queue_auth_work for better
readability.
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/auth.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index d45333268fcf6..e3e801e2b78d5 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -691,7 +691,7 @@ static void nvme_auth_free_dhchap(struct nvme_dhchap_queue_context *chap)
kfree(chap);
}
-static void __nvme_auth_work(struct work_struct *work)
+static void nvme_queue_auth_work(struct work_struct *work)
{
struct nvme_dhchap_queue_context *chap =
container_of(work, struct nvme_dhchap_queue_context, auth_work);
@@ -893,7 +893,7 @@ int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid)
return -ENOMEM;
}
- INIT_WORK(&chap->auth_work, __nvme_auth_work);
+ INIT_WORK(&chap->auth_work, nvme_queue_auth_work);
list_add(&chap->entry, &ctrl->dhchap_auth_list);
mutex_unlock(&ctrl->dhchap_auth_mutex);
queue_work(nvme_wq, &chap->auth_work);
@@ -934,7 +934,7 @@ void nvme_auth_reset(struct nvme_ctrl *ctrl)
}
EXPORT_SYMBOL_GPL(nvme_auth_reset);
-static void nvme_dhchap_auth_work(struct work_struct *work)
+static void nvme_ctrl_auth_work(struct work_struct *work)
{
struct nvme_ctrl *ctrl =
container_of(work, struct nvme_ctrl, dhchap_auth_work);
@@ -973,7 +973,7 @@ static void nvme_dhchap_auth_work(struct work_struct *work)
void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
{
INIT_LIST_HEAD(&ctrl->dhchap_auth_list);
- INIT_WORK(&ctrl->dhchap_auth_work, nvme_dhchap_auth_work);
+ INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work);
mutex_init(&ctrl->dhchap_auth_mutex);
if (!ctrl->opts)
return;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 017/591] nvme-auth: remove symbol export from nvme_auth_reset
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 016/591] nvme-auth: rename authentication work elements Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 018/591] nvme-auth: no need to reset chap contexts on re-authentication Greg Kroah-Hartman
` (577 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Sagi Grimberg,
Chaitanya Kulkarni, Christoph Hellwig, Sasha Levin
From: Sagi Grimberg <sagi@grimberg.me>
[ Upstream commit 100b555bc204fc754108351676297805f5affa49 ]
Only the nvme module calls it.
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/auth.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index e3e801e2b78d5..2f823c6b84fd3 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -932,7 +932,6 @@ void nvme_auth_reset(struct nvme_ctrl *ctrl)
}
mutex_unlock(&ctrl->dhchap_auth_mutex);
}
-EXPORT_SYMBOL_GPL(nvme_auth_reset);
static void nvme_ctrl_auth_work(struct work_struct *work)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 018/591] nvme-auth: no need to reset chap contexts on re-authentication
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 017/591] nvme-auth: remove symbol export from nvme_auth_reset Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 019/591] nvme-core: fix memory leak in dhchap_secret_store Greg Kroah-Hartman
` (576 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Sagi Grimberg,
Chaitanya Kulkarni, Christoph Hellwig, Sasha Levin
From: Sagi Grimberg <sagi@grimberg.me>
[ Upstream commit e8a420efb637f52c586596283d6fd96f2a7ecb5c ]
Now that the chap context is reset upon completion, this is no longer
needed. Also remove nvme_auth_reset as no callers are left.
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/auth.c | 13 -------------
drivers/nvme/host/core.c | 4 ----
drivers/nvme/host/nvme.h | 1 -
3 files changed, 18 deletions(-)
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index 2f823c6b84fd3..1a27d7fb4fa91 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -920,19 +920,6 @@ int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid)
}
EXPORT_SYMBOL_GPL(nvme_auth_wait);
-void nvme_auth_reset(struct nvme_ctrl *ctrl)
-{
- struct nvme_dhchap_queue_context *chap;
-
- mutex_lock(&ctrl->dhchap_auth_mutex);
- list_for_each_entry(chap, &ctrl->dhchap_auth_list, entry) {
- mutex_unlock(&ctrl->dhchap_auth_mutex);
- flush_work(&chap->auth_work);
- nvme_auth_reset_dhchap(chap);
- }
- mutex_unlock(&ctrl->dhchap_auth_mutex);
-}
-
static void nvme_ctrl_auth_work(struct work_struct *work)
{
struct nvme_ctrl *ctrl =
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index a7d9b5b42b388..b63511f481a7f 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3832,8 +3832,6 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
host_key = ctrl->host_key;
ctrl->host_key = key;
nvme_auth_free_key(host_key);
- /* Key has changed; re-authentication with new key */
- nvme_auth_reset(ctrl);
}
/* Start re-authentication */
dev_info(ctrl->device, "re-authenticating controller\n");
@@ -3886,8 +3884,6 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
ctrl_key = ctrl->ctrl_key;
ctrl->ctrl_key = key;
nvme_auth_free_key(ctrl_key);
- /* Key has changed; re-authentication with new key */
- nvme_auth_reset(ctrl);
}
/* Start re-authentication */
dev_info(ctrl->device, "re-authenticating controller\n");
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 2aa514c3dfa17..5ed771d576c6d 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -1032,7 +1032,6 @@ void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl);
void nvme_auth_stop(struct nvme_ctrl *ctrl);
int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid);
int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid);
-void nvme_auth_reset(struct nvme_ctrl *ctrl);
void nvme_auth_free(struct nvme_ctrl *ctrl);
#else
static inline void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) {};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 019/591] nvme-core: fix memory leak in dhchap_secret_store
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 018/591] nvme-auth: no need to reset chap contexts on re-authentication Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 020/591] nvme-core: fix memory leak in dhchap_ctrl_secret Greg Kroah-Hartman
` (575 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chaitanya Kulkarni, Yi Zhang,
Christoph Hellwig, Sagi Grimberg, Keith Busch, Sasha Levin
From: Chaitanya Kulkarni <kch@nvidia.com>
[ Upstream commit a836ca33c5b07d34dd5347af9f64d25651d12674 ]
Free dhchap_secret in nvme_ctrl_dhchap_secret_store() before we return
fix following kmemleack:-
unreferenced object 0xffff8886376ea800 (size 64):
comm "check", pid 22048, jiffies 4344316705 (age 92.199s)
hex dump (first 32 bytes):
44 48 48 43 2d 31 3a 30 30 3a 6e 78 72 35 4b 67 DHHC-1:00:nxr5Kg
75 58 34 75 6f 41 78 73 4a 61 34 63 2f 68 75 4c uX4uoAxsJa4c/huL
backtrace:
[<0000000030ce5d4b>] __kmalloc+0x4b/0x130
[<000000009be1cdc1>] nvme_ctrl_dhchap_secret_store+0x8f/0x160 [nvme_core]
[<00000000ac06c96a>] kernfs_fop_write_iter+0x12b/0x1c0
[<00000000437e7ced>] vfs_write+0x2ba/0x3c0
[<00000000f9491baf>] ksys_write+0x5f/0xe0
[<000000001c46513d>] do_syscall_64+0x3b/0x90
[<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
unreferenced object 0xffff8886376eaf00 (size 64):
comm "check", pid 22048, jiffies 4344316736 (age 92.168s)
hex dump (first 32 bytes):
44 48 48 43 2d 31 3a 30 30 3a 6e 78 72 35 4b 67 DHHC-1:00:nxr5Kg
75 58 34 75 6f 41 78 73 4a 61 34 63 2f 68 75 4c uX4uoAxsJa4c/huL
backtrace:
[<0000000030ce5d4b>] __kmalloc+0x4b/0x130
[<000000009be1cdc1>] nvme_ctrl_dhchap_secret_store+0x8f/0x160 [nvme_core]
[<00000000ac06c96a>] kernfs_fop_write_iter+0x12b/0x1c0
[<00000000437e7ced>] vfs_write+0x2ba/0x3c0
[<00000000f9491baf>] ksys_write+0x5f/0xe0
[<000000001c46513d>] do_syscall_64+0x3b/0x90
[<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index b63511f481a7f..3956164272253 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3825,14 +3825,17 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
int ret;
ret = nvme_auth_generate_key(dhchap_secret, &key);
- if (ret)
+ if (ret) {
+ kfree(dhchap_secret);
return ret;
+ }
kfree(opts->dhchap_secret);
opts->dhchap_secret = dhchap_secret;
host_key = ctrl->host_key;
ctrl->host_key = key;
nvme_auth_free_key(host_key);
- }
+ } else
+ kfree(dhchap_secret);
/* Start re-authentication */
dev_info(ctrl->device, "re-authenticating controller\n");
queue_work(nvme_wq, &ctrl->dhchap_auth_work);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 020/591] nvme-core: fix memory leak in dhchap_ctrl_secret
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 019/591] nvme-core: fix memory leak in dhchap_secret_store Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 021/591] nvme-auth: dont ignore key generation failures when initializing ctrl keys Greg Kroah-Hartman
` (574 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chaitanya Kulkarni,
Christoph Hellwig, Sagi Grimberg, Keith Busch, Sasha Levin
From: Chaitanya Kulkarni <kch@nvidia.com>
[ Upstream commit 99c2dcc8ffc24e210a3aa05c204d92f3ef460b05 ]
Free dhchap_secret in nvme_ctrl_dhchap_ctrl_secret_store() before we
return when nvme_auth_generate_key() returns error.
Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 3956164272253..2b07a67958b46 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3880,14 +3880,17 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
int ret;
ret = nvme_auth_generate_key(dhchap_secret, &key);
- if (ret)
+ if (ret) {
+ kfree(dhchap_secret);
return ret;
+ }
kfree(opts->dhchap_ctrl_secret);
opts->dhchap_ctrl_secret = dhchap_secret;
ctrl_key = ctrl->ctrl_key;
ctrl->ctrl_key = key;
nvme_auth_free_key(ctrl_key);
- }
+ } else
+ kfree(dhchap_secret);
/* Start re-authentication */
dev_info(ctrl->device, "re-authenticating controller\n");
queue_work(nvme_wq, &ctrl->dhchap_auth_work);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 021/591] nvme-auth: dont ignore key generation failures when initializing ctrl keys
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 020/591] nvme-core: fix memory leak in dhchap_ctrl_secret Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 022/591] nvme-core: add missing fault-injection cleanup Greg Kroah-Hartman
` (573 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Sagi Grimberg,
Chaitanya Kulkarni, Christoph Hellwig, Sasha Levin
From: Sagi Grimberg <sagi@grimberg.me>
[ Upstream commit 193a8c7e5f1a8481841636cec9c185543ec5c759 ]
nvme_auth_generate_key can fail, don't ignore it upon initialization.
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Stable-dep-of: 7ed5cf8e6d9b ("nvme-core: fix dev_pm_qos memleak")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/auth.c | 19 +++++++++++++++----
drivers/nvme/host/core.c | 6 +++++-
drivers/nvme/host/nvme.h | 7 +++++--
3 files changed, 25 insertions(+), 7 deletions(-)
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index 1a27d7fb4fa91..9dfd3d0293054 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -956,15 +956,26 @@ static void nvme_ctrl_auth_work(struct work_struct *work)
*/
}
-void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
+int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
{
+ int ret;
+
INIT_LIST_HEAD(&ctrl->dhchap_auth_list);
INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work);
mutex_init(&ctrl->dhchap_auth_mutex);
if (!ctrl->opts)
- return;
- nvme_auth_generate_key(ctrl->opts->dhchap_secret, &ctrl->host_key);
- nvme_auth_generate_key(ctrl->opts->dhchap_ctrl_secret, &ctrl->ctrl_key);
+ return 0;
+ ret = nvme_auth_generate_key(ctrl->opts->dhchap_secret,
+ &ctrl->host_key);
+ if (ret)
+ return ret;
+ ret = nvme_auth_generate_key(ctrl->opts->dhchap_ctrl_secret,
+ &ctrl->ctrl_key);
+ if (ret) {
+ nvme_auth_free_key(ctrl->host_key);
+ ctrl->host_key = NULL;
+ }
+ return ret;
}
EXPORT_SYMBOL_GPL(nvme_auth_init_ctrl);
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 2b07a67958b46..09ff0d75aaf38 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -5171,9 +5171,13 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
nvme_fault_inject_init(&ctrl->fault_inject, dev_name(ctrl->device));
nvme_mpath_init_ctrl(ctrl);
- nvme_auth_init_ctrl(ctrl);
+ ret = nvme_auth_init_ctrl(ctrl);
+ if (ret)
+ goto out_free_cdev;
return 0;
+out_free_cdev:
+ cdev_device_del(&ctrl->cdev, ctrl->device);
out_free_name:
nvme_put_ctrl(ctrl);
kfree_const(ctrl->device->kobj.name);
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 5ed771d576c6d..69f9e69208f68 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -1028,13 +1028,16 @@ static inline bool nvme_ctrl_sgl_supported(struct nvme_ctrl *ctrl)
}
#ifdef CONFIG_NVME_AUTH
-void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl);
+int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl);
void nvme_auth_stop(struct nvme_ctrl *ctrl);
int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid);
int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid);
void nvme_auth_free(struct nvme_ctrl *ctrl);
#else
-static inline void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) {};
+static inline int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
+{
+ return 0;
+}
static inline void nvme_auth_stop(struct nvme_ctrl *ctrl) {};
static inline int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 022/591] nvme-core: add missing fault-injection cleanup
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 021/591] nvme-auth: dont ignore key generation failures when initializing ctrl keys Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 023/591] nvme-core: fix dev_pm_qos memleak Greg Kroah-Hartman
` (572 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chaitanya Kulkarni, Yi Zhang,
Christoph Hellwig, Sagi Grimberg, Keith Busch, Sasha Levin
From: Chaitanya Kulkarni <kch@nvidia.com>
[ Upstream commit 3a12a0b868a512fcada564699d00f5e652c0998c ]
Add missing fault-injection cleanup in nvme_init_ctrl() in the error
unwind path that also fixes following message for blktests:-
linux-block (for-next) # grep debugfs debugfs-err.log
[ 147.853464] debugfs: Directory 'nvme1' with parent '/' already present!
[ 147.853973] nvme1: failed to create debugfs attr
[ 148.802490] debugfs: Directory 'nvme1' with parent '/' already present!
[ 148.803244] nvme1: failed to create debugfs attr
[ 148.877304] debugfs: Directory 'nvme1' with parent '/' already present!
[ 148.877775] nvme1: failed to create debugfs attr
[ 149.816652] debugfs: Directory 'nvme1' with parent '/' already present!
[ 149.818011] nvme1: failed to create debugfs attr
Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Stable-dep-of: 7ed5cf8e6d9b ("nvme-core: fix dev_pm_qos memleak")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 09ff0d75aaf38..8414e1a036464 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -5177,6 +5177,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
return 0;
out_free_cdev:
+ nvme_fault_inject_fini(&ctrl->fault_inject);
cdev_device_del(&ctrl->cdev, ctrl->device);
out_free_name:
nvme_put_ctrl(ctrl);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 023/591] nvme-core: fix dev_pm_qos memleak
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 022/591] nvme-core: add missing fault-injection cleanup Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 024/591] md/raid10: check slab-out-of-bounds in md_bitmap_get_counter Greg Kroah-Hartman
` (571 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chaitanya Kulkarni, Yi Zhang,
Christoph Hellwig, Sagi Grimberg, Keith Busch, Sasha Levin
From: Chaitanya Kulkarni <kch@nvidia.com>
[ Upstream commit 7ed5cf8e6d9bfb6a78d0471317edff14f0f2b4dd ]
Call dev_pm_qos_hide_latency_tolerance() in the error unwind patch to
avoid following kmemleak:-
blktests (master) # kmemleak-clear; ./check nvme/044;
blktests (master) # kmemleak-scan ; kmemleak-show
nvme/044 (Test bi-directional authentication) [passed]
runtime 2.111s ... 2.124s
unreferenced object 0xffff888110c46240 (size 96):
comm "nvme", pid 33461, jiffies 4345365353 (age 75.586s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000069ac2cec>] kmalloc_trace+0x25/0x90
[<000000006acc66d5>] dev_pm_qos_update_user_latency_tolerance+0x6f/0x100
[<00000000cc376ea7>] nvme_init_ctrl+0x38e/0x410 [nvme_core]
[<000000007df61b4b>] 0xffffffffc05e88b3
[<00000000d152b985>] 0xffffffffc05744cb
[<00000000f04a4041>] vfs_write+0xc5/0x3c0
[<00000000f9491baf>] ksys_write+0x5f/0xe0
[<000000001c46513d>] do_syscall_64+0x3b/0x90
[<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
Link: https://lore.kernel.org/linux-nvme/CAHj4cs-nDaKzMx2txO4dbE+Mz9ePwLtU0e3egz+StmzOUgWUrA@mail.gmail.com/
Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 8414e1a036464..560ce2f05a96d 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -5178,6 +5178,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
return 0;
out_free_cdev:
nvme_fault_inject_fini(&ctrl->fault_inject);
+ dev_pm_qos_hide_latency_tolerance(ctrl->device);
cdev_device_del(&ctrl->cdev, ctrl->device);
out_free_name:
nvme_put_ctrl(ctrl);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 024/591] md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 023/591] nvme-core: fix dev_pm_qos memleak Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 025/591] md/raid10: fix overflow of md/safe_mode_delay Greg Kroah-Hartman
` (570 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Nan, Yu Kuai, Song Liu,
Sasha Levin
From: Li Nan <linan122@huawei.com>
[ Upstream commit 301867b1c16805aebbc306aafa6ecdc68b73c7e5 ]
If we write a large number to md/bitmap_set_bits, md_bitmap_checkpage()
will return -EINVAL because 'page >= bitmap->pages', but the return value
was not checked immediately in md_bitmap_get_counter() in order to set
*blocks value and slab-out-of-bounds occurs.
Move check of 'page >= bitmap->pages' to md_bitmap_get_counter() and
return directly if true.
Fixes: ef4256733506 ("md/bitmap: optimise scanning of empty bitmaps.")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230515134808.3936750-2-linan666@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md-bitmap.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index e7cc6ba1b657f..9640741e8d369 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -54,14 +54,7 @@ __acquires(bitmap->lock)
{
unsigned char *mappage;
- if (page >= bitmap->pages) {
- /* This can happen if bitmap_start_sync goes beyond
- * End-of-device while looking for a whole page.
- * It is harmless.
- */
- return -EINVAL;
- }
-
+ WARN_ON_ONCE(page >= bitmap->pages);
if (bitmap->bp[page].hijacked) /* it's hijacked, don't try to alloc */
return 0;
@@ -1364,6 +1357,14 @@ __acquires(bitmap->lock)
sector_t csize;
int err;
+ if (page >= bitmap->pages) {
+ /*
+ * This can happen if bitmap_start_sync goes beyond
+ * End-of-device while looking for a whole page or
+ * user set a huge number to sysfs bitmap_set_bits.
+ */
+ return NULL;
+ }
err = md_bitmap_checkpage(bitmap, page, create, 0);
if (bitmap->bp[page].hijacked ||
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 025/591] md/raid10: fix overflow of md/safe_mode_delay
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 024/591] md/raid10: check slab-out-of-bounds in md_bitmap_get_counter Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 026/591] md/raid10: fix wrong setting of max_corr_read_errors Greg Kroah-Hartman
` (569 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Nan, Song Liu, Sasha Levin
From: Li Nan <linan122@huawei.com>
[ Upstream commit 6beb489b2eed25978523f379a605073f99240c50 ]
There is no input check when echo md/safe_mode_delay in safe_delay_store().
And msec might also overflow when HZ < 1000 in safe_delay_show(), Fix it by
checking overflow in safe_delay_store() and use unsigned long conversion in
safe_delay_show().
Fixes: 72e02075a33f ("md: factor out parsing of fixed-point numbers")
Signed-off-by: Li Nan <linan122@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230522072535.1523740-2-linan666@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index bb73a541bb193..0c97531d35038 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3830,8 +3830,9 @@ int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale)
static ssize_t
safe_delay_show(struct mddev *mddev, char *page)
{
- int msec = (mddev->safemode_delay*1000)/HZ;
- return sprintf(page, "%d.%03d\n", msec/1000, msec%1000);
+ unsigned int msec = ((unsigned long)mddev->safemode_delay*1000)/HZ;
+
+ return sprintf(page, "%u.%03u\n", msec/1000, msec%1000);
}
static ssize_t
safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len)
@@ -3843,7 +3844,7 @@ safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len)
return -EINVAL;
}
- if (strict_strtoul_scaled(cbuf, &msec, 3) < 0)
+ if (strict_strtoul_scaled(cbuf, &msec, 3) < 0 || msec > UINT_MAX / HZ)
return -EINVAL;
if (msec == 0)
mddev->safemode_delay = 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 026/591] md/raid10: fix wrong setting of max_corr_read_errors
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 025/591] md/raid10: fix overflow of md/safe_mode_delay Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 027/591] md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request Greg Kroah-Hartman
` (568 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Nan, Yu Kuai, Song Liu,
Sasha Levin
From: Li Nan <linan122@huawei.com>
[ Upstream commit f8b20a405428803bd9881881d8242c9d72c6b2b2 ]
There is no input check when echo md/max_read_errors and overflow might
occur. Add check of input number.
Fixes: 1e50915fe0bb ("raid: improve MD/raid10 handling of correctable read errors.")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230522072535.1523740-3-linan666@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 0c97531d35038..829e1bd9bcbf9 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4513,6 +4513,8 @@ max_corrected_read_errors_store(struct mddev *mddev, const char *buf, size_t len
rv = kstrtouint(buf, 10, &n);
if (rv < 0)
return rv;
+ if (n > INT_MAX)
+ return -EINVAL;
atomic_set(&mddev->max_corr_read_errors, n);
return len;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 027/591] md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 026/591] md/raid10: fix wrong setting of max_corr_read_errors Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 028/591] md/raid10: fix io loss while replacement replace rdev Greg Kroah-Hartman
` (567 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Nan, Yu Kuai, Song Liu,
Sasha Levin
From: Li Nan <linan122@huawei.com>
[ Upstream commit 34817a2441747b48e444cb0e05d84e14bc9443da ]
There are two check of 'mreplace' in raid10_sync_request(). In the first
check, 'need_replace' will be set and 'mreplace' will be used later if
no-Faulty 'mreplace' exists, In the second check, 'mreplace' will be
set to NULL if it is Faulty, but 'need_replace' will not be changed
accordingly. null-ptr-deref occurs if Faulty is set between two check.
Fix it by merging two checks into one. And replace 'need_replace' with
'mreplace' because their values are always the same.
Fixes: ee37d7314a32 ("md/raid10: Fix raid10 replace hang when new added disk faulty")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230527072218.2365857-2-linan666@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid10.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 67398394cc9c9..0eb2eb83ddb9e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3436,7 +3436,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
int must_sync;
int any_working;
int need_recover = 0;
- int need_replace = 0;
struct raid10_info *mirror = &conf->mirrors[i];
struct md_rdev *mrdev, *mreplace;
@@ -3448,11 +3447,10 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
!test_bit(Faulty, &mrdev->flags) &&
!test_bit(In_sync, &mrdev->flags))
need_recover = 1;
- if (mreplace != NULL &&
- !test_bit(Faulty, &mreplace->flags))
- need_replace = 1;
+ if (mreplace && test_bit(Faulty, &mreplace->flags))
+ mreplace = NULL;
- if (!need_recover && !need_replace) {
+ if (!need_recover && !mreplace) {
rcu_read_unlock();
continue;
}
@@ -3468,8 +3466,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
rcu_read_unlock();
continue;
}
- if (mreplace && test_bit(Faulty, &mreplace->flags))
- mreplace = NULL;
/* Unless we are doing a full sync, or a replacement
* we only need to recover the block if it is set in
* the bitmap
@@ -3592,11 +3588,11 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
bio = r10_bio->devs[1].repl_bio;
if (bio)
bio->bi_end_io = NULL;
- /* Note: if need_replace, then bio
+ /* Note: if replace is not NULL, then bio
* cannot be NULL as r10buf_pool_alloc will
* have allocated it.
*/
- if (!need_replace)
+ if (!mreplace)
break;
bio->bi_next = biolist;
biolist = bio;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 028/591] md/raid10: fix io loss while replacement replace rdev
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 027/591] md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 029/591] md/raid1-10: factor out a helper to add bio to plug Greg Kroah-Hartman
` (566 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Nan, Yu Kuai, Song Liu,
Sasha Levin
From: Li Nan <linan122@huawei.com>
[ Upstream commit 2ae6aaf76912bae53c74b191569d2ab484f24bf3 ]
When removing a disk with replacement, the replacement will be used to
replace rdev. During this process, there is a brief window in which both
rdev and replacement are read as NULL in raid10_write_request(). This
will result in io not being submitted but it should be.
//remove //write
raid10_remove_disk raid10_write_request
mirror->rdev = NULL
read rdev -> NULL
mirror->rdev = mirror->replacement
mirror->replacement = NULL
read replacement -> NULL
Fix it by reading replacement first and rdev later, meanwhile, use smp_mb()
to prevent memory reordering.
Fixes: 475b0321a4df ("md/raid10: writes should get directed to replacement as well as original.")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230602091839.743798-3-linan666@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid10.c | 22 ++++++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 0eb2eb83ddb9e..386c16c398269 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -779,8 +779,16 @@ static struct md_rdev *read_balance(struct r10conf *conf,
disk = r10_bio->devs[slot].devnum;
rdev = rcu_dereference(conf->mirrors[disk].replacement);
if (rdev == NULL || test_bit(Faulty, &rdev->flags) ||
- r10_bio->devs[slot].addr + sectors > rdev->recovery_offset)
+ r10_bio->devs[slot].addr + sectors >
+ rdev->recovery_offset) {
+ /*
+ * Read replacement first to prevent reading both rdev
+ * and replacement as NULL during replacement replace
+ * rdev.
+ */
+ smp_mb();
rdev = rcu_dereference(conf->mirrors[disk].rdev);
+ }
if (rdev == NULL ||
test_bit(Faulty, &rdev->flags))
continue;
@@ -1477,9 +1485,15 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,
for (i = 0; i < conf->copies; i++) {
int d = r10_bio->devs[i].devnum;
- struct md_rdev *rdev = rcu_dereference(conf->mirrors[d].rdev);
- struct md_rdev *rrdev = rcu_dereference(
- conf->mirrors[d].replacement);
+ struct md_rdev *rdev, *rrdev;
+
+ rrdev = rcu_dereference(conf->mirrors[d].replacement);
+ /*
+ * Read replacement first to prevent reading both rdev and
+ * replacement as NULL during replacement replace rdev.
+ */
+ smp_mb();
+ rdev = rcu_dereference(conf->mirrors[d].rdev);
if (rdev == rrdev)
rrdev = NULL;
if (rdev && (test_bit(Faulty, &rdev->flags)))
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 029/591] md/raid1-10: factor out a helper to add bio to plug
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 028/591] md/raid10: fix io loss while replacement replace rdev Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 030/591] md/raid1-10: factor out a helper to submit normal write Greg Kroah-Hartman
` (565 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Song Liu, Sasha Levin
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 5ec6ca140a034682e421e2e808ef5ddfdfd65242 ]
The code in raid1 and raid10 is identical, prepare to limit the number
of plugged bios.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230529131106.2123367-3-yukuai1@huaweicloud.com
Stable-dep-of: 7db922bae3ab ("md/raid1-10: submit write io directly if bitmap is not enabled")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid1-10.c | 16 ++++++++++++++++
drivers/md/raid1.c | 12 +-----------
drivers/md/raid10.c | 11 +----------
3 files changed, 18 insertions(+), 21 deletions(-)
diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c
index e61f6cad4e08e..9bf19a3409cef 100644
--- a/drivers/md/raid1-10.c
+++ b/drivers/md/raid1-10.c
@@ -109,3 +109,19 @@ static void md_bio_reset_resync_pages(struct bio *bio, struct resync_pages *rp,
size -= len;
} while (idx++ < RESYNC_PAGES && size > 0);
}
+
+static inline bool raid1_add_bio_to_plug(struct mddev *mddev, struct bio *bio,
+ blk_plug_cb_fn unplug)
+{
+ struct raid1_plug_cb *plug = NULL;
+ struct blk_plug_cb *cb = blk_check_plugged(unplug, mddev,
+ sizeof(*plug));
+
+ if (!cb)
+ return false;
+
+ plug = container_of(cb, struct raid1_plug_cb, cb);
+ bio_list_add(&plug->pending, bio);
+
+ return true;
+}
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 58f705f429480..f3f2078d69e77 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1343,8 +1343,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
struct bitmap *bitmap = mddev->bitmap;
unsigned long flags;
struct md_rdev *blocked_rdev;
- struct blk_plug_cb *cb;
- struct raid1_plug_cb *plug = NULL;
int first_clone;
int max_sectors;
bool write_behind = false;
@@ -1573,15 +1571,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
r1_bio->sector);
/* flush_pending_writes() needs access to the rdev so...*/
mbio->bi_bdev = (void *)rdev;
-
- cb = blk_check_plugged(raid1_unplug, mddev, sizeof(*plug));
- if (cb)
- plug = container_of(cb, struct raid1_plug_cb, cb);
- else
- plug = NULL;
- if (plug) {
- bio_list_add(&plug->pending, mbio);
- } else {
+ if (!raid1_add_bio_to_plug(mddev, mbio, raid1_unplug)) {
spin_lock_irqsave(&conf->device_lock, flags);
bio_list_add(&conf->pending_bio_list, mbio);
spin_unlock_irqrestore(&conf->device_lock, flags);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 386c16c398269..14001cceb6186 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1288,8 +1288,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio,
const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC;
const blk_opf_t do_fua = bio->bi_opf & REQ_FUA;
unsigned long flags;
- struct blk_plug_cb *cb;
- struct raid1_plug_cb *plug = NULL;
struct r10conf *conf = mddev->private;
struct md_rdev *rdev;
int devnum = r10_bio->devs[n_copy].devnum;
@@ -1329,14 +1327,7 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio,
atomic_inc(&r10_bio->remaining);
- cb = blk_check_plugged(raid10_unplug, mddev, sizeof(*plug));
- if (cb)
- plug = container_of(cb, struct raid1_plug_cb, cb);
- else
- plug = NULL;
- if (plug) {
- bio_list_add(&plug->pending, mbio);
- } else {
+ if (!raid1_add_bio_to_plug(mddev, mbio, raid10_unplug)) {
spin_lock_irqsave(&conf->device_lock, flags);
bio_list_add(&conf->pending_bio_list, mbio);
spin_unlock_irqrestore(&conf->device_lock, flags);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 030/591] md/raid1-10: factor out a helper to submit normal write
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 029/591] md/raid1-10: factor out a helper to add bio to plug Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 031/591] md/raid1-10: submit write io directly if bitmap is not enabled Greg Kroah-Hartman
` (564 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Song Liu, Sasha Levin
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 8295efbe68c080047e98d9c0eb5cb933b238a8cb ]
There are multiple places to do the same thing, factor out a helper to
prevent redundant code, and the helper will be used in following patch
as well.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230529131106.2123367-4-yukuai1@huaweicloud.com
Stable-dep-of: 7db922bae3ab ("md/raid1-10: submit write io directly if bitmap is not enabled")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid1-10.c | 17 +++++++++++++++++
drivers/md/raid1.c | 13 ++-----------
drivers/md/raid10.c | 26 ++++----------------------
3 files changed, 23 insertions(+), 33 deletions(-)
diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c
index 9bf19a3409cef..506299bd55cb6 100644
--- a/drivers/md/raid1-10.c
+++ b/drivers/md/raid1-10.c
@@ -110,6 +110,23 @@ static void md_bio_reset_resync_pages(struct bio *bio, struct resync_pages *rp,
} while (idx++ < RESYNC_PAGES && size > 0);
}
+
+static inline void raid1_submit_write(struct bio *bio)
+{
+ struct md_rdev *rdev = (struct md_rdev *)bio->bi_bdev;
+
+ bio->bi_next = NULL;
+ bio_set_dev(bio, rdev->bdev);
+ if (test_bit(Faulty, &rdev->flags))
+ bio_io_error(bio);
+ else if (unlikely(bio_op(bio) == REQ_OP_DISCARD &&
+ !bdev_max_discard_sectors(bio->bi_bdev)))
+ /* Just ignore it */
+ bio_endio(bio);
+ else
+ submit_bio_noacct(bio);
+}
+
static inline bool raid1_add_bio_to_plug(struct mddev *mddev, struct bio *bio,
blk_plug_cb_fn unplug)
{
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f3f2078d69e77..ac64c587191b9 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -799,17 +799,8 @@ static void flush_bio_list(struct r1conf *conf, struct bio *bio)
while (bio) { /* submit pending writes */
struct bio *next = bio->bi_next;
- struct md_rdev *rdev = (void *)bio->bi_bdev;
- bio->bi_next = NULL;
- bio_set_dev(bio, rdev->bdev);
- if (test_bit(Faulty, &rdev->flags)) {
- bio_io_error(bio);
- } else if (unlikely((bio_op(bio) == REQ_OP_DISCARD) &&
- !bdev_max_discard_sectors(bio->bi_bdev)))
- /* Just ignore it */
- bio_endio(bio);
- else
- submit_bio_noacct(bio);
+
+ raid1_submit_write(bio);
bio = next;
cond_resched();
}
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 14001cceb6186..ea6228ff3bb5e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -917,17 +917,8 @@ static void flush_pending_writes(struct r10conf *conf)
while (bio) { /* submit pending writes */
struct bio *next = bio->bi_next;
- struct md_rdev *rdev = (void*)bio->bi_bdev;
- bio->bi_next = NULL;
- bio_set_dev(bio, rdev->bdev);
- if (test_bit(Faulty, &rdev->flags)) {
- bio_io_error(bio);
- } else if (unlikely((bio_op(bio) == REQ_OP_DISCARD) &&
- !bdev_max_discard_sectors(bio->bi_bdev)))
- /* Just ignore it */
- bio_endio(bio);
- else
- submit_bio_noacct(bio);
+
+ raid1_submit_write(bio);
bio = next;
}
blk_finish_plug(&plug);
@@ -1136,17 +1127,8 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
while (bio) { /* submit pending writes */
struct bio *next = bio->bi_next;
- struct md_rdev *rdev = (void*)bio->bi_bdev;
- bio->bi_next = NULL;
- bio_set_dev(bio, rdev->bdev);
- if (test_bit(Faulty, &rdev->flags)) {
- bio_io_error(bio);
- } else if (unlikely((bio_op(bio) == REQ_OP_DISCARD) &&
- !bdev_max_discard_sectors(bio->bi_bdev)))
- /* Just ignore it */
- bio_endio(bio);
- else
- submit_bio_noacct(bio);
+
+ raid1_submit_write(bio);
bio = next;
}
kfree(plug);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 031/591] md/raid1-10: submit write io directly if bitmap is not enabled
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 030/591] md/raid1-10: factor out a helper to submit normal write Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 032/591] block: fix blktrace debugfs entries leakage Greg Kroah-Hartman
` (563 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Song Liu, Sasha Levin
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 7db922bae3abdf0a1db81ef7228cc0b996a0c1e3 ]
Commit 6cce3b23f6f8 ("[PATCH] md: write intent bitmap support for raid10")
add bitmap support, and it changed that write io is submitted through
daemon thread because bitmap need to be updated before write io. And
later, plug is used to fix performance regression because all the write io
will go to demon thread, which means io can't be issued concurrently.
However, if bitmap is not enabled, the write io should not go to daemon
thread in the first place, and plug is not needed as well.
Fixes: 6cce3b23f6f8 ("[PATCH] md: write intent bitmap support for raid10")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230529131106.2123367-5-yukuai1@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md-bitmap.c | 4 +---
drivers/md/md-bitmap.h | 7 +++++++
drivers/md/raid1-10.c | 13 +++++++++++--
3 files changed, 19 insertions(+), 5 deletions(-)
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index 9640741e8d369..8bbeeec70905c 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -993,7 +993,6 @@ static int md_bitmap_file_test_bit(struct bitmap *bitmap, sector_t block)
return set;
}
-
/* this gets called when the md device is ready to unplug its underlying
* (slave) device queues -- before we let any writes go down, we need to
* sync the dirty pages of the bitmap file to disk */
@@ -1003,8 +1002,7 @@ void md_bitmap_unplug(struct bitmap *bitmap)
int dirty, need_write;
int writing = 0;
- if (!bitmap || !bitmap->storage.filemap ||
- test_bit(BITMAP_STALE, &bitmap->flags))
+ if (!md_bitmap_enabled(bitmap))
return;
/* look at each page to see if there are any set bits that need to be
diff --git a/drivers/md/md-bitmap.h b/drivers/md/md-bitmap.h
index cfd7395de8fd3..3a4750952b3a7 100644
--- a/drivers/md/md-bitmap.h
+++ b/drivers/md/md-bitmap.h
@@ -273,6 +273,13 @@ int md_bitmap_copy_from_slot(struct mddev *mddev, int slot,
sector_t *lo, sector_t *hi, bool clear_bits);
void md_bitmap_free(struct bitmap *bitmap);
void md_bitmap_wait_behind_writes(struct mddev *mddev);
+
+static inline bool md_bitmap_enabled(struct bitmap *bitmap)
+{
+ return bitmap && bitmap->storage.filemap &&
+ !test_bit(BITMAP_STALE, &bitmap->flags);
+}
+
#endif
#endif
diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c
index 506299bd55cb6..73cc3cb9154d8 100644
--- a/drivers/md/raid1-10.c
+++ b/drivers/md/raid1-10.c
@@ -131,9 +131,18 @@ static inline bool raid1_add_bio_to_plug(struct mddev *mddev, struct bio *bio,
blk_plug_cb_fn unplug)
{
struct raid1_plug_cb *plug = NULL;
- struct blk_plug_cb *cb = blk_check_plugged(unplug, mddev,
- sizeof(*plug));
+ struct blk_plug_cb *cb;
+
+ /*
+ * If bitmap is not enabled, it's safe to submit the io directly, and
+ * this can get optimal performance.
+ */
+ if (!md_bitmap_enabled(mddev->bitmap)) {
+ raid1_submit_write(bio);
+ return true;
+ }
+ cb = blk_check_plugged(unplug, mddev, sizeof(*plug));
if (!cb)
return false;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 032/591] block: fix blktrace debugfs entries leakage
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 031/591] md/raid1-10: submit write io directly if bitmap is not enabled Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 033/591] irqchip/stm32-exti: Fix warning on initialized field overwritten Greg Kroah-Hartman
` (562 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Christoph Hellwig,
Jens Axboe, Sasha Levin
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit dd7de3704af9989b780693d51eaea49a665bd9c2 ]
Commit 99d055b4fd4b ("block: remove per-disk debugfs files in
blk_unregister_queue") moves blk_trace_shutdown() from
blk_release_queue() to blk_unregister_queue(), this is safe if blktrace
is created through sysfs, however, there is a regression in corner
case.
blktrace can still be enabled after del_gendisk() through ioctl if
the disk is opened before del_gendisk(), and if blktrace is not shutdown
through ioctl before closing the disk, debugfs entries will be leaked.
Fix this problem by shutdown blktrace in disk_release(), this is safe
because blk_trace_remove() is reentrant.
Fixes: 99d055b4fd4b ("block: remove per-disk debugfs files in blk_unregister_queue")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230610022003.2557284-4-yukuai1@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/genhd.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/block/genhd.c b/block/genhd.c
index 62a61388e752d..afab646d12c85 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -25,8 +25,9 @@
#include <linux/pm_runtime.h>
#include <linux/badblocks.h>
#include <linux/part_stat.h>
-#include "blk-throttle.h"
+#include <linux/blktrace_api.h>
+#include "blk-throttle.h"
#include "blk.h"
#include "blk-mq-sched.h"
#include "blk-rq-qos.h"
@@ -1181,6 +1182,8 @@ static void disk_release(struct device *dev)
might_sleep();
WARN_ON_ONCE(disk_live(disk));
+ blk_trace_remove(disk->queue);
+
/*
* To undo the all initialization from blk_mq_init_allocated_queue in
* case of a probe failure where add_disk is never called we have to
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 033/591] irqchip/stm32-exti: Fix warning on initialized field overwritten
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 032/591] block: fix blktrace debugfs entries leakage Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 034/591] irqchip/jcore-aic: Fix missing allocation of IRQ descriptors Greg Kroah-Hartman
` (561 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antonio Borneo, Marc Zyngier,
Sasha Levin
From: Antonio Borneo <antonio.borneo@foss.st.com>
[ Upstream commit 48f31e496488a25f443c0df52464da446fb1d10c ]
While compiling with W=1, both gcc and clang complain about a
tricky way to initialize an array by filling it with a non-zero
value and then overrride some of the array elements.
In this case the override is intentional, so just disable the
specific warning for only this part of the code.
Note: the flag "-Woverride-init" is recognized by both compilers,
but the warning msg from clang reports "-Winitializer-overrides".
The doc of clang clarifies that the two flags are synonyms, so use
here only the flag name common on both compilers.
Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
Fixes: c297493336b7 ("irqchip/stm32-exti: Simplify irq description table")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230601155614.34490-1-antonio.borneo@foss.st.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-stm32-exti.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index 6a3f7498ea8ea..8bbb2b114636c 100644
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -173,6 +173,16 @@ static struct irq_chip stm32_exti_h_chip_direct;
#define EXTI_INVALID_IRQ U8_MAX
#define STM32MP1_DESC_IRQ_SIZE (ARRAY_SIZE(stm32mp1_exti_banks) * IRQS_PER_BANK)
+/*
+ * Use some intentionally tricky logic here to initialize the whole array to
+ * EXTI_INVALID_IRQ, but then override certain fields, requiring us to indicate
+ * that we "know" that there are overrides in this structure, and we'll need to
+ * disable that warning from W=1 builds.
+ */
+__diag_push();
+__diag_ignore_all("-Woverride-init",
+ "logic to initialize all and then override some is OK");
+
static const u8 stm32mp1_desc_irq[] = {
/* default value */
[0 ... (STM32MP1_DESC_IRQ_SIZE - 1)] = EXTI_INVALID_IRQ,
@@ -266,6 +276,8 @@ static const u8 stm32mp13_desc_irq[] = {
[70] = 98,
};
+__diag_pop();
+
static const struct stm32_exti_drv_data stm32mp1_drv_data = {
.exti_banks = stm32mp1_exti_banks,
.bank_nr = ARRAY_SIZE(stm32mp1_exti_banks),
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 034/591] irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 033/591] irqchip/stm32-exti: Fix warning on initialized field overwritten Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 035/591] svcrdma: Prevent page release when nothing was received Greg Kroah-Hartman
` (560 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Paul Adrian Glaubitz,
Rob Landley, Marc Zyngier, Sasha Levin
From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
[ Upstream commit 4848229494a323eeaab62eee5574ef9f7de80374 ]
The initialization function for the J-Core AIC aic_irq_of_init() is
currently missing the call to irq_alloc_descs() which allocates and
initializes all the IRQ descriptors. Add missing function call and
return the error code from irq_alloc_descs() in case the allocation
fails.
Fixes: 981b58f66cfc ("irqchip/jcore-aic: Add J-Core AIC driver")
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Tested-by: Rob Landley <rob@landley.net>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230510163343.43090-1-glaubitz@physik.fu-berlin.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-jcore-aic.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/irqchip/irq-jcore-aic.c b/drivers/irqchip/irq-jcore-aic.c
index 5f47d8ee4ae39..b9dcc8e78c750 100644
--- a/drivers/irqchip/irq-jcore-aic.c
+++ b/drivers/irqchip/irq-jcore-aic.c
@@ -68,6 +68,7 @@ static int __init aic_irq_of_init(struct device_node *node,
unsigned min_irq = JCORE_AIC2_MIN_HWIRQ;
unsigned dom_sz = JCORE_AIC_MAX_HWIRQ+1;
struct irq_domain *domain;
+ int ret;
pr_info("Initializing J-Core AIC\n");
@@ -100,6 +101,12 @@ static int __init aic_irq_of_init(struct device_node *node,
jcore_aic.irq_unmask = noop;
jcore_aic.name = "AIC";
+ ret = irq_alloc_descs(-1, min_irq, dom_sz - min_irq,
+ of_node_to_nid(node));
+
+ if (ret < 0)
+ return ret;
+
domain = irq_domain_add_legacy(node, dom_sz - min_irq, min_irq, min_irq,
&jcore_aic_irqdomain_ops,
&jcore_aic);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 035/591] svcrdma: Prevent page release when nothing was received
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 034/591] irqchip/jcore-aic: Fix missing allocation of IRQ descriptors Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 036/591] erofs: simplify iloc() Greg Kroah-Hartman
` (559 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever,
Sasha Levin
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit baf6d18b116b7dc84ed5e212c3a89f17cdc3f28c ]
I noticed that svc_rqst_release_pages() was still unnecessarily
releasing a page when svc_rdma_recvfrom() returns zero.
Fixes: a53d5cb0646a ("svcrdma: Avoid releasing a page in svc_xprt_release()")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 53a7cb2f6c07d..6da6608985ce9 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -796,6 +796,12 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
struct svc_rdma_recv_ctxt *ctxt;
int ret;
+ /* Prevent svc_xprt_release() from releasing pages in rq_pages
+ * when returning 0 or an error.
+ */
+ rqstp->rq_respages = rqstp->rq_pages;
+ rqstp->rq_next_page = rqstp->rq_respages;
+
rqstp->rq_xprt_ctxt = NULL;
ctxt = NULL;
@@ -819,12 +825,6 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
DMA_FROM_DEVICE);
svc_rdma_build_arg_xdr(rqstp, ctxt);
- /* Prevent svc_xprt_release from releasing pages in rq_pages
- * if we return 0 or an error.
- */
- rqstp->rq_respages = rqstp->rq_pages;
- rqstp->rq_next_page = rqstp->rq_respages;
-
ret = svc_rdma_xdr_decode_req(&rqstp->rq_arg, ctxt);
if (ret < 0)
goto out_err;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 036/591] erofs: simplify iloc()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 035/591] svcrdma: Prevent page release when nothing was received Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 037/591] erofs: fix compact 4B support for 16k block size Greg Kroah-Hartman
` (558 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yue Hu, Jingbo Xu, Chao Yu,
Gao Xiang, Sasha Levin
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit b780d3fc6107464dcc43631a6208c43b6421f1e6 ]
Actually we could pass in inodes directly to clean up all callers.
Also rename iloc() as erofs_iloc().
Link: https://lore.kernel.org/r/20230114150823.432069-1-xiang@kernel.org
Reviewed-by: Yue Hu <huyue2@coolpad.com>
Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Stable-dep-of: 001b8ccd0650 ("erofs: fix compact 4B support for 16k block size")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/data.c | 9 +++------
fs/erofs/inode.c | 2 +-
fs/erofs/internal.h | 16 +++++++++-------
fs/erofs/xattr.c | 20 +++++++-------------
fs/erofs/zmap.c | 13 +++++--------
include/trace/events/erofs.h | 4 ++--
6 files changed, 27 insertions(+), 37 deletions(-)
diff --git a/fs/erofs/data.c b/fs/erofs/data.c
index fe8ac0e163f7e..b32801d716f89 100644
--- a/fs/erofs/data.c
+++ b/fs/erofs/data.c
@@ -95,11 +95,8 @@ static int erofs_map_blocks_flatmode(struct inode *inode,
map->m_pa = blknr_to_addr(vi->raw_blkaddr) + map->m_la;
map->m_plen = blknr_to_addr(lastblk) - offset;
} else if (tailendpacking) {
- /* 2 - inode inline B: inode, [xattrs], inline last blk... */
- struct erofs_sb_info *sbi = EROFS_SB(inode->i_sb);
-
- map->m_pa = iloc(sbi, vi->nid) + vi->inode_isize +
- vi->xattr_isize + erofs_blkoff(map->m_la);
+ map->m_pa = erofs_iloc(inode) + vi->inode_isize +
+ vi->xattr_isize + erofs_blkoff(offset);
map->m_plen = inode->i_size - offset;
/* inline data should be located in the same meta block */
@@ -154,7 +151,7 @@ int erofs_map_blocks(struct inode *inode,
unit = EROFS_BLOCK_MAP_ENTRY_SIZE; /* block map */
chunknr = map->m_la >> vi->chunkbits;
- pos = ALIGN(iloc(EROFS_SB(sb), vi->nid) + vi->inode_isize +
+ pos = ALIGN(erofs_iloc(inode) + vi->inode_isize +
vi->xattr_isize, unit) + unit * chunknr;
kaddr = erofs_read_metabuf(&buf, sb, erofs_blknr(pos), EROFS_KMAP);
diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c
index ad2a82f2eb4cd..5aadc73d57652 100644
--- a/fs/erofs/inode.c
+++ b/fs/erofs/inode.c
@@ -14,7 +14,7 @@ static void *erofs_read_inode(struct erofs_buf *buf,
struct super_block *sb = inode->i_sb;
struct erofs_sb_info *sbi = EROFS_SB(sb);
struct erofs_inode *vi = EROFS_I(inode);
- const erofs_off_t inode_loc = iloc(sbi, vi->nid);
+ const erofs_off_t inode_loc = erofs_iloc(inode);
erofs_blk_t blkaddr, nblks = 0;
void *kaddr;
diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h
index 340bd56a57559..d8d09fc3ed655 100644
--- a/fs/erofs/internal.h
+++ b/fs/erofs/internal.h
@@ -273,11 +273,6 @@ struct erofs_buf {
#define erofs_blkoff(addr) ((addr) % EROFS_BLKSIZ)
#define blknr_to_addr(nr) ((erofs_off_t)(nr) * EROFS_BLKSIZ)
-static inline erofs_off_t iloc(struct erofs_sb_info *sbi, erofs_nid_t nid)
-{
- return blknr_to_addr(sbi->meta_blkaddr) + (nid << sbi->islotbits);
-}
-
#define EROFS_FEATURE_FUNCS(name, compat, feature) \
static inline bool erofs_sb_has_##name(struct erofs_sb_info *sbi) \
{ \
@@ -342,8 +337,15 @@ struct erofs_inode {
struct inode vfs_inode;
};
-#define EROFS_I(ptr) \
- container_of(ptr, struct erofs_inode, vfs_inode)
+#define EROFS_I(ptr) container_of(ptr, struct erofs_inode, vfs_inode)
+
+static inline erofs_off_t erofs_iloc(struct inode *inode)
+{
+ struct erofs_sb_info *sbi = EROFS_I_SB(inode);
+
+ return blknr_to_addr(sbi->meta_blkaddr) +
+ (EROFS_I(inode)->nid << sbi->islotbits);
+}
static inline unsigned long erofs_inode_datablocks(struct inode *inode)
{
diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c
index 8106bcb5a38d1..a2776abf36986 100644
--- a/fs/erofs/xattr.c
+++ b/fs/erofs/xattr.c
@@ -22,8 +22,7 @@ static int init_inode_xattrs(struct inode *inode)
struct xattr_iter it;
unsigned int i;
struct erofs_xattr_ibody_header *ih;
- struct super_block *sb;
- struct erofs_sb_info *sbi;
+ struct super_block *sb = inode->i_sb;
int ret = 0;
/* the most case is that xattrs of this inode are initialized. */
@@ -52,15 +51,14 @@ static int init_inode_xattrs(struct inode *inode)
* undefined right now (maybe use later with some new sb feature).
*/
if (vi->xattr_isize == sizeof(struct erofs_xattr_ibody_header)) {
- erofs_err(inode->i_sb,
+ erofs_err(sb,
"xattr_isize %d of nid %llu is not supported yet",
vi->xattr_isize, vi->nid);
ret = -EOPNOTSUPP;
goto out_unlock;
} else if (vi->xattr_isize < sizeof(struct erofs_xattr_ibody_header)) {
if (vi->xattr_isize) {
- erofs_err(inode->i_sb,
- "bogus xattr ibody @ nid %llu", vi->nid);
+ erofs_err(sb, "bogus xattr ibody @ nid %llu", vi->nid);
DBG_BUGON(1);
ret = -EFSCORRUPTED;
goto out_unlock; /* xattr ondisk layout error */
@@ -69,11 +67,9 @@ static int init_inode_xattrs(struct inode *inode)
goto out_unlock;
}
- sb = inode->i_sb;
- sbi = EROFS_SB(sb);
it.buf = __EROFS_BUF_INITIALIZER;
- it.blkaddr = erofs_blknr(iloc(sbi, vi->nid) + vi->inode_isize);
- it.ofs = erofs_blkoff(iloc(sbi, vi->nid) + vi->inode_isize);
+ it.blkaddr = erofs_blknr(erofs_iloc(inode) + vi->inode_isize);
+ it.ofs = erofs_blkoff(erofs_iloc(inode) + vi->inode_isize);
/* read in shared xattr array (non-atomic, see kmalloc below) */
it.kaddr = erofs_read_metabuf(&it.buf, sb, it.blkaddr, EROFS_KMAP);
@@ -159,7 +155,6 @@ static int inline_xattr_iter_begin(struct xattr_iter *it,
struct inode *inode)
{
struct erofs_inode *const vi = EROFS_I(inode);
- struct erofs_sb_info *const sbi = EROFS_SB(inode->i_sb);
unsigned int xattr_header_sz, inline_xattr_ofs;
xattr_header_sz = inlinexattr_header_size(inode);
@@ -170,9 +165,8 @@ static int inline_xattr_iter_begin(struct xattr_iter *it,
inline_xattr_ofs = vi->inode_isize + xattr_header_sz;
- it->blkaddr = erofs_blknr(iloc(sbi, vi->nid) + inline_xattr_ofs);
- it->ofs = erofs_blkoff(iloc(sbi, vi->nid) + inline_xattr_ofs);
-
+ it->blkaddr = erofs_blknr(erofs_iloc(inode) + inline_xattr_ofs);
+ it->ofs = erofs_blkoff(erofs_iloc(inode) + inline_xattr_ofs);
it->kaddr = erofs_read_metabuf(&it->buf, inode->i_sb, it->blkaddr,
EROFS_KMAP_ATOMIC);
if (IS_ERR(it->kaddr))
diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
index bb91cc6499725..3961bb55dea11 100644
--- a/fs/erofs/zmap.c
+++ b/fs/erofs/zmap.c
@@ -55,8 +55,7 @@ static int z_erofs_fill_inode_lazy(struct inode *inode)
if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags))
goto out_unlock;
- pos = ALIGN(iloc(EROFS_SB(sb), vi->nid) + vi->inode_isize +
- vi->xattr_isize, 8);
+ pos = ALIGN(erofs_iloc(inode) + vi->inode_isize + vi->xattr_isize, 8);
kaddr = erofs_read_metabuf(&buf, sb, erofs_blknr(pos), EROFS_KMAP);
if (IS_ERR(kaddr)) {
err = PTR_ERR(kaddr);
@@ -169,10 +168,9 @@ static int legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m,
{
struct inode *const inode = m->inode;
struct erofs_inode *const vi = EROFS_I(inode);
- const erofs_off_t ibase = iloc(EROFS_I_SB(inode), vi->nid);
const erofs_off_t pos =
- Z_EROFS_VLE_LEGACY_INDEX_ALIGN(ibase + vi->inode_isize +
- vi->xattr_isize) +
+ Z_EROFS_VLE_LEGACY_INDEX_ALIGN(erofs_iloc(inode) +
+ vi->inode_isize + vi->xattr_isize) +
lcn * sizeof(struct z_erofs_vle_decompressed_index);
struct z_erofs_vle_decompressed_index *di;
unsigned int advise, type;
@@ -376,9 +374,8 @@ static int compacted_load_cluster_from_disk(struct z_erofs_maprecorder *m,
struct inode *const inode = m->inode;
struct erofs_inode *const vi = EROFS_I(inode);
const unsigned int lclusterbits = vi->z_logical_clusterbits;
- const erofs_off_t ebase = ALIGN(iloc(EROFS_I_SB(inode), vi->nid) +
- vi->inode_isize + vi->xattr_isize, 8) +
- sizeof(struct z_erofs_map_header);
+ const erofs_off_t ebase = sizeof(struct z_erofs_map_header) +
+ ALIGN(erofs_iloc(inode) + vi->inode_isize + vi->xattr_isize, 8);
const unsigned int totalidx = DIV_ROUND_UP(inode->i_size, EROFS_BLKSIZ);
unsigned int compacted_4b_initial, compacted_2b;
unsigned int amortizedshift;
diff --git a/include/trace/events/erofs.h b/include/trace/events/erofs.h
index 4f4c44ea3a655..e095d36db9391 100644
--- a/include/trace/events/erofs.h
+++ b/include/trace/events/erofs.h
@@ -66,8 +66,8 @@ TRACE_EVENT(erofs_fill_inode,
TP_fast_assign(
__entry->dev = inode->i_sb->s_dev;
__entry->nid = EROFS_I(inode)->nid;
- __entry->blkaddr = erofs_blknr(iloc(EROFS_I_SB(inode), __entry->nid));
- __entry->ofs = erofs_blkoff(iloc(EROFS_I_SB(inode), __entry->nid));
+ __entry->blkaddr = erofs_blknr(erofs_iloc(inode));
+ __entry->ofs = erofs_blkoff(erofs_iloc(inode));
),
TP_printk("dev = (%d,%d), nid = %llu, blkaddr %u ofs %u",
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 037/591] erofs: fix compact 4B support for 16k block size
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 036/591] erofs: simplify iloc() Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 038/591] posix-timers: Prevent RT livelock in itimer_delete() Greg Kroah-Hartman
` (557 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gao Xiang, Sasha Levin
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit 001b8ccd0650727e54ec16ef72bf1b8eeab7168e ]
In compact 4B, two adjacent lclusters are packed together as a unit to
form on-disk indexes for effective random access, as below:
(amortized = 4, vcnt = 2)
_____________________________________________
|___@_____ encoded bits __________|_ blkaddr _|
0 . amortized * vcnt = 8
. .
. . amortized * vcnt - 4 = 4
. .
.____________________________.
|_type (2 bits)_|_clusterofs_|
Therefore, encoded bits for each pack are 32 bits (4 bytes). IOWs,
since each lcluster can get 16 bits for its type and clusterofs, the
maximum supported lclustersize for compact 4B format is 16k (14 bits).
Fix this to enable compact 4B format for 16k lclusters (blocks), which
is tested on an arm64 server with 16k page size.
Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20230601112341.56960-1-hsiangkao@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/zmap.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
index 3961bb55dea11..0337b70b2dac4 100644
--- a/fs/erofs/zmap.c
+++ b/fs/erofs/zmap.c
@@ -271,7 +271,7 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m,
u8 *in, type;
bool big_pcluster;
- if (1 << amortizedshift == 4)
+ if (1 << amortizedshift == 4 && lclusterbits <= 14)
vcnt = 2;
else if (1 << amortizedshift == 2 && lclusterbits == 12)
vcnt = 16;
@@ -373,7 +373,6 @@ static int compacted_load_cluster_from_disk(struct z_erofs_maprecorder *m,
{
struct inode *const inode = m->inode;
struct erofs_inode *const vi = EROFS_I(inode);
- const unsigned int lclusterbits = vi->z_logical_clusterbits;
const erofs_off_t ebase = sizeof(struct z_erofs_map_header) +
ALIGN(erofs_iloc(inode) + vi->inode_isize + vi->xattr_isize, 8);
const unsigned int totalidx = DIV_ROUND_UP(inode->i_size, EROFS_BLKSIZ);
@@ -381,9 +380,6 @@ static int compacted_load_cluster_from_disk(struct z_erofs_maprecorder *m,
unsigned int amortizedshift;
erofs_off_t pos;
- if (lclusterbits != 12)
- return -EOPNOTSUPP;
-
if (lcn >= totalidx)
return -EINVAL;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 038/591] posix-timers: Prevent RT livelock in itimer_delete()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 037/591] erofs: fix compact 4B support for 16k block size Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 039/591] tick/rcu: Fix bogus ratelimit condition Greg Kroah-Hartman
` (556 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Gleixner, Frederic Weisbecker,
Sasha Levin
From: Thomas Gleixner <tglx@linutronix.de>
[ Upstream commit 9d9e522010eb5685d8b53e8a24320653d9d4cbbf ]
itimer_delete() has a retry loop when the timer is concurrently expired. On
non-RT kernels this just spin-waits until the timer callback has completed,
except for posix CPU timers which have HAVE_POSIX_CPU_TIMERS_TASK_WORK
enabled.
In that case and on RT kernels the existing task could live lock when
preempting the task which does the timer delivery.
Replace spin_unlock() with an invocation of timer_wait_running() to handle
it the same way as the other retry loops in the posix timer code.
Fixes: ec8f954a40da ("posix-timers: Use a callback for cancel synchronization on PREEMPT_RT")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Link: https://lore.kernel.org/r/87v8g7c50d.ffs@tglx
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/posix-timers.c | 43 +++++++++++++++++++++++++++++++-------
1 file changed, 35 insertions(+), 8 deletions(-)
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 808a247205a9a..ed3c4a9543982 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -1037,27 +1037,52 @@ SYSCALL_DEFINE1(timer_delete, timer_t, timer_id)
}
/*
- * return timer owned by the process, used by exit_itimers
+ * Delete a timer if it is armed, remove it from the hash and schedule it
+ * for RCU freeing.
*/
static void itimer_delete(struct k_itimer *timer)
{
-retry_delete:
- spin_lock_irq(&timer->it_lock);
+ unsigned long flags;
+
+ /*
+ * irqsave is required to make timer_wait_running() work.
+ */
+ spin_lock_irqsave(&timer->it_lock, flags);
+retry_delete:
+ /*
+ * Even if the timer is not longer accessible from other tasks
+ * it still might be armed and queued in the underlying timer
+ * mechanism. Worse, that timer mechanism might run the expiry
+ * function concurrently.
+ */
if (timer_delete_hook(timer) == TIMER_RETRY) {
- spin_unlock_irq(&timer->it_lock);
+ /*
+ * Timer is expired concurrently, prevent livelocks
+ * and pointless spinning on RT.
+ *
+ * timer_wait_running() drops timer::it_lock, which opens
+ * the possibility for another task to delete the timer.
+ *
+ * That's not possible here because this is invoked from
+ * do_exit() only for the last thread of the thread group.
+ * So no other task can access and delete that timer.
+ */
+ if (WARN_ON_ONCE(timer_wait_running(timer, &flags) != timer))
+ return;
+
goto retry_delete;
}
list_del(&timer->list);
- spin_unlock_irq(&timer->it_lock);
+ spin_unlock_irqrestore(&timer->it_lock, flags);
release_posix_timer(timer, IT_ID_SET);
}
/*
- * This is called by do_exit or de_thread, only when nobody else can
- * modify the signal->posix_timers list. Yet we need sighand->siglock
- * to prevent the race with /proc/pid/timers.
+ * Invoked from do_exit() when the last thread of a thread group exits.
+ * At that point no other task can access the timers of the dying
+ * task anymore.
*/
void exit_itimers(struct task_struct *tsk)
{
@@ -1067,10 +1092,12 @@ void exit_itimers(struct task_struct *tsk)
if (list_empty(&tsk->signal->posix_timers))
return;
+ /* Protect against concurrent read via /proc/$PID/timers */
spin_lock_irq(&tsk->sighand->siglock);
list_replace_init(&tsk->signal->posix_timers, &timers);
spin_unlock_irq(&tsk->sighand->siglock);
+ /* The timers are not longer accessible via tsk::signal */
while (!list_empty(&timers)) {
tmr = list_first_entry(&timers, struct k_itimer, list);
itimer_delete(tmr);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 039/591] tick/rcu: Fix bogus ratelimit condition
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 038/591] posix-timers: Prevent RT livelock in itimer_delete() Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:42 ` [PATCH 6.1 040/591] tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode() Greg Kroah-Hartman
` (555 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wen Yang, Thomas Gleixner,
Sasha Levin
From: Wen Yang <wenyang.linux@foxmail.com>
[ Upstream commit a7e282c77785c7eabf98836431b1f029481085ad ]
The ratelimit logic in report_idle_softirq() is broken because the
exit condition is always true:
static int ratelimit;
if (ratelimit < 10)
return false; ---> always returns here
ratelimit++; ---> no chance to run
Make it check for >= 10 instead.
Fixes: 0345691b24c0 ("tick/rcu: Stop allowing RCU_SOFTIRQ in idle")
Signed-off-by: Wen Yang <wenyang.linux@foxmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/tencent_5AAA3EEAB42095C9B7740BE62FBF9A67E007@qq.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/tick-sched.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index d6fb6a676bbbb..1ad89eec2a55f 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -1046,7 +1046,7 @@ static bool report_idle_softirq(void)
return false;
}
- if (ratelimit < 10)
+ if (ratelimit >= 10)
return false;
/* On RT, softirqs handling may be waiting on some lock */
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 040/591] tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 039/591] tick/rcu: Fix bogus ratelimit condition Greg Kroah-Hartman
@ 2023-07-16 19:42 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 041/591] clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe Greg Kroah-Hartman
` (554 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Thomas Gleixner, Mukesh Ojha, Steven Rostedt (Google),
Sasha Levin
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 2951580ba6adb082bb6b7154a5ecb24e7c1f7569 ]
The trace output for the HRTIMER_MODE_.*_HARD modes is seen as a number
since these modes are not decoded. The author was not aware of the fancy
decoding function which makes the life easier.
Extend decode_hrtimer_mode() with the additional HRTIMER_MODE_.*_HARD
modes.
Fixes: ae6683d815895 ("hrtimer: Introduce HARD expiry mode")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Link: https://lore.kernel.org/r/20230418143854.8vHWQKLM@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/trace/events/timer.h | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h
index 3e8619c72f774..b4bc2828fa09f 100644
--- a/include/trace/events/timer.h
+++ b/include/trace/events/timer.h
@@ -158,7 +158,11 @@ DEFINE_EVENT(timer_class, timer_cancel,
{ HRTIMER_MODE_ABS_SOFT, "ABS|SOFT" }, \
{ HRTIMER_MODE_REL_SOFT, "REL|SOFT" }, \
{ HRTIMER_MODE_ABS_PINNED_SOFT, "ABS|PINNED|SOFT" }, \
- { HRTIMER_MODE_REL_PINNED_SOFT, "REL|PINNED|SOFT" })
+ { HRTIMER_MODE_REL_PINNED_SOFT, "REL|PINNED|SOFT" }, \
+ { HRTIMER_MODE_ABS_HARD, "ABS|HARD" }, \
+ { HRTIMER_MODE_REL_HARD, "REL|HARD" }, \
+ { HRTIMER_MODE_ABS_PINNED_HARD, "ABS|PINNED|HARD" }, \
+ { HRTIMER_MODE_REL_PINNED_HARD, "REL|PINNED|HARD" })
/**
* hrtimer_init - called when the hrtimer is initialized
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 041/591] clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2023-07-16 19:42 ` [PATCH 6.1 040/591] tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 042/591] PM: domains: fix integer overflow issues in genpd_parse_state() Greg Kroah-Hartman
` (553 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Feng Mingxi, Dongliang Mu,
Michal Simek, Daniel Lezcano, Sasha Levin
From: Feng Mingxi <m202271825@hust.edu.cn>
[ Upstream commit 8b5bf64c89c7100c921bd807ba39b2eb003061ab ]
Smatch reports:
drivers/clocksource/timer-cadence-ttc.c:529 ttc_timer_probe()
warn: 'timer_baseaddr' from of_iomap() not released on lines: 498,508,516.
timer_baseaddr may have the problem of not being released after use,
I replaced it with the devm_of_iomap() function and added the clk_put()
function to cleanup the "clk_ce" and "clk_cs".
Fixes: e932900a3279 ("arm: zynq: Use standard timer binding")
Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error")
Signed-off-by: Feng Mingxi <m202271825@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Acked-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20230425065611.702917-1-m202271825@hust.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-cadence-ttc.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/clocksource/timer-cadence-ttc.c b/drivers/clocksource/timer-cadence-ttc.c
index 4efd0cf3b602d..0d52e28fea4de 100644
--- a/drivers/clocksource/timer-cadence-ttc.c
+++ b/drivers/clocksource/timer-cadence-ttc.c
@@ -486,10 +486,10 @@ static int __init ttc_timer_probe(struct platform_device *pdev)
* and use it. Note that the event timer uses the interrupt and it's the
* 2nd TTC hence the irq_of_parse_and_map(,1)
*/
- timer_baseaddr = of_iomap(timer, 0);
- if (!timer_baseaddr) {
+ timer_baseaddr = devm_of_iomap(&pdev->dev, timer, 0, NULL);
+ if (IS_ERR(timer_baseaddr)) {
pr_err("ERROR: invalid timer base address\n");
- return -ENXIO;
+ return PTR_ERR(timer_baseaddr);
}
irq = irq_of_parse_and_map(timer, 1);
@@ -513,20 +513,27 @@ static int __init ttc_timer_probe(struct platform_device *pdev)
clk_ce = of_clk_get(timer, clksel);
if (IS_ERR(clk_ce)) {
pr_err("ERROR: timer input clock not found\n");
- return PTR_ERR(clk_ce);
+ ret = PTR_ERR(clk_ce);
+ goto put_clk_cs;
}
ret = ttc_setup_clocksource(clk_cs, timer_baseaddr, timer_width);
if (ret)
- return ret;
+ goto put_clk_ce;
ret = ttc_setup_clockevent(clk_ce, timer_baseaddr + 4, irq);
if (ret)
- return ret;
+ goto put_clk_ce;
pr_info("%pOFn #0 at %p, irq=%d\n", timer, timer_baseaddr, irq);
return 0;
+
+put_clk_ce:
+ clk_put(clk_ce);
+put_clk_cs:
+ clk_put(clk_cs);
+ return ret;
}
static const struct of_device_id ttc_timer_of_match[] = {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 042/591] PM: domains: fix integer overflow issues in genpd_parse_state()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 041/591] clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 043/591] perf/arm-cmn: Fix DTC reset Greg Kroah-Hartman
` (552 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich, Ulf Hansson,
Rafael J. Wysocki, Sasha Levin
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit e5d1c8722083f0332dcd3c85fa1273d85fb6bed8 ]
Currently, while calculating residency and latency values, right
operands may overflow if resulting values are big enough.
To prevent this, albeit unlikely case, play it safe and convert
right operands to left ones' type s64.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 30f604283e05 ("PM / Domains: Allow domain power states to be read from DT")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/power/domain.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index b411201f75bfb..b33fc322e0928 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -2923,10 +2923,10 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state,
err = of_property_read_u32(state_node, "min-residency-us", &residency);
if (!err)
- genpd_state->residency_ns = 1000 * residency;
+ genpd_state->residency_ns = 1000LL * residency;
- genpd_state->power_on_latency_ns = 1000 * exit_latency;
- genpd_state->power_off_latency_ns = 1000 * entry_latency;
+ genpd_state->power_on_latency_ns = 1000LL * exit_latency;
+ genpd_state->power_off_latency_ns = 1000LL * entry_latency;
genpd_state->fwnode = &state_node->fwnode;
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 043/591] perf/arm-cmn: Fix DTC reset
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 042/591] PM: domains: fix integer overflow issues in genpd_parse_state() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 044/591] x86/mm: Allow guest.enc_status_change_prepare() to fail Greg Kroah-Hartman
` (551 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geoff Blake, Robin Murphy,
Will Deacon, Sasha Levin
From: Robin Murphy <robin.murphy@arm.com>
[ Upstream commit 71746c995cac92fcf6a65661b51211cf2009d7f0 ]
It turns out that my naive DTC reset logic fails to work as intended,
since, after checking with the hardware designers, the PMU actually
needs to be fully enabled in order to correctly clear any pending
overflows. Therefore, invert the sequence to start with turning on both
enables so that we can reliably get the DTCs into a known state, then
moving to our normal counters-stopped state from there. Since all the
DTM counters have already been unpaired during the initial discovery
pass, we just need to additionally reset the cycle counters to ensure
that no other unexpected overflows occur during this period.
Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver")
Reported-by: Geoff Blake <blakgeof@amazon.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/0ea4559261ea394f827c9aee5168c77a60aaee03.1684946389.git.robin.murphy@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/arm-cmn.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
index ff86075edca48..90008e24d1cc7 100644
--- a/drivers/perf/arm-cmn.c
+++ b/drivers/perf/arm-cmn.c
@@ -1898,9 +1898,10 @@ static int arm_cmn_init_dtc(struct arm_cmn *cmn, struct arm_cmn_node *dn, int id
if (dtc->irq < 0)
return dtc->irq;
- writel_relaxed(0, dtc->base + CMN_DT_PMCR);
+ writel_relaxed(CMN_DT_DTC_CTL_DT_EN, dtc->base + CMN_DT_DTC_CTL);
+ writel_relaxed(CMN_DT_PMCR_PMU_EN | CMN_DT_PMCR_OVFL_INTR_EN, dtc->base + CMN_DT_PMCR);
+ writeq_relaxed(0, dtc->base + CMN_DT_PMCCNTR);
writel_relaxed(0x1ff, dtc->base + CMN_DT_PMOVSR_CLR);
- writel_relaxed(CMN_DT_PMCR_OVFL_INTR_EN, dtc->base + CMN_DT_PMCR);
return 0;
}
@@ -1960,7 +1961,7 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn)
dn->type = CMN_TYPE_CCLA;
}
- writel_relaxed(CMN_DT_DTC_CTL_DT_EN, cmn->dtc[0].base + CMN_DT_DTC_CTL);
+ arm_cmn_set_state(cmn, CMN_STATE_DISABLED);
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 044/591] x86/mm: Allow guest.enc_status_change_prepare() to fail
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 043/591] perf/arm-cmn: Fix DTC reset Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 045/591] x86/tdx: Fix race between set_memory_encrypted() and load_unaligned_zeropad() Greg Kroah-Hartman
` (550 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kirill A. Shutemov, Dave Hansen,
Kuppuswamy Sathyanarayanan, Sasha Levin
From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
[ Upstream commit 3f6819dd192ef4f0c568ec3e9d6d408b3fa1ad3d ]
TDX code is going to provide guest.enc_status_change_prepare() that is
able to fail. TDX will use the call to convert the GPA range from shared
to private. This operation can fail.
Add a way to return an error from the callback.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Link: https://lore.kernel.org/all/20230606095622.1939-2-kirill.shutemov%40linux.intel.com
Stable-dep-of: 195edce08b63 ("x86/tdx: Fix race between set_memory_encrypted() and load_unaligned_zeropad()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/x86_init.h | 2 +-
arch/x86/kernel/x86_init.c | 2 +-
arch/x86/mm/mem_encrypt_amd.c | 4 +++-
arch/x86/mm/pat/set_memory.c | 3 ++-
4 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
index c1c8c581759d6..034e62838b284 100644
--- a/arch/x86/include/asm/x86_init.h
+++ b/arch/x86/include/asm/x86_init.h
@@ -150,7 +150,7 @@ struct x86_init_acpi {
* @enc_cache_flush_required Returns true if a cache flush is needed before changing page encryption status
*/
struct x86_guest {
- void (*enc_status_change_prepare)(unsigned long vaddr, int npages, bool enc);
+ bool (*enc_status_change_prepare)(unsigned long vaddr, int npages, bool enc);
bool (*enc_status_change_finish)(unsigned long vaddr, int npages, bool enc);
bool (*enc_tlb_flush_required)(bool enc);
bool (*enc_cache_flush_required)(void);
diff --git a/arch/x86/kernel/x86_init.c b/arch/x86/kernel/x86_init.c
index 10622cf2b30f4..41e5b4cb898c3 100644
--- a/arch/x86/kernel/x86_init.c
+++ b/arch/x86/kernel/x86_init.c
@@ -130,7 +130,7 @@ struct x86_cpuinit_ops x86_cpuinit = {
static void default_nmi_init(void) { };
-static void enc_status_change_prepare_noop(unsigned long vaddr, int npages, bool enc) { }
+static bool enc_status_change_prepare_noop(unsigned long vaddr, int npages, bool enc) { return true; }
static bool enc_status_change_finish_noop(unsigned long vaddr, int npages, bool enc) { return false; }
static bool enc_tlb_flush_required_noop(bool enc) { return false; }
static bool enc_cache_flush_required_noop(void) { return false; }
diff --git a/arch/x86/mm/mem_encrypt_amd.c b/arch/x86/mm/mem_encrypt_amd.c
index 9c4d8dbcb1296..ff6c0462beee7 100644
--- a/arch/x86/mm/mem_encrypt_amd.c
+++ b/arch/x86/mm/mem_encrypt_amd.c
@@ -319,7 +319,7 @@ static void enc_dec_hypercall(unsigned long vaddr, int npages, bool enc)
#endif
}
-static void amd_enc_status_change_prepare(unsigned long vaddr, int npages, bool enc)
+static bool amd_enc_status_change_prepare(unsigned long vaddr, int npages, bool enc)
{
/*
* To maintain the security guarantees of SEV-SNP guests, make sure
@@ -327,6 +327,8 @@ static void amd_enc_status_change_prepare(unsigned long vaddr, int npages, bool
*/
if (cc_platform_has(CC_ATTR_GUEST_SEV_SNP) && !enc)
snp_set_memory_shared(vaddr, npages);
+
+ return true;
}
/* Return true unconditionally: return value doesn't matter for the SEV side */
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index 2e5a045731dec..5f0ce77a259d8 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -2096,7 +2096,8 @@ static int __set_memory_enc_pgtable(unsigned long addr, int numpages, bool enc)
cpa_flush(&cpa, x86_platform.guest.enc_cache_flush_required());
/* Notify hypervisor that we are about to set/clr encryption attribute. */
- x86_platform.guest.enc_status_change_prepare(addr, numpages, enc);
+ if (!x86_platform.guest.enc_status_change_prepare(addr, numpages, enc))
+ return -EIO;
ret = __change_page_attr_set_clr(&cpa, 1);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 045/591] x86/tdx: Fix race between set_memory_encrypted() and load_unaligned_zeropad()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 044/591] x86/mm: Allow guest.enc_status_change_prepare() to fail Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 046/591] drivers/perf: hisi: Dont migrate perf to the CPU going to teardown Greg Kroah-Hartman
` (549 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kirill A. Shutemov, Dave Hansen,
Kuppuswamy Sathyanarayanan, Sasha Levin
From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
[ Upstream commit 195edce08b63d293377f615f4f7f086715d2d212 ]
tl;dr: There is a race in the TDX private<=>shared conversion code
which could kill the TDX guest. Fix it by changing conversion
ordering to eliminate the window.
TDX hardware maintains metadata to track which pages are private and
shared. Additionally, TDX guests use the guest x86 page tables to
specify whether a given mapping is intended to be private or shared.
Bad things happen when the intent and metadata do not match.
So there are two thing in play:
1. "the page" -- the physical TDX page metadata
2. "the mapping" -- the guest-controlled x86 page table intent
For instance, an unrecoverable exit to VMM occurs if a guest touches a
private mapping that points to a shared physical page.
In summary:
* Private mapping => Private Page == OK (obviously)
* Shared mapping => Shared Page == OK (obviously)
* Private mapping => Shared Page == BIG BOOM!
* Shared mapping => Private Page == OK-ish
(It will read generate a recoverable #VE via handle_mmio())
Enter load_unaligned_zeropad(). It can touch memory that is adjacent but
otherwise unrelated to the memory it needs to touch. It will cause one
of those unrecoverable exits (aka. BIG BOOM) if it blunders into a
shared mapping pointing to a private page.
This is a problem when __set_memory_enc_pgtable() converts pages from
shared to private. It first changes the mapping and second modifies
the TDX page metadata. It's moving from:
* Shared mapping => Shared Page == OK
to:
* Private mapping => Shared Page == BIG BOOM!
This means that there is a window with a shared mapping pointing to a
private page where load_unaligned_zeropad() can strike.
Add a TDX handler for guest.enc_status_change_prepare(). This converts
the page from shared to private *before* the page becomes private. This
ensures that there is never a private mapping to a shared page.
Leave a guest.enc_status_change_finish() in place but only use it for
private=>shared conversions. This will delay updating the TDX metadata
marking the page private until *after* the mapping matches the metadata.
This also ensures that there is never a private mapping to a shared page.
[ dhansen: rewrite changelog ]
Fixes: 7dbde7631629 ("x86/mm/cpa: Add support for TDX shared memory")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Link: https://lore.kernel.org/all/20230606095622.1939-3-kirill.shutemov%40linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/coco/tdx/tdx.c | 51 ++++++++++++++++++++++++++++++++++++++---
1 file changed, 48 insertions(+), 3 deletions(-)
diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
index b8998cf0508a6..8a1d48b8c2a3e 100644
--- a/arch/x86/coco/tdx/tdx.c
+++ b/arch/x86/coco/tdx/tdx.c
@@ -756,6 +756,30 @@ static bool tdx_enc_status_changed(unsigned long vaddr, int numpages, bool enc)
return true;
}
+static bool tdx_enc_status_change_prepare(unsigned long vaddr, int numpages,
+ bool enc)
+{
+ /*
+ * Only handle shared->private conversion here.
+ * See the comment in tdx_early_init().
+ */
+ if (enc)
+ return tdx_enc_status_changed(vaddr, numpages, enc);
+ return true;
+}
+
+static bool tdx_enc_status_change_finish(unsigned long vaddr, int numpages,
+ bool enc)
+{
+ /*
+ * Only handle private->shared conversion here.
+ * See the comment in tdx_early_init().
+ */
+ if (!enc)
+ return tdx_enc_status_changed(vaddr, numpages, enc);
+ return true;
+}
+
void __init tdx_early_init(void)
{
u64 cc_mask;
@@ -780,9 +804,30 @@ void __init tdx_early_init(void)
*/
physical_mask &= cc_mask - 1;
- x86_platform.guest.enc_cache_flush_required = tdx_cache_flush_required;
- x86_platform.guest.enc_tlb_flush_required = tdx_tlb_flush_required;
- x86_platform.guest.enc_status_change_finish = tdx_enc_status_changed;
+ /*
+ * The kernel mapping should match the TDX metadata for the page.
+ * load_unaligned_zeropad() can touch memory *adjacent* to that which is
+ * owned by the caller and can catch even _momentary_ mismatches. Bad
+ * things happen on mismatch:
+ *
+ * - Private mapping => Shared Page == Guest shutdown
+ * - Shared mapping => Private Page == Recoverable #VE
+ *
+ * guest.enc_status_change_prepare() converts the page from
+ * shared=>private before the mapping becomes private.
+ *
+ * guest.enc_status_change_finish() converts the page from
+ * private=>shared after the mapping becomes private.
+ *
+ * In both cases there is a temporary shared mapping to a private page,
+ * which can result in a #VE. But, there is never a private mapping to
+ * a shared page.
+ */
+ x86_platform.guest.enc_status_change_prepare = tdx_enc_status_change_prepare;
+ x86_platform.guest.enc_status_change_finish = tdx_enc_status_change_finish;
+
+ x86_platform.guest.enc_cache_flush_required = tdx_cache_flush_required;
+ x86_platform.guest.enc_tlb_flush_required = tdx_tlb_flush_required;
pr_info("Guest detected\n");
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 046/591] drivers/perf: hisi: Dont migrate perf to the CPU going to teardown
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 045/591] x86/tdx: Fix race between set_memory_encrypted() and load_unaligned_zeropad() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 047/591] powercap: RAPL: Fix CONFIG_IOSF_MBI dependency Greg Kroah-Hartman
` (548 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junhao He, Jonathan Cameron,
Yicong Yang, Mark Rutland, Will Deacon, Sasha Levin
From: Junhao He <hejunhao3@huawei.com>
[ Upstream commit 7a6a9f1c5a0a875a421db798d4b2ee022dc1ee1a ]
The driver needs to migrate the perf context if the current using CPU going
to teardown. By the time calling the cpuhp::teardown() callback the
cpu_online_mask() hasn't updated yet and still includes the CPU going to
teardown. In current driver's implementation we may migrate the context
to the teardown CPU and leads to the below calltrace:
...
[ 368.104662][ T932] task:cpuhp/0 state:D stack: 0 pid: 15 ppid: 2 flags:0x00000008
[ 368.113699][ T932] Call trace:
[ 368.116834][ T932] __switch_to+0x7c/0xbc
[ 368.120924][ T932] __schedule+0x338/0x6f0
[ 368.125098][ T932] schedule+0x50/0xe0
[ 368.128926][ T932] schedule_preempt_disabled+0x18/0x24
[ 368.134229][ T932] __mutex_lock.constprop.0+0x1d4/0x5dc
[ 368.139617][ T932] __mutex_lock_slowpath+0x1c/0x30
[ 368.144573][ T932] mutex_lock+0x50/0x60
[ 368.148579][ T932] perf_pmu_migrate_context+0x84/0x2b0
[ 368.153884][ T932] hisi_pcie_pmu_offline_cpu+0x90/0xe0 [hisi_pcie_pmu]
[ 368.160579][ T932] cpuhp_invoke_callback+0x2a0/0x650
[ 368.165707][ T932] cpuhp_thread_fun+0xe4/0x190
[ 368.170316][ T932] smpboot_thread_fn+0x15c/0x1a0
[ 368.175099][ T932] kthread+0x108/0x13c
[ 368.179012][ T932] ret_from_fork+0x10/0x18
...
Use function cpumask_any_but() to find one correct active cpu to fixes
this issue.
Fixes: 8404b0fbc7fb ("drivers/perf: hisi: Add driver for HiSilicon PCIe PMU")
Signed-off-by: Junhao He <hejunhao3@huawei.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Yicong Yang <yangyicong@hisilicon.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Link: https://lore.kernel.org/r/20230608114326.27649-1-hejunhao3@huawei.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/hisilicon/hisi_pcie_pmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c
index 071e63d9a9ac6..b61f1f9aba214 100644
--- a/drivers/perf/hisilicon/hisi_pcie_pmu.c
+++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c
@@ -672,7 +672,7 @@ static int hisi_pcie_pmu_offline_cpu(unsigned int cpu, struct hlist_node *node)
pcie_pmu->on_cpu = -1;
/* Choose a new CPU from all online cpus. */
- target = cpumask_first(cpu_online_mask);
+ target = cpumask_any_but(cpu_online_mask, cpu);
if (target >= nr_cpu_ids) {
pci_err(pcie_pmu->pdev, "There is no CPU to set\n");
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 047/591] powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 046/591] drivers/perf: hisi: Dont migrate perf to the CPU going to teardown Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 048/591] PM: domains: Move the verification of in-params from genpd_add_device() Greg Kroah-Hartman
` (547 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Zhang Rui,
Rafael J. Wysocki, Sasha Levin
From: Zhang Rui <rui.zhang@intel.com>
[ Upstream commit 4658fe81b3f8afe8adf37734ec5fe595d90415c6 ]
After commit 3382388d7148 ("intel_rapl: abstract RAPL common code"),
accessing to IOSF_MBI interface is done in the RAPL common code.
Thus it is the CONFIG_INTEL_RAPL_CORE that has dependency of
CONFIG_IOSF_MBI, while CONFIG_INTEL_RAPL_MSR does not.
This problem was not exposed previously because all the previous RAPL
common code users, aka, the RAPL MSR and MMIO I/F drivers, have
CONFIG_IOSF_MBI selected.
Fix the CONFIG_IOSF_MBI dependency in RAPL code. This also fixes a build
time failure when the RAPL TPMI I/F driver is introduced without
selecting CONFIG_IOSF_MBI.
x86_64-linux-ld: vmlinux.o: in function `set_floor_freq_atom':
intel_rapl_common.c:(.text+0x2dac9b8): undefined reference to `iosf_mbi_write'
x86_64-linux-ld: intel_rapl_common.c:(.text+0x2daca66): undefined reference to `iosf_mbi_read'
Reference to iosf_mbi.h is also removed from the RAPL MSR I/F driver.
Fixes: 3382388d7148 ("intel_rapl: abstract RAPL common code")
Reported-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/all/20230601213246.3271412-1-arnd@kernel.org
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/powercap/Kconfig | 4 +++-
drivers/powercap/intel_rapl_msr.c | 1 -
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/powercap/Kconfig b/drivers/powercap/Kconfig
index 515e3ceb3393a..863e240b37e01 100644
--- a/drivers/powercap/Kconfig
+++ b/drivers/powercap/Kconfig
@@ -18,10 +18,12 @@ if POWERCAP
# Client driver configurations go here.
config INTEL_RAPL_CORE
tristate
+ depends on PCI
+ select IOSF_MBI
config INTEL_RAPL
tristate "Intel RAPL Support via MSR Interface"
- depends on X86 && IOSF_MBI
+ depends on X86 && PCI
select INTEL_RAPL_CORE
help
This enables support for the Intel Running Average Power Limit (RAPL)
diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c
index bc6adda588835..65adb4cbaaf8e 100644
--- a/drivers/powercap/intel_rapl_msr.c
+++ b/drivers/powercap/intel_rapl_msr.c
@@ -22,7 +22,6 @@
#include <linux/processor.h>
#include <linux/platform_device.h>
-#include <asm/iosf_mbi.h>
#include <asm/cpu_device_id.h>
#include <asm/intel-family.h>
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 048/591] PM: domains: Move the verification of in-params from genpd_add_device()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 047/591] powercap: RAPL: Fix CONFIG_IOSF_MBI dependency Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 049/591] ARM: 9303/1: kprobes: avoid missing-declaration warnings Greg Kroah-Hartman
` (546 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Ulf Hansson,
Rafael J. Wysocki, Sasha Levin
From: Ulf Hansson <ulf.hansson@linaro.org>
[ Upstream commit 4384a70c8813e8573d1841fd94eee873f80a7e1a ]
Commit f38d1a6d0025 ("PM: domains: Allocate governor data dynamically
based on a genpd governor") started to use the in-parameters in
genpd_add_device(), without first doing a verification of them.
This isn't really a big problem, as most callers do a verification already.
Therefore, let's drop the verification from genpd_add_device() and make
sure all the callers take care of it instead.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Fixes: f38d1a6d0025 ("PM: domains: Allocate governor data dynamically based on a genpd governor")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/power/domain.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index b33fc322e0928..56ceba4698024 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -1624,9 +1624,6 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
dev_dbg(dev, "%s()\n", __func__);
- if (IS_ERR_OR_NULL(genpd) || IS_ERR_OR_NULL(dev))
- return -EINVAL;
-
gpd_data = genpd_alloc_dev_data(dev, gd);
if (IS_ERR(gpd_data))
return PTR_ERR(gpd_data);
@@ -1668,6 +1665,9 @@ int pm_genpd_add_device(struct generic_pm_domain *genpd, struct device *dev)
{
int ret;
+ if (!genpd || !dev)
+ return -EINVAL;
+
mutex_lock(&gpd_list_lock);
ret = genpd_add_device(genpd, dev, dev);
mutex_unlock(&gpd_list_lock);
@@ -2514,6 +2514,9 @@ int of_genpd_add_device(struct of_phandle_args *genpdspec, struct device *dev)
struct generic_pm_domain *genpd;
int ret;
+ if (!dev)
+ return -EINVAL;
+
mutex_lock(&gpd_list_lock);
genpd = genpd_get_from_provider(genpdspec);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 049/591] ARM: 9303/1: kprobes: avoid missing-declaration warnings
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 048/591] PM: domains: Move the verification of in-params from genpd_add_device() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 050/591] cpufreq: intel_pstate: Fix energy_performance_preference for passive Greg Kroah-Hartman
` (545 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google), Kees Cook,
Arnd Bergmann, Russell King (Oracle), Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 1b9c3ddcec6a55e15d3e38e7405e2d078db02020 ]
checker_stack_use_t32strd() and kprobe_handler() can be made static since
they are not used from other files, while coverage_start_registers()
and __kprobes_test_case() are used from assembler code, and just need
a declaration to avoid a warning with the global definition.
arch/arm/probes/kprobes/checkers-common.c:43:18: error: no previous prototype for 'checker_stack_use_t32strd'
arch/arm/probes/kprobes/core.c:236:16: error: no previous prototype for 'kprobe_handler'
arch/arm/probes/kprobes/test-core.c:723:10: error: no previous prototype for 'coverage_start_registers'
arch/arm/probes/kprobes/test-core.c:918:14: error: no previous prototype for '__kprobes_test_case_start'
arch/arm/probes/kprobes/test-core.c:952:14: error: no previous prototype for '__kprobes_test_case_end_16'
arch/arm/probes/kprobes/test-core.c:967:14: error: no previous prototype for '__kprobes_test_case_end_32'
Fixes: 6624cf651f1a ("ARM: kprobes: collects stack consumption for store instructions")
Fixes: 454f3e132d05 ("ARM/kprobes: Remove jprobe arm implementation")
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/probes/kprobes/checkers-common.c | 2 +-
arch/arm/probes/kprobes/core.c | 2 +-
arch/arm/probes/kprobes/opt-arm.c | 2 --
arch/arm/probes/kprobes/test-core.c | 2 +-
arch/arm/probes/kprobes/test-core.h | 4 ++++
5 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/arch/arm/probes/kprobes/checkers-common.c b/arch/arm/probes/kprobes/checkers-common.c
index 4d720990cf2a3..eba7ac4725c02 100644
--- a/arch/arm/probes/kprobes/checkers-common.c
+++ b/arch/arm/probes/kprobes/checkers-common.c
@@ -40,7 +40,7 @@ enum probes_insn checker_stack_use_imm_0xx(probes_opcode_t insn,
* Different from other insn uses imm8, the real addressing offset of
* STRD in T32 encoding should be imm8 * 4. See ARMARM description.
*/
-enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn,
+static enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn,
struct arch_probes_insn *asi,
const struct decode_header *h)
{
diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c
index 9090c3a74dcce..d8238da095df7 100644
--- a/arch/arm/probes/kprobes/core.c
+++ b/arch/arm/probes/kprobes/core.c
@@ -233,7 +233,7 @@ singlestep(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *kcb)
* kprobe, and that level is reserved for user kprobe handlers, so we can't
* risk encountering a new kprobe in an interrupt handler.
*/
-void __kprobes kprobe_handler(struct pt_regs *regs)
+static void __kprobes kprobe_handler(struct pt_regs *regs)
{
struct kprobe *p, *cur;
struct kprobe_ctlblk *kcb;
diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c
index dbef34ed933f2..7f65048380ca5 100644
--- a/arch/arm/probes/kprobes/opt-arm.c
+++ b/arch/arm/probes/kprobes/opt-arm.c
@@ -145,8 +145,6 @@ __arch_remove_optimized_kprobe(struct optimized_kprobe *op, int dirty)
}
}
-extern void kprobe_handler(struct pt_regs *regs);
-
static void
optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs)
{
diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c
index c562832b86272..171c7076b89f4 100644
--- a/arch/arm/probes/kprobes/test-core.c
+++ b/arch/arm/probes/kprobes/test-core.c
@@ -720,7 +720,7 @@ static const char coverage_register_lookup[16] = {
[REG_TYPE_NOSPPCX] = COVERAGE_ANY_REG | COVERAGE_SP,
};
-unsigned coverage_start_registers(const struct decode_header *h)
+static unsigned coverage_start_registers(const struct decode_header *h)
{
unsigned regs = 0;
int i;
diff --git a/arch/arm/probes/kprobes/test-core.h b/arch/arm/probes/kprobes/test-core.h
index 56ad3c0aaeeac..c7297037c1623 100644
--- a/arch/arm/probes/kprobes/test-core.h
+++ b/arch/arm/probes/kprobes/test-core.h
@@ -454,3 +454,7 @@ void kprobe_thumb32_test_cases(void);
#else
void kprobe_arm_test_cases(void);
#endif
+
+void __kprobes_test_case_start(void);
+void __kprobes_test_case_end_16(void);
+void __kprobes_test_case_end_32(void);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 050/591] cpufreq: intel_pstate: Fix energy_performance_preference for passive
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 049/591] ARM: 9303/1: kprobes: avoid missing-declaration warnings Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 051/591] thermal/drivers/mediatek: Relocate driver to mediatek folder Greg Kroah-Hartman
` (544 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Neronin, Tero Kristo,
Rafael J. Wysocki, Sasha Levin
From: Tero Kristo <tero.kristo@linux.intel.com>
[ Upstream commit 03f44ffb3d5be2fceda375d92c70ab6de4df7081 ]
If the intel_pstate driver is set to passive mode, then writing the
same value to the energy_performance_preference sysfs twice will fail.
This is caused by the wrong return value used (index of the matched
energy_perf_string), instead of the length of the passed in parameter.
Fix by forcing the internal return value to zero when the same
preference is passed in by user. This same issue is not present when
active mode is used for the driver.
Fixes: f6ebbcf08f37 ("cpufreq: intel_pstate: Implement passive mode with HWP enabled")
Reported-by: Niklas Neronin <niklas.neronin@intel.com>
Signed-off-by: Tero Kristo <tero.kristo@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/intel_pstate.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 6ff73c30769fa..818eb2503cdd5 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -837,6 +837,8 @@ static ssize_t store_energy_performance_preference(
err = cpufreq_start_governor(policy);
if (!ret)
ret = err;
+ } else {
+ ret = 0;
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 051/591] thermal/drivers/mediatek: Relocate driver to mediatek folder
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 050/591] cpufreq: intel_pstate: Fix energy_performance_preference for passive Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 052/591] thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe() Greg Kroah-Hartman
` (543 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balsam CHIHI,
AngeloGioacchino Del Regno, Daniel Lezcano, Rafael J. Wysocki,
Sasha Levin
From: Balsam CHIHI <bchihi@baylibre.com>
[ Upstream commit fad399ebdd67f602f306b524e6f62c3570943a48 ]
Add MediaTek proprietary folder to upstream more thermal zone and cooler
drivers, relocate the original thermal controller driver to it, and rename it
as "auxadc_thermal.c" to show its purpose more clearly.
Signed-off-by: Balsam CHIHI <bchihi@baylibre.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20230209105628.50294-2-bchihi@baylibre.com
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 86edac7d3888 ("Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe"")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/Kconfig | 14 ++++---------
drivers/thermal/Makefile | 2 +-
drivers/thermal/mediatek/Kconfig | 21 +++++++++++++++++++
drivers/thermal/mediatek/Makefile | 1 +
.../auxadc_thermal.c} | 2 +-
5 files changed, 28 insertions(+), 12 deletions(-)
create mode 100644 drivers/thermal/mediatek/Kconfig
create mode 100644 drivers/thermal/mediatek/Makefile
rename drivers/thermal/{mtk_thermal.c => mediatek/auxadc_thermal.c} (99%)
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index e052dae614ebb..d35f63daca3b7 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -412,16 +412,10 @@ config DA9062_THERMAL
zone.
Compatible with the DA9062 and DA9061 PMICs.
-config MTK_THERMAL
- tristate "Temperature sensor driver for mediatek SoCs"
- depends on ARCH_MEDIATEK || COMPILE_TEST
- depends on HAS_IOMEM
- depends on NVMEM || NVMEM=n
- depends on RESET_CONTROLLER
- default y
- help
- Enable this option if you want to have support for thermal management
- controller present in Mediatek SoCs
+menu "Mediatek thermal drivers"
+depends on ARCH_MEDIATEK || COMPILE_TEST
+source "drivers/thermal/mediatek/Kconfig"
+endmenu
config AMLOGIC_THERMAL
tristate "Amlogic Thermal Support"
diff --git a/drivers/thermal/Makefile b/drivers/thermal/Makefile
index 2506c6c8ca83a..766ce38ff4f33 100644
--- a/drivers/thermal/Makefile
+++ b/drivers/thermal/Makefile
@@ -55,7 +55,7 @@ obj-y += st/
obj-y += qcom/
obj-y += tegra/
obj-$(CONFIG_HISI_THERMAL) += hisi_thermal.o
-obj-$(CONFIG_MTK_THERMAL) += mtk_thermal.o
+obj-y += mediatek/
obj-$(CONFIG_GENERIC_ADC_THERMAL) += thermal-generic-adc.o
obj-$(CONFIG_UNIPHIER_THERMAL) += uniphier_thermal.o
obj-$(CONFIG_AMLOGIC_THERMAL) += amlogic_thermal.o
diff --git a/drivers/thermal/mediatek/Kconfig b/drivers/thermal/mediatek/Kconfig
new file mode 100644
index 0000000000000..7558a847d4e92
--- /dev/null
+++ b/drivers/thermal/mediatek/Kconfig
@@ -0,0 +1,21 @@
+config MTK_THERMAL
+ tristate "MediaTek thermal drivers"
+ depends on THERMAL_OF
+ help
+ This is the option for MediaTek thermal software solutions.
+ Please enable corresponding options to get temperature
+ information from thermal sensors or turn on throttle
+ mechaisms for thermal mitigation.
+
+if MTK_THERMAL
+
+config MTK_SOC_THERMAL
+ tristate "AUXADC temperature sensor driver for MediaTek SoCs"
+ depends on HAS_IOMEM
+ help
+ Enable this option if you want to get SoC temperature
+ information for MediaTek platforms.
+ This driver configures thermal controllers to collect
+ temperature via AUXADC interface.
+
+endif
diff --git a/drivers/thermal/mediatek/Makefile b/drivers/thermal/mediatek/Makefile
new file mode 100644
index 0000000000000..53e86e30b26ff
--- /dev/null
+++ b/drivers/thermal/mediatek/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_MTK_SOC_THERMAL) += auxadc_thermal.o
diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mediatek/auxadc_thermal.c
similarity index 99%
rename from drivers/thermal/mtk_thermal.c
rename to drivers/thermal/mediatek/auxadc_thermal.c
index 8440692e3890d..b4ef57fa9183e 100644
--- a/drivers/thermal/mtk_thermal.c
+++ b/drivers/thermal/mediatek/auxadc_thermal.c
@@ -23,7 +23,7 @@
#include <linux/reset.h>
#include <linux/types.h>
-#include "thermal_hwmon.h"
+#include "../thermal_hwmon.h"
/* AUXADC Registers */
#define AUXADC_CON1_SET_V 0x008
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 052/591] thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 051/591] thermal/drivers/mediatek: Relocate driver to mediatek folder Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 053/591] rcu: Make rcu_cpu_starting() rely on interrupts being disabled Greg Kroah-Hartman
` (542 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Maxime Ripard,
Daniel Lezcano, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 89382022b370dfd34eaae9c863baa123fcd4d132 ]
Should an error occur after calling sun8i_ths_resource_init() in the probe
function, some resources need to be released, as already done in the
.remove() function.
Switch to the devm_clk_get_enabled() helper and add a new devm_action to
turn sun8i_ths_resource_init() into a fully managed function.
Move the place where reset_control_deassert() is called so that the
recommended order of reset release/clock enable steps is kept.
A64 manual states that:
3.3.6.4. Gating and reset
Make sure that the reset signal has been released before the release of
module clock gating;
This fixes the issue and removes some LoC at the same time.
Fixes: dccc5c3b6f30 ("thermal/drivers/sun8i: Add thermal driver for H6/H5/H3/A64/A83T/R40")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Maxime Ripard <maxime@cerno.tech>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/a8ae84bd2dc4b55fe428f8e20f31438bf8bb6762.1684089931.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/sun8i_thermal.c | 55 +++++++++++----------------------
1 file changed, 18 insertions(+), 37 deletions(-)
diff --git a/drivers/thermal/sun8i_thermal.c b/drivers/thermal/sun8i_thermal.c
index e64d06d1328ce..80614b6adfac5 100644
--- a/drivers/thermal/sun8i_thermal.c
+++ b/drivers/thermal/sun8i_thermal.c
@@ -319,6 +319,11 @@ static int sun8i_ths_calibrate(struct ths_device *tmdev)
return ret;
}
+static void sun8i_ths_reset_control_assert(void *data)
+{
+ reset_control_assert(data);
+}
+
static int sun8i_ths_resource_init(struct ths_device *tmdev)
{
struct device *dev = tmdev->dev;
@@ -339,47 +344,35 @@ static int sun8i_ths_resource_init(struct ths_device *tmdev)
if (IS_ERR(tmdev->reset))
return PTR_ERR(tmdev->reset);
- tmdev->bus_clk = devm_clk_get(&pdev->dev, "bus");
+ ret = reset_control_deassert(tmdev->reset);
+ if (ret)
+ return ret;
+
+ ret = devm_add_action_or_reset(dev, sun8i_ths_reset_control_assert,
+ tmdev->reset);
+ if (ret)
+ return ret;
+
+ tmdev->bus_clk = devm_clk_get_enabled(&pdev->dev, "bus");
if (IS_ERR(tmdev->bus_clk))
return PTR_ERR(tmdev->bus_clk);
}
if (tmdev->chip->has_mod_clk) {
- tmdev->mod_clk = devm_clk_get(&pdev->dev, "mod");
+ tmdev->mod_clk = devm_clk_get_enabled(&pdev->dev, "mod");
if (IS_ERR(tmdev->mod_clk))
return PTR_ERR(tmdev->mod_clk);
}
- ret = reset_control_deassert(tmdev->reset);
- if (ret)
- return ret;
-
- ret = clk_prepare_enable(tmdev->bus_clk);
- if (ret)
- goto assert_reset;
-
ret = clk_set_rate(tmdev->mod_clk, 24000000);
if (ret)
- goto bus_disable;
-
- ret = clk_prepare_enable(tmdev->mod_clk);
- if (ret)
- goto bus_disable;
+ return ret;
ret = sun8i_ths_calibrate(tmdev);
if (ret)
- goto mod_disable;
+ return ret;
return 0;
-
-mod_disable:
- clk_disable_unprepare(tmdev->mod_clk);
-bus_disable:
- clk_disable_unprepare(tmdev->bus_clk);
-assert_reset:
- reset_control_assert(tmdev->reset);
-
- return ret;
}
static int sun8i_h3_thermal_init(struct ths_device *tmdev)
@@ -530,17 +523,6 @@ static int sun8i_ths_probe(struct platform_device *pdev)
return 0;
}
-static int sun8i_ths_remove(struct platform_device *pdev)
-{
- struct ths_device *tmdev = platform_get_drvdata(pdev);
-
- clk_disable_unprepare(tmdev->mod_clk);
- clk_disable_unprepare(tmdev->bus_clk);
- reset_control_assert(tmdev->reset);
-
- return 0;
-}
-
static const struct ths_thermal_chip sun8i_a83t_ths = {
.sensor_num = 3,
.scale = 705,
@@ -642,7 +624,6 @@ MODULE_DEVICE_TABLE(of, of_ths_match);
static struct platform_driver ths_driver = {
.probe = sun8i_ths_probe,
- .remove = sun8i_ths_remove,
.driver = {
.name = "sun8i-thermal",
.of_match_table = of_ths_match,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 053/591] rcu: Make rcu_cpu_starting() rely on interrupts being disabled
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 052/591] thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 054/591] rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs Greg Kroah-Hartman
` (541 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul E. McKenney, Sasha Levin
From: Paul E. McKenney <paulmck@kernel.org>
[ Upstream commit 15d44dfa40305da1648de4bf001e91cc63148725 ]
Currently, rcu_cpu_starting() is written so that it might be invoked
with interrupts enabled. However, it is always called when interrupts
are disabled, either by rcu_init(), notify_cpu_starting(), or from a
call point prior to the call to notify_cpu_starting().
But why bother requiring that interrupts be disabled? The purpose is
to allow the rcu_data structure's ->beenonline flag to be set after all
early processing has completed for the incoming CPU, thus allowing this
flag to be used to determine when workqueues have been set up for the
incoming CPU, while still allowing this flag to be used as a diagnostic
within rcu_core().
This commit therefore makes rcu_cpu_starting() rely on interrupts being
disabled.
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Stable-dep-of: 401b0de3ae4f ("rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/tree.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index d03122f90cc48..5b5ed772f620a 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -4223,15 +4223,16 @@ int rcutree_offline_cpu(unsigned int cpu)
* Note that this function is special in that it is invoked directly
* from the incoming CPU rather than from the cpuhp_step mechanism.
* This is because this function must be invoked at a precise location.
+ * This incoming CPU must not have enabled interrupts yet.
*/
void rcu_cpu_starting(unsigned int cpu)
{
- unsigned long flags;
unsigned long mask;
struct rcu_data *rdp;
struct rcu_node *rnp;
bool newcpu;
+ lockdep_assert_irqs_disabled();
rdp = per_cpu_ptr(&rcu_data, cpu);
if (rdp->cpu_started)
return;
@@ -4239,7 +4240,6 @@ void rcu_cpu_starting(unsigned int cpu)
rnp = rdp->mynode;
mask = rdp->grpmask;
- local_irq_save(flags);
arch_spin_lock(&rcu_state.ofl_lock);
rcu_dynticks_eqs_online();
raw_spin_lock(&rcu_state.barrier_lock);
@@ -4258,17 +4258,16 @@ void rcu_cpu_starting(unsigned int cpu)
/* An incoming CPU should never be blocking a grace period. */
if (WARN_ON_ONCE(rnp->qsmask & mask)) { /* RCU waiting on incoming CPU? */
/* rcu_report_qs_rnp() *really* wants some flags to restore */
- unsigned long flags2;
+ unsigned long flags;
- local_irq_save(flags2);
+ local_irq_save(flags);
rcu_disable_urgency_upon_qs(rdp);
/* Report QS -after- changing ->qsmaskinitnext! */
- rcu_report_qs_rnp(mask, rnp, rnp->gp_seq, flags2);
+ rcu_report_qs_rnp(mask, rnp, rnp->gp_seq, flags);
} else {
raw_spin_unlock_rcu_node(rnp);
}
arch_spin_unlock(&rcu_state.ofl_lock);
- local_irq_restore(flags);
smp_mb(); /* Ensure RCU read-side usage follows above initialization. */
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 054/591] rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 053/591] rcu: Make rcu_cpu_starting() rely on interrupts being disabled Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 055/591] rcutorture: Correct name of use_softirq module parameter Greg Kroah-Hartman
` (540 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tejun Heo, Paul E. McKenney,
Sasha Levin
From: Paul E. McKenney <paulmck@kernel.org>
[ Upstream commit 401b0de3ae4fa49d1014c8941e26d9a25f37e7cf ]
The rcu_tasks_invoke_cbs() function relies on queue_work_on() to silently
fall back to WORK_CPU_UNBOUND when the specified CPU is offline. However,
the queue_work_on() function's silent fallback mechanism relies on that
CPU having been online at some time in the past. When queue_work_on()
is passed a CPU that has never been online, workqueue lockups ensue,
which can be bad for your kernel's general health and well-being.
This commit therefore checks whether a given CPU has ever been online,
and, if not substitutes WORK_CPU_UNBOUND in the subsequent call to
queue_work_on(). Why not simply omit the queue_work_on() call entirely?
Because this function is flooding callback-invocation notifications
to all CPUs, and must deal with possibilities that include a sparse
cpu_possible_mask.
This commit also moves the setting of the rcu_data structure's
->beenonline field to rcu_cpu_starting(), which executes on the
incoming CPU before that CPU has ever enabled interrupts. This ensures
that the required workqueues are present. In addition, because the
incoming CPU has not yet enabled its interrupts, there cannot yet have
been any softirq handlers running on this CPU, which means that the
WARN_ON_ONCE(!rdp->beenonline) within the RCU_SOFTIRQ handler cannot
have triggered yet.
Fixes: d363f833c6d88 ("rcu-tasks: Use workqueues for multiple rcu_tasks_invoke_cbs() invocations")
Reported-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/rcu.h | 6 ++++++
kernel/rcu/tasks.h | 7 +++++--
kernel/rcu/tree.c | 12 +++++++++++-
3 files changed, 22 insertions(+), 3 deletions(-)
diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h
index be5979da07f59..48d8f754b730e 100644
--- a/kernel/rcu/rcu.h
+++ b/kernel/rcu/rcu.h
@@ -583,4 +583,10 @@ void show_rcu_tasks_trace_gp_kthread(void);
static inline void show_rcu_tasks_trace_gp_kthread(void) {}
#endif
+#ifdef CONFIG_TINY_RCU
+static inline bool rcu_cpu_beenfullyonline(int cpu) { return true; }
+#else
+bool rcu_cpu_beenfullyonline(int cpu);
+#endif
+
#endif /* __LINUX_RCU_H */
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index c8409601fec38..df968321feada 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -455,6 +455,7 @@ static void rcu_tasks_invoke_cbs(struct rcu_tasks *rtp, struct rcu_tasks_percpu
{
int cpu;
int cpunext;
+ int cpuwq;
unsigned long flags;
int len;
struct rcu_head *rhp;
@@ -465,11 +466,13 @@ static void rcu_tasks_invoke_cbs(struct rcu_tasks *rtp, struct rcu_tasks_percpu
cpunext = cpu * 2 + 1;
if (cpunext < smp_load_acquire(&rtp->percpu_dequeue_lim)) {
rtpcp_next = per_cpu_ptr(rtp->rtpcpu, cpunext);
- queue_work_on(cpunext, system_wq, &rtpcp_next->rtp_work);
+ cpuwq = rcu_cpu_beenfullyonline(cpunext) ? cpunext : WORK_CPU_UNBOUND;
+ queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work);
cpunext++;
if (cpunext < smp_load_acquire(&rtp->percpu_dequeue_lim)) {
rtpcp_next = per_cpu_ptr(rtp->rtpcpu, cpunext);
- queue_work_on(cpunext, system_wq, &rtpcp_next->rtp_work);
+ cpuwq = rcu_cpu_beenfullyonline(cpunext) ? cpunext : WORK_CPU_UNBOUND;
+ queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work);
}
}
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 5b5ed772f620a..917a1e43f7839 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -4138,7 +4138,6 @@ int rcutree_prepare_cpu(unsigned int cpu)
*/
rnp = rdp->mynode;
raw_spin_lock_rcu_node(rnp); /* irqs already disabled. */
- rdp->beenonline = true; /* We have now been online. */
rdp->gp_seq = READ_ONCE(rnp->gp_seq);
rdp->gp_seq_needed = rdp->gp_seq;
rdp->cpu_no_qs.b.norm = true;
@@ -4165,6 +4164,16 @@ static void rcutree_affinity_setting(unsigned int cpu, int outgoing)
rcu_boost_kthread_setaffinity(rdp->mynode, outgoing);
}
+/*
+ * Has the specified (known valid) CPU ever been fully online?
+ */
+bool rcu_cpu_beenfullyonline(int cpu)
+{
+ struct rcu_data *rdp = per_cpu_ptr(&rcu_data, cpu);
+
+ return smp_load_acquire(&rdp->beenonline);
+}
+
/*
* Near the end of the CPU-online process. Pretty much all services
* enabled, and the CPU is now very much alive.
@@ -4268,6 +4277,7 @@ void rcu_cpu_starting(unsigned int cpu)
raw_spin_unlock_rcu_node(rnp);
}
arch_spin_unlock(&rcu_state.ofl_lock);
+ smp_store_release(&rdp->beenonline, true);
smp_mb(); /* Ensure RCU read-side usage follows above initialization. */
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 055/591] rcutorture: Correct name of use_softirq module parameter
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 054/591] rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 056/591] rcuscale: Move shutdown from wait_event() to wait_event_idle() Greg Kroah-Hartman
` (539 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul E. McKenney,
Joel Fernandes (Google), Sasha Levin
From: Paul E. McKenney <paulmck@kernel.org>
[ Upstream commit b409afe0268faeb77267f028ea85f2d93438fced ]
The BUSTED-BOOST and TREE03 scenarios specify a mythical tree.use_softirq
module parameter, which means a failure to get full test coverage. This
commit therefore corrects the name to rcutree.use_softirq.
Fixes: e2b949d54392 ("rcutorture: Make TREE03 use real-time tree.use_softirq setting")
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot | 2 +-
tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot b/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot
index f57720c52c0f9..84f6bb98ce993 100644
--- a/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot
+++ b/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot
@@ -5,4 +5,4 @@ rcutree.gp_init_delay=3
rcutree.gp_cleanup_delay=3
rcutree.kthread_prio=2
threadirqs
-tree.use_softirq=0
+rcutree.use_softirq=0
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot b/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot
index 64f864f1f361f..8e50bfd4b710d 100644
--- a/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot
@@ -4,4 +4,4 @@ rcutree.gp_init_delay=3
rcutree.gp_cleanup_delay=3
rcutree.kthread_prio=2
threadirqs
-tree.use_softirq=0
+rcutree.use_softirq=0
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 056/591] rcuscale: Move shutdown from wait_event() to wait_event_idle()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 055/591] rcutorture: Correct name of use_softirq module parameter Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 057/591] rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup() Greg Kroah-Hartman
` (538 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Liam Howlett,
Paul E. McKenney, Boqun Feng, Sasha Levin
From: Paul E. McKenney <paulmck@kernel.org>
[ Upstream commit ef1ef3d47677dc191b88650a9f7f91413452cc1b ]
The rcu_scale_shutdown() and kfree_scale_shutdown() kthreads/functions
use wait_event() to wait for the rcuscale test to complete. However,
each updater thread in such a test waits for at least 100 grace periods.
If each grace period takes more than 1.2 seconds, which is long, but
not insanely so, this can trigger the hung-task timeout.
This commit therefore replaces those wait_event() calls with calls to
wait_event_idle(), which do not trigger the hung-task timeout.
Reported-by: kernel test robot <yujie.liu@intel.com>
Reported-by: Liam Howlett <liam.howlett@oracle.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Tested-by: Yujie Liu <yujie.liu@intel.com>
Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
Stable-dep-of: 23fc8df26dea ("rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/rcuscale.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c
index 3ef02d4a81085..de4d4e3844bb1 100644
--- a/kernel/rcu/rcuscale.c
+++ b/kernel/rcu/rcuscale.c
@@ -630,8 +630,7 @@ static int compute_real(int n)
static int
rcu_scale_shutdown(void *arg)
{
- wait_event(shutdown_wq,
- atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters);
+ wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters);
smp_mb(); /* Wake before output. */
rcu_scale_cleanup();
kernel_power_off();
@@ -757,8 +756,8 @@ kfree_scale_cleanup(void)
static int
kfree_scale_shutdown(void *arg)
{
- wait_event(shutdown_wq,
- atomic_read(&n_kfree_scale_thread_ended) >= kfree_nrealthreads);
+ wait_event_idle(shutdown_wq,
+ atomic_read(&n_kfree_scale_thread_ended) >= kfree_nrealthreads);
smp_mb(); /* Wake before output. */
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 057/591] rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 056/591] rcuscale: Move shutdown from wait_event() to wait_event_idle() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 058/591] rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale Greg Kroah-Hartman
` (537 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qiuxu Zhuo, Paul E. McKenney,
Joel Fernandes (Google), Sasha Levin
From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
[ Upstream commit bf5ddd736509a7d9077c0b6793e6f0852214dbea ]
This code-movement-only commit moves the rcu_scale_cleanup() and
rcu_scale_shutdown() functions to follow kfree_scale_cleanup().
This is code movement is in preparation for a bug-fix patch that invokes
kfree_scale_cleanup() from rcu_scale_cleanup().
Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Stable-dep-of: 23fc8df26dea ("rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/rcuscale.c | 194 +++++++++++++++++++++---------------------
1 file changed, 97 insertions(+), 97 deletions(-)
diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c
index de4d4e3844bb1..63e4c2d629a96 100644
--- a/kernel/rcu/rcuscale.c
+++ b/kernel/rcu/rcuscale.c
@@ -521,89 +521,6 @@ rcu_scale_print_module_parms(struct rcu_scale_ops *cur_ops, const char *tag)
scale_type, tag, nrealreaders, nrealwriters, verbose, shutdown);
}
-static void
-rcu_scale_cleanup(void)
-{
- int i;
- int j;
- int ngps = 0;
- u64 *wdp;
- u64 *wdpp;
-
- /*
- * Would like warning at start, but everything is expedited
- * during the mid-boot phase, so have to wait till the end.
- */
- if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp)
- SCALEOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!");
- if (rcu_gp_is_normal() && gp_exp)
- SCALEOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!");
- if (gp_exp && gp_async)
- SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!");
-
- if (torture_cleanup_begin())
- return;
- if (!cur_ops) {
- torture_cleanup_end();
- return;
- }
-
- if (reader_tasks) {
- for (i = 0; i < nrealreaders; i++)
- torture_stop_kthread(rcu_scale_reader,
- reader_tasks[i]);
- kfree(reader_tasks);
- }
-
- if (writer_tasks) {
- for (i = 0; i < nrealwriters; i++) {
- torture_stop_kthread(rcu_scale_writer,
- writer_tasks[i]);
- if (!writer_n_durations)
- continue;
- j = writer_n_durations[i];
- pr_alert("%s%s writer %d gps: %d\n",
- scale_type, SCALE_FLAG, i, j);
- ngps += j;
- }
- pr_alert("%s%s start: %llu end: %llu duration: %llu gps: %d batches: %ld\n",
- scale_type, SCALE_FLAG,
- t_rcu_scale_writer_started, t_rcu_scale_writer_finished,
- t_rcu_scale_writer_finished -
- t_rcu_scale_writer_started,
- ngps,
- rcuscale_seq_diff(b_rcu_gp_test_finished,
- b_rcu_gp_test_started));
- for (i = 0; i < nrealwriters; i++) {
- if (!writer_durations)
- break;
- if (!writer_n_durations)
- continue;
- wdpp = writer_durations[i];
- if (!wdpp)
- continue;
- for (j = 0; j < writer_n_durations[i]; j++) {
- wdp = &wdpp[j];
- pr_alert("%s%s %4d writer-duration: %5d %llu\n",
- scale_type, SCALE_FLAG,
- i, j, *wdp);
- if (j % 100 == 0)
- schedule_timeout_uninterruptible(1);
- }
- kfree(writer_durations[i]);
- }
- kfree(writer_tasks);
- kfree(writer_durations);
- kfree(writer_n_durations);
- }
-
- /* Do torture-type-specific cleanup operations. */
- if (cur_ops->cleanup != NULL)
- cur_ops->cleanup();
-
- torture_cleanup_end();
-}
-
/*
* Return the number if non-negative. If -1, the number of CPUs.
* If less than -1, that much less than the number of CPUs, but
@@ -623,20 +540,6 @@ static int compute_real(int n)
return nr;
}
-/*
- * RCU scalability shutdown kthread. Just waits to be awakened, then shuts
- * down system.
- */
-static int
-rcu_scale_shutdown(void *arg)
-{
- wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters);
- smp_mb(); /* Wake before output. */
- rcu_scale_cleanup();
- kernel_power_off();
- return -EINVAL;
-}
-
/*
* kfree_rcu() scalability tests: Start a kfree_rcu() loop on all CPUs for number
* of iterations and measure total time and number of GP for all iterations to complete.
@@ -811,6 +714,103 @@ kfree_scale_init(void)
return firsterr;
}
+static void
+rcu_scale_cleanup(void)
+{
+ int i;
+ int j;
+ int ngps = 0;
+ u64 *wdp;
+ u64 *wdpp;
+
+ /*
+ * Would like warning at start, but everything is expedited
+ * during the mid-boot phase, so have to wait till the end.
+ */
+ if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp)
+ SCALEOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!");
+ if (rcu_gp_is_normal() && gp_exp)
+ SCALEOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!");
+ if (gp_exp && gp_async)
+ SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!");
+
+ if (torture_cleanup_begin())
+ return;
+ if (!cur_ops) {
+ torture_cleanup_end();
+ return;
+ }
+
+ if (reader_tasks) {
+ for (i = 0; i < nrealreaders; i++)
+ torture_stop_kthread(rcu_scale_reader,
+ reader_tasks[i]);
+ kfree(reader_tasks);
+ }
+
+ if (writer_tasks) {
+ for (i = 0; i < nrealwriters; i++) {
+ torture_stop_kthread(rcu_scale_writer,
+ writer_tasks[i]);
+ if (!writer_n_durations)
+ continue;
+ j = writer_n_durations[i];
+ pr_alert("%s%s writer %d gps: %d\n",
+ scale_type, SCALE_FLAG, i, j);
+ ngps += j;
+ }
+ pr_alert("%s%s start: %llu end: %llu duration: %llu gps: %d batches: %ld\n",
+ scale_type, SCALE_FLAG,
+ t_rcu_scale_writer_started, t_rcu_scale_writer_finished,
+ t_rcu_scale_writer_finished -
+ t_rcu_scale_writer_started,
+ ngps,
+ rcuscale_seq_diff(b_rcu_gp_test_finished,
+ b_rcu_gp_test_started));
+ for (i = 0; i < nrealwriters; i++) {
+ if (!writer_durations)
+ break;
+ if (!writer_n_durations)
+ continue;
+ wdpp = writer_durations[i];
+ if (!wdpp)
+ continue;
+ for (j = 0; j < writer_n_durations[i]; j++) {
+ wdp = &wdpp[j];
+ pr_alert("%s%s %4d writer-duration: %5d %llu\n",
+ scale_type, SCALE_FLAG,
+ i, j, *wdp);
+ if (j % 100 == 0)
+ schedule_timeout_uninterruptible(1);
+ }
+ kfree(writer_durations[i]);
+ }
+ kfree(writer_tasks);
+ kfree(writer_durations);
+ kfree(writer_n_durations);
+ }
+
+ /* Do torture-type-specific cleanup operations. */
+ if (cur_ops->cleanup != NULL)
+ cur_ops->cleanup();
+
+ torture_cleanup_end();
+}
+
+/*
+ * RCU scalability shutdown kthread. Just waits to be awakened, then shuts
+ * down system.
+ */
+static int
+rcu_scale_shutdown(void *arg)
+{
+ wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters);
+ smp_mb(); /* Wake before output. */
+ rcu_scale_cleanup();
+ kernel_power_off();
+ return -EINVAL;
+}
+
static int __init
rcu_scale_init(void)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 058/591] rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 057/591] rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 059/591] kselftest: vDSO: Fix accumulation of uninitialized ret when CLOCK_REALTIME is undefined Greg Kroah-Hartman
` (536 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Davidlohr Bueso,
Joel Fernandes (Google), Qiuxu Zhuo, Paul E. McKenney,
Sasha Levin
From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
[ Upstream commit 23fc8df26dead16687ae6eb47b0561a4a832e2f6 ]
Running the 'kfree_rcu_test' test case [1] results in a splat [2].
The root cause is the kfree_scale_thread thread(s) continue running
after unloading the rcuscale module. This commit fixes that isue by
invoking kfree_scale_cleanup() from rcu_scale_cleanup() when removing
the rcuscale module.
[1] modprobe rcuscale kfree_rcu_test=1
// After some time
rmmod rcuscale
rmmod torture
[2] BUG: unable to handle page fault for address: ffffffffc0601a87
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 11de4f067 P4D 11de4f067 PUD 11de51067 PMD 112f4d067 PTE 0
Oops: 0010 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 1798 Comm: kfree_scale_thr Not tainted 6.3.0-rc1-rcu+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
RIP: 0010:0xffffffffc0601a87
Code: Unable to access opcode bytes at 0xffffffffc0601a5d.
RSP: 0018:ffffb25bc2e57e18 EFLAGS: 00010297
RAX: 0000000000000000 RBX: ffffffffc061f0b6 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff962fd0de RDI: ffffffff962fd0de
RBP: ffffb25bc2e57ea8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 000000000000000a R15: 00000000001c1dbe
FS: 0000000000000000(0000) GS:ffff921fa2200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffc0601a5d CR3: 000000011de4c006 CR4: 0000000000370ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
? kvfree_call_rcu+0xf0/0x3a0
? kthread+0xf3/0x120
? kthread_complete_and_exit+0x20/0x20
? ret_from_fork+0x1f/0x30
</TASK>
Modules linked in: rfkill sunrpc ... [last unloaded: torture]
CR2: ffffffffc0601a87
---[ end trace 0000000000000000 ]---
Fixes: e6e78b004fa7 ("rcuperf: Add kfree_rcu() performance Tests")
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/rcuscale.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c
index 63e4c2d629a96..7854dc3226e1b 100644
--- a/kernel/rcu/rcuscale.c
+++ b/kernel/rcu/rcuscale.c
@@ -734,6 +734,11 @@ rcu_scale_cleanup(void)
if (gp_exp && gp_async)
SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!");
+ if (kfree_rcu_test) {
+ kfree_scale_cleanup();
+ return;
+ }
+
if (torture_cleanup_begin())
return;
if (!cur_ops) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 059/591] kselftest: vDSO: Fix accumulation of uninitialized ret when CLOCK_REALTIME is undefined
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 058/591] rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 060/591] perf/ibs: Fix interface via core pmu events Greg Kroah-Hartman
` (535 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Colin Ian King, Vincenzo Frascino,
Shuah Khan, Sasha Levin
From: Colin Ian King <colin.i.king@gmail.com>
[ Upstream commit 375b9ff53cb6f9c042817b75f2be0a650626dc4f ]
In the unlikely case that CLOCK_REALTIME is not defined, variable ret is
not initialized and further accumulation of return values to ret can leave
ret in an undefined state. Fix this by initialized ret to zero and changing
the assignment of ret to an accumulation for the CLOCK_REALTIME case.
Fixes: 03f55c7952c9 ("kselftest: Extend vDSO selftest to clock_getres")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/vDSO/vdso_test_clock_getres.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/vDSO/vdso_test_clock_getres.c b/tools/testing/selftests/vDSO/vdso_test_clock_getres.c
index 15dcee16ff726..38d46a8bf7cba 100644
--- a/tools/testing/selftests/vDSO/vdso_test_clock_getres.c
+++ b/tools/testing/selftests/vDSO/vdso_test_clock_getres.c
@@ -84,12 +84,12 @@ static inline int vdso_test_clock(unsigned int clock_id)
int main(int argc, char **argv)
{
- int ret;
+ int ret = 0;
#if _POSIX_TIMERS > 0
#ifdef CLOCK_REALTIME
- ret = vdso_test_clock(CLOCK_REALTIME);
+ ret += vdso_test_clock(CLOCK_REALTIME);
#endif
#ifdef CLOCK_BOOTTIME
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 060/591] perf/ibs: Fix interface via core pmu events
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 059/591] kselftest: vDSO: Fix accumulation of uninitialized ret when CLOCK_REALTIME is undefined Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 061/591] x86/mm: Fix __swp_entry_to_pte() for Xen PV guests Greg Kroah-Hartman
` (534 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephane Eranian, Ravi Bangoria,
Peter Zijlstra (Intel), Sasha Levin
From: Ravi Bangoria <ravi.bangoria@amd.com>
[ Upstream commit 2fad201fe38ff9a692acedb1990ece2c52a29f95 ]
Although, IBS pmus can be invoked via their own interface, indirect
IBS invocation via core pmu events is also supported with fixed set
of events: cpu-cycles:p, r076:p (same as cpu-cycles:p) and r0C1:p
(micro-ops) for user convenience.
This indirect IBS invocation is broken since commit 66d258c5b048
("perf/core: Optimize perf_init_event()"), which added RAW pmu under
'pmu_idr' list and thus if event_init() fails with RAW pmu, it started
returning error instead of trying other pmus.
Forward precise events from core pmu to IBS by overwriting 'type' and
'config' in the kernel copy of perf_event_attr. Overwriting will cause
perf_init_event() to retry with updated 'type' and 'config', which will
automatically forward event to IBS pmu.
Without patch:
$ sudo ./perf record -C 0 -e r076:p -- sleep 1
Error:
The r076:p event is not supported.
With patch:
$ sudo ./perf record -C 0 -e r076:p -- sleep 1
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.341 MB perf.data (37 samples) ]
Fixes: 66d258c5b048 ("perf/core: Optimize perf_init_event()")
Reported-by: Stephane Eranian <eranian@google.com>
Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20230504110003.2548-3-ravi.bangoria@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/amd/core.c | 2 +-
arch/x86/events/amd/ibs.c | 53 +++++++++++++++----------------
arch/x86/include/asm/perf_event.h | 2 ++
3 files changed, 29 insertions(+), 28 deletions(-)
diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
index 8ca5e827f30b2..6672a3f05fc68 100644
--- a/arch/x86/events/amd/core.c
+++ b/arch/x86/events/amd/core.c
@@ -374,7 +374,7 @@ static int amd_pmu_hw_config(struct perf_event *event)
/* pass precise event sampling to ibs: */
if (event->attr.precise_ip && get_ibs_caps())
- return -ENOENT;
+ return forward_event_to_ibs(event);
if (has_branch_stack(event) && !x86_pmu.lbr_nr)
return -EOPNOTSUPP;
diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
index 4cb710efbdd9a..37cbbc5c659a5 100644
--- a/arch/x86/events/amd/ibs.c
+++ b/arch/x86/events/amd/ibs.c
@@ -190,7 +190,7 @@ static struct perf_ibs *get_ibs_pmu(int type)
}
/*
- * Use IBS for precise event sampling:
+ * core pmu config -> IBS config
*
* perf record -a -e cpu-cycles:p ... # use ibs op counting cycle count
* perf record -a -e r076:p ... # same as -e cpu-cycles:p
@@ -199,25 +199,9 @@ static struct perf_ibs *get_ibs_pmu(int type)
* IbsOpCntCtl (bit 19) of IBS Execution Control Register (IbsOpCtl,
* MSRC001_1033) is used to select either cycle or micro-ops counting
* mode.
- *
- * The rip of IBS samples has skid 0. Thus, IBS supports precise
- * levels 1 and 2 and the PERF_EFLAGS_EXACT is set. In rare cases the
- * rip is invalid when IBS was not able to record the rip correctly.
- * We clear PERF_EFLAGS_EXACT and take the rip from pt_regs then.
- *
*/
-static int perf_ibs_precise_event(struct perf_event *event, u64 *config)
+static int core_pmu_ibs_config(struct perf_event *event, u64 *config)
{
- switch (event->attr.precise_ip) {
- case 0:
- return -ENOENT;
- case 1:
- case 2:
- break;
- default:
- return -EOPNOTSUPP;
- }
-
switch (event->attr.type) {
case PERF_TYPE_HARDWARE:
switch (event->attr.config) {
@@ -243,22 +227,37 @@ static int perf_ibs_precise_event(struct perf_event *event, u64 *config)
return -EOPNOTSUPP;
}
+/*
+ * The rip of IBS samples has skid 0. Thus, IBS supports precise
+ * levels 1 and 2 and the PERF_EFLAGS_EXACT is set. In rare cases the
+ * rip is invalid when IBS was not able to record the rip correctly.
+ * We clear PERF_EFLAGS_EXACT and take the rip from pt_regs then.
+ */
+int forward_event_to_ibs(struct perf_event *event)
+{
+ u64 config = 0;
+
+ if (!event->attr.precise_ip || event->attr.precise_ip > 2)
+ return -EOPNOTSUPP;
+
+ if (!core_pmu_ibs_config(event, &config)) {
+ event->attr.type = perf_ibs_op.pmu.type;
+ event->attr.config = config;
+ }
+ return -ENOENT;
+}
+
static int perf_ibs_init(struct perf_event *event)
{
struct hw_perf_event *hwc = &event->hw;
struct perf_ibs *perf_ibs;
u64 max_cnt, config;
- int ret;
perf_ibs = get_ibs_pmu(event->attr.type);
- if (perf_ibs) {
- config = event->attr.config;
- } else {
- perf_ibs = &perf_ibs_op;
- ret = perf_ibs_precise_event(event, &config);
- if (ret)
- return ret;
- }
+ if (!perf_ibs)
+ return -ENOENT;
+
+ config = event->attr.config;
if (event->pmu != &perf_ibs->pmu)
return -ENOENT;
diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
index 5d0f6891ae611..4d810b9478a43 100644
--- a/arch/x86/include/asm/perf_event.h
+++ b/arch/x86/include/asm/perf_event.h
@@ -467,8 +467,10 @@ struct pebs_xmm {
#ifdef CONFIG_X86_LOCAL_APIC
extern u32 get_ibs_caps(void);
+extern int forward_event_to_ibs(struct perf_event *event);
#else
static inline u32 get_ibs_caps(void) { return 0; }
+static inline int forward_event_to_ibs(struct perf_event *event) { return -ENOENT; }
#endif
#ifdef CONFIG_PERF_EVENTS
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 061/591] x86/mm: Fix __swp_entry_to_pte() for Xen PV guests
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 060/591] perf/ibs: Fix interface via core pmu events Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 062/591] locking/atomic: arm: fix sync ops Greg Kroah-Hartman
` (533 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Juergen Gross, Borislav Petkov (AMD),
Sasha Levin
From: Juergen Gross <jgross@suse.com>
[ Upstream commit 0f88130e8a6fd185b0aeb5d8e286083735f2585a ]
Normally __swp_entry_to_pte() is never called with a value translating
to a valid PTE. The only known exception is pte_swap_tests(), resulting
in a WARN splat in Xen PV guests, as __pte_to_swp_entry() did
translate the PFN of the valid PTE to a guest local PFN, while
__swp_entry_to_pte() doesn't do the opposite translation.
Fix that by using __pte() in __swp_entry_to_pte() instead of open
coding the native variant of it.
For correctness do the similar conversion for __swp_entry_to_pmd().
Fixes: 05289402d717 ("mm/debug_vm_pgtable: add tests validating arch helpers for core MM features")
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230306123259.12461-1-jgross@suse.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/pgtable_64.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index e479491da8d51..07cd53eeec770 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -237,8 +237,8 @@ static inline void native_pgd_clear(pgd_t *pgd)
#define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val((pte)) })
#define __pmd_to_swp_entry(pmd) ((swp_entry_t) { pmd_val((pmd)) })
-#define __swp_entry_to_pte(x) ((pte_t) { .pte = (x).val })
-#define __swp_entry_to_pmd(x) ((pmd_t) { .pmd = (x).val })
+#define __swp_entry_to_pte(x) (__pte((x).val))
+#define __swp_entry_to_pmd(x) (__pmd((x).val))
extern int kern_addr_valid(unsigned long addr);
extern void cleanup_highmap(void);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 062/591] locking/atomic: arm: fix sync ops
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 061/591] x86/mm: Fix __swp_entry_to_pte() for Xen PV guests Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 063/591] evm: Complete description of evm_inode_setattr() Greg Kroah-Hartman
` (532 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Peter Zijlstra (Intel),
Kees Cook, Sasha Levin
From: Mark Rutland <mark.rutland@arm.com>
[ Upstream commit dda5f312bb09e56e7a1c3e3851f2000eb2e9c879 ]
The sync_*() ops on arch/arm are defined in terms of the regular bitops
with no special handling. This is not correct, as UP kernels elide
barriers for the fully-ordered operations, and so the required ordering
is lost when such UP kernels are run under a hypervsior on an SMP
system.
Fix this by defining sync ops with the required barriers.
Note: On 32-bit arm, the sync_*() ops are currently only used by Xen,
which requires ARMv7, but the semantics can be implemented for ARMv6+.
Fixes: e54d2f61528165bb ("xen/arm: sync_bitops")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230605070124.3741859-2-mark.rutland@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/include/asm/assembler.h | 17 +++++++++++++++++
arch/arm/include/asm/sync_bitops.h | 29 +++++++++++++++++++++++++----
arch/arm/lib/bitops.h | 14 +++++++++++---
arch/arm/lib/testchangebit.S | 4 ++++
arch/arm/lib/testclearbit.S | 4 ++++
arch/arm/lib/testsetbit.S | 4 ++++
6 files changed, 65 insertions(+), 7 deletions(-)
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 90fbe4a3f9c84..84912b19cac85 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -402,6 +402,23 @@ ALT_UP_B(.L0_\@)
#endif
.endm
+/*
+ * Raw SMP data memory barrier
+ */
+ .macro __smp_dmb mode
+#if __LINUX_ARM_ARCH__ >= 7
+ .ifeqs "\mode","arm"
+ dmb ish
+ .else
+ W(dmb) ish
+ .endif
+#elif __LINUX_ARM_ARCH__ == 6
+ mcr p15, 0, r0, c7, c10, 5 @ dmb
+#else
+ .error "Incompatible SMP platform"
+#endif
+ .endm
+
#if defined(CONFIG_CPU_V7M)
/*
* setmode is used to assert to be in svc mode during boot. For v7-M
diff --git a/arch/arm/include/asm/sync_bitops.h b/arch/arm/include/asm/sync_bitops.h
index 6f5d627c44a3c..f46b3c570f92e 100644
--- a/arch/arm/include/asm/sync_bitops.h
+++ b/arch/arm/include/asm/sync_bitops.h
@@ -14,14 +14,35 @@
* ops which are SMP safe even on a UP kernel.
*/
+/*
+ * Unordered
+ */
+
#define sync_set_bit(nr, p) _set_bit(nr, p)
#define sync_clear_bit(nr, p) _clear_bit(nr, p)
#define sync_change_bit(nr, p) _change_bit(nr, p)
-#define sync_test_and_set_bit(nr, p) _test_and_set_bit(nr, p)
-#define sync_test_and_clear_bit(nr, p) _test_and_clear_bit(nr, p)
-#define sync_test_and_change_bit(nr, p) _test_and_change_bit(nr, p)
#define sync_test_bit(nr, addr) test_bit(nr, addr)
-#define arch_sync_cmpxchg arch_cmpxchg
+/*
+ * Fully ordered
+ */
+
+int _sync_test_and_set_bit(int nr, volatile unsigned long * p);
+#define sync_test_and_set_bit(nr, p) _sync_test_and_set_bit(nr, p)
+
+int _sync_test_and_clear_bit(int nr, volatile unsigned long * p);
+#define sync_test_and_clear_bit(nr, p) _sync_test_and_clear_bit(nr, p)
+
+int _sync_test_and_change_bit(int nr, volatile unsigned long * p);
+#define sync_test_and_change_bit(nr, p) _sync_test_and_change_bit(nr, p)
+
+#define arch_sync_cmpxchg(ptr, old, new) \
+({ \
+ __typeof__(*(ptr)) __ret; \
+ __smp_mb__before_atomic(); \
+ __ret = arch_cmpxchg_relaxed((ptr), (old), (new)); \
+ __smp_mb__after_atomic(); \
+ __ret; \
+})
#endif
diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
index 95bd359912889..f069d1b2318e6 100644
--- a/arch/arm/lib/bitops.h
+++ b/arch/arm/lib/bitops.h
@@ -28,7 +28,7 @@ UNWIND( .fnend )
ENDPROC(\name )
.endm
- .macro testop, name, instr, store
+ .macro __testop, name, instr, store, barrier
ENTRY( \name )
UNWIND( .fnstart )
ands ip, r1, #3
@@ -38,7 +38,7 @@ UNWIND( .fnstart )
mov r0, r0, lsr #5
add r1, r1, r0, lsl #2 @ Get word offset
mov r3, r2, lsl r3 @ create mask
- smp_dmb
+ \barrier
#if __LINUX_ARM_ARCH__ >= 7 && defined(CONFIG_SMP)
.arch_extension mp
ALT_SMP(W(pldw) [r1])
@@ -50,13 +50,21 @@ UNWIND( .fnstart )
strex ip, r2, [r1]
cmp ip, #0
bne 1b
- smp_dmb
+ \barrier
cmp r0, #0
movne r0, #1
2: bx lr
UNWIND( .fnend )
ENDPROC(\name )
.endm
+
+ .macro testop, name, instr, store
+ __testop \name, \instr, \store, smp_dmb
+ .endm
+
+ .macro sync_testop, name, instr, store
+ __testop \name, \instr, \store, __smp_dmb
+ .endm
#else
.macro bitop, name, instr
ENTRY( \name )
diff --git a/arch/arm/lib/testchangebit.S b/arch/arm/lib/testchangebit.S
index 4ebecc67e6e04..f13fe9bc2399a 100644
--- a/arch/arm/lib/testchangebit.S
+++ b/arch/arm/lib/testchangebit.S
@@ -10,3 +10,7 @@
.text
testop _test_and_change_bit, eor, str
+
+#if __LINUX_ARM_ARCH__ >= 6
+sync_testop _sync_test_and_change_bit, eor, str
+#endif
diff --git a/arch/arm/lib/testclearbit.S b/arch/arm/lib/testclearbit.S
index 009afa0f5b4a7..4d2c5ca620ebf 100644
--- a/arch/arm/lib/testclearbit.S
+++ b/arch/arm/lib/testclearbit.S
@@ -10,3 +10,7 @@
.text
testop _test_and_clear_bit, bicne, strne
+
+#if __LINUX_ARM_ARCH__ >= 6
+sync_testop _sync_test_and_clear_bit, bicne, strne
+#endif
diff --git a/arch/arm/lib/testsetbit.S b/arch/arm/lib/testsetbit.S
index f3192e55acc87..649dbab65d8d0 100644
--- a/arch/arm/lib/testsetbit.S
+++ b/arch/arm/lib/testsetbit.S
@@ -10,3 +10,7 @@
.text
testop _test_and_set_bit, orreq, streq
+
+#if __LINUX_ARM_ARCH__ >= 6
+sync_testop _sync_test_and_set_bit, orreq, streq
+#endif
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 063/591] evm: Complete description of evm_inode_setattr()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 062/591] locking/atomic: arm: fix sync ops Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-08-17 11:11 ` Mimi Zohar
2023-07-16 19:43 ` [PATCH 6.1 064/591] evm: Fix build warnings Greg Kroah-Hartman
` (531 subsequent siblings)
594 siblings, 1 reply; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roberto Sassu, Stefan Berger,
Mimi Zohar, Sasha Levin
From: Roberto Sassu <roberto.sassu@huawei.com>
[ Upstream commit b1de86d4248b273cb12c4cd7d20c08d459519f7d ]
Add the description for missing parameters of evm_inode_setattr() to
avoid the warning arising with W=n compile option.
Fixes: 817b54aa45db ("evm: add evm_inode_setattr to prevent updating an invalid security.evm") # v3.2+
Fixes: c1632a0f1120 ("fs: port ->setattr() to pass mnt_idmap") # v6.3+
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/integrity/evm/evm_main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 23d484e05e6f2..f1a26d50c1d58 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -776,7 +776,9 @@ static int evm_attr_change(struct user_namespace *mnt_userns,
/**
* evm_inode_setattr - prevent updating an invalid EVM extended attribute
+ * @idmap: idmap of the mount
* @dentry: pointer to the affected dentry
+ * @attr: iattr structure containing the new file attributes
*
* Permit update of file attributes when files have a valid EVM signature,
* except in the case of them having an immutable portable signature.
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* Re: [PATCH 6.1 063/591] evm: Complete description of evm_inode_setattr()
2023-07-16 19:43 ` [PATCH 6.1 063/591] evm: Complete description of evm_inode_setattr() Greg Kroah-Hartman
@ 2023-08-17 11:11 ` Mimi Zohar
0 siblings, 0 replies; 604+ messages in thread
From: Mimi Zohar @ 2023-08-17 11:11 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Roberto Sassu, Stefan Berger, Sasha Levin
Hi Greg,
To clarify the kernel test robot report:
[stable:linux-6.1.y 7217/8698] security/integrity/evm/evm_main.c:788:
warning: Excess function parameter 'idmap' description in
'evm_inode_setattr'
Commit b1de86d4248b added two missing kernel-doc function arguments.
Both changes should be backported to 6.3, but then only "* @attr: iattr
structure containing the new file attributes" should be backported.
thanks,
Mimi
On Sun, 2023-07-16 at 21:43 +0200, Greg Kroah-Hartman wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> [ Upstream commit b1de86d4248b273cb12c4cd7d20c08d459519f7d ]
>
> Add the description for missing parameters of evm_inode_setattr() to
> avoid the warning arising with W=n compile option.
>
> Fixes: 817b54aa45db ("evm: add evm_inode_setattr to prevent updating an invalid security.evm") # v3.2+
> Fixes: c1632a0f1120 ("fs: port ->setattr() to pass mnt_idmap") # v6.3+
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> security/integrity/evm/evm_main.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
> index 23d484e05e6f2..f1a26d50c1d58 100644
> --- a/security/integrity/evm/evm_main.c
> +++ b/security/integrity/evm/evm_main.c
> @@ -776,7 +776,9 @@ static int evm_attr_change(struct user_namespace *mnt_userns,
>
> /**
> * evm_inode_setattr - prevent updating an invalid EVM extended attribute
> + * @idmap: idmap of the mount
> * @dentry: pointer to the affected dentry
> + * @attr: iattr structure containing the new file attributes
> *
> * Permit update of file attributes when files have a valid EVM signature,
> * except in the case of them having an immutable portable signature.
^ permalink raw reply [flat|nested] 604+ messages in thread
* [PATCH 6.1 064/591] evm: Fix build warnings
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 063/591] evm: Complete description of evm_inode_setattr() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 065/591] ima: " Greg Kroah-Hartman
` (530 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Roberto Sassu, Mimi Zohar,
Sasha Levin
From: Roberto Sassu <roberto.sassu@huawei.com>
[ Upstream commit 996e0a97ebd7b11cb785794e2a83c20c1add9d92 ]
Fix build warnings (function parameters description) for
evm_read_protected_xattrs(), evm_set_key() and evm_verifyxattr().
Fixes: 7626676320f3 ("evm: provide a function to set the EVM key from the kernel") # v4.5+
Fixes: 8314b6732ae4 ("ima: Define new template fields xattrnames, xattrlengths and xattrvalues") # v5.14+
Fixes: 2960e6cb5f7c ("evm: additional parameter to pass integrity cache entry 'iint'") # v3.2+
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/integrity/evm/evm_crypto.c | 2 +-
security/integrity/evm/evm_main.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 708de9656bbd2..b9395f8ef5829 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -40,7 +40,7 @@ static const char evm_hmac[] = "hmac(sha1)";
/**
* evm_set_key() - set EVM HMAC key from the kernel
* @key: pointer to a buffer with the key data
- * @size: length of the key data
+ * @keylen: length of the key data
*
* This function allows setting the EVM HMAC key from the kernel
* without using the "encrypted" key subsystem keys. It can be used
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index f1a26d50c1d58..a338f19447d03 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -318,7 +318,6 @@ int evm_protected_xattr_if_enabled(const char *req_xattr_name)
/**
* evm_read_protected_xattrs - read EVM protected xattr names, lengths, values
* @dentry: dentry of the read xattrs
- * @inode: inode of the read xattrs
* @buffer: buffer xattr names, lengths or values are copied to
* @buffer_size: size of buffer
* @type: n: names, l: lengths, v: values
@@ -390,6 +389,7 @@ int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer,
* @xattr_name: requested xattr
* @xattr_value: requested xattr value
* @xattr_value_len: requested xattr value length
+ * @iint: inode integrity metadata
*
* Calculate the HMAC for the given dentry and verify it against the stored
* security.evm xattr. For performance, use the xattr value and length
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 065/591] ima: Fix build warnings
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 064/591] evm: Fix build warnings Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 066/591] pstore/ram: Add check for kstrdup Greg Kroah-Hartman
` (529 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Roberto Sassu, Mimi Zohar,
Sasha Levin
From: Roberto Sassu <roberto.sassu@huawei.com>
[ Upstream commit 95526d13038c2bbddd567a4d8e39fac42484e182 ]
Fix build warnings (function parameters description) for
ima_collect_modsig(), ima_match_policy() and ima_parse_add_rule().
Fixes: 15588227e086 ("ima: Collect modsig") # v5.4+
Fixes: 2fe5d6def167 ("ima: integrity appraisal extension") # v5.14+
Fixes: 4af4662fa4a9 ("integrity: IMA policy") # v3.2+
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/integrity/ima/ima_modsig.c | 3 +++
security/integrity/ima/ima_policy.c | 3 ++-
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/security/integrity/ima/ima_modsig.c b/security/integrity/ima/ima_modsig.c
index fb25723c65bc4..3e7bee30080f2 100644
--- a/security/integrity/ima/ima_modsig.c
+++ b/security/integrity/ima/ima_modsig.c
@@ -89,6 +89,9 @@ int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len,
/**
* ima_collect_modsig - Calculate the file hash without the appended signature.
+ * @modsig: parsed module signature
+ * @buf: data to verify the signature on
+ * @size: data size
*
* Since the modsig is part of the file contents, the hash used in its signature
* isn't the same one ordinarily calculated by IMA. Therefore PKCS7 code
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 2edff7f58c25c..bdc40535ff489 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -694,6 +694,7 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
* @secid: LSM secid of the task to be validated
* @func: IMA hook identifier
* @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
+ * @flags: IMA actions to consider (e.g. IMA_MEASURE | IMA_APPRAISE)
* @pcr: set the pcr to extend
* @template_desc: the template that should be used for this rule
* @func_data: func specific data, may be NULL
@@ -1885,7 +1886,7 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
/**
* ima_parse_add_rule - add a rule to ima_policy_rules
- * @rule - ima measurement policy rule
+ * @rule: ima measurement policy rule
*
* Avoid locking by allowing just one writer at a time in ima_write_policy()
* Returns the length of the rule parsed, an error code on failure
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 066/591] pstore/ram: Add check for kstrdup
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 065/591] ima: " Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 067/591] igc: Enable and fix RX hash usage by netstack Greg Kroah-Hartman
` (528 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Kees Cook,
Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit d97038d5ec2062733c1e016caf9baaf68cf64ea1 ]
Add check for the return value of kstrdup() and return the error
if it fails in order to avoid NULL pointer dereference.
Fixes: e163fdb3f7f8 ("pstore/ram: Regularize prz label allocation lifetime")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230614093733.36048-1-jiasheng@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/pstore/ram_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
index 8bf09886e7e66..2384de1c2d187 100644
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -591,6 +591,8 @@ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
raw_spin_lock_init(&prz->buffer_lock);
prz->flags = flags;
prz->label = kstrdup(label, GFP_KERNEL);
+ if (!prz->label)
+ goto err;
ret = persistent_ram_buffer_map(start, size, prz, memtype);
if (ret)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 067/591] igc: Enable and fix RX hash usage by netstack
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 066/591] pstore/ram: Add check for kstrdup Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 068/591] wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation Greg Kroah-Hartman
` (527 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jesper Dangaard Brouer,
Daniel Borkmann, Song Yoong Siang, Sasha Levin
From: Jesper Dangaard Brouer <brouer@redhat.com>
[ Upstream commit 84214ab4689f962b4bfc47fc9a5838d25ac4274d ]
When function igc_rx_hash() was introduced in v4.20 via commit 0507ef8a0372
("igc: Add transmit and receive fastpath and interrupt handlers"), the
hardware wasn't configured to provide RSS hash, thus it made sense to not
enable net_device NETIF_F_RXHASH feature bit.
The NIC hardware was configured to enable RSS hash info in v5.2 via commit
2121c2712f82 ("igc: Add multiple receive queues control supporting"), but
forgot to set the NETIF_F_RXHASH feature bit.
The original implementation of igc_rx_hash() didn't extract the associated
pkt_hash_type, but statically set PKT_HASH_TYPE_L3. The largest portions of
this patch are about extracting the RSS Type from the hardware and mapping
this to enum pkt_hash_types. This was based on Foxville i225 software user
manual rev-1.3.1 and tested on Intel Ethernet Controller I225-LM (rev 03).
For UDP it's worth noting that RSS (type) hashing have been disabled both for
IPv4 and IPv6 (see IGC_MRQC_RSS_FIELD_IPV4_UDP + IGC_MRQC_RSS_FIELD_IPV6_UDP)
because hardware RSS doesn't handle fragmented pkts well when enabled (can
cause out-of-order). This results in PKT_HASH_TYPE_L3 for UDP packets, and
hash value doesn't include UDP port numbers. Not being PKT_HASH_TYPE_L4, have
the effect that netstack will do a software based hash calc calling into
flow_dissect, but only when code calls skb_get_hash(), which doesn't
necessary happen for local delivery.
For QA verification testing I wrote a small bpftrace prog:
[0] https://github.com/xdp-project/xdp-project/blob/master/areas/hints/monitor_skb_hash_on_dev.bt
Fixes: 2121c2712f82 ("igc: Add multiple receive queues control supporting")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Song Yoong Siang <yoong.siang.song@intel.com>
Link: https://lore.kernel.org/bpf/168182464270.616355.11391652654430626584.stgit@firesoul
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igc/igc.h | 28 ++++++++++++++++++++
drivers/net/ethernet/intel/igc/igc_main.c | 31 ++++++++++++++++++++---
2 files changed, 55 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h
index df3e26c0cf01a..f83cbc4a1afa8 100644
--- a/drivers/net/ethernet/intel/igc/igc.h
+++ b/drivers/net/ethernet/intel/igc/igc.h
@@ -13,6 +13,7 @@
#include <linux/ptp_clock_kernel.h>
#include <linux/timecounter.h>
#include <linux/net_tstamp.h>
+#include <linux/bitfield.h>
#include "igc_hw.h"
@@ -311,6 +312,33 @@ extern char igc_driver_name[];
#define IGC_MRQC_RSS_FIELD_IPV4_UDP 0x00400000
#define IGC_MRQC_RSS_FIELD_IPV6_UDP 0x00800000
+/* RX-desc Write-Back format RSS Type's */
+enum igc_rss_type_num {
+ IGC_RSS_TYPE_NO_HASH = 0,
+ IGC_RSS_TYPE_HASH_TCP_IPV4 = 1,
+ IGC_RSS_TYPE_HASH_IPV4 = 2,
+ IGC_RSS_TYPE_HASH_TCP_IPV6 = 3,
+ IGC_RSS_TYPE_HASH_IPV6_EX = 4,
+ IGC_RSS_TYPE_HASH_IPV6 = 5,
+ IGC_RSS_TYPE_HASH_TCP_IPV6_EX = 6,
+ IGC_RSS_TYPE_HASH_UDP_IPV4 = 7,
+ IGC_RSS_TYPE_HASH_UDP_IPV6 = 8,
+ IGC_RSS_TYPE_HASH_UDP_IPV6_EX = 9,
+ IGC_RSS_TYPE_MAX = 10,
+};
+#define IGC_RSS_TYPE_MAX_TABLE 16
+#define IGC_RSS_TYPE_MASK GENMASK(3,0) /* 4-bits (3:0) = mask 0x0F */
+
+/* igc_rss_type - Rx descriptor RSS type field */
+static inline u32 igc_rss_type(const union igc_adv_rx_desc *rx_desc)
+{
+ /* RSS Type 4-bits (3:0) number: 0-9 (above 9 is reserved)
+ * Accessing the same bits via u16 (wb.lower.lo_dword.hs_rss.pkt_info)
+ * is slightly slower than via u32 (wb.lower.lo_dword.data)
+ */
+ return le32_get_bits(rx_desc->wb.lower.lo_dword.data, IGC_RSS_TYPE_MASK);
+}
+
/* Interrupt defines */
#define IGC_START_ITR 648 /* ~6000 ints/sec */
#define IGC_4K_ITR 980
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 3509974c1f8e4..b67a6a81474f5 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -1684,14 +1684,36 @@ static void igc_rx_checksum(struct igc_ring *ring,
le32_to_cpu(rx_desc->wb.upper.status_error));
}
+/* Mapping HW RSS Type to enum pkt_hash_types */
+static const enum pkt_hash_types igc_rss_type_table[IGC_RSS_TYPE_MAX_TABLE] = {
+ [IGC_RSS_TYPE_NO_HASH] = PKT_HASH_TYPE_L2,
+ [IGC_RSS_TYPE_HASH_TCP_IPV4] = PKT_HASH_TYPE_L4,
+ [IGC_RSS_TYPE_HASH_IPV4] = PKT_HASH_TYPE_L3,
+ [IGC_RSS_TYPE_HASH_TCP_IPV6] = PKT_HASH_TYPE_L4,
+ [IGC_RSS_TYPE_HASH_IPV6_EX] = PKT_HASH_TYPE_L3,
+ [IGC_RSS_TYPE_HASH_IPV6] = PKT_HASH_TYPE_L3,
+ [IGC_RSS_TYPE_HASH_TCP_IPV6_EX] = PKT_HASH_TYPE_L4,
+ [IGC_RSS_TYPE_HASH_UDP_IPV4] = PKT_HASH_TYPE_L4,
+ [IGC_RSS_TYPE_HASH_UDP_IPV6] = PKT_HASH_TYPE_L4,
+ [IGC_RSS_TYPE_HASH_UDP_IPV6_EX] = PKT_HASH_TYPE_L4,
+ [10] = PKT_HASH_TYPE_NONE, /* RSS Type above 9 "Reserved" by HW */
+ [11] = PKT_HASH_TYPE_NONE, /* keep array sized for SW bit-mask */
+ [12] = PKT_HASH_TYPE_NONE, /* to handle future HW revisons */
+ [13] = PKT_HASH_TYPE_NONE,
+ [14] = PKT_HASH_TYPE_NONE,
+ [15] = PKT_HASH_TYPE_NONE,
+};
+
static inline void igc_rx_hash(struct igc_ring *ring,
union igc_adv_rx_desc *rx_desc,
struct sk_buff *skb)
{
- if (ring->netdev->features & NETIF_F_RXHASH)
- skb_set_hash(skb,
- le32_to_cpu(rx_desc->wb.lower.hi_dword.rss),
- PKT_HASH_TYPE_L3);
+ if (ring->netdev->features & NETIF_F_RXHASH) {
+ u32 rss_hash = le32_to_cpu(rx_desc->wb.lower.hi_dword.rss);
+ u32 rss_type = igc_rss_type(rx_desc);
+
+ skb_set_hash(skb, rss_hash, igc_rss_type_table[rss_type]);
+ }
}
static void igc_rx_vlan(struct igc_ring *rx_ring,
@@ -6518,6 +6540,7 @@ static int igc_probe(struct pci_dev *pdev,
netdev->features |= NETIF_F_TSO;
netdev->features |= NETIF_F_TSO6;
netdev->features |= NETIF_F_TSO_ECN;
+ netdev->features |= NETIF_F_RXHASH;
netdev->features |= NETIF_F_RXCSUM;
netdev->features |= NETIF_F_HW_CSUM;
netdev->features |= NETIF_F_SCTP_CRC;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 068/591] wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 067/591] igc: Enable and fix RX hash usage by netstack Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 069/591] wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx Greg Kroah-Hartman
` (526 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregg Wonderly, Peter Seiderer,
Toke Høiland-Jørgensen, Simon Horman, Kalle Valo,
Sasha Levin
From: Peter Seiderer <ps.report@gmx.net>
[ Upstream commit 3e56c80931c7615250fe4bf83f93b57881969266 ]
Fix ath9k_hw_verify_hang()/ar9003_hw_detect_mac_hang() register offset
calculation (do not overflow the shift for the second register/queues
above five, use the register layout described in the comments above
ath9k_hw_verify_hang() instead).
Fixes: 222e04830ff0 ("ath9k: Fix MAC HW hang check for AR9003")
Reported-by: Gregg Wonderly <greggwonderly@seqtechllc.com>
Link: https://lore.kernel.org/linux-wireless/E3A9C354-0CB7-420C-ADEF-F0177FB722F4@seqtechllc.com/
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230422212423.26065-1-ps.report@gmx.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/ar9003_hw.c | 27 ++++++++++++++--------
1 file changed, 18 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 42f00a2a8c800..cf5648188459c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -1099,17 +1099,22 @@ static bool ath9k_hw_verify_hang(struct ath_hw *ah, unsigned int queue)
{
u32 dma_dbg_chain, dma_dbg_complete;
u8 dcu_chain_state, dcu_complete_state;
+ unsigned int dbg_reg, reg_offset;
int i;
- for (i = 0; i < NUM_STATUS_READS; i++) {
- if (queue < 6)
- dma_dbg_chain = REG_READ(ah, AR_DMADBG_4);
- else
- dma_dbg_chain = REG_READ(ah, AR_DMADBG_5);
+ if (queue < 6) {
+ dbg_reg = AR_DMADBG_4;
+ reg_offset = queue * 5;
+ } else {
+ dbg_reg = AR_DMADBG_5;
+ reg_offset = (queue - 6) * 5;
+ }
+ for (i = 0; i < NUM_STATUS_READS; i++) {
+ dma_dbg_chain = REG_READ(ah, dbg_reg);
dma_dbg_complete = REG_READ(ah, AR_DMADBG_6);
- dcu_chain_state = (dma_dbg_chain >> (5 * queue)) & 0x1f;
+ dcu_chain_state = (dma_dbg_chain >> reg_offset) & 0x1f;
dcu_complete_state = dma_dbg_complete & 0x3;
if ((dcu_chain_state != 0x6) || (dcu_complete_state != 0x1))
@@ -1128,6 +1133,7 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah)
u8 dcu_chain_state, dcu_complete_state;
bool dcu_wait_frdone = false;
unsigned long chk_dcu = 0;
+ unsigned int reg_offset;
unsigned int i = 0;
dma_dbg_4 = REG_READ(ah, AR_DMADBG_4);
@@ -1139,12 +1145,15 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah)
goto exit;
for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
- if (i < 6)
+ if (i < 6) {
chk_dbg = dma_dbg_4;
- else
+ reg_offset = i * 5;
+ } else {
chk_dbg = dma_dbg_5;
+ reg_offset = (i - 6) * 5;
+ }
- dcu_chain_state = (chk_dbg >> (5 * i)) & 0x1f;
+ dcu_chain_state = (chk_dbg >> reg_offset) & 0x1f;
if (dcu_chain_state == 0x6) {
dcu_wait_frdone = true;
chk_dcu |= BIT(i);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 069/591] wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 068/591] wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 070/591] libbpf: btf_dump_type_data_check_overflow needs to consider BTF_MEMBER_BITFIELD_SIZE Greg Kroah-Hartman
` (525 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin,
Toke Høiland-Jørgensen, Kalle Valo, Sasha Levin,
syzbot+f2cb6e0ffdb961921e4d
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit f24292e827088bba8de7158501ac25a59b064953 ]
For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid
uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should
validate pkt_len before accessing the SKB.
For example, the obtained SKB may have been badly constructed with
pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr
but after being processed in ath9k_htc_rx_msg() and passed to
ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI
command header which should be located inside its data payload.
Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit
memory can be referenced.
Tested on Qualcomm Atheros Communications AR9271 802.11n .
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
Reported-and-tested-by: syzbot+f2cb6e0ffdb961921e4d@syzkaller.appspotmail.com
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230424183348.111355-1-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/wmi.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index 19345b8f7bfd5..d652c647d56b5 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -221,6 +221,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
if (unlikely(wmi->stopped))
goto free_skb;
+ /* Validate the obtained SKB. */
+ if (unlikely(skb->len < sizeof(struct wmi_cmd_hdr)))
+ goto free_skb;
+
hdr = (struct wmi_cmd_hdr *) skb->data;
cmd_id = be16_to_cpu(hdr->command_id);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 070/591] libbpf: btf_dump_type_data_check_overflow needs to consider BTF_MEMBER_BITFIELD_SIZE
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 069/591] wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 071/591] samples/bpf: Fix buffer overflow in tcp_basertt Greg Kroah-Hartman
` (524 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin KaFai Lau, Daniel Borkmann,
Yonghong Song, Sasha Levin
From: Martin KaFai Lau <martin.lau@kernel.org>
[ Upstream commit c39028b333f3a3a765c5c0b9726b8e38aedf0ba1 ]
The btf_dump/struct_data selftest is failing with:
[...]
test_btf_dump_struct_data:FAIL:unexpected return value dumping fs_context unexpected unexpected return value dumping fs_context: actual -7 != expected 264
[...]
The reason is in btf_dump_type_data_check_overflow(). It does not use
BTF_MEMBER_BITFIELD_SIZE from the struct's member (btf_member). Instead,
it is using the enum size which is 4. It had been working till the recent
commit 4e04143c869c ("fs_context: drop the unused lsm_flags member")
removed an integer member which also removed the 4 bytes padding at the
end of the fs_context. Missing this 4 bytes padding exposed this bug. In
particular, when btf_dump_type_data_check_overflow() reaches the member
'phase', -E2BIG is returned.
The fix is to pass bit_sz to btf_dump_type_data_check_overflow(). In
btf_dump_type_data_check_overflow(), it does a different size check when
bit_sz is not zero.
The current fs_context:
[3600] ENUM 'fs_context_purpose' encoding=UNSIGNED size=4 vlen=3
'FS_CONTEXT_FOR_MOUNT' val=0
'FS_CONTEXT_FOR_SUBMOUNT' val=1
'FS_CONTEXT_FOR_RECONFIGURE' val=2
[3601] ENUM 'fs_context_phase' encoding=UNSIGNED size=4 vlen=7
'FS_CONTEXT_CREATE_PARAMS' val=0
'FS_CONTEXT_CREATING' val=1
'FS_CONTEXT_AWAITING_MOUNT' val=2
'FS_CONTEXT_AWAITING_RECONF' val=3
'FS_CONTEXT_RECONF_PARAMS' val=4
'FS_CONTEXT_RECONFIGURING' val=5
'FS_CONTEXT_FAILED' val=6
[3602] STRUCT 'fs_context' size=264 vlen=21
'ops' type_id=3603 bits_offset=0
'uapi_mutex' type_id=235 bits_offset=64
'fs_type' type_id=872 bits_offset=1216
'fs_private' type_id=21 bits_offset=1280
'sget_key' type_id=21 bits_offset=1344
'root' type_id=781 bits_offset=1408
'user_ns' type_id=251 bits_offset=1472
'net_ns' type_id=984 bits_offset=1536
'cred' type_id=1785 bits_offset=1600
'log' type_id=3621 bits_offset=1664
'source' type_id=42 bits_offset=1792
'security' type_id=21 bits_offset=1856
's_fs_info' type_id=21 bits_offset=1920
'sb_flags' type_id=20 bits_offset=1984
'sb_flags_mask' type_id=20 bits_offset=2016
's_iflags' type_id=20 bits_offset=2048
'purpose' type_id=3600 bits_offset=2080 bitfield_size=8
'phase' type_id=3601 bits_offset=2088 bitfield_size=8
'need_free' type_id=67 bits_offset=2096 bitfield_size=1
'global' type_id=67 bits_offset=2097 bitfield_size=1
'oldapi' type_id=67 bits_offset=2098 bitfield_size=1
Fixes: 920d16af9b42 ("libbpf: BTF dumper support for typed data")
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20230428013638.1581263-1-martin.lau@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/btf_dump.c | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
index 4cd1d49c94d6d..713264899250a 100644
--- a/tools/lib/bpf/btf_dump.c
+++ b/tools/lib/bpf/btf_dump.c
@@ -2213,9 +2213,25 @@ static int btf_dump_type_data_check_overflow(struct btf_dump *d,
const struct btf_type *t,
__u32 id,
const void *data,
- __u8 bits_offset)
+ __u8 bits_offset,
+ __u8 bit_sz)
{
- __s64 size = btf__resolve_size(d->btf, id);
+ __s64 size;
+
+ if (bit_sz) {
+ /* bits_offset is at most 7. bit_sz is at most 128. */
+ __u8 nr_bytes = (bits_offset + bit_sz + 7) / 8;
+
+ /* When bit_sz is non zero, it is called from
+ * btf_dump_struct_data() where it only cares about
+ * negative error value.
+ * Return nr_bytes in success case to make it
+ * consistent as the regular integer case below.
+ */
+ return data + nr_bytes > d->typed_dump->data_end ? -E2BIG : nr_bytes;
+ }
+
+ size = btf__resolve_size(d->btf, id);
if (size < 0 || size >= INT_MAX) {
pr_warn("unexpected size [%zu] for id [%u]\n",
@@ -2370,7 +2386,7 @@ static int btf_dump_dump_type_data(struct btf_dump *d,
{
int size, err = 0;
- size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset);
+ size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset, bit_sz);
if (size < 0)
return size;
err = btf_dump_type_data_check_zero(d, t, id, data, bits_offset, bit_sz);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 071/591] samples/bpf: Fix buffer overflow in tcp_basertt
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 070/591] libbpf: btf_dump_type_data_check_overflow needs to consider BTF_MEMBER_BITFIELD_SIZE Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 072/591] spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG Greg Kroah-Hartman
` (523 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengcheng Yang, Alexei Starovoitov,
Sasha Levin
From: Pengcheng Yang <yangpc@wangsu.com>
[ Upstream commit f4dea9689c5fea3d07170c2cb0703e216f1a0922 ]
Using sizeof(nv) or strlen(nv)+1 is correct.
Fixes: c890063e4404 ("bpf: sample BPF_SOCKET_OPS_BASE_RTT program")
Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
Link: https://lore.kernel.org/r/1683276658-2860-1-git-send-email-yangpc@wangsu.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
samples/bpf/tcp_basertt_kern.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/samples/bpf/tcp_basertt_kern.c b/samples/bpf/tcp_basertt_kern.c
index 8dfe09a92feca..822b0742b8154 100644
--- a/samples/bpf/tcp_basertt_kern.c
+++ b/samples/bpf/tcp_basertt_kern.c
@@ -47,7 +47,7 @@ int bpf_basertt(struct bpf_sock_ops *skops)
case BPF_SOCK_OPS_BASE_RTT:
n = bpf_getsockopt(skops, SOL_TCP, TCP_CONGESTION,
cong, sizeof(cong));
- if (!n && !__builtin_memcmp(cong, nv, sizeof(nv)+1)) {
+ if (!n && !__builtin_memcmp(cong, nv, sizeof(nv))) {
/* Set base_rtt to 80us */
rv = 80;
} else if (n) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 072/591] spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 071/591] samples/bpf: Fix buffer overflow in tcp_basertt Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 073/591] wifi: wilc1000: fix for absent RSN capabilities WFA testcase Greg Kroah-Hartman
` (522 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Vijaya Krishna Nivarthi <quic_vnivarth@quicinc.com>
[ Upstream commit 5fd7c99ecf45c8ee8a9b1268f0ffc91cc6271da2 ]
The CS_TOGGLE bit when set is supposed to instruct FW to
toggle CS line between words. The driver with intent of
disabling this behaviour has been unsetting BIT(0). This has
not caused any trouble so far because the original BIT(1)
is untouched and BIT(0) likely wasn't being used.
Correct this to prevent a potential future bug.
Signed-off-by: Vijaya Krishna Nivarthi <quic_vnivarth@quicinc.com
Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org
Fixes: 561de45f72bd ("spi: spi-geni-qcom: Add SPI driver support for GENI based QUP")
Reviewed-by: Douglas Anderson <dianders@chromium.org
Link: https://lore.kernel.org/r/1682412128-1913-1-git-send-email-quic_vnivarth@quicinc.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-geni-qcom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
index dd1581893fe72..689b94fc5570a 100644
--- a/drivers/spi/spi-geni-qcom.c
+++ b/drivers/spi/spi-geni-qcom.c
@@ -35,7 +35,7 @@
#define CS_DEMUX_OUTPUT_SEL GENMASK(3, 0)
#define SE_SPI_TRANS_CFG 0x25c
-#define CS_TOGGLE BIT(0)
+#define CS_TOGGLE BIT(1)
#define SE_SPI_WORD_LEN 0x268
#define WORD_LEN_MSK GENMASK(9, 0)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 073/591] wifi: wilc1000: fix for absent RSN capabilities WFA testcase
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 072/591] spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 074/591] wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan() Greg Kroah-Hartman
` (521 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Amisha Patel, Kalle Valo,
Sasha Levin
From: Amisha Patel <amisha.patel@microchip.com>
[ Upstream commit 9ce4bb09123e9754996e358bd808d39f5d112899 ]
Mandatory WFA testcase
CT_Security_WPA2Personal_STA_RSNEBoundsVerification-AbsentRSNCap,
performs bounds verfication on Beacon and/or Probe response frames. It
failed and observed the reason to be absence of cipher suite and AKM
suite in RSN information. To fix this, enable the RSN flag before extracting RSN
capabilities.
Fixes: cd21d99e595e ("wifi: wilc1000: validate pairwise and authentication suite offsets")
Signed-off-by: Amisha Patel <amisha.patel@microchip.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230421181005.4865-1-amisha.patel@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/microchip/wilc1000/hif.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c
index 67df8221b5aeb..a1b75feec6edf 100644
--- a/drivers/net/wireless/microchip/wilc1000/hif.c
+++ b/drivers/net/wireless/microchip/wilc1000/hif.c
@@ -485,6 +485,9 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
int rsn_ie_len = sizeof(struct element) + rsn_ie[1];
int offset = 8;
+ param->mode_802_11i = 2;
+ param->rsn_found = true;
+
/* extract RSN capabilities */
if (offset < rsn_ie_len) {
/* skip over pairwise suites */
@@ -494,11 +497,8 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
/* skip over authentication suites */
offset += (rsn_ie[offset] * 4) + 2;
- if (offset + 1 < rsn_ie_len) {
- param->mode_802_11i = 2;
- param->rsn_found = true;
+ if (offset + 1 < rsn_ie_len)
memcpy(param->rsn_cap, &rsn_ie[offset], 2);
- }
}
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 074/591] wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 073/591] wifi: wilc1000: fix for absent RSN capabilities WFA testcase Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 075/591] sctp: add bpf_bypass_getsockopt proto callback Greg Kroah-Hartman
` (520 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Simon Horman,
Kalle Valo, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit d9aef04fcfa81ee4fb2804a21a3712b7bbd936af ]
The type of "mwifiex_adapter->nd_info" is "struct cfg80211_wowlan_nd_info",
not "struct cfg80211_wowlan_nd_match".
Use struct_size() to ease the computation of the needed size.
The current code over-allocates some memory, so is safe.
But it wastes 32 bytes.
Fixes: 7d7f07d8c5d3 ("mwifiex: add wowlan net-detect support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/7a6074fb056d2181e058a3cc6048d8155c20aec7.1683371982.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/scan.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index ac8001c842935..644b1e134b01c 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -2187,9 +2187,9 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
if (nd_config) {
adapter->nd_info =
- kzalloc(sizeof(struct cfg80211_wowlan_nd_match) +
- sizeof(struct cfg80211_wowlan_nd_match *) *
- scan_rsp->number_of_sets, GFP_ATOMIC);
+ kzalloc(struct_size(adapter->nd_info, matches,
+ scan_rsp->number_of_sets),
+ GFP_ATOMIC);
if (adapter->nd_info)
adapter->nd_info->n_matches = scan_rsp->number_of_sets;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 075/591] sctp: add bpf_bypass_getsockopt proto callback
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 074/591] wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 076/591] libbpf: fix offsetof() and container_of() to work with CO-RE Greg Kroah-Hartman
` (519 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Borkmann, Christian Brauner,
Stanislav Fomichev, Neil Horman, Marcelo Ricardo Leitner,
Xin Long, linux-sctp, linux-kernel, netdev, Alexander Mikhalitsyn,
David S. Miller, Sasha Levin
From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
[ Upstream commit 2598619e012cee5273a2821441b9a051ad931249 ]
Implement ->bpf_bypass_getsockopt proto callback and filter out
SCTP_SOCKOPT_PEELOFF, SCTP_SOCKOPT_PEELOFF_FLAGS and SCTP_SOCKOPT_CONNECTX3
socket options from running eBPF hook on them.
SCTP_SOCKOPT_PEELOFF and SCTP_SOCKOPT_PEELOFF_FLAGS options do fd_install(),
and if BPF_CGROUP_RUN_PROG_GETSOCKOPT hook returns an error after success of
the original handler sctp_getsockopt(...), userspace will receive an error
from getsockopt syscall and will be not aware that fd was successfully
installed into a fdtable.
As pointed by Marcelo Ricardo Leitner it seems reasonable to skip
bpf getsockopt hook for SCTP_SOCKOPT_CONNECTX3 sockopt too.
Because internaly, it triggers connect() and if error is masked
then userspace will be confused.
This patch was born as a result of discussion around a new SCM_PIDFD interface:
https://lore.kernel.org/all/20230413133355.350571-3-aleksandr.mikhalitsyn@canonical.com/
Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks")
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Stanislav Fomichev <sdf@google.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Cc: Xin Long <lucien.xin@gmail.com>
Cc: linux-sctp@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: netdev@vger.kernel.org
Suggested-by: Stanislav Fomichev <sdf@google.com>
Acked-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/socket.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index bc3d08bd7cef3..e1011311bc877 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -8279,6 +8279,22 @@ static int sctp_getsockopt(struct sock *sk, int level, int optname,
return retval;
}
+static bool sctp_bpf_bypass_getsockopt(int level, int optname)
+{
+ if (level == SOL_SCTP) {
+ switch (optname) {
+ case SCTP_SOCKOPT_PEELOFF:
+ case SCTP_SOCKOPT_PEELOFF_FLAGS:
+ case SCTP_SOCKOPT_CONNECTX3:
+ return true;
+ default:
+ return false;
+ }
+ }
+
+ return false;
+}
+
static int sctp_hash(struct sock *sk)
{
/* STUB */
@@ -9643,6 +9659,7 @@ struct proto sctp_prot = {
.shutdown = sctp_shutdown,
.setsockopt = sctp_setsockopt,
.getsockopt = sctp_getsockopt,
+ .bpf_bypass_getsockopt = sctp_bpf_bypass_getsockopt,
.sendmsg = sctp_sendmsg,
.recvmsg = sctp_recvmsg,
.bind = sctp_bind,
@@ -9698,6 +9715,7 @@ struct proto sctpv6_prot = {
.shutdown = sctp_shutdown,
.setsockopt = sctp_setsockopt,
.getsockopt = sctp_getsockopt,
+ .bpf_bypass_getsockopt = sctp_bpf_bypass_getsockopt,
.sendmsg = sctp_sendmsg,
.recvmsg = sctp_recvmsg,
.bind = sctp_bind,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 076/591] libbpf: fix offsetof() and container_of() to work with CO-RE
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 075/591] sctp: add bpf_bypass_getsockopt proto callback Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 077/591] bpf: Dont EFAULT for {g,s}setsockopt with wrong optlen Greg Kroah-Hartman
` (518 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lennart Poettering, Andrii Nakryiko,
Yonghong Song, Alexei Starovoitov, Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit bdeeed3498c7871c17465bb4f11d1bc67f9098af ]
It seems like __builtin_offset() doesn't preserve CO-RE field
relocations properly. So if offsetof() macro is defined through
__builtin_offset(), CO-RE-enabled BPF code using container_of() will be
subtly and silently broken.
To avoid this problem, redefine offsetof() and container_of() in the
form that works with CO-RE relocations more reliably.
Fixes: 5fbc220862fc ("tools/libpf: Add offsetof/container_of macro in bpf_helpers.h")
Reported-by: Lennart Poettering <lennart@poettering.net>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/r/20230509065502.2306180-1-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/bpf_helpers.h | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/tools/lib/bpf/bpf_helpers.h b/tools/lib/bpf/bpf_helpers.h
index d37c4fe2849d2..2b3b300bf4dfa 100644
--- a/tools/lib/bpf/bpf_helpers.h
+++ b/tools/lib/bpf/bpf_helpers.h
@@ -77,16 +77,21 @@
/*
* Helper macros to manipulate data structures
*/
-#ifndef offsetof
-#define offsetof(TYPE, MEMBER) ((unsigned long)&((TYPE *)0)->MEMBER)
-#endif
-#ifndef container_of
+
+/* offsetof() definition that uses __builtin_offset() might not preserve field
+ * offset CO-RE relocation properly, so force-redefine offsetof() using
+ * old-school approach which works with CO-RE correctly
+ */
+#undef offsetof
+#define offsetof(type, member) ((unsigned long)&((type *)0)->member)
+
+/* redefined container_of() to ensure we use the above offsetof() macro */
+#undef container_of
#define container_of(ptr, type, member) \
({ \
void *__mptr = (void *)(ptr); \
((type *)(__mptr - offsetof(type, member))); \
})
-#endif
/*
* Compiler (optimization) barrier.
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 077/591] bpf: Dont EFAULT for {g,s}setsockopt with wrong optlen
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 076/591] libbpf: fix offsetof() and container_of() to work with CO-RE Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 078/591] spi: dw: Round of n_bytes to power of 2 Greg Kroah-Hartman
` (517 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin KaFai Lau, Stanislav Fomichev,
Sasha Levin
From: Stanislav Fomichev <sdf@google.com>
[ Upstream commit 29ebbba7d46136cba324264e513a1e964ca16c0a ]
With the way the hooks implemented right now, we have a special
condition: optval larger than PAGE_SIZE will expose only first 4k into
BPF; any modifications to the optval are ignored. If the BPF program
doesn't handle this condition by resetting optlen to 0,
the userspace will get EFAULT.
The intention of the EFAULT was to make it apparent to the
developers that the program is doing something wrong.
However, this inadvertently might affect production workloads
with the BPF programs that are not too careful (i.e., returning EFAULT
for perfectly valid setsockopt/getsockopt calls).
Let's try to minimize the chance of BPF program screwing up userspace
by ignoring the output of those BPF programs (instead of returning
EFAULT to the userspace). pr_info_once those cases to
the dmesg to help with figuring out what's going wrong.
Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks")
Suggested-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/r/20230511170456.1759459-2-sdf@google.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/cgroup.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index b86b907e566ca..bb70f400c25eb 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -1826,6 +1826,12 @@ int __cgroup_bpf_run_filter_setsockopt(struct sock *sk, int *level,
ret = 1;
} else if (ctx.optlen > max_optlen || ctx.optlen < -1) {
/* optlen is out of bounds */
+ if (*optlen > PAGE_SIZE && ctx.optlen >= 0) {
+ pr_info_once("bpf setsockopt: ignoring program buffer with optlen=%d (max_optlen=%d)\n",
+ ctx.optlen, max_optlen);
+ ret = 0;
+ goto out;
+ }
ret = -EFAULT;
} else {
/* optlen within bounds, run kernel handler */
@@ -1881,8 +1887,10 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
.optname = optname,
.current_task = current,
};
+ int orig_optlen;
int ret;
+ orig_optlen = max_optlen;
ctx.optlen = max_optlen;
max_optlen = sockopt_alloc_buf(&ctx, max_optlen, &buf);
if (max_optlen < 0)
@@ -1905,6 +1913,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
ret = -EFAULT;
goto out;
}
+ orig_optlen = ctx.optlen;
if (copy_from_user(ctx.optval, optval,
min(ctx.optlen, max_optlen)) != 0) {
@@ -1922,6 +1931,12 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
goto out;
if (optval && (ctx.optlen > max_optlen || ctx.optlen < 0)) {
+ if (orig_optlen > PAGE_SIZE && ctx.optlen >= 0) {
+ pr_info_once("bpf getsockopt: ignoring program buffer with optlen=%d (max_optlen=%d)\n",
+ ctx.optlen, max_optlen);
+ ret = retval;
+ goto out;
+ }
ret = -EFAULT;
goto out;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 078/591] spi: dw: Round of n_bytes to power of 2
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 077/591] bpf: Dont EFAULT for {g,s}setsockopt with wrong optlen Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 079/591] nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() Greg Kroah-Hartman
` (516 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Joy Chakraborty <joychakr@google.com>
[ Upstream commit 9f34baf67e4d08908fd94ff29c825bb673295336 ]
n_bytes variable in the driver represents the number of bytes per word
that needs to be sent/copied to fifo. Bits/word can be between 8 and 32
bits from the client but in memory they are a power of 2, same is mentioned
in spi.h header:
"
* @bits_per_word: Data transfers involve one or more words; word sizes
* like eight or 12 bits are common. In-memory wordsizes are
* powers of two bytes (e.g. 20 bit samples use 32 bits).
* This may be changed by the device's driver, or left at the
* default (0) indicating protocol words are eight bit bytes.
* The spi_transfer.bits_per_word can override this for each transfer.
"
Hence, round of n_bytes to a power of 2 to avoid values like 3 which
would generate unalligned/odd accesses to memory/fifo.
* tested on Baikal-T1 based system with DW SPI-looped back interface
transferring a chunk of data with DFS:8,12,16.
Fixes: a51acc2400d4 ("spi: dw: Add support for 32-bits max xfer size")
Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com
Signed-off-by: Joy Chakraborty <joychakr@google.com
Reviewed-by: Serge Semin <fancer.lancer@gmail.com
Tested-by: Serge Semin <fancer.lancer@gmail.com
Link: https://lore.kernel.org/r/20230512104746.1797865-4-joychakr@google.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-dw-core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-dw-core.c b/drivers/spi/spi-dw-core.c
index c3bfb6c84cab2..4976e3b8923ee 100644
--- a/drivers/spi/spi-dw-core.c
+++ b/drivers/spi/spi-dw-core.c
@@ -426,7 +426,10 @@ static int dw_spi_transfer_one(struct spi_controller *master,
int ret;
dws->dma_mapped = 0;
- dws->n_bytes = DIV_ROUND_UP(transfer->bits_per_word, BITS_PER_BYTE);
+ dws->n_bytes =
+ roundup_pow_of_two(DIV_ROUND_UP(transfer->bits_per_word,
+ BITS_PER_BYTE));
+
dws->tx = (void *)transfer->tx_buf;
dws->tx_len = transfer->len / dws->n_bytes;
dws->rx = transfer->rx_buf;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 079/591] nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 078/591] spi: dw: Round of n_bytes to power of 2 Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 080/591] bpftool: JIT limited misreported as negative value on aarch64 Greg Kroah-Hartman
` (515 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, David S. Miller,
Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 0d9b41daa5907756a31772d8af8ac5ff25cf17c1 ]
If sock->service_name is NULL, the local variable
service_name_tlv_length will not be assigned by nfc_llcp_build_tlv(),
later leading to using value frmo the stack. Smatch warning:
net/nfc/llcp_commands.c:442 nfc_llcp_send_connect() error: uninitialized symbol 'service_name_tlv_length'.
Fixes: de9e5aeb4f40 ("NFC: llcp: Fix usage of llcp_add_tlv()")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/llcp_commands.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index 41e3a20c89355..cdb001de06928 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -390,7 +390,8 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
const u8 *service_name_tlv = NULL;
const u8 *miux_tlv = NULL;
const u8 *rw_tlv = NULL;
- u8 service_name_tlv_length, miux_tlv_length, rw_tlv_length, rw;
+ u8 service_name_tlv_length = 0;
+ u8 miux_tlv_length, rw_tlv_length, rw;
int err;
u16 size = 0;
__be16 miux;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 080/591] bpftool: JIT limited misreported as negative value on aarch64
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 079/591] nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 081/591] bpf: Remove bpf trampoline selector Greg Kroah-Hartman
` (514 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicky Veitch, Alan Maguire,
Daniel Borkmann, Jiri Olsa, Quentin Monnet, Sasha Levin
From: Alan Maguire <alan.maguire@oracle.com>
[ Upstream commit 04cb8453a91c7c22f60ddadb6cef0d19abb33bb5 ]
On aarch64, "bpftool feature" reports an incorrect BPF JIT limit:
$ sudo /sbin/bpftool feature
Scanning system configuration...
bpf() syscall restricted to privileged users
JIT compiler is enabled
JIT compiler hardening is disabled
JIT compiler kallsyms exports are enabled for root
skipping kernel config, can't open file: No such file or directory
Global memory limit for JIT compiler for unprivileged users is -201326592 bytes
This is because /proc/sys/net/core/bpf_jit_limit reports
$ sudo cat /proc/sys/net/core/bpf_jit_limit
68169519595520
...and an int is assumed in read_procfs(). Change read_procfs()
to return a long to avoid negative value reporting.
Fixes: 7a4522bbef0c ("tools: bpftool: add probes for /proc/ eBPF parameters")
Reported-by: Nicky Veitch <nicky.veitch@oracle.com>
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Quentin Monnet <quentin@isovalent.com>
Link: https://lore.kernel.org/bpf/20230512113134.58996-1-alan.maguire@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/feature.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/tools/bpf/bpftool/feature.c b/tools/bpf/bpftool/feature.c
index 36cf0f1517c94..4460399bc8ed8 100644
--- a/tools/bpf/bpftool/feature.c
+++ b/tools/bpf/bpftool/feature.c
@@ -167,12 +167,12 @@ static int get_vendor_id(int ifindex)
return strtol(buf, NULL, 0);
}
-static int read_procfs(const char *path)
+static long read_procfs(const char *path)
{
char *endptr, *line = NULL;
size_t len = 0;
FILE *fd;
- int res;
+ long res;
fd = fopen(path, "r");
if (!fd)
@@ -194,7 +194,7 @@ static int read_procfs(const char *path)
static void probe_unprivileged_disabled(void)
{
- int res;
+ long res;
/* No support for C-style ouptut */
@@ -216,14 +216,14 @@ static void probe_unprivileged_disabled(void)
printf("Unable to retrieve required privileges for bpf() syscall\n");
break;
default:
- printf("bpf() syscall restriction has unknown value %d\n", res);
+ printf("bpf() syscall restriction has unknown value %ld\n", res);
}
}
}
static void probe_jit_enable(void)
{
- int res;
+ long res;
/* No support for C-style ouptut */
@@ -245,7 +245,7 @@ static void probe_jit_enable(void)
printf("Unable to retrieve JIT-compiler status\n");
break;
default:
- printf("JIT-compiler status has unknown value %d\n",
+ printf("JIT-compiler status has unknown value %ld\n",
res);
}
}
@@ -253,7 +253,7 @@ static void probe_jit_enable(void)
static void probe_jit_harden(void)
{
- int res;
+ long res;
/* No support for C-style ouptut */
@@ -275,7 +275,7 @@ static void probe_jit_harden(void)
printf("Unable to retrieve JIT hardening status\n");
break;
default:
- printf("JIT hardening status has unknown value %d\n",
+ printf("JIT hardening status has unknown value %ld\n",
res);
}
}
@@ -283,7 +283,7 @@ static void probe_jit_harden(void)
static void probe_jit_kallsyms(void)
{
- int res;
+ long res;
/* No support for C-style ouptut */
@@ -302,14 +302,14 @@ static void probe_jit_kallsyms(void)
printf("Unable to retrieve JIT kallsyms export status\n");
break;
default:
- printf("JIT kallsyms exports status has unknown value %d\n", res);
+ printf("JIT kallsyms exports status has unknown value %ld\n", res);
}
}
}
static void probe_jit_limit(void)
{
- int res;
+ long res;
/* No support for C-style ouptut */
@@ -322,7 +322,7 @@ static void probe_jit_limit(void)
printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n");
break;
default:
- printf("Global memory limit for JIT compiler for unprivileged users is %d bytes\n", res);
+ printf("Global memory limit for JIT compiler for unprivileged users is %ld bytes\n", res);
}
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 081/591] bpf: Remove bpf trampoline selector
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 080/591] bpftool: JIT limited misreported as negative value on aarch64 Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 082/591] bpf: Fix memleak due to fentry attach failure Greg Kroah-Hartman
` (513 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yafang Shao, Daniel Borkmann,
Song Liu, Jiri Olsa, Sasha Levin
From: Yafang Shao <laoar.shao@gmail.com>
[ Upstream commit 47e79cbeea4b3891ad476047f4c68543eb51c8e0 ]
After commit e21aa341785c ("bpf: Fix fexit trampoline."), the selector is only
used to indicate how many times the bpf trampoline image are updated and been
displayed in the trampoline ksym name. After the trampoline is freed, the
selector will start from 0 again. So the selector is a useless value to the
user. We can remove it.
If the user want to check whether the bpf trampoline image has been updated
or not, the user can compare the address. Each time the trampoline image is
updated, the address will change consequently. Jiri also pointed out another
issue that perf is still using the old name "bpf_trampoline_%lu", so this
change can fix the issue in perf.
Fixes: e21aa341785c ("bpf: Fix fexit trampoline.")
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Song Liu <song@kernel.org>
Cc: Jiri Olsa <olsajiri@gmail.com>
Link: https://lore.kernel.org/bpf/ZFvOOlrmHiY9AgXE@krava
Link: https://lore.kernel.org/bpf/20230515130849.57502-3-laoar.shao@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/bpf.h | 1 -
kernel/bpf/trampoline.c | 11 ++++-------
2 files changed, 4 insertions(+), 8 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 942f9ac9fa7b6..8cef9ec3a89c2 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -933,7 +933,6 @@ struct bpf_trampoline {
int progs_cnt[BPF_TRAMP_MAX];
/* Executable image of trampoline */
struct bpf_tramp_image *cur_image;
- u64 selector;
struct module *mod;
};
diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index f1504cb5b6e19..91d8de938a3dd 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -372,7 +372,7 @@ static void bpf_tramp_image_put(struct bpf_tramp_image *im)
call_rcu_tasks_trace(&im->rcu, __bpf_tramp_image_put_rcu_tasks);
}
-static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, u32 idx)
+static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key)
{
struct bpf_tramp_image *im;
struct bpf_ksym *ksym;
@@ -399,7 +399,7 @@ static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, u32 idx)
ksym = &im->ksym;
INIT_LIST_HEAD_RCU(&ksym->lnode);
- snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu_%u", key, idx);
+ snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu", key);
bpf_image_ksym_add(image, ksym);
return im;
@@ -429,11 +429,10 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
err = unregister_fentry(tr, tr->cur_image->image);
bpf_tramp_image_put(tr->cur_image);
tr->cur_image = NULL;
- tr->selector = 0;
goto out;
}
- im = bpf_tramp_image_alloc(tr->key, tr->selector);
+ im = bpf_tramp_image_alloc(tr->key);
if (IS_ERR(im)) {
err = PTR_ERR(im);
goto out;
@@ -471,8 +470,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
set_memory_ro((long)im->image, 1);
set_memory_x((long)im->image, 1);
- WARN_ON(tr->cur_image && tr->selector == 0);
- WARN_ON(!tr->cur_image && tr->selector);
+ WARN_ON(tr->cur_image && total == 0);
if (tr->cur_image)
/* progs already running at this address */
err = modify_fentry(tr, tr->cur_image->image, im->image, lock_direct_mutex);
@@ -502,7 +500,6 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
if (tr->cur_image)
bpf_tramp_image_put(tr->cur_image);
tr->cur_image = im;
- tr->selector++;
out:
/* If any error happens, restore previous flags */
if (err)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 082/591] bpf: Fix memleak due to fentry attach failure
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 081/591] bpf: Remove bpf trampoline selector Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 083/591] selftests/bpf: Do not use sign-file as testcase Greg Kroah-Hartman
` (512 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yafang Shao, Daniel Borkmann,
Song Liu, Jiri Olsa, Sasha Levin
From: Yafang Shao <laoar.shao@gmail.com>
[ Upstream commit 108598c39eefbedc9882273ac0df96127a629220 ]
If it fails to attach fentry, the allocated bpf trampoline image will be
left in the system. That can be verified by checking /proc/kallsyms.
This meamleak can be verified by a simple bpf program as follows:
SEC("fentry/trap_init")
int fentry_run()
{
return 0;
}
It will fail to attach trap_init because this function is freed after
kernel init, and then we can find the trampoline image is left in the
system by checking /proc/kallsyms.
$ tail /proc/kallsyms
ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf]
ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf]
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'"
[2522] FUNC 'trap_init' type_id=119 linkage=static
$ echo $((6442453466 & 0x7fffffff))
2522
Note that there are two left bpf trampoline images, that is because the
libbpf will fallback to raw tracepoint if -EINVAL is returned.
Fixes: e21aa341785c ("bpf: Fix fexit trampoline.")
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Song Liu <song@kernel.org>
Cc: Jiri Olsa <olsajiri@gmail.com>
Link: https://lore.kernel.org/bpf/20230515130849.57502-2-laoar.shao@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/trampoline.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index 91d8de938a3dd..30af8f66e17b4 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -279,11 +279,8 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total, bool *ip_a
return tlinks;
}
-static void __bpf_tramp_image_put_deferred(struct work_struct *work)
+static void bpf_tramp_image_free(struct bpf_tramp_image *im)
{
- struct bpf_tramp_image *im;
-
- im = container_of(work, struct bpf_tramp_image, work);
bpf_image_ksym_del(&im->ksym);
bpf_jit_free_exec(im->image);
bpf_jit_uncharge_modmem(PAGE_SIZE);
@@ -291,6 +288,14 @@ static void __bpf_tramp_image_put_deferred(struct work_struct *work)
kfree_rcu(im, rcu);
}
+static void __bpf_tramp_image_put_deferred(struct work_struct *work)
+{
+ struct bpf_tramp_image *im;
+
+ im = container_of(work, struct bpf_tramp_image, work);
+ bpf_tramp_image_free(im);
+}
+
/* callback, fexit step 3 or fentry step 2 */
static void __bpf_tramp_image_put_rcu(struct rcu_head *rcu)
{
@@ -465,7 +470,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
&tr->func.model, tr->flags, tlinks,
tr->func.addr);
if (err < 0)
- goto out;
+ goto out_free;
set_memory_ro((long)im->image, 1);
set_memory_x((long)im->image, 1);
@@ -495,7 +500,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
}
#endif
if (err)
- goto out;
+ goto out_free;
if (tr->cur_image)
bpf_tramp_image_put(tr->cur_image);
@@ -506,6 +511,10 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
tr->flags = orig_flags;
kfree(tlinks);
return err;
+
+out_free:
+ bpf_tramp_image_free(im);
+ goto out;
}
static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 083/591] selftests/bpf: Do not use sign-file as testcase
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 082/591] bpf: Fix memleak due to fentry attach failure Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 084/591] regulator: core: Fix more error checking for debugfs_create_dir() Greg Kroah-Hartman
` (511 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Gladkov, Daniel Borkmann,
Roberto Sassu, Stanislav Fomichev, Sasha Levin
From: Alexey Gladkov <legion@kernel.org>
[ Upstream commit f04a32b2c5b539e3c097cb5c7c1df12a8f4a0cf0 ]
The sign-file utility (from scripts/) is used in prog_tests/verify_pkcs7_sig.c,
but the utility should not be called as a test. Executing this utility produces
the following error:
selftests: /linux/tools/testing/selftests/bpf: urandom_read
ok 16 selftests: /linux/tools/testing/selftests/bpf: urandom_read
selftests: /linux/tools/testing/selftests/bpf: sign-file
not ok 17 selftests: /linux/tools/testing/selftests/bpf: sign-file # exit=2
Also, urandom_read is mistakenly used as a test. It does not lead to an error,
but should be moved over to TEST_GEN_FILES as well. The empty TEST_CUSTOM_PROGS
can then be removed.
Fixes: fc97590668ae ("selftests/bpf: Add test for bpf_verify_pkcs7_signature() kfunc")
Signed-off-by: Alexey Gladkov <legion@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
Acked-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/bpf/ZEuWFk3QyML9y5QQ@example.org
Link: https://lore.kernel.org/bpf/88e3ab23029d726a2703adcf6af8356f7a2d3483.1684316821.git.legion@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/Makefile | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 0465ddc81f352..3b57fbf8fff4a 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -85,8 +85,7 @@ TEST_GEN_PROGS_EXTENDED = test_sock_addr test_skb_cgroup_id_user \
test_lirc_mode2_user xdping test_cpp runqslower bench bpf_testmod.ko \
xskxceiver xdp_redirect_multi xdp_synproxy veristat
-TEST_CUSTOM_PROGS = $(OUTPUT)/urandom_read $(OUTPUT)/sign-file
-TEST_GEN_FILES += liburandom_read.so
+TEST_GEN_FILES += liburandom_read.so urandom_read sign-file
# Emit succinct information message describing current building step
# $1 - generic step name (e.g., CC, LINK, etc);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 084/591] regulator: core: Fix more error checking for debugfs_create_dir()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 083/591] selftests/bpf: Do not use sign-file as testcase Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 085/591] regulator: core: Streamline debugfs operations Greg Kroah-Hartman
` (510 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Mark Brown,
Sasha Levin
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 2715bb11cfff964aa33946847f9527cfbd4874f5 ]
In case of failure, debugfs_create_dir() does not return NULL, but an
error pointer. Most incorrect error checks were fixed, but the one in
create_regulator() was forgotten.
Fix the remaining error check.
Fixes: 2bf1c45be3b8f3a3 ("regulator: Fix error checking for debugfs_create_dir")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/ee980a108b5854dd8ce3630f8f673e784e057d17.1685013051.git.geert+renesas@glider.be
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index e01cade8be0c7..eaf9d99f1f43c 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1918,7 +1918,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
if (err != -EEXIST)
regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs);
- if (!regulator->debugfs) {
+ if (IS_ERR(regulator->debugfs)) {
rdev_dbg(rdev, "Failed to create debugfs directory\n");
} else {
debugfs_create_u32("uA_load", 0444, regulator->debugfs,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 085/591] regulator: core: Streamline debugfs operations
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 084/591] regulator: core: Fix more error checking for debugfs_create_dir() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 086/591] wifi: orinoco: Fix an error handling path in spectrum_cs_probe() Greg Kroah-Hartman
` (509 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Mark Brown,
Sasha Levin
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 08880713ceec023dd94d634f1e8902728c385939 ]
If CONFIG_DEBUG_FS is not set:
regulator: Failed to create debugfs directory
...
regulator-dummy: Failed to create debugfs directory
As per the comments for debugfs_create_dir(), errors returned by this
function should be expected, and ignored:
* If debugfs is not enabled in the kernel, the value -%ENODEV will be
* returned.
*
* NOTE: it's expected that most callers should _ignore_ the errors returned
* by this function. Other debugfs functions handle the fact that the "dentry"
* passed to them could be an error and they don't crash in that case.
* Drivers should generally work fine even if debugfs fails to init anyway.
Adhere to the debugfs spirit, and streamline all operations by:
1. Demoting the importance of the printed error messages to debug
level, like is already done in create_regulator(),
2. Further ignoring any returned errors, as by design, all debugfs
functions are no-ops when passed an error pointer.
Fixes: 2bf1c45be3b8f3a3 ("regulator: Fix error checking for debugfs_create_dir")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/2f8bb6e113359ddfab7b59e4d4274bd4c06d6d0a.1685013051.git.geert+renesas@glider.be
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 30 +++++++++++++-----------------
1 file changed, 13 insertions(+), 17 deletions(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index eaf9d99f1f43c..351f0fd225b14 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1918,19 +1918,17 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
if (err != -EEXIST)
regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs);
- if (IS_ERR(regulator->debugfs)) {
+ if (IS_ERR(regulator->debugfs))
rdev_dbg(rdev, "Failed to create debugfs directory\n");
- } else {
- debugfs_create_u32("uA_load", 0444, regulator->debugfs,
- ®ulator->uA_load);
- debugfs_create_u32("min_uV", 0444, regulator->debugfs,
- ®ulator->voltage[PM_SUSPEND_ON].min_uV);
- debugfs_create_u32("max_uV", 0444, regulator->debugfs,
- ®ulator->voltage[PM_SUSPEND_ON].max_uV);
- debugfs_create_file("constraint_flags", 0444,
- regulator->debugfs, regulator,
- &constraint_flags_fops);
- }
+
+ debugfs_create_u32("uA_load", 0444, regulator->debugfs,
+ ®ulator->uA_load);
+ debugfs_create_u32("min_uV", 0444, regulator->debugfs,
+ ®ulator->voltage[PM_SUSPEND_ON].min_uV);
+ debugfs_create_u32("max_uV", 0444, regulator->debugfs,
+ ®ulator->voltage[PM_SUSPEND_ON].max_uV);
+ debugfs_create_file("constraint_flags", 0444, regulator->debugfs,
+ regulator, &constraint_flags_fops);
/*
* Check now if the regulator is an always on regulator - if
@@ -5257,10 +5255,8 @@ static void rdev_init_debugfs(struct regulator_dev *rdev)
}
rdev->debugfs = debugfs_create_dir(rname, debugfs_root);
- if (IS_ERR(rdev->debugfs)) {
- rdev_warn(rdev, "Failed to create debugfs directory\n");
- return;
- }
+ if (IS_ERR(rdev->debugfs))
+ rdev_dbg(rdev, "Failed to create debugfs directory\n");
debugfs_create_u32("use_count", 0444, rdev->debugfs,
&rdev->use_count);
@@ -6180,7 +6176,7 @@ static int __init regulator_init(void)
debugfs_root = debugfs_create_dir("regulator", NULL);
if (IS_ERR(debugfs_root))
- pr_warn("regulator: Failed to create debugfs directory\n");
+ pr_debug("regulator: Failed to create debugfs directory\n");
#ifdef CONFIG_DEBUG_FS
debugfs_create_file("supply_map", 0444, debugfs_root, NULL,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 086/591] wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 085/591] regulator: core: Streamline debugfs operations Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 087/591] wifi: orinoco: Fix an error handling path in orinoco_cs_probe() Greg Kroah-Hartman
` (508 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Simon Horman,
Kalle Valo, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 925244325159824385209e3e0e3f91fa6bf0646c ]
Should spectrum_cs_config() fail, some resources need to be released as
already done in the remove function.
While at it, remove a useless and erroneous comment. The probe is
spectrum_cs_probe(), not spectrum_cs_attach().
Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/c0bc0c21c58ca477fc5521607615bafbf2aef8eb.1684567733.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intersil/orinoco/spectrum_cs.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c
index 291ef97ed45ec..841d623c621ac 100644
--- a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c
+++ b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c
@@ -157,6 +157,7 @@ spectrum_cs_probe(struct pcmcia_device *link)
{
struct orinoco_private *priv;
struct orinoco_pccard *card;
+ int ret;
priv = alloc_orinocodev(sizeof(*card), &link->dev,
spectrum_cs_hard_reset,
@@ -169,8 +170,16 @@ spectrum_cs_probe(struct pcmcia_device *link)
card->p_dev = link;
link->priv = priv;
- return spectrum_cs_config(link);
-} /* spectrum_cs_attach */
+ ret = spectrum_cs_config(link);
+ if (ret)
+ goto err_free_orinocodev;
+
+ return 0;
+
+err_free_orinocodev:
+ free_orinocodev(priv);
+ return ret;
+}
static void spectrum_cs_detach(struct pcmcia_device *link)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 087/591] wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 086/591] wifi: orinoco: Fix an error handling path in spectrum_cs_probe() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 088/591] wifi: atmel: Fix an error handling path in atmel_probe() Greg Kroah-Hartman
` (507 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Kalle Valo,
Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 67a81d911c01225f426cc6bee2373df044c1a9b7 ]
Should orinoco_cs_config() fail, some resources need to be released as
already done in the remove function.
While at it, remove a useless and erroneous comment. The probe is
orinoco_cs_probe(), not orinoco_cs_attach().
Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/e24735ce4d82901d5f7ea08419eea53bfdde3d65.1684568286.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intersil/orinoco/orinoco_cs.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c
index a956f965a1e5e..03bfd2482656c 100644
--- a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c
@@ -96,6 +96,7 @@ orinoco_cs_probe(struct pcmcia_device *link)
{
struct orinoco_private *priv;
struct orinoco_pccard *card;
+ int ret;
priv = alloc_orinocodev(sizeof(*card), &link->dev,
orinoco_cs_hard_reset, NULL);
@@ -107,8 +108,16 @@ orinoco_cs_probe(struct pcmcia_device *link)
card->p_dev = link;
link->priv = priv;
- return orinoco_cs_config(link);
-} /* orinoco_cs_attach */
+ ret = orinoco_cs_config(link);
+ if (ret)
+ goto err_free_orinocodev;
+
+ return 0;
+
+err_free_orinocodev:
+ free_orinocodev(priv);
+ return ret;
+}
static void orinoco_cs_detach(struct pcmcia_device *link)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 088/591] wifi: atmel: Fix an error handling path in atmel_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 087/591] wifi: orinoco: Fix an error handling path in orinoco_cs_probe() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 089/591] wifi: wl3501_cs: Fix an error handling path in wl3501_probe() Greg Kroah-Hartman
` (506 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Simon Horman,
Kalle Valo, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 6b92e4351a29af52c285fe235e6e4d1a75de04b2 ]
Should atmel_config() fail, some resources need to be released as already
done in the remove function.
While at it, remove a useless and erroneous comment. The probe is
atmel_probe(), not atmel_attach().
Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/1e65f174607a83348034197fa7d603bab10ba4a9.1684569156.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/atmel/atmel_cs.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/atmel/atmel_cs.c b/drivers/net/wireless/atmel/atmel_cs.c
index 453bb84cb3386..58bba9875d366 100644
--- a/drivers/net/wireless/atmel/atmel_cs.c
+++ b/drivers/net/wireless/atmel/atmel_cs.c
@@ -72,6 +72,7 @@ struct local_info {
static int atmel_probe(struct pcmcia_device *p_dev)
{
struct local_info *local;
+ int ret;
dev_dbg(&p_dev->dev, "atmel_attach()\n");
@@ -82,8 +83,16 @@ static int atmel_probe(struct pcmcia_device *p_dev)
p_dev->priv = local;
- return atmel_config(p_dev);
-} /* atmel_attach */
+ ret = atmel_config(p_dev);
+ if (ret)
+ goto err_free_priv;
+
+ return 0;
+
+err_free_priv:
+ kfree(p_dev->priv);
+ return ret;
+}
static void atmel_detach(struct pcmcia_device *link)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 089/591] wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 088/591] wifi: atmel: Fix an error handling path in atmel_probe() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 090/591] wifi: ray_cs: Fix an error handling path in ray_probe() Greg Kroah-Hartman
` (505 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Simon Horman,
Kalle Valo, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 391af06a02e7642039ac5f6c4b2c034ab0992b5d ]
Should wl3501_config() fail, some resources need to be released as already
done in the remove function.
Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/7cc9c9316489b7d69b36aeb0edd3123538500b41.1684569865.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/wl3501_cs.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 7fb2f95134760..c45c4b7cbbaf1 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -1862,6 +1862,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
{
struct net_device *dev;
struct wl3501_card *this;
+ int ret;
/* The io structure describes IO port mapping */
p_dev->resource[0]->end = 16;
@@ -1873,8 +1874,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
dev = alloc_etherdev(sizeof(struct wl3501_card));
if (!dev)
- goto out_link;
-
+ return -ENOMEM;
dev->netdev_ops = &wl3501_netdev_ops;
dev->watchdog_timeo = 5 * HZ;
@@ -1887,9 +1887,15 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
netif_stop_queue(dev);
p_dev->priv = dev;
- return wl3501_config(p_dev);
-out_link:
- return -ENOMEM;
+ ret = wl3501_config(p_dev);
+ if (ret)
+ goto out_free_etherdev;
+
+ return 0;
+
+out_free_etherdev:
+ free_netdev(dev);
+ return ret;
}
static int wl3501_config(struct pcmcia_device *link)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 090/591] wifi: ray_cs: Fix an error handling path in ray_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 089/591] wifi: wl3501_cs: Fix an error handling path in wl3501_probe() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 091/591] wifi: ath9k: dont allow to overwrite ENDPOINT0 attributes Greg Kroah-Hartman
` (504 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Simon Horman,
Kalle Valo, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 4f8d66a9fb2edcd05c1e563456a55a08910bfb37 ]
Should ray_config() fail, some resources need to be released as already
done in the remove function.
While at it, remove a useless and erroneous comment. The probe is
ray_probe(), not ray_attach().
Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/8c544d18084f8b37dd108e844f7e79e85ff708ff.1684570373.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ray_cs.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 1f57a0055bbd8..38782d4c4694a 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -270,13 +270,14 @@ static int ray_probe(struct pcmcia_device *p_dev)
{
ray_dev_t *local;
struct net_device *dev;
+ int ret;
dev_dbg(&p_dev->dev, "ray_attach()\n");
/* Allocate space for private device-specific data */
dev = alloc_etherdev(sizeof(ray_dev_t));
if (!dev)
- goto fail_alloc_dev;
+ return -ENOMEM;
local = netdev_priv(dev);
local->finder = p_dev;
@@ -313,11 +314,16 @@ static int ray_probe(struct pcmcia_device *p_dev)
timer_setup(&local->timer, NULL, 0);
this_device = p_dev;
- return ray_config(p_dev);
+ ret = ray_config(p_dev);
+ if (ret)
+ goto err_free_dev;
+
+ return 0;
-fail_alloc_dev:
- return -ENOMEM;
-} /* ray_attach */
+err_free_dev:
+ free_netdev(dev);
+ return ret;
+}
static void ray_detach(struct pcmcia_device *link)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 091/591] wifi: ath9k: dont allow to overwrite ENDPOINT0 attributes
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 090/591] wifi: ray_cs: Fix an error handling path in ray_probe() Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 092/591] samples/bpf: xdp1 and xdp2 reduce XDPBUFSIZE to 60 Greg Kroah-Hartman
` (503 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+b68fbebe56d8362907e8,
Fedor Pchelkin, Toke Høiland-Jørgensen, Kalle Valo,
Sasha Levin
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit 061b0cb9327b80d7a0f63a33e7c3e2a91a71f142 ]
A bad USB device is able to construct a service connection response
message with target endpoint being ENDPOINT0 which is reserved for
HTC_CTRL_RSVD_SVC and should not be modified to be used for any other
services.
Reject such service connection responses.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
Reported-by: syzbot+b68fbebe56d8362907e8@syzkaller.appspotmail.com
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230516150427.79469-1-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/htc_hst.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index fe62ff668f757..99667aba289df 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -114,7 +114,13 @@ static void htc_process_conn_rsp(struct htc_target *target,
if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) {
epid = svc_rspmsg->endpoint_id;
- if (epid < 0 || epid >= ENDPOINT_MAX)
+
+ /* Check that the received epid for the endpoint to attach
+ * a new service is valid. ENDPOINT0 can't be used here as it
+ * is already reserved for HTC_CTRL_RSVD_SVC service and thus
+ * should not be modified.
+ */
+ if (epid <= ENDPOINT0 || epid >= ENDPOINT_MAX)
return;
service_id = be16_to_cpu(svc_rspmsg->service_id);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 092/591] samples/bpf: xdp1 and xdp2 reduce XDPBUFSIZE to 60
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 091/591] wifi: ath9k: dont allow to overwrite ENDPOINT0 attributes Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 093/591] wifi: ath10k: Trigger STA disconnect after reconfig complete on hardware restart Greg Kroah-Hartman
` (502 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jesper Dangaard Brouer,
Daniel Borkmann, Tariq Toukan, Sasha Levin
From: Jesper Dangaard Brouer <brouer@redhat.com>
[ Upstream commit 60548b825b082cedf89b275c21c28b1e1d030e50 ]
Default samples/pktgen scripts send 60 byte packets as hardware adds
4-bytes FCS checksum, which fulfils minimum Ethernet 64 bytes frame
size.
XDP layer will not necessary have access to the 4-bytes FCS checksum.
This leads to bpf_xdp_load_bytes() failing as it tries to copy 64-bytes
from an XDP packet that only have 60-bytes available.
Fixes: 772251742262 ("samples/bpf: fixup some tools to be able to support xdp multibuffer")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://lore.kernel.org/bpf/168545704139.2996228.2516528552939485216.stgit@firesoul
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
samples/bpf/xdp1_kern.c | 2 +-
samples/bpf/xdp2_kern.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/samples/bpf/xdp1_kern.c b/samples/bpf/xdp1_kern.c
index 0a5c704badd00..d91f27cbcfa99 100644
--- a/samples/bpf/xdp1_kern.c
+++ b/samples/bpf/xdp1_kern.c
@@ -39,7 +39,7 @@ static int parse_ipv6(void *data, u64 nh_off, void *data_end)
return ip6h->nexthdr;
}
-#define XDPBUFSIZE 64
+#define XDPBUFSIZE 60
SEC("xdp.frags")
int xdp_prog1(struct xdp_md *ctx)
{
diff --git a/samples/bpf/xdp2_kern.c b/samples/bpf/xdp2_kern.c
index 67804ecf7ce37..8bca674451ed1 100644
--- a/samples/bpf/xdp2_kern.c
+++ b/samples/bpf/xdp2_kern.c
@@ -55,7 +55,7 @@ static int parse_ipv6(void *data, u64 nh_off, void *data_end)
return ip6h->nexthdr;
}
-#define XDPBUFSIZE 64
+#define XDPBUFSIZE 60
SEC("xdp.frags")
int xdp_prog1(struct xdp_md *ctx)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 093/591] wifi: ath10k: Trigger STA disconnect after reconfig complete on hardware restart
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 092/591] samples/bpf: xdp1 and xdp2 reduce XDPBUFSIZE to 60 Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 094/591] wifi: mac80211: recalc min chandef for new STA links Greg Kroah-Hartman
` (501 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Youghandhar Chintala, Kalle Valo,
Sasha Levin
From: Youghandhar Chintala <quic_youghand@quicinc.com>
[ Upstream commit 75bd32f5ce94bc365ba0b9b68bcf9de84a391d37 ]
Currently, on WCN3990, the station disconnect after hardware recovery is
not working as expected. This is because of setting the
IEEE80211_SDATA_DISCONNECT_HW_RESTART flag very early in the hardware
recovery process even before the driver invokes ieee80211_hw_restart().
On the contrary, mac80211 expects this flag to be set after
ieee80211_hw_restart() is invoked for it to trigger station disconnect.
Set the IEEE80211_SDATA_DISCONNECT_HW_RESTART flag in
ath10k_reconfig_complete() instead to fix this.
The other targets are not affected by this change, since the hardware
params flag is not set.
Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2.c10-00754-QCAHLSWMTPL-1
Fixes: 2c3fc50591ff ("ath10k: Trigger sta disconnect on hardware restart")
Signed-off-by: Youghandhar Chintala <quic_youghand@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230518101515.3820-1-quic_youghand@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/core.c | 9 ---------
drivers/net/wireless/ath/ath10k/mac.c | 7 +++++++
2 files changed, 7 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 5eb131ab916fd..b6052dcc45ebf 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -2504,7 +2504,6 @@ EXPORT_SYMBOL(ath10k_core_napi_sync_disable);
static void ath10k_core_restart(struct work_struct *work)
{
struct ath10k *ar = container_of(work, struct ath10k, restart_work);
- struct ath10k_vif *arvif;
int ret;
set_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags);
@@ -2543,14 +2542,6 @@ static void ath10k_core_restart(struct work_struct *work)
ar->state = ATH10K_STATE_RESTARTING;
ath10k_halt(ar);
ath10k_scan_finish(ar);
- if (ar->hw_params.hw_restart_disconnect) {
- list_for_each_entry(arvif, &ar->arvifs, list) {
- if (arvif->is_up &&
- arvif->vdev_type == WMI_VDEV_TYPE_STA)
- ieee80211_hw_restart_disconnect(arvif->vif);
- }
- }
-
ieee80211_restart_hw(ar->hw);
break;
case ATH10K_STATE_OFF:
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index ec8d5b29bc72c..f0729acdec50a 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -8108,6 +8108,7 @@ static void ath10k_reconfig_complete(struct ieee80211_hw *hw,
enum ieee80211_reconfig_type reconfig_type)
{
struct ath10k *ar = hw->priv;
+ struct ath10k_vif *arvif;
if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART)
return;
@@ -8122,6 +8123,12 @@ static void ath10k_reconfig_complete(struct ieee80211_hw *hw,
ar->state = ATH10K_STATE_ON;
ieee80211_wake_queues(ar->hw);
clear_bit(ATH10K_FLAG_RESTARTING, &ar->dev_flags);
+ if (ar->hw_params.hw_restart_disconnect) {
+ list_for_each_entry(arvif, &ar->arvifs, list) {
+ if (arvif->is_up && arvif->vdev_type == WMI_VDEV_TYPE_STA)
+ ieee80211_hw_restart_disconnect(arvif->vif);
+ }
+ }
}
mutex_unlock(&ar->conf_mutex);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 094/591] wifi: mac80211: recalc min chandef for new STA links
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 093/591] wifi: ath10k: Trigger STA disconnect after reconfig complete on hardware restart Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 095/591] selftests/bpf: Fix check_mtu using wrong variable type Greg Kroah-Hartman
` (500 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Gregory Greenman,
Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit ba7af2654e3b7b810c750b3c6106f6f20b81cc88 ]
When adding a new link to a station, this needs to cause a
recalculation of the minimum chandef since otherwise we can
have a higher bandwidth station connected on that link than
the link is operating at. Do the appropriate recalc.
Fixes: cb71f1d136a6 ("wifi: mac80211: add sta link addition/removal")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230604120651.377adf3c789a.I91bf28f399e16e6ac1f83bacd1029a698b4e6685@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/sta_info.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 30efa26f977f6..b8c6f6a668fc9 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2861,6 +2861,8 @@ int ieee80211_sta_activate_link(struct sta_info *sta, unsigned int link_id)
if (!test_sta_flag(sta, WLAN_STA_INSERTED))
goto hash;
+ ieee80211_recalc_min_chandef(sdata, link_id);
+
/* Ensure the values are updated for the driver,
* redone by sta_remove_link on failure.
*/
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 095/591] selftests/bpf: Fix check_mtu using wrong variable type
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 094/591] wifi: mac80211: recalc min chandef for new STA links Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 096/591] wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled Greg Kroah-Hartman
` (499 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter,
Jesper Dangaard Brouer, Daniel Borkmann, Simon Horman,
Sasha Levin
From: Jesper Dangaard Brouer <brouer@redhat.com>
[ Upstream commit 095641817e1bf6aa2560e025e47575188ee3edaf ]
Dan Carpenter found via Smatch static checker, that unsigned 'mtu_lo' is
never less than zero.
Variable mtu_lo should have been an 'int', because read_mtu_device_lo()
uses minus as error indications.
Fixes: b62eba563229 ("selftests/bpf: Tests using bpf_check_mtu BPF-helper")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/bpf/168605104733.3636467.17945947801753092590.stgit@firesoul
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/prog_tests/check_mtu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/check_mtu.c b/tools/testing/selftests/bpf/prog_tests/check_mtu.c
index 12f4395f18b37..a756760a45edb 100644
--- a/tools/testing/selftests/bpf/prog_tests/check_mtu.c
+++ b/tools/testing/selftests/bpf/prog_tests/check_mtu.c
@@ -183,7 +183,7 @@ static void test_check_mtu_tc(__u32 mtu, __u32 ifindex)
void serial_test_check_mtu(void)
{
- __u32 mtu_lo;
+ int mtu_lo;
if (test__start_subtest("bpf_check_mtu XDP-attach"))
test_check_mtu_xdp_attach();
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 096/591] wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 095/591] selftests/bpf: Fix check_mtu using wrong variable type Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 097/591] wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown Greg Kroah-Hartman
` (498 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Simon Horman,
Kalle Valo, Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit b241e260820b68c09586e8a0ae0fc23c0e3215bd ]
In case WoWlan was never configured during the operation of the system,
the hw->wiphy->wowlan_config will be NULL. rsi_config_wowlan() checks
whether wowlan_config is non-NULL and if it is not, then WARNs about it.
The warning is valid, as during normal operation the rsi_config_wowlan()
should only ever be called with non-NULL wowlan_config. In shutdown this
rsi_config_wowlan() should only ever be called if WoWlan was configured
before by the user.
Add checks for non-NULL wowlan_config into the shutdown hook. While at it,
check whether the wiphy is also non-NULL before accessing wowlan_config .
Drop the single-use wowlan_config variable, just inline it into function
call.
Fixes: 16bbc3eb8372 ("rsi: fix null pointer dereference during rsi_shutdown()")
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230527222833.273741-1-marex@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/rsi/rsi_91x_sdio.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
index d09998796ac08..6e33a2563fdbd 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -1463,10 +1463,8 @@ static void rsi_shutdown(struct device *dev)
rsi_dbg(ERR_ZONE, "SDIO Bus shutdown =====>\n");
- if (hw) {
- struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
-
- if (rsi_config_wowlan(adapter, wowlan))
+ if (hw && hw->wiphy && hw->wiphy->wowlan_config) {
+ if (rsi_config_wowlan(adapter, hw->wiphy->wowlan_config))
rsi_dbg(ERR_ZONE, "Failed to configure WoWLAN\n");
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 097/591] wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 096/591] wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 098/591] ice: handle extts in the miscellaneous interrupt thread Greg Kroah-Hartman
` (497 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Simon Horman,
Kalle Valo, Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit e74f562328b03fbe9cf438f958464dff3a644dfc ]
It makes no sense to set MMC_PM_KEEP_POWER in shutdown. The flag
indicates to the MMC subsystem to keep the slot powered on during
suspend, but in shutdown the slot should actually be powered off.
Drop this call.
Fixes: 063848c3e155 ("rsi: sdio: Add WOWLAN support for S5 shutdown state")
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230527222859.273768-1-marex@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/rsi/rsi_91x_sdio.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
index 6e33a2563fdbd..1911fef3bbad6 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -1479,9 +1479,6 @@ static void rsi_shutdown(struct device *dev)
if (sdev->write_fail)
rsi_dbg(INFO_ZONE, "###### Device is not ready #######\n");
- if (rsi_set_sdio_pm_caps(adapter))
- rsi_dbg(INFO_ZONE, "Setting power management caps failed\n");
-
rsi_dbg(INFO_ZONE, "***** RSI module shut down *****\n");
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 098/591] ice: handle extts in the miscellaneous interrupt thread
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 097/591] wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 099/591] selftests: cgroup: fix unexpected failure on test_memcg_low Greg Kroah-Hartman
` (496 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karol Kolacinski, Jacob Keller,
Tony Nguyen, Sasha Levin, Arpana Arland
From: Karol Kolacinski <karol.kolacinski@intel.com>
[ Upstream commit 6e8b2c88fc8cf95ed09de25946b20b7536c88cd5 ]
The ice_ptp_extts_work() and ice_ptp_periodic_work() functions are both
scheduled on the same kthread worker, pf.ptp.kworker. The
ice_ptp_periodic_work() function sends to the firmware to interact with the
PHY, and must block to wait for responses.
This can cause delay in responding to the PFINT_OICR_TSYN_EVNT interrupt
cause, ultimately resulting in disruption to processing an input signal of
the frequency is high enough. In our testing, even 100 Hz signals get
disrupted.
Fix this by instead processing the signal inside the miscellaneous
interrupt thread prior to handling Tx timestamps.
Use atomic bits in a new pf->misc_thread bitmap in order to safely
communicate which tasks require processing within the
ice_misc_intr_thread_fn(). This ensures the communication of desired tasks
from the ice_misc_intr() are correctly processed without racing even in the
event that the interrupt triggers again before the thread function exits.
Fixes: 172db5f91d5f ("ice: add support for auxiliary input/output pins")
Signed-off-by: Karol Kolacinski <karol.kolacinski@intel.com>
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice.h | 7 ++++++
drivers/net/ethernet/intel/ice/ice_main.c | 29 ++++++++++++++++-------
drivers/net/ethernet/intel/ice/ice_ptp.c | 12 +++-------
drivers/net/ethernet/intel/ice/ice_ptp.h | 4 ++--
4 files changed, 33 insertions(+), 19 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index ca6b877fdde81..f2be383d97df5 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -491,6 +491,12 @@ enum ice_pf_flags {
ICE_PF_FLAGS_NBITS /* must be last */
};
+enum ice_misc_thread_tasks {
+ ICE_MISC_THREAD_EXTTS_EVENT,
+ ICE_MISC_THREAD_TX_TSTAMP,
+ ICE_MISC_THREAD_NBITS /* must be last */
+};
+
struct ice_switchdev_info {
struct ice_vsi *control_vsi;
struct ice_vsi *uplink_vsi;
@@ -532,6 +538,7 @@ struct ice_pf {
DECLARE_BITMAP(features, ICE_F_MAX);
DECLARE_BITMAP(state, ICE_STATE_NBITS);
DECLARE_BITMAP(flags, ICE_PF_FLAGS_NBITS);
+ DECLARE_BITMAP(misc_thread, ICE_MISC_THREAD_NBITS);
unsigned long *avail_txqs; /* bitmap to track PF Tx queue usage */
unsigned long *avail_rxqs; /* bitmap to track PF Rx queue usage */
unsigned long serv_tmr_period;
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 4095fe40dfc9b..7a5ec3ce3407a 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -3116,20 +3116,28 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data)
if (oicr & PFINT_OICR_TSYN_TX_M) {
ena_mask &= ~PFINT_OICR_TSYN_TX_M;
- if (!hw->reset_ongoing)
+ if (!hw->reset_ongoing) {
+ set_bit(ICE_MISC_THREAD_TX_TSTAMP, pf->misc_thread);
ret = IRQ_WAKE_THREAD;
+ }
}
if (oicr & PFINT_OICR_TSYN_EVNT_M) {
u8 tmr_idx = hw->func_caps.ts_func_info.tmr_index_owned;
u32 gltsyn_stat = rd32(hw, GLTSYN_STAT(tmr_idx));
- /* Save EVENTs from GTSYN register */
- pf->ptp.ext_ts_irq |= gltsyn_stat & (GLTSYN_STAT_EVENT0_M |
- GLTSYN_STAT_EVENT1_M |
- GLTSYN_STAT_EVENT2_M);
ena_mask &= ~PFINT_OICR_TSYN_EVNT_M;
- kthread_queue_work(pf->ptp.kworker, &pf->ptp.extts_work);
+
+ if (hw->func_caps.ts_func_info.src_tmr_owned) {
+ /* Save EVENTs from GLTSYN register */
+ pf->ptp.ext_ts_irq |= gltsyn_stat &
+ (GLTSYN_STAT_EVENT0_M |
+ GLTSYN_STAT_EVENT1_M |
+ GLTSYN_STAT_EVENT2_M);
+
+ set_bit(ICE_MISC_THREAD_EXTTS_EVENT, pf->misc_thread);
+ ret = IRQ_WAKE_THREAD;
+ }
}
#define ICE_AUX_CRIT_ERR (PFINT_OICR_PE_CRITERR_M | PFINT_OICR_HMC_ERR_M | PFINT_OICR_PE_PUSH_M)
@@ -3173,8 +3181,13 @@ static irqreturn_t ice_misc_intr_thread_fn(int __always_unused irq, void *data)
if (ice_is_reset_in_progress(pf->state))
return IRQ_HANDLED;
- while (!ice_ptp_process_ts(pf))
- usleep_range(50, 100);
+ if (test_and_clear_bit(ICE_MISC_THREAD_EXTTS_EVENT, pf->misc_thread))
+ ice_ptp_extts_event(pf);
+
+ if (test_and_clear_bit(ICE_MISC_THREAD_TX_TSTAMP, pf->misc_thread)) {
+ while (!ice_ptp_process_ts(pf))
+ usleep_range(50, 100);
+ }
return IRQ_HANDLED;
}
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index a3585ede829bb..46b0063a5e128 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -1478,15 +1478,11 @@ static int ice_ptp_adjfine(struct ptp_clock_info *info, long scaled_ppm)
}
/**
- * ice_ptp_extts_work - Workqueue task function
- * @work: external timestamp work structure
- *
- * Service for PTP external clock event
+ * ice_ptp_extts_event - Process PTP external clock event
+ * @pf: Board private structure
*/
-static void ice_ptp_extts_work(struct kthread_work *work)
+void ice_ptp_extts_event(struct ice_pf *pf)
{
- struct ice_ptp *ptp = container_of(work, struct ice_ptp, extts_work);
- struct ice_pf *pf = container_of(ptp, struct ice_pf, ptp);
struct ptp_clock_event event;
struct ice_hw *hw = &pf->hw;
u8 chan, tmr_idx;
@@ -2512,7 +2508,6 @@ void ice_ptp_prepare_for_reset(struct ice_pf *pf)
ice_ptp_cfg_timestamp(pf, false);
kthread_cancel_delayed_work_sync(&ptp->work);
- kthread_cancel_work_sync(&ptp->extts_work);
if (test_bit(ICE_PFR_REQ, pf->state))
return;
@@ -2610,7 +2605,6 @@ static int ice_ptp_init_work(struct ice_pf *pf, struct ice_ptp *ptp)
/* Initialize work functions */
kthread_init_delayed_work(&ptp->work, ice_ptp_periodic_work);
- kthread_init_work(&ptp->extts_work, ice_ptp_extts_work);
/* Allocate a kworker for handling work required for the ports
* connected to the PTP hardware clock.
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.h b/drivers/net/ethernet/intel/ice/ice_ptp.h
index 028349295b719..e689c05bb001f 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.h
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.h
@@ -159,7 +159,6 @@ struct ice_ptp_port {
* struct ice_ptp - data used for integrating with CONFIG_PTP_1588_CLOCK
* @port: data for the PHY port initialization procedure
* @work: delayed work function for periodic tasks
- * @extts_work: work function for handling external Tx timestamps
* @cached_phc_time: a cached copy of the PHC time for timestamp extension
* @cached_phc_jiffies: jiffies when cached_phc_time was last updated
* @ext_ts_chan: the external timestamp channel in use
@@ -180,7 +179,6 @@ struct ice_ptp_port {
struct ice_ptp {
struct ice_ptp_port port;
struct kthread_delayed_work work;
- struct kthread_work extts_work;
u64 cached_phc_time;
unsigned long cached_phc_jiffies;
u8 ext_ts_chan;
@@ -246,6 +244,7 @@ int ice_ptp_get_ts_config(struct ice_pf *pf, struct ifreq *ifr);
void ice_ptp_cfg_timestamp(struct ice_pf *pf, bool ena);
int ice_get_ptp_clock_index(struct ice_pf *pf);
+void ice_ptp_extts_event(struct ice_pf *pf);
s8 ice_ptp_request_ts(struct ice_ptp_tx *tx, struct sk_buff *skb);
bool ice_ptp_process_ts(struct ice_pf *pf);
@@ -274,6 +273,7 @@ static inline int ice_get_ptp_clock_index(struct ice_pf *pf)
return -1;
}
+static inline void ice_ptp_extts_event(struct ice_pf *pf) { }
static inline s8
ice_ptp_request_ts(struct ice_ptp_tx *tx, struct sk_buff *skb)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 099/591] selftests: cgroup: fix unexpected failure on test_memcg_low
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 098/591] ice: handle extts in the miscellaneous interrupt thread Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:43 ` [PATCH 6.1 100/591] watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config Greg Kroah-Hartman
` (495 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haifeng Xu, Johannes Weiner,
Michal Hocko, Roman Gushchin, Shakeel Butt, Andrew Morton,
Sasha Levin
From: Haifeng Xu <haifeng.xu@shopee.com>
[ Upstream commit 19ab365762c6cc39dfdee9e13ab0d12fe4b5540d ]
Since commit f079a020ba95 ("selftests: memcg: factor out common parts of
memory.{low,min} tests"), the value used in second alloc_anon has changed
from 148M to 170M. Because memory.low allows reclaiming page cache in
child cgroups, so the memory.current is close to 30M instead of 50M.
Therefore, adjust the expected value of parent cgroup.
Link: https://lkml.kernel.org/r/20230522095233.4246-2-haifeng.xu@shopee.com
Fixes: f079a020ba95 ("selftests: memcg: factor out common parts of memory.{low,min} tests")
Signed-off-by: Haifeng Xu <haifeng.xu@shopee.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeelb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/cgroup/test_memcontrol.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/cgroup/test_memcontrol.c b/tools/testing/selftests/cgroup/test_memcontrol.c
index fe4f9f4302822..5a526a8e7d333 100644
--- a/tools/testing/selftests/cgroup/test_memcontrol.c
+++ b/tools/testing/selftests/cgroup/test_memcontrol.c
@@ -284,6 +284,7 @@ static int test_memcg_protection(const char *root, bool min)
char *children[4] = {NULL};
const char *attribute = min ? "memory.min" : "memory.low";
long c[4];
+ long current;
int i, attempts;
int fd;
@@ -392,7 +393,8 @@ static int test_memcg_protection(const char *root, bool min)
goto cleanup;
}
- if (!values_close(cg_read_long(parent[1], "memory.current"), MB(50), 3))
+ current = min ? MB(50) : MB(30);
+ if (!values_close(cg_read_long(parent[1], "memory.current"), current, 3))
goto cleanup;
if (min) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 100/591] watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 099/591] selftests: cgroup: fix unexpected failure on test_memcg_low Greg Kroah-Hartman
@ 2023-07-16 19:43 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 101/591] watchdog/perf: more properly prevent false positives with turbo modes Greg Kroah-Hartman
` (494 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Douglas Anderson, Nicholas Piggin,
Petr Mladek, Andi Kleen, Catalin Marinas, Chen-Yu Tsai,
Christophe Leroy, Daniel Thompson, David S. Miller, Guenter Roeck,
Ian Rogers, Lecopzer Chen, Marc Zyngier, Mark Rutland,
Masayoshi Mizuma, Matthias Kaehlcke, Michael Ellerman,
Pingfan Liu, Randy Dunlap, Ravi V. Shankar, Ricardo Neri,
Stephane Eranian, Stephen Boyd, Sumit Garg, Tzung-Bi Shih,
Will Deacon, Colin Cross, Andrew Morton, Sasha Levin
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 5e008df11c55228a86a1bae692cc2002503572c9 ]
Patch series "watchdog/hardlockup: Add the buddy hardlockup detector", v5.
This patch series adds the "buddy" hardlockup detector. In brief, the
buddy hardlockup detector can detect hardlockups without arch-level
support by having CPUs checkup on a "buddy" CPU periodically.
Given the new design of this patch series, testing all combinations is
fairly difficult. I've attempted to make sure that all combinations of
CONFIG_ options are good, but it wouldn't surprise me if I missed
something. I apologize in advance and I'll do my best to fix any
problems that are found.
This patch (of 18):
The real watchdog_update_hrtimer_threshold() is defined in
kernel/watchdog_hld.c. That file is included if
CONFIG_HARDLOCKUP_DETECTOR_PERF and the function is defined in that file
if CONFIG_HARDLOCKUP_CHECK_TIMESTAMP.
The dummy version of the function in "nmi.h" didn't get that quite right.
While this doesn't appear to be a huge deal, it's nice to make it
consistent.
It doesn't break builds because CHECK_TIMESTAMP is only defined by x86 so
others don't get a double definition, and x86 uses perf lockup detector,
so it gets the out of line version.
Link: https://lkml.kernel.org/r/20230519101840.v5.18.Ia44852044cdcb074f387e80df6b45e892965d4a1@changeid
Link: https://lkml.kernel.org/r/20230519101840.v5.1.I8cbb2f4fa740528fcfade4f5439b6cdcdd059251@changeid
Fixes: 7edaeb6841df ("kernel/watchdog: Prevent false positives with turbo modes")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chen-Yu Tsai <wens@csie.org>
Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Guenter Roeck <groeck@chromium.org>
Cc: Ian Rogers <irogers@google.com>
Cc: Lecopzer Chen <lecopzer.chen@mediatek.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Masayoshi Mizuma <msys.mizuma@gmail.com>
Cc: Matthias Kaehlcke <mka@chromium.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Pingfan Liu <kernelfans@gmail.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
Cc: Ricardo Neri <ricardo.neri@intel.com>
Cc: Stephane Eranian <eranian@google.com>
Cc: Stephen Boyd <swboyd@chromium.org>
Cc: Sumit Garg <sumit.garg@linaro.org>
Cc: Tzung-Bi Shih <tzungbi@chromium.org>
Cc: Will Deacon <will@kernel.org>
Cc: Colin Cross <ccross@android.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/nmi.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index f700ff2df074e..0db377ff8f608 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -197,7 +197,7 @@ u64 hw_nmi_get_sample_period(int watchdog_thresh);
#endif
#if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \
- defined(CONFIG_HARDLOCKUP_DETECTOR)
+ defined(CONFIG_HARDLOCKUP_DETECTOR_PERF)
void watchdog_update_hrtimer_threshold(u64 period);
#else
static inline void watchdog_update_hrtimer_threshold(u64 period) { }
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 101/591] watchdog/perf: more properly prevent false positives with turbo modes
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2023-07-16 19:43 ` [PATCH 6.1 100/591] watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 102/591] kexec: fix a memory leak in crash_shrink_memory() Greg Kroah-Hartman
` (493 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Douglas Anderson, Andi Kleen,
Catalin Marinas, Chen-Yu Tsai, Christophe Leroy, Colin Cross,
Daniel Thompson, David S. Miller, Guenter Roeck, Ian Rogers,
Lecopzer Chen, Marc Zyngier, Mark Rutland, Masayoshi Mizuma,
Matthias Kaehlcke, Michael Ellerman, Nicholas Piggin, Petr Mladek,
Pingfan Liu, Randy Dunlap, Ravi V. Shankar, Ricardo Neri,
Stephane Eranian, Stephen Boyd, Sumit Garg, Tzung-Bi Shih,
Will Deacon, Andrew Morton, Sasha Levin
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 4379e59fe5665cfda737e45b8bf2f05321ef049c ]
Currently, in the watchdog_overflow_callback() we first check to see if
the watchdog had been touched and _then_ we handle the workaround for
turbo mode. This order should be reversed.
Specifically, "touching" the hardlockup detector's watchdog should avoid
lockups being detected for one period that should be roughly the same
regardless of whether we're running turbo or not. That means that we
should do the extra accounting for turbo _before_ we look at (and clear)
the global indicating that we've been touched.
NOTE: this fix is made based on code inspection. I am not aware of any
reports where the old code would have generated false positives. That
being said, this order seems more correct and also makes it easier down
the line to share code with the "buddy" hardlockup detector.
Link: https://lkml.kernel.org/r/20230519101840.v5.2.I843b0d1de3e096ba111a179f3adb16d576bef5c7@changeid
Fixes: 7edaeb6841df ("kernel/watchdog: Prevent false positives with turbo modes")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chen-Yu Tsai <wens@csie.org>
Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Colin Cross <ccross@android.com>
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Guenter Roeck <groeck@chromium.org>
Cc: Ian Rogers <irogers@google.com>
Cc: Lecopzer Chen <lecopzer.chen@mediatek.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Masayoshi Mizuma <msys.mizuma@gmail.com>
Cc: Matthias Kaehlcke <mka@chromium.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Pingfan Liu <kernelfans@gmail.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
Cc: Ricardo Neri <ricardo.neri@intel.com>
Cc: Stephane Eranian <eranian@google.com>
Cc: Stephen Boyd <swboyd@chromium.org>
Cc: Sumit Garg <sumit.garg@linaro.org>
Cc: Tzung-Bi Shih <tzungbi@chromium.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/watchdog_hld.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index 247bf0b1582ca..1e8a49dc956e2 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -114,14 +114,14 @@ static void watchdog_overflow_callback(struct perf_event *event,
/* Ensure the watchdog never gets throttled */
event->hw.interrupts = 0;
+ if (!watchdog_check_timestamp())
+ return;
+
if (__this_cpu_read(watchdog_nmi_touch) == true) {
__this_cpu_write(watchdog_nmi_touch, false);
return;
}
- if (!watchdog_check_timestamp())
- return;
-
/* check for a hardlockup
* This is done by making sure our timer interrupt
* is incrementing. The timer interrupt should have
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 102/591] kexec: fix a memory leak in crash_shrink_memory()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 101/591] watchdog/perf: more properly prevent false positives with turbo modes Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 103/591] mmc: mediatek: Avoid ugly error message when SDIO wakeup IRQ isnt used Greg Kroah-Hartman
` (492 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhen Lei, Baoquan He, Cong Wang,
Eric W. Biederman, Michael Holzheu, Andrew Morton, Sasha Levin
From: Zhen Lei <thunder.leizhen@huawei.com>
[ Upstream commit 1cba6c4309f03de570202c46f03df3f73a0d4c82 ]
Patch series "kexec: enable kexec_crash_size to support two crash kernel
regions".
When crashkernel=X fails to reserve region under 4G, it will fall back to
reserve region above 4G and a region of the default size will also be
reserved under 4G. Unfortunately, /sys/kernel/kexec_crash_size only
supports one crash kernel region now, the user cannot sense the low memory
reserved by reading /sys/kernel/kexec_crash_size. Also, low memory cannot
be freed by writing this file.
For example:
resource_size(crashk_res) = 512M
resource_size(crashk_low_res) = 256M
The result of 'cat /sys/kernel/kexec_crash_size' is 512M, but it should be
768M. When we execute 'echo 0 > /sys/kernel/kexec_crash_size', the size
of crashk_res becomes 0 and resource_size(crashk_low_res) is still 256 MB,
which is incorrect.
Since crashk_res manages the memory with high address and crashk_low_res
manages the memory with low address, crashk_low_res is shrunken only when
all crashk_res is shrunken. And because when there is only one crash
kernel region, crashk_res is always used. Therefore, if all crashk_res is
shrunken and crashk_low_res still exists, swap them.
This patch (of 6):
If the value of parameter 'new_size' is in the semi-open and semi-closed
interval (crashk_res.end - KEXEC_CRASH_MEM_ALIGN + 1, crashk_res.end], the
calculation result of ram_res is:
ram_res->start = crashk_res.end + 1
ram_res->end = crashk_res.end
The operation of insert_resource() fails, and ram_res is not added to
iomem_resource. As a result, the memory of the control block ram_res is
leaked.
In fact, on all architectures, the start address and size of crashk_res
are already aligned by KEXEC_CRASH_MEM_ALIGN. Therefore, we do not need
to round up crashk_res.start again. Instead, we should round up
'new_size' in advance.
Link: https://lkml.kernel.org/r/20230527123439.772-1-thunder.leizhen@huawei.com
Link: https://lkml.kernel.org/r/20230527123439.772-2-thunder.leizhen@huawei.com
Fixes: 6480e5a09237 ("kdump: add missing RAM resource in crash_shrink_memory()")
Fixes: 06a7f711246b ("kexec: premit reduction of the reserved memory size")
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Baoquan He <bhe@redhat.com>
Cc: Cong Wang <amwang@redhat.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/kexec_core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index ca2743f9c634e..79c012fbb49c8 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -1035,6 +1035,7 @@ int crash_shrink_memory(unsigned long new_size)
start = crashk_res.start;
end = crashk_res.end;
old_size = (end == 0) ? 0 : end - start + 1;
+ new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN);
if (new_size >= old_size) {
ret = (new_size == old_size) ? 0 : -EINVAL;
goto unlock;
@@ -1046,9 +1047,7 @@ int crash_shrink_memory(unsigned long new_size)
goto unlock;
}
- start = roundup(start, KEXEC_CRASH_MEM_ALIGN);
- end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN);
-
+ end = start + new_size;
crash_free_reserved_phys_range(end, crashk_res.end);
if ((start == end) && (crashk_res.parent != NULL))
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 103/591] mmc: mediatek: Avoid ugly error message when SDIO wakeup IRQ isnt used
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 102/591] kexec: fix a memory leak in crash_shrink_memory() Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 104/591] memstick r592: make memstick_debug_get_tpc_name() static Greg Kroah-Hartman
` (491 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Douglas Anderson, Matthias Brugger,
Ulf Hansson, Sasha Levin
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit a3332b7aad346b14770797e03ddd02ebdb14db41 ]
When I boot a kukui-kodama board, I see an ugly warning in my kernel
log:
mtk-msdc 11240000.mmc: error -ENXIO: IRQ sdio_wakeup not found
It's pretty normal not to have an "sdio_wakeup" IRQ defined. In fact,
no device trees in mainline seem to have it. Let's use the
platform_get_irq_byname_optional() to avoid the error message.
Fixes: 527f36f5efa4 ("mmc: mediatek: add support for SDIO eint wakup IRQ")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
Link: https://lore.kernel.org/r/20230510064434.1.I935404c5396e6bf952e99bb7ffb744c6f7fd430b@changeid
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/mtk-sd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 425efb3fba048..1a0d4dc24717c 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -2685,7 +2685,7 @@ static int msdc_drv_probe(struct platform_device *pdev)
/* Support for SDIO eint irq ? */
if ((mmc->pm_caps & MMC_PM_WAKE_SDIO_IRQ) && (mmc->pm_caps & MMC_PM_KEEP_POWER)) {
- host->eint_irq = platform_get_irq_byname(pdev, "sdio_wakeup");
+ host->eint_irq = platform_get_irq_byname_optional(pdev, "sdio_wakeup");
if (host->eint_irq > 0) {
host->pins_eint = pinctrl_lookup_state(host->pinctrl, "state_eint");
if (IS_ERR(host->pins_eint)) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 104/591] memstick r592: make memstick_debug_get_tpc_name() static
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 103/591] mmc: mediatek: Avoid ugly error message when SDIO wakeup IRQ isnt used Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 105/591] wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() Greg Kroah-Hartman
` (490 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Ulf Hansson,
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 434587df9f7fd68575f99a889cc5f2efc2eaee5e ]
There are no other files referencing this function, apparently
it was left global to avoid an 'unused function' warning when
the only caller is left out. With a 'W=1' build, it causes
a 'missing prototype' warning though:
drivers/memstick/host/r592.c:47:13: error: no previous prototype for 'memstick_debug_get_tpc_name' [-Werror=missing-prototypes]
Annotate the function as 'static __maybe_unused' to avoid both
problems.
Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20230516202714.560929-1-arnd@kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memstick/host/r592.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
index 42bfc46842b82..461f5ffd02bc1 100644
--- a/drivers/memstick/host/r592.c
+++ b/drivers/memstick/host/r592.c
@@ -44,12 +44,10 @@ static const char *tpc_names[] = {
* memstick_debug_get_tpc_name - debug helper that returns string for
* a TPC number
*/
-const char *memstick_debug_get_tpc_name(int tpc)
+static __maybe_unused const char *memstick_debug_get_tpc_name(int tpc)
{
return tpc_names[tpc-1];
}
-EXPORT_SYMBOL(memstick_debug_get_tpc_name);
-
/* Read a register*/
static inline u32 r592_read_reg(struct r592_device *dev, int address)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 105/591] wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 104/591] memstick r592: make memstick_debug_get_tpc_name() static Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 106/591] wifi: mac80211: Fix permissions for valid_links debugfs entry Greg Kroah-Hartman
` (489 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Remi Pommarel, Nicolas Escande,
Toke Høiland-Jørgensen, Kalle Valo, Sasha Levin
From: Remi Pommarel <repk@triplefau.lt>
[ Upstream commit 75086cc6dee046e3fbb3dba148b376d8802f83bc ]
On EDMA capable hardware, ath9k_txq_list_has_key() can enter infinite
loop if it is called while all txq_fifos have packets that use different
key that the one we are looking for. Fix it by exiting the loop if all
txq_fifos have been checked already.
Because this loop is called under spin_lock_bh() (see ath_txq_lock) it
causes the following rcu stall:
rcu: INFO: rcu_sched self-detected stall on CPU
ath10k_pci 0000:01:00.0: failed to read temperature -11
rcu: 1-....: (5254 ticks this GP) idle=189/1/0x4000000000000002 softirq=8442983/8442984 fqs=2579
(t=5257 jiffies g=17983297 q=334)
Task dump for CPU 1:
task:hostapd state:R running task stack: 0 pid: 297 ppid: 289 flags:0x0000000a
Call trace:
dump_backtrace+0x0/0x170
show_stack+0x1c/0x24
sched_show_task+0x140/0x170
dump_cpu_task+0x48/0x54
rcu_dump_cpu_stacks+0xf0/0x134
rcu_sched_clock_irq+0x8d8/0x9fc
update_process_times+0xa0/0xec
tick_sched_timer+0x5c/0xd0
__hrtimer_run_queues+0x154/0x320
hrtimer_interrupt+0x120/0x2f0
arch_timer_handler_virt+0x38/0x44
handle_percpu_devid_irq+0x9c/0x1e0
handle_domain_irq+0x64/0x90
gic_handle_irq+0x78/0xb0
call_on_irq_stack+0x28/0x38
do_interrupt_handler+0x54/0x5c
el1_interrupt+0x2c/0x4c
el1h_64_irq_handler+0x14/0x1c
el1h_64_irq+0x74/0x78
ath9k_txq_has_key+0x1bc/0x250 [ath9k]
ath9k_set_key+0x1cc/0x3dc [ath9k]
drv_set_key+0x78/0x170
ieee80211_key_replace+0x564/0x6cc
ieee80211_key_link+0x174/0x220
ieee80211_add_key+0x11c/0x300
nl80211_new_key+0x12c/0x330
genl_family_rcv_msg_doit+0xbc/0x11c
genl_rcv_msg+0xd8/0x1c4
netlink_rcv_skb+0x40/0x100
genl_rcv+0x3c/0x50
netlink_unicast+0x1ec/0x2c0
netlink_sendmsg+0x198/0x3c0
____sys_sendmsg+0x210/0x250
___sys_sendmsg+0x78/0xc4
__sys_sendmsg+0x4c/0x90
__arm64_sys_sendmsg+0x28/0x30
invoke_syscall.constprop.0+0x60/0x100
do_el0_svc+0x48/0xd0
el0_svc+0x14/0x50
el0t_64_sync_handler+0xa8/0xb0
el0t_64_sync+0x158/0x15c
This rcu stall is hard to reproduce as is, but changing ATH_TXFIFO_DEPTH
from 8 to 2 makes it reasonably easy to reproduce.
Fixes: ca2848022c12 ("ath9k: Postpone key cache entry deletion for TXQ frames reference it")
Signed-off-by: Remi Pommarel <repk@triplefau.lt>
Tested-by: Nicolas Escande <nico.escande@gmail.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230609093744.1985-1-repk@triplefau.lt
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/main.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index a4197c14f0a92..7f9f06ea8a05f 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -850,7 +850,7 @@ static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix)
static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix)
{
struct ath_hw *ah = sc->sc_ah;
- int i;
+ int i, j;
struct ath_txq *txq;
bool key_in_use = false;
@@ -868,8 +868,9 @@ static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix)
if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
int idx = txq->txq_tailidx;
- while (!key_in_use &&
- !list_empty(&txq->txq_fifo[idx])) {
+ for (j = 0; !key_in_use &&
+ !list_empty(&txq->txq_fifo[idx]) &&
+ j < ATH_TXFIFO_DEPTH; j++) {
key_in_use = ath9k_txq_list_has_key(
&txq->txq_fifo[idx], keyix);
INCR(idx, ATH_TXFIFO_DEPTH);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 106/591] wifi: mac80211: Fix permissions for valid_links debugfs entry
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 105/591] wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 107/591] rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO Greg Kroah-Hartman
` (488 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilan Peer, Gregory Greenman,
Johannes Berg, Sasha Levin
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit 4cacadc0dbd8013e6161aa8843d8e9d8ad435b47 ]
The entry should be a read only one and not a write only one. Fix it.
Fixes: 3d9011029227 ("wifi: mac80211: implement link switching")
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230611121219.c75316990411.I1565a7fcba8a37f83efffb0cc6b71c572b896e94@changeid
[remove x16 change since it doesn't work yet]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/debugfs_netdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 5b014786fd2d0..08a1d7564b7f2 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -694,7 +694,7 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
DEBUGFS_ADD_MODE(uapsd_queues, 0600);
DEBUGFS_ADD_MODE(uapsd_max_sp_len, 0600);
DEBUGFS_ADD_MODE(tdls_wider_bw, 0600);
- DEBUGFS_ADD_MODE(valid_links, 0200);
+ DEBUGFS_ADD_MODE(valid_links, 0400);
DEBUGFS_ADD_MODE(active_links, 0600);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 107/591] rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 106/591] wifi: mac80211: Fix permissions for valid_links debugfs entry Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 108/591] wifi: ath11k: Add missing check for ioremap Greg Kroah-Hartman
` (487 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Edwin Peer, Edwin Peer, Gal Pressman,
Paolo Abeni, Sasha Levin
From: Edwin Peer <edwin.peer@broadcom.com>
[ Upstream commit fa0e21fa44438a0e856d42224bfa24641d37b979 ]
This filter already exists for excluding IPv6 SNMP stats. Extend its
definition to also exclude IFLA_VF_INFO stats in RTM_GETLINK.
This patch constitutes a partial fix for a netlink attribute nesting
overflow bug in IFLA_VFINFO_LIST. By excluding the stats when the
requester doesn't need them, the truncation of the VF list is avoided.
While it was technically only the stats added in commit c5a9f6f0ab40
("net/core: Add drop counters to VF statistics") breaking the camel's
back, the appreciable size of the stats data should never have been
included without due consideration for the maximum number of VFs
supported by PCI.
Fixes: 3b766cd83232 ("net/core: Add reading VF statistics through the PF netdevice")
Fixes: c5a9f6f0ab40 ("net/core: Add drop counters to VF statistics")
Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
Cc: Edwin Peer <espeer@gmail.com>
Signed-off-by: Gal Pressman <gal@nvidia.com>
Link: https://lore.kernel.org/r/20230611105108.122586-1-gal@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/rtnetlink.c | 96 +++++++++++++++++++++++---------------------
1 file changed, 51 insertions(+), 45 deletions(-)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index b192c69f3936c..ef2a07ae5496e 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -957,24 +957,27 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev,
nla_total_size(sizeof(struct ifla_vf_rate)) +
nla_total_size(sizeof(struct ifla_vf_link_state)) +
nla_total_size(sizeof(struct ifla_vf_rss_query_en)) +
- nla_total_size(0) + /* nest IFLA_VF_STATS */
- /* IFLA_VF_STATS_RX_PACKETS */
- nla_total_size_64bit(sizeof(__u64)) +
- /* IFLA_VF_STATS_TX_PACKETS */
- nla_total_size_64bit(sizeof(__u64)) +
- /* IFLA_VF_STATS_RX_BYTES */
- nla_total_size_64bit(sizeof(__u64)) +
- /* IFLA_VF_STATS_TX_BYTES */
- nla_total_size_64bit(sizeof(__u64)) +
- /* IFLA_VF_STATS_BROADCAST */
- nla_total_size_64bit(sizeof(__u64)) +
- /* IFLA_VF_STATS_MULTICAST */
- nla_total_size_64bit(sizeof(__u64)) +
- /* IFLA_VF_STATS_RX_DROPPED */
- nla_total_size_64bit(sizeof(__u64)) +
- /* IFLA_VF_STATS_TX_DROPPED */
- nla_total_size_64bit(sizeof(__u64)) +
nla_total_size(sizeof(struct ifla_vf_trust)));
+ if (~ext_filter_mask & RTEXT_FILTER_SKIP_STATS) {
+ size += num_vfs *
+ (nla_total_size(0) + /* nest IFLA_VF_STATS */
+ /* IFLA_VF_STATS_RX_PACKETS */
+ nla_total_size_64bit(sizeof(__u64)) +
+ /* IFLA_VF_STATS_TX_PACKETS */
+ nla_total_size_64bit(sizeof(__u64)) +
+ /* IFLA_VF_STATS_RX_BYTES */
+ nla_total_size_64bit(sizeof(__u64)) +
+ /* IFLA_VF_STATS_TX_BYTES */
+ nla_total_size_64bit(sizeof(__u64)) +
+ /* IFLA_VF_STATS_BROADCAST */
+ nla_total_size_64bit(sizeof(__u64)) +
+ /* IFLA_VF_STATS_MULTICAST */
+ nla_total_size_64bit(sizeof(__u64)) +
+ /* IFLA_VF_STATS_RX_DROPPED */
+ nla_total_size_64bit(sizeof(__u64)) +
+ /* IFLA_VF_STATS_TX_DROPPED */
+ nla_total_size_64bit(sizeof(__u64)));
+ }
return size;
} else
return 0;
@@ -1253,7 +1256,8 @@ static noinline_for_stack int rtnl_fill_stats(struct sk_buff *skb,
static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
struct net_device *dev,
int vfs_num,
- struct nlattr *vfinfo)
+ struct nlattr *vfinfo,
+ u32 ext_filter_mask)
{
struct ifla_vf_rss_query_en vf_rss_query_en;
struct nlattr *vf, *vfstats, *vfvlanlist;
@@ -1359,33 +1363,35 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
goto nla_put_vf_failure;
}
nla_nest_end(skb, vfvlanlist);
- memset(&vf_stats, 0, sizeof(vf_stats));
- if (dev->netdev_ops->ndo_get_vf_stats)
- dev->netdev_ops->ndo_get_vf_stats(dev, vfs_num,
- &vf_stats);
- vfstats = nla_nest_start_noflag(skb, IFLA_VF_STATS);
- if (!vfstats)
- goto nla_put_vf_failure;
- if (nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_PACKETS,
- vf_stats.rx_packets, IFLA_VF_STATS_PAD) ||
- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_PACKETS,
- vf_stats.tx_packets, IFLA_VF_STATS_PAD) ||
- nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_BYTES,
- vf_stats.rx_bytes, IFLA_VF_STATS_PAD) ||
- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_BYTES,
- vf_stats.tx_bytes, IFLA_VF_STATS_PAD) ||
- nla_put_u64_64bit(skb, IFLA_VF_STATS_BROADCAST,
- vf_stats.broadcast, IFLA_VF_STATS_PAD) ||
- nla_put_u64_64bit(skb, IFLA_VF_STATS_MULTICAST,
- vf_stats.multicast, IFLA_VF_STATS_PAD) ||
- nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_DROPPED,
- vf_stats.rx_dropped, IFLA_VF_STATS_PAD) ||
- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_DROPPED,
- vf_stats.tx_dropped, IFLA_VF_STATS_PAD)) {
- nla_nest_cancel(skb, vfstats);
- goto nla_put_vf_failure;
+ if (~ext_filter_mask & RTEXT_FILTER_SKIP_STATS) {
+ memset(&vf_stats, 0, sizeof(vf_stats));
+ if (dev->netdev_ops->ndo_get_vf_stats)
+ dev->netdev_ops->ndo_get_vf_stats(dev, vfs_num,
+ &vf_stats);
+ vfstats = nla_nest_start_noflag(skb, IFLA_VF_STATS);
+ if (!vfstats)
+ goto nla_put_vf_failure;
+ if (nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_PACKETS,
+ vf_stats.rx_packets, IFLA_VF_STATS_PAD) ||
+ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_PACKETS,
+ vf_stats.tx_packets, IFLA_VF_STATS_PAD) ||
+ nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_BYTES,
+ vf_stats.rx_bytes, IFLA_VF_STATS_PAD) ||
+ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_BYTES,
+ vf_stats.tx_bytes, IFLA_VF_STATS_PAD) ||
+ nla_put_u64_64bit(skb, IFLA_VF_STATS_BROADCAST,
+ vf_stats.broadcast, IFLA_VF_STATS_PAD) ||
+ nla_put_u64_64bit(skb, IFLA_VF_STATS_MULTICAST,
+ vf_stats.multicast, IFLA_VF_STATS_PAD) ||
+ nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_DROPPED,
+ vf_stats.rx_dropped, IFLA_VF_STATS_PAD) ||
+ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_DROPPED,
+ vf_stats.tx_dropped, IFLA_VF_STATS_PAD)) {
+ nla_nest_cancel(skb, vfstats);
+ goto nla_put_vf_failure;
+ }
+ nla_nest_end(skb, vfstats);
}
- nla_nest_end(skb, vfstats);
nla_nest_end(skb, vf);
return 0;
@@ -1418,7 +1424,7 @@ static noinline_for_stack int rtnl_fill_vf(struct sk_buff *skb,
return -EMSGSIZE;
for (i = 0; i < num_vfs; i++) {
- if (rtnl_fill_vfinfo(skb, dev, i, vfinfo))
+ if (rtnl_fill_vfinfo(skb, dev, i, vfinfo, ext_filter_mask))
return -EMSGSIZE;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 108/591] wifi: ath11k: Add missing check for ioremap
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 107/591] rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 109/591] wifi: iwlwifi: pull from TXQs with softirqs disabled Greg Kroah-Hartman
` (486 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Kalle Valo,
Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit 16e0077e14a73866e9b0f4a6bf4ad3d4a5cb0f2a ]
Add check for ioremap() and return the error if it fails in order to
guarantee the success of ioremap(), same as in
ath11k_qmi_load_file_target_mem().
Fixes: 6ac04bdc5edb ("ath11k: Use reserved host DDR addresses from DT for PCI devices")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230608022858.27405-1-jiasheng@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/qmi.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c
index 381c6b390dd78..01b02c03fa89c 100644
--- a/drivers/net/wireless/ath/ath11k/qmi.c
+++ b/drivers/net/wireless/ath/ath11k/qmi.c
@@ -2058,6 +2058,9 @@ static int ath11k_qmi_assign_target_mem_chunk(struct ath11k_base *ab)
ab->qmi.target_mem[idx].iaddr =
ioremap(ab->qmi.target_mem[idx].paddr,
ab->qmi.target_mem[i].size);
+ if (!ab->qmi.target_mem[idx].iaddr)
+ return -EIO;
+
ab->qmi.target_mem[idx].size = ab->qmi.target_mem[i].size;
host_ddr_sz = ab->qmi.target_mem[i].size;
ab->qmi.target_mem[idx].type = ab->qmi.target_mem[i].type;
@@ -2083,6 +2086,8 @@ static int ath11k_qmi_assign_target_mem_chunk(struct ath11k_base *ab)
ab->qmi.target_mem[idx].iaddr =
ioremap(ab->qmi.target_mem[idx].paddr,
ab->qmi.target_mem[i].size);
+ if (!ab->qmi.target_mem[idx].iaddr)
+ return -EIO;
} else {
ab->qmi.target_mem[idx].paddr =
ATH11K_QMI_CALDB_ADDRESS;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 109/591] wifi: iwlwifi: pull from TXQs with softirqs disabled
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 108/591] wifi: ath11k: Add missing check for ioremap Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 110/591] wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() Greg Kroah-Hartman
` (485 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Gregory Greenman,
Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 96fb6f47db24a712d650b0a9b9074873f273fb0e ]
In mac80211, it's required that we pull from TXQs by calling
ieee80211_tx_dequeue() only with softirqs disabled. However,
in iwl_mvm_queue_state_change() we're often called with them
enabled, e.g. from flush if anything was flushed, triggering
a mac80211 warning.
Fix that by disabling the softirqs across the TX call.
Fixes: cfbc6c4c5b91 ("iwlwifi: mvm: support mac80211 TXQs model")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230614123446.0feef7fa81db.I4dd62542d955b40dd8f0af34fa4accb9d0d17c7e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 994f597a7102a..864f5fb260409 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1686,8 +1686,11 @@ static void iwl_mvm_queue_state_change(struct iwl_op_mode *op_mode,
else
set_bit(IWL_MVM_TXQ_STATE_STOP_FULL, &mvmtxq->state);
- if (start && mvmsta->sta_state != IEEE80211_STA_NOTEXIST)
+ if (start && mvmsta->sta_state != IEEE80211_STA_NOTEXIST) {
+ local_bh_disable();
iwl_mvm_mac_itxq_xmit(mvm->hw, txq);
+ local_bh_enable();
+ }
}
out:
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 110/591] wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 109/591] wifi: iwlwifi: pull from TXQs with softirqs disabled Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 111/591] wifi: mac80211: Remove "Missing iftype sband data/EHT cap" spam Greg Kroah-Hartman
` (484 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anjaneyulu, Gregory Greenman,
Johannes Berg, Sasha Levin
From: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
[ Upstream commit 1902f1953b8ba100ee8705cb8a6f1a9795550eca ]
rxq can be NULL only when trans_pcie->rxq is NULL and entry->entry
is zero. For the case when entry->entry is not equal to 0, rxq
won't be NULL even if trans_pcie->rxq is NULL. Modify checker to
check for trans_pcie->rxq.
Fixes: abc599efa67b ("iwlwifi: pcie: don't crash when rx queues aren't allocated in interrupt")
Signed-off-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230614123446.5a5eb3889a4a.I375a1d58f16b48cd2044e7b7caddae512d7c86fd@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index 9c9f87fe83777..b455e981faa1f 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -1620,14 +1620,14 @@ irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id)
struct msix_entry *entry = dev_id;
struct iwl_trans_pcie *trans_pcie = iwl_pcie_get_trans_pcie(entry);
struct iwl_trans *trans = trans_pcie->trans;
- struct iwl_rxq *rxq = &trans_pcie->rxq[entry->entry];
+ struct iwl_rxq *rxq;
trace_iwlwifi_dev_irq_msix(trans->dev, entry, false, 0, 0);
if (WARN_ON(entry->entry >= trans->num_rx_queues))
return IRQ_NONE;
- if (!rxq) {
+ if (!trans_pcie->rxq) {
if (net_ratelimit())
IWL_ERR(trans,
"[%d] Got MSI-X interrupt before we have Rx queues\n",
@@ -1635,6 +1635,7 @@ irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id)
return IRQ_NONE;
}
+ rxq = &trans_pcie->rxq[entry->entry];
lock_map_acquire(&trans->sync_cmd_lockdep_map);
IWL_DEBUG_ISR(trans, "[%d] Got interrupt\n", entry->entry);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 111/591] wifi: mac80211: Remove "Missing iftype sband data/EHT cap" spam
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 110/591] wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 112/591] wifi: cfg80211: rewrite merging of inherited elements Greg Kroah-Hartman
` (483 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Cavallari, Simon Horman,
Johannes Berg, Sasha Levin
From: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
[ Upstream commit 6e21e7b8cd897193cee3c2649640efceb3004ba5 ]
In mesh mode, ieee80211_chandef_he_6ghz_oper() is called by
mesh_matches_local() for every received mesh beacon.
On a 6 GHz mesh of a HE-only phy, this spams that the hardware does not
have EHT capabilities, even if the received mesh beacon does not have an
EHT element.
Unlike HE, not supporting EHT in the 6 GHz band is not an error so do
not print anything in this case.
Fixes: 5dca295dd767 ("mac80211: Add initial support for EHT and 320 MHz channels")
Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230614132648.28995-1-nicolas.cavallari@green-communications.fr
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/util.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 784b9ba61581e..98806c359b173 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -3599,10 +3599,8 @@ bool ieee80211_chandef_he_6ghz_oper(struct ieee80211_sub_if_data *sdata,
}
eht_cap = ieee80211_get_eht_iftype_cap(sband, iftype);
- if (!eht_cap) {
- sdata_info(sdata, "Missing iftype sband data/EHT cap");
+ if (!eht_cap)
eht_oper = NULL;
- }
he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 112/591] wifi: cfg80211: rewrite merging of inherited elements
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 111/591] wifi: mac80211: Remove "Missing iftype sband data/EHT cap" spam Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 113/591] wifi: cfg80211: drop incorrect nontransmitted BSS update code Greg Kroah-Hartman
` (482 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Berg, Gregory Greenman,
Johannes Berg, Sasha Levin
From: Benjamin Berg <benjamin.berg@intel.com>
[ Upstream commit dfd9aa3e7a456d57b18021d66472ab7ff8373ab7 ]
The cfg80211_gen_new_ie function merges the IEs using inheritance rules.
Rewrite this function to fix issues around inheritance rules. In
particular, vendor elements do not require any special handling, as they
are either all inherited or overridden by the subprofile.
Also, add fragmentation handling as this may be needed in some cases.
This also changes the function to not require making a copy. The new
version could be optimized a bit by explicitly tracking which IEs have
been handled already rather than looking that up again every time.
Note that a small behavioural change is the removal of the SSID special
handling. This should be fine for the MBSSID element, as the SSID must
be included in the subelement.
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230616094949.bc6152e146db.I2b5f3bc45085e1901e5b5192a674436adaf94748@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/scan.c | 213 ++++++++++++++++++++++++++------------------
1 file changed, 124 insertions(+), 89 deletions(-)
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 6c2b73c0d36e8..9fcb6f06b8cbe 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -262,117 +262,152 @@ bool cfg80211_is_element_inherited(const struct element *elem,
}
EXPORT_SYMBOL(cfg80211_is_element_inherited);
-static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
- const u8 *subelement, size_t subie_len,
- u8 *new_ie, gfp_t gfp)
+static size_t cfg80211_copy_elem_with_frags(const struct element *elem,
+ const u8 *ie, size_t ie_len,
+ u8 **pos, u8 *buf, size_t buf_len)
{
- u8 *pos, *tmp;
- const u8 *tmp_old, *tmp_new;
- const struct element *non_inherit_elem;
- u8 *sub_copy;
+ if (WARN_ON((u8 *)elem < ie || elem->data > ie + ie_len ||
+ elem->data + elem->datalen > ie + ie_len))
+ return 0;
- /* copy subelement as we need to change its content to
- * mark an ie after it is processed.
- */
- sub_copy = kmemdup(subelement, subie_len, gfp);
- if (!sub_copy)
+ if (elem->datalen + 2 > buf + buf_len - *pos)
return 0;
- pos = &new_ie[0];
+ memcpy(*pos, elem, elem->datalen + 2);
+ *pos += elem->datalen + 2;
- /* set new ssid */
- tmp_new = cfg80211_find_ie(WLAN_EID_SSID, sub_copy, subie_len);
- if (tmp_new) {
- memcpy(pos, tmp_new, tmp_new[1] + 2);
- pos += (tmp_new[1] + 2);
+ /* Finish if it is not fragmented */
+ if (elem->datalen != 255)
+ return *pos - buf;
+
+ ie_len = ie + ie_len - elem->data - elem->datalen;
+ ie = (const u8 *)elem->data + elem->datalen;
+
+ for_each_element(elem, ie, ie_len) {
+ if (elem->id != WLAN_EID_FRAGMENT)
+ break;
+
+ if (elem->datalen + 2 > buf + buf_len - *pos)
+ return 0;
+
+ memcpy(*pos, elem, elem->datalen + 2);
+ *pos += elem->datalen + 2;
+
+ if (elem->datalen != 255)
+ break;
}
- /* get non inheritance list if exists */
- non_inherit_elem =
- cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
- sub_copy, subie_len);
+ return *pos - buf;
+}
- /* go through IEs in ie (skip SSID) and subelement,
- * merge them into new_ie
+static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
+ const u8 *subie, size_t subie_len,
+ u8 *new_ie, size_t new_ie_len)
+{
+ const struct element *non_inherit_elem, *parent, *sub;
+ u8 *pos = new_ie;
+ u8 id, ext_id;
+ unsigned int match_len;
+
+ non_inherit_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
+ subie, subie_len);
+
+ /* We copy the elements one by one from the parent to the generated
+ * elements.
+ * If they are not inherited (included in subie or in the non
+ * inheritance element), then we copy all occurrences the first time
+ * we see this element type.
*/
- tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
- tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;
-
- while (tmp_old + 2 - ie <= ielen &&
- tmp_old + tmp_old[1] + 2 - ie <= ielen) {
- if (tmp_old[0] == 0) {
- tmp_old++;
+ for_each_element(parent, ie, ielen) {
+ if (parent->id == WLAN_EID_FRAGMENT)
continue;
+
+ if (parent->id == WLAN_EID_EXTENSION) {
+ if (parent->datalen < 1)
+ continue;
+
+ id = WLAN_EID_EXTENSION;
+ ext_id = parent->data[0];
+ match_len = 1;
+ } else {
+ id = parent->id;
+ match_len = 0;
}
- if (tmp_old[0] == WLAN_EID_EXTENSION)
- tmp = (u8 *)cfg80211_find_ext_ie(tmp_old[2], sub_copy,
- subie_len);
- else
- tmp = (u8 *)cfg80211_find_ie(tmp_old[0], sub_copy,
- subie_len);
+ /* Find first occurrence in subie */
+ sub = cfg80211_find_elem_match(id, subie, subie_len,
+ &ext_id, match_len, 0);
- if (!tmp) {
- const struct element *old_elem = (void *)tmp_old;
+ /* Copy from parent if not in subie and inherited */
+ if (!sub &&
+ cfg80211_is_element_inherited(parent, non_inherit_elem)) {
+ if (!cfg80211_copy_elem_with_frags(parent,
+ ie, ielen,
+ &pos, new_ie,
+ new_ie_len))
+ return 0;
- /* ie in old ie but not in subelement */
- if (cfg80211_is_element_inherited(old_elem,
- non_inherit_elem)) {
- memcpy(pos, tmp_old, tmp_old[1] + 2);
- pos += tmp_old[1] + 2;
- }
- } else {
- /* ie in transmitting ie also in subelement,
- * copy from subelement and flag the ie in subelement
- * as copied (by setting eid field to WLAN_EID_SSID,
- * which is skipped anyway).
- * For vendor ie, compare OUI + type + subType to
- * determine if they are the same ie.
- */
- if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) {
- if (tmp_old[1] >= 5 && tmp[1] >= 5 &&
- !memcmp(tmp_old + 2, tmp + 2, 5)) {
- /* same vendor ie, copy from
- * subelement
- */
- memcpy(pos, tmp, tmp[1] + 2);
- pos += tmp[1] + 2;
- tmp[0] = WLAN_EID_SSID;
- } else {
- memcpy(pos, tmp_old, tmp_old[1] + 2);
- pos += tmp_old[1] + 2;
- }
- } else {
- /* copy ie from subelement into new ie */
- memcpy(pos, tmp, tmp[1] + 2);
- pos += tmp[1] + 2;
- tmp[0] = WLAN_EID_SSID;
- }
+ continue;
}
- if (tmp_old + tmp_old[1] + 2 - ie == ielen)
- break;
+ /* Already copied if an earlier element had the same type */
+ if (cfg80211_find_elem_match(id, ie, (u8 *)parent - ie,
+ &ext_id, match_len, 0))
+ continue;
- tmp_old += tmp_old[1] + 2;
+ /* Not inheriting, copy all similar elements from subie */
+ while (sub) {
+ if (!cfg80211_copy_elem_with_frags(sub,
+ subie, subie_len,
+ &pos, new_ie,
+ new_ie_len))
+ return 0;
+
+ sub = cfg80211_find_elem_match(id,
+ sub->data + sub->datalen,
+ subie_len + subie -
+ (sub->data +
+ sub->datalen),
+ &ext_id, match_len, 0);
+ }
}
- /* go through subelement again to check if there is any ie not
- * copied to new ie, skip ssid, capability, bssid-index ie
+ /* The above misses elements that are included in subie but not in the
+ * parent, so do a pass over subie and append those.
+ * Skip the non-tx BSSID caps and non-inheritance element.
*/
- tmp_new = sub_copy;
- while (tmp_new + 2 - sub_copy <= subie_len &&
- tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
- if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||
- tmp_new[0] == WLAN_EID_SSID)) {
- memcpy(pos, tmp_new, tmp_new[1] + 2);
- pos += tmp_new[1] + 2;
+ for_each_element(sub, subie, subie_len) {
+ if (sub->id == WLAN_EID_NON_TX_BSSID_CAP)
+ continue;
+
+ if (sub->id == WLAN_EID_FRAGMENT)
+ continue;
+
+ if (sub->id == WLAN_EID_EXTENSION) {
+ if (sub->datalen < 1)
+ continue;
+
+ id = WLAN_EID_EXTENSION;
+ ext_id = sub->data[0];
+ match_len = 1;
+
+ if (ext_id == WLAN_EID_EXT_NON_INHERITANCE)
+ continue;
+ } else {
+ id = sub->id;
+ match_len = 0;
}
- if (tmp_new + tmp_new[1] + 2 - sub_copy == subie_len)
- break;
- tmp_new += tmp_new[1] + 2;
+
+ /* Processed if one was included in the parent */
+ if (cfg80211_find_elem_match(id, ie, ielen,
+ &ext_id, match_len, 0))
+ continue;
+
+ if (!cfg80211_copy_elem_with_frags(sub, subie, subie_len,
+ &pos, new_ie, new_ie_len))
+ return 0;
}
- kfree(sub_copy);
return pos - new_ie;
}
@@ -2224,7 +2259,7 @@ static void cfg80211_parse_mbssid_data(struct wiphy *wiphy,
new_ie_len = cfg80211_gen_new_ie(ie, ielen,
profile,
profile_len, new_ie,
- gfp);
+ IEEE80211_MAX_DATA_LEN);
if (!new_ie_len)
continue;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 113/591] wifi: cfg80211: drop incorrect nontransmitted BSS update code
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 112/591] wifi: cfg80211: rewrite merging of inherited elements Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 114/591] wifi: cfg80211: fix regulatory disconnect with OCB/NAN Greg Kroah-Hartman
` (481 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Berg, Gregory Greenman,
Johannes Berg, Sasha Levin
From: Benjamin Berg <benjamin.berg@intel.com>
[ Upstream commit 39432f8a3752a87a53fd8d5e51824a43aaae5cab ]
The removed code ran for any BSS that was not included in the MBSSID
element in order to update it. However, instead of using the correct
inheritance rules, it would simply copy the elements from the
transmitting AP. The result is that we would report incorrect elements
in this case.
After some discussions, it seems that there are likely not even APs
actually using this feature. Either way, removing the code decreases
complexity and makes the cfg80211 behaviour more correct.
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230616094949.cfd6d8db1f26.Ia1044902b86cd7d366400a4bfb93691b8f05d68c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/scan.c | 154 ++++----------------------------------------
1 file changed, 11 insertions(+), 143 deletions(-)
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 9fcb6f06b8cbe..efe9283e98935 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -2308,118 +2308,6 @@ cfg80211_inform_bss_data(struct wiphy *wiphy,
}
EXPORT_SYMBOL(cfg80211_inform_bss_data);
-static void
-cfg80211_parse_mbssid_frame_data(struct wiphy *wiphy,
- struct cfg80211_inform_bss *data,
- struct ieee80211_mgmt *mgmt, size_t len,
- struct cfg80211_non_tx_bss *non_tx_data,
- gfp_t gfp)
-{
- enum cfg80211_bss_frame_type ftype;
- const u8 *ie = mgmt->u.probe_resp.variable;
- size_t ielen = len - offsetof(struct ieee80211_mgmt,
- u.probe_resp.variable);
-
- ftype = ieee80211_is_beacon(mgmt->frame_control) ?
- CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP;
-
- cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid,
- le64_to_cpu(mgmt->u.probe_resp.timestamp),
- le16_to_cpu(mgmt->u.probe_resp.beacon_int),
- ie, ielen, non_tx_data, gfp);
-}
-
-static void
-cfg80211_update_notlisted_nontrans(struct wiphy *wiphy,
- struct cfg80211_bss *nontrans_bss,
- struct ieee80211_mgmt *mgmt, size_t len)
-{
- u8 *ie, *new_ie, *pos;
- const struct element *nontrans_ssid;
- const u8 *trans_ssid, *mbssid;
- size_t ielen = len - offsetof(struct ieee80211_mgmt,
- u.probe_resp.variable);
- size_t new_ie_len;
- struct cfg80211_bss_ies *new_ies;
- const struct cfg80211_bss_ies *old;
- size_t cpy_len;
-
- lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
-
- ie = mgmt->u.probe_resp.variable;
-
- new_ie_len = ielen;
- trans_ssid = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
- if (!trans_ssid)
- return;
- new_ie_len -= trans_ssid[1];
- mbssid = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen);
- /*
- * It's not valid to have the MBSSID element before SSID
- * ignore if that happens - the code below assumes it is
- * after (while copying things inbetween).
- */
- if (!mbssid || mbssid < trans_ssid)
- return;
- new_ie_len -= mbssid[1];
-
- nontrans_ssid = ieee80211_bss_get_elem(nontrans_bss, WLAN_EID_SSID);
- if (!nontrans_ssid)
- return;
-
- new_ie_len += nontrans_ssid->datalen;
-
- /* generate new ie for nontrans BSS
- * 1. replace SSID with nontrans BSS' SSID
- * 2. skip MBSSID IE
- */
- new_ie = kzalloc(new_ie_len, GFP_ATOMIC);
- if (!new_ie)
- return;
-
- new_ies = kzalloc(sizeof(*new_ies) + new_ie_len, GFP_ATOMIC);
- if (!new_ies)
- goto out_free;
-
- pos = new_ie;
-
- /* copy the nontransmitted SSID */
- cpy_len = nontrans_ssid->datalen + 2;
- memcpy(pos, nontrans_ssid, cpy_len);
- pos += cpy_len;
- /* copy the IEs between SSID and MBSSID */
- cpy_len = trans_ssid[1] + 2;
- memcpy(pos, (trans_ssid + cpy_len), (mbssid - (trans_ssid + cpy_len)));
- pos += (mbssid - (trans_ssid + cpy_len));
- /* copy the IEs after MBSSID */
- cpy_len = mbssid[1] + 2;
- memcpy(pos, mbssid + cpy_len, ((ie + ielen) - (mbssid + cpy_len)));
-
- /* update ie */
- new_ies->len = new_ie_len;
- new_ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
- new_ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control);
- memcpy(new_ies->data, new_ie, new_ie_len);
- if (ieee80211_is_probe_resp(mgmt->frame_control)) {
- old = rcu_access_pointer(nontrans_bss->proberesp_ies);
- rcu_assign_pointer(nontrans_bss->proberesp_ies, new_ies);
- rcu_assign_pointer(nontrans_bss->ies, new_ies);
- if (old)
- kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
- } else {
- old = rcu_access_pointer(nontrans_bss->beacon_ies);
- rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies);
- cfg80211_update_hidden_bsses(bss_from_pub(nontrans_bss),
- new_ies, old);
- rcu_assign_pointer(nontrans_bss->ies, new_ies);
- if (old)
- kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
- }
-
-out_free:
- kfree(new_ie);
-}
-
/* cfg80211_inform_bss_width_frame helper */
static struct cfg80211_bss *
cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
@@ -2561,51 +2449,31 @@ cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
struct ieee80211_mgmt *mgmt, size_t len,
gfp_t gfp)
{
- struct cfg80211_bss *res, *tmp_bss;
+ struct cfg80211_bss *res;
const u8 *ie = mgmt->u.probe_resp.variable;
- const struct cfg80211_bss_ies *ies1, *ies2;
size_t ielen = len - offsetof(struct ieee80211_mgmt,
u.probe_resp.variable);
+ enum cfg80211_bss_frame_type ftype;
struct cfg80211_non_tx_bss non_tx_data = {};
res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt,
len, gfp);
+ if (!res)
+ return NULL;
/* don't do any further MBSSID handling for S1G */
if (ieee80211_is_s1g_beacon(mgmt->frame_control))
return res;
- if (!res || !wiphy->support_mbssid ||
- !cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, ie, ielen))
- return res;
- if (wiphy->support_only_he_mbssid &&
- !cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen))
- return res;
-
+ ftype = ieee80211_is_beacon(mgmt->frame_control) ?
+ CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP;
non_tx_data.tx_bss = res;
- /* process each non-transmitting bss */
- cfg80211_parse_mbssid_frame_data(wiphy, data, mgmt, len,
- &non_tx_data, gfp);
-
- spin_lock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
- /* check if the res has other nontransmitting bss which is not
- * in MBSSID IE
- */
- ies1 = rcu_access_pointer(res->ies);
-
- /* go through nontrans_list, if the timestamp of the BSS is
- * earlier than the timestamp of the transmitting BSS then
- * update it
- */
- list_for_each_entry(tmp_bss, &res->nontrans_list,
- nontrans_list) {
- ies2 = rcu_access_pointer(tmp_bss->ies);
- if (ies2->tsf < ies1->tsf)
- cfg80211_update_notlisted_nontrans(wiphy, tmp_bss,
- mgmt, len);
- }
- spin_unlock_bh(&wiphy_to_rdev(wiphy)->bss_lock);
+ /* process each non-transmitting bss */
+ cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid,
+ le64_to_cpu(mgmt->u.probe_resp.timestamp),
+ le16_to_cpu(mgmt->u.probe_resp.beacon_int),
+ ie, ielen, &non_tx_data, gfp);
return res;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 114/591] wifi: cfg80211: fix regulatory disconnect with OCB/NAN
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 113/591] wifi: cfg80211: drop incorrect nontransmitted BSS update code Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 115/591] wifi: cfg80211/mac80211: Fix ML element common size calculation Greg Kroah-Hartman
` (480 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johannes Berg, Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit e8c2af660ba0790afd14d5cbc2fd05c6dc85e207 ]
Since regulatory disconnect was added, OCB and NAN interface
types were added, which made it completely unusable for any
driver that allowed OCB/NAN. Add OCB/NAN (though NAN doesn't
do anything, we don't have any info) and also remove all the
logic that opts out, so it won't be broken again if/when new
interface types are added.
Fixes: 6e0bd6c35b02 ("cfg80211: 802.11p OCB mode handling")
Fixes: cb3b7d87652a ("cfg80211: add start / stop NAN commands")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Link: https://lore.kernel.org/r/20230616222844.2794d1625a26.I8e78a3789a29e6149447b3139df724a6f1b46fc3@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/regulatory.h | 13 +------------
net/wireless/core.c | 16 ----------------
net/wireless/reg.c | 14 ++++++++++----
3 files changed, 11 insertions(+), 32 deletions(-)
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index 896191f420d50..b2cb4a9eb04dc 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -140,17 +140,6 @@ struct regulatory_request {
* otherwise initiating radiation is not allowed. This will enable the
* relaxations enabled under the CFG80211_REG_RELAX_NO_IR configuration
* option
- * @REGULATORY_IGNORE_STALE_KICKOFF: the regulatory core will _not_ make sure
- * all interfaces on this wiphy reside on allowed channels. If this flag
- * is not set, upon a regdomain change, the interfaces are given a grace
- * period (currently 60 seconds) to disconnect or move to an allowed
- * channel. Interfaces on forbidden channels are forcibly disconnected.
- * Currently these types of interfaces are supported for enforcement:
- * NL80211_IFTYPE_ADHOC, NL80211_IFTYPE_STATION, NL80211_IFTYPE_AP,
- * NL80211_IFTYPE_AP_VLAN, NL80211_IFTYPE_MONITOR,
- * NL80211_IFTYPE_P2P_CLIENT, NL80211_IFTYPE_P2P_GO,
- * NL80211_IFTYPE_P2P_DEVICE. The flag will be set by default if a device
- * includes any modes unsupported for enforcement checking.
* @REGULATORY_WIPHY_SELF_MANAGED: for devices that employ wiphy-specific
* regdom management. These devices will ignore all regdom changes not
* originating from their own wiphy.
@@ -177,7 +166,7 @@ enum ieee80211_regulatory_flags {
REGULATORY_COUNTRY_IE_FOLLOW_POWER = BIT(3),
REGULATORY_COUNTRY_IE_IGNORE = BIT(4),
REGULATORY_ENABLE_RELAX_NO_IR = BIT(5),
- REGULATORY_IGNORE_STALE_KICKOFF = BIT(6),
+ /* reuse bit 6 next time */
REGULATORY_WIPHY_SELF_MANAGED = BIT(7),
};
diff --git a/net/wireless/core.c b/net/wireless/core.c
index b3ec9eaec36b3..609b79fe4a748 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -721,22 +721,6 @@ int wiphy_register(struct wiphy *wiphy)
return -EINVAL;
}
- /*
- * if a wiphy has unsupported modes for regulatory channel enforcement,
- * opt-out of enforcement checking
- */
- if (wiphy->interface_modes & ~(BIT(NL80211_IFTYPE_STATION) |
- BIT(NL80211_IFTYPE_P2P_CLIENT) |
- BIT(NL80211_IFTYPE_AP) |
- BIT(NL80211_IFTYPE_MESH_POINT) |
- BIT(NL80211_IFTYPE_P2P_GO) |
- BIT(NL80211_IFTYPE_ADHOC) |
- BIT(NL80211_IFTYPE_P2P_DEVICE) |
- BIT(NL80211_IFTYPE_NAN) |
- BIT(NL80211_IFTYPE_AP_VLAN) |
- BIT(NL80211_IFTYPE_MONITOR)))
- wiphy->regulatory_flags |= REGULATORY_IGNORE_STALE_KICKOFF;
-
if (WARN_ON((wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) &&
(wiphy->regulatory_flags &
(REGULATORY_CUSTOM_REG |
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 522180919a1a3..3b44fa59dbbab 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2429,9 +2429,17 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
case NL80211_IFTYPE_P2P_DEVICE:
/* no enforcement required */
break;
+ case NL80211_IFTYPE_OCB:
+ if (!wdev->u.ocb.chandef.chan)
+ continue;
+ chandef = wdev->u.ocb.chandef;
+ break;
+ case NL80211_IFTYPE_NAN:
+ /* we have no info, but NAN is also pretty universal */
+ continue;
default:
/* others not implemented for now */
- WARN_ON(1);
+ WARN_ON_ONCE(1);
break;
}
@@ -2490,9 +2498,7 @@ static void reg_check_chans_work(struct work_struct *work)
rtnl_lock();
list_for_each_entry(rdev, &cfg80211_rdev_list, list)
- if (!(rdev->wiphy.regulatory_flags &
- REGULATORY_IGNORE_STALE_KICKOFF))
- reg_leave_invalid_chans(&rdev->wiphy);
+ reg_leave_invalid_chans(&rdev->wiphy);
rtnl_unlock();
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 115/591] wifi: cfg80211/mac80211: Fix ML element common size calculation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 114/591] wifi: cfg80211: fix regulatory disconnect with OCB/NAN Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 116/591] wifi: ieee80211: Fix the common size calculation for reconfiguration ML Greg Kroah-Hartman
` (479 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilan Peer, Johannes Berg,
Sasha Levin
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit 1403b109c9a5244dc6ab79154f04eecc209ef3d2 ]
The common size is part of the length in the data
so don't add it again.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Stable-dep-of: ce6e1f600b0c ("wifi: ieee80211: Fix the common size calculation for reconfiguration ML")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/ieee80211.h | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index d3088666f3f44..470fafce2e707 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -4573,18 +4573,17 @@ static inline u8 ieee80211_mle_common_size(const u8 *data)
switch (u16_get_bits(control, IEEE80211_ML_CONTROL_TYPE)) {
case IEEE80211_ML_CONTROL_TYPE_BASIC:
- common += sizeof(struct ieee80211_mle_basic_common_info);
- break;
case IEEE80211_ML_CONTROL_TYPE_PREQ:
- common += sizeof(struct ieee80211_mle_preq_common_info);
+ case IEEE80211_ML_CONTROL_TYPE_TDLS:
+ /*
+ * The length is the first octet pointed by mle->variable so no
+ * need to add anything
+ */
break;
case IEEE80211_ML_CONTROL_TYPE_RECONF:
if (control & IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR)
common += ETH_ALEN;
return common;
- case IEEE80211_ML_CONTROL_TYPE_TDLS:
- common += sizeof(struct ieee80211_mle_tdls_common_info);
- break;
case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:
if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR)
common += ETH_ALEN;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 116/591] wifi: ieee80211: Fix the common size calculation for reconfiguration ML
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 115/591] wifi: cfg80211/mac80211: Fix ML element common size calculation Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 117/591] mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019 Greg Kroah-Hartman
` (478 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilan Peer, Gregory Greenman,
Johannes Berg, Sasha Levin
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit ce6e1f600b0cfc563a7d607de702262a58cd835d ]
The common information length is found in the first octet of the common
information.
Fixes: 0f48b8b88aa9 ("wifi: ieee80211: add definitions for multi-link element")
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230618214435.3c7ed4817338.I42ef706cb827b4dade6e4ffbb6e7f341eaccd398@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/ieee80211.h | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 470fafce2e707..870ae4cd82029 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -4575,15 +4575,12 @@ static inline u8 ieee80211_mle_common_size(const u8 *data)
case IEEE80211_ML_CONTROL_TYPE_BASIC:
case IEEE80211_ML_CONTROL_TYPE_PREQ:
case IEEE80211_ML_CONTROL_TYPE_TDLS:
+ case IEEE80211_ML_CONTROL_TYPE_RECONF:
/*
* The length is the first octet pointed by mle->variable so no
* need to add anything
*/
break;
- case IEEE80211_ML_CONTROL_TYPE_RECONF:
- if (control & IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR)
- common += ETH_ALEN;
- return common;
case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:
if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR)
common += ETH_ALEN;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 117/591] mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 116/591] wifi: ieee80211: Fix the common size calculation for reconfiguration ML Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 118/591] wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection Greg Kroah-Hartman
` (477 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Ulf Hansson,
Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit c467c8f081859d4f4ca4eee4fba54bb5d85d6c97 ]
This microSD card never clears Flush Cache bit after cache flush has
been started in sd_flush_cache(). This leads e.g. to failure to mount
file system. Add a quirk which disables the SD cache for this specific
card from specific manufacturing date of 11/2019, since on newer dated
cards from 05/2023 the cache flush works correctly.
Fixes: 08ebf903af57 ("mmc: core: Fixup support for writeback-cache for eMMC and SD")
Signed-off-by: Marek Vasut <marex@denx.de>
Link: https://lore.kernel.org/r/20230620102713.7701-1-marex@denx.de
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/core/card.h | 30 +++++++++++++++++++++++-------
drivers/mmc/core/quirks.h | 13 +++++++++++++
drivers/mmc/core/sd.c | 2 +-
include/linux/mmc/card.h | 1 +
4 files changed, 38 insertions(+), 8 deletions(-)
diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
index cfdd1ff40b865..4edf9057fa79d 100644
--- a/drivers/mmc/core/card.h
+++ b/drivers/mmc/core/card.h
@@ -53,6 +53,10 @@ struct mmc_fixup {
unsigned int manfid;
unsigned short oemid;
+ /* Manufacturing date */
+ unsigned short year;
+ unsigned char month;
+
/* SDIO-specific fields. You can use SDIO_ANY_ID here of course */
u16 cis_vendor, cis_device;
@@ -68,6 +72,8 @@ struct mmc_fixup {
#define CID_MANFID_ANY (-1u)
#define CID_OEMID_ANY ((unsigned short) -1)
+#define CID_YEAR_ANY ((unsigned short) -1)
+#define CID_MONTH_ANY ((unsigned char) -1)
#define CID_NAME_ANY (NULL)
#define EXT_CSD_REV_ANY (-1u)
@@ -81,17 +87,21 @@ struct mmc_fixup {
#define CID_MANFID_APACER 0x27
#define CID_MANFID_KINGSTON 0x70
#define CID_MANFID_HYNIX 0x90
+#define CID_MANFID_KINGSTON_SD 0x9F
#define CID_MANFID_NUMONYX 0xFE
#define END_FIXUP { NULL }
-#define _FIXUP_EXT(_name, _manfid, _oemid, _rev_start, _rev_end, \
- _cis_vendor, _cis_device, \
- _fixup, _data, _ext_csd_rev) \
+#define _FIXUP_EXT(_name, _manfid, _oemid, _year, _month, \
+ _rev_start, _rev_end, \
+ _cis_vendor, _cis_device, \
+ _fixup, _data, _ext_csd_rev) \
{ \
.name = (_name), \
.manfid = (_manfid), \
.oemid = (_oemid), \
+ .year = (_year), \
+ .month = (_month), \
.rev_start = (_rev_start), \
.rev_end = (_rev_end), \
.cis_vendor = (_cis_vendor), \
@@ -103,8 +113,8 @@ struct mmc_fixup {
#define MMC_FIXUP_REV(_name, _manfid, _oemid, _rev_start, _rev_end, \
_fixup, _data, _ext_csd_rev) \
- _FIXUP_EXT(_name, _manfid, \
- _oemid, _rev_start, _rev_end, \
+ _FIXUP_EXT(_name, _manfid, _oemid, CID_YEAR_ANY, CID_MONTH_ANY, \
+ _rev_start, _rev_end, \
SDIO_ANY_ID, SDIO_ANY_ID, \
_fixup, _data, _ext_csd_rev) \
@@ -118,8 +128,9 @@ struct mmc_fixup {
_ext_csd_rev)
#define SDIO_FIXUP(_vendor, _device, _fixup, _data) \
- _FIXUP_EXT(CID_NAME_ANY, CID_MANFID_ANY, \
- CID_OEMID_ANY, 0, -1ull, \
+ _FIXUP_EXT(CID_NAME_ANY, CID_MANFID_ANY, CID_OEMID_ANY, \
+ CID_YEAR_ANY, CID_MONTH_ANY, \
+ 0, -1ull, \
_vendor, _device, \
_fixup, _data, EXT_CSD_REV_ANY) \
@@ -264,4 +275,9 @@ static inline int mmc_card_broken_sd_discard(const struct mmc_card *c)
return c->quirks & MMC_QUIRK_BROKEN_SD_DISCARD;
}
+static inline int mmc_card_broken_sd_cache(const struct mmc_card *c)
+{
+ return c->quirks & MMC_QUIRK_BROKEN_SD_CACHE;
+}
+
#endif
diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
index 29b9497936df9..a7ffbc930ea9d 100644
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -53,6 +53,15 @@ static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = {
MMC_FIXUP("MMC32G", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc,
MMC_QUIRK_BLK_NO_CMD23),
+ /*
+ * Kingston Canvas Go! Plus microSD cards never finish SD cache flush.
+ * This has so far only been observed on cards from 11/2019, while new
+ * cards from 2023/05 do not exhibit this behavior.
+ */
+ _FIXUP_EXT("SD64G", CID_MANFID_KINGSTON_SD, 0x5449, 2019, 11,
+ 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
+ MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
+
/*
* Some SD cards lockup while using CMD23 multiblock transfers.
*/
@@ -209,6 +218,10 @@ static inline void mmc_fixup_device(struct mmc_card *card,
if (f->of_compatible &&
!mmc_fixup_of_compatible_match(card, f->of_compatible))
continue;
+ if (f->year != CID_YEAR_ANY && f->year != card->cid.year)
+ continue;
+ if (f->month != CID_MONTH_ANY && f->month != card->cid.month)
+ continue;
dev_dbg(&card->dev, "calling %ps\n", f->vendor_fixup);
f->vendor_fixup(card, f->data);
diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index 72b664ed90cf6..246ce027ae0aa 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -1170,7 +1170,7 @@ static int sd_parse_ext_reg_perf(struct mmc_card *card, u8 fno, u8 page,
card->ext_perf.feature_support |= SD_EXT_PERF_HOST_MAINT;
/* Cache support at bit 0. */
- if (reg_buf[4] & BIT(0))
+ if ((reg_buf[4] & BIT(0)) && !mmc_card_broken_sd_cache(card))
card->ext_perf.feature_support |= SD_EXT_PERF_CACHE;
/* Command queue support indicated via queue depth bits (0 to 4). */
diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
index c726ea7812552..daa2f40d9ce65 100644
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -294,6 +294,7 @@ struct mmc_card {
#define MMC_QUIRK_TRIM_BROKEN (1<<12) /* Skip trim */
#define MMC_QUIRK_BROKEN_HPI (1<<13) /* Disable broken HPI support */
#define MMC_QUIRK_BROKEN_SD_DISCARD (1<<14) /* Disable broken SD discard support */
+#define MMC_QUIRK_BROKEN_SD_CACHE (1<<15) /* Disable broken SD cache support */
bool reenable_cmdq; /* Re-enable Command Queue */
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 118/591] wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 117/591] mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019 Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 119/591] wifi: ath9k: convert msecs to jiffies where needed Greg Kroah-Hartman
` (476 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Gregory Greenman,
Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 2db72b8a700943aa54dce0aabe6ff1b72b615162 ]
We've already done the 'decryption' here, so tell
mac80211 it need not do it again.
Fixes: b1fdc2505abc ("iwlwifi: mvm: advertise BIGTK client support if available")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230620125813.a50cf68fbf2e.Ieceacbe3789d81ea02ae085ad8d1f8813a33c31b@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 02c2a06301076..f268a31ce26d9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -296,7 +296,8 @@ static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm,
static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
struct ieee80211_hdr *hdr,
struct iwl_rx_mpdu_desc *desc,
- u32 status)
+ u32 status,
+ struct ieee80211_rx_status *stats)
{
struct iwl_mvm_sta *mvmsta;
struct iwl_mvm_vif *mvmvif;
@@ -325,8 +326,10 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
/* good cases */
if (likely(status & IWL_RX_MPDU_STATUS_MIC_OK &&
- !(status & IWL_RX_MPDU_STATUS_REPLAY_ERROR)))
+ !(status & IWL_RX_MPDU_STATUS_REPLAY_ERROR))) {
+ stats->flag |= RX_FLAG_DECRYPTED;
return 0;
+ }
if (!sta)
return -1;
@@ -395,7 +398,7 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
if (unlikely(ieee80211_is_mgmt(hdr->frame_control) &&
!ieee80211_has_protected(hdr->frame_control)))
- return iwl_mvm_rx_mgmt_prot(sta, hdr, desc, status);
+ return iwl_mvm_rx_mgmt_prot(sta, hdr, desc, status, stats);
if (!ieee80211_has_protected(hdr->frame_control) ||
(status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 119/591] wifi: ath9k: convert msecs to jiffies where needed
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 118/591] wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 120/591] bpf: Factor out socket lookup functions for the TC hookpoint Greg Kroah-Hartman
` (475 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Antipov,
Toke Høiland-Jørgensen, Kalle Valo, Sasha Levin
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit 2aa083acea9f61be3280184384551178f510ff51 ]
Since 'ieee80211_queue_delayed_work()' expects timeout in
jiffies and not milliseconds, 'msecs_to_jiffies()' should
be used in 'ath_restart_work()' and '__ath9k_flush()'.
Fixes: d63ffc45c5d3 ("ath9k: rename tx_complete_work to hw_check_work")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230613134655.248728-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 7f9f06ea8a05f..6360d3356e256 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -203,7 +203,7 @@ void ath_cancel_work(struct ath_softc *sc)
void ath_restart_work(struct ath_softc *sc)
{
ieee80211_queue_delayed_work(sc->hw, &sc->hw_check_work,
- ATH_HW_CHECK_POLL_INT);
+ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT));
if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah))
ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
@@ -2240,7 +2240,7 @@ void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop,
}
ieee80211_queue_delayed_work(hw, &sc->hw_check_work,
- ATH_HW_CHECK_POLL_INT);
+ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT));
}
static bool ath9k_tx_frames_pending(struct ieee80211_hw *hw)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 120/591] bpf: Factor out socket lookup functions for the TC hookpoint.
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 119/591] wifi: ath9k: convert msecs to jiffies where needed Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 121/591] bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via " Greg Kroah-Hartman
` (474 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gilad Sever, Daniel Borkmann,
Shmulik Ladkani, Eyal Birger, Stanislav Fomichev, Sasha Levin
From: Gilad Sever <gilad9366@gmail.com>
[ Upstream commit 6e98730bc0b44acaf86eccc75f823128aa9c9e79 ]
Change BPF helper socket lookup functions to use TC specific variants:
bpf_tc_sk_lookup_tcp() / bpf_tc_sk_lookup_udp() / bpf_tc_skc_lookup_tcp()
instead of sharing implementation with the cg / sk_skb hooking points.
This allows introducing a separate logic for the TC flow.
The tc functions are identical to the original code.
Signed-off-by: Gilad Sever <gilad9366@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Reviewed-by: Eyal Birger <eyal.birger@gmail.com>
Acked-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/bpf/20230621104211.301902-2-gilad9366@gmail.com
Stable-dep-of: 9a5cb79762e0 ("bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 63 ++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 60 insertions(+), 3 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index b79a070fa8246..e0f73ed8821e1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6646,6 +6646,63 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = {
.arg5_type = ARG_ANYTHING,
};
+BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb,
+ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
+{
+ return (unsigned long)bpf_skc_lookup(skb, tuple, len, IPPROTO_TCP,
+ netns_id, flags);
+}
+
+static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = {
+ .func = bpf_tc_skc_lookup_tcp,
+ .gpl_only = false,
+ .pkt_access = true,
+ .ret_type = RET_PTR_TO_SOCK_COMMON_OR_NULL,
+ .arg1_type = ARG_PTR_TO_CTX,
+ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
+ .arg3_type = ARG_CONST_SIZE,
+ .arg4_type = ARG_ANYTHING,
+ .arg5_type = ARG_ANYTHING,
+};
+
+BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb,
+ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
+{
+ return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_TCP,
+ netns_id, flags);
+}
+
+static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = {
+ .func = bpf_tc_sk_lookup_tcp,
+ .gpl_only = false,
+ .pkt_access = true,
+ .ret_type = RET_PTR_TO_SOCKET_OR_NULL,
+ .arg1_type = ARG_PTR_TO_CTX,
+ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
+ .arg3_type = ARG_CONST_SIZE,
+ .arg4_type = ARG_ANYTHING,
+ .arg5_type = ARG_ANYTHING,
+};
+
+BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb,
+ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
+{
+ return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_UDP,
+ netns_id, flags);
+}
+
+static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = {
+ .func = bpf_tc_sk_lookup_udp,
+ .gpl_only = false,
+ .pkt_access = true,
+ .ret_type = RET_PTR_TO_SOCKET_OR_NULL,
+ .arg1_type = ARG_PTR_TO_CTX,
+ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
+ .arg3_type = ARG_CONST_SIZE,
+ .arg4_type = ARG_ANYTHING,
+ .arg5_type = ARG_ANYTHING,
+};
+
BPF_CALL_1(bpf_sk_release, struct sock *, sk)
{
if (sk && sk_is_refcounted(sk))
@@ -7902,9 +7959,9 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
#endif
#ifdef CONFIG_INET
case BPF_FUNC_sk_lookup_tcp:
- return &bpf_sk_lookup_tcp_proto;
+ return &bpf_tc_sk_lookup_tcp_proto;
case BPF_FUNC_sk_lookup_udp:
- return &bpf_sk_lookup_udp_proto;
+ return &bpf_tc_sk_lookup_udp_proto;
case BPF_FUNC_sk_release:
return &bpf_sk_release_proto;
case BPF_FUNC_tcp_sock:
@@ -7912,7 +7969,7 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
case BPF_FUNC_get_listener_sock:
return &bpf_get_listener_sock_proto;
case BPF_FUNC_skc_lookup_tcp:
- return &bpf_skc_lookup_tcp_proto;
+ return &bpf_tc_skc_lookup_tcp_proto;
case BPF_FUNC_tcp_check_syncookie:
return &bpf_tcp_check_syncookie_proto;
case BPF_FUNC_skb_ecn_set_ce:
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 121/591] bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 120/591] bpf: Factor out socket lookup functions for the TC hookpoint Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 122/591] bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings Greg Kroah-Hartman
` (473 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gilad Sever, Daniel Borkmann,
Shmulik Ladkani, Eyal Birger, Stanislav Fomichev, Sasha Levin
From: Gilad Sever <gilad9366@gmail.com>
[ Upstream commit 97fbfeb86917bdbe9c41d5143e335a929147f405 ]
skb->dev always exists in the tc flow. There is no need to use
bpf_skc_lookup(), bpf_sk_lookup() from this code path.
This change facilitates fixing the tc flow to be VRF aware.
Signed-off-by: Gilad Sever <gilad9366@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Reviewed-by: Eyal Birger <eyal.birger@gmail.com>
Acked-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/bpf/20230621104211.301902-3-gilad9366@gmail.com
Stable-dep-of: 9a5cb79762e0 ("bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index e0f73ed8821e1..1b60a6cc975a7 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6649,8 +6649,12 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = {
BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb,
struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
{
- return (unsigned long)bpf_skc_lookup(skb, tuple, len, IPPROTO_TCP,
- netns_id, flags);
+ struct net *caller_net = dev_net(skb->dev);
+ int ifindex = skb->dev->ifindex;
+
+ return (unsigned long)__bpf_skc_lookup(skb, tuple, len, caller_net,
+ ifindex, IPPROTO_TCP, netns_id,
+ flags);
}
static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = {
@@ -6668,8 +6672,12 @@ static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = {
BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb,
struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
{
- return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_TCP,
- netns_id, flags);
+ struct net *caller_net = dev_net(skb->dev);
+ int ifindex = skb->dev->ifindex;
+
+ return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net,
+ ifindex, IPPROTO_TCP, netns_id,
+ flags);
}
static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = {
@@ -6687,8 +6695,12 @@ static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = {
BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb,
struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
{
- return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_UDP,
- netns_id, flags);
+ struct net *caller_net = dev_net(skb->dev);
+ int ifindex = skb->dev->ifindex;
+
+ return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net,
+ ifindex, IPPROTO_UDP, netns_id,
+ flags);
}
static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 122/591] bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 121/591] bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via " Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 123/591] can: length: fix bitstuffing count Greg Kroah-Hartman
` (472 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gilad Sever, Daniel Borkmann,
Shmulik Ladkani, Eyal Birger, Stanislav Fomichev, David Ahern,
Sasha Levin
From: Gilad Sever <gilad9366@gmail.com>
[ Upstream commit 9a5cb79762e0eda17ca15c2a6eaca4622383c21c ]
When calling bpf_sk_lookup_tcp(), bpf_sk_lookup_udp() or
bpf_skc_lookup_tcp() from tc/xdp ingress, VRF socket bindings aren't
respoected, i.e. unbound sockets are returned, and bound sockets aren't
found.
VRF binding is determined by the sdif argument to sk_lookup(), however
when called from tc the IP SKB control block isn't initialized and thus
inet{,6}_sdif() always returns 0.
Fix by calculating sdif for the tc/xdp flows by observing the device's
l3 enslaved state.
The cg/sk_skb hooking points which are expected to support
inet{,6}_sdif() pass sdif=-1 which makes __bpf_skc_lookup() use the
existing logic.
Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF")
Signed-off-by: Gilad Sever <gilad9366@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Reviewed-by: Eyal Birger <eyal.birger@gmail.com>
Acked-by: Stanislav Fomichev <sdf@google.com>
Cc: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/bpf/20230621104211.301902-4-gilad9366@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/netdevice.h | 9 +++++
net/core/filter.c | 69 ++++++++++++++++++++++-----------------
2 files changed, 48 insertions(+), 30 deletions(-)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d5eb3ab8e38f2..5a04fbf724768 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -5028,6 +5028,15 @@ static inline bool netif_is_l3_slave(const struct net_device *dev)
return dev->priv_flags & IFF_L3MDEV_SLAVE;
}
+static inline int dev_sdif(const struct net_device *dev)
+{
+#ifdef CONFIG_NET_L3_MASTER_DEV
+ if (netif_is_l3_slave(dev))
+ return dev->ifindex;
+#endif
+ return 0;
+}
+
static inline bool netif_is_bridge_master(const struct net_device *dev)
{
return dev->priv_flags & IFF_EBRIDGE;
diff --git a/net/core/filter.c b/net/core/filter.c
index 1b60a6cc975a7..da71e6812ab51 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6474,12 +6474,11 @@ static struct sock *sk_lookup(struct net *net, struct bpf_sock_tuple *tuple,
static struct sock *
__bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
struct net *caller_net, u32 ifindex, u8 proto, u64 netns_id,
- u64 flags)
+ u64 flags, int sdif)
{
struct sock *sk = NULL;
struct net *net;
u8 family;
- int sdif;
if (len == sizeof(tuple->ipv4))
family = AF_INET;
@@ -6491,10 +6490,12 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
if (unlikely(flags || !((s32)netns_id < 0 || netns_id <= S32_MAX)))
goto out;
- if (family == AF_INET)
- sdif = inet_sdif(skb);
- else
- sdif = inet6_sdif(skb);
+ if (sdif < 0) {
+ if (family == AF_INET)
+ sdif = inet_sdif(skb);
+ else
+ sdif = inet6_sdif(skb);
+ }
if ((s32)netns_id < 0) {
net = caller_net;
@@ -6514,10 +6515,11 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
static struct sock *
__bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
struct net *caller_net, u32 ifindex, u8 proto, u64 netns_id,
- u64 flags)
+ u64 flags, int sdif)
{
struct sock *sk = __bpf_skc_lookup(skb, tuple, len, caller_net,
- ifindex, proto, netns_id, flags);
+ ifindex, proto, netns_id, flags,
+ sdif);
if (sk) {
struct sock *sk2 = sk_to_full_sk(sk);
@@ -6557,7 +6559,7 @@ bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
}
return __bpf_skc_lookup(skb, tuple, len, caller_net, ifindex, proto,
- netns_id, flags);
+ netns_id, flags, -1);
}
static struct sock *
@@ -6649,12 +6651,13 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = {
BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb,
struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
{
- struct net *caller_net = dev_net(skb->dev);
- int ifindex = skb->dev->ifindex;
+ struct net_device *dev = skb->dev;
+ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
+ struct net *caller_net = dev_net(dev);
return (unsigned long)__bpf_skc_lookup(skb, tuple, len, caller_net,
ifindex, IPPROTO_TCP, netns_id,
- flags);
+ flags, sdif);
}
static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = {
@@ -6672,12 +6675,13 @@ static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = {
BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb,
struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
{
- struct net *caller_net = dev_net(skb->dev);
- int ifindex = skb->dev->ifindex;
+ struct net_device *dev = skb->dev;
+ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
+ struct net *caller_net = dev_net(dev);
return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net,
ifindex, IPPROTO_TCP, netns_id,
- flags);
+ flags, sdif);
}
static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = {
@@ -6695,12 +6699,13 @@ static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = {
BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb,
struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags)
{
- struct net *caller_net = dev_net(skb->dev);
- int ifindex = skb->dev->ifindex;
+ struct net_device *dev = skb->dev;
+ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
+ struct net *caller_net = dev_net(dev);
return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net,
ifindex, IPPROTO_UDP, netns_id,
- flags);
+ flags, sdif);
}
static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = {
@@ -6732,12 +6737,13 @@ static const struct bpf_func_proto bpf_sk_release_proto = {
BPF_CALL_5(bpf_xdp_sk_lookup_udp, struct xdp_buff *, ctx,
struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags)
{
- struct net *caller_net = dev_net(ctx->rxq->dev);
- int ifindex = ctx->rxq->dev->ifindex;
+ struct net_device *dev = ctx->rxq->dev;
+ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
+ struct net *caller_net = dev_net(dev);
return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, caller_net,
ifindex, IPPROTO_UDP, netns_id,
- flags);
+ flags, sdif);
}
static const struct bpf_func_proto bpf_xdp_sk_lookup_udp_proto = {
@@ -6755,12 +6761,13 @@ static const struct bpf_func_proto bpf_xdp_sk_lookup_udp_proto = {
BPF_CALL_5(bpf_xdp_skc_lookup_tcp, struct xdp_buff *, ctx,
struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags)
{
- struct net *caller_net = dev_net(ctx->rxq->dev);
- int ifindex = ctx->rxq->dev->ifindex;
+ struct net_device *dev = ctx->rxq->dev;
+ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
+ struct net *caller_net = dev_net(dev);
return (unsigned long)__bpf_skc_lookup(NULL, tuple, len, caller_net,
ifindex, IPPROTO_TCP, netns_id,
- flags);
+ flags, sdif);
}
static const struct bpf_func_proto bpf_xdp_skc_lookup_tcp_proto = {
@@ -6778,12 +6785,13 @@ static const struct bpf_func_proto bpf_xdp_skc_lookup_tcp_proto = {
BPF_CALL_5(bpf_xdp_sk_lookup_tcp, struct xdp_buff *, ctx,
struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags)
{
- struct net *caller_net = dev_net(ctx->rxq->dev);
- int ifindex = ctx->rxq->dev->ifindex;
+ struct net_device *dev = ctx->rxq->dev;
+ int ifindex = dev->ifindex, sdif = dev_sdif(dev);
+ struct net *caller_net = dev_net(dev);
return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, caller_net,
ifindex, IPPROTO_TCP, netns_id,
- flags);
+ flags, sdif);
}
static const struct bpf_func_proto bpf_xdp_sk_lookup_tcp_proto = {
@@ -6803,7 +6811,8 @@ BPF_CALL_5(bpf_sock_addr_skc_lookup_tcp, struct bpf_sock_addr_kern *, ctx,
{
return (unsigned long)__bpf_skc_lookup(NULL, tuple, len,
sock_net(ctx->sk), 0,
- IPPROTO_TCP, netns_id, flags);
+ IPPROTO_TCP, netns_id, flags,
+ -1);
}
static const struct bpf_func_proto bpf_sock_addr_skc_lookup_tcp_proto = {
@@ -6822,7 +6831,7 @@ BPF_CALL_5(bpf_sock_addr_sk_lookup_tcp, struct bpf_sock_addr_kern *, ctx,
{
return (unsigned long)__bpf_sk_lookup(NULL, tuple, len,
sock_net(ctx->sk), 0, IPPROTO_TCP,
- netns_id, flags);
+ netns_id, flags, -1);
}
static const struct bpf_func_proto bpf_sock_addr_sk_lookup_tcp_proto = {
@@ -6841,7 +6850,7 @@ BPF_CALL_5(bpf_sock_addr_sk_lookup_udp, struct bpf_sock_addr_kern *, ctx,
{
return (unsigned long)__bpf_sk_lookup(NULL, tuple, len,
sock_net(ctx->sk), 0, IPPROTO_UDP,
- netns_id, flags);
+ netns_id, flags, -1);
}
static const struct bpf_func_proto bpf_sock_addr_sk_lookup_udp_proto = {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 123/591] can: length: fix bitstuffing count
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 122/591] bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 124/591] can: kvaser_pciefd: Add function to set skb hwtstamps Greg Kroah-Hartman
` (471 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Kopp, Vincent Mailhol,
Marc Kleine-Budde, Sasha Levin
From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
[ Upstream commit 9fde4c557f78ee2f3626e92b4089ce9d54a2573a ]
The Stuff Bit Count is always coded on 4 bits [1]. Update the Stuff
Bit Count size accordingly.
In addition, the CRC fields of CAN FD Frames contain stuff bits at
fixed positions called fixed stuff bits [2]. The CRC field starts with
a fixed stuff bit and then has another fixed stuff bit after each
fourth bit [2], which allows us to derive this formula:
FSB count = 1 + round_down(len(CRC field)/4)
The length of the CRC field is [1]:
len(CRC field) = len(Stuff Bit Count) + len(CRC)
= 4 + len(CRC)
with len(CRC) either 17 or 21 bits depending of the payload length.
In conclusion, for CRC17:
FSB count = 1 + round_down((4 + 17)/4)
= 6
and for CRC 21:
FSB count = 1 + round_down((4 + 21)/4)
= 7
Add a Fixed Stuff bits (FSB) field with above values and update
CANFD_FRAME_OVERHEAD_SFF and CANFD_FRAME_OVERHEAD_EFF accordingly.
[1] ISO 11898-1:2015 section 10.4.2.6 "CRC field":
The CRC field shall contain the CRC sequence followed by a recessive
CRC delimiter. For FD Frames, the CRC field shall also contain the
stuff count.
Stuff count
If FD Frames, the stuff count shall be at the beginning of the CRC
field. It shall consist of the stuff bit count modulo 8 in a 3-bit
gray code followed by a parity bit [...]
[2] ISO 11898-1:2015 paragraph 10.5 "Frame coding":
In the CRC field of FD Frames, the stuff bits shall be inserted at
fixed positions; they are called fixed stuff bits. There shall be a
fixed stuff bit before the first bit of the stuff count, even if the
last bits of the preceding field are a sequence of five consecutive
bits of identical value, there shall be only the fixed stuff bit,
there shall not be two consecutive stuff bits. A further fixed stuff
bit shall be inserted after each fourth bit of the CRC field [...]
Fixes: 85d99c3e2a13 ("can: length: can_skb_get_frame_len(): introduce function to get data length of frame in data link layer")
Suggested-by: Thomas Kopp <Thomas.Kopp@microchip.com>
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Reviewed-by: Thomas Kopp <Thomas.Kopp@microchip.com>
Link: https://lore.kernel.org/all/20230611025728.450837-2-mailhol.vincent@wanadoo.fr
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/can/length.h | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/include/linux/can/length.h b/include/linux/can/length.h
index 6995092b774ec..ef1fd32cef16b 100644
--- a/include/linux/can/length.h
+++ b/include/linux/can/length.h
@@ -69,17 +69,18 @@
* Error Status Indicator (ESI) 1
* Data length code (DLC) 4
* Data field 0...512
- * Stuff Bit Count (SBC) 0...16: 4 20...64:5
+ * Stuff Bit Count (SBC) 4
* CRC 0...16: 17 20...64:21
* CRC delimiter (CD) 1
+ * Fixed Stuff bits (FSB) 0...16: 6 20...64:7
* ACK slot (AS) 1
* ACK delimiter (AD) 1
* End-of-frame (EOF) 7
* Inter frame spacing 3
*
- * assuming CRC21, rounded up and ignoring bitstuffing
+ * assuming CRC21, rounded up and ignoring dynamic bitstuffing
*/
-#define CANFD_FRAME_OVERHEAD_SFF DIV_ROUND_UP(61, 8)
+#define CANFD_FRAME_OVERHEAD_SFF DIV_ROUND_UP(67, 8)
/*
* Size of a CAN-FD Extended Frame
@@ -98,17 +99,18 @@
* Error Status Indicator (ESI) 1
* Data length code (DLC) 4
* Data field 0...512
- * Stuff Bit Count (SBC) 0...16: 4 20...64:5
+ * Stuff Bit Count (SBC) 4
* CRC 0...16: 17 20...64:21
* CRC delimiter (CD) 1
+ * Fixed Stuff bits (FSB) 0...16: 6 20...64:7
* ACK slot (AS) 1
* ACK delimiter (AD) 1
* End-of-frame (EOF) 7
* Inter frame spacing 3
*
- * assuming CRC21, rounded up and ignoring bitstuffing
+ * assuming CRC21, rounded up and ignoring dynamic bitstuffing
*/
-#define CANFD_FRAME_OVERHEAD_EFF DIV_ROUND_UP(80, 8)
+#define CANFD_FRAME_OVERHEAD_EFF DIV_ROUND_UP(86, 8)
/*
* Maximum size of a Classical CAN frame
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 124/591] can: kvaser_pciefd: Add function to set skb hwtstamps
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 123/591] can: length: fix bitstuffing count Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 125/591] can: kvaser_pciefd: Set hardware timestamp on transmitted packets Greg Kroah-Hartman
` (470 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jimmy Assarsson, Vincent Mailhol,
Marc Kleine-Budde, Sasha Levin
From: Jimmy Assarsson <extja@kvaser.com>
[ Upstream commit 2d55e9f9b4427e1ad59b974f2267767aac3788d3 ]
Add new function, kvaser_pciefd_set_skb_timestamp(), to set skb hwtstamps.
Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Link: https://lore.kernel.org/all/20230529134248.752036-4-extja@kvaser.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Stable-dep-of: ec681b91befa ("can: kvaser_pciefd: Set hardware timestamp on transmitted packets")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/kvaser_pciefd.c | 27 ++++++++++-----------------
1 file changed, 10 insertions(+), 17 deletions(-)
diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c
index 956a4a57396f9..0b537292c7b19 100644
--- a/drivers/net/can/kvaser_pciefd.c
+++ b/drivers/net/can/kvaser_pciefd.c
@@ -538,6 +538,13 @@ static int kvaser_pciefd_set_tx_irq(struct kvaser_pciefd_can *can)
return 0;
}
+static inline void kvaser_pciefd_set_skb_timestamp(const struct kvaser_pciefd *pcie,
+ struct sk_buff *skb, u64 timestamp)
+{
+ skb_hwtstamps(skb)->hwtstamp =
+ ns_to_ktime(div_u64(timestamp * 1000, pcie->freq_to_ticks_div));
+}
+
static void kvaser_pciefd_setup_controller(struct kvaser_pciefd_can *can)
{
u32 mode;
@@ -1171,7 +1178,6 @@ static int kvaser_pciefd_handle_data_packet(struct kvaser_pciefd *pcie,
struct canfd_frame *cf;
struct can_priv *priv;
struct net_device_stats *stats;
- struct skb_shared_hwtstamps *shhwtstamps;
u8 ch_id = (p->header[1] >> KVASER_PCIEFD_PACKET_CHID_SHIFT) & 0x7;
if (ch_id >= pcie->nr_channels)
@@ -1214,12 +1220,7 @@ static int kvaser_pciefd_handle_data_packet(struct kvaser_pciefd *pcie,
stats->rx_bytes += cf->len;
}
stats->rx_packets++;
-
- shhwtstamps = skb_hwtstamps(skb);
-
- shhwtstamps->hwtstamp =
- ns_to_ktime(div_u64(p->timestamp * 1000,
- pcie->freq_to_ticks_div));
+ kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp);
return netif_rx(skb);
}
@@ -1282,7 +1283,6 @@ static int kvaser_pciefd_rx_error_frame(struct kvaser_pciefd_can *can,
struct net_device *ndev = can->can.dev;
struct sk_buff *skb;
struct can_frame *cf = NULL;
- struct skb_shared_hwtstamps *shhwtstamps;
struct net_device_stats *stats = &ndev->stats;
old_state = can->can.state;
@@ -1323,10 +1323,7 @@ static int kvaser_pciefd_rx_error_frame(struct kvaser_pciefd_can *can,
return -ENOMEM;
}
- shhwtstamps = skb_hwtstamps(skb);
- shhwtstamps->hwtstamp =
- ns_to_ktime(div_u64(p->timestamp * 1000,
- can->kv_pcie->freq_to_ticks_div));
+ kvaser_pciefd_set_skb_timestamp(can->kv_pcie, skb, p->timestamp);
cf->can_id |= CAN_ERR_BUSERROR | CAN_ERR_CNT;
cf->data[6] = bec.txerr;
@@ -1374,7 +1371,6 @@ static int kvaser_pciefd_handle_status_resp(struct kvaser_pciefd_can *can,
struct net_device *ndev = can->can.dev;
struct sk_buff *skb;
struct can_frame *cf;
- struct skb_shared_hwtstamps *shhwtstamps;
skb = alloc_can_err_skb(ndev, &cf);
if (!skb) {
@@ -1394,10 +1390,7 @@ static int kvaser_pciefd_handle_status_resp(struct kvaser_pciefd_can *can,
cf->can_id |= CAN_ERR_RESTARTED;
}
- shhwtstamps = skb_hwtstamps(skb);
- shhwtstamps->hwtstamp =
- ns_to_ktime(div_u64(p->timestamp * 1000,
- can->kv_pcie->freq_to_ticks_div));
+ kvaser_pciefd_set_skb_timestamp(can->kv_pcie, skb, p->timestamp);
cf->data[6] = bec.txerr;
cf->data[7] = bec.rxerr;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 125/591] can: kvaser_pciefd: Set hardware timestamp on transmitted packets
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 124/591] can: kvaser_pciefd: Add function to set skb hwtstamps Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 126/591] net: stmmac: fix double serdes powerdown Greg Kroah-Hartman
` (469 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jimmy Assarsson, Vincent Mailhol,
Marc Kleine-Budde, Sasha Levin
From: Jimmy Assarsson <extja@kvaser.com>
[ Upstream commit ec681b91befa982477e24a150dd6452427fe6473 ]
Set hardware timestamp on transmitted packets.
Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Link: https://lore.kernel.org/all/20230529134248.752036-5-extja@kvaser.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/kvaser_pciefd.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c
index 0b537292c7b19..74a47244f1291 100644
--- a/drivers/net/can/kvaser_pciefd.c
+++ b/drivers/net/can/kvaser_pciefd.c
@@ -1519,6 +1519,7 @@ static void kvaser_pciefd_handle_nack_packet(struct kvaser_pciefd_can *can,
if (skb) {
cf->can_id |= CAN_ERR_BUSERROR;
+ kvaser_pciefd_set_skb_timestamp(can->kv_pcie, skb, p->timestamp);
netif_rx(skb);
} else {
stats->rx_dropped++;
@@ -1550,8 +1551,15 @@ static int kvaser_pciefd_handle_ack_packet(struct kvaser_pciefd *pcie,
netdev_dbg(can->can.dev, "Packet was flushed\n");
} else {
int echo_idx = p->header[0] & KVASER_PCIEFD_PACKET_SEQ_MSK;
- int dlc = can_get_echo_skb(can->can.dev, echo_idx, NULL);
- u8 count = ioread32(can->reg_base +
+ int dlc;
+ u8 count;
+ struct sk_buff *skb;
+
+ skb = can->can.echo_skb[echo_idx];
+ if (skb)
+ kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp);
+ dlc = can_get_echo_skb(can->can.dev, echo_idx, NULL);
+ count = ioread32(can->reg_base +
KVASER_PCIEFD_KCAN_TX_NPACKETS_REG) & 0xff;
if (count < KVASER_PCIEFD_CAN_TX_MAX_COUNT &&
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 126/591] net: stmmac: fix double serdes powerdown
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 125/591] can: kvaser_pciefd: Set hardware timestamp on transmitted packets Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 127/591] netlink: fix potential deadlock in netlink_set_err() Greg Kroah-Hartman
` (468 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Jiri Pirko,
Junxiao Chang, Andrew Halaney, Jakub Kicinski, Sasha Levin
From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
[ Upstream commit c4fc88ad2a765224a648db8ab35f125e120fe41b ]
Commit 49725ffc15fc ("net: stmmac: power up/down serdes in
stmmac_open/release") correctly added a call to the serdes_powerdown()
callback to stmmac_release() but did not remove the one from
stmmac_remove() which leads to a doubled call to serdes_powerdown().
This can lead to all kinds of problems: in the case of the qcom ethqos
driver, it caused an unbalanced regulator disable splat.
Fixes: 49725ffc15fc ("net: stmmac: power up/down serdes in stmmac_open/release")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Acked-by: Junxiao Chang <junxiao.chang@intel.com>
Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
Tested-by: Andrew Halaney <ahalaney@redhat.com>
Link: https://lore.kernel.org/r/20230621135537.376649-1-brgl@bgdev.pl
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 30ce073055785..a07bcb2f5d2e2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -7388,12 +7388,6 @@ int stmmac_dvr_remove(struct device *dev)
netif_carrier_off(ndev);
unregister_netdev(ndev);
- /* Serdes power down needs to happen after VLAN filter
- * is deleted that is triggered by unregister_netdev().
- */
- if (priv->plat->serdes_powerdown)
- priv->plat->serdes_powerdown(ndev, priv->plat->bsp_priv);
-
#ifdef CONFIG_DEBUG_FS
stmmac_exit_fs(ndev);
#endif
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 127/591] netlink: fix potential deadlock in netlink_set_err()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 126/591] net: stmmac: fix double serdes powerdown Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 128/591] netlink: do not hard code device address lenth in fdb dumps Greg Kroah-Hartman
` (467 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+a7d200a347f912723e5c,
Eric Dumazet, Johannes Berg, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 8d61f926d42045961e6b65191c09e3678d86a9cf ]
syzbot reported a possible deadlock in netlink_set_err() [1]
A similar issue was fixed in commit 1d482e666b8e ("netlink: disable IRQs
for netlink_lock_table()") in netlink_lock_table()
This patch adds IRQ safety to netlink_set_err() and __netlink_diag_dump()
which were not covered by cited commit.
[1]
WARNING: possible irq lock inversion dependency detected
6.4.0-rc6-syzkaller-00240-g4e9f0ec38852 #0 Not tainted
syz-executor.2/23011 just changed the state of lock:
ffffffff8e1a7a58 (nl_table_lock){.+.?}-{2:2}, at: netlink_set_err+0x2e/0x3a0 net/netlink/af_netlink.c:1612
but this lock was taken by another, SOFTIRQ-safe lock in the past:
(&local->queue_stop_reason_lock){..-.}-{2:2}
and interrupts could create inverse lock ordering between them.
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(nl_table_lock);
local_irq_disable();
lock(&local->queue_stop_reason_lock);
lock(nl_table_lock);
<Interrupt>
lock(&local->queue_stop_reason_lock);
*** DEADLOCK ***
Fixes: 1d482e666b8e ("netlink: disable IRQs for netlink_lock_table()")
Reported-by: syzbot+a7d200a347f912723e5c@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=a7d200a347f912723e5c
Link: https://lore.kernel.org/netdev/000000000000e38d1605fea5747e@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Johannes Berg <johannes.berg@intel.com>
Link: https://lore.kernel.org/r/20230621154337.1668594-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netlink/af_netlink.c | 5 +++--
net/netlink/diag.c | 5 +++--
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 6d493a0ccf399..ed123cf462afe 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1589,6 +1589,7 @@ static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p)
int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
{
struct netlink_set_err_data info;
+ unsigned long flags;
struct sock *sk;
int ret = 0;
@@ -1598,12 +1599,12 @@ int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
/* sk->sk_err wants a positive error value */
info.code = -code;
- read_lock(&nl_table_lock);
+ read_lock_irqsave(&nl_table_lock, flags);
sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
ret += do_one_set_err(sk, &info);
- read_unlock(&nl_table_lock);
+ read_unlock_irqrestore(&nl_table_lock, flags);
return ret;
}
EXPORT_SYMBOL(netlink_set_err);
diff --git a/net/netlink/diag.c b/net/netlink/diag.c
index c6255eac305c7..4143b2ea4195a 100644
--- a/net/netlink/diag.c
+++ b/net/netlink/diag.c
@@ -94,6 +94,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
struct net *net = sock_net(skb->sk);
struct netlink_diag_req *req;
struct netlink_sock *nlsk;
+ unsigned long flags;
struct sock *sk;
int num = 2;
int ret = 0;
@@ -152,7 +153,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
num++;
mc_list:
- read_lock(&nl_table_lock);
+ read_lock_irqsave(&nl_table_lock, flags);
sk_for_each_bound(sk, &tbl->mc_list) {
if (sk_hashed(sk))
continue;
@@ -173,7 +174,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
}
num++;
}
- read_unlock(&nl_table_lock);
+ read_unlock_irqrestore(&nl_table_lock, flags);
done:
cb->args[0] = num;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 128/591] netlink: do not hard code device address lenth in fdb dumps
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 127/591] netlink: fix potential deadlock in netlink_set_err() Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 129/591] bonding: do not assume skb mac_header is set Greg Kroah-Hartman
` (466 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet, Jiri Pirko,
Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit aa5406950726e336c5c9585b09799a734b6e77bf ]
syzbot reports that some netdev devices do not have a six bytes
address [1]
Replace ETH_ALEN by dev->addr_len.
[1] (Case of a device where dev->addr_len = 4)
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in copyout+0xb8/0x100 lib/iov_iter.c:169
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
copyout+0xb8/0x100 lib/iov_iter.c:169
_copy_to_iter+0x6d8/0x1d00 lib/iov_iter.c:536
copy_to_iter include/linux/uio.h:206 [inline]
simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:513
__skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419
skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:527
skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]
netlink_recvmsg+0x4ae/0x15a0 net/netlink/af_netlink.c:1970
sock_recvmsg_nosec net/socket.c:1019 [inline]
sock_recvmsg net/socket.c:1040 [inline]
____sys_recvmsg+0x283/0x7f0 net/socket.c:2722
___sys_recvmsg+0x223/0x840 net/socket.c:2764
do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858
__sys_recvmmsg net/socket.c:2937 [inline]
__do_sys_recvmmsg net/socket.c:2960 [inline]
__se_sys_recvmmsg net/socket.c:2953 [inline]
__x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was stored to memory at:
__nla_put lib/nlattr.c:1009 [inline]
nla_put+0x1c6/0x230 lib/nlattr.c:1067
nlmsg_populate_fdb_fill+0x2b8/0x600 net/core/rtnetlink.c:4071
nlmsg_populate_fdb net/core/rtnetlink.c:4418 [inline]
ndo_dflt_fdb_dump+0x616/0x840 net/core/rtnetlink.c:4456
rtnl_fdb_dump+0x14ff/0x1fc0 net/core/rtnetlink.c:4629
netlink_dump+0x9d1/0x1310 net/netlink/af_netlink.c:2268
netlink_recvmsg+0xc5c/0x15a0 net/netlink/af_netlink.c:1995
sock_recvmsg_nosec+0x7a/0x120 net/socket.c:1019
____sys_recvmsg+0x664/0x7f0 net/socket.c:2720
___sys_recvmsg+0x223/0x840 net/socket.c:2764
do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858
__sys_recvmmsg net/socket.c:2937 [inline]
__do_sys_recvmmsg net/socket.c:2960 [inline]
__se_sys_recvmmsg net/socket.c:2953 [inline]
__x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at:
slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:716
slab_alloc_node mm/slub.c:3451 [inline]
__kmem_cache_alloc_node+0x4ff/0x8b0 mm/slub.c:3490
kmalloc_trace+0x51/0x200 mm/slab_common.c:1057
kmalloc include/linux/slab.h:559 [inline]
__hw_addr_create net/core/dev_addr_lists.c:60 [inline]
__hw_addr_add_ex+0x2e5/0x9e0 net/core/dev_addr_lists.c:118
__dev_mc_add net/core/dev_addr_lists.c:867 [inline]
dev_mc_add+0x9a/0x130 net/core/dev_addr_lists.c:885
igmp6_group_added+0x267/0xbc0 net/ipv6/mcast.c:680
ipv6_mc_up+0x296/0x3b0 net/ipv6/mcast.c:2754
ipv6_mc_remap+0x1e/0x30 net/ipv6/mcast.c:2708
addrconf_type_change net/ipv6/addrconf.c:3731 [inline]
addrconf_notify+0x4d3/0x1d90 net/ipv6/addrconf.c:3699
notifier_call_chain kernel/notifier.c:93 [inline]
raw_notifier_call_chain+0xe4/0x430 kernel/notifier.c:461
call_netdevice_notifiers_info net/core/dev.c:1935 [inline]
call_netdevice_notifiers_extack net/core/dev.c:1973 [inline]
call_netdevice_notifiers+0x1ee/0x2d0 net/core/dev.c:1987
bond_enslave+0xccd/0x53f0 drivers/net/bonding/bond_main.c:1906
do_set_master net/core/rtnetlink.c:2626 [inline]
rtnl_newlink_create net/core/rtnetlink.c:3460 [inline]
__rtnl_newlink net/core/rtnetlink.c:3660 [inline]
rtnl_newlink+0x378c/0x40e0 net/core/rtnetlink.c:3673
rtnetlink_rcv_msg+0x16a6/0x1840 net/core/rtnetlink.c:6395
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546
rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6413
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
____sys_sendmsg+0x999/0xd50 net/socket.c:2503
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2557
__sys_sendmsg net/socket.c:2586 [inline]
__do_sys_sendmsg net/socket.c:2595 [inline]
__se_sys_sendmsg net/socket.c:2593 [inline]
__x64_sys_sendmsg+0x304/0x490 net/socket.c:2593
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Bytes 2856-2857 of 3500 are uninitialized
Memory access of size 3500 starts at ffff888018d99104
Data copied to user address 0000000020000480
Fixes: d83b06036048 ("net: add fdb generic dump routine")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20230621174720.1845040-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/rtnetlink.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index ef2a07ae5496e..5625ed30a06f3 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3992,7 +3992,7 @@ static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
ndm->ndm_ifindex = dev->ifindex;
ndm->ndm_state = ndm_state;
- if (nla_put(skb, NDA_LLADDR, ETH_ALEN, addr))
+ if (nla_put(skb, NDA_LLADDR, dev->addr_len, addr))
goto nla_put_failure;
if (vid)
if (nla_put(skb, NDA_VLAN, sizeof(u16), &vid))
@@ -4006,10 +4006,10 @@ static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
return -EMSGSIZE;
}
-static inline size_t rtnl_fdb_nlmsg_size(void)
+static inline size_t rtnl_fdb_nlmsg_size(const struct net_device *dev)
{
return NLMSG_ALIGN(sizeof(struct ndmsg)) +
- nla_total_size(ETH_ALEN) + /* NDA_LLADDR */
+ nla_total_size(dev->addr_len) + /* NDA_LLADDR */
nla_total_size(sizeof(u16)) + /* NDA_VLAN */
0;
}
@@ -4021,7 +4021,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, u16 vid, int type,
struct sk_buff *skb;
int err = -ENOBUFS;
- skb = nlmsg_new(rtnl_fdb_nlmsg_size(), GFP_ATOMIC);
+ skb = nlmsg_new(rtnl_fdb_nlmsg_size(dev), GFP_ATOMIC);
if (!skb)
goto errout;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 129/591] bonding: do not assume skb mac_header is set
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 128/591] netlink: do not hard code device address lenth in fdb dumps Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 130/591] selftests: rtnetlink: remove netdevsim device after ipsec offload test Greg Kroah-Hartman
` (465 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet, Jarod Wilson,
Moshe Tal, Jussi Maki, Jay Vosburgh, Andy Gospodarek,
Vladimir Oltean, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 6a940abdef3162e5723f1495b8a49859d1708f79 ]
Drivers must not assume in their ndo_start_xmit() that
skbs have their mac_header set. skb->data is all what is needed.
bonding seems to be one of the last offender as caught by syzbot:
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 skb_mac_offset include/linux/skbuff.h:2913 [inline]
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline]
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline]
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline]
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 __bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline]
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470
Modules linked in:
CPU: 1 PID: 12155 Comm: syz-executor.3 Not tainted 6.1.30-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
RIP: 0010:skb_mac_header include/linux/skbuff.h:2907 [inline]
RIP: 0010:skb_mac_offset include/linux/skbuff.h:2913 [inline]
RIP: 0010:bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline]
RIP: 0010:bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline]
RIP: 0010:bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline]
RIP: 0010:__bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline]
RIP: 0010:bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470
Code: 8b 7c 24 30 e8 76 dd 1a 01 48 85 c0 74 0d 48 89 c3 e8 29 67 2e fe e9 15 ef ff ff e8 1f 67 2e fe e9 10 ef ff ff e8 15 67 2e fe <0f> 0b e9 45 f8 ff ff e8 09 67 2e fe e9 dc fa ff ff e8 ff 66 2e fe
RSP: 0018:ffffc90002fff6e0 EFLAGS: 00010283
RAX: ffffffff835874db RBX: 000000000000ffff RCX: 0000000000040000
RDX: ffffc90004dcf000 RSI: 00000000000000b5 RDI: 00000000000000b6
RBP: ffffc90002fff8b8 R08: ffffffff83586d16 R09: ffffffff83586584
R10: 0000000000000007 R11: ffff8881599fc780 R12: ffff88811b6a7b7e
R13: 1ffff110236d4f6f R14: ffff88811b6a7ac0 R15: 1ffff110236d4f76
FS: 00007f2e9eb47700(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e421000 CR3: 000000010e6d4000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
[<ffffffff8471a49f>] netdev_start_xmit include/linux/netdevice.h:4925 [inline]
[<ffffffff8471a49f>] __dev_direct_xmit+0x4ef/0x850 net/core/dev.c:4380
[<ffffffff851d845b>] dev_direct_xmit include/linux/netdevice.h:3043 [inline]
[<ffffffff851d845b>] packet_direct_xmit+0x18b/0x300 net/packet/af_packet.c:284
[<ffffffff851c7472>] packet_snd net/packet/af_packet.c:3112 [inline]
[<ffffffff851c7472>] packet_sendmsg+0x4a22/0x64d0 net/packet/af_packet.c:3143
[<ffffffff8467a4b2>] sock_sendmsg_nosec net/socket.c:716 [inline]
[<ffffffff8467a4b2>] sock_sendmsg net/socket.c:736 [inline]
[<ffffffff8467a4b2>] __sys_sendto+0x472/0x5f0 net/socket.c:2139
[<ffffffff8467a715>] __do_sys_sendto net/socket.c:2151 [inline]
[<ffffffff8467a715>] __se_sys_sendto net/socket.c:2147 [inline]
[<ffffffff8467a715>] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147
[<ffffffff8553071f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff8553071f>] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80
[<ffffffff85600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fixes: 7b8fc0103bb5 ("bonding: add a vlan+srcmac tx hashing option")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jarod Wilson <jarod@redhat.com>
Cc: Moshe Tal <moshet@nvidia.com>
Cc: Jussi Maki <joamaki@gmail.com>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Cc: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://lore.kernel.org/r/20230622152304.2137482-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9ed80f7106515..91d84df91123b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4168,7 +4168,7 @@ u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb)
return skb->hash;
return __bond_xmit_hash(bond, skb, skb->data, skb->protocol,
- skb_mac_offset(skb), skb_network_offset(skb),
+ 0, skb_network_offset(skb),
skb_headlen(skb));
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 130/591] selftests: rtnetlink: remove netdevsim device after ipsec offload test
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 129/591] bonding: do not assume skb mac_header is set Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 131/591] gtp: Fix use-after-free in __gtp_encap_destroy() Greg Kroah-Hartman
` (464 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sabrina Dubroca, Simon Horman,
Jiri Pirko, Jakub Kicinski, Sasha Levin
From: Sabrina Dubroca <sd@queasysnail.net>
[ Upstream commit 5f789f103671fec3733ebe756e56adf15c90c21d ]
On systems where netdevsim is built-in or loaded before the test
starts, kci_test_ipsec_offload doesn't remove the netdevsim device it
created during the test.
Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/e1cb94f4f82f4eca4a444feec4488a1323396357.1687466906.git.sd@queasysnail.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/rtnetlink.sh | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh
index 275491be3da2f..cafd14b1ed2ab 100755
--- a/tools/testing/selftests/net/rtnetlink.sh
+++ b/tools/testing/selftests/net/rtnetlink.sh
@@ -835,6 +835,7 @@ EOF
fi
# clean up any leftovers
+ echo 0 > /sys/bus/netdevsim/del_device
$probed && rmmod netdevsim
if [ $ret -ne 0 ]; then
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 131/591] gtp: Fix use-after-free in __gtp_encap_destroy().
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 130/591] selftests: rtnetlink: remove netdevsim device after ipsec offload test Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 132/591] net: axienet: Move reset before 64-bit DMA detection Greg Kroah-Hartman
` (463 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzkaller, Kuniyuki Iwashima,
Pablo Neira Ayuso, Jakub Kicinski, Sasha Levin
From: Kuniyuki Iwashima <kuniyu@amazon.com>
[ Upstream commit ce3aee7114c575fab32a5e9e939d4bbb3dcca79f ]
syzkaller reported use-after-free in __gtp_encap_destroy(). [0]
It shows the same process freed sk and touched it illegally.
Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock()
and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data,
but release_sock() is called after sock_put() releases the last refcnt.
[0]:
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
BUG: KASAN: slab-use-after-free in do_raw_spin_lock include/linux/spinlock.h:186 [inline]
BUG: KASAN: slab-use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178
Write of size 4 at addr ffff88800dbef398 by task syz-executor.2/2401
CPU: 1 PID: 2401 Comm: syz-executor.2 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:351 [inline]
print_report+0xcc/0x620 mm/kasan/report.c:462
kasan_report+0xb2/0xe0 mm/kasan/report.c:572
check_region_inline mm/kasan/generic.c:181 [inline]
kasan_check_range+0x39/0x1c0 mm/kasan/generic.c:187
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
do_raw_spin_lock include/linux/spinlock.h:186 [inline]
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline]
_raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
release_sock+0x1f/0x1a0 net/core/sock.c:3526
gtp_encap_disable_sock drivers/net/gtp.c:651 [inline]
gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664
gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728
unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841
rtnl_delete_link net/core/rtnetlink.c:3216 [inline]
rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268
rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423
netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0x1b7/0x200 net/socket.c:747
____sys_sendmsg+0x75a/0x990 net/socket.c:2493
___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547
__sys_sendmsg+0xfe/0x1d0 net/socket.c:2576
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f1168b1fe5d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48
RSP: 002b:00007f1167edccc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f1168b1fe5d
RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003
RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f1168b80530 R15: 0000000000000000
</TASK>
Allocated by task 1483:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x59/0x70 mm/kasan/common.c:328
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:711 [inline]
slab_alloc_node mm/slub.c:3451 [inline]
slab_alloc mm/slub.c:3459 [inline]
__kmem_cache_alloc_lru mm/slub.c:3466 [inline]
kmem_cache_alloc+0x16d/0x340 mm/slub.c:3475
sk_prot_alloc+0x5f/0x280 net/core/sock.c:2073
sk_alloc+0x34/0x6c0 net/core/sock.c:2132
inet6_create net/ipv6/af_inet6.c:192 [inline]
inet6_create+0x2c7/0xf20 net/ipv6/af_inet6.c:119
__sock_create+0x2a1/0x530 net/socket.c:1535
sock_create net/socket.c:1586 [inline]
__sys_socket_create net/socket.c:1623 [inline]
__sys_socket_create net/socket.c:1608 [inline]
__sys_socket+0x137/0x250 net/socket.c:1651
__do_sys_socket net/socket.c:1664 [inline]
__se_sys_socket net/socket.c:1662 [inline]
__x64_sys_socket+0x72/0xb0 net/socket.c:1662
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Freed by task 2401:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free mm/kasan/common.c:200 [inline]
__kasan_slab_free+0x10c/0x1b0 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook mm/slub.c:1807 [inline]
slab_free mm/slub.c:3786 [inline]
kmem_cache_free+0xb4/0x490 mm/slub.c:3808
sk_prot_free net/core/sock.c:2113 [inline]
__sk_destruct+0x500/0x720 net/core/sock.c:2207
sk_destruct+0xc1/0xe0 net/core/sock.c:2222
__sk_free+0xed/0x3d0 net/core/sock.c:2233
sk_free+0x7c/0xa0 net/core/sock.c:2244
sock_put include/net/sock.h:1981 [inline]
__gtp_encap_destroy+0x165/0x1b0 drivers/net/gtp.c:634
gtp_encap_disable_sock drivers/net/gtp.c:651 [inline]
gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664
gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728
unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841
rtnl_delete_link net/core/rtnetlink.c:3216 [inline]
rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268
rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423
netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0x1b7/0x200 net/socket.c:747
____sys_sendmsg+0x75a/0x990 net/socket.c:2493
___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547
__sys_sendmsg+0xfe/0x1d0 net/socket.c:2576
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
The buggy address belongs to the object at ffff88800dbef300
which belongs to the cache UDPv6 of size 1344
The buggy address is located 152 bytes inside of
freed 1344-byte region [ffff88800dbef300, ffff88800dbef840)
The buggy address belongs to the physical page:
page:00000000d31bfed5 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800dbeed40 pfn:0xdbe8
head:00000000d31bfed5 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888008ee0801
flags: 0x100000000010200(slab|head|node=0|zone=1)
page_type: 0xffffffff()
raw: 0100000000010200 ffff88800c7a3000 dead000000000122 0000000000000000
raw: ffff88800dbeed40 0000000080160015 00000001ffffffff ffff888008ee0801
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88800dbef280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800dbef300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88800dbef380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88800dbef400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88800dbef480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Fixes: e198987e7dd7 ("gtp: fix suspicious RCU usage")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Link: https://lore.kernel.org/r/20230622213231.24651-1-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/gtp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 15c7dc82107f4..acb20ad4e37eb 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -631,7 +631,9 @@ static void __gtp_encap_destroy(struct sock *sk)
gtp->sk1u = NULL;
udp_sk(sk)->encap_type = 0;
rcu_assign_sk_user_data(sk, NULL);
+ release_sock(sk);
sock_put(sk);
+ return;
}
release_sock(sk);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 132/591] net: axienet: Move reset before 64-bit DMA detection
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 131/591] gtp: Fix use-after-free in __gtp_encap_destroy() Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 133/591] ocfs2: Fix use of slab data with sendpage Greg Kroah-Hartman
` (462 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxim Kochetkov, Robert Hancock,
Radhey Shyam Pandey, Jakub Kicinski, Sasha Levin
From: Maxim Kochetkov <fido_max@inbox.ru>
[ Upstream commit f1bc9fc4a06de0108e0dca2a9a7e99ba1fc632f9 ]
64-bit DMA detection will fail if axienet was started before (by boot
loader, boot ROM, etc). In this state axienet will not start properly.
XAXIDMA_TX_CDESC_OFFSET + 4 register (MM2S_CURDESC_MSB) is used to detect
64-bit DMA capability here. But datasheet says: When DMACR.RS is 1
(axienet is in enabled state), CURDESC_PTR becomes Read Only (RO) and
is used to fetch the first descriptor. So iowrite32()/ioread32() trick
to this register to detect 64-bit DMA will not work.
So move axienet reset before 64-bit DMA detection.
Fixes: f735c40ed93c ("net: axienet: Autodetect 64-bit DMA capability")
Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Reviewed-by: Robert Hancock <robert.hancock@calian.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://lore.kernel.org/r/20230622192245.116864-1-fido_max@inbox.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index d1d772580da98..d14648558338b 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -2043,6 +2043,11 @@ static int axienet_probe(struct platform_device *pdev)
goto cleanup_clk;
}
+ /* Reset core now that clocks are enabled, prior to accessing MDIO */
+ ret = __axienet_device_reset(lp);
+ if (ret)
+ goto cleanup_clk;
+
/* Autodetect the need for 64-bit DMA pointers.
* When the IP is configured for a bus width bigger than 32 bits,
* writing the MSB registers is mandatory, even if they are all 0.
@@ -2097,11 +2102,6 @@ static int axienet_probe(struct platform_device *pdev)
lp->coalesce_count_tx = XAXIDMA_DFT_TX_THRESHOLD;
lp->coalesce_usec_tx = XAXIDMA_DFT_TX_USEC;
- /* Reset core now that clocks are enabled, prior to accessing MDIO */
- ret = __axienet_device_reset(lp);
- if (ret)
- goto cleanup_clk;
-
ret = axienet_mdio_setup(lp);
if (ret)
dev_warn(&pdev->dev,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 133/591] ocfs2: Fix use of slab data with sendpage
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 132/591] net: axienet: Move reset before 64-bit DMA detection Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-18 18:26 ` Joel Becker
2023-07-16 19:44 ` [PATCH 6.1 134/591] sfc: fix crash when reading stats while NIC is resetting Greg Kroah-Hartman
` (461 subsequent siblings)
594 siblings, 1 reply; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Mark Fasheh,
Kurt Hackel, Joel Becker, Joseph Qi, ocfs2-devel, Jakub Kicinski,
Sasha Levin
From: David Howells <dhowells@redhat.com>
[ Upstream commit 86d7bd6e66e9925f0f04a7bcf3c92c05fdfefb5a ]
ocfs2 uses kzalloc() to allocate buffers for o2net_hand, o2net_keep_req and
o2net_keep_resp and then passes these to sendpage. This isn't really
allowed as the lifetime of slab objects is not controlled by page ref -
though in this case it will probably work. sendmsg() with MSG_SPLICE_PAGES
will, however, print a warning and give an error.
Fix it to use folio_alloc() instead to allocate a buffer for the handshake
message, keepalive request and reply messages.
Fixes: 98211489d414 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Mark Fasheh <mark@fasheh.com>
cc: Kurt Hackel <kurt.hackel@oracle.com>
cc: Joel Becker <jlbec@evilplan.org>
cc: Joseph Qi <joseph.qi@linux.alibaba.com>
cc: ocfs2-devel@oss.oracle.com
Link: https://lore.kernel.org/r/20230623225513.2732256-14-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/cluster/tcp.c | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 785cabd71d670..4e083e25d0e7d 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -2083,18 +2083,24 @@ void o2net_stop_listening(struct o2nm_node *node)
int o2net_init(void)
{
+ struct folio *folio;
+ void *p;
unsigned long i;
o2quo_init();
-
o2net_debugfs_init();
- o2net_hand = kzalloc(sizeof(struct o2net_handshake), GFP_KERNEL);
- o2net_keep_req = kzalloc(sizeof(struct o2net_msg), GFP_KERNEL);
- o2net_keep_resp = kzalloc(sizeof(struct o2net_msg), GFP_KERNEL);
- if (!o2net_hand || !o2net_keep_req || !o2net_keep_resp)
+ folio = folio_alloc(GFP_KERNEL | __GFP_ZERO, 0);
+ if (!folio)
goto out;
+ p = folio_address(folio);
+ o2net_hand = p;
+ p += sizeof(struct o2net_handshake);
+ o2net_keep_req = p;
+ p += sizeof(struct o2net_msg);
+ o2net_keep_resp = p;
+
o2net_hand->protocol_version = cpu_to_be64(O2NET_PROTOCOL_VERSION);
o2net_hand->connector_id = cpu_to_be64(1);
@@ -2120,9 +2126,6 @@ int o2net_init(void)
return 0;
out:
- kfree(o2net_hand);
- kfree(o2net_keep_req);
- kfree(o2net_keep_resp);
o2net_debugfs_exit();
o2quo_exit();
return -ENOMEM;
@@ -2131,8 +2134,6 @@ int o2net_init(void)
void o2net_exit(void)
{
o2quo_exit();
- kfree(o2net_hand);
- kfree(o2net_keep_req);
- kfree(o2net_keep_resp);
o2net_debugfs_exit();
+ folio_put(virt_to_folio(o2net_hand));
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* Re: [PATCH 6.1 133/591] ocfs2: Fix use of slab data with sendpage
2023-07-16 19:44 ` [PATCH 6.1 133/591] ocfs2: Fix use of slab data with sendpage Greg Kroah-Hartman
@ 2023-07-18 18:26 ` Joel Becker
0 siblings, 0 replies; 604+ messages in thread
From: Joel Becker @ 2023-07-18 18:26 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, David Howells, Mark Fasheh, Kurt Hackel,
Joseph Qi, ocfs2-devel, Jakub Kicinski, Sasha Levin
Noticing this patch only here rather than the original post, sorry.
On Sun, Jul 16, 2023 at 09:44:32PM +0200, Greg Kroah-Hartman wrote:
> From: David Howells <dhowells@redhat.com>
>
...
> [ Upstream commit 86d7bd6e66e9925f0f04a7bcf3c92c05fdfefb5a ]
> - o2net_hand = kzalloc(sizeof(struct o2net_handshake), GFP_KERNEL);
> - o2net_keep_req = kzalloc(sizeof(struct o2net_msg), GFP_KERNEL);
> - o2net_keep_resp = kzalloc(sizeof(struct o2net_msg), GFP_KERNEL);
> - if (!o2net_hand || !o2net_keep_req || !o2net_keep_resp)
> + folio = folio_alloc(GFP_KERNEL | __GFP_ZERO, 0);
> + if (!folio)
> goto out;
>
> + p = folio_address(folio);
> + o2net_hand = p;
> + p += sizeof(struct o2net_handshake);
> + o2net_keep_req = p;
> + p += sizeof(struct o2net_msg);
> + o2net_keep_resp = p;
Do we care that we aren't validating sizes here? The original code
allocates the structures by size. This code grabs an order 0 folio and
assumes the total size of these structures is smaller than a page. But
while we "know" today that the handshake messages have no payload,
`o2net_msg.buf` could theoretically be filled by more data. What if
someone decided to change the code to put some payload in
`o2net_keep_resp.buf`? Yes, we would hope they would think to add the
appropriate allocation. But should we be validating this with some kind
of safety check?
Thanks,
Joel
--
"I almost ran over an angel
He had a nice big fat cigar.
'In a sense,' he said, 'You're alone here
So if you jump, you'd best jump far.'"
http://www.jlbec.org/
jlbec@evilplan.org
^ permalink raw reply [flat|nested] 604+ messages in thread
* [PATCH 6.1 134/591] sfc: fix crash when reading stats while NIC is resetting
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 133/591] ocfs2: Fix use of slab data with sendpage Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 135/591] net: nfc: Fix use-after-free caused by nfc_llcp_find_local Greg Kroah-Hartman
` (460 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pieter Jansen van Vuuren,
Edward Cree, David S. Miller, Sasha Levin
From: Edward Cree <ecree.xilinx@gmail.com>
[ Upstream commit d1b355438b8325a486f087e506d412c4e852f37b ]
efx_net_stats() (.ndo_get_stats64) can be called during an ethtool
selftest, during which time nic_data->mc_stats is NULL as the NIC has
been fini'd. In this case do not attempt to fetch the latest stats
from the hardware, else we will crash on a NULL dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000038
RIP efx_nic_update_stats
abridged calltrace:
efx_ef10_update_stats_pf
efx_net_stats
dev_get_stats
dev_seq_printf_stats
Skipping the read is safe, we will simply give out stale stats.
To ensure that the free in efx_ef10_fini_nic() does not race against
efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the
efx->stats_lock in fini_nic (it is already held across update_stats).
Fixes: d3142c193dca ("sfc: refactor EF10 stats handling")
Reviewed-by: Pieter Jansen van Vuuren <pieter.jansen-van-vuuren@amd.com>
Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sfc/ef10.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index b63e47af63655..8c019f382a7f3 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -1297,8 +1297,10 @@ static void efx_ef10_fini_nic(struct efx_nic *efx)
{
struct efx_ef10_nic_data *nic_data = efx->nic_data;
+ spin_lock_bh(&efx->stats_lock);
kfree(nic_data->mc_stats);
nic_data->mc_stats = NULL;
+ spin_unlock_bh(&efx->stats_lock);
}
static int efx_ef10_init_nic(struct efx_nic *efx)
@@ -1852,9 +1854,14 @@ static size_t efx_ef10_update_stats_pf(struct efx_nic *efx, u64 *full_stats,
efx_ef10_get_stat_mask(efx, mask);
- efx_nic_copy_stats(efx, nic_data->mc_stats);
- efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT,
- mask, stats, nic_data->mc_stats, false);
+ /* If NIC was fini'd (probably resetting), then we can't read
+ * updated stats right now.
+ */
+ if (nic_data->mc_stats) {
+ efx_nic_copy_stats(efx, nic_data->mc_stats);
+ efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT,
+ mask, stats, nic_data->mc_stats, false);
+ }
/* Update derived statistics */
efx_nic_fix_nodesc_drop_stat(efx,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 135/591] net: nfc: Fix use-after-free caused by nfc_llcp_find_local
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 134/591] sfc: fix crash when reading stats while NIC is resetting Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 136/591] lib/ts_bm: reset initial match offset for every block of text Greg Kroah-Hartman
` (459 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin Ma, Simon Horman,
David S. Miller, Sasha Levin
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit 6709d4b7bc2e079241fdef15d1160581c5261c10 ]
This commit fixes several use-after-free that caused by function
nfc_llcp_find_local(). For example, one UAF can happen when below buggy
time window occurs.
// nfc_genl_llc_get_params | // nfc_unregister_device
|
dev = nfc_get_device(idx); | device_lock(...)
if (!dev) | dev->shutting_down = true;
return -ENODEV; | device_unlock(...);
|
device_lock(...); | // nfc_llcp_unregister_device
| nfc_llcp_find_local()
nfc_llcp_find_local(...); |
| local_cleanup()
if (!local) { |
rc = -ENODEV; | // nfc_llcp_local_put
goto exit; | kref_put(.., local_release)
} |
| // local_release
| list_del(&local->list)
// nfc_genl_send_params | kfree()
local->dev->idx !!!UAF!!! |
|
and the crash trace for the one of the discussed UAF like:
BUG: KASAN: slab-use-after-free in nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
Read of size 8 at addr ffff888105b0e410 by task 20114
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:319 [inline]
print_report+0xcc/0x620 mm/kasan/report.c:430
kasan_report+0xb2/0xe0 mm/kasan/report.c:536
nfc_genl_send_params net/nfc/netlink.c:999 [inline]
nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
genl_family_rcv_msg_doit.isra.0+0x1ee/0x2e0 net/netlink/genetlink.c:968
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x503/0x7d0 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x161/0x430 net/netlink/af_netlink.c:2548
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x644/0x900 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x934/0xe70 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0x1b6/0x200 net/socket.c:747
____sys_sendmsg+0x6e9/0x890 net/socket.c:2501
___sys_sendmsg+0x110/0x1b0 net/socket.c:2555
__sys_sendmsg+0xf7/0x1d0 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f34640a2389
RSP: 002b:00007f3463415168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f34641c1f80 RCX: 00007f34640a2389
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006
RBP: 00007f34640ed493 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe38449ecf R14: 00007f3463415300 R15: 0000000000022000
</TASK>
Allocated by task 20116:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:383
kmalloc include/linux/slab.h:580 [inline]
kzalloc include/linux/slab.h:720 [inline]
nfc_llcp_register_device+0x49/0xa40 net/nfc/llcp_core.c:1567
nfc_register_device+0x61/0x260 net/nfc/core.c:1124
nci_register_device+0x776/0xb20 net/nfc/nci/core.c:1257
virtual_ncidev_open+0x147/0x230 drivers/nfc/virtual_ncidev.c:148
misc_open+0x379/0x4a0 drivers/char/misc.c:165
chrdev_open+0x26c/0x780 fs/char_dev.c:414
do_dentry_open+0x6c4/0x12a0 fs/open.c:920
do_open fs/namei.c:3560 [inline]
path_openat+0x24fe/0x37e0 fs/namei.c:3715
do_filp_open+0x1ba/0x410 fs/namei.c:3742
do_sys_openat2+0x171/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x143/0x200 fs/open.c:1383
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Freed by task 20115:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free mm/kasan/common.c:200 [inline]
__kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook mm/slub.c:1807 [inline]
slab_free mm/slub.c:3787 [inline]
__kmem_cache_free+0x7a/0x190 mm/slub.c:3800
local_release net/nfc/llcp_core.c:174 [inline]
kref_put include/linux/kref.h:65 [inline]
nfc_llcp_local_put net/nfc/llcp_core.c:182 [inline]
nfc_llcp_local_put net/nfc/llcp_core.c:177 [inline]
nfc_llcp_unregister_device+0x206/0x290 net/nfc/llcp_core.c:1620
nfc_unregister_device+0x160/0x1d0 net/nfc/core.c:1179
virtual_ncidev_close+0x52/0xa0 drivers/nfc/virtual_ncidev.c:163
__fput+0x252/0xa20 fs/file_table.c:321
task_work_run+0x174/0x270 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x108/0x110 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:297
do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Last potentially related work creation:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
__kasan_record_aux_stack+0x95/0xb0 mm/kasan/generic.c:491
kvfree_call_rcu+0x29/0xa80 kernel/rcu/tree.c:3328
drop_sysctl_table+0x3be/0x4e0 fs/proc/proc_sysctl.c:1735
unregister_sysctl_table.part.0+0x9c/0x190 fs/proc/proc_sysctl.c:1773
unregister_sysctl_table+0x24/0x30 fs/proc/proc_sysctl.c:1753
neigh_sysctl_unregister+0x5f/0x80 net/core/neighbour.c:3895
addrconf_notify+0x140/0x17b0 net/ipv6/addrconf.c:3684
notifier_call_chain+0xbe/0x210 kernel/notifier.c:87
call_netdevice_notifiers_info+0xb5/0x150 net/core/dev.c:1937
call_netdevice_notifiers_extack net/core/dev.c:1975 [inline]
call_netdevice_notifiers net/core/dev.c:1989 [inline]
dev_change_name+0x3c3/0x870 net/core/dev.c:1211
dev_ifsioc+0x800/0xf70 net/core/dev_ioctl.c:376
dev_ioctl+0x3d9/0xf80 net/core/dev_ioctl.c:542
sock_do_ioctl+0x160/0x260 net/socket.c:1213
sock_ioctl+0x3f9/0x670 net/socket.c:1316
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x19e/0x210 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
The buggy address belongs to the object at ffff888105b0e400
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 16 bytes inside of
freed 1024-byte region [ffff888105b0e400, ffff888105b0e800)
The buggy address belongs to the physical page:
head:ffffea000416c200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000010200(slab|head|node=0|zone=2)
raw: 0200000000010200 ffff8881000430c0 ffffea00044c7010 ffffea0004510e10
raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888105b0e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888105b0e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888105b0e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888105b0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888105b0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
In summary, this patch solves those use-after-free by
1. Re-implement the nfc_llcp_find_local(). The current version does not
grab the reference when getting the local from the linked list. For
example, the llcp_sock_bind() gets the reference like below:
// llcp_sock_bind()
local = nfc_llcp_find_local(dev); // A
..... \
| raceable
..... /
llcp_sock->local = nfc_llcp_local_get(local); // B
There is an apparent race window that one can drop the reference
and free the local object fetched in (A) before (B) gets the reference.
2. Some callers of the nfc_llcp_find_local() do not grab the reference
at all. For example, the nfc_genl_llc_{{get/set}_params/sdreq} functions.
We add the nfc_llcp_local_put() for them. Moreover, we add the necessary
error handling function to put the reference.
3. Add the nfc_llcp_remove_local() helper. The local object is removed
from the linked list in local_release() when all reference is gone. This
patch removes it when nfc_llcp_unregister_device() is called.
Therefore, every caller of nfc_llcp_find_local() will get a reference
even when the nfc_llcp_unregister_device() is called. This promises no
use-after-free for the local object is ever possible.
Fixes: 52feb444a903 ("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support")
Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/llcp.h | 1 -
net/nfc/llcp_commands.c | 12 +++++++---
net/nfc/llcp_core.c | 49 +++++++++++++++++++++++++++++++++++------
net/nfc/llcp_sock.c | 18 ++++++++-------
net/nfc/netlink.c | 20 ++++++++++++-----
net/nfc/nfc.h | 1 +
6 files changed, 77 insertions(+), 24 deletions(-)
diff --git a/net/nfc/llcp.h b/net/nfc/llcp.h
index c1d9be636933c..d8345ed57c954 100644
--- a/net/nfc/llcp.h
+++ b/net/nfc/llcp.h
@@ -201,7 +201,6 @@ void nfc_llcp_sock_link(struct llcp_sock_list *l, struct sock *s);
void nfc_llcp_sock_unlink(struct llcp_sock_list *l, struct sock *s);
void nfc_llcp_socket_remote_param_init(struct nfc_llcp_sock *sock);
struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev);
-struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local);
int nfc_llcp_local_put(struct nfc_llcp_local *local);
u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
struct nfc_llcp_sock *sock);
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index cdb001de06928..e2680a3bef799 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -359,6 +359,7 @@ int nfc_llcp_send_symm(struct nfc_dev *dev)
struct sk_buff *skb;
struct nfc_llcp_local *local;
u16 size = 0;
+ int err;
local = nfc_llcp_find_local(dev);
if (local == NULL)
@@ -368,8 +369,10 @@ int nfc_llcp_send_symm(struct nfc_dev *dev)
size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;
skb = alloc_skb(size, GFP_KERNEL);
- if (skb == NULL)
- return -ENOMEM;
+ if (skb == NULL) {
+ err = -ENOMEM;
+ goto out;
+ }
skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
@@ -379,8 +382,11 @@ int nfc_llcp_send_symm(struct nfc_dev *dev)
nfc_llcp_send_to_raw_sock(local, skb, NFC_DIRECTION_TX);
- return nfc_data_exchange(dev, local->target_idx, skb,
+ err = nfc_data_exchange(dev, local->target_idx, skb,
nfc_llcp_recv, local);
+out:
+ nfc_llcp_local_put(local);
+ return err;
}
int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index a27e1842b2a09..f60e424e06076 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -17,6 +17,8 @@
static u8 llcp_magic[3] = {0x46, 0x66, 0x6d};
static LIST_HEAD(llcp_devices);
+/* Protects llcp_devices list */
+static DEFINE_SPINLOCK(llcp_devices_lock);
static void nfc_llcp_rx_skb(struct nfc_llcp_local *local, struct sk_buff *skb);
@@ -141,7 +143,7 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool device,
write_unlock(&local->raw_sockets.lock);
}
-struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
+static struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
{
kref_get(&local->ref);
@@ -169,7 +171,6 @@ static void local_release(struct kref *ref)
local = container_of(ref, struct nfc_llcp_local, ref);
- list_del(&local->list);
local_cleanup(local);
kfree(local);
}
@@ -282,12 +283,33 @@ static void nfc_llcp_sdreq_timer(struct timer_list *t)
struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev)
{
struct nfc_llcp_local *local;
+ struct nfc_llcp_local *res = NULL;
+ spin_lock(&llcp_devices_lock);
list_for_each_entry(local, &llcp_devices, list)
- if (local->dev == dev)
+ if (local->dev == dev) {
+ res = nfc_llcp_local_get(local);
+ break;
+ }
+ spin_unlock(&llcp_devices_lock);
+
+ return res;
+}
+
+static struct nfc_llcp_local *nfc_llcp_remove_local(struct nfc_dev *dev)
+{
+ struct nfc_llcp_local *local, *tmp;
+
+ spin_lock(&llcp_devices_lock);
+ list_for_each_entry_safe(local, tmp, &llcp_devices, list)
+ if (local->dev == dev) {
+ list_del(&local->list);
+ spin_unlock(&llcp_devices_lock);
return local;
+ }
+ spin_unlock(&llcp_devices_lock);
- pr_debug("No device found\n");
+ pr_warn("Shutting down device not found\n");
return NULL;
}
@@ -608,12 +630,15 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
*general_bytes_len = local->gb_len;
+ nfc_llcp_local_put(local);
+
return local->gb;
}
int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
{
struct nfc_llcp_local *local;
+ int err;
if (gb_len < 3 || gb_len > NFC_MAX_GT_LEN)
return -EINVAL;
@@ -630,12 +655,16 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
if (memcmp(local->remote_gb, llcp_magic, 3)) {
pr_err("MAC does not support LLCP\n");
- return -EINVAL;
+ err = -EINVAL;
+ goto out;
}
- return nfc_llcp_parse_gb_tlv(local,
+ err = nfc_llcp_parse_gb_tlv(local,
&local->remote_gb[3],
local->remote_gb_len - 3);
+out:
+ nfc_llcp_local_put(local);
+ return err;
}
static u8 nfc_llcp_dsap(const struct sk_buff *pdu)
@@ -1517,6 +1546,8 @@ int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb)
__nfc_llcp_recv(local, skb);
+ nfc_llcp_local_put(local);
+
return 0;
}
@@ -1533,6 +1564,8 @@ void nfc_llcp_mac_is_down(struct nfc_dev *dev)
/* Close and purge all existing sockets */
nfc_llcp_socket_release(local, true, 0);
+
+ nfc_llcp_local_put(local);
}
void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
@@ -1558,6 +1591,8 @@ void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
mod_timer(&local->link_timer,
jiffies + msecs_to_jiffies(local->remote_lto));
}
+
+ nfc_llcp_local_put(local);
}
int nfc_llcp_register_device(struct nfc_dev *ndev)
@@ -1608,7 +1643,7 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
void nfc_llcp_unregister_device(struct nfc_dev *dev)
{
- struct nfc_llcp_local *local = nfc_llcp_find_local(dev);
+ struct nfc_llcp_local *local = nfc_llcp_remove_local(dev);
if (local == NULL) {
pr_debug("No such device\n");
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 77642d18a3b43..645677f84dba2 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -99,7 +99,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
}
llcp_sock->dev = dev;
- llcp_sock->local = nfc_llcp_local_get(local);
+ llcp_sock->local = local;
llcp_sock->nfc_protocol = llcp_addr.nfc_protocol;
llcp_sock->service_name_len = min_t(unsigned int,
llcp_addr.service_name_len,
@@ -186,7 +186,7 @@ static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr *addr,
}
llcp_sock->dev = dev;
- llcp_sock->local = nfc_llcp_local_get(local);
+ llcp_sock->local = local;
llcp_sock->nfc_protocol = llcp_addr.nfc_protocol;
nfc_llcp_sock_link(&local->raw_sockets, sk);
@@ -696,22 +696,22 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
if (dev->dep_link_up == false) {
ret = -ENOLINK;
device_unlock(&dev->dev);
- goto put_dev;
+ goto sock_llcp_put_local;
}
device_unlock(&dev->dev);
if (local->rf_mode == NFC_RF_INITIATOR &&
addr->target_idx != local->target_idx) {
ret = -ENOLINK;
- goto put_dev;
+ goto sock_llcp_put_local;
}
llcp_sock->dev = dev;
- llcp_sock->local = nfc_llcp_local_get(local);
+ llcp_sock->local = local;
llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
if (llcp_sock->ssap == LLCP_SAP_MAX) {
ret = -ENOMEM;
- goto sock_llcp_put_local;
+ goto sock_llcp_nullify;
}
llcp_sock->reserved_ssap = llcp_sock->ssap;
@@ -757,11 +757,13 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
sock_llcp_release:
nfc_llcp_put_ssap(local, llcp_sock->ssap);
-sock_llcp_put_local:
- nfc_llcp_local_put(llcp_sock->local);
+sock_llcp_nullify:
llcp_sock->local = NULL;
llcp_sock->dev = NULL;
+sock_llcp_put_local:
+ nfc_llcp_local_put(local);
+
put_dev:
nfc_put_device(dev);
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index b9264e730fd93..e9ac6a6f934e7 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1039,11 +1039,14 @@ static int nfc_genl_llc_get_params(struct sk_buff *skb, struct genl_info *info)
msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
if (!msg) {
rc = -ENOMEM;
- goto exit;
+ goto put_local;
}
rc = nfc_genl_send_params(msg, local, info->snd_portid, info->snd_seq);
+put_local:
+ nfc_llcp_local_put(local);
+
exit:
device_unlock(&dev->dev);
@@ -1105,7 +1108,7 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info)
if (info->attrs[NFC_ATTR_LLC_PARAM_LTO]) {
if (dev->dep_link_up) {
rc = -EINPROGRESS;
- goto exit;
+ goto put_local;
}
local->lto = nla_get_u8(info->attrs[NFC_ATTR_LLC_PARAM_LTO]);
@@ -1117,6 +1120,9 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info)
if (info->attrs[NFC_ATTR_LLC_PARAM_MIUX])
local->miux = cpu_to_be16(miux);
+put_local:
+ nfc_llcp_local_put(local);
+
exit:
device_unlock(&dev->dev);
@@ -1172,7 +1178,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
if (rc != 0) {
rc = -EINVAL;
- goto exit;
+ goto put_local;
}
if (!sdp_attrs[NFC_SDP_ATTR_URI])
@@ -1191,7 +1197,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
sdreq = nfc_llcp_build_sdreq_tlv(tid, uri, uri_len);
if (sdreq == NULL) {
rc = -ENOMEM;
- goto exit;
+ goto put_local;
}
tlvs_len += sdreq->tlv_len;
@@ -1201,10 +1207,14 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
if (hlist_empty(&sdreq_list)) {
rc = -EINVAL;
- goto exit;
+ goto put_local;
}
rc = nfc_llcp_send_snl_sdreq(local, &sdreq_list, tlvs_len);
+
+put_local:
+ nfc_llcp_local_put(local);
+
exit:
device_unlock(&dev->dev);
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index de2ec66d7e83a..0b1e6466f4fbf 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -52,6 +52,7 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len);
u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len);
int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb);
struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev);
+int nfc_llcp_local_put(struct nfc_llcp_local *local);
int __init nfc_llcp_init(void);
void nfc_llcp_exit(void);
void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 136/591] lib/ts_bm: reset initial match offset for every block of text
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 135/591] net: nfc: Fix use-after-free caused by nfc_llcp_find_local Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 137/591] netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Greg Kroah-Hartman
` (458 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeremy Sowden, Pablo Neira Ayuso,
Sasha Levin
From: Jeremy Sowden <jeremy@azazel.net>
[ Upstream commit 6f67fbf8192da80c4db01a1800c7fceaca9cf1f9 ]
The `shift` variable which indicates the offset in the string at which
to start matching the pattern is initialized to `bm->patlen - 1`, but it
is not reset when a new block is retrieved. This means the implemen-
tation may start looking at later and later positions in each successive
block and miss occurrences of the pattern at the beginning. E.g.,
consider a HTTP packet held in a non-linear skb, where the HTTP request
line occurs in the second block:
[... 52 bytes of packet headers ...]
GET /bmtest HTTP/1.1\r\nHost: www.example.com\r\n\r\n
and the pattern is "GET /bmtest".
Once the first block comprising the packet headers has been examined,
`shift` will be pointing to somewhere near the end of the block, and so
when the second block is examined the request line at the beginning will
be missed.
Reinitialize the variable for each new block.
Fixes: 8082e4ed0a61 ("[LIB]: Boyer-Moore extension for textsearch infrastructure strike #2")
Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1390
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/ts_bm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/ts_bm.c b/lib/ts_bm.c
index 1f2234221dd11..c8ecbf74ef295 100644
--- a/lib/ts_bm.c
+++ b/lib/ts_bm.c
@@ -60,10 +60,12 @@ static unsigned int bm_find(struct ts_config *conf, struct ts_state *state)
struct ts_bm *bm = ts_config_priv(conf);
unsigned int i, text_len, consumed = state->offset;
const u8 *text;
- int shift = bm->patlen - 1, bs;
+ int bs;
const u8 icase = conf->flags & TS_IGNORECASE;
for (;;) {
+ int shift = bm->patlen - 1;
+
text_len = conf->get_next_block(consumed, &text, conf, state);
if (unlikely(text_len == 0))
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 137/591] netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 136/591] lib/ts_bm: reset initial match offset for every block of text Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 138/591] netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value Greg Kroah-Hartman
` (457 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Florian Westphal,
Pablo Neira Ayuso, Sasha Levin
From: Florian Westphal <fw@strlen.de>
[ Upstream commit ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30 ]
Eric Dumazet says:
nf_conntrack_dccp_packet() has an unique:
dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
And nothing more is 'pulled' from the packet, depending on the content.
dh->dccph_doff, and/or dh->dccph_x ...)
So dccp_ack_seq() is happily reading stuff past the _dh buffer.
BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0
Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371
[..]
Fix this by increasing the stack buffer to also include room for
the extra sequence numbers and all the known dccp packet type headers,
then pull again after the initial validation of the basic header.
While at it, mark packets invalid that lack 48bit sequence bit but
where RFC says the type MUST use them.
Compile tested only.
v2: first skb_header_pointer() now needs to adjust the size to
only pull the generic header. (Eric)
Heads-up: I intend to remove dccp conntrack support later this year.
Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support")
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_proto_dccp.c | 52 +++++++++++++++++++++++--
1 file changed, 49 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index c1557d47ccd1e..d4fd626d2b8c3 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -432,9 +432,19 @@ static bool dccp_error(const struct dccp_hdr *dh,
struct sk_buff *skb, unsigned int dataoff,
const struct nf_hook_state *state)
{
+ static const unsigned long require_seq48 = 1 << DCCP_PKT_REQUEST |
+ 1 << DCCP_PKT_RESPONSE |
+ 1 << DCCP_PKT_CLOSEREQ |
+ 1 << DCCP_PKT_CLOSE |
+ 1 << DCCP_PKT_RESET |
+ 1 << DCCP_PKT_SYNC |
+ 1 << DCCP_PKT_SYNCACK;
unsigned int dccp_len = skb->len - dataoff;
unsigned int cscov;
const char *msg;
+ u8 type;
+
+ BUILD_BUG_ON(DCCP_PKT_INVALID >= BITS_PER_LONG);
if (dh->dccph_doff * 4 < sizeof(struct dccp_hdr) ||
dh->dccph_doff * 4 > dccp_len) {
@@ -459,34 +469,70 @@ static bool dccp_error(const struct dccp_hdr *dh,
goto out_invalid;
}
- if (dh->dccph_type >= DCCP_PKT_INVALID) {
+ type = dh->dccph_type;
+ if (type >= DCCP_PKT_INVALID) {
msg = "nf_ct_dccp: reserved packet type ";
goto out_invalid;
}
+
+ if (test_bit(type, &require_seq48) && !dh->dccph_x) {
+ msg = "nf_ct_dccp: type lacks 48bit sequence numbers";
+ goto out_invalid;
+ }
+
return false;
out_invalid:
nf_l4proto_log_invalid(skb, state, IPPROTO_DCCP, "%s", msg);
return true;
}
+struct nf_conntrack_dccp_buf {
+ struct dccp_hdr dh; /* generic header part */
+ struct dccp_hdr_ext ext; /* optional depending dh->dccph_x */
+ union { /* depends on header type */
+ struct dccp_hdr_ack_bits ack;
+ struct dccp_hdr_request req;
+ struct dccp_hdr_response response;
+ struct dccp_hdr_reset rst;
+ } u;
+};
+
+static struct dccp_hdr *
+dccp_header_pointer(const struct sk_buff *skb, int offset, const struct dccp_hdr *dh,
+ struct nf_conntrack_dccp_buf *buf)
+{
+ unsigned int hdrlen = __dccp_hdr_len(dh);
+
+ if (hdrlen > sizeof(*buf))
+ return NULL;
+
+ return skb_header_pointer(skb, offset, hdrlen, buf);
+}
+
int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb,
unsigned int dataoff,
enum ip_conntrack_info ctinfo,
const struct nf_hook_state *state)
{
enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
- struct dccp_hdr _dh, *dh;
+ struct nf_conntrack_dccp_buf _dh;
u_int8_t type, old_state, new_state;
enum ct_dccp_roles role;
unsigned int *timeouts;
+ struct dccp_hdr *dh;
- dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
+ dh = skb_header_pointer(skb, dataoff, sizeof(*dh), &_dh.dh);
if (!dh)
return NF_DROP;
if (dccp_error(dh, skb, dataoff, state))
return -NF_ACCEPT;
+ /* pull again, including possible 48 bit sequences and subtype header */
+ dh = dccp_header_pointer(skb, dataoff, dh, &_dh);
+ if (!dh)
+ return NF_DROP;
+
type = dh->dccph_type;
if (!nf_ct_is_confirmed(ct) && !dccp_new(ct, skb, dh, state))
return -NF_ACCEPT;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 138/591] netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 137/591] netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 139/591] ipvlan: Fix return value of ipvlan_queue_xmit() Greg Kroah-Hartman
` (456 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilia.Gavrilov, Simon Horman,
Florian Westphal, Pablo Neira Ayuso, Sasha Levin
From: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>
[ Upstream commit f188d30087480eab421cd8ca552fb15f55d57f4d ]
ct_sip_parse_numerical_param() returns only 0 or 1 now.
But process_register_request() and process_register_response() imply
checking for a negative value if parsing of a numerical header parameter
failed.
The invocation in nf_nat_sip() looks correct:
if (ct_sip_parse_numerical_param(...) > 0 &&
...) { ... }
Make the return value of the function ct_sip_parse_numerical_param()
a tristate to fix all the cases
a) return 1 if value is found; *val is set
b) return 0 if value is not found; *val is unchanged
c) return -1 on error; *val is undefined
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
Fixes: 0f32a40fc91a ("[NETFILTER]: nf_conntrack_sip: create signalling expectations")
Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_sip.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 77f5e82d8e3fe..d0eac27f6ba03 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -611,7 +611,7 @@ int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr,
start += strlen(name);
*val = simple_strtoul(start, &end, 0);
if (start == end)
- return 0;
+ return -1;
if (matchoff && matchlen) {
*matchoff = start - dptr;
*matchlen = end - start;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 139/591] ipvlan: Fix return value of ipvlan_queue_xmit()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 138/591] netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 140/591] netlink: Add __sock_i_ino() for __netlink_diag_dump() Greg Kroah-Hartman
` (455 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cambda Zhu, Paolo Abeni, Sasha Levin
From: Cambda Zhu <cambda@linux.alibaba.com>
[ Upstream commit 8a9922e7be6d042fa00f894c376473b17a162b66 ]
ipvlan_queue_xmit() should return NET_XMIT_XXX, but
ipvlan_xmit_mode_l2/l3() returns rx_handler_result_t or NET_RX_XXX
in some cases. ipvlan_rcv_frame() will only return RX_HANDLER_CONSUMED
in ipvlan_xmit_mode_l2/l3() because 'local' is true. It's equal to
NET_XMIT_SUCCESS. But dev_forward_skb() can return NET_RX_SUCCESS or
NET_RX_DROP, and returning NET_RX_DROP(NET_XMIT_DROP) will increase
both ipvlan and ipvlan->phy_dev drops counter.
The skb to forward can be treated as xmitted successfully. This patch
makes ipvlan_queue_xmit() return NET_XMIT_SUCCESS for forward skb.
Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Cambda Zhu <cambda@linux.alibaba.com>
Link: https://lore.kernel.org/r/20230626093347.7492-1-cambda@linux.alibaba.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ipvlan/ipvlan_core.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 2de3bd3b0c278..59e29e08398a0 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -585,7 +585,8 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
consume_skb(skb);
return NET_XMIT_DROP;
}
- return ipvlan_rcv_frame(addr, &skb, true);
+ ipvlan_rcv_frame(addr, &skb, true);
+ return NET_XMIT_SUCCESS;
}
}
out:
@@ -611,7 +612,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
consume_skb(skb);
return NET_XMIT_DROP;
}
- return ipvlan_rcv_frame(addr, &skb, true);
+ ipvlan_rcv_frame(addr, &skb, true);
+ return NET_XMIT_SUCCESS;
}
}
skb = skb_share_check(skb, GFP_ATOMIC);
@@ -623,7 +625,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
* the skb for the main-dev. At the RX side we just return
* RX_PASS for it to be processed further on the stack.
*/
- return dev_forward_skb(ipvlan->phy_dev, skb);
+ dev_forward_skb(ipvlan->phy_dev, skb);
+ return NET_XMIT_SUCCESS;
} else if (is_multicast_ether_addr(eth->h_dest)) {
skb_reset_mac_header(skb);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 140/591] netlink: Add __sock_i_ino() for __netlink_diag_dump().
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 139/591] ipvlan: Fix return value of ipvlan_queue_xmit() Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 141/591] drm/amd/display: Add logging for display MALL refresh setting Greg Kroah-Hartman
` (454 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5da61cf6a9bc1902d422,
Eric Dumazet, Kuniyuki Iwashima, Jakub Kicinski, Sasha Levin
From: Kuniyuki Iwashima <kuniyu@amazon.com>
[ Upstream commit 25a9c8a4431c364f97f75558cb346d2ad3f53fbb ]
syzbot reported a warning in __local_bh_enable_ip(). [0]
Commit 8d61f926d420 ("netlink: fix potential deadlock in
netlink_set_err()") converted read_lock(&nl_table_lock) to
read_lock_irqsave() in __netlink_diag_dump() to prevent a deadlock.
However, __netlink_diag_dump() calls sock_i_ino() that uses
read_lock_bh() and read_unlock_bh(). If CONFIG_TRACE_IRQFLAGS=y,
read_unlock_bh() finally enables IRQ even though it should stay
disabled until the following read_unlock_irqrestore().
Using read_lock() in sock_i_ino() would trigger a lockdep splat
in another place that was fixed in commit f064af1e500a ("net: fix
a lockdep splat"), so let's add __sock_i_ino() that would be safe
to use under BH disabled.
[0]:
WARNING: CPU: 0 PID: 5012 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
Modules linked in:
CPU: 0 PID: 5012 Comm: syz-executor487 Not tainted 6.4.0-rc7-syzkaller-00202-g6f68fc395f49 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
Code: 45 bf 01 00 00 00 e8 91 5b 0a 00 e8 3c 15 3d 00 fb 65 8b 05 ec e9 b5 7e 85 c0 74 58 5b 5d c3 65 8b 05 b2 b6 b4 7e 85 c0 75 a2 <0f> 0b eb 9e e8 89 15 3d 00 eb 9f 48 89 ef e8 6f 49 18 00 eb a8 0f
RSP: 0018:ffffc90003a1f3d0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000201 RCX: 1ffffffff1cf5996
RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff8805c6f3
RBP: ffffffff8805c6f3 R08: 0000000000000001 R09: ffff8880152b03a3
R10: ffffed1002a56074 R11: 0000000000000005 R12: 00000000000073e4
R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000
FS: 0000555556726300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000045ad50 CR3: 000000007c646000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
sock_i_ino+0x83/0xa0 net/core/sock.c:2559
__netlink_diag_dump+0x45c/0x790 net/netlink/diag.c:171
netlink_diag_dump+0xd6/0x230 net/netlink/diag.c:207
netlink_dump+0x570/0xc50 net/netlink/af_netlink.c:2269
__netlink_dump_start+0x64b/0x910 net/netlink/af_netlink.c:2374
netlink_dump_start include/linux/netlink.h:329 [inline]
netlink_diag_handler_dump+0x1ae/0x250 net/netlink/diag.c:238
__sock_diag_cmd net/core/sock_diag.c:238 [inline]
sock_diag_rcv_msg+0x31e/0x440 net/core/sock_diag.c:269
netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2547
sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1914
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0xde/0x190 net/socket.c:747
____sys_sendmsg+0x71c/0x900 net/socket.c:2503
___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
__sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5303aaabb9
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc7506e548 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5303aaabb9
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003
RBP: 00007f5303a6ed60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5303a6edf0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Fixes: 8d61f926d420 ("netlink: fix potential deadlock in netlink_set_err()")
Reported-by: syzbot+5da61cf6a9bc1902d422@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=5da61cf6a9bc1902d422
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20230626164313.52528-1-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sock.h | 1 +
net/core/sock.c | 17 ++++++++++++++---
net/netlink/diag.c | 2 +-
3 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index 2f35b82a123f8..1bbdddcf61542 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2124,6 +2124,7 @@ static inline void sock_graft(struct sock *sk, struct socket *parent)
}
kuid_t sock_i_uid(struct sock *sk);
+unsigned long __sock_i_ino(struct sock *sk);
unsigned long sock_i_ino(struct sock *sk);
static inline kuid_t sock_net_uid(const struct net *net, const struct sock *sk)
diff --git a/net/core/sock.c b/net/core/sock.c
index b021cb9c95ef3..0c1baa5517f11 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2542,13 +2542,24 @@ kuid_t sock_i_uid(struct sock *sk)
}
EXPORT_SYMBOL(sock_i_uid);
-unsigned long sock_i_ino(struct sock *sk)
+unsigned long __sock_i_ino(struct sock *sk)
{
unsigned long ino;
- read_lock_bh(&sk->sk_callback_lock);
+ read_lock(&sk->sk_callback_lock);
ino = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_ino : 0;
- read_unlock_bh(&sk->sk_callback_lock);
+ read_unlock(&sk->sk_callback_lock);
+ return ino;
+}
+EXPORT_SYMBOL(__sock_i_ino);
+
+unsigned long sock_i_ino(struct sock *sk)
+{
+ unsigned long ino;
+
+ local_bh_disable();
+ ino = __sock_i_ino(sk);
+ local_bh_enable();
return ino;
}
EXPORT_SYMBOL(sock_i_ino);
diff --git a/net/netlink/diag.c b/net/netlink/diag.c
index 4143b2ea4195a..e4f21b1067bcc 100644
--- a/net/netlink/diag.c
+++ b/net/netlink/diag.c
@@ -168,7 +168,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
NETLINK_CB(cb->skb).portid,
cb->nlh->nlmsg_seq,
NLM_F_MULTI,
- sock_i_ino(sk)) < 0) {
+ __sock_i_ino(sk)) < 0) {
ret = 1;
break;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 141/591] drm/amd/display: Add logging for display MALL refresh setting
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 140/591] netlink: Add __sock_i_ino() for __netlink_diag_dump() Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 142/591] radeon: avoid double free in ci_dpm_init() Greg Kroah-Hartman
` (453 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wesley Chalmers, Aurabindo Pillai,
Daniel Wheeler, Alex Deucher, Sasha Levin
From: Wesley Chalmers <Wesley.Chalmers@amd.com>
[ Upstream commit cd8f067a46d34dee3188da184912ae3d64d98444 ]
[WHY]
Add log entry for when display refresh from MALL
settings are sent to SMU.
Fixes: 1664641ea946 ("drm/amd/display: Add logger for SMU msg")
Signed-off-by: Wesley Chalmers <Wesley.Chalmers@amd.com>
Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c
index 1fbf1c105dc12..bdbf183066981 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c
@@ -312,6 +312,9 @@ void dcn30_smu_set_display_refresh_from_mall(struct clk_mgr_internal *clk_mgr, b
/* bits 8:7 for cache timer scale, bits 6:1 for cache timer delay, bit 0 = 1 for enable, = 0 for disable */
uint32_t param = (cache_timer_scale << 7) | (cache_timer_delay << 1) | (enable ? 1 : 0);
+ smu_print("SMU Set display refresh from mall: enable = %d, cache_timer_delay = %d, cache_timer_scale = %d\n",
+ enable, cache_timer_delay, cache_timer_scale);
+
dcn30_smu_send_msg_with_param(clk_mgr,
DALSMC_MSG_SetDisplayRefreshFromMall, param, NULL);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 142/591] radeon: avoid double free in ci_dpm_init()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 141/591] drm/amd/display: Add logging for display MALL refresh setting Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 143/591] drm/amd/display: Explicitly specify update type per plane info change Greg Kroah-Hartman
` (452 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich, Alex Deucher,
Sasha Levin, Natalia Petrova
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit 20c3dffdccbd494e0dd631d1660aeecbff6775f2 ]
Several calls to ci_dpm_fini() will attempt to free resources that
either have been freed before or haven't been allocated yet. This
may lead to undefined or dangerous behaviour.
For instance, if r600_parse_extended_power_table() fails, it might
call r600_free_extended_power_table() as will ci_dpm_fini() later
during error handling.
Fix this by only freeing pointers to objects previously allocated.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: cc8dbbb4f62a ("drm/radeon: add dpm support for CI dGPUs (v2)")
Co-developed-by: Natalia Petrova <n.petrova@fintech.ru>
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/ci_dpm.c | 28 ++++++++++++++++++++--------
1 file changed, 20 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 8ef25ab305ae7..b8f4dac68d850 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -5517,6 +5517,7 @@ static int ci_parse_power_table(struct radeon_device *rdev)
u8 frev, crev;
u8 *power_state_offset;
struct ci_ps *ps;
+ int ret;
if (!atom_parse_data_header(mode_info->atom_context, index, NULL,
&frev, &crev, &data_offset))
@@ -5546,11 +5547,15 @@ static int ci_parse_power_table(struct radeon_device *rdev)
non_clock_array_index = power_state->v2.nonClockInfoIndex;
non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
&non_clock_info_array->nonClockInfo[non_clock_array_index];
- if (!rdev->pm.power_state[i].clock_info)
- return -EINVAL;
+ if (!rdev->pm.power_state[i].clock_info) {
+ ret = -EINVAL;
+ goto err_free_ps;
+ }
ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL);
- if (ps == NULL)
- return -ENOMEM;
+ if (ps == NULL) {
+ ret = -ENOMEM;
+ goto err_free_ps;
+ }
rdev->pm.dpm.ps[i].ps_priv = ps;
ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i],
non_clock_info,
@@ -5590,6 +5595,12 @@ static int ci_parse_power_table(struct radeon_device *rdev)
}
return 0;
+
+err_free_ps:
+ for (i = 0; i < rdev->pm.dpm.num_ps; i++)
+ kfree(rdev->pm.dpm.ps[i].ps_priv);
+ kfree(rdev->pm.dpm.ps);
+ return ret;
}
static int ci_get_vbios_boot_values(struct radeon_device *rdev,
@@ -5678,25 +5689,26 @@ int ci_dpm_init(struct radeon_device *rdev)
ret = ci_get_vbios_boot_values(rdev, &pi->vbios_boot_state);
if (ret) {
- ci_dpm_fini(rdev);
+ kfree(rdev->pm.dpm.priv);
return ret;
}
ret = r600_get_platform_caps(rdev);
if (ret) {
- ci_dpm_fini(rdev);
+ kfree(rdev->pm.dpm.priv);
return ret;
}
ret = r600_parse_extended_power_table(rdev);
if (ret) {
- ci_dpm_fini(rdev);
+ kfree(rdev->pm.dpm.priv);
return ret;
}
ret = ci_parse_power_table(rdev);
if (ret) {
- ci_dpm_fini(rdev);
+ kfree(rdev->pm.dpm.priv);
+ r600_free_extended_power_table(rdev);
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 143/591] drm/amd/display: Explicitly specify update type per plane info change
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 142/591] radeon: avoid double free in ci_dpm_init() Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 144/591] drm/bridge: it6505: Move a variable assignment behind a null pointer check in receive_timing_debugfs_show() Greg Kroah-Hartman
` (451 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rodrigo Siqueira,
Nicholas Kazlauskas, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
[ Upstream commit 710cc1e7cd461446a9325c9bd1e9a54daa462952 ]
[Why]
The bit for flip addr is being set causing the determination for
FAST vs MEDIUM to always return MEDIUM when plane info is provided
as a surface update. This causes extreme stuttering for the typical
atomic update path on Linux.
[How]
Don't use update_flags->raw for determining FAST vs MEDIUM. It's too
fragile to changes like this.
Explicitly specify the update type per update flag instead. It's not
as clever as checking the bits itself but at least it's correct.
Fixes: aa5fdb1ab5b6 ("drm/amd/display: Explicitly specify update type per plane info change")
Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 087a4838488b2..b405f2e86927d 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -2360,9 +2360,6 @@ static enum surface_update_type det_surface_update(const struct dc *dc,
enum surface_update_type overall_type = UPDATE_TYPE_FAST;
union surface_update_flags *update_flags = &u->surface->update_flags;
- if (u->flip_addr)
- update_flags->bits.addr_update = 1;
-
if (!is_surface_in_context(context, u->surface) || u->surface->force_full_update) {
update_flags->raw = 0xFFFFFFFF;
return UPDATE_TYPE_FULL;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 144/591] drm/bridge: it6505: Move a variable assignment behind a null pointer check in receive_timing_debugfs_show()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 143/591] drm/amd/display: Explicitly specify update type per plane info change Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 145/591] Input: drv260x - sleep between polling GO bit Greg Kroah-Hartman
` (450 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Markus Elfring, Robert Foss,
Sasha Levin
From: Markus Elfring <elfring@users.sourceforge.net>
[ Upstream commit 0be05a75de2916421e88e0d64b001984f54df0bd ]
The address of a data structure member was determined before
a corresponding null pointer check in the implementation of
the function “receive_timing_debugfs_show”.
Thus avoid the risk for undefined behaviour by moving the assignment
for the variable “vid” behind the null pointer check.
This issue was detected by using the Coccinelle software.
Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Link: https://patchwork.freedesktop.org/patch/msgid/fa69384f-1485-142b-c4ee-3df54ac68a89@web.de
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ite-it6505.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index 99123eec45511..292c4f6da04af 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -3085,7 +3085,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf,
size_t len, loff_t *ppos)
{
struct it6505 *it6505 = file->private_data;
- struct drm_display_mode *vid = &it6505->video_info;
+ struct drm_display_mode *vid;
u8 read_buf[READ_BUFFER_SIZE];
u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE;
ssize_t ret, count;
@@ -3094,6 +3094,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf,
return -ENODEV;
it6505_calc_video_info(it6505);
+ vid = &it6505->video_info;
str += scnprintf(str, end - str, "---video timing---\n");
str += scnprintf(str, end - str, "PCLK:%d.%03dMHz\n",
vid->clock / 1000, vid->clock % 1000);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 145/591] Input: drv260x - sleep between polling GO bit
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 144/591] drm/bridge: it6505: Move a variable assignment behind a null pointer check in receive_timing_debugfs_show() Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 146/591] drm/bridge: ti-sn65dsi83: Fix enable error path Greg Kroah-Hartman
` (449 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Dmitry Torokhov,
Sasha Levin
From: Luca Weiss <luca@z3ntu.xyz>
[ Upstream commit efef661dfa6bf8cbafe4cd6a97433fcef0118967 ]
When doing the initial startup there's no need to poll without any
delay and spam the I2C bus.
Let's sleep 15ms between each attempt, which is the same time as used
in the vendor driver.
Fixes: 7132fe4f5687 ("Input: drv260x - add TI drv260x haptics driver")
Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
Link: https://lore.kernel.org/r/20230430-drv260x-improvements-v1-2-1fb28b4cc698@z3ntu.xyz
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/drv260x.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c
index 0efe56f49aa94..1923924fdd444 100644
--- a/drivers/input/misc/drv260x.c
+++ b/drivers/input/misc/drv260x.c
@@ -435,6 +435,7 @@ static int drv260x_init(struct drv260x_data *haptics)
}
do {
+ usleep_range(15000, 15500);
error = regmap_read(haptics->regmap, DRV260X_GO, &cal_buf);
if (error) {
dev_err(&haptics->client->dev,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 146/591] drm/bridge: ti-sn65dsi83: Fix enable error path
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 145/591] Input: drv260x - sleep between polling GO bit Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 147/591] drm/bridge: tc358768: always enable HS video mode Greg Kroah-Hartman
` (448 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Stein, Laurent Pinchart,
Robert Foss, Sasha Levin
From: Alexander Stein <alexander.stein@ew.tq-group.com>
[ Upstream commit 8a91b29f1f50ce7742cdbe5cf11d17f128511f3f ]
If PLL locking failed, the regulator needs to be disabled again.
Fixes: 5664e3c907e2 ("drm/bridge: ti-sn65dsi83: Add vcc supply regulator support")
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230504065316.2640739-1-alexander.stein@ew.tq-group.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ti-sn65dsi83.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
index 047c14ddbbf11..0635b824e3682 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
@@ -478,6 +478,7 @@ static void sn65dsi83_atomic_enable(struct drm_bridge *bridge,
dev_err(ctx->dev, "failed to lock PLL, ret=%i\n", ret);
/* On failure, disable PLL again and exit. */
regmap_write(ctx->regmap, REG_RC_PLL_EN, 0x00);
+ regulator_disable(ctx->vcc);
return;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 147/591] drm/bridge: tc358768: always enable HS video mode
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 146/591] drm/bridge: ti-sn65dsi83: Fix enable error path Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 148/591] drm/bridge: tc358768: fix PLL parameters computation Greg Kroah-Hartman
` (447 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Robert Foss,
Sasha Levin
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 75a8aeac2573ab258c53676eba9b3796ea691988 ]
Always enable HS video mode setting the TXMD bit, without this change no
video output is present with DSI sinks that are setting
MIPI_DSI_MODE_LPM flag (tested with LT8912B DSI-HDMI bridge).
Previously the driver was enabling HS mode only when the DSI sink was
not explicitly setting the MIPI_DSI_MODE_LPM, however this is not
correct.
The MIPI_DSI_MODE_LPM is supposed to indicate that the sink is willing
to receive data in low power mode, however clearing the
TC358768_DSI_CONTROL_TXMD bit will make the TC358768 send video in
LP mode that is not the intended behavior.
Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358768.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index 4c4b77ce8aba3..23a7a1206e900 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -867,8 +867,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
val = TC358768_DSI_CONFW_MODE_SET | TC358768_DSI_CONFW_ADDR_DSI_CONTROL;
val |= (dsi_dev->lanes - 1) << 1;
- if (!(dsi_dev->mode_flags & MIPI_DSI_MODE_LPM))
- val |= TC358768_DSI_CONTROL_TXMD;
+ val |= TC358768_DSI_CONTROL_TXMD;
if (!(mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS))
val |= TC358768_DSI_CONTROL_HSCKMD;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 148/591] drm/bridge: tc358768: fix PLL parameters computation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 147/591] drm/bridge: tc358768: always enable HS video mode Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 149/591] drm/bridge: tc358768: fix PLL target frequency Greg Kroah-Hartman
` (446 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Robert Foss,
Sasha Levin
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 6a4020b4c63911977aaf8047f904a300d15de739 ]
According to Toshiba documentation the PLL input clock after the divider
should be not less than 4MHz, fix the PLL parameters computation
accordingly.
Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358768.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index 23a7a1206e900..f961259dc85bd 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -335,13 +335,17 @@ static int tc358768_calc_pll(struct tc358768_priv *priv,
u32 fbd;
for (fbd = 0; fbd < 512; ++fbd) {
- u32 pll, diff;
+ u32 pll, diff, pll_in;
pll = (u32)div_u64((u64)refclk * (fbd + 1), divisor);
if (pll >= max_pll || pll < min_pll)
continue;
+ pll_in = (u32)div_u64((u64)refclk, prd + 1);
+ if (pll_in < 4000000)
+ continue;
+
diff = max(pll, target_pll) - min(pll, target_pll);
if (diff < best_diff) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 149/591] drm/bridge: tc358768: fix PLL target frequency
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 148/591] drm/bridge: tc358768: fix PLL parameters computation Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 150/591] drm/bridge: tc358768: fix TCLK_ZEROCNT computation Greg Kroah-Hartman
` (445 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Robert Foss,
Sasha Levin
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit ffd2e4bbea626d565b9817312b0fcfb382fecb88 ]
Correctly compute the PLL target frequency, the current formula works
correctly only when the input bus width is 24bit, actually to properly
compute the PLL target frequency what is relevant is the bits-per-pixel
on the DSI link.
No regression expected since the DSI format is currently hard-coded as
MIPI_DSI_FMT_RGB888.
Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358768.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index f961259dc85bd..9bc726b79dd57 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -147,6 +147,7 @@ struct tc358768_priv {
u32 pd_lines; /* number of Parallel Port Input Data Lines */
u32 dsi_lanes; /* number of DSI Lanes */
+ u32 dsi_bpp; /* number of Bits Per Pixel over DSI */
/* Parameters for PLL programming */
u32 fbd; /* PLL feedback divider */
@@ -285,12 +286,12 @@ static void tc358768_hw_disable(struct tc358768_priv *priv)
static u32 tc358768_pll_to_pclk(struct tc358768_priv *priv, u32 pll_clk)
{
- return (u32)div_u64((u64)pll_clk * priv->dsi_lanes, priv->pd_lines);
+ return (u32)div_u64((u64)pll_clk * priv->dsi_lanes, priv->dsi_bpp);
}
static u32 tc358768_pclk_to_pll(struct tc358768_priv *priv, u32 pclk)
{
- return (u32)div_u64((u64)pclk * priv->pd_lines, priv->dsi_lanes);
+ return (u32)div_u64((u64)pclk * priv->dsi_bpp, priv->dsi_lanes);
}
static int tc358768_calc_pll(struct tc358768_priv *priv,
@@ -427,6 +428,7 @@ static int tc358768_dsi_host_attach(struct mipi_dsi_host *host,
priv->output.panel = panel;
priv->dsi_lanes = dev->lanes;
+ priv->dsi_bpp = mipi_dsi_pixel_format_to_bpp(dev->format);
/* get input ep (port0/endpoint0) */
ret = -EINVAL;
@@ -438,7 +440,7 @@ static int tc358768_dsi_host_attach(struct mipi_dsi_host *host,
}
if (ret)
- priv->pd_lines = mipi_dsi_pixel_format_to_bpp(dev->format);
+ priv->pd_lines = priv->dsi_bpp;
drm_bridge_add(&priv->bridge);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 150/591] drm/bridge: tc358768: fix TCLK_ZEROCNT computation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 149/591] drm/bridge: tc358768: fix PLL target frequency Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 151/591] drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation Greg Kroah-Hartman
` (444 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Robert Foss,
Sasha Levin
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit f9cf811374f42fca31ac34aaf59ee2ae72b89879 ]
Correct computation of TCLK_ZEROCNT register.
This register must be set to a value that ensure that
(TCLK-PREPARECNT + TCLK-ZERO) > 300ns
with the actual value of (TCLK-PREPARECNT + TCLK-ZERO) being
(1 to 2) + (TCLK_ZEROCNT + 1)) x HSByteClkCycle + (PHY output delay)
with PHY output delay being about
(2 to 3) x MIPIBitClk cycle in the BitClk conversion.
Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358768.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index 9bc726b79dd57..765bdebbd06f9 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -743,10 +743,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
/* 38ns < TCLK_PREPARE < 95ns */
val = tc358768_ns_to_cnt(65, dsibclk_nsk) - 1;
- /* TCLK_PREPARE > 300ns */
- val2 = tc358768_ns_to_cnt(300 + tc358768_to_ns(3 * ui_nsk),
- dsibclk_nsk);
- val |= (val2 - tc358768_to_ns(phy_delay_nsk - dsibclk_nsk)) << 8;
+ /* TCLK_PREPARE + TCLK_ZERO > 300ns */
+ val2 = tc358768_ns_to_cnt(300 - tc358768_to_ns(2 * ui_nsk),
+ dsibclk_nsk) - 2;
+ val |= val2 << 8;
dev_dbg(priv->dev, "TCLK_HEADERCNT: 0x%x\n", val);
tc358768_write(priv, TC358768_TCLK_HEADERCNT, val);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 151/591] drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 150/591] drm/bridge: tc358768: fix TCLK_ZEROCNT computation Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 152/591] drm/bridge: tc358768: fix TCLK_TRAILCNT computation Greg Kroah-Hartman
` (443 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Robert Foss,
Sasha Levin
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit cec5ccef85bd0128cf895612de54a9d21d2015d0 ]
Add atomic_get_input_bus_fmts() implementation, tc358768 has a parallel
RGB input interface with the actual bus format depending on the amount
of parallel input data lines.
Without this change when the tc358768 is used with less than 24bit the
color mapping is completely wrong.
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230330095941.428122-7-francesco@dolcini.it
Stable-dep-of: ee18698e212b ("drm/bridge: tc358768: fix TCLK_TRAILCNT computation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358768.c | 44 +++++++++++++++++++++++++++++++
1 file changed, 44 insertions(+)
diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index 765bdebbd06f9..8f7efb14ebdc7 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -9,6 +9,7 @@
#include <linux/gpio/consumer.h>
#include <linux/i2c.h>
#include <linux/kernel.h>
+#include <linux/media-bus-format.h>
#include <linux/module.h>
#include <linux/regmap.h>
#include <linux/regulator/consumer.h>
@@ -919,6 +920,44 @@ static void tc358768_bridge_enable(struct drm_bridge *bridge)
}
}
+#define MAX_INPUT_SEL_FORMATS 1
+
+static u32 *
+tc358768_atomic_get_input_bus_fmts(struct drm_bridge *bridge,
+ struct drm_bridge_state *bridge_state,
+ struct drm_crtc_state *crtc_state,
+ struct drm_connector_state *conn_state,
+ u32 output_fmt,
+ unsigned int *num_input_fmts)
+{
+ struct tc358768_priv *priv = bridge_to_tc358768(bridge);
+ u32 *input_fmts;
+
+ *num_input_fmts = 0;
+
+ input_fmts = kcalloc(MAX_INPUT_SEL_FORMATS, sizeof(*input_fmts),
+ GFP_KERNEL);
+ if (!input_fmts)
+ return NULL;
+
+ switch (priv->pd_lines) {
+ case 16:
+ input_fmts[0] = MEDIA_BUS_FMT_RGB565_1X16;
+ break;
+ case 18:
+ input_fmts[0] = MEDIA_BUS_FMT_RGB666_1X18;
+ break;
+ default:
+ case 24:
+ input_fmts[0] = MEDIA_BUS_FMT_RGB888_1X24;
+ break;
+ };
+
+ *num_input_fmts = MAX_INPUT_SEL_FORMATS;
+
+ return input_fmts;
+}
+
static const struct drm_bridge_funcs tc358768_bridge_funcs = {
.attach = tc358768_bridge_attach,
.mode_valid = tc358768_bridge_mode_valid,
@@ -926,6 +965,11 @@ static const struct drm_bridge_funcs tc358768_bridge_funcs = {
.enable = tc358768_bridge_enable,
.disable = tc358768_bridge_disable,
.post_disable = tc358768_bridge_post_disable,
+
+ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
+ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
+ .atomic_reset = drm_atomic_helper_bridge_reset,
+ .atomic_get_input_bus_fmts = tc358768_atomic_get_input_bus_fmts,
};
static const struct drm_bridge_timings default_tc358768_timings = {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 152/591] drm/bridge: tc358768: fix TCLK_TRAILCNT computation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 151/591] drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 153/591] drm/bridge: tc358768: fix THS_ZEROCNT computation Greg Kroah-Hartman
` (442 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Robert Foss,
Sasha Levin
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit ee18698e212b1659dd0850d7e2ae0f22e16ed3d3 ]
Correct computation of TCLK_TRAILCNT register.
The driver does not implement non-continuous clock mode, so the actual
value doesn't make a practical difference yet. However this change also
ensures that the value does not write to reserved registers bits in case
of under/overflow.
This register must be set to a value that ensures that
TCLK-TRAIL > 60ns
and
TEOT <= (105 ns + 12 x UI)
with the actual value of TCLK-TRAIL being
(TCLK_TRAILCNT + (1 to 2)) xHSByteClkCycle +
(2 + (1 to 2)) * HSBYTECLKCycle - (PHY output delay)
with PHY output delay being about
(2 to 3) x MIPIBitClk cycle in the BitClk conversion.
Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358768.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index 8f7efb14ebdc7..822de6e356a2c 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -10,6 +10,7 @@
#include <linux/i2c.h>
#include <linux/kernel.h>
#include <linux/media-bus-format.h>
+#include <linux/minmax.h>
#include <linux/module.h>
#include <linux/regmap.h>
#include <linux/regulator/consumer.h>
@@ -640,6 +641,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
struct mipi_dsi_device *dsi_dev = priv->output.dev;
unsigned long mode_flags = dsi_dev->mode_flags;
u32 val, val2, lptxcnt, hact, data_type;
+ s32 raw_val;
const struct drm_display_mode *mode;
u32 dsibclk_nsk, dsiclk_nsk, ui_nsk, phy_delay_nsk;
u32 dsiclk, dsibclk, video_start;
@@ -751,9 +753,9 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
dev_dbg(priv->dev, "TCLK_HEADERCNT: 0x%x\n", val);
tc358768_write(priv, TC358768_TCLK_HEADERCNT, val);
- /* TCLK_TRAIL > 60ns + 3*UI */
- val = 60 + tc358768_to_ns(3 * ui_nsk);
- val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 5;
+ /* TCLK_TRAIL > 60ns AND TEOT <= 105 ns + 12*UI */
+ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(2 * ui_nsk), dsibclk_nsk) - 5;
+ val = clamp(raw_val, 0, 127);
dev_dbg(priv->dev, "TCLK_TRAILCNT: 0x%x\n", val);
tc358768_write(priv, TC358768_TCLK_TRAILCNT, val);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 153/591] drm/bridge: tc358768: fix THS_ZEROCNT computation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 152/591] drm/bridge: tc358768: fix TCLK_TRAILCNT computation Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 154/591] drm/bridge: tc358768: fix TXTAGOCNT computation Greg Kroah-Hartman
` (441 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Robert Foss,
Sasha Levin
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 77a089328da791118af9692543a5eedc79eb5fd4 ]
Correct computation of THS_ZEROCNT register.
This register must be set to a value that ensure that
THS_PREPARE + THS_ZERO > 145ns + 10*UI
with the actual value of (THS_PREPARE + THS_ZERO) being
((1 to 2) + 1 + (TCLK_ZEROCNT + 1) + (3 to 4)) x ByteClk cycle +
+ HSByteClk x (2 + (1 to 2)) + (PHY delay)
with PHY delay being about
(8 + (5 to 6)) x MIPIBitClk cycle in the BitClk conversion.
Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-7-francesco@dolcini.it
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358768.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index 822de6e356a2c..014585b9582b9 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -762,9 +762,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
/* 40ns + 4*UI < THS_PREPARE < 85ns + 6*UI */
val = 50 + tc358768_to_ns(4 * ui_nsk);
val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 1;
- /* THS_ZERO > 145ns + 10*UI */
- val2 = tc358768_ns_to_cnt(145 - tc358768_to_ns(ui_nsk), dsibclk_nsk);
- val |= (val2 - tc358768_to_ns(phy_delay_nsk)) << 8;
+ /* THS_PREPARE + THS_ZERO > 145ns + 10*UI */
+ raw_val = tc358768_ns_to_cnt(145 - tc358768_to_ns(3 * ui_nsk), dsibclk_nsk) - 10;
+ val2 = clamp(raw_val, 0, 127);
+ val |= val2 << 8;
dev_dbg(priv->dev, "THS_HEADERCNT: 0x%x\n", val);
tc358768_write(priv, TC358768_THS_HEADERCNT, val);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 154/591] drm/bridge: tc358768: fix TXTAGOCNT computation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 153/591] drm/bridge: tc358768: fix THS_ZEROCNT computation Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 155/591] drm/bridge: tc358768: fix THS_TRAILCNT computation Greg Kroah-Hartman
` (440 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Robert Foss,
Sasha Levin
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 3666aad8185af8d0ce164fd3c4974235417d6d0b ]
Correct computation of TXTAGOCNT register.
This register must be set to a value that ensure that the
TTA-GO period = (4 x TLPX)
with the actual value of TTA-GO being
4 x (TXTAGOCNT + 1) x (HSByteClk cycle)
Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-8-francesco@dolcini.it
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358768.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index 014585b9582b9..ab408f3407ba4 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -797,7 +797,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
/* TXTAGOCNT[26:16] RXTASURECNT[10:0] */
val = tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk * 4);
- val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 1;
+ val = tc358768_ns_to_cnt(val, dsibclk_nsk) / 4 - 1;
val2 = tc358768_ns_to_cnt(tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk),
dsibclk_nsk) - 2;
val = val << 16 | val2;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 155/591] drm/bridge: tc358768: fix THS_TRAILCNT computation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 154/591] drm/bridge: tc358768: fix TXTAGOCNT computation Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 156/591] drm/vram-helper: fix function names in vram helper doc Greg Kroah-Hartman
` (439 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Robert Foss,
Sasha Levin
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit bac7842cd179572e8e0fc2d7b5254e40c6e9e057 ]
Correct computation of THS_TRAILCNT register.
This register must be set to a value that ensure that
THS_TRAIL > 60 ns + 4 x UI
and
THS_TRAIL > 8 x UI
and
THS_TRAIL < TEOT
with
TEOT = 105 ns + (12 x UI)
with the actual value of THS_TRAIL being
(1 + THS_TRAILCNT) x ByteClk cycle + ((1 to 2) + 2) xHSBYTECLK cycle +
- (PHY output delay)
with PHY output delay being about
(8 + (5 to 6)) x MIPIBitClk cycle in the BitClk conversion.
Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-9-francesco@dolcini.it
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358768.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index ab408f3407ba4..2d0ac9987b58e 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -781,9 +781,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
dev_dbg(priv->dev, "TCLK_POSTCNT: 0x%x\n", val);
tc358768_write(priv, TC358768_TCLK_POSTCNT, val);
- /* 60ns + 4*UI < THS_PREPARE < 105ns + 12*UI */
- val = tc358768_ns_to_cnt(60 + tc358768_to_ns(15 * ui_nsk),
- dsibclk_nsk) - 5;
+ /* max(60ns + 4*UI, 8*UI) < THS_TRAILCNT < 105ns + 12*UI */
+ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(18 * ui_nsk),
+ dsibclk_nsk) - 4;
+ val = clamp(raw_val, 0, 15);
dev_dbg(priv->dev, "THS_TRAILCNT: 0x%x\n", val);
tc358768_write(priv, TC358768_THS_TRAILCNT, val);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 156/591] drm/vram-helper: fix function names in vram helper doc
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 155/591] drm/bridge: tc358768: fix THS_TRAILCNT computation Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 157/591] ARM: dts: BCM5301X: Drop "clock-names" from the SPI node Greg Kroah-Hartman
` (438 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luc Ma, Thomas Zimmermann,
Sasha Levin
From: Luc Ma <luc@sietium.com>
[ Upstream commit b8e392245105b50706f18418054821e71e637288 ]
Refer to drmm_vram_helper_init() instead of the non-existent
drmm_vram_helper_alloc_mm().
Fixes: a5f23a72355d ("drm/vram-helper: Managed vram helpers")
Signed-off-by: Luc Ma <luc@sietium.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/64583db2.630a0220.eb75d.8f51@mx.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_gem_vram_helper.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c
index 125160b534bef..928e08e0b5b86 100644
--- a/drivers/gpu/drm/drm_gem_vram_helper.c
+++ b/drivers/gpu/drm/drm_gem_vram_helper.c
@@ -44,7 +44,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs;
* the frame's scanout buffer or the cursor image. If there's no more space
* left in VRAM, inactive GEM objects can be moved to system memory.
*
- * To initialize the VRAM helper library call drmm_vram_helper_alloc_mm().
+ * To initialize the VRAM helper library call drmm_vram_helper_init().
* The function allocates and initializes an instance of &struct drm_vram_mm
* in &struct drm_device.vram_mm . Use &DRM_GEM_VRAM_DRIVER to initialize
* &struct drm_driver and &DRM_VRAM_MM_FILE_OPERATIONS to initialize
@@ -72,7 +72,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs;
* // setup device, vram base and size
* // ...
*
- * ret = drmm_vram_helper_alloc_mm(dev, vram_base, vram_size);
+ * ret = drmm_vram_helper_init(dev, vram_base, vram_size);
* if (ret)
* return ret;
* return 0;
@@ -85,7 +85,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs;
* to userspace.
*
* You don't have to clean up the instance of VRAM MM.
- * drmm_vram_helper_alloc_mm() is a managed interface that installs a
+ * drmm_vram_helper_init() is a managed interface that installs a
* clean-up handler to run during the DRM device's release.
*
* For drawing or scanout operations, rsp. buffer objects have to be pinned
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 157/591] ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 156/591] drm/vram-helper: fix function names in vram helper doc Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 158/591] ARM: dts: meson8b: correct uart_B and uart_C clock references Greg Kroah-Hartman
` (437 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafał Miłecki,
Florian Fainelli, Sasha Levin
From: Rafał Miłecki <rafal@milecki.pl>
[ Upstream commit d3c8e2c5757153bbfad70019ec1decbca86f3def ]
There is no such property in the SPI controller binding documentation.
Also Linux driver doesn't look for it.
This fixes:
arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: spi@18029200: Unevaluated properties are not allowed ('clock-names' was unexpected)
From schema: Documentation/devicetree/bindings/spi/brcm,spi-bcm-qspi.yaml
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Link: https://lore.kernel.org/r/20230503122830.3200-1-zajec5@gmail.com
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm5301x.dtsi | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
index 5fc1b847f4aa5..787a0dd8216b7 100644
--- a/arch/arm/boot/dts/bcm5301x.dtsi
+++ b/arch/arm/boot/dts/bcm5301x.dtsi
@@ -542,7 +542,6 @@ spi@18029200 {
"spi_lr_session_done",
"spi_lr_overread";
clocks = <&iprocmed>;
- clock-names = "iprocmed";
num-cs = <2>;
#address-cells = <1>;
#size-cells = <0>;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 158/591] ARM: dts: meson8b: correct uart_B and uart_C clock references
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 157/591] ARM: dts: BCM5301X: Drop "clock-names" from the SPI node Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 159/591] mm: call arch_swap_restore() from do_swap_page() Greg Kroah-Hartman
` (436 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans-Frieder Vogt,
Martin Blumenstingl, Neil Armstrong, Sasha Levin
From: hfdevel@gmx.net <hfdevel@gmx.net>
[ Upstream commit d542ce8d4769cdef6a7bc3437e59cfed9c68f0e4 ]
With the current device tree for meson8b, uarts B (e.g. available on pins
8/10 on Odroid-C1) and C (pins 3/5 on Odroid-C1) do not work, because they
are relying on incorrect clocks. Change the references of pclk to the
correct CLKID, to allow use of the two uarts.
Fixes: 3375aa77135f ("ARM: dts: meson8b: Fix the UART device-tree schema validation")
Signed-off-by: Hans-Frieder Vogt <hfdevel@gmx.net>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Link: https://lore.kernel.org/r/trinity-bf20bcb9-790b-4ab9-99e3-0831ef8257f4-1680878185420@3c-app-gmx-bap55
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/meson8b.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/meson8b.dtsi b/arch/arm/boot/dts/meson8b.dtsi
index cf9c04a61ba3c..d3e0f085904db 100644
--- a/arch/arm/boot/dts/meson8b.dtsi
+++ b/arch/arm/boot/dts/meson8b.dtsi
@@ -737,13 +737,13 @@ &uart_A {
&uart_B {
compatible = "amlogic,meson8b-uart";
- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>;
+ clocks = <&xtal>, <&clkc CLKID_UART1>, <&clkc CLKID_CLK81>;
clock-names = "xtal", "pclk", "baud";
};
&uart_C {
compatible = "amlogic,meson8b-uart";
- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>;
+ clocks = <&xtal>, <&clkc CLKID_UART2>, <&clkc CLKID_CLK81>;
clock-names = "xtal", "pclk", "baud";
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 159/591] mm: call arch_swap_restore() from do_swap_page()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 158/591] ARM: dts: meson8b: correct uart_B and uart_C clock references Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:44 ` [PATCH 6.1 160/591] clk: vc5: Use `clamp()` to restrict PLL range Greg Kroah-Hartman
` (435 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Collingbourne, Qun-wei Lin,
David Hildenbrand, Huang, Ying, Steven Price, Catalin Marinas,
Andrew Morton
From: Peter Collingbourne <pcc@google.com>
commit 6dca4ac6fc91fd41ea4d6c4511838d37f4e0eab2 upstream.
Commit c145e0b47c77 ("mm: streamline COW logic in do_swap_page()") moved
the call to swap_free() before the call to set_pte_at(), which meant that
the MTE tags could end up being freed before set_pte_at() had a chance to
restore them. Fix it by adding a call to the arch_swap_restore() hook
before the call to swap_free().
Link: https://lkml.kernel.org/r/20230523004312.1807357-2-pcc@google.com
Link: https://linux-review.googlesource.com/id/I6470efa669e8bd2f841049b8c61020c510678965
Fixes: c145e0b47c77 ("mm: streamline COW logic in do_swap_page()")
Signed-off-by: Peter Collingbourne <pcc@google.com>
Reported-by: Qun-wei Lin <Qun-wei.Lin@mediatek.com>
Closes: https://lore.kernel.org/all/5050805753ac469e8d727c797c2218a9d780d434.camel@mediatek.com/
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: "Huang, Ying" <ying.huang@intel.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: <stable@vger.kernel.org> [6.1+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memory.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3981,6 +3981,13 @@ vm_fault_t do_swap_page(struct vm_fault
}
/*
+ * Some architectures may have to restore extra metadata to the page
+ * when reading from swap. This metadata may be indexed by swap entry
+ * so this must be called before swap_free().
+ */
+ arch_swap_restore(entry, folio);
+
+ /*
* Remove the swap entry and conditionally try to free up the swapcache.
* We're already holding a reference on the page but haven't mapped it
* yet.
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 160/591] clk: vc5: Use `clamp()` to restrict PLL range
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 159/591] mm: call arch_swap_restore() from do_swap_page() Greg Kroah-Hartman
@ 2023-07-16 19:44 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 161/591] bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page Greg Kroah-Hartman
` (434 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars-Peter Clausen, Luca Ceresoli,
Stephen Boyd, Sasha Levin
From: Lars-Peter Clausen <lars@metafoo.de>
[ Upstream commit 3ed741db04f58e8df0d46cec7ecfc4bfd075f047 ]
The VCO frequency needs to be within a certain range and the driver
enforces this.
Make use of the clamp macro to implement this instead of open-coding it.
This makes the code a bit shorter and also semanticly stronger.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Link: https://lore.kernel.org/r/20230114233500.3294789-1-lars@metafoo.de
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: be3471c5bd9b ("clk: vc5: Fix .driver_data content in i2c_device_id")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-versaclock5.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
index 88689415aff9c..abfe59ac4e487 100644
--- a/drivers/clk/clk-versaclock5.c
+++ b/drivers/clk/clk-versaclock5.c
@@ -450,10 +450,7 @@ static long vc5_pll_round_rate(struct clk_hw *hw, unsigned long rate,
u32 div_int;
u64 div_frc;
- if (rate < VC5_PLL_VCO_MIN)
- rate = VC5_PLL_VCO_MIN;
- if (rate > VC5_PLL_VCO_MAX)
- rate = VC5_PLL_VCO_MAX;
+ rate = clamp(rate, VC5_PLL_VCO_MIN, VC5_PLL_VCO_MAX);
/* Determine integer part, which is 12 bit wide */
div_int = rate / *parent_rate;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 161/591] bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2023-07-16 19:44 ` [PATCH 6.1 160/591] clk: vc5: Use `clamp()` to restrict PLL range Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 162/591] clk: vc5: Fix .driver_data content in i2c_device_id Greg Kroah-Hartman
` (433 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liu Shixin, Muchun Song,
Matthew Wilcox, Mike Kravetz, Oscar Salvador, Andrew Morton
From: Liu Shixin <liushixin2@huawei.com>
commit 028725e73375a1ff080bbdf9fb503306d0116f28 upstream.
commit dd0ff4d12dd2 ("bootmem: remove the vmemmap pages from kmemleak in
put_page_bootmem") fix an overlaps existing problem of kmemleak. But the
problem still existed when HAVE_BOOTMEM_INFO_NODE is disabled, because in
this case, free_bootmem_page() will call free_reserved_page() directly.
Fix the problem by adding kmemleak_free_part() in free_bootmem_page() when
HAVE_BOOTMEM_INFO_NODE is disabled.
Link: https://lkml.kernel.org/r/20230704101942.2819426-1-liushixin2@huawei.com
Fixes: f41f2ed43ca5 ("mm: hugetlb: free the vmemmap pages associated with each HugeTLB page")
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
Acked-by: Muchun Song <songmuchun@bytedance.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/bootmem_info.h | 2 ++
1 file changed, 2 insertions(+)
--- a/include/linux/bootmem_info.h
+++ b/include/linux/bootmem_info.h
@@ -3,6 +3,7 @@
#define __LINUX_BOOTMEM_INFO_H
#include <linux/mm.h>
+#include <linux/kmemleak.h>
/*
* Types for free bootmem stored in page->lru.next. These have to be in
@@ -59,6 +60,7 @@ static inline void get_page_bootmem(unsi
static inline void free_bootmem_page(struct page *page)
{
+ kmemleak_free_part(page_to_virt(page), PAGE_SIZE);
free_reserved_page(page);
}
#endif
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 162/591] clk: vc5: Fix .driver_data content in i2c_device_id
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 161/591] bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 163/591] clk: vc7: " Greg Kroah-Hartman
` (432 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Luca Ceresoli,
Geert Uytterhoeven, Stephen Boyd, Sasha Levin
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit be3471c5bd9b921c9adfab7948e8021611639164 ]
The .driver_data content in i2c_device_id table must match the
.data content in of_device_id table, else device_get_match_data()
would return bogus value on i2c_device_id match. Align the two
tables.
The i2c_device_id table is now converted from of_device_id using
's@.compatible = "idt,\([^"]\+"\), .data = \(.*\)@"\1, .driver_data = (kernel_ulong_t)\2@'
Fixes: 9adddb01ce5f ("clk: vc5: Add structure to describe particular chip features")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Link: https://lore.kernel.org/r/20230507133906.15061-1-marek.vasut+renesas@mailbox.org
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-versaclock5.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
index abfe59ac4e487..5f2c9093c5b94 100644
--- a/drivers/clk/clk-versaclock5.c
+++ b/drivers/clk/clk-versaclock5.c
@@ -1255,13 +1255,13 @@ static const struct vc5_chip_info idt_5p49v6975_info = {
};
static const struct i2c_device_id vc5_id[] = {
- { "5p49v5923", .driver_data = IDT_VC5_5P49V5923 },
- { "5p49v5925", .driver_data = IDT_VC5_5P49V5925 },
- { "5p49v5933", .driver_data = IDT_VC5_5P49V5933 },
- { "5p49v5935", .driver_data = IDT_VC5_5P49V5935 },
- { "5p49v6901", .driver_data = IDT_VC6_5P49V6901 },
- { "5p49v6965", .driver_data = IDT_VC6_5P49V6965 },
- { "5p49v6975", .driver_data = IDT_VC6_5P49V6975 },
+ { "5p49v5923", .driver_data = (kernel_ulong_t)&idt_5p49v5923_info },
+ { "5p49v5925", .driver_data = (kernel_ulong_t)&idt_5p49v5925_info },
+ { "5p49v5933", .driver_data = (kernel_ulong_t)&idt_5p49v5933_info },
+ { "5p49v5935", .driver_data = (kernel_ulong_t)&idt_5p49v5935_info },
+ { "5p49v6901", .driver_data = (kernel_ulong_t)&idt_5p49v6901_info },
+ { "5p49v6965", .driver_data = (kernel_ulong_t)&idt_5p49v6965_info },
+ { "5p49v6975", .driver_data = (kernel_ulong_t)&idt_5p49v6975_info },
{ }
};
MODULE_DEVICE_TABLE(i2c, vc5_id);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 163/591] clk: vc7: Fix .driver_data content in i2c_device_id
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 162/591] clk: vc5: Fix .driver_data content in i2c_device_id Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 164/591] clk: rs9: " Greg Kroah-Hartman
` (431 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Geert Uytterhoeven,
Stephen Boyd, Sasha Levin
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit b5e10beeafaa3266559c582dde7534ae3fe8cefb ]
The .driver_data content in i2c_device_id table must match the
.data content in of_device_id table, else device_get_match_data()
would return bogus value on i2c_device_id match. Align the two
tables.
The i2c_device_id table is now converted from of_device_id using
's@.compatible = "renesas,\([^"]\+"\), .data = \(.*\)@"\1, .driver_data = (kernel_ulong_t)\2@'
Fixes: 48c5e98fedd9 ("clk: Renesas versaclock7 ccf device driver")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Link: https://lore.kernel.org/r/20230507133906.15061-2-marek.vasut+renesas@mailbox.org
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-versaclock7.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/clk-versaclock7.c b/drivers/clk/clk-versaclock7.c
index 8e4f86e852aa0..0ae191f50b4b2 100644
--- a/drivers/clk/clk-versaclock7.c
+++ b/drivers/clk/clk-versaclock7.c
@@ -1282,7 +1282,7 @@ static const struct regmap_config vc7_regmap_config = {
};
static const struct i2c_device_id vc7_i2c_id[] = {
- { "rc21008a", VC7_RC21008A },
+ { "rc21008a", .driver_data = (kernel_ulong_t)&vc7_rc21008a_info },
{}
};
MODULE_DEVICE_TABLE(i2c, vc7_i2c_id);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 164/591] clk: rs9: Fix .driver_data content in i2c_device_id
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 163/591] clk: vc7: " Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 165/591] Input: adxl34x - do not hardcode interrupt trigger type Greg Kroah-Hartman
` (430 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Geert Uytterhoeven,
Stephen Boyd, Sasha Levin
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit ad527ca87e4ea42d7baad2ce710b44069287931b ]
The .driver_data content in i2c_device_id table must match the
.data content in of_device_id table, else device_get_match_data()
would return bogus value on i2c_device_id match. Align the two
tables.
The i2c_device_id table is now converted from of_device_id using
's@.compatible = "renesas,\([^"]\+"\), .data = \(.*\)@"\1, .driver_data = (kernel_ulong_t)\2@'
Fixes: 892e0ddea1aa ("clk: rs9: Add Renesas 9-series PCIe clock generator driver")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Link: https://lore.kernel.org/r/20230507133906.15061-3-marek.vasut+renesas@mailbox.org
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-renesas-pcie.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/clk-renesas-pcie.c b/drivers/clk/clk-renesas-pcie.c
index 3e98a16eba6bb..35b2519f16961 100644
--- a/drivers/clk/clk-renesas-pcie.c
+++ b/drivers/clk/clk-renesas-pcie.c
@@ -353,7 +353,7 @@ static const struct rs9_chip_info renesas_9fgv0241_info = {
};
static const struct i2c_device_id rs9_id[] = {
- { "9fgv0241", .driver_data = RENESAS_9FGV0241 },
+ { "9fgv0241", .driver_data = (kernel_ulong_t)&renesas_9fgv0241_info },
{ }
};
MODULE_DEVICE_TABLE(i2c, rs9_id);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 165/591] Input: adxl34x - do not hardcode interrupt trigger type
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 164/591] clk: rs9: " Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 166/591] drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks` Greg Kroah-Hartman
` (429 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Michael Hennerich,
Dmitry Torokhov, Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit e96220bce5176ed2309f77f061dcc0430b82b25e ]
Instead of hardcoding IRQ trigger type to IRQF_TRIGGER_HIGH, let's
respect the settings specified in the firmware description.
Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers")
Signed-off-by: Marek Vasut <marex@denx.de>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Link: https://lore.kernel.org/r/20230509203555.549158-1-marex@denx.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/adxl34x.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
index a4af314392a9f..69e359ff51805 100644
--- a/drivers/input/misc/adxl34x.c
+++ b/drivers/input/misc/adxl34x.c
@@ -811,8 +811,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
AC_WRITE(ac, POWER_CTL, 0);
err = request_threaded_irq(ac->irq, NULL, adxl34x_irq,
- IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
- dev_name(dev), ac);
+ IRQF_ONESHOT, dev_name(dev), ac);
if (err) {
dev_err(dev, "irq %d busy?\n", ac->irq);
goto err_free_mem;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 166/591] drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 165/591] Input: adxl34x - do not hardcode interrupt trigger type Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 167/591] drm/panel: sharp-ls043t1le01: adjust mode settings Greg Kroah-Hartman
` (428 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, XuDong Liu, Dongliang Mu,
Maxime Ripard, Sasha Levin
From: XuDong Liu <m202071377@hust.edu.cn>
[ Upstream commit 123ee07ba5b7123e0ce0e0f9d64938026c16a2ce ]
Smatch reports:
drivers/gpu/drm/sun4i/sun4i_tcon.c:805 sun4i_tcon_init_clocks() warn:
'tcon->clk' from clk_prepare_enable() not released on lines: 792,801.
In the function sun4i_tcon_init_clocks(), tcon->clk and tcon->sclk0 are
not disabled in the error handling, which affects the release of
these variable. Although sun4i_tcon_bind(), which calls
sun4i_tcon_init_clocks(), use sun4i_tcon_free_clocks to disable the
variables mentioned, but the error handling branch of
sun4i_tcon_init_clocks() ignores the required disable process.
To fix this issue, use the devm_clk_get_enabled to automatically
balance enable and disabled calls. As original implementation use
sun4i_tcon_free_clocks() to disable clk explicitly, we delete the
related calls and error handling that are no longer needed.
Fixes: 9026e0d122ac ("drm: Add Allwinner A10 Display Engine support")
Fixes: b14e945bda8a ("drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init")
Fixes: 8e9240472522 ("drm/sun4i: support TCONs without channel 1")
Fixes: 34d698f6e349 ("drm/sun4i: Add has_channel_0 TCON quirk")
Signed-off-by: XuDong Liu <m202071377@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20230430112347.4689-1-m202071377@hust.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/sun4i/sun4i_tcon.c | 19 ++++---------------
1 file changed, 4 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 523a6d7879210..936796851ffd3 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -778,21 +778,19 @@ static irqreturn_t sun4i_tcon_handler(int irq, void *private)
static int sun4i_tcon_init_clocks(struct device *dev,
struct sun4i_tcon *tcon)
{
- tcon->clk = devm_clk_get(dev, "ahb");
+ tcon->clk = devm_clk_get_enabled(dev, "ahb");
if (IS_ERR(tcon->clk)) {
dev_err(dev, "Couldn't get the TCON bus clock\n");
return PTR_ERR(tcon->clk);
}
- clk_prepare_enable(tcon->clk);
if (tcon->quirks->has_channel_0) {
- tcon->sclk0 = devm_clk_get(dev, "tcon-ch0");
+ tcon->sclk0 = devm_clk_get_enabled(dev, "tcon-ch0");
if (IS_ERR(tcon->sclk0)) {
dev_err(dev, "Couldn't get the TCON channel 0 clock\n");
return PTR_ERR(tcon->sclk0);
}
}
- clk_prepare_enable(tcon->sclk0);
if (tcon->quirks->has_channel_1) {
tcon->sclk1 = devm_clk_get(dev, "tcon-ch1");
@@ -805,12 +803,6 @@ static int sun4i_tcon_init_clocks(struct device *dev,
return 0;
}
-static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon)
-{
- clk_disable_unprepare(tcon->sclk0);
- clk_disable_unprepare(tcon->clk);
-}
-
static int sun4i_tcon_init_irq(struct device *dev,
struct sun4i_tcon *tcon)
{
@@ -1223,14 +1215,14 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master,
ret = sun4i_tcon_init_regmap(dev, tcon);
if (ret) {
dev_err(dev, "Couldn't init our TCON regmap\n");
- goto err_free_clocks;
+ goto err_assert_reset;
}
if (tcon->quirks->has_channel_0) {
ret = sun4i_dclk_create(dev, tcon);
if (ret) {
dev_err(dev, "Couldn't create our TCON dot clock\n");
- goto err_free_clocks;
+ goto err_assert_reset;
}
}
@@ -1293,8 +1285,6 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master,
err_free_dotclock:
if (tcon->quirks->has_channel_0)
sun4i_dclk_free(tcon);
-err_free_clocks:
- sun4i_tcon_free_clocks(tcon);
err_assert_reset:
reset_control_assert(tcon->lcd_rst);
return ret;
@@ -1308,7 +1298,6 @@ static void sun4i_tcon_unbind(struct device *dev, struct device *master,
list_del(&tcon->list);
if (tcon->quirks->has_channel_0)
sun4i_dclk_free(tcon);
- sun4i_tcon_free_clocks(tcon);
}
static const struct component_ops sun4i_tcon_ops = {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 167/591] drm/panel: sharp-ls043t1le01: adjust mode settings
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 166/591] drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks` Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 168/591] driver: soc: xilinx: use _safe loop iterator to avoid a use after free Greg Kroah-Hartman
` (427 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Neil Armstrong,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit dee23b2c9e3ff46d59c5d45e1436eceb878e7c9a ]
Using current settings causes panel flickering on APQ8074 dragonboard.
Adjust panel settings to follow the vendor-provided mode. This also
enables MIPI_DSI_MODE_VIDEO_SYNC_PULSE, which is also specified by the
vendor dtsi for the mentioned dragonboard.
Fixes: ee0172383190 ("drm/panel: Add Sharp LS043T1LE01 MIPI DSI panel")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230507172639.2320934-1-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
index d1ec80a3e3c72..ef148504cf24a 100644
--- a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
+++ b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
@@ -192,15 +192,15 @@ static int sharp_nt_panel_enable(struct drm_panel *panel)
}
static const struct drm_display_mode default_mode = {
- .clock = 41118,
+ .clock = (540 + 48 + 32 + 80) * (960 + 3 + 10 + 15) * 60 / 1000,
.hdisplay = 540,
.hsync_start = 540 + 48,
- .hsync_end = 540 + 48 + 80,
- .htotal = 540 + 48 + 80 + 32,
+ .hsync_end = 540 + 48 + 32,
+ .htotal = 540 + 48 + 32 + 80,
.vdisplay = 960,
.vsync_start = 960 + 3,
- .vsync_end = 960 + 3 + 15,
- .vtotal = 960 + 3 + 15 + 1,
+ .vsync_end = 960 + 3 + 10,
+ .vtotal = 960 + 3 + 10 + 15,
};
static int sharp_nt_panel_get_modes(struct drm_panel *panel,
@@ -280,6 +280,7 @@ static int sharp_nt_panel_probe(struct mipi_dsi_device *dsi)
dsi->lanes = 2;
dsi->format = MIPI_DSI_FMT_RGB888;
dsi->mode_flags = MIPI_DSI_MODE_VIDEO |
+ MIPI_DSI_MODE_VIDEO_SYNC_PULSE |
MIPI_DSI_MODE_VIDEO_HSE |
MIPI_DSI_CLOCK_NON_CONTINUOUS |
MIPI_DSI_MODE_NO_EOT_PACKET;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 168/591] driver: soc: xilinx: use _safe loop iterator to avoid a use after free
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 167/591] drm/panel: sharp-ls043t1le01: adjust mode settings Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 169/591] ASoC: Intel: sof_sdw: remove SOF_SDW_TGL_HDMI for MeteorLake devices Greg Kroah-Hartman
` (426 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Michal Simek,
Sasha Levin
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit c58da0ba3e5c86e51e2c1557afaf6f71e00c4533 ]
The hash_for_each_possible() loop dereferences "eve_data" to get the
next item on the list. However the loop frees eve_data so it leads to
a use after free. Use hash_for_each_possible_safe() instead.
Fixes: c7fdb2404f66 ("drivers: soc: xilinx: add xilinx event management driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/761e0e4a-4caf-4a71-8f47-1c6ad908a848@kili.mountain
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/xilinx/xlnx_event_manager.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c
index c76381899ef49..f9d9b82b562da 100644
--- a/drivers/soc/xilinx/xlnx_event_manager.c
+++ b/drivers/soc/xilinx/xlnx_event_manager.c
@@ -192,11 +192,12 @@ static int xlnx_remove_cb_for_suspend(event_cb_func_t cb_fun)
struct registered_event_data *eve_data;
struct agent_cb *cb_pos;
struct agent_cb *cb_next;
+ struct hlist_node *tmp;
is_need_to_unregister = false;
/* Check for existing entry in hash table for given cb_type */
- hash_for_each_possible(reg_driver_map, eve_data, hentry, PM_INIT_SUSPEND_CB) {
+ hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, PM_INIT_SUSPEND_CB) {
if (eve_data->cb_type == PM_INIT_SUSPEND_CB) {
/* Delete the list of callback */
list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) {
@@ -228,11 +229,12 @@ static int xlnx_remove_cb_for_notify_event(const u32 node_id, const u32 event,
u64 key = ((u64)node_id << 32U) | (u64)event;
struct agent_cb *cb_pos;
struct agent_cb *cb_next;
+ struct hlist_node *tmp;
is_need_to_unregister = false;
/* Check for existing entry in hash table for given key id */
- hash_for_each_possible(reg_driver_map, eve_data, hentry, key) {
+ hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, key) {
if (eve_data->key == key) {
/* Delete the list of callback */
list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 169/591] ASoC: Intel: sof_sdw: remove SOF_SDW_TGL_HDMI for MeteorLake devices
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 168/591] driver: soc: xilinx: use _safe loop iterator to avoid a use after free Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 170/591] drm/vkms: isolate pixel conversion functionality Greg Kroah-Hartman
` (425 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Bard Liao <yung-chuan.liao@linux.intel.com>
[ Upstream commit 0db94947c9d3da16aa31d152b7d26fab78b02cb9 ]
Topologies support three HDMI links on MeteorLake devices only.
Fixes: 18489174e4fb ("ASoC: intel: sof_sdw: add RT711 SDCA card for MTL platform")
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com
Link: https://lore.kernel.org/r/20230512173305.65399-3-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/sof_sdw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
index d4f92bb5e29f8..a37c85d301471 100644
--- a/sound/soc/intel/boards/sof_sdw.c
+++ b/sound/soc/intel/boards/sof_sdw.c
@@ -372,7 +372,7 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
.matches = {
DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_mtlrvp"),
},
- .driver_data = (void *)(RT711_JD1 | SOF_SDW_TGL_HDMI),
+ .driver_data = (void *)(RT711_JD1),
},
{}
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 170/591] drm/vkms: isolate pixel conversion functionality
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 169/591] ASoC: Intel: sof_sdw: remove SOF_SDW_TGL_HDMI for MeteorLake devices Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 171/591] drm: Add fixed-point helper to get rounded integer values Greg Kroah-Hartman
` (424 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arthur Grillo, Maíra Canal,
Maíra Canal, Sasha Levin
From: Maíra Canal <mcanal@igalia.com>
[ Upstream commit 322d716a3e8a74fb75cd0f657647be4df253fd2f ]
Currently, the pixel conversion functions repeat the same loop to
iterate the rows. Instead of repeating the same code for each pixel
format, create a function to wrap the loop and isolate the pixel
conversion functionality.
Suggested-by: Arthur Grillo <arthurgrillo@riseup.net>
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Reviewed-by: Arthur Grillo <arthurgrillo@riseup.net>
Signed-off-by: Maíra Canal <mairacanal@riseup.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20230418130525.128733-2-mcanal@igalia.com
Stable-dep-of: ab87f558dcfb ("drm/vkms: Fix RGB565 pixel conversion")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vkms/vkms_composer.c | 4 +-
drivers/gpu/drm/vkms/vkms_drv.h | 4 +-
drivers/gpu/drm/vkms/vkms_formats.c | 125 +++++++++++----------------
drivers/gpu/drm/vkms/vkms_formats.h | 2 +-
drivers/gpu/drm/vkms/vkms_plane.c | 2 +-
5 files changed, 56 insertions(+), 81 deletions(-)
diff --git a/drivers/gpu/drm/vkms/vkms_composer.c b/drivers/gpu/drm/vkms/vkms_composer.c
index 8e53fa80742b2..80164e79af006 100644
--- a/drivers/gpu/drm/vkms/vkms_composer.c
+++ b/drivers/gpu/drm/vkms/vkms_composer.c
@@ -99,7 +99,7 @@ static void blend(struct vkms_writeback_job *wb,
if (!check_y_limit(plane[i]->frame_info, y))
continue;
- plane[i]->plane_read(stage_buffer, plane[i]->frame_info, y);
+ vkms_compose_row(stage_buffer, plane[i], y);
pre_mul_alpha_blend(plane[i]->frame_info, stage_buffer,
output_buffer);
}
@@ -118,7 +118,7 @@ static int check_format_funcs(struct vkms_crtc_state *crtc_state,
u32 n_active_planes = crtc_state->num_active_planes;
for (size_t i = 0; i < n_active_planes; i++)
- if (!planes[i]->plane_read)
+ if (!planes[i]->pixel_read)
return -1;
if (active_wb && !active_wb->wb_write)
diff --git a/drivers/gpu/drm/vkms/vkms_drv.h b/drivers/gpu/drm/vkms/vkms_drv.h
index 0a67b8073f7e5..de4efc0a3bd01 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.h
+++ b/drivers/gpu/drm/vkms/vkms_drv.h
@@ -56,8 +56,7 @@ struct vkms_writeback_job {
struct vkms_plane_state {
struct drm_shadow_plane_state base;
struct vkms_frame_info *frame_info;
- void (*plane_read)(struct line_buffer *buffer,
- const struct vkms_frame_info *frame_info, int y);
+ void (*pixel_read)(u8 *src_buffer, struct pixel_argb_u16 *out_pixel);
};
struct vkms_plane {
@@ -155,6 +154,7 @@ int vkms_verify_crc_source(struct drm_crtc *crtc, const char *source_name,
/* Composer Support */
void vkms_composer_worker(struct work_struct *work);
void vkms_set_composer(struct vkms_output *out, bool enabled);
+void vkms_compose_row(struct line_buffer *stage_buffer, struct vkms_plane_state *plane, int y);
/* Writeback */
int vkms_enable_writeback_connector(struct vkms_device *vkmsdev);
diff --git a/drivers/gpu/drm/vkms/vkms_formats.c b/drivers/gpu/drm/vkms/vkms_formats.c
index d4950688b3f17..8d948c73741ef 100644
--- a/drivers/gpu/drm/vkms/vkms_formats.c
+++ b/drivers/gpu/drm/vkms/vkms_formats.c
@@ -42,100 +42,75 @@ static void *get_packed_src_addr(const struct vkms_frame_info *frame_info, int y
return packed_pixels_addr(frame_info, x_src, y_src);
}
-static void ARGB8888_to_argb_u16(struct line_buffer *stage_buffer,
- const struct vkms_frame_info *frame_info, int y)
+static void ARGB8888_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
{
- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
- u8 *src_pixels = get_packed_src_addr(frame_info, y);
- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst),
- stage_buffer->n_pixels);
-
- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) {
- /*
- * The 257 is the "conversion ratio". This number is obtained by the
- * (2^16 - 1) / (2^8 - 1) division. Which, in this case, tries to get
- * the best color value in a pixel format with more possibilities.
- * A similar idea applies to others RGB color conversions.
- */
- out_pixels[x].a = (u16)src_pixels[3] * 257;
- out_pixels[x].r = (u16)src_pixels[2] * 257;
- out_pixels[x].g = (u16)src_pixels[1] * 257;
- out_pixels[x].b = (u16)src_pixels[0] * 257;
- }
+ /*
+ * The 257 is the "conversion ratio". This number is obtained by the
+ * (2^16 - 1) / (2^8 - 1) division. Which, in this case, tries to get
+ * the best color value in a pixel format with more possibilities.
+ * A similar idea applies to others RGB color conversions.
+ */
+ out_pixel->a = (u16)src_pixels[3] * 257;
+ out_pixel->r = (u16)src_pixels[2] * 257;
+ out_pixel->g = (u16)src_pixels[1] * 257;
+ out_pixel->b = (u16)src_pixels[0] * 257;
}
-static void XRGB8888_to_argb_u16(struct line_buffer *stage_buffer,
- const struct vkms_frame_info *frame_info, int y)
+static void XRGB8888_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
{
- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
- u8 *src_pixels = get_packed_src_addr(frame_info, y);
- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst),
- stage_buffer->n_pixels);
-
- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) {
- out_pixels[x].a = (u16)0xffff;
- out_pixels[x].r = (u16)src_pixels[2] * 257;
- out_pixels[x].g = (u16)src_pixels[1] * 257;
- out_pixels[x].b = (u16)src_pixels[0] * 257;
- }
+ out_pixel->a = (u16)0xffff;
+ out_pixel->r = (u16)src_pixels[2] * 257;
+ out_pixel->g = (u16)src_pixels[1] * 257;
+ out_pixel->b = (u16)src_pixels[0] * 257;
}
-static void ARGB16161616_to_argb_u16(struct line_buffer *stage_buffer,
- const struct vkms_frame_info *frame_info,
- int y)
+static void ARGB16161616_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
{
- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
- u16 *src_pixels = get_packed_src_addr(frame_info, y);
- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst),
- stage_buffer->n_pixels);
+ u16 *pixels = (u16 *)src_pixels;
- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) {
- out_pixels[x].a = le16_to_cpu(src_pixels[3]);
- out_pixels[x].r = le16_to_cpu(src_pixels[2]);
- out_pixels[x].g = le16_to_cpu(src_pixels[1]);
- out_pixels[x].b = le16_to_cpu(src_pixels[0]);
- }
+ out_pixel->a = le16_to_cpu(pixels[3]);
+ out_pixel->r = le16_to_cpu(pixels[2]);
+ out_pixel->g = le16_to_cpu(pixels[1]);
+ out_pixel->b = le16_to_cpu(pixels[0]);
}
-static void XRGB16161616_to_argb_u16(struct line_buffer *stage_buffer,
- const struct vkms_frame_info *frame_info,
- int y)
+static void XRGB16161616_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
{
- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
- u16 *src_pixels = get_packed_src_addr(frame_info, y);
- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst),
- stage_buffer->n_pixels);
+ u16 *pixels = (u16 *)src_pixels;
- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) {
- out_pixels[x].a = (u16)0xffff;
- out_pixels[x].r = le16_to_cpu(src_pixels[2]);
- out_pixels[x].g = le16_to_cpu(src_pixels[1]);
- out_pixels[x].b = le16_to_cpu(src_pixels[0]);
- }
+ out_pixel->a = (u16)0xffff;
+ out_pixel->r = le16_to_cpu(pixels[2]);
+ out_pixel->g = le16_to_cpu(pixels[1]);
+ out_pixel->b = le16_to_cpu(pixels[0]);
}
-static void RGB565_to_argb_u16(struct line_buffer *stage_buffer,
- const struct vkms_frame_info *frame_info, int y)
+static void RGB565_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
{
- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
- u16 *src_pixels = get_packed_src_addr(frame_info, y);
- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst),
- stage_buffer->n_pixels);
+ u16 *pixels = (u16 *)src_pixels;
s64 fp_rb_ratio = drm_fixp_div(drm_int2fixp(65535), drm_int2fixp(31));
s64 fp_g_ratio = drm_fixp_div(drm_int2fixp(65535), drm_int2fixp(63));
- for (size_t x = 0; x < x_limit; x++, src_pixels++) {
- u16 rgb_565 = le16_to_cpu(*src_pixels);
- s64 fp_r = drm_int2fixp((rgb_565 >> 11) & 0x1f);
- s64 fp_g = drm_int2fixp((rgb_565 >> 5) & 0x3f);
- s64 fp_b = drm_int2fixp(rgb_565 & 0x1f);
+ u16 rgb_565 = le16_to_cpu(*pixels);
+ s64 fp_r = drm_int2fixp((rgb_565 >> 11) & 0x1f);
+ s64 fp_g = drm_int2fixp((rgb_565 >> 5) & 0x3f);
+ s64 fp_b = drm_int2fixp(rgb_565 & 0x1f);
- out_pixels[x].a = (u16)0xffff;
- out_pixels[x].r = drm_fixp2int(drm_fixp_mul(fp_r, fp_rb_ratio));
- out_pixels[x].g = drm_fixp2int(drm_fixp_mul(fp_g, fp_g_ratio));
- out_pixels[x].b = drm_fixp2int(drm_fixp_mul(fp_b, fp_rb_ratio));
- }
+ out_pixel->a = (u16)0xffff;
+ out_pixel->r = drm_fixp2int(drm_fixp_mul(fp_r, fp_rb_ratio));
+ out_pixel->g = drm_fixp2int(drm_fixp_mul(fp_g, fp_g_ratio));
+ out_pixel->b = drm_fixp2int(drm_fixp_mul(fp_b, fp_rb_ratio));
+}
+
+void vkms_compose_row(struct line_buffer *stage_buffer, struct vkms_plane_state *plane, int y)
+{
+ struct pixel_argb_u16 *out_pixels = stage_buffer->pixels;
+ struct vkms_frame_info *frame_info = plane->frame_info;
+ u8 *src_pixels = get_packed_src_addr(frame_info, y);
+ int limit = min_t(size_t, drm_rect_width(&frame_info->dst), stage_buffer->n_pixels);
+
+ for (size_t x = 0; x < limit; x++, src_pixels += frame_info->cpp)
+ plane->pixel_read(src_pixels, &out_pixels[x]);
}
/*
@@ -249,7 +224,7 @@ static void argb_u16_to_RGB565(struct vkms_frame_info *frame_info,
}
}
-void *get_frame_to_line_function(u32 format)
+void *get_pixel_conversion_function(u32 format)
{
switch (format) {
case DRM_FORMAT_ARGB8888:
diff --git a/drivers/gpu/drm/vkms/vkms_formats.h b/drivers/gpu/drm/vkms/vkms_formats.h
index 43b7c19790181..c5b113495d0c0 100644
--- a/drivers/gpu/drm/vkms/vkms_formats.h
+++ b/drivers/gpu/drm/vkms/vkms_formats.h
@@ -5,7 +5,7 @@
#include "vkms_drv.h"
-void *get_frame_to_line_function(u32 format);
+void *get_pixel_conversion_function(u32 format);
void *get_line_to_frame_function(u32 format);
diff --git a/drivers/gpu/drm/vkms/vkms_plane.c b/drivers/gpu/drm/vkms/vkms_plane.c
index c3a845220e10c..80e964589cecb 100644
--- a/drivers/gpu/drm/vkms/vkms_plane.c
+++ b/drivers/gpu/drm/vkms/vkms_plane.c
@@ -123,7 +123,7 @@ static void vkms_plane_atomic_update(struct drm_plane *plane,
frame_info->offset = fb->offsets[0];
frame_info->pitch = fb->pitches[0];
frame_info->cpp = fb->format->cpp[0];
- vkms_plane_state->plane_read = get_frame_to_line_function(fmt);
+ vkms_plane_state->pixel_read = get_pixel_conversion_function(fmt);
}
static int vkms_plane_atomic_check(struct drm_plane *plane,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 171/591] drm: Add fixed-point helper to get rounded integer values
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 170/591] drm/vkms: isolate pixel conversion functionality Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 172/591] drm/vkms: Fix RGB565 pixel conversion Greg Kroah-Hartman
` (423 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maíra Canal, Arthur Grillo,
Maíra Canal, Sasha Levin
From: Maíra Canal <mcanal@igalia.com>
[ Upstream commit 8b25320887d7feac98875546ea0f521628b745bb ]
Create a new fixed-point helper to allow us to return the rounded value
of our fixed point value.
[v2]:
* Create the function drm_fixp2int_round() (Melissa Wen).
[v3]:
* Use drm_fixp2int() instead of shifting manually (Arthur Grillo).
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Reviewed-by: Arthur Grillo <arthurgrillo@riseup.net>
Signed-off-by: Maíra Canal <mairacanal@riseup.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20230512104044.65034-1-mcanal@igalia.com
Stable-dep-of: ab87f558dcfb ("drm/vkms: Fix RGB565 pixel conversion")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/drm/drm_fixed.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h
index 553210c02ee0f..03cb890690e83 100644
--- a/include/drm/drm_fixed.h
+++ b/include/drm/drm_fixed.h
@@ -70,6 +70,7 @@ static inline u32 dfixed_div(fixed20_12 A, fixed20_12 B)
}
#define DRM_FIXED_POINT 32
+#define DRM_FIXED_POINT_HALF 16
#define DRM_FIXED_ONE (1ULL << DRM_FIXED_POINT)
#define DRM_FIXED_DECIMAL_MASK (DRM_FIXED_ONE - 1)
#define DRM_FIXED_DIGITS_MASK (~DRM_FIXED_DECIMAL_MASK)
@@ -86,6 +87,11 @@ static inline int drm_fixp2int(s64 a)
return ((s64)a) >> DRM_FIXED_POINT;
}
+static inline int drm_fixp2int_round(s64 a)
+{
+ return drm_fixp2int(a + (1 << (DRM_FIXED_POINT_HALF - 1)));
+}
+
static inline int drm_fixp2int_ceil(s64 a)
{
if (a > 0)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 172/591] drm/vkms: Fix RGB565 pixel conversion
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 171/591] drm: Add fixed-point helper to get rounded integer values Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 173/591] ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards Greg Kroah-Hartman
` (422 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maíra Canal, Arthur Grillo,
Maíra Canal, Sasha Levin
From: Maíra Canal <mcanal@igalia.com>
[ Upstream commit ab87f558dcfb2562c3497e89600dec798a446665 ]
Currently, the pixel conversion isn't rounding the fixed-point values
before assigning it to the RGB coefficients, which is causing the IGT
pixel-format tests to fail. So, use the drm_fixp2int_round() fixed-point
helper to round the values when assigning it to the RGB coefficients.
Tested with igt@kms_plane@pixel-format and igt@kms_plane@pixel-format-source-clamping.
[v2]:
* Use drm_fixp2int_round() to fix the pixel conversion instead of
casting the values to s32 (Melissa Wen).
Fixes: 89b03aeaef16 ("drm/vkms: fix 32bit compilation error by replacing macros")
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Reviewed-by: Arthur Grillo <arthurgrillo@riseup.net>
Signed-off-by: Maíra Canal <mairacanal@riseup.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20230512104044.65034-2-mcanal@igalia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vkms/vkms_formats.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/vkms/vkms_formats.c b/drivers/gpu/drm/vkms/vkms_formats.c
index 8d948c73741ef..b11342026485f 100644
--- a/drivers/gpu/drm/vkms/vkms_formats.c
+++ b/drivers/gpu/drm/vkms/vkms_formats.c
@@ -97,9 +97,9 @@ static void RGB565_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel)
s64 fp_b = drm_int2fixp(rgb_565 & 0x1f);
out_pixel->a = (u16)0xffff;
- out_pixel->r = drm_fixp2int(drm_fixp_mul(fp_r, fp_rb_ratio));
- out_pixel->g = drm_fixp2int(drm_fixp_mul(fp_g, fp_g_ratio));
- out_pixel->b = drm_fixp2int(drm_fixp_mul(fp_b, fp_rb_ratio));
+ out_pixel->r = drm_fixp2int_round(drm_fixp_mul(fp_r, fp_rb_ratio));
+ out_pixel->g = drm_fixp2int_round(drm_fixp_mul(fp_g, fp_g_ratio));
+ out_pixel->b = drm_fixp2int_round(drm_fixp_mul(fp_b, fp_rb_ratio));
}
void vkms_compose_row(struct line_buffer *stage_buffer, struct vkms_plane_state *plane, int y)
@@ -216,9 +216,9 @@ static void argb_u16_to_RGB565(struct vkms_frame_info *frame_info,
s64 fp_g = drm_int2fixp(in_pixels[x].g);
s64 fp_b = drm_int2fixp(in_pixels[x].b);
- u16 r = drm_fixp2int(drm_fixp_div(fp_r, fp_rb_ratio));
- u16 g = drm_fixp2int(drm_fixp_div(fp_g, fp_g_ratio));
- u16 b = drm_fixp2int(drm_fixp_div(fp_b, fp_rb_ratio));
+ u16 r = drm_fixp2int_round(drm_fixp_div(fp_r, fp_rb_ratio));
+ u16 g = drm_fixp2int_round(drm_fixp_div(fp_g, fp_g_ratio));
+ u16 b = drm_fixp2int_round(drm_fixp_div(fp_b, fp_rb_ratio));
*dst_pixels = cpu_to_le16(r << 11 | g << 5 | b);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 173/591] ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 172/591] drm/vkms: Fix RGB565 pixel conversion Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 174/591] bus: ti-sysc: Fix dispc quirk masking bool variables Greg Kroah-Hartman
` (421 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Alexandre Torgue,
Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit 9660efc2af37f3c12dc6e6a5511ad99e0addc297 ]
The ethernet MAC EEPROM is not populated on the SoM itself, it has to be
populated on each carrier board. Move the EEPROM into the correct place
in DTs, i.e. the carrier board DTs. Add label to the EEPROM too.
Fixes: 7e76f82acd9e1 ("ARM: dts: stm32: Split Avenger96 into DHCOR SoM and Avenger96 board")
Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 6 ++++++
arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi | 6 ++++++
arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi | 6 ------
3 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
index b6957cbdeff5f..2c246ac641533 100644
--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
+++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
@@ -322,6 +322,12 @@ adv7513_i2s0: endpoint {
};
};
};
+
+ dh_mac_eeprom: eeprom@53 {
+ compatible = "atmel,24c02";
+ reg = <0x53>;
+ pagesize = <16>;
+ };
};
<dc {
diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi
index 27477bb219ded..bb4ac6c13cbd3 100644
--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi
+++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi
@@ -192,6 +192,12 @@ eeprom@50 {
reg = <0x50>;
pagesize = <16>;
};
+
+ dh_mac_eeprom: eeprom@53 {
+ compatible = "atmel,24c02";
+ reg = <0x53>;
+ pagesize = <16>;
+ };
};
&sdmmc1 { /* MicroSD */
diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
index bb40fb46da81d..bba19f21e5277 100644
--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
+++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
@@ -213,12 +213,6 @@ watchdog {
status = "disabled";
};
};
-
- eeprom@53 {
- compatible = "atmel,24c02";
- reg = <0x53>;
- pagesize = <16>;
- };
};
&ipcc {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 174/591] bus: ti-sysc: Fix dispc quirk masking bool variables
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 173/591] ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 175/591] arm64: dts: microchip: sparx5: do not use PSCI on reference boards Greg Kroah-Hartman
` (420 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Tony Lindgren,
Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit f620596fa347170852da499e778a5736d79a4b79 ]
Fix warning drivers/bus/ti-sysc.c:1806 sysc_quirk_dispc()
warn: masking a bool.
While at it let's add a comment for what were doing to make
the code a bit easier to follow.
Fixes: 7324a7a0d5e2 ("bus: ti-sysc: Implement display subsystem reset quirk")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/linux-omap/a8ec8a68-9c2c-4076-bf47-09fccce7659f@kili.mountain/
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/ti-sysc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index 9a7d12332fadb..cae078bffc715 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -1808,7 +1808,7 @@ static u32 sysc_quirk_dispc(struct sysc *ddata, int dispc_offset,
if (!ddata->module_va)
return -EIO;
- /* DISP_CONTROL */
+ /* DISP_CONTROL, shut down lcd and digit on disable if enabled */
val = sysc_read(ddata, dispc_offset + 0x40);
lcd_en = val & lcd_en_mask;
digit_en = val & digit_en_mask;
@@ -1820,7 +1820,7 @@ static u32 sysc_quirk_dispc(struct sysc *ddata, int dispc_offset,
else
irq_mask |= BIT(2) | BIT(3); /* EVSYNC bits */
}
- if (disable & (lcd_en | digit_en))
+ if (disable && (lcd_en || digit_en))
sysc_write(ddata, dispc_offset + 0x40,
val & ~(lcd_en_mask | digit_en_mask));
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 175/591] arm64: dts: microchip: sparx5: do not use PSCI on reference boards
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 174/591] bus: ti-sysc: Fix dispc quirk masking bool variables Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 176/591] drm/bridge: tc358767: Switch to devm MIPI-DSI helpers Greg Kroah-Hartman
` (419 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Marko, Steen Hegelund,
Krzysztof Kozlowski, Sasha Levin
From: Robert Marko <robert.marko@sartura.hr>
[ Upstream commit 70be83708c925b3f72c508e4756e48ad2330c830 ]
PSCI is not implemented on SparX-5 at all, there is no ATF and U-boot that
is shipped does not implement it as well.
I have tried flashing the latest BSP 2022.12 U-boot which did not work.
After contacting Microchip, they confirmed that there is no ATF for the
SoC nor PSCI implementation which is unfortunate in 2023.
So, disable PSCI as otherwise kernel crashes as soon as it tries probing
PSCI with, and the crash is only visible if earlycon is used.
Since PSCI is not implemented, switch core bringup to use spin-tables
which are implemented in the vendor U-boot and actually work.
Tested on PCB134 with eMMC (VSC5640EV).
Fixes: 6694aee00a4b ("arm64: dts: sparx5: Add basic cpu support")
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Acked-by: Steen Hegelund <Steen.Hegelund@microchip.com>
Link: https://lore.kernel.org/r/20230221105039.316819-1-robert.marko@sartura.hr
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/microchip/sparx5.dtsi | 2 +-
arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi | 12 ++++++++++++
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/microchip/sparx5.dtsi b/arch/arm64/boot/dts/microchip/sparx5.dtsi
index 2dd5e38820b16..088d89801c276 100644
--- a/arch/arm64/boot/dts/microchip/sparx5.dtsi
+++ b/arch/arm64/boot/dts/microchip/sparx5.dtsi
@@ -61,7 +61,7 @@ arm-pmu {
interrupt-affinity = <&cpu0>, <&cpu1>;
};
- psci {
+ psci: psci {
compatible = "arm,psci-0.2";
method = "smc";
};
diff --git a/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi b/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi
index 9d1a082de3e29..32bb76b3202a0 100644
--- a/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi
+++ b/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi
@@ -6,6 +6,18 @@
/dts-v1/;
#include "sparx5.dtsi"
+&psci {
+ status = "disabled";
+};
+
+&cpu0 {
+ enable-method = "spin-table";
+};
+
+&cpu1 {
+ enable-method = "spin-table";
+};
+
&uart0 {
status = "okay";
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 176/591] drm/bridge: tc358767: Switch to devm MIPI-DSI helpers
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 175/591] arm64: dts: microchip: sparx5: do not use PSCI on reference boards Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 177/591] clk: imx: scu: use _safe list iterator to avoid a use after free Greg Kroah-Hartman
` (418 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Stein, Robert Foss,
Sasha Levin
From: Alexander Stein <alexander.stein@ew.tq-group.com>
[ Upstream commit f47d6140b7a4c858d82d263e7577ff6fb5279a9c ]
DSI device registering and attaching needs to be undone upon
deregistration. This fixes module unload/load.
Fixes: bbfd3190b656 ("drm/bridge: tc358767: Add DSI-to-DPI mode support")
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230517122107.1766673-1-alexander.stein@ew.tq-group.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358767.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index b9b681086fc49..7ef78283e3d3e 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -1890,7 +1890,7 @@ static int tc_mipi_dsi_host_attach(struct tc_data *tc)
if (dsi_lanes < 0)
return dsi_lanes;
- dsi = mipi_dsi_device_register_full(host, &info);
+ dsi = devm_mipi_dsi_device_register_full(dev, host, &info);
if (IS_ERR(dsi))
return dev_err_probe(dev, PTR_ERR(dsi),
"failed to create dsi device\n");
@@ -1901,7 +1901,7 @@ static int tc_mipi_dsi_host_attach(struct tc_data *tc)
dsi->format = MIPI_DSI_FMT_RGB888;
dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE;
- ret = mipi_dsi_attach(dsi);
+ ret = devm_mipi_dsi_attach(dev, dsi);
if (ret < 0) {
dev_err(dev, "failed to attach dsi to host: %d\n", ret);
return ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 177/591] clk: imx: scu: use _safe list iterator to avoid a use after free
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 176/591] drm/bridge: tc358767: Switch to devm MIPI-DSI helpers Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 178/591] hwmon: (f71882fg) prevent possible division by zero Greg Kroah-Hartman
` (417 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Abel Vesa,
Sasha Levin
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 632c60ecd25dbacee54d5581fe3aeb834b57010a ]
This loop is freeing "clk" so it needs to use list_for_each_entry_safe().
Otherwise it dereferences a freed variable to get the next item on the
loop.
Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://lore.kernel.org/r/0793fbd1-d2b5-4ec2-9403-3c39343a3e2d@kili.mountain
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk-scu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c
index 1e6870f3671f6..db307890e4c16 100644
--- a/drivers/clk/imx/clk-scu.c
+++ b/drivers/clk/imx/clk-scu.c
@@ -707,11 +707,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name,
void imx_clk_scu_unregister(void)
{
- struct imx_scu_clk_node *clk;
+ struct imx_scu_clk_node *clk, *n;
int i;
for (i = 0; i < IMX_SC_R_LAST; i++) {
- list_for_each_entry(clk, &imx_scu_clks[i], node) {
+ list_for_each_entry_safe(clk, n, &imx_scu_clks[i], node) {
clk_hw_unregister(clk->hw);
kfree(clk);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 178/591] hwmon: (f71882fg) prevent possible division by zero
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 177/591] clk: imx: scu: use _safe list iterator to avoid a use after free Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 179/591] RDMA/bnxt_re: Disable/kill tasklet only if it is enabled Greg Kroah-Hartman
` (416 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich, Guenter Roeck,
Sasha Levin
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit 0babf89c9cca7e074d6e59893e462e4886f481cc ]
In the unlikely event that something goes wrong with the device and
its registers, the fan_from_reg() function may return 0. This value
will cause a division-by-zero error in the show_pwm() function.
To prevent this, test the value of
fan_from_reg(data->fan_full_speed[nr]) against 0 before performing
the division. If the division-by-zero error is avoided, assign 0 to
the val variable.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: df9ec2dae094 ("hwmon: (f71882fg) Reorder symbols to get rid of a few forward declarations")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://lore.kernel.org/r/20230510143537.145060-1-n.zhandarovich@fintech.ru
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/f71882fg.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index 70121482a6173..27207ec6f7feb 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -1096,8 +1096,11 @@ static ssize_t show_pwm(struct device *dev,
val = data->pwm[nr];
else {
/* RPM mode */
- val = 255 * fan_from_reg(data->fan_target[nr])
- / fan_from_reg(data->fan_full_speed[nr]);
+ if (fan_from_reg(data->fan_full_speed[nr]))
+ val = 255 * fan_from_reg(data->fan_target[nr])
+ / fan_from_reg(data->fan_full_speed[nr]);
+ else
+ val = 0;
}
mutex_unlock(&data->update_lock);
return sprintf(buf, "%d\n", val);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 179/591] RDMA/bnxt_re: Disable/kill tasklet only if it is enabled
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 178/591] hwmon: (f71882fg) prevent possible division by zero Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 180/591] RDMA/bnxt_re: Fix to remove unnecessary return labels Greg Kroah-Hartman
` (415 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kalesh AP, Selvin Xavier,
Jason Gunthorpe, Sasha Levin
From: Selvin Xavier <selvin.xavier@broadcom.com>
[ Upstream commit ab112ee7899d6171da5acd77a7ed7ae103f488de ]
When the ulp hook to start the IRQ fails because the rings are not
available, tasklets are not enabled. In this case when the driver is
unloaded, driver calls CREQ tasklet_kill. This causes an indefinite hang
as the tasklet is not enabled.
Driver shouldn't call tasklet_kill if it is not enabled. So using the
creq->requested and nq->requested flags to identify if both tasklets/irqs
are registered. Checking this flag while scheduling the tasklet from
ISR. Also, added a cleanup for disabling tasklet, in case request_irq
fails during start_irq.
Check for return value for bnxt_qplib_rcfw_start_irq and in case the
bnxt_qplib_rcfw_start_irq fails, return bnxt_re_start_irq without
attempting to start NQ IRQs.
Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Link: https://lore.kernel.org/r/1684478897-12247-2-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/main.c | 12 +++++++++---
drivers/infiniband/hw/bnxt_re/qplib_fp.c | 16 ++++++++++------
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 14 +++++++++-----
3 files changed, 28 insertions(+), 14 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 8c0c80a8d3384..1589b1105f2ec 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -333,15 +333,21 @@ static void bnxt_re_start_irq(void *handle, struct bnxt_msix_entry *ent)
for (indx = 0; indx < rdev->num_msix; indx++)
rdev->msix_entries[indx].vector = ent[indx].vector;
- bnxt_qplib_rcfw_start_irq(rcfw, msix_ent[BNXT_RE_AEQ_IDX].vector,
- false);
+ rc = bnxt_qplib_rcfw_start_irq(rcfw, msix_ent[BNXT_RE_AEQ_IDX].vector,
+ false);
+ if (rc) {
+ ibdev_warn(&rdev->ibdev, "Failed to reinit CREQ\n");
+ return;
+ }
for (indx = BNXT_RE_NQ_IDX ; indx < rdev->num_msix; indx++) {
nq = &rdev->nq[indx - 1];
rc = bnxt_qplib_nq_start_irq(nq, indx - 1,
msix_ent[indx].vector, false);
- if (rc)
+ if (rc) {
ibdev_warn(&rdev->ibdev, "Failed to reinit NQ index %d\n",
indx - 1);
+ return;
+ }
}
}
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index ab2cc1c67f70b..a143bd3580a27 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -405,6 +405,9 @@ static irqreturn_t bnxt_qplib_nq_irq(int irq, void *dev_instance)
void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill)
{
+ if (!nq->requested)
+ return;
+
tasklet_disable(&nq->nq_tasklet);
/* Mask h/w interrupt */
bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, nq->res->cctx, false);
@@ -412,11 +415,10 @@ void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill)
synchronize_irq(nq->msix_vec);
if (kill)
tasklet_kill(&nq->nq_tasklet);
- if (nq->requested) {
- irq_set_affinity_hint(nq->msix_vec, NULL);
- free_irq(nq->msix_vec, nq);
- nq->requested = false;
- }
+
+ irq_set_affinity_hint(nq->msix_vec, NULL);
+ free_irq(nq->msix_vec, nq);
+ nq->requested = false;
}
void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq)
@@ -455,8 +457,10 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx,
snprintf(nq->name, sizeof(nq->name), "bnxt_qplib_nq-%d", nq_indx);
rc = request_irq(nq->msix_vec, bnxt_qplib_nq_irq, 0, nq->name, nq);
- if (rc)
+ if (rc) {
+ tasklet_disable(&nq->nq_tasklet);
return rc;
+ }
cpumask_clear(&nq->mask);
cpumask_set_cpu(nq_indx, &nq->mask);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 061b2895dd9b5..e28f0eb5b55d4 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -635,6 +635,10 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill)
struct bnxt_qplib_creq_ctx *creq;
creq = &rcfw->creq;
+
+ if (!creq->requested)
+ return;
+
tasklet_disable(&creq->creq_tasklet);
/* Mask h/w interrupts */
bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, false);
@@ -643,10 +647,8 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill)
if (kill)
tasklet_kill(&creq->creq_tasklet);
- if (creq->requested) {
- free_irq(creq->msix_vec, rcfw);
- creq->requested = false;
- }
+ free_irq(creq->msix_vec, rcfw);
+ creq->requested = false;
}
void bnxt_qplib_disable_rcfw_channel(struct bnxt_qplib_rcfw *rcfw)
@@ -692,8 +694,10 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector,
tasklet_enable(&creq->creq_tasklet);
rc = request_irq(creq->msix_vec, bnxt_qplib_creq_irq, 0,
"bnxt_qplib_creq", rcfw);
- if (rc)
+ if (rc) {
+ tasklet_disable(&creq->creq_tasklet);
return rc;
+ }
creq->requested = true;
bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, true);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 180/591] RDMA/bnxt_re: Fix to remove unnecessary return labels
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 179/591] RDMA/bnxt_re: Disable/kill tasklet only if it is enabled Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 181/591] RDMA/bnxt_re: Use unique names while registering interrupts Greg Kroah-Hartman
` (414 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kashyap Desai, Saravanan Vajravel,
Kalesh AP, Selvin Xavier, Jason Gunthorpe, Sasha Levin
From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
[ Upstream commit 9b3ee47796f529e5bc31a355d6cb756d68a7079a ]
If there is no cleanup needed then just return directly. This cleans up
the code and improve readability.
Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Link: https://lore.kernel.org/r/1684478897-12247-3-git-send-email-selvin.xavier@broadcom.com
Reviewed-by: Kashyap Desai <kashyap.desai@broadcom.com>
Reviewed-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/qplib_fp.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index a143bd3580a27..4abe1f59b3689 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -1605,7 +1605,7 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp,
il_src = (void *)wqe->sg_list[indx].addr;
t_len += len;
if (t_len > qp->max_inline_data)
- goto bad;
+ return -ENOMEM;
while (len) {
if (pull_dst) {
pull_dst = false;
@@ -1629,8 +1629,6 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp,
}
return t_len;
-bad:
- return -ENOMEM;
}
static u32 bnxt_qplib_put_sges(struct bnxt_qplib_hwq *hwq,
@@ -2060,7 +2058,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
hwq_attr.sginfo = &cq->sg_info;
rc = bnxt_qplib_alloc_init_hwq(&cq->hwq, &hwq_attr);
if (rc)
- goto exit;
+ return rc;
RCFW_CMD_PREP(req, CREATE_CQ, cmd_flags);
@@ -2101,7 +2099,6 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
fail:
bnxt_qplib_free_hwq(res, &cq->hwq);
-exit:
return rc;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 181/591] RDMA/bnxt_re: Use unique names while registering interrupts
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 180/591] RDMA/bnxt_re: Fix to remove unnecessary return labels Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 182/591] RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid Greg Kroah-Hartman
` (413 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bhargava Chenna Marreddy, Kalesh AP,
Selvin Xavier, Jason Gunthorpe, Sasha Levin
From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
[ Upstream commit ff2e4bfd162cf66a112a81509e419805add44d64 ]
bnxt_re currently uses the names "bnxt_qplib_creq" and "bnxt_qplib_nq-0"
while registering IRQs. There is no way to distinguish the IRQs of
different device ports when there are multiple IB devices registered.
This could make the scenarios worse where one want to pin IRQs of a device
port to certain CPUs.
Fixed the code to use unique names which has PCI BDF information while
registering interrupts like: "bnxt_re-nq-0@pci:0000:65:00.0" and
"bnxt_re-creq@pci:0000:65:00.1".
Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Link: https://lore.kernel.org/r/1684478897-12247-4-git-send-email-selvin.xavier@broadcom.com
Reviewed-by: Bhargava Chenna Marreddy <bhargava.marreddy@broadcom.com>
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/qplib_fp.c | 12 ++++++++++--
drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +-
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 15 +++++++++++++--
drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 1 +
4 files changed, 25 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 4abe1f59b3689..640d932bec376 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -418,6 +418,8 @@ void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill)
irq_set_affinity_hint(nq->msix_vec, NULL);
free_irq(nq->msix_vec, nq);
+ kfree(nq->name);
+ nq->name = NULL;
nq->requested = false;
}
@@ -444,6 +446,7 @@ void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq)
int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx,
int msix_vector, bool need_init)
{
+ struct bnxt_qplib_res *res = nq->res;
int rc;
if (nq->requested)
@@ -455,9 +458,14 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx,
else
tasklet_enable(&nq->nq_tasklet);
- snprintf(nq->name, sizeof(nq->name), "bnxt_qplib_nq-%d", nq_indx);
+ nq->name = kasprintf(GFP_KERNEL, "bnxt_re-nq-%d@pci:%s",
+ nq_indx, pci_name(res->pdev));
+ if (!nq->name)
+ return -ENOMEM;
rc = request_irq(nq->msix_vec, bnxt_qplib_nq_irq, 0, nq->name, nq);
if (rc) {
+ kfree(nq->name);
+ nq->name = NULL;
tasklet_disable(&nq->nq_tasklet);
return rc;
}
@@ -471,7 +479,7 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx,
nq->msix_vec, nq_indx);
}
nq->requested = true;
- bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, nq->res->cctx, true);
+ bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, res->cctx, true);
return rc;
}
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
index 0375019525431..f859710f9a7f4 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -471,7 +471,7 @@ typedef int (*srqn_handler_t)(struct bnxt_qplib_nq *nq,
struct bnxt_qplib_nq {
struct pci_dev *pdev;
struct bnxt_qplib_res *res;
- char name[32];
+ char *name;
struct bnxt_qplib_hwq hwq;
struct bnxt_qplib_nq_db nq_db;
u16 ring_id;
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index e28f0eb5b55d4..9c63b8b62edfc 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -648,6 +648,8 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill)
tasklet_kill(&creq->creq_tasklet);
free_irq(creq->msix_vec, rcfw);
+ kfree(creq->irq_name);
+ creq->irq_name = NULL;
creq->requested = false;
}
@@ -680,9 +682,11 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector,
bool need_init)
{
struct bnxt_qplib_creq_ctx *creq;
+ struct bnxt_qplib_res *res;
int rc;
creq = &rcfw->creq;
+ res = rcfw->res;
if (creq->requested)
return -EFAULT;
@@ -692,15 +696,22 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector,
tasklet_setup(&creq->creq_tasklet, bnxt_qplib_service_creq);
else
tasklet_enable(&creq->creq_tasklet);
+
+ creq->irq_name = kasprintf(GFP_KERNEL, "bnxt_re-creq@pci:%s",
+ pci_name(res->pdev));
+ if (!creq->irq_name)
+ return -ENOMEM;
rc = request_irq(creq->msix_vec, bnxt_qplib_creq_irq, 0,
- "bnxt_qplib_creq", rcfw);
+ creq->irq_name, rcfw);
if (rc) {
+ kfree(creq->irq_name);
+ creq->irq_name = NULL;
tasklet_disable(&creq->creq_tasklet);
return rc;
}
creq->requested = true;
- bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, true);
+ bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, res->cctx, true);
return 0;
}
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
index 0a3d8e7da3d42..b887e7fbad9ef 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -174,6 +174,7 @@ struct bnxt_qplib_creq_ctx {
u16 ring_id;
int msix_vec;
bool requested; /*irq handler installed */
+ char *irq_name;
};
/* RCFW Communication Channels */
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 182/591] RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 181/591] RDMA/bnxt_re: Use unique names while registering interrupts Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 183/591] RDMA/bnxt_re: Fix to remove an unnecessary log Greg Kroah-Hartman
` (412 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saravanan Vajravel,
Damodharam Ammepalli, Ajit Khaparde, Selvin Xavier, Kalesh AP,
Jason Gunthorpe, Sasha Levin
From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
[ Upstream commit b989f90cef0af48aa5679b6a75476371705ec53c ]
The NULL check inside bnxt_re_update_gid() always return false. If
sgid_tbl->tbl is not allocated, then dev_init would have failed.
Fixes: 5fac5b1b297f ("RDMA/bnxt_re: Add vlan tag for untagged RoCE traffic when PFC is configured")
Link: https://lore.kernel.org/r/1684478897-12247-5-git-send-email-selvin.xavier@broadcom.com
Reviewed-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
Reviewed-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/main.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 1589b1105f2ec..e58893387bb4d 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -1182,12 +1182,6 @@ static int bnxt_re_update_gid(struct bnxt_re_dev *rdev)
if (!ib_device_try_get(&rdev->ibdev))
return 0;
- if (!sgid_tbl) {
- ibdev_err(&rdev->ibdev, "QPLIB: SGID table not allocated");
- rc = -EINVAL;
- goto out;
- }
-
for (index = 0; index < sgid_tbl->active; index++) {
gid_idx = sgid_tbl->hw_id[index];
@@ -1205,7 +1199,7 @@ static int bnxt_re_update_gid(struct bnxt_re_dev *rdev)
rc = bnxt_qplib_update_sgid(sgid_tbl, &gid, gid_idx,
rdev->qplib_res.netdev->dev_addr);
}
-out:
+
ib_device_put(&rdev->ibdev);
return rc;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 183/591] RDMA/bnxt_re: Fix to remove an unnecessary log
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 182/591] RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 184/591] drm/msm/dsi: dont allow enabling 14nm VCO with unprogrammed rate Greg Kroah-Hartman
` (411 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kalesh AP, Selvin Xavier,
Jason Gunthorpe, Sasha Levin
From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
[ Upstream commit 43774bc156614346fe5dacabc8e8c229167f2536 ]
During destroy_qp, driver sets the qp handle in the existing CQEs
belonging to the QP being destroyed to NULL. As a result, a poll_cq after
destroy_qp can report unnecessary messages. Remove this noise from system
logs.
Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Link: https://lore.kernel.org/r/1684478897-12247-6-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/qplib_fp.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 640d932bec376..74d56900387a1 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -2734,11 +2734,8 @@ static int bnxt_qplib_cq_process_terminal(struct bnxt_qplib_cq *cq,
qp = (struct bnxt_qplib_qp *)((unsigned long)
le64_to_cpu(hwcqe->qp_handle));
- if (!qp) {
- dev_err(&cq->hwq.pdev->dev,
- "FP: CQ Process terminal qp is NULL\n");
+ if (!qp)
return -EINVAL;
- }
/* Must block new posting of SQ and RQ */
qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 184/591] drm/msm/dsi: dont allow enabling 14nm VCO with unprogrammed rate
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 183/591] RDMA/bnxt_re: Fix to remove an unnecessary log Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 185/591] drm/msm/disp/dpu: get timing engine status from intf status register Greg Kroah-Hartman
` (410 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Vladimir Zapolskiy, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 1e0a97f84d73ea1182740f62069690c7f3271abb ]
If the dispcc uses CLK_OPS_PARENT_ENABLE (e.g. on QCM2290), CCF can try
enabling VCO before the rate has been programmed. This can cause clock
lockups and/or other boot issues. Program the VCO to the minimal PLL
rate if the read rate is 0 Hz.
Cc: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reported-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Reported-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Fixes: f079f6d999cb ("drm/msm/dsi: Add PHY/PLL for 8x96")
Patchwork: https://patchwork.freedesktop.org/patch/534813/
Link: https://lore.kernel.org/r/20230501011257.3460103-1-dmitry.baryshkov@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
index 0f8f4ca464291..f0780c40b379a 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
@@ -539,6 +539,9 @@ static int dsi_pll_14nm_vco_prepare(struct clk_hw *hw)
if (unlikely(pll_14nm->phy->pll_on))
return 0;
+ if (dsi_pll_14nm_vco_recalc_rate(hw, VCO_REF_CLK_RATE) == 0)
+ dsi_pll_14nm_vco_set_rate(hw, pll_14nm->phy->cfg->min_pll_rate, VCO_REF_CLK_RATE);
+
dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_VREF_CFG1, 0x10);
dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_PLL_CNTRL, 1);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 185/591] drm/msm/disp/dpu: get timing engine status from intf status register
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 184/591] drm/msm/dsi: dont allow enabling 14nm VCO with unprogrammed rate Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 186/591] drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK Greg Kroah-Hartman
` (409 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vinod Polimera, Dmitry Baryshkov,
Sasha Levin
From: Vinod Polimera <quic_vpolimer@quicinc.com>
[ Upstream commit e3969eadc8ee78a5bdca65b8ed0a421a359e4090 ]
Recommended way of reading the interface timing gen status is via
status register. Timing gen status register will give a reliable status
of the interface especially during ON/OFF transitions. This support was
added from DPU version 5.0.0.
Signed-off-by: Vinod Polimera <quic_vpolimer@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/524724/
Link: https://lore.kernel.org/r/1677774797-31063-6-git-send-email-quic_vpolimer@quicinc.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Stable-dep-of: a7129231edf3 ("drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 3 ++-
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 12 +++++++-----
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 8 +++++++-
3 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
index 32a3c42ec45b1..715c7a254632b 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
@@ -79,7 +79,8 @@
#define INTF_SDM845_MASK (0)
-#define INTF_SC7180_MASK BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE)
+#define INTF_SC7180_MASK \
+ (BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE) | BIT(DPU_INTF_STATUS_SUPPORTED))
#define INTF_SC7280_MASK INTF_SC7180_MASK | BIT(DPU_DATA_HCTL_EN)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
index 38aa38ab15685..77c46ce5a22f9 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
@@ -203,17 +203,19 @@ enum {
/**
* INTF sub-blocks
- * @DPU_INTF_INPUT_CTRL Supports the setting of pp block from which
- * pixel data arrives to this INTF
- * @DPU_INTF_TE INTF block has TE configuration support
- * @DPU_DATA_HCTL_EN Allows data to be transferred at different rate
- than video timing
+ * @DPU_INTF_INPUT_CTRL Supports the setting of pp block from which
+ * pixel data arrives to this INTF
+ * @DPU_INTF_TE INTF block has TE configuration support
+ * @DPU_DATA_HCTL_EN Allows data to be transferred at different rate
+ * than video timing
+ * @DPU_INTF_STATUS_SUPPORTED INTF block has INTF_STATUS register
* @DPU_INTF_MAX
*/
enum {
DPU_INTF_INPUT_CTRL = 0x1,
DPU_INTF_TE,
DPU_DATA_HCTL_EN,
+ DPU_INTF_STATUS_SUPPORTED,
DPU_INTF_MAX
};
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
index b2a94b9a3e987..b9dddf576c029 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
@@ -57,6 +57,7 @@
#define INTF_PROG_FETCH_START 0x170
#define INTF_PROG_ROT_START 0x174
#define INTF_MUX 0x25C
+#define INTF_STATUS 0x26C
#define INTF_CFG_ACTIVE_H_EN BIT(29)
#define INTF_CFG_ACTIVE_V_EN BIT(30)
@@ -292,8 +293,13 @@ static void dpu_hw_intf_get_status(
struct intf_status *s)
{
struct dpu_hw_blk_reg_map *c = &intf->hw;
+ unsigned long cap = intf->cap->features;
+
+ if (cap & BIT(DPU_INTF_STATUS_SUPPORTED))
+ s->is_en = DPU_REG_READ(c, INTF_STATUS) & BIT(0);
+ else
+ s->is_en = DPU_REG_READ(c, INTF_TIMING_ENGINE_EN);
- s->is_en = DPU_REG_READ(c, INTF_TIMING_ENGINE_EN);
s->is_prog_fetch_en = !!(DPU_REG_READ(c, INTF_CONFIG) & BIT(31));
if (s->is_en) {
s->frame_count = DPU_REG_READ(c, INTF_FRAME_COUNT);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 186/591] drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 185/591] drm/msm/disp/dpu: get timing engine status from intf status register Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 187/591] iommu/virtio: Detach domain on endpoint release Greg Kroah-Hartman
` (408 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Marijn Suijten,
Konrad Dybcio, Abhinav Kumar, Sasha Levin
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit a7129231edf329a00e92dbd2d741f6da728a4a06 ]
DPU5 and newer targets enable this unconditionally. Move it from the
SC7280 mask to the SC7180 one.
Fixes: 7e6ee55320f0 ("drm/msm/disp/dpu1: enable DATA_HCTL_EN for sc7280 target")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/538159/
Link: https://lore.kernel.org/r/20230508-topic-hctl_en-v2-1-e7bea9f1f5dd@linaro.org
[DB: removed BIT(DPU_INTF_DATA_COMPRESS), which is not yet merged]
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
index 715c7a254632b..80e59d3f9dd3e 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
@@ -80,9 +80,12 @@
#define INTF_SDM845_MASK (0)
#define INTF_SC7180_MASK \
- (BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE) | BIT(DPU_INTF_STATUS_SUPPORTED))
+ (BIT(DPU_INTF_INPUT_CTRL) | \
+ BIT(DPU_INTF_TE) | \
+ BIT(DPU_INTF_STATUS_SUPPORTED) | \
+ BIT(DPU_DATA_HCTL_EN))
-#define INTF_SC7280_MASK INTF_SC7180_MASK | BIT(DPU_DATA_HCTL_EN)
+#define INTF_SC7280_MASK (INTF_SC7180_MASK)
#define IRQ_SDM845_MASK (BIT(MDP_SSPP_TOP0_INTR) | \
BIT(MDP_SSPP_TOP0_INTR2) | \
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 187/591] iommu/virtio: Detach domain on endpoint release
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 186/591] drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 188/591] iommu/virtio: Return size mapped for a detached domain Greg Kroah-Hartman
` (407 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akihiko Odaki, Jean-Philippe Brucker,
Joerg Roedel, Sasha Levin
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
[ Upstream commit 809d0810e3520da669d231303608cdf5fe5c1a70 ]
When an endpoint is released, for example a PCIe VF being destroyed or a
function hot-unplugged, it should be detached from its domain. Send a
DETACH request.
Fixes: edcd69ab9a32 ("iommu: Add virtio-iommu driver")
Reported-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Link: https://lore.kernel.org/all/15bf1b00-3aa0-973a-3a86-3fa5c4d41d2c@daynix.com/
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Tested-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Link: https://lore.kernel.org/r/20230515113946.1017624-2-jean-philippe@linaro.org
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/virtio-iommu.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
index 8b1b5c270e502..fe02ac772b651 100644
--- a/drivers/iommu/virtio-iommu.c
+++ b/drivers/iommu/virtio-iommu.c
@@ -789,6 +789,29 @@ static int viommu_attach_dev(struct iommu_domain *domain, struct device *dev)
return 0;
}
+static void viommu_detach_dev(struct viommu_endpoint *vdev)
+{
+ int i;
+ struct virtio_iommu_req_detach req;
+ struct viommu_domain *vdomain = vdev->vdomain;
+ struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(vdev->dev);
+
+ if (!vdomain)
+ return;
+
+ req = (struct virtio_iommu_req_detach) {
+ .head.type = VIRTIO_IOMMU_T_DETACH,
+ .domain = cpu_to_le32(vdomain->id),
+ };
+
+ for (i = 0; i < fwspec->num_ids; i++) {
+ req.endpoint = cpu_to_le32(fwspec->ids[i]);
+ WARN_ON(viommu_send_req_sync(vdev->viommu, &req, sizeof(req)));
+ }
+ vdomain->nr_endpoints--;
+ vdev->vdomain = NULL;
+}
+
static int viommu_map_pages(struct iommu_domain *domain, unsigned long iova,
phys_addr_t paddr, size_t pgsize, size_t pgcount,
int prot, gfp_t gfp, size_t *mapped)
@@ -991,6 +1014,7 @@ static void viommu_release_device(struct device *dev)
{
struct viommu_endpoint *vdev = dev_iommu_priv_get(dev);
+ viommu_detach_dev(vdev);
iommu_put_resv_regions(dev, &vdev->resv_regions);
kfree(vdev);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 188/591] iommu/virtio: Return size mapped for a detached domain
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 187/591] iommu/virtio: Detach domain on endpoint release Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 189/591] clk: renesas: rzg2l: Fix CPG_SIPLL5_CLK1 register write Greg Kroah-Hartman
` (406 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Philippe Brucker,
Jason Gunthorpe, Joerg Roedel, Sasha Levin
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
[ Upstream commit 7061b6af34686e7e2364b7240cfb061293218f2d ]
When map() is called on a detached domain, the domain does not exist in
the device so we do not send a MAP request, but we do update the
internal mapping tree, to be replayed on the next attach. Since this
constitutes a successful iommu_map() call, return *mapped in this case
too.
Fixes: 7e62edd7a33a ("iommu/virtio: Add map/unmap_pages() callbacks implementation")
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20230515113946.1017624-3-jean-philippe@linaro.org
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/virtio-iommu.c | 33 +++++++++++++++++----------------
1 file changed, 17 insertions(+), 16 deletions(-)
diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
index fe02ac772b651..fd86ccb709ec5 100644
--- a/drivers/iommu/virtio-iommu.c
+++ b/drivers/iommu/virtio-iommu.c
@@ -834,25 +834,26 @@ static int viommu_map_pages(struct iommu_domain *domain, unsigned long iova,
if (ret)
return ret;
- map = (struct virtio_iommu_req_map) {
- .head.type = VIRTIO_IOMMU_T_MAP,
- .domain = cpu_to_le32(vdomain->id),
- .virt_start = cpu_to_le64(iova),
- .phys_start = cpu_to_le64(paddr),
- .virt_end = cpu_to_le64(end),
- .flags = cpu_to_le32(flags),
- };
-
- if (!vdomain->nr_endpoints)
- return 0;
+ if (vdomain->nr_endpoints) {
+ map = (struct virtio_iommu_req_map) {
+ .head.type = VIRTIO_IOMMU_T_MAP,
+ .domain = cpu_to_le32(vdomain->id),
+ .virt_start = cpu_to_le64(iova),
+ .phys_start = cpu_to_le64(paddr),
+ .virt_end = cpu_to_le64(end),
+ .flags = cpu_to_le32(flags),
+ };
- ret = viommu_send_req_sync(vdomain->viommu, &map, sizeof(map));
- if (ret)
- viommu_del_mappings(vdomain, iova, end);
- else if (mapped)
+ ret = viommu_send_req_sync(vdomain->viommu, &map, sizeof(map));
+ if (ret) {
+ viommu_del_mappings(vdomain, iova, end);
+ return ret;
+ }
+ }
+ if (mapped)
*mapped = size;
- return ret;
+ return 0;
}
static size_t viommu_unmap_pages(struct iommu_domain *domain, unsigned long iova,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 189/591] clk: renesas: rzg2l: Fix CPG_SIPLL5_CLK1 register write
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 188/591] iommu/virtio: Return size mapped for a detached domain Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 190/591] ARM: dts: gta04: Move model property out of pinctrl node Greg Kroah-Hartman
` (405 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Biju Das, Geert Uytterhoeven,
Sasha Levin
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit d1c20885d3b01e6a62e920af4b227abd294d22f3 ]
As per the RZ/G2L HW(Rev.1.30 May2023) manual, there are no "write enable"
bits in the CPG_SIPLL5_CLK1 register. So fix the CPG_SIPLL5_CLK register
write by removing the "write enable" bits.
Fixes: 1561380ee72f ("clk: renesas: rzg2l: Add FOUTPOSTDIV clk support")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20230518152334.514922-1-biju.das.jz@bp.renesas.com
[geert: Remove CPG_SIPLL5_CLK1_*_WEN bit definitions]
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/rzg2l-cpg.c | 6 ++----
drivers/clk/renesas/rzg2l-cpg.h | 3 ---
2 files changed, 2 insertions(+), 7 deletions(-)
diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
index 3ff6ecd617565..2c877576c5729 100644
--- a/drivers/clk/renesas/rzg2l-cpg.c
+++ b/drivers/clk/renesas/rzg2l-cpg.c
@@ -600,10 +600,8 @@ static int rzg2l_cpg_sipll5_set_rate(struct clk_hw *hw,
}
/* Output clock setting 1 */
- writel(CPG_SIPLL5_CLK1_POSTDIV1_WEN | CPG_SIPLL5_CLK1_POSTDIV2_WEN |
- CPG_SIPLL5_CLK1_REFDIV_WEN | (params.pl5_postdiv1 << 0) |
- (params.pl5_postdiv2 << 4) | (params.pl5_refdiv << 8),
- priv->base + CPG_SIPLL5_CLK1);
+ writel((params.pl5_postdiv1 << 0) | (params.pl5_postdiv2 << 4) |
+ (params.pl5_refdiv << 8), priv->base + CPG_SIPLL5_CLK1);
/* Output clock setting, SSCG modulation value setting 3 */
writel((params.pl5_fracin << 8), priv->base + CPG_SIPLL5_CLK3);
diff --git a/drivers/clk/renesas/rzg2l-cpg.h b/drivers/clk/renesas/rzg2l-cpg.h
index cecbdf5e4f93a..b33a3e79161b6 100644
--- a/drivers/clk/renesas/rzg2l-cpg.h
+++ b/drivers/clk/renesas/rzg2l-cpg.h
@@ -32,9 +32,6 @@
#define CPG_SIPLL5_STBY_RESETB_WEN BIT(16)
#define CPG_SIPLL5_STBY_SSCG_EN_WEN BIT(18)
#define CPG_SIPLL5_STBY_DOWNSPREAD_WEN BIT(20)
-#define CPG_SIPLL5_CLK1_POSTDIV1_WEN BIT(16)
-#define CPG_SIPLL5_CLK1_POSTDIV2_WEN BIT(20)
-#define CPG_SIPLL5_CLK1_REFDIV_WEN BIT(24)
#define CPG_SIPLL5_CLK4_RESV_LSB (0xFF)
#define CPG_SIPLL5_MON_PLL5_LOCK BIT(4)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 190/591] ARM: dts: gta04: Move model property out of pinctrl node
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 189/591] clk: renesas: rzg2l: Fix CPG_SIPLL5_CLK1 register write Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 191/591] drm/bridge: anx7625: Convert to i2cs .probe_new() Greg Kroah-Hartman
` (404 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Kemnade,
H. Nikolaus Schaller, Tony Lindgren, Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 4ffec92e70ac5097b9f67ec154065305b16a3b46 ]
The model property should be at the top level, let's move it out
of the pinctrl node.
Fixes: d2eaf949d2c3 ("ARM: dts: omap3-gta04a5one: define GTA04A5 variant with OneNAND")
Cc: Andreas Kemnade <andreas@kemnade.info>
Cc: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/omap3-gta04a5one.dts | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/omap3-gta04a5one.dts b/arch/arm/boot/dts/omap3-gta04a5one.dts
index 9db9fe67cd63b..95df45cc70c09 100644
--- a/arch/arm/boot/dts/omap3-gta04a5one.dts
+++ b/arch/arm/boot/dts/omap3-gta04a5one.dts
@@ -5,9 +5,11 @@
#include "omap3-gta04a5.dts"
-&omap3_pmx_core {
+/ {
model = "Goldelico GTA04A5/Letux 2804 with OneNAND";
+};
+&omap3_pmx_core {
gpmc_pins: pinmux_gpmc_pins {
pinctrl-single,pins = <
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 191/591] drm/bridge: anx7625: Convert to i2cs .probe_new()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 190/591] ARM: dts: gta04: Move model property out of pinctrl node Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 192/591] drm/bridge: anx7625: Prevent endless probe loop Greg Kroah-Hartman
` (403 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Laurent Pinchart, Robert Foss, Sasha Levin
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 71450f8c824f5571d4af9e6e021b733085c8e690 ]
The probe function doesn't make use of the i2c_device_id * parameter so it
can be trivially converted.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Link: https://lore.kernel.org/r/20221118224540.619276-18-uwe@kleine-koenig.org
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Stable-dep-of: 1464e48d69ab ("drm/bridge: anx7625: Prevent endless probe loop")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/analogix/anx7625.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
index b0ff1ecb80a50..86a52c5f4fbc4 100644
--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
@@ -2562,8 +2562,7 @@ static void anx7625_runtime_disable(void *data)
pm_runtime_disable(data);
}
-static int anx7625_i2c_probe(struct i2c_client *client,
- const struct i2c_device_id *id)
+static int anx7625_i2c_probe(struct i2c_client *client)
{
struct anx7625_data *platform;
struct anx7625_platform_data *pdata;
@@ -2756,7 +2755,7 @@ static struct i2c_driver anx7625_driver = {
.of_match_table = anx_match_table,
.pm = &anx7625_pm_ops,
},
- .probe = anx7625_i2c_probe,
+ .probe_new = anx7625_i2c_probe,
.remove = anx7625_i2c_remove,
.id_table = anx7625_id,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 192/591] drm/bridge: anx7625: Prevent endless probe loop
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 191/591] drm/bridge: anx7625: Convert to i2cs .probe_new() Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 193/591] ARM: dts: qcom: msm8974: do not use underscore in node name (again) Greg Kroah-Hartman
` (402 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernelci.org bot,
Nícolas F . R . A . Prado, Robert Foss, Sasha Levin
From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
[ Upstream commit 1464e48d69ab7a50a377c9d39f5e5eb3cee2722e ]
During probe, the driver registers i2c dummy devices and populates the
aux bus, which registers a device for the panel. After doing that, the
driver can still defer probe if needed. This ordering of operations is
troublesome however, because the deferred probe work will retry probing
all pending devices every time a new device is registered. Therefore, if
modules need to be loaded in order to satisfy the dependencies for this
driver to complete probe, the kernel will stall, since it'll keep trying
to probe the anx7625 driver, but never succeed, given that modules would
only be loaded after the deferred probe work completes.
Two changes are required to avoid this issue:
* Move of_find_mipi_dsi_host_by_node(), which can defer probe, to before
anx7625_register_i2c_dummy_clients() and
devm_of_dp_aux_populate_ep_devices(), which register devices.
* Make use of the done_probing callback when populating the aux bus,
so that the bridge registration is only done after the panel is
probed. This is required because the panel might need to defer probe,
but the aux bus population needs the i2c dummy devices working, so
this call couldn't just be moved to an earlier point in probe.
One caveat is that if the panel is described outside the aux bus, the
probe loop issue can still happen, but we don't have a way to avoid
it in that case since there's no callback available.
With this patch applied, it's possible to boot on
mt8192-asurada-spherion with
CONFIG_DRM_ANALOGIX_ANX7625=y
CONFIG_MTK_MMSYS=m
CONFIG_BACKLIGHT_PWM=y
and also with
CONFIG_DRM_ANALOGIX_ANX7625=y
CONFIG_MTK_MMSYS=y
CONFIG_BACKLIGHT_PWM=m
Fixes: adca62ec370c ("drm/bridge: anx7625: Support reading edid through aux channel")
Fixes: 269332997a16 ("drm/bridge: anx7625: Return -EPROBE_DEFER if the dsi host was not found")
Reported-by: "kernelci.org bot" <bot@kernelci.org>
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230518193902.891121-1-nfraprado@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/analogix/anx7625.c | 128 +++++++++++++++-------
1 file changed, 88 insertions(+), 40 deletions(-)
diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
index 86a52c5f4fbc4..213263ad6a064 100644
--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
@@ -1689,6 +1689,14 @@ static int anx7625_parse_dt(struct device *dev,
if (of_property_read_bool(np, "analogix,audio-enable"))
pdata->audio_en = 1;
+ return 0;
+}
+
+static int anx7625_parse_dt_panel(struct device *dev,
+ struct anx7625_platform_data *pdata)
+{
+ struct device_node *np = dev->of_node;
+
pdata->panel_bridge = devm_drm_of_get_bridge(dev, np, 1, 0);
if (IS_ERR(pdata->panel_bridge)) {
if (PTR_ERR(pdata->panel_bridge) == -ENODEV) {
@@ -2034,7 +2042,7 @@ static int anx7625_register_audio(struct device *dev, struct anx7625_data *ctx)
return 0;
}
-static int anx7625_attach_dsi(struct anx7625_data *ctx)
+static int anx7625_setup_dsi_device(struct anx7625_data *ctx)
{
struct mipi_dsi_device *dsi;
struct device *dev = &ctx->client->dev;
@@ -2044,9 +2052,6 @@ static int anx7625_attach_dsi(struct anx7625_data *ctx)
.channel = 0,
.node = NULL,
};
- int ret;
-
- DRM_DEV_DEBUG_DRIVER(dev, "attach dsi\n");
host = of_find_mipi_dsi_host_by_node(ctx->pdata.mipi_host_node);
if (!host) {
@@ -2067,14 +2072,24 @@ static int anx7625_attach_dsi(struct anx7625_data *ctx)
MIPI_DSI_MODE_VIDEO_HSE |
MIPI_DSI_HS_PKT_END_ALIGNED;
- ret = devm_mipi_dsi_attach(dev, dsi);
+ ctx->dsi = dsi;
+
+ return 0;
+}
+
+static int anx7625_attach_dsi(struct anx7625_data *ctx)
+{
+ struct device *dev = &ctx->client->dev;
+ int ret;
+
+ DRM_DEV_DEBUG_DRIVER(dev, "attach dsi\n");
+
+ ret = devm_mipi_dsi_attach(dev, ctx->dsi);
if (ret) {
DRM_DEV_ERROR(dev, "fail to attach dsi to host.\n");
return ret;
}
- ctx->dsi = dsi;
-
DRM_DEV_DEBUG_DRIVER(dev, "attach dsi succeeded.\n");
return 0;
@@ -2562,6 +2577,40 @@ static void anx7625_runtime_disable(void *data)
pm_runtime_disable(data);
}
+static int anx7625_link_bridge(struct drm_dp_aux *aux)
+{
+ struct anx7625_data *platform = container_of(aux, struct anx7625_data, aux);
+ struct device *dev = aux->dev;
+ int ret;
+
+ ret = anx7625_parse_dt_panel(dev, &platform->pdata);
+ if (ret) {
+ DRM_DEV_ERROR(dev, "fail to parse DT for panel : %d\n", ret);
+ return ret;
+ }
+
+ platform->bridge.funcs = &anx7625_bridge_funcs;
+ platform->bridge.of_node = dev->of_node;
+ if (!anx7625_of_panel_on_aux_bus(dev))
+ platform->bridge.ops |= DRM_BRIDGE_OP_EDID;
+ if (!platform->pdata.panel_bridge)
+ platform->bridge.ops |= DRM_BRIDGE_OP_HPD |
+ DRM_BRIDGE_OP_DETECT;
+ platform->bridge.type = platform->pdata.panel_bridge ?
+ DRM_MODE_CONNECTOR_eDP :
+ DRM_MODE_CONNECTOR_DisplayPort;
+
+ drm_bridge_add(&platform->bridge);
+
+ if (!platform->pdata.is_dpi) {
+ ret = anx7625_attach_dsi(platform);
+ if (ret)
+ drm_bridge_remove(&platform->bridge);
+ }
+
+ return ret;
+}
+
static int anx7625_i2c_probe(struct i2c_client *client)
{
struct anx7625_data *platform;
@@ -2636,6 +2685,24 @@ static int anx7625_i2c_probe(struct i2c_client *client)
platform->aux.wait_hpd_asserted = anx7625_wait_hpd_asserted;
drm_dp_aux_init(&platform->aux);
+ ret = anx7625_parse_dt(dev, pdata);
+ if (ret) {
+ if (ret != -EPROBE_DEFER)
+ DRM_DEV_ERROR(dev, "fail to parse DT : %d\n", ret);
+ goto free_wq;
+ }
+
+ if (!platform->pdata.is_dpi) {
+ ret = anx7625_setup_dsi_device(platform);
+ if (ret < 0)
+ goto free_wq;
+ }
+
+ /*
+ * Registering the i2c devices will retrigger deferred probe, so it
+ * needs to be done after calls that might return EPROBE_DEFER,
+ * otherwise we can get an infinite loop.
+ */
if (anx7625_register_i2c_dummy_clients(platform, client) != 0) {
ret = -ENOMEM;
DRM_DEV_ERROR(dev, "fail to reserve I2C bus.\n");
@@ -2650,13 +2717,21 @@ static int anx7625_i2c_probe(struct i2c_client *client)
if (ret)
goto free_wq;
- devm_of_dp_aux_populate_ep_devices(&platform->aux);
-
- ret = anx7625_parse_dt(dev, pdata);
+ /*
+ * Populating the aux bus will retrigger deferred probe, so it needs to
+ * be done after calls that might return EPROBE_DEFER, otherwise we can
+ * get an infinite loop.
+ */
+ ret = devm_of_dp_aux_populate_bus(&platform->aux, anx7625_link_bridge);
if (ret) {
- if (ret != -EPROBE_DEFER)
- DRM_DEV_ERROR(dev, "fail to parse DT : %d\n", ret);
- goto free_wq;
+ if (ret != -ENODEV) {
+ DRM_DEV_ERROR(dev, "failed to populate aux bus : %d\n", ret);
+ goto free_wq;
+ }
+
+ ret = anx7625_link_bridge(&platform->aux);
+ if (ret)
+ goto free_wq;
}
if (!platform->pdata.low_power_mode) {
@@ -2669,27 +2744,6 @@ static int anx7625_i2c_probe(struct i2c_client *client)
if (platform->pdata.intp_irq)
queue_work(platform->workqueue, &platform->work);
- platform->bridge.funcs = &anx7625_bridge_funcs;
- platform->bridge.of_node = client->dev.of_node;
- if (!anx7625_of_panel_on_aux_bus(&client->dev))
- platform->bridge.ops |= DRM_BRIDGE_OP_EDID;
- if (!platform->pdata.panel_bridge)
- platform->bridge.ops |= DRM_BRIDGE_OP_HPD |
- DRM_BRIDGE_OP_DETECT;
- platform->bridge.type = platform->pdata.panel_bridge ?
- DRM_MODE_CONNECTOR_eDP :
- DRM_MODE_CONNECTOR_DisplayPort;
-
- drm_bridge_add(&platform->bridge);
-
- if (!platform->pdata.is_dpi) {
- ret = anx7625_attach_dsi(platform);
- if (ret) {
- DRM_DEV_ERROR(dev, "Fail to attach to dsi : %d\n", ret);
- goto unregister_bridge;
- }
- }
-
if (platform->pdata.audio_en)
anx7625_register_audio(dev, platform);
@@ -2697,12 +2751,6 @@ static int anx7625_i2c_probe(struct i2c_client *client)
return 0;
-unregister_bridge:
- drm_bridge_remove(&platform->bridge);
-
- if (!platform->pdata.low_power_mode)
- pm_runtime_put_sync_suspend(&client->dev);
-
free_wq:
if (platform->workqueue)
destroy_workqueue(platform->workqueue);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 193/591] ARM: dts: qcom: msm8974: do not use underscore in node name (again)
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 192/591] drm/bridge: anx7625: Prevent endless probe loop Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 194/591] arm64: dts: qcom: msm8916: correct camss unit address Greg Kroah-Hartman
` (401 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 311bbc884b2edcf584b67d331be85ce43b27586f ]
Align RPM requests node with DT schema by using hyphen instead of
underscore.
Fixes: f300826d27be ("ARM: dts: qcom-msm8974: Sort and clean up nodes")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230410175232.22317-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/qcom-msm8974.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/qcom-msm8974.dtsi b/arch/arm/boot/dts/qcom-msm8974.dtsi
index 7a9be0acf3f5a..c4b2e9ac24940 100644
--- a/arch/arm/boot/dts/qcom-msm8974.dtsi
+++ b/arch/arm/boot/dts/qcom-msm8974.dtsi
@@ -300,7 +300,7 @@ rpm {
qcom,ipc = <&apcs 8 0>;
qcom,smd-edge = <15>;
- rpm_requests: rpm_requests {
+ rpm_requests: rpm-requests {
compatible = "qcom,rpm-msm8974";
qcom,smd-channels = "rpm_requests";
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 194/591] arm64: dts: qcom: msm8916: correct camss unit address
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 193/591] ARM: dts: qcom: msm8974: do not use underscore in node name (again) Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 195/591] arm64: dts: qcom: msm8916: correct MMC " Greg Kroah-Hartman
` (400 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 48798d992ce276cf0d57bf75318daf8eabd02aa4 ]
Match unit-address to reg entry to fix dtbs W=1 warnings:
Warning (simple_bus_reg): /soc@0/camss@1b00000: simple-bus unit address format error, expected "1b0ac00"
Fixes: 58f479f90a7c ("arm64: dts: qcom: msm8916: Add CAMSS support")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230419211856.79332-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
index 9743cb270639d..99aa9b4dce8aa 100644
--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
@@ -1088,7 +1088,7 @@ dsi_phy0: dsi-phy@1a98300 {
};
};
- camss: camss@1b00000 {
+ camss: camss@1b0ac00 {
compatible = "qcom,msm8916-camss";
reg = <0x01b0ac00 0x200>,
<0x01b00030 0x4>,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 195/591] arm64: dts: qcom: msm8916: correct MMC unit address
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 194/591] arm64: dts: qcom: msm8916: correct camss unit address Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 196/591] arm64: dts: qcom: msm8994: correct SPMI " Greg Kroah-Hartman
` (399 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 72644bc76d5145c098c268829554a0b98fab1de1 ]
Match unit-address to reg entry to fix dtbs W=1 warnings:
Warning (simple_bus_reg): /soc@0/mmc@7824000: simple-bus unit address format error, expected "7824900"
Warning (simple_bus_reg): /soc@0/mmc@7864000: simple-bus unit address format error, expected "7864900"
Fixes: c4da5a561627 ("arm64: dts: qcom: Add msm8916 sdhci configuration nodes")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230419211856.79332-3-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
index 99aa9b4dce8aa..f84b3c1a03c53 100644
--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
@@ -1480,7 +1480,7 @@ lpass_codec: audio-codec@771c000 {
#sound-dai-cells = <1>;
};
- sdhc_1: mmc@7824000 {
+ sdhc_1: mmc@7824900 {
compatible = "qcom,msm8916-sdhci", "qcom,sdhci-msm-v4";
reg = <0x07824900 0x11c>, <0x07824000 0x800>;
reg-names = "hc", "core";
@@ -1498,7 +1498,7 @@ sdhc_1: mmc@7824000 {
status = "disabled";
};
- sdhc_2: mmc@7864000 {
+ sdhc_2: mmc@7864900 {
compatible = "qcom,msm8916-sdhci", "qcom,sdhci-msm-v4";
reg = <0x07864900 0x11c>, <0x07864000 0x800>;
reg-names = "hc", "core";
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 196/591] arm64: dts: qcom: msm8994: correct SPMI unit address
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 195/591] arm64: dts: qcom: msm8916: correct MMC " Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 197/591] arm64: dts: qcom: msm8996: correct camss " Greg Kroah-Hartman
` (398 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 24f0f6a8059c7108d4ee3476c95db1e7ff4feb79 ]
Match unit-address to reg entry to fix dtbs W=1 warnings:
Warning (simple_bus_reg): /soc/spmi@fc4c0000: simple-bus unit address format error, expected "fc4cf000"
Fixes: b0ad598f8ec0 ("arm64: dts: qcom: msm8994: Add SPMI PMIC arbiter device")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230419211856.79332-8-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8994.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi
index 7ed59e698c14d..3c6c2cf99fb9d 100644
--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi
@@ -746,7 +746,7 @@ restart@fc4ab000 {
reg = <0xfc4ab000 0x4>;
};
- spmi_bus: spmi@fc4c0000 {
+ spmi_bus: spmi@fc4cf000 {
compatible = "qcom,spmi-pmic-arb";
reg = <0xfc4cf000 0x1000>,
<0xfc4cb000 0x1000>,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 197/591] arm64: dts: qcom: msm8996: correct camss unit address
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 196/591] arm64: dts: qcom: msm8994: correct SPMI " Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 198/591] arm64: dts: qcom: sdm630: " Greg Kroah-Hartman
` (397 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit e959ced1d0e5ef0b1f66a0c2d0e1ae80790e5ca5 ]
Match unit-address to reg entry to fix dtbs W=1 warnings:
Warning (simple_bus_reg): /soc/camss@a00000: simple-bus unit address format error, expected "a34000"
Fixes: e0531312e78f ("arm64: dts: qcom: msm8996: Add CAMSS support")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230419211856.79332-9-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
index 9f89100542018..9d6ec59d1cd3a 100644
--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
@@ -2045,7 +2045,7 @@ ufsphy_lane: phy@627400 {
};
};
- camss: camss@a00000 {
+ camss: camss@a34000 {
compatible = "qcom,msm8996-camss";
reg = <0x00a34000 0x1000>,
<0x00a00030 0x4>,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 198/591] arm64: dts: qcom: sdm630: correct camss unit address
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 197/591] arm64: dts: qcom: msm8996: correct camss " Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 199/591] arm64: dts: qcom: sdm845: " Greg Kroah-Hartman
` (396 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
AngeloGioacchino Del Regno, Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit c8b7faa7e9913a94444b3f00b6480e53a174fcfd ]
Match unit-address to reg entry to fix dtbs W=1 warnings:
Warning (simple_bus_reg): /soc/camss@ca00000: simple-bus unit address format error, expected "ca00020"
Fixes: f3d5d3cc6971 ("arm64: dts: qcom: sdm630: Configure the camera subsystem")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230419211856.79332-10-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm630.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi
index e119060ac56cb..2430549265d3f 100644
--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
@@ -1902,7 +1902,7 @@ pil-reloc@94c {
};
};
- camss: camss@ca00000 {
+ camss: camss@ca00020 {
compatible = "qcom,sdm660-camss";
reg = <0x0ca00020 0x10>,
<0x0ca30000 0x100>,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 199/591] arm64: dts: qcom: sdm845: correct camss unit address
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 198/591] arm64: dts: qcom: sdm630: " Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 200/591] arm64: dts: qcom: sm8350: Add GPI DMA compatible fallback Greg Kroah-Hartman
` (395 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit a05b913a27e46926ba60ba2bcacc7ec7a8403e4c ]
Match unit-address to reg entry to fix dtbs W=1 warnings:
Warning (simple_bus_reg): /soc@0/camss@a00000: simple-bus unit address format error, expected "acb3000"
Fixes: d48a6698a6b7 ("arm64: dts: qcom: sdm845: Add CAMSS ISP node")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230419211856.79332-11-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
index a99eda4971010..6f4cc3329400c 100644
--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
@@ -4207,7 +4207,7 @@ videocc: clock-controller@ab00000 {
#reset-cells = <1>;
};
- camss: camss@a00000 {
+ camss: camss@acb3000 {
compatible = "qcom,sdm845-camss";
reg = <0 0xacb3000 0 0x1000>,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 200/591] arm64: dts: qcom: sm8350: Add GPI DMA compatible fallback
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 199/591] arm64: dts: qcom: sdm845: " Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 201/591] arm64: dts: qcom: sm8350: correct DMA controller unit address Greg Kroah-Hartman
` (394 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Neil Armstrong,
Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit b561e225dee5412609fd98340ca71ba0ab2e4b36 ]
Use SM6350 as fallback for GPI DMA, to indicate devices are compatible
and that drivers can bind with only one compatible.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221018230352.1238479-5-krzysztof.kozlowski@linaro.org
Stable-dep-of: 41d6bca799b3 ("arm64: dts: qcom: sm8350: correct DMA controller unit address")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8350.dtsi | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
index ca7c428a741d4..9430166ee45b5 100644
--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
@@ -678,7 +678,7 @@ ipcc: mailbox@408000 {
};
gpi_dma2: dma-controller@800000 {
- compatible = "qcom,sm8350-gpi-dma";
+ compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma";
reg = <0 0x00800000 0 0x60000>;
interrupts = <GIC_SPI 588 IRQ_TYPE_LEVEL_HIGH>,
<GIC_SPI 589 IRQ_TYPE_LEVEL_HIGH>,
@@ -904,7 +904,7 @@ spi19: spi@894000 {
};
gpi_dma0: dma-controller@900000 {
- compatible = "qcom,sm8350-gpi-dma";
+ compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma";
reg = <0 0x09800000 0 0x60000>;
interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
<GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>,
@@ -1207,7 +1207,7 @@ spi7: spi@99c000 {
};
gpi_dma1: dma-controller@a00000 {
- compatible = "qcom,sm8350-gpi-dma";
+ compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma";
reg = <0 0x00a00000 0 0x60000>;
interrupts = <GIC_SPI 279 IRQ_TYPE_LEVEL_HIGH>,
<GIC_SPI 280 IRQ_TYPE_LEVEL_HIGH>,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 201/591] arm64: dts: qcom: sm8350: correct DMA controller unit address
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 200/591] arm64: dts: qcom: sm8350: Add GPI DMA compatible fallback Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 202/591] arm64: dts: qcom: sdm845-polaris: add missing touchscreen child node reg Greg Kroah-Hartman
` (393 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 41d6bca799b3f40d4d3c22dd4545aeac7c210e33 ]
Match unit-address to reg entry to fix dtbs W=1 warnings:
Warning (simple_bus_reg): /soc@0/dma-controller@900000: simple-bus unit address format error, expected "9800000"
Fixes: bc08fbf49bc8 ("arm64: dts: qcom: sm8350: Define GPI DMA engines")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230419211856.79332-13-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
index 9430166ee45b5..7fd1c3f71c0f8 100644
--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
@@ -903,7 +903,7 @@ spi19: spi@894000 {
};
};
- gpi_dma0: dma-controller@900000 {
+ gpi_dma0: dma-controller@9800000 {
compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma";
reg = <0 0x09800000 0 0x60000>;
interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 202/591] arm64: dts: qcom: sdm845-polaris: add missing touchscreen child node reg
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 201/591] arm64: dts: qcom: sm8350: correct DMA controller unit address Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 203/591] arm64: dts: qcom: apq8016-sbc: Fix regulator constraints Greg Kroah-Hartman
` (392 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Molly Sophia, Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 4a0156b8862665a3e31c8280607388e3001ace3d ]
Add missing reg property to touchscreen child node to fix dtbs W=1 warnings:
Warning (unit_address_vs_reg): /soc@0/geniqup@ac0000/i2c@a98000/touchscreen@20/rmi4-f12@12: node has a unit name, but no reg or ranges property
Fixes: be497abe19bf ("arm64: dts: qcom: Add support for Xiaomi Mi Mix2s")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Molly Sophia <mollysophia379@gmail.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230419211856.79332-18-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
index 74c6832e05985..093b04359ec39 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
@@ -484,6 +484,7 @@ rmi4-f01@1 {
};
rmi4-f12@12 {
+ reg = <0x12>;
syna,rezero-wait-ms = <0xc8>;
syna,clip-x-high = <0x438>;
syna,clip-y-high = <0x870>;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 203/591] arm64: dts: qcom: apq8016-sbc: Fix regulator constraints
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 202/591] arm64: dts: qcom: sdm845-polaris: add missing touchscreen child node reg Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 204/591] arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion Greg Kroah-Hartman
` (391 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Stephan Gerhold,
Bjorn Andersson, Sasha Levin
From: Stephan Gerhold <stephan@gerhold.net>
[ Upstream commit e27654df20d77ad7549a3cf6739ebaa3aa59a088 ]
For some reason DB410c has completely bogus regulator constraints that
actually just correspond to the programmable voltages which are already
provided by the regulator driver. Some of them are not just outside the
recommended operating conditions of the APQ8016E SoC but even exceed
the absolute maximum ratings, potentially risking permanent device
damage.
In practice it's not quite as dangerous thanks to the RPM firmware:
It turns out that it has its own voltage constraints and silently
clamps all regulator requests. For example, requesting 3.3V for L5
(allowed by the current regulator constraints!) still results in 1.8V
being programmed in the actual regulator hardware.
Experimentation with various voltages shows that the internal RPM
voltage constraints roughly correspond to the safe "specified range"
in the PM8916 Device Specification (rather than the "programmable
range" used inside apq8016-sbc.dtsi right now).
Combine those together with some fixed voltages used in the old
msm-3.10 device tree from Qualcomm to give DB410c some actually valid
voltage constraints.
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Fixes: 4c7d53d16d77 ("arm64: dts: apq8016-sbc: add regulators support")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230510-msm8916-regulators-v1-1-54d4960a05fc@gerhold.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 64 ++++++++++++------------
1 file changed, 32 insertions(+), 32 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
index 1b613098fb4a0..c6f4ee7b82042 100644
--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
+++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
@@ -448,21 +448,21 @@ &smd_rpm_regulators {
vdd_l7-supply = <&pm8916_s4>;
s3 {
- regulator-min-microvolt = <375000>;
- regulator-max-microvolt = <1562000>;
+ regulator-min-microvolt = <1250000>;
+ regulator-max-microvolt = <1350000>;
};
s4 {
- regulator-min-microvolt = <1800000>;
- regulator-max-microvolt = <1800000>;
+ regulator-min-microvolt = <1850000>;
+ regulator-max-microvolt = <2150000>;
regulator-always-on;
regulator-boot-on;
};
l1 {
- regulator-min-microvolt = <375000>;
- regulator-max-microvolt = <1525000>;
+ regulator-min-microvolt = <1225000>;
+ regulator-max-microvolt = <1225000>;
};
l2 {
@@ -471,13 +471,13 @@ l2 {
};
l4 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <2050000>;
+ regulator-max-microvolt = <2050000>;
};
l5 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
};
l6 {
@@ -486,45 +486,45 @@ l6 {
};
l7 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
};
l8 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <2900000>;
+ regulator-max-microvolt = <2900000>;
};
l9 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
};
l10 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <2800000>;
+ regulator-max-microvolt = <2800000>;
};
l11 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <2950000>;
+ regulator-max-microvolt = <2950000>;
regulator-allow-set-load;
regulator-system-load = <200000>;
};
l12 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <2950000>;
};
l13 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <3075000>;
+ regulator-max-microvolt = <3075000>;
};
l14 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <3300000>;
};
/**
@@ -532,14 +532,14 @@ l14 {
* for mezzanine boards
*/
l15 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
regulator-always-on;
};
l16 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <3300000>;
};
l17 {
@@ -548,8 +548,8 @@ l17 {
};
l18 {
- regulator-min-microvolt = <1750000>;
- regulator-max-microvolt = <3337000>;
+ regulator-min-microvolt = <2700000>;
+ regulator-max-microvolt = <2700000>;
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 204/591] arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 203/591] arm64: dts: qcom: apq8016-sbc: Fix regulator constraints Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 205/591] drm/bridge: Introduce pre_enable_prev_first to alter bridge init order Greg Kroah-Hartman
` (390 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Stephan Gerhold,
Bjorn Andersson, Sasha Levin
From: Stephan Gerhold <stephan@gerhold.net>
[ Upstream commit 5500f823db38db073d30557af159b77fb1f2bf26 ]
The 96Boards specification expects a 1.8V power rail on the low-speed
expansion connector that is able to provide at least 0.18W / 100 mA.
According to the DB410c hardware user manual this is done by connecting
both L15 and L16 in parallel with up to 55mA each (for 110 mA total) [1].
Unfortunately the current regulator setup in the DB410c device tree
does not implement the specification correctly and only provides 5 mA:
- Only L15 is marked always-on, so L16 is never enabled.
- Without specifying a load the regulator is put into LPM where
it can only provide 5 mA.
Fix this by:
- Adding proper voltage constraints for L16.
- Making L16 always-on.
- Adding regulator-system-load for both L15 and L16. 100 mA should be
available in total, so specify 50 mA for each. (The regulator
hardware can only be in normal (55 mA) or low-power mode (5 mA) so
this will actually result in the expected 110 mA total...)
[1]: https://www.96boards.org/documentation/consumer/dragonboard/dragonboard410c/hardware-docs/hardware-user-manual.md.html#power-supplies
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Fixes: 828dd5d66f0f ("arm64: dts: apq8016-sbc: make 1.8v available on LS expansion")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230510-msm8916-regulators-v1-2-54d4960a05fc@gerhold.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
index c6f4ee7b82042..e3e90ad92cc59 100644
--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
+++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
@@ -527,19 +527,27 @@ l14 {
regulator-max-microvolt = <3300000>;
};
- /**
- * 1.8v required on LS expansion
- * for mezzanine boards
+ /*
+ * The 96Boards specification expects a 1.8V power rail on the low-speed
+ * expansion connector that is able to provide at least 0.18W / 100 mA.
+ * L15/L16 are connected in parallel to provide 55 mA each. A minimum load
+ * must be specified to ensure the regulators are not put in LPM where they
+ * would only provide 5 mA.
*/
l15 {
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <1800000>;
+ regulator-system-load = <50000>;
+ regulator-allow-set-load;
regulator-always-on;
};
l16 {
regulator-min-microvolt = <1800000>;
- regulator-max-microvolt = <3300000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-system-load = <50000>;
+ regulator-allow-set-load;
+ regulator-always-on;
};
l17 {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 205/591] drm/bridge: Introduce pre_enable_prev_first to alter bridge init order
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 204/591] arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 206/591] drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec Greg Kroah-Hartman
` (389 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Stevenson, Frieder Schrempf,
Maxime Ripard, Sasha Levin
From: Dave Stevenson <dave.stevenson@raspberrypi.com>
[ Upstream commit 4fb912e5e19075874379cfcf074d90bd51ebf8ea ]
DSI sink devices typically want the DSI host powered up and configured
before they are powered up. pre_enable is the place this would normally
happen, but they are called in reverse order from panel/connector towards
the encoder, which is the "wrong" order.
Add a new flag pre_enable_prev_first that any bridge can set
to swap the order of pre_enable (and post_disable) for that and the
immediately previous bridge.
Should the immediately previous bridge also set the
pre_enable_prev_first flag, the previous bridge to that will be called
before either of those which requested pre_enable_prev_first.
eg:
- Panel
- Bridge 1
- Bridge 2 pre_enable_prev_first
- Bridge 3
- Bridge 4 pre_enable_prev_first
- Bridge 5 pre_enable_prev_first
- Bridge 6
- Encoder
Would result in pre_enable's being called as Panel, Bridge 1, Bridge 3,
Bridge 2, Bridge 6, Bridge 5, Bridge 4, Encoder.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Tested-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Link: https://lore.kernel.org/r/20221205173328.1395350-5-dave.stevenson@raspberrypi.com
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Stable-dep-of: dd9e329af723 ("drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_bridge.c | 145 +++++++++++++++++++++++++++++------
include/drm/drm_bridge.h | 8 ++
2 files changed, 129 insertions(+), 24 deletions(-)
diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c
index 1545c50fd1c8f..7044e339a82cd 100644
--- a/drivers/gpu/drm/drm_bridge.c
+++ b/drivers/gpu/drm/drm_bridge.c
@@ -691,6 +691,25 @@ void drm_atomic_bridge_chain_disable(struct drm_bridge *bridge,
}
EXPORT_SYMBOL(drm_atomic_bridge_chain_disable);
+static void drm_atomic_bridge_call_post_disable(struct drm_bridge *bridge,
+ struct drm_atomic_state *old_state)
+{
+ if (old_state && bridge->funcs->atomic_post_disable) {
+ struct drm_bridge_state *old_bridge_state;
+
+ old_bridge_state =
+ drm_atomic_get_old_bridge_state(old_state,
+ bridge);
+ if (WARN_ON(!old_bridge_state))
+ return;
+
+ bridge->funcs->atomic_post_disable(bridge,
+ old_bridge_state);
+ } else if (bridge->funcs->post_disable) {
+ bridge->funcs->post_disable(bridge);
+ }
+}
+
/**
* drm_atomic_bridge_chain_post_disable - cleans up after disabling all bridges
* in the encoder chain
@@ -702,36 +721,86 @@ EXPORT_SYMBOL(drm_atomic_bridge_chain_disable);
* starting from the first bridge to the last. These are called after completing
* &drm_encoder_helper_funcs.atomic_disable
*
+ * If a bridge sets @pre_enable_prev_first, then the @post_disable for that
+ * bridge will be called before the previous one to reverse the @pre_enable
+ * calling direction.
+ *
* Note: the bridge passed should be the one closest to the encoder
*/
void drm_atomic_bridge_chain_post_disable(struct drm_bridge *bridge,
struct drm_atomic_state *old_state)
{
struct drm_encoder *encoder;
+ struct drm_bridge *next, *limit;
if (!bridge)
return;
encoder = bridge->encoder;
+
list_for_each_entry_from(bridge, &encoder->bridge_chain, chain_node) {
- if (bridge->funcs->atomic_post_disable) {
- struct drm_bridge_state *old_bridge_state;
+ limit = NULL;
+
+ if (!list_is_last(&bridge->chain_node, &encoder->bridge_chain)) {
+ next = list_next_entry(bridge, chain_node);
+
+ if (next->pre_enable_prev_first) {
+ /* next bridge had requested that prev
+ * was enabled first, so disabled last
+ */
+ limit = next;
+
+ /* Find the next bridge that has NOT requested
+ * prev to be enabled first / disabled last
+ */
+ list_for_each_entry_from(next, &encoder->bridge_chain,
+ chain_node) {
+ if (next->pre_enable_prev_first) {
+ next = list_prev_entry(next, chain_node);
+ limit = next;
+ break;
+ }
+ }
+
+ /* Call these bridges in reverse order */
+ list_for_each_entry_from_reverse(next, &encoder->bridge_chain,
+ chain_node) {
+ if (next == bridge)
+ break;
+
+ drm_atomic_bridge_call_post_disable(next,
+ old_state);
+ }
+ }
+ }
- old_bridge_state =
- drm_atomic_get_old_bridge_state(old_state,
- bridge);
- if (WARN_ON(!old_bridge_state))
- return;
+ drm_atomic_bridge_call_post_disable(bridge, old_state);
- bridge->funcs->atomic_post_disable(bridge,
- old_bridge_state);
- } else if (bridge->funcs->post_disable) {
- bridge->funcs->post_disable(bridge);
- }
+ if (limit)
+ /* Jump all bridges that we have already post_disabled */
+ bridge = limit;
}
}
EXPORT_SYMBOL(drm_atomic_bridge_chain_post_disable);
+static void drm_atomic_bridge_call_pre_enable(struct drm_bridge *bridge,
+ struct drm_atomic_state *old_state)
+{
+ if (old_state && bridge->funcs->atomic_pre_enable) {
+ struct drm_bridge_state *old_bridge_state;
+
+ old_bridge_state =
+ drm_atomic_get_old_bridge_state(old_state,
+ bridge);
+ if (WARN_ON(!old_bridge_state))
+ return;
+
+ bridge->funcs->atomic_pre_enable(bridge, old_bridge_state);
+ } else if (bridge->funcs->pre_enable) {
+ bridge->funcs->pre_enable(bridge);
+ }
+}
+
/**
* drm_atomic_bridge_chain_pre_enable - prepares for enabling all bridges in
* the encoder chain
@@ -743,32 +812,60 @@ EXPORT_SYMBOL(drm_atomic_bridge_chain_post_disable);
* starting from the last bridge to the first. These are called before calling
* &drm_encoder_helper_funcs.atomic_enable
*
+ * If a bridge sets @pre_enable_prev_first, then the pre_enable for the
+ * prev bridge will be called before pre_enable of this bridge.
+ *
* Note: the bridge passed should be the one closest to the encoder
*/
void drm_atomic_bridge_chain_pre_enable(struct drm_bridge *bridge,
struct drm_atomic_state *old_state)
{
struct drm_encoder *encoder;
- struct drm_bridge *iter;
+ struct drm_bridge *iter, *next, *limit;
if (!bridge)
return;
encoder = bridge->encoder;
+
list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) {
- if (iter->funcs->atomic_pre_enable) {
- struct drm_bridge_state *old_bridge_state;
+ if (iter->pre_enable_prev_first) {
+ next = iter;
+ limit = bridge;
+ list_for_each_entry_from_reverse(next,
+ &encoder->bridge_chain,
+ chain_node) {
+ if (next == bridge)
+ break;
+
+ if (!next->pre_enable_prev_first) {
+ /* Found first bridge that does NOT
+ * request prev to be enabled first
+ */
+ limit = list_prev_entry(next, chain_node);
+ break;
+ }
+ }
+
+ list_for_each_entry_from(next, &encoder->bridge_chain, chain_node) {
+ /* Call requested prev bridge pre_enable
+ * in order.
+ */
+ if (next == iter)
+ /* At the first bridge to request prev
+ * bridges called first.
+ */
+ break;
+
+ drm_atomic_bridge_call_pre_enable(next, old_state);
+ }
+ }
- old_bridge_state =
- drm_atomic_get_old_bridge_state(old_state,
- iter);
- if (WARN_ON(!old_bridge_state))
- return;
+ drm_atomic_bridge_call_pre_enable(iter, old_state);
- iter->funcs->atomic_pre_enable(iter, old_bridge_state);
- } else if (iter->funcs->pre_enable) {
- iter->funcs->pre_enable(iter);
- }
+ if (iter->pre_enable_prev_first)
+ /* Jump all bridges that we have already pre_enabled */
+ iter = limit;
if (iter == bridge)
break;
diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h
index 288c6feda5de2..6b656ea23b964 100644
--- a/include/drm/drm_bridge.h
+++ b/include/drm/drm_bridge.h
@@ -768,6 +768,14 @@ struct drm_bridge {
* modes.
*/
bool interlace_allowed;
+ /**
+ * @pre_enable_prev_first: The bridge requires that the prev
+ * bridge @pre_enable function is called before its @pre_enable,
+ * and conversely for post_disable. This is most frequently a
+ * requirement for DSI devices which need the host to be initialised
+ * before the peripheral.
+ */
+ bool pre_enable_prev_first;
/**
* @ddc: Associated I2C adapter for DDC access, if any.
*/
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 206/591] drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 205/591] drm/bridge: Introduce pre_enable_prev_first to alter bridge init order Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 207/591] drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H Greg Kroah-Hartman
` (388 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frieder Schrempf, Neil Armstrong,
Sasha Levin, Alexander Stein
From: Frieder Schrempf <frieder.schrempf@kontron.de>
[ Upstream commit dd9e329af7236e34c566d3705ea32a63069b9b13 ]
The datasheet describes the following initialization flow including
minimum delay times between each step:
1. DSI data lanes need to be in LP-11 and the clock lane in HS mode
2. toggle EN signal
3. initialize registers
4. enable PLL
5. soft reset
6. enable DSI stream
7. check error status register
To meet this requirement we need to make sure the host bridge's
pre_enable() is called first by using the pre_enable_prev_first
flag.
Furthermore we need to split enable() into pre_enable() which covers
steps 2-5 from above and enable() which covers step 7 and is called
after the host bridge's enable().
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Fixes: ceb515ba29ba ("drm/bridge: ti-sn65dsi83: Add TI SN65DSI83 and SN65DSI84 driver")
Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> #TQMa8MxML/MBa8Mx
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230503163313.2640898-3-frieder@fris.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ti-sn65dsi83.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
index 0635b824e3682..55efd3eb66723 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
@@ -321,8 +321,8 @@ static u8 sn65dsi83_get_dsi_div(struct sn65dsi83 *ctx)
return dsi_div - 1;
}
-static void sn65dsi83_atomic_enable(struct drm_bridge *bridge,
- struct drm_bridge_state *old_bridge_state)
+static void sn65dsi83_atomic_pre_enable(struct drm_bridge *bridge,
+ struct drm_bridge_state *old_bridge_state)
{
struct sn65dsi83 *ctx = bridge_to_sn65dsi83(bridge);
struct drm_atomic_state *state = old_bridge_state->base.state;
@@ -485,11 +485,22 @@ static void sn65dsi83_atomic_enable(struct drm_bridge *bridge,
/* Trigger reset after CSR register update. */
regmap_write(ctx->regmap, REG_RC_RESET, REG_RC_RESET_SOFT_RESET);
+ /* Wait for 10ms after soft reset as specified in datasheet */
+ usleep_range(10000, 12000);
+}
+
+static void sn65dsi83_atomic_enable(struct drm_bridge *bridge,
+ struct drm_bridge_state *old_bridge_state)
+{
+ struct sn65dsi83 *ctx = bridge_to_sn65dsi83(bridge);
+ unsigned int pval;
+
/* Clear all errors that got asserted during initialization. */
regmap_read(ctx->regmap, REG_IRQ_STAT, &pval);
regmap_write(ctx->regmap, REG_IRQ_STAT, pval);
- usleep_range(10000, 12000);
+ /* Wait for 1ms and check for errors in status register */
+ usleep_range(1000, 1100);
regmap_read(ctx->regmap, REG_IRQ_STAT, &pval);
if (pval)
dev_err(ctx->dev, "Unexpected link status 0x%02x\n", pval);
@@ -556,6 +567,7 @@ static const struct drm_bridge_funcs sn65dsi83_funcs = {
.attach = sn65dsi83_attach,
.detach = sn65dsi83_detach,
.atomic_enable = sn65dsi83_atomic_enable,
+ .atomic_pre_enable = sn65dsi83_atomic_pre_enable,
.atomic_disable = sn65dsi83_atomic_disable,
.mode_valid = sn65dsi83_mode_valid,
@@ -696,6 +708,7 @@ static int sn65dsi83_probe(struct i2c_client *client,
ctx->bridge.funcs = &sn65dsi83_funcs;
ctx->bridge.of_node = dev->of_node;
+ ctx->bridge.pre_enable_prev_first = true;
drm_bridge_add(&ctx->bridge);
ret = sn65dsi83_host_attach(ctx);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 207/591] drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 206/591] drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 208/591] ARM: ep93xx: fix missing-prototype warnings Greg Kroah-Hartman
` (387 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dario Binacchi, Neil Armstrong,
Sasha Levin
From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[ Upstream commit f24b49550814fdee4a98b9552e35e243ccafd4a8 ]
The previous setting was related to the overall dimension and not to the
active display area.
In the "PHYSICAL SPECIFICATIONS" section, the datasheet shows the
following parameters:
----------------------------------------------------------
| Item | Specifications | unit |
----------------------------------------------------------
| Display area | 98.7 (W) x 57.5 (H) | mm |
----------------------------------------------------------
| Overall dimension | 105.5(W) x 67.2(H) x 4.96(D) | mm |
----------------------------------------------------------
Fixes: 966fea78adf2 ("drm/panel: simple: Add support for Ampire AM-480272H3TMQW-T01H")
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
[narmstrong: fixed Fixes commit id length]
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230516085039.3797303-1-dario.binacchi@amarulasolutions.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-simple.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index 8a3b685c2fcc0..7ca00b0323362 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -759,8 +759,8 @@ static const struct panel_desc ampire_am_480272h3tmqw_t01h = {
.num_modes = 1,
.bpc = 8,
.size = {
- .width = 105,
- .height = 67,
+ .width = 99,
+ .height = 58,
},
.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 208/591] ARM: ep93xx: fix missing-prototype warnings
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 207/591] drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 209/591] ARM: omap2: fix missing tick_broadcast() prototype Greg Kroah-Hartman
` (386 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Sverdlin, Arnd Bergmann,
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 419013740ea1e4343d8ade535d999f59fa28e460 ]
ep93xx_clocksource_read() is only called from the file it is declared in,
while ep93xx_timer_init() is declared in a header that is not included here.
arch/arm/mach-ep93xx/timer-ep93xx.c:120:13: error: no previous prototype for 'ep93xx_timer_init'
arch/arm/mach-ep93xx/timer-ep93xx.c:63:5: error: no previous prototype for 'ep93xx_clocksource_read'
Fixes: 000bc17817bf ("ARM: ep93xx: switch to GENERIC_CLOCKEVENTS")
Acked-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://lore.kernel.org/r/20230516153109.514251-3-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-ep93xx/timer-ep93xx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm/mach-ep93xx/timer-ep93xx.c b/arch/arm/mach-ep93xx/timer-ep93xx.c
index dd4b164d18317..a9efa7bc2fa12 100644
--- a/arch/arm/mach-ep93xx/timer-ep93xx.c
+++ b/arch/arm/mach-ep93xx/timer-ep93xx.c
@@ -9,6 +9,7 @@
#include <linux/io.h>
#include <asm/mach/time.h>
#include "soc.h"
+#include "platform.h"
/*************************************************************************
* Timer handling for EP93xx
@@ -60,7 +61,7 @@ static u64 notrace ep93xx_read_sched_clock(void)
return ret;
}
-u64 ep93xx_clocksource_read(struct clocksource *c)
+static u64 ep93xx_clocksource_read(struct clocksource *c)
{
u64 ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 209/591] ARM: omap2: fix missing tick_broadcast() prototype
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 208/591] ARM: ep93xx: fix missing-prototype warnings Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 210/591] arm64: dts: qcom: pm7250b: add missing spmi-vadc include Greg Kroah-Hartman
` (385 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaro Koskinen, Arnd Bergmann,
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 861bc1d2886d47bd57a2cbf2cda87fdbe3eb9d08 ]
omap2 contains a hack to define tick_broadcast() on non-SMP
configurations in place of the normal SMP definition. This one
causes a warning because of a missing prototype:
arch/arm/mach-omap2/board-generic.c:44:6: error: no previous prototype for 'tick_broadcast'
Make sure to always include the header with the declaration.
Fixes: d86ad463d670 ("ARM: OMAP2+: Fix regression for using local timer on non-SMP SoCs")
Acked-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Link: https://lore.kernel.org/r/20230516153109.514251-9-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-omap2/board-generic.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index 1610c567a6a3a..10d2f078e4a8e 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -13,6 +13,7 @@
#include <linux/of_platform.h>
#include <linux/irqdomain.h>
#include <linux/clocksource.h>
+#include <linux/clockchips.h>
#include <asm/setup.h>
#include <asm/mach/arch.h>
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 210/591] arm64: dts: qcom: pm7250b: add missing spmi-vadc include
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 209/591] ARM: omap2: fix missing tick_broadcast() prototype Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 211/591] arm64: dts: qcom: apq8096: fix fixed regulator name property Greg Kroah-Hartman
` (384 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Bjorn Andersson,
Sasha Levin
From: Luca Weiss <luca.weiss@fairphone.com>
[ Upstream commit 83022f6484b11a60dbf9a95a88c7ef8e59c4b19c ]
This file is using definitions from the spmi-vadc header, so we need to
include it.
Fixes: 11975b9b8135 ("arm64: dts: qcom: Add pm7250b PMIC")
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230407-pm7250b-sid-v1-1-fc648478cc25@fairphone.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/pm7250b.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/pm7250b.dtsi b/arch/arm64/boot/dts/qcom/pm7250b.dtsi
index 61f7a63451505..694fe912536e8 100644
--- a/arch/arm64/boot/dts/qcom/pm7250b.dtsi
+++ b/arch/arm64/boot/dts/qcom/pm7250b.dtsi
@@ -3,6 +3,7 @@
* Copyright (C) 2022 Luca Weiss <luca.weiss@fairphone.com>
*/
+#include <dt-bindings/iio/qcom,spmi-vadc.h>
#include <dt-bindings/interrupt-controller/irq.h>
#include <dt-bindings/spmi/spmi.h>
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 211/591] arm64: dts: qcom: apq8096: fix fixed regulator name property
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 210/591] arm64: dts: qcom: pm7250b: add missing spmi-vadc include Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 212/591] arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to kukui Greg Kroah-Hartman
` (383 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit c77612a07d18d4425fd8ddd532a8a9b8e1970c53 ]
Correct the typo in 'regulator-name' property.
apq8096-ifc6640.dtb: v1p05-regulator: 'regulator-name' is a required property
apq8096-ifc6640.dtb: v1p05-regulator: Unevaluated properties are not allowed ('reglator-name' was unexpected)
Fixes: 6cbdec2d3ca6 ("arm64: dts: qcom: msm8996: Introduce IFC6640")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230507174516.264936-3-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts b/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts
index 92f264891d84b..9b20c1a47a186 100644
--- a/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts
+++ b/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts
@@ -26,7 +26,7 @@ chosen {
v1p05: v1p05-regulator {
compatible = "regulator-fixed";
- reglator-name = "v1p05";
+ regulator-name = "v1p05";
regulator-always-on;
regulator-boot-on;
@@ -38,7 +38,7 @@ v1p05: v1p05-regulator {
v12_poe: v12-poe-regulator {
compatible = "regulator-fixed";
- reglator-name = "v12_poe";
+ regulator-name = "v12_poe";
regulator-always-on;
regulator-boot-on;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 212/591] arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to kukui
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 211/591] arm64: dts: qcom: apq8096: fix fixed regulator name property Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 213/591] ARM: dts: stm32: Shorten the AV96 HDMI sound card name Greg Kroah-Hartman
` (382 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Julius Werner, Douglas Anderson,
AngeloGioacchino Del Regno, Matthias Brugger, Sasha Levin
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 42127f578ebde652d1373e0233356fbd351675c4 ]
Firmware shipped on mt8183 Chromebooks is affected by the GICR
save/restore issue as described by the patch ("dt-bindings:
interrupt-controller: arm,gic-v3: Add quirk for Mediatek SoCs w/
broken FW"). Add the quirk property.
Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board")
Reviewed-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20230515131353.v2.3.I525a2ed4260046d43c885ee1275e91707743df1c@changeid
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
index b4b86bb1f1a7d..632fd89e75969 100644
--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
@@ -297,6 +297,10 @@ dsi_out: endpoint {
};
};
+&gic {
+ mediatek,broken-save-restore-fw;
+};
+
&gpu {
mali-supply = <&mt6358_vgpu_reg>;
sram-supply = <&mt6358_vsram_gpu_reg>;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 213/591] ARM: dts: stm32: Shorten the AV96 HDMI sound card name
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 212/591] arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to kukui Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 214/591] memory: brcmstb_dpfe: fix testing array offset after use Greg Kroah-Hartman
` (381 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Alexandre Torgue,
Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit 0cf765e598712addec34d0208cc1418c151fefb2 ]
Fix the following error in kernel log due to too long sound card name:
"
asoc-audio-graph-card sound: ASoC: driver name too long 'STM32MP1-AV96-HDMI' -> 'STM32MP1-AV96-H'
"
Fixes: e027da342772 ("ARM: dts: stm32: Add bindings for audio on AV96")
Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
index 2c246ac641533..f068e4fcc404f 100644
--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
+++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
@@ -88,7 +88,7 @@ sd_switch: regulator-sd_switch {
sound {
compatible = "audio-graph-card";
- label = "STM32MP1-AV96-HDMI";
+ label = "STM32-AV96-HDMI";
dais = <&sai2a_port>;
status = "okay";
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 214/591] memory: brcmstb_dpfe: fix testing array offset after use
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 213/591] ARM: dts: stm32: Shorten the AV96 HDMI sound card name Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 215/591] ARM: dts: qcom: apq8074-dragonboard: Set DMA as remotely controlled Greg Kroah-Hartman
` (380 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Markus Mayer, Florian Fainelli,
Krzysztof Kozlowski, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 1d9e93fad549bc38f593147479ee063f2872c170 ]
Code should first check for valid value of array offset, then use it as
the index. Fixes smatch warning:
drivers/memory/brcmstb_dpfe.c:443 __send_command() error: testing array offset 'cmd' after use.
Fixes: 2f330caff577 ("memory: brcmstb: Add driver for DPFE")
Acked-by: Markus Mayer <mmayer@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://lore.kernel.org/r/20230513112931.176066-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/brcmstb_dpfe.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
index 76c82e9c8fceb..9339f80b21c50 100644
--- a/drivers/memory/brcmstb_dpfe.c
+++ b/drivers/memory/brcmstb_dpfe.c
@@ -434,15 +434,17 @@ static void __finalize_command(struct brcmstb_dpfe_priv *priv)
static int __send_command(struct brcmstb_dpfe_priv *priv, unsigned int cmd,
u32 result[])
{
- const u32 *msg = priv->dpfe_api->command[cmd];
void __iomem *regs = priv->regs;
unsigned int i, chksum, chksum_idx;
+ const u32 *msg;
int ret = 0;
u32 resp;
if (cmd >= DPFE_CMD_MAX)
return -1;
+ msg = priv->dpfe_api->command[cmd];
+
mutex_lock(&priv->lock);
/* Wait for DCPU to become ready */
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 215/591] ARM: dts: qcom: apq8074-dragonboard: Set DMA as remotely controlled
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 214/591] memory: brcmstb_dpfe: fix testing array offset after use Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 216/591] ASoC: es8316: Increment max value for ALC Capture Target Volume control Greg Kroah-Hartman
` (379 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit e60c230588d88036f974cec7e93361e2c4f62226 ]
Add the qcom,controlled-remotely property for the blsp2_bam
controller node. This board requires this, otherwise the board stalls
during the boot for some reason (most probably because TZ mishandles the
protection error and keeps on looping somewhere inside).
Fixes: 62bc81792223 dts: msm8974: Add blsp2_bam dma node
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230507190735.2333145-3-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/qcom-apq8074-dragonboard.dts | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts b/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts
index 91716298ec5ed..be1ab7eff8ff4 100644
--- a/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts
+++ b/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts
@@ -23,6 +23,10 @@ &blsp1_uart2 {
status = "okay";
};
+&blsp2_dma {
+ qcom,controlled-remotely;
+};
+
&blsp2_i2c5 {
status = "okay";
clock-frequency = <200000>;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 216/591] ASoC: es8316: Increment max value for ALC Capture Target Volume control
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 215/591] ARM: dts: qcom: apq8074-dragonboard: Set DMA as remotely controlled Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 217/591] ASoC: es8316: Do not set rate constraints for unsupported MCLKs Greg Kroah-Hartman
` (378 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Mark Brown,
Sasha Levin
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit 6f073429037cd79d7311cd8236311c53f5ea8f01 ]
The following error occurs when trying to restore a previously saved
ALSA mixer state (tested on a Rock 5B board):
$ alsactl --no-ucm -f /tmp/asound.state store hw:Analog
$ alsactl --no-ucm -I -f /tmp/asound.state restore hw:Analog
alsactl: set_control:1475: Cannot write control '2:0:0:ALC Capture Target Volume:0' : Invalid argument
According to ES8316 datasheet, the register at address 0x2B, which is
related to the above mixer control, contains by default the value 0xB0.
Considering the corresponding ALC target bits (ALCLVL) are 7:4, the
control is initialized with 11, which is one step above the maximum
value allowed by the driver:
ALCLVL | dB gain
-------+--------
0000 | -16.5
0001 | -15.0
0010 | -13.5
.... | .....
0111 | -6.0
1000 | -4.5
1001 | -3.0
1010 | -1.5
.... | .....
1111 | -1.5
The tests performed using the VU meter feature (--vumeter=TYPE) of
arecord/aplay confirm the specs are correct and there is no measured
gain if the 1011-1111 range would have been mapped to 0 dB:
dB gain | VU meter %
--------+-----------
-6.0 | 30-31
-4.5 | 35-36
-3.0 | 42-43
-1.5 | 50-51
0.0 | 50-51
Increment the max value allowed for ALC Capture Target Volume control,
so that it matches the hardware default. Additionally, update the
related TLV to prevent an artificial extension of the dB gain range.
Fixes: b8b88b70875a ("ASoC: add es8316 codec driver")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Link: https://lore.kernel.org/r/20230530181140.483936-2-cristian.ciocaltea@collabora.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/es8316.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
index f7d7a9c91e04c..2bfcd9af39172 100644
--- a/sound/soc/codecs/es8316.c
+++ b/sound/soc/codecs/es8316.c
@@ -52,7 +52,12 @@ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(dac_vol_tlv, -9600, 50, 1);
static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(adc_vol_tlv, -9600, 50, 1);
static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_max_gain_tlv, -650, 150, 0);
static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_min_gain_tlv, -1200, 150, 0);
-static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_target_tlv, -1650, 150, 0);
+
+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(alc_target_tlv,
+ 0, 10, TLV_DB_SCALE_ITEM(-1650, 150, 0),
+ 11, 11, TLV_DB_SCALE_ITEM(-150, 0, 0),
+);
+
static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(hpmixer_gain_tlv,
0, 4, TLV_DB_SCALE_ITEM(-1200, 150, 0),
8, 11, TLV_DB_SCALE_ITEM(-450, 150, 0),
@@ -115,7 +120,7 @@ static const struct snd_kcontrol_new es8316_snd_controls[] = {
alc_max_gain_tlv),
SOC_SINGLE_TLV("ALC Capture Min Volume", ES8316_ADC_ALC2, 0, 28, 0,
alc_min_gain_tlv),
- SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 10, 0,
+ SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 11, 0,
alc_target_tlv),
SOC_SINGLE("ALC Capture Hold Time", ES8316_ADC_ALC3, 0, 10, 0),
SOC_SINGLE("ALC Capture Decay Time", ES8316_ADC_ALC4, 4, 10, 0),
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 217/591] ASoC: es8316: Do not set rate constraints for unsupported MCLKs
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 216/591] ASoC: es8316: Increment max value for ALC Capture Target Volume control Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 218/591] ARM: dts: meson8: correct uart_B and uart_C clock references Greg Kroah-Hartman
` (377 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Mark Brown,
Sasha Levin
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit 60413129ee2b38a80347489270af7f6e1c1de4d0 ]
When using the codec through the generic audio graph card, there are at
least two calls of es8316_set_dai_sysclk(), with the effect of limiting
the allowed sample rates according to the MCLK/LRCK ratios supported by
the codec:
1. During audio card setup, to set the initial MCLK - see
asoc_simple_init_dai().
2. Before opening a stream, to update MCLK, according to the stream
sample rate and the multiplication factor - see
asoc_simple_hw_params().
In some cases the initial MCLK might be set to a frequency that doesn't
match any of the supported ratios, e.g. 12287999 instead of 12288000,
which is only 1 Hz below the supported clock, as that is what the
hardware reports. This creates an empty list of rate constraints, which
is further passed to snd_pcm_hw_constraint_list() via
es8316_pcm_startup(), and causes the following error on the very first
access of the sound card:
$ speaker-test -D hw:Analog,0 -F S16_LE -c 2 -t wav
Broken configuration for playback: no configurations available: Invalid argument
Setting of hwparams failed: Invalid argument
Note that all subsequent retries succeed thanks to the updated MCLK set
at point 2 above, which uses a computed frequency value instead of a
reading from the hardware registers. Normally this would have mitigated
the issue, but es8316_pcm_startup() executes before the 2nd call to
es8316_set_dai_sysclk(), hence it cannot make use of the updated
constraints.
Since es8316_pcm_hw_params() performs anyway a final validation of MCLK
against the stream sample rate and the supported MCLK/LRCK ratios, fix
the issue by ensuring that sysclk_constraints list is only set when at
least one supported sample rate is autodetected by the codec.
Fixes: b8b88b70875a ("ASoC: add es8316 codec driver")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Link: https://lore.kernel.org/r/20230530181140.483936-3-cristian.ciocaltea@collabora.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/es8316.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
index 2bfcd9af39172..87775378362e7 100644
--- a/sound/soc/codecs/es8316.c
+++ b/sound/soc/codecs/es8316.c
@@ -369,13 +369,11 @@ static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai,
int count = 0;
es8316->sysclk = freq;
+ es8316->sysclk_constraints.list = NULL;
+ es8316->sysclk_constraints.count = 0;
- if (freq == 0) {
- es8316->sysclk_constraints.list = NULL;
- es8316->sysclk_constraints.count = 0;
-
+ if (freq == 0)
return 0;
- }
ret = clk_set_rate(es8316->mclk, freq);
if (ret)
@@ -391,8 +389,10 @@ static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai,
es8316->allowed_rates[count++] = freq / ratio;
}
- es8316->sysclk_constraints.list = es8316->allowed_rates;
- es8316->sysclk_constraints.count = count;
+ if (count) {
+ es8316->sysclk_constraints.list = es8316->allowed_rates;
+ es8316->sysclk_constraints.count = count;
+ }
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 218/591] ARM: dts: meson8: correct uart_B and uart_C clock references
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 217/591] ASoC: es8316: Do not set rate constraints for unsupported MCLKs Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 219/591] soc/fsl/qe: fix usb.c build errors Greg Kroah-Hartman
` (376 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Blumenstingl, Neil Armstrong,
Sasha Levin, Hans-Frieder Vogt
From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[ Upstream commit 98b503c7fb13a17a47d8ebf15fa8f7c10118e75c ]
On Meson8 uart_B and uart_C do not work, because they are relying on
incorrect clocks. Change the references of pclk to the correct CLKID
(UART1 for uart_B and UART2 for uart_C), to allow use of the two uarts.
This was originally reported by Hans-Frieder Vogt for Meson8b [0], but
the same bug is also present in meson8.dtsi
[0] https://lore.kernel.org/linux-amlogic/trinity-bf20bcb9-790b-4ab9-99e3-0831ef8257f4-1680878185420@3c-app-gmx-bap55/
Fixes: 57007bfb5469 ("ARM: dts: meson8: Fix the UART device-tree schema validation")
Reported-by: Hans-Frieder Vogt <hfdevel@gmx.net> # for meson8b.dtsi
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Link: https://lore.kernel.org/r/20230516203029.1031174-1-martin.blumenstingl@googlemail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/meson8.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi
index 0f8bac8bac8bb..f9da7faa2186b 100644
--- a/arch/arm/boot/dts/meson8.dtsi
+++ b/arch/arm/boot/dts/meson8.dtsi
@@ -749,13 +749,13 @@ &uart_A {
&uart_B {
compatible = "amlogic,meson8-uart";
- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>;
+ clocks = <&xtal>, <&clkc CLKID_UART1>, <&clkc CLKID_CLK81>;
clock-names = "xtal", "pclk", "baud";
};
&uart_C {
compatible = "amlogic,meson8-uart";
- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>;
+ clocks = <&xtal>, <&clkc CLKID_UART2>, <&clkc CLKID_CLK81>;
clock-names = "xtal", "pclk", "baud";
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 219/591] soc/fsl/qe: fix usb.c build errors
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 218/591] ARM: dts: meson8: correct uart_B and uart_C clock references Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:45 ` [PATCH 6.1 220/591] RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes Greg Kroah-Hartman
` (375 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, kernel test robot,
Michael Ellerman, Christophe Leroy, Leo Li, Masahiro Yamada,
Nicolas Schier, Qiang Zhao, linuxppc-dev, linux-arm-kernel,
Kumar Gala, Nicolas Schier, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 7b1a78babd0d2cd27aa07255dee0c2d7ac0f31e3 ]
Fix build errors in soc/fsl/qe/usb.c when QUICC_ENGINE is not set.
This happens when PPC_EP88XC is set, which selects CPM1 & CPM.
When CPM is set, USB_FSL_QE can be set without QUICC_ENGINE
being set. When USB_FSL_QE is set, QE_USB deafults to y, which
causes build errors when QUICC_ENGINE is not set. Making
QE_USB depend on QUICC_ENGINE prevents QE_USB from defaulting to y.
Fixes these build errors:
drivers/soc/fsl/qe/usb.o: in function `qe_usb_clock_set':
usb.c:(.text+0x1e): undefined reference to `qe_immr'
powerpc-linux-ld: usb.c:(.text+0x2a): undefined reference to `qe_immr'
powerpc-linux-ld: usb.c:(.text+0xbc): undefined reference to `qe_setbrg'
powerpc-linux-ld: usb.c:(.text+0xca): undefined reference to `cmxgcr_lock'
powerpc-linux-ld: usb.c:(.text+0xce): undefined reference to `cmxgcr_lock'
Fixes: 5e41486c408e ("powerpc/QE: add support for QE USB clocks routing")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/all/202301101500.pillNv6R-lkp@intel.com/
Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Leo Li <leoyang.li@nxp.com>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Cc: Nicolas Schier <nicolas@fjasle.eu>
Cc: Qiang Zhao <qiang.zhao@nxp.com>
Cc: linuxppc-dev <linuxppc-dev@lists.ozlabs.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: Kumar Gala <galak@kernel.crashing.org>
Acked-by: Nicolas Schier <nicolas@jasle.eu>
Signed-off-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/fsl/qe/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/soc/fsl/qe/Kconfig b/drivers/soc/fsl/qe/Kconfig
index 357c5800b112f..7afa796dbbb89 100644
--- a/drivers/soc/fsl/qe/Kconfig
+++ b/drivers/soc/fsl/qe/Kconfig
@@ -39,6 +39,7 @@ config QE_TDM
config QE_USB
bool
+ depends on QUICC_ENGINE
default y if USB_FSL_QE
help
QE USB Controller support
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 220/591] RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 219/591] soc/fsl/qe: fix usb.c build errors Greg Kroah-Hartman
@ 2023-07-16 19:45 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 221/591] IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate Greg Kroah-Hartman
` (374 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Shiraz Saleem,
Jason Gunthorpe, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit b002760f877c0d91ecd3c78565b52f4bbac379dd ]
Commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") triggers a
warning for fortified memset():
In function 'fortify_memset_chk',
inlined from 'irdma_clr_wqes' at drivers/infiniband/hw/irdma/uk.c:103:4:
include/linux/fortify-string.h:493:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
493 | __write_overflow_field(p_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The problem here isthat the inner array only has four 8-byte elements, so
clearing 4096 bytes overflows that. As this structure is part of an outer
array, change the code to pass a pointer to the irdma_qp_quanta instead,
and change the size argument for readability, matching the comment above
it.
Fixes: 551c46edc769 ("RDMA/irdma: Add user/kernel shared libraries")
Link: https://lore.kernel.org/r/20230523111859.2197825-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/uk.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/irdma/uk.c b/drivers/infiniband/hw/irdma/uk.c
index 16183e894da77..dd428d915c175 100644
--- a/drivers/infiniband/hw/irdma/uk.c
+++ b/drivers/infiniband/hw/irdma/uk.c
@@ -93,16 +93,18 @@ static int irdma_nop_1(struct irdma_qp_uk *qp)
*/
void irdma_clr_wqes(struct irdma_qp_uk *qp, u32 qp_wqe_idx)
{
- __le64 *wqe;
+ struct irdma_qp_quanta *sq;
u32 wqe_idx;
if (!(qp_wqe_idx & 0x7F)) {
wqe_idx = (qp_wqe_idx + 128) % qp->sq_ring.size;
- wqe = qp->sq_base[wqe_idx].elem;
+ sq = qp->sq_base + wqe_idx;
if (wqe_idx)
- memset(wqe, qp->swqe_polarity ? 0 : 0xFF, 0x1000);
+ memset(sq, qp->swqe_polarity ? 0 : 0xFF,
+ 128 * sizeof(*sq));
else
- memset(wqe, qp->swqe_polarity ? 0xFF : 0, 0x1000);
+ memset(sq, qp->swqe_polarity ? 0xFF : 0,
+ 128 * sizeof(*sq));
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 221/591] IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2023-07-16 19:45 ` [PATCH 6.1 220/591] RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 222/591] RDMA/hns: Fix hns_roce_table_get return value Greg Kroah-Hartman
` (373 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dean Luick, Brendan Cunningham,
Dennis Dalessandro, Jason Gunthorpe, Sasha Levin
From: Brendan Cunningham <bcunningham@cornelisnetworks.com>
[ Upstream commit c9358de193ecfb360c3ce75f27ce839ca0b0bc8c ]
The hfi1 user SDMA pinned-page cache will leave a stale cache entry when
the cache-entry's virtual address range is invalidated but that cache
entry is in-use by an outstanding SDMA request.
Subsequent user SDMA requests with buffers in or spanning the virtual
address range of the stale cache entry will result in packets constructed
from the wrong memory, the physical pages pointed to by the stale cache
entry.
To fix this, remove mmu_rb_node cache entries from the mmu_rb_handler
cache independent of the cache entry's refcount. Add 'struct kref
refcount' to struct mmu_rb_node and manage mmu_rb_node lifetime with
kref_get() and kref_put().
mmu_rb_node.refcount makes sdma_mmu_node.refcount redundant. Remove
'atomic_t refcount' from struct sdma_mmu_node and change sdma_mmu_node
code to use mmu_rb_node.refcount.
Move the mmu_rb_handler destructor call after a
wait-for-SDMA-request-completion call so mmu_rb_nodes that need
mmu_rb_handler's workqueue to queue themselves up for destruction from an
interrupt context may do so.
Fixes: f48ad614c100 ("IB/hfi1: Move driver out of staging")
Fixes: 00cbce5cbf88 ("IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests")
Link: https://lore.kernel.org/r/168451393605.3700681.13493776139032178861.stgit@awfm-02.cornelisnetworks.com
Reviewed-by: Dean Luick <dean.luick@cornelisnetworks.com>
Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/ipoib_tx.c | 4 +-
drivers/infiniband/hw/hfi1/mmu_rb.c | 101 ++++++++++-------
drivers/infiniband/hw/hfi1/mmu_rb.h | 3 +
drivers/infiniband/hw/hfi1/sdma.c | 23 +++-
drivers/infiniband/hw/hfi1/sdma.h | 47 +++++---
drivers/infiniband/hw/hfi1/sdma_txreq.h | 2 +
drivers/infiniband/hw/hfi1/user_sdma.c | 137 ++++++++++--------------
drivers/infiniband/hw/hfi1/user_sdma.h | 1 -
drivers/infiniband/hw/hfi1/vnic_sdma.c | 4 +-
9 files changed, 177 insertions(+), 145 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c
index 8973a081d641e..e7d831330278d 100644
--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c
+++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c
@@ -215,11 +215,11 @@ static int hfi1_ipoib_build_ulp_payload(struct ipoib_txreq *tx,
const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
ret = sdma_txadd_page(dd,
- NULL,
txreq,
skb_frag_page(frag),
frag->bv_offset,
- skb_frag_size(frag));
+ skb_frag_size(frag),
+ NULL, NULL, NULL);
if (unlikely(ret))
break;
}
diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
index 71b9ac0188875..94f1701667301 100644
--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
+++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
@@ -19,8 +19,7 @@ static int mmu_notifier_range_start(struct mmu_notifier *,
const struct mmu_notifier_range *);
static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *,
unsigned long, unsigned long);
-static void do_remove(struct mmu_rb_handler *handler,
- struct list_head *del_list);
+static void release_immediate(struct kref *refcount);
static void handle_remove(struct work_struct *work);
static const struct mmu_notifier_ops mn_opts = {
@@ -103,7 +102,11 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler)
}
spin_unlock_irqrestore(&handler->lock, flags);
- do_remove(handler, &del_list);
+ while (!list_empty(&del_list)) {
+ rbnode = list_first_entry(&del_list, struct mmu_rb_node, list);
+ list_del(&rbnode->list);
+ kref_put(&rbnode->refcount, release_immediate);
+ }
/* Now the mm may be freed. */
mmdrop(handler->mn.mm);
@@ -131,12 +134,6 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
}
__mmu_int_rb_insert(mnode, &handler->root);
list_add_tail(&mnode->list, &handler->lru_list);
-
- ret = handler->ops->insert(handler->ops_arg, mnode);
- if (ret) {
- __mmu_int_rb_remove(mnode, &handler->root);
- list_del(&mnode->list); /* remove from LRU list */
- }
mnode->handler = handler;
unlock:
spin_unlock_irqrestore(&handler->lock, flags);
@@ -180,6 +177,48 @@ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler,
return node;
}
+/*
+ * Must NOT call while holding mnode->handler->lock.
+ * mnode->handler->ops->remove() may sleep and mnode->handler->lock is a
+ * spinlock.
+ */
+static void release_immediate(struct kref *refcount)
+{
+ struct mmu_rb_node *mnode =
+ container_of(refcount, struct mmu_rb_node, refcount);
+ mnode->handler->ops->remove(mnode->handler->ops_arg, mnode);
+}
+
+/* Caller must hold mnode->handler->lock */
+static void release_nolock(struct kref *refcount)
+{
+ struct mmu_rb_node *mnode =
+ container_of(refcount, struct mmu_rb_node, refcount);
+ list_move(&mnode->list, &mnode->handler->del_list);
+ queue_work(mnode->handler->wq, &mnode->handler->del_work);
+}
+
+/*
+ * struct mmu_rb_node->refcount kref_put() callback.
+ * Adds mmu_rb_node to mmu_rb_node->handler->del_list and queues
+ * handler->del_work on handler->wq.
+ * Does not remove mmu_rb_node from handler->lru_list or handler->rb_root.
+ * Acquires mmu_rb_node->handler->lock; do not call while already holding
+ * handler->lock.
+ */
+void hfi1_mmu_rb_release(struct kref *refcount)
+{
+ struct mmu_rb_node *mnode =
+ container_of(refcount, struct mmu_rb_node, refcount);
+ struct mmu_rb_handler *handler = mnode->handler;
+ unsigned long flags;
+
+ spin_lock_irqsave(&handler->lock, flags);
+ list_move(&mnode->list, &mnode->handler->del_list);
+ spin_unlock_irqrestore(&handler->lock, flags);
+ queue_work(handler->wq, &handler->del_work);
+}
+
void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
{
struct mmu_rb_node *rbnode, *ptr;
@@ -194,6 +233,10 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
spin_lock_irqsave(&handler->lock, flags);
list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) {
+ /* refcount == 1 implies mmu_rb_handler has only rbnode ref */
+ if (kref_read(&rbnode->refcount) > 1)
+ continue;
+
if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg,
&stop)) {
__mmu_int_rb_remove(rbnode, &handler->root);
@@ -206,7 +249,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
spin_unlock_irqrestore(&handler->lock, flags);
list_for_each_entry_safe(rbnode, ptr, &del_list, list) {
- handler->ops->remove(handler->ops_arg, rbnode);
+ kref_put(&rbnode->refcount, release_immediate);
}
}
@@ -218,7 +261,6 @@ static int mmu_notifier_range_start(struct mmu_notifier *mn,
struct rb_root_cached *root = &handler->root;
struct mmu_rb_node *node, *ptr = NULL;
unsigned long flags;
- bool added = false;
spin_lock_irqsave(&handler->lock, flags);
for (node = __mmu_int_rb_iter_first(root, range->start, range->end-1);
@@ -227,38 +269,16 @@ static int mmu_notifier_range_start(struct mmu_notifier *mn,
ptr = __mmu_int_rb_iter_next(node, range->start,
range->end - 1);
trace_hfi1_mmu_mem_invalidate(node->addr, node->len);
- if (handler->ops->invalidate(handler->ops_arg, node)) {
- __mmu_int_rb_remove(node, root);
- /* move from LRU list to delete list */
- list_move(&node->list, &handler->del_list);
- added = true;
- }
+ /* Remove from rb tree and lru_list. */
+ __mmu_int_rb_remove(node, root);
+ list_del_init(&node->list);
+ kref_put(&node->refcount, release_nolock);
}
spin_unlock_irqrestore(&handler->lock, flags);
- if (added)
- queue_work(handler->wq, &handler->del_work);
-
return 0;
}
-/*
- * Call the remove function for the given handler and the list. This
- * is expected to be called with a delete list extracted from handler.
- * The caller should not be holding the handler lock.
- */
-static void do_remove(struct mmu_rb_handler *handler,
- struct list_head *del_list)
-{
- struct mmu_rb_node *node;
-
- while (!list_empty(del_list)) {
- node = list_first_entry(del_list, struct mmu_rb_node, list);
- list_del(&node->list);
- handler->ops->remove(handler->ops_arg, node);
- }
-}
-
/*
* Work queue function to remove all nodes that have been queued up to
* be removed. The key feature is that mm->mmap_lock is not being held
@@ -271,11 +291,16 @@ static void handle_remove(struct work_struct *work)
del_work);
struct list_head del_list;
unsigned long flags;
+ struct mmu_rb_node *node;
/* remove anything that is queued to get removed */
spin_lock_irqsave(&handler->lock, flags);
list_replace_init(&handler->del_list, &del_list);
spin_unlock_irqrestore(&handler->lock, flags);
- do_remove(handler, &del_list);
+ while (!list_empty(&del_list)) {
+ node = list_first_entry(&del_list, struct mmu_rb_node, list);
+ list_del(&node->list);
+ handler->ops->remove(handler->ops_arg, node);
+ }
}
diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.h b/drivers/infiniband/hw/hfi1/mmu_rb.h
index ed75acdb7b839..dd2c4a0ae95b1 100644
--- a/drivers/infiniband/hw/hfi1/mmu_rb.h
+++ b/drivers/infiniband/hw/hfi1/mmu_rb.h
@@ -16,6 +16,7 @@ struct mmu_rb_node {
struct rb_node node;
struct mmu_rb_handler *handler;
struct list_head list;
+ struct kref refcount;
};
/*
@@ -51,6 +52,8 @@ int hfi1_mmu_rb_register(void *ops_arg,
void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler);
int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
struct mmu_rb_node *mnode);
+void hfi1_mmu_rb_release(struct kref *refcount);
+
void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg);
struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler,
unsigned long addr,
diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
index bb2552dd29c1e..26c62162759ba 100644
--- a/drivers/infiniband/hw/hfi1/sdma.c
+++ b/drivers/infiniband/hw/hfi1/sdma.c
@@ -1593,7 +1593,20 @@ static inline void sdma_unmap_desc(
struct hfi1_devdata *dd,
struct sdma_desc *descp)
{
- system_descriptor_complete(dd, descp);
+ switch (sdma_mapping_type(descp)) {
+ case SDMA_MAP_SINGLE:
+ dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp),
+ sdma_mapping_len(descp), DMA_TO_DEVICE);
+ break;
+ case SDMA_MAP_PAGE:
+ dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp),
+ sdma_mapping_len(descp), DMA_TO_DEVICE);
+ break;
+ }
+
+ if (descp->pinning_ctx && descp->ctx_put)
+ descp->ctx_put(descp->pinning_ctx);
+ descp->pinning_ctx = NULL;
}
/*
@@ -3113,8 +3126,8 @@ int ext_coal_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx,
/* Add descriptor for coalesce buffer */
tx->desc_limit = MAX_DESC;
- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx,
- addr, tx->tlen);
+ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx,
+ addr, tx->tlen, NULL, NULL, NULL);
}
return 1;
@@ -3157,9 +3170,9 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
make_tx_sdma_desc(
tx,
SDMA_MAP_NONE,
- NULL,
dd->sdma_pad_phys,
- sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1)));
+ sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1)),
+ NULL, NULL, NULL);
tx->num_desc++;
_sdma_close_tx(dd, tx);
return rval;
diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h
index 95aaec14c6c28..7fdebab202c4f 100644
--- a/drivers/infiniband/hw/hfi1/sdma.h
+++ b/drivers/infiniband/hw/hfi1/sdma.h
@@ -594,9 +594,11 @@ static inline dma_addr_t sdma_mapping_addr(struct sdma_desc *d)
static inline void make_tx_sdma_desc(
struct sdma_txreq *tx,
int type,
- void *pinning_ctx,
dma_addr_t addr,
- size_t len)
+ size_t len,
+ void *pinning_ctx,
+ void (*ctx_get)(void *),
+ void (*ctx_put)(void *))
{
struct sdma_desc *desc = &tx->descp[tx->num_desc];
@@ -613,7 +615,11 @@ static inline void make_tx_sdma_desc(
<< SDMA_DESC0_PHY_ADDR_SHIFT) |
(((u64)len & SDMA_DESC0_BYTE_COUNT_MASK)
<< SDMA_DESC0_BYTE_COUNT_SHIFT);
+
desc->pinning_ctx = pinning_ctx;
+ desc->ctx_put = ctx_put;
+ if (pinning_ctx && ctx_get)
+ ctx_get(pinning_ctx);
}
/* helper to extend txreq */
@@ -645,18 +651,20 @@ static inline void _sdma_close_tx(struct hfi1_devdata *dd,
static inline int _sdma_txadd_daddr(
struct hfi1_devdata *dd,
int type,
- void *pinning_ctx,
struct sdma_txreq *tx,
dma_addr_t addr,
- u16 len)
+ u16 len,
+ void *pinning_ctx,
+ void (*ctx_get)(void *),
+ void (*ctx_put)(void *))
{
int rval = 0;
make_tx_sdma_desc(
tx,
type,
- pinning_ctx,
- addr, len);
+ addr, len,
+ pinning_ctx, ctx_get, ctx_put);
WARN_ON(len > tx->tlen);
tx->num_desc++;
tx->tlen -= len;
@@ -676,11 +684,18 @@ static inline int _sdma_txadd_daddr(
/**
* sdma_txadd_page() - add a page to the sdma_txreq
* @dd: the device to use for mapping
- * @pinning_ctx: context to be released at descriptor retirement
* @tx: tx request to which the page is added
* @page: page to map
* @offset: offset within the page
* @len: length in bytes
+ * @pinning_ctx: context to be stored on struct sdma_desc .pinning_ctx. Not
+ * added if coalesce buffer is used. E.g. pointer to pinned-page
+ * cache entry for the sdma_desc.
+ * @ctx_get: optional function to take reference to @pinning_ctx. Not called if
+ * @pinning_ctx is NULL.
+ * @ctx_put: optional function to release reference to @pinning_ctx after
+ * sdma_desc completes. May be called in interrupt context so must
+ * not sleep. Not called if @pinning_ctx is NULL.
*
* This is used to add a page/offset/length descriptor.
*
@@ -692,11 +707,13 @@ static inline int _sdma_txadd_daddr(
*/
static inline int sdma_txadd_page(
struct hfi1_devdata *dd,
- void *pinning_ctx,
struct sdma_txreq *tx,
struct page *page,
unsigned long offset,
- u16 len)
+ u16 len,
+ void *pinning_ctx,
+ void (*ctx_get)(void *),
+ void (*ctx_put)(void *))
{
dma_addr_t addr;
int rval;
@@ -720,7 +737,8 @@ static inline int sdma_txadd_page(
return -ENOSPC;
}
- return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, pinning_ctx, tx, addr, len);
+ return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, tx, addr, len,
+ pinning_ctx, ctx_get, ctx_put);
}
/**
@@ -754,8 +772,8 @@ static inline int sdma_txadd_daddr(
return rval;
}
- return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, NULL, tx,
- addr, len);
+ return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, tx, addr, len,
+ NULL, NULL, NULL);
}
/**
@@ -801,7 +819,8 @@ static inline int sdma_txadd_kvaddr(
return -ENOSPC;
}
- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, addr, len);
+ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx, addr, len,
+ NULL, NULL, NULL);
}
struct iowait_work;
@@ -1034,6 +1053,4 @@ u16 sdma_get_descq_cnt(void);
extern uint mod_num_sdma;
void sdma_update_lmc(struct hfi1_devdata *dd, u64 mask, u32 lid);
-
-void system_descriptor_complete(struct hfi1_devdata *dd, struct sdma_desc *descp);
#endif
diff --git a/drivers/infiniband/hw/hfi1/sdma_txreq.h b/drivers/infiniband/hw/hfi1/sdma_txreq.h
index fad946cb5e0d8..85ae7293c2741 100644
--- a/drivers/infiniband/hw/hfi1/sdma_txreq.h
+++ b/drivers/infiniband/hw/hfi1/sdma_txreq.h
@@ -20,6 +20,8 @@ struct sdma_desc {
/* private: don't use directly */
u64 qw[2];
void *pinning_ctx;
+ /* Release reference to @pinning_ctx. May be called in interrupt context. Must not sleep. */
+ void (*ctx_put)(void *ctx);
};
/**
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
index ae58b48afe074..02bd62b857b75 100644
--- a/drivers/infiniband/hw/hfi1/user_sdma.c
+++ b/drivers/infiniband/hw/hfi1/user_sdma.c
@@ -62,18 +62,14 @@ static int defer_packet_queue(
static void activate_packet_queue(struct iowait *wait, int reason);
static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr,
unsigned long len);
-static int sdma_rb_insert(void *arg, struct mmu_rb_node *mnode);
static int sdma_rb_evict(void *arg, struct mmu_rb_node *mnode,
void *arg2, bool *stop);
static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode);
-static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode);
static struct mmu_rb_ops sdma_rb_ops = {
.filter = sdma_rb_filter,
- .insert = sdma_rb_insert,
.evict = sdma_rb_evict,
.remove = sdma_rb_remove,
- .invalidate = sdma_rb_invalidate
};
static int add_system_pages_to_sdma_packet(struct user_sdma_request *req,
@@ -247,14 +243,14 @@ int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd,
spin_unlock(&fd->pq_rcu_lock);
synchronize_srcu(&fd->pq_srcu);
/* at this point there can be no more new requests */
- if (pq->handler)
- hfi1_mmu_rb_unregister(pq->handler);
iowait_sdma_drain(&pq->busy);
/* Wait until all requests have been freed. */
wait_event_interruptible(
pq->wait,
!atomic_read(&pq->n_reqs));
kfree(pq->reqs);
+ if (pq->handler)
+ hfi1_mmu_rb_unregister(pq->handler);
bitmap_free(pq->req_in_use);
kmem_cache_destroy(pq->txreq_cache);
flush_pq_iowait(pq);
@@ -1275,25 +1271,17 @@ static void free_system_node(struct sdma_mmu_node *node)
kfree(node);
}
-static inline void acquire_node(struct sdma_mmu_node *node)
-{
- atomic_inc(&node->refcount);
- WARN_ON(atomic_read(&node->refcount) < 0);
-}
-
-static inline void release_node(struct mmu_rb_handler *handler,
- struct sdma_mmu_node *node)
-{
- atomic_dec(&node->refcount);
- WARN_ON(atomic_read(&node->refcount) < 0);
-}
-
+/*
+ * kref_get()'s an additional kref on the returned rb_node to prevent rb_node
+ * from being released until after rb_node is assigned to an SDMA descriptor
+ * (struct sdma_desc) under add_system_iovec_to_sdma_packet(), even if the
+ * virtual address range for rb_node is invalidated between now and then.
+ */
static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler,
unsigned long start,
unsigned long end)
{
struct mmu_rb_node *rb_node;
- struct sdma_mmu_node *node;
unsigned long flags;
spin_lock_irqsave(&handler->lock, flags);
@@ -1302,11 +1290,12 @@ static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler,
spin_unlock_irqrestore(&handler->lock, flags);
return NULL;
}
- node = container_of(rb_node, struct sdma_mmu_node, rb);
- acquire_node(node);
+
+ /* "safety" kref to prevent release before add_system_iovec_to_sdma_packet() */
+ kref_get(&rb_node->refcount);
spin_unlock_irqrestore(&handler->lock, flags);
- return node;
+ return container_of(rb_node, struct sdma_mmu_node, rb);
}
static int pin_system_pages(struct user_sdma_request *req,
@@ -1355,6 +1344,13 @@ static int pin_system_pages(struct user_sdma_request *req,
return 0;
}
+/*
+ * kref refcount on *node_p will be 2 on successful addition: one kref from
+ * kref_init() for mmu_rb_handler and one kref to prevent *node_p from being
+ * released until after *node_p is assigned to an SDMA descriptor (struct
+ * sdma_desc) under add_system_iovec_to_sdma_packet(), even if the virtual
+ * address range for *node_p is invalidated between now and then.
+ */
static int add_system_pinning(struct user_sdma_request *req,
struct sdma_mmu_node **node_p,
unsigned long start, unsigned long len)
@@ -1368,6 +1364,12 @@ static int add_system_pinning(struct user_sdma_request *req,
if (!node)
return -ENOMEM;
+ /* First kref "moves" to mmu_rb_handler */
+ kref_init(&node->rb.refcount);
+
+ /* "safety" kref to prevent release before add_system_iovec_to_sdma_packet() */
+ kref_get(&node->rb.refcount);
+
node->pq = pq;
ret = pin_system_pages(req, start, len, node, PFN_DOWN(len));
if (ret == 0) {
@@ -1431,15 +1433,15 @@ static int get_system_cache_entry(struct user_sdma_request *req,
return 0;
}
- SDMA_DBG(req, "prepend: node->rb.addr %lx, node->refcount %d",
- node->rb.addr, atomic_read(&node->refcount));
+ SDMA_DBG(req, "prepend: node->rb.addr %lx, node->rb.refcount %d",
+ node->rb.addr, kref_read(&node->rb.refcount));
prepend_len = node->rb.addr - start;
/*
* This node will not be returned, instead a new node
* will be. So release the reference.
*/
- release_node(handler, node);
+ kref_put(&node->rb.refcount, hfi1_mmu_rb_release);
/* Prepend a node to cover the beginning of the allocation */
ret = add_system_pinning(req, node_p, start, prepend_len);
@@ -1451,6 +1453,20 @@ static int get_system_cache_entry(struct user_sdma_request *req,
}
}
+static void sdma_mmu_rb_node_get(void *ctx)
+{
+ struct mmu_rb_node *node = ctx;
+
+ kref_get(&node->refcount);
+}
+
+static void sdma_mmu_rb_node_put(void *ctx)
+{
+ struct sdma_mmu_node *node = ctx;
+
+ kref_put(&node->rb.refcount, hfi1_mmu_rb_release);
+}
+
static int add_mapping_to_sdma_packet(struct user_sdma_request *req,
struct user_sdma_txreq *tx,
struct sdma_mmu_node *cache_entry,
@@ -1494,9 +1510,12 @@ static int add_mapping_to_sdma_packet(struct user_sdma_request *req,
ctx = cache_entry;
}
- ret = sdma_txadd_page(pq->dd, ctx, &tx->txreq,
+ ret = sdma_txadd_page(pq->dd, &tx->txreq,
cache_entry->pages[page_index],
- page_offset, from_this_page);
+ page_offset, from_this_page,
+ ctx,
+ sdma_mmu_rb_node_get,
+ sdma_mmu_rb_node_put);
if (ret) {
/*
* When there's a failure, the entire request is freed by
@@ -1518,8 +1537,6 @@ static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req,
struct user_sdma_iovec *iovec,
size_t from_this_iovec)
{
- struct mmu_rb_handler *handler = req->pq->handler;
-
while (from_this_iovec > 0) {
struct sdma_mmu_node *cache_entry;
size_t from_this_cache_entry;
@@ -1540,15 +1557,15 @@ static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req,
ret = add_mapping_to_sdma_packet(req, tx, cache_entry, start,
from_this_cache_entry);
+
+ /*
+ * Done adding cache_entry to zero or more sdma_desc. Can
+ * kref_put() the "safety" kref taken under
+ * get_system_cache_entry().
+ */
+ kref_put(&cache_entry->rb.refcount, hfi1_mmu_rb_release);
+
if (ret) {
- /*
- * We're guaranteed that there will be no descriptor
- * completion callback that releases this node
- * because only the last descriptor referencing it
- * has a context attached, and a failure means the
- * last descriptor was never added.
- */
- release_node(handler, cache_entry);
SDMA_DBG(req, "add system segment failed %d", ret);
return ret;
}
@@ -1599,42 +1616,12 @@ static int add_system_pages_to_sdma_packet(struct user_sdma_request *req,
return 0;
}
-void system_descriptor_complete(struct hfi1_devdata *dd,
- struct sdma_desc *descp)
-{
- switch (sdma_mapping_type(descp)) {
- case SDMA_MAP_SINGLE:
- dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp),
- sdma_mapping_len(descp), DMA_TO_DEVICE);
- break;
- case SDMA_MAP_PAGE:
- dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp),
- sdma_mapping_len(descp), DMA_TO_DEVICE);
- break;
- }
-
- if (descp->pinning_ctx) {
- struct sdma_mmu_node *node = descp->pinning_ctx;
-
- release_node(node->rb.handler, node);
- }
-}
-
static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr,
unsigned long len)
{
return (bool)(node->addr == addr);
}
-static int sdma_rb_insert(void *arg, struct mmu_rb_node *mnode)
-{
- struct sdma_mmu_node *node =
- container_of(mnode, struct sdma_mmu_node, rb);
-
- atomic_inc(&node->refcount);
- return 0;
-}
-
/*
* Return 1 to remove the node from the rb tree and call the remove op.
*
@@ -1647,10 +1634,6 @@ static int sdma_rb_evict(void *arg, struct mmu_rb_node *mnode,
container_of(mnode, struct sdma_mmu_node, rb);
struct evict_data *evict_data = evict_arg;
- /* is this node still being used? */
- if (atomic_read(&node->refcount))
- return 0; /* keep this node */
-
/* this node will be evicted, add its pages to our count */
evict_data->cleared += node->npages;
@@ -1668,13 +1651,3 @@ static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode)
free_system_node(node);
}
-
-static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode)
-{
- struct sdma_mmu_node *node =
- container_of(mnode, struct sdma_mmu_node, rb);
-
- if (!atomic_read(&node->refcount))
- return 1;
- return 0;
-}
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h
index a241836371dc1..548347d4c5bc2 100644
--- a/drivers/infiniband/hw/hfi1/user_sdma.h
+++ b/drivers/infiniband/hw/hfi1/user_sdma.h
@@ -104,7 +104,6 @@ struct hfi1_user_sdma_comp_q {
struct sdma_mmu_node {
struct mmu_rb_node rb;
struct hfi1_user_sdma_pkt_q *pq;
- atomic_t refcount;
struct page **pages;
unsigned int npages;
};
diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c
index 727eedfba332a..cc6324d2d1ddc 100644
--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c
+++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c
@@ -64,11 +64,11 @@ static noinline int build_vnic_ulp_payload(struct sdma_engine *sde,
/* combine physically continuous fragments later? */
ret = sdma_txadd_page(sde->dd,
- NULL,
&tx->txreq,
skb_frag_page(frag),
skb_frag_off(frag),
- skb_frag_size(frag));
+ skb_frag_size(frag),
+ NULL, NULL, NULL);
if (unlikely(ret))
goto bail_txadd;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 222/591] RDMA/hns: Fix hns_roce_table_get return value
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 221/591] IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 223/591] ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier Greg Kroah-Hartman
` (372 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengchang Tang, Junxian Huang,
Jason Gunthorpe, Sasha Levin
From: Chengchang Tang <tangchengchang@huawei.com>
[ Upstream commit cf5b608fb0e369c473a8303cad6ddb386505e5b8 ]
The return value of set_hem has been fixed to ENODEV, which will lead a
diagnostic information missing.
Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
Link: https://lore.kernel.org/r/20230523121641.3132102-3-huangjunxian6@hisilicon.com
Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hns/hns_roce_hem.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index aa8a08d1c0145..f30274986c0da 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -595,11 +595,12 @@ int hns_roce_table_get(struct hns_roce_dev *hr_dev,
}
/* Set HEM base address(128K/page, pa) to Hardware */
- if (hr_dev->hw->set_hem(hr_dev, table, obj, HEM_HOP_STEP_DIRECT)) {
+ ret = hr_dev->hw->set_hem(hr_dev, table, obj, HEM_HOP_STEP_DIRECT);
+ if (ret) {
hns_roce_free_hem(hr_dev, table->hem[i]);
table->hem[i] = NULL;
- ret = -ENODEV;
- dev_err(dev, "set HEM base address to HW failed.\n");
+ dev_err(dev, "set HEM base address to HW failed, ret = %d.\n",
+ ret);
goto out;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 223/591] ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 222/591] RDMA/hns: Fix hns_roce_table_get return value Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 224/591] arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 Greg Kroah-Hartman
` (371 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Sasha Levin
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 0501fdec106a291c43b3c1b525cf22ab4c24b2d8 ]
make dtbs_check:
arch/arm/boot/dts/renesas/r8a7743-iwg20d-q7.dtb: backlight: pwms: [[58, 0, 5000000], [0]] is too long
From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml
arch/arm/boot/dts/renesas/r8a7743-iwg20d-q7-dbcm-ca.dtb: backlight: pwms: [[67, 0, 5000000], [0]] is too long
From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml
arch/arm/boot/dts/renesas/r8a7744-iwg20d-q7-dbcm-ca.dtb: backlight: pwms: [[67, 0, 5000000], [0]] is too long
From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml
arch/arm/boot/dts/renesas/r8a7744-iwg20d-q7.dtb: backlight: pwms: [[58, 0, 5000000], [0]] is too long
From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml
PWM specifiers referring to R-Car PWM Timer Controllers should contain
only two cells.
Fix this by dropping the bogus third cell.
Fixes: 6f89dd9e9325d05b ("ARM: dts: iwg20d-q7-common: Add LCD support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/6e5c3167424a43faf8c1fa68d9667b3d87dc86d8.1684855911.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/iwg20d-q7-common.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/iwg20d-q7-common.dtsi b/arch/arm/boot/dts/iwg20d-q7-common.dtsi
index 03caea6fc6ffa..4351c5a02fa59 100644
--- a/arch/arm/boot/dts/iwg20d-q7-common.dtsi
+++ b/arch/arm/boot/dts/iwg20d-q7-common.dtsi
@@ -49,7 +49,7 @@ audio_clock: audio_clock {
lcd_backlight: backlight {
compatible = "pwm-backlight";
- pwms = <&pwm3 0 5000000 0>;
+ pwms = <&pwm3 0 5000000>;
brightness-levels = <0 4 8 16 32 64 128 255>;
default-brightness-level = <7>;
enable-gpios = <&gpio5 14 GPIO_ACTIVE_HIGH>;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 224/591] arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 223/591] ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 225/591] drm/msm/dpu: set DSC flush bit correctly at MDP CTL flush register Greg Kroah-Hartman
` (370 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Geert Uytterhoeven,
Sasha Levin
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit 1a2c4e5635177939a088d22fa35c6a7032725663 ]
The schematics are misleading, the flow control is for HSCIF1. We need
SCIF1 for GNSS/GPS which does not use flow control.
Fixes: c6c816e22bc8 ("arm64: dts: ulcb-kf: enable SCIF1")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20230525084823.4195-2-wsa+renesas@sang-engineering.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
index 408871c2859d1..588b14b66b6fb 100644
--- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
+++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
@@ -393,7 +393,7 @@ hscif0_pins: hscif0 {
};
scif1_pins: scif1 {
- groups = "scif1_data_b", "scif1_ctrl";
+ groups = "scif1_data_b";
function = "scif1";
};
@@ -447,7 +447,6 @@ rsnd_for_pcm3168a_capture: endpoint {
&scif1 {
pinctrl-0 = <&scif1_pins>;
pinctrl-names = "default";
- uart-has-rtscts;
status = "okay";
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 225/591] drm/msm/dpu: set DSC flush bit correctly at MDP CTL flush register
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 224/591] arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 226/591] fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() Greg Kroah-Hartman
` (369 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuogee Hsieh, Marijn Suijten,
Dmitry Baryshkov, Sasha Levin
From: Kuogee Hsieh <quic_khsieh@quicinc.com>
[ Upstream commit 12cef323c903bd8b13d1f6ff24a9695c2cdc360b ]
The CTL_FLUSH register should be programmed with the 22th bit
(DSC_IDX) to flush the DSC hardware blocks, not the literal value of
22 (which corresponds to flushing VIG1, VIG2 and RGB1 instead).
Changes in V12:
-- split this patch out of "separate DSC flush update out of interface"
Changes in V13:
-- rewording the commit text
Changes in V14:
-- drop 'DSC" from "The DSC CTL_FLUSH register" at commit text
Fixes: 77f6da90487c ("drm/msm/disp/dpu1: Add DSC support in hw_ctl")
Signed-off-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
Patchwork: https://patchwork.freedesktop.org/patch/539496/
Link: https://lore.kernel.org/r/1685036458-22683-2-git-send-email-quic_khsieh@quicinc.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
index a35ecb6676c88..696c32d30d10c 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
@@ -550,7 +550,7 @@ static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx,
DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE,
BIT(cfg->merge_3d - MERGE_3D_0));
if (cfg->dsc) {
- DPU_REG_WRITE(&ctx->hw, CTL_FLUSH, DSC_IDX);
+ DPU_REG_WRITE(&ctx->hw, CTL_FLUSH, BIT(DSC_IDX));
DPU_REG_WRITE(c, CTL_DSC_ACTIVE, cfg->dsc);
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 226/591] fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 225/591] drm/msm/dpu: set DSC flush bit correctly at MDP CTL flush register Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 227/591] arm64: dts: ti: k3-j7200: Fix physical address of pin Greg Kroah-Hartman
` (368 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Helge Deller,
Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 79a3908d1ea6c35157a6d907b1a9d8ec06015e7a ]
If 'mipid_detect()' fails, we must free 'md' to avoid a memory leak.
Fixes: 66d2f99d0bb5 ("omapfb: add support for MIPI-DCS compatible LCDs")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/omap/lcd_mipid.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/omap/lcd_mipid.c b/drivers/video/fbdev/omap/lcd_mipid.c
index 03cff39d392db..cc1079aad61f2 100644
--- a/drivers/video/fbdev/omap/lcd_mipid.c
+++ b/drivers/video/fbdev/omap/lcd_mipid.c
@@ -563,11 +563,15 @@ static int mipid_spi_probe(struct spi_device *spi)
r = mipid_detect(md);
if (r < 0)
- return r;
+ goto free_md;
omapfb_register_panel(&md->panel);
return 0;
+
+free_md:
+ kfree(md);
+ return r;
}
static void mipid_spi_remove(struct spi_device *spi)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 227/591] arm64: dts: ti: k3-j7200: Fix physical address of pin
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 226/591] fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 228/591] Input: pm8941-powerkey - fix debounce on gen2+ PMICs Greg Kroah-Hartman
` (367 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Keerthy, Udit Kumar,
Vignesh Raghavendra, Sasha Levin
From: Keerthy <j-keerthy@ti.com>
[ Upstream commit 3d011933000ed9054c649952d83162d24f020a93 ]
wkup_pmx splits into multiple regions. Like
wkup_pmx0 -> 13 pins (WKUP_PADCONFIG 0 - 12)
wkup_pmx1 -> 2 pins (WKUP_PADCONFIG 14 - 15)
wkup_pmx2 -> 59 pins (WKUP_PADCONFIG 26 - 84)
wkup_pmx3 -> 8 pins (WKUP_PADCONFIG 93 - 100)
With this split, pin offset needs to be adjusted to
match with new pmx for all pins above wkup_pmx0.
Example a pin under wkup_pmx1 should start from 0 instead of
old offset(0x38 WKUP_PADCONFIG 14 offset)
J7200 Datasheet (Table 6-106, Section 6.4 Pin Multiplexing) :
https://www.ti.com/lit/ds/symlink/dra821u.pdf
Fixes: 9ae21ac445e9 ("arm64: dts: ti: k3-j7200: Fix wakeup pinmux range")
Signed-off-by: Keerthy <j-keerthy@ti.com>
Signed-off-by: Udit Kumar <u-kumar1@ti.com>
Link: https://lore.kernel.org/r/20230419040007.3022780-2-u-kumar1@ti.com
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dts/ti/k3-j7200-common-proc-board.dts | 28 +++++++++----------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
index 50009f963a324..5840063f61293 100644
--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
@@ -83,25 +83,25 @@ vdd_sd_dv: gpio-regulator-TLV71033 {
&wkup_pmx2 {
mcu_cpsw_pins_default: mcu-cpsw-pins-default {
pinctrl-single,pins = <
- J721E_WKUP_IOPAD(0x0068, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */
- J721E_WKUP_IOPAD(0x006c, PIN_INPUT, 0) /* MCU_RGMII1_RX_CTL */
- J721E_WKUP_IOPAD(0x0070, PIN_OUTPUT, 0) /* MCU_RGMII1_TD3 */
- J721E_WKUP_IOPAD(0x0074, PIN_OUTPUT, 0) /* MCU_RGMII1_TD2 */
- J721E_WKUP_IOPAD(0x0078, PIN_OUTPUT, 0) /* MCU_RGMII1_TD1 */
- J721E_WKUP_IOPAD(0x007c, PIN_OUTPUT, 0) /* MCU_RGMII1_TD0 */
- J721E_WKUP_IOPAD(0x0088, PIN_INPUT, 0) /* MCU_RGMII1_RD3 */
- J721E_WKUP_IOPAD(0x008c, PIN_INPUT, 0) /* MCU_RGMII1_RD2 */
- J721E_WKUP_IOPAD(0x0090, PIN_INPUT, 0) /* MCU_RGMII1_RD1 */
- J721E_WKUP_IOPAD(0x0094, PIN_INPUT, 0) /* MCU_RGMII1_RD0 */
- J721E_WKUP_IOPAD(0x0080, PIN_OUTPUT, 0) /* MCU_RGMII1_TXC */
- J721E_WKUP_IOPAD(0x0084, PIN_INPUT, 0) /* MCU_RGMII1_RXC */
+ J721E_WKUP_IOPAD(0x0000, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */
+ J721E_WKUP_IOPAD(0x0004, PIN_INPUT, 0) /* MCU_RGMII1_RX_CTL */
+ J721E_WKUP_IOPAD(0x0008, PIN_OUTPUT, 0) /* MCU_RGMII1_TD3 */
+ J721E_WKUP_IOPAD(0x000c, PIN_OUTPUT, 0) /* MCU_RGMII1_TD2 */
+ J721E_WKUP_IOPAD(0x0010, PIN_OUTPUT, 0) /* MCU_RGMII1_TD1 */
+ J721E_WKUP_IOPAD(0x0014, PIN_OUTPUT, 0) /* MCU_RGMII1_TD0 */
+ J721E_WKUP_IOPAD(0x0020, PIN_INPUT, 0) /* MCU_RGMII1_RD3 */
+ J721E_WKUP_IOPAD(0x0024, PIN_INPUT, 0) /* MCU_RGMII1_RD2 */
+ J721E_WKUP_IOPAD(0x0028, PIN_INPUT, 0) /* MCU_RGMII1_RD1 */
+ J721E_WKUP_IOPAD(0x002c, PIN_INPUT, 0) /* MCU_RGMII1_RD0 */
+ J721E_WKUP_IOPAD(0x0018, PIN_OUTPUT, 0) /* MCU_RGMII1_TXC */
+ J721E_WKUP_IOPAD(0x001c, PIN_INPUT, 0) /* MCU_RGMII1_RXC */
>;
};
mcu_mdio_pins_default: mcu-mdio1-pins-default {
pinctrl-single,pins = <
- J721E_WKUP_IOPAD(0x009c, PIN_OUTPUT, 0) /* (L1) MCU_MDIO0_MDC */
- J721E_WKUP_IOPAD(0x0098, PIN_INPUT, 0) /* (L4) MCU_MDIO0_MDIO */
+ J721E_WKUP_IOPAD(0x0034, PIN_OUTPUT, 0) /* (L1) MCU_MDIO0_MDC */
+ J721E_WKUP_IOPAD(0x0030, PIN_INPUT, 0) /* (L4) MCU_MDIO0_MDIO */
>;
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 228/591] Input: pm8941-powerkey - fix debounce on gen2+ PMICs
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 227/591] arm64: dts: ti: k3-j7200: Fix physical address of pin Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 229/591] ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 Greg Kroah-Hartman
` (366 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Caleb Connolly, Dmitry Torokhov,
Sasha Levin
From: Caleb Connolly <caleb.connolly@linaro.org>
[ Upstream commit 8c9cce9cb81b5fdc6e66bf3f129727b89e8daab7 ]
Since PM8998/PM660, the power key debounce register was redefined to
support shorter debounce times. On PM8941 the shortest debounce time
(represented by register value 0) was 15625us, on PM8998 the shortest
debounce time is 62us, with the default being 2ms.
Adjust the bit shift to correctly program debounce on PM8998 and newer.
Fixes: 68c581d5e7d8 ("Input: add Qualcomm PM8941 power key driver")
Signed-off-by: Caleb Connolly <caleb.connolly@linaro.org>
Link: https://lore.kernel.org/r/20230529-pm8941-pwrkey-debounce-v1-2-c043a6d5c814@linaro.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/pm8941-pwrkey.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/input/misc/pm8941-pwrkey.c b/drivers/input/misc/pm8941-pwrkey.c
index 549df01b6ee33..5dd68a02c4451 100644
--- a/drivers/input/misc/pm8941-pwrkey.c
+++ b/drivers/input/misc/pm8941-pwrkey.c
@@ -50,7 +50,10 @@
#define PON_RESIN_PULL_UP BIT(0)
#define PON_DBC_CTL 0x71
-#define PON_DBC_DELAY_MASK 0x7
+#define PON_DBC_DELAY_MASK_GEN1 0x7
+#define PON_DBC_DELAY_MASK_GEN2 0xf
+#define PON_DBC_SHIFT_GEN1 6
+#define PON_DBC_SHIFT_GEN2 14
struct pm8941_data {
unsigned int pull_up_bit;
@@ -247,7 +250,7 @@ static int pm8941_pwrkey_probe(struct platform_device *pdev)
struct device *parent;
struct device_node *regmap_node;
const __be32 *addr;
- u32 req_delay;
+ u32 req_delay, mask, delay_shift;
int error;
if (of_property_read_u32(pdev->dev.of_node, "debounce", &req_delay))
@@ -336,12 +339,20 @@ static int pm8941_pwrkey_probe(struct platform_device *pdev)
pwrkey->input->phys = pwrkey->data->phys;
if (pwrkey->data->supports_debounce_config) {
- req_delay = (req_delay << 6) / USEC_PER_SEC;
+ if (pwrkey->subtype >= PON_SUBTYPE_GEN2_PRIMARY) {
+ mask = PON_DBC_DELAY_MASK_GEN2;
+ delay_shift = PON_DBC_SHIFT_GEN2;
+ } else {
+ mask = PON_DBC_DELAY_MASK_GEN1;
+ delay_shift = PON_DBC_SHIFT_GEN1;
+ }
+
+ req_delay = (req_delay << delay_shift) / USEC_PER_SEC;
req_delay = ilog2(req_delay);
error = regmap_update_bits(pwrkey->regmap,
pwrkey->baseaddr + PON_DBC_CTL,
- PON_DBC_DELAY_MASK,
+ mask,
req_delay);
if (error) {
dev_err(&pdev->dev, "failed to set debounce: %d\n",
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 229/591] ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 228/591] Input: pm8941-powerkey - fix debounce on gen2+ PMICs Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 230/591] ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx Greg Kroah-Hartman
` (365 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Alexandre Torgue,
Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit e3f2778b1b6ced649bffdc7cbb05b80bb92f2108 ]
The audio routing flow is not correct, the flow should be from source
(second element in the pair) to sink (first element in the pair). The
flow now is from "HP_OUT" to "Playback", where "Playback" is source
and "HP_OUT" is sink, i.e. the direction is swapped and there is no
direct link between the two either.
Fill in the correct routing, where "HP_OUT" supplies the "Headphone Jack",
"Line In Jack" supplies "LINE_IN" input, "Microphone Jack" supplies "MIC_IN"
input and "Mic Bias" supplies "Microphone Jack".
Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board")
Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
index 5f586f024060f..38f46c2c83aa6 100644
--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
@@ -137,10 +137,13 @@ reg_panel_supply: regulator-panel-supply {
sound {
compatible = "audio-graph-card";
- routing =
- "MIC_IN", "Capture",
- "Capture", "Mic Bias",
- "Playback", "HP_OUT";
+ widgets = "Headphone", "Headphone Jack",
+ "Line", "Line In Jack",
+ "Microphone", "Microphone Jack";
+ routing = "Headphone Jack", "HP_OUT",
+ "LINE_IN", "Line In Jack",
+ "MIC_IN", "Microphone Jack",
+ "Microphone Jack", "Mic Bias";
dais = <&sai2a_port &sai2b_port>;
status = "okay";
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 230/591] ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 229/591] ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 231/591] hwmon: (gsc-hwmon) fix fan pwm temperature scaling Greg Kroah-Hartman
` (364 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olivier Moysan, Alexandre Torgue,
Sasha Levin
From: Olivier Moysan <olivier.moysan@foss.st.com>
[ Upstream commit 076c74c592cabe4a47537fe5205b5b678bed010d ]
Use "dai-format" to configure DAI audio format as specified in
audio-graph-port.yaml bindings.
Fixes: 144d1ba70548 ("ARM: dts: stm32: Adapt STM32MP157 DK boards to stm32 DT diversity")
Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/stm32mp15xx-dkx.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
index 8b48d3c89a047..fdc48536e97d1 100644
--- a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
+++ b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
@@ -438,7 +438,7 @@ &i2s2 {
i2s2_port: port {
i2s2_endpoint: endpoint {
remote-endpoint = <&sii9022_tx_endpoint>;
- format = "i2s";
+ dai-format = "i2s";
mclk-fs = <256>;
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 231/591] hwmon: (gsc-hwmon) fix fan pwm temperature scaling
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 230/591] ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 232/591] hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272 Greg Kroah-Hartman
` (363 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tim Harvey, Guenter Roeck,
Sasha Levin
From: Tim Harvey <tharvey@gateworks.com>
[ Upstream commit a6d80df47ee2c69db99e4f2f8871aa4db154620b ]
The GSC fan pwm temperature register is in centidegrees celcius but the
Linux hwmon convention is to use milidegrees celcius. Fix the scaling.
Fixes: 3bce5377ef66 ("hwmon: Add Gateworks System Controller support")
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Link: https://lore.kernel.org/r/20230606153004.1448086-1-tharvey@gateworks.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/gsc-hwmon.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/hwmon/gsc-hwmon.c b/drivers/hwmon/gsc-hwmon.c
index b60ec95b5edbf..74bfc21c2767b 100644
--- a/drivers/hwmon/gsc-hwmon.c
+++ b/drivers/hwmon/gsc-hwmon.c
@@ -82,8 +82,8 @@ static ssize_t pwm_auto_point_temp_store(struct device *dev,
if (kstrtol(buf, 10, &temp))
return -EINVAL;
- temp = clamp_val(temp, 0, 10000);
- temp = DIV_ROUND_CLOSEST(temp, 10);
+ temp = clamp_val(temp, 0, 100000);
+ temp = DIV_ROUND_CLOSEST(temp, 100);
regs[0] = temp & 0xff;
regs[1] = (temp >> 8) & 0xff;
@@ -100,7 +100,7 @@ static ssize_t pwm_auto_point_pwm_show(struct device *dev,
{
struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
- return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10)) / 100);
+ return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10)));
}
static SENSOR_DEVICE_ATTR_RO(pwm1_auto_point1_pwm, pwm_auto_point_pwm, 0);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 232/591] hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 231/591] hwmon: (gsc-hwmon) fix fan pwm temperature scaling Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 233/591] ARM: dts: BCM5301X: fix duplex-full => full-duplex Greg Kroah-Hartman
` (362 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Sasha Levin
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit b153a0bb4199566abd337119207f82b59a8cd1ca ]
The PMON_CONFIG register on ADM1272 is a 16 bit register. Writing a 8 bit
value into it clears the upper 8 bits of the register, resulting in
unexpected side effects. Fix by writing the 16 bit register value.
Also, it has been reported that temperature readings are sometimes widely
inaccurate, to the point where readings may result in device shutdown due
to errant overtemperature faults. Improve by enabling temperature sampling.
While at it, move the common code for ADM1272 and ADM1278 into a separate
function, and clarify in the error message that an attempt was made to
enable both VOUT and temperature monitoring.
Last but not least, return the error code reported by the underlying I2C
controller and not -ENODEV if updating the PMON_CONFIG register fails.
After all, this does not indicate that the chip is not present, but an
error in the communication with the chip.
Fixes: 4ff0ce227a1e ("hwmon: (pmbus/adm1275) Add support for ADM1272")
Fixes: 9da9c2dc57b2 ("hwmon: (adm1275) enable adm1272 temperature reporting")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20230602213447.3557346-1-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/pmbus/adm1275.c | 52 +++++++++++++++++------------------
1 file changed, 26 insertions(+), 26 deletions(-)
diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c
index 3b07bfb43e937..b8543c06d022a 100644
--- a/drivers/hwmon/pmbus/adm1275.c
+++ b/drivers/hwmon/pmbus/adm1275.c
@@ -37,10 +37,13 @@ enum chips { adm1075, adm1272, adm1275, adm1276, adm1278, adm1293, adm1294 };
#define ADM1272_IRANGE BIT(0)
+#define ADM1278_TSFILT BIT(15)
#define ADM1278_TEMP1_EN BIT(3)
#define ADM1278_VIN_EN BIT(2)
#define ADM1278_VOUT_EN BIT(1)
+#define ADM1278_PMON_DEFCONFIG (ADM1278_VOUT_EN | ADM1278_TEMP1_EN | ADM1278_TSFILT)
+
#define ADM1293_IRANGE_25 0
#define ADM1293_IRANGE_50 BIT(6)
#define ADM1293_IRANGE_100 BIT(7)
@@ -462,6 +465,22 @@ static const struct i2c_device_id adm1275_id[] = {
};
MODULE_DEVICE_TABLE(i2c, adm1275_id);
+/* Enable VOUT & TEMP1 if not enabled (disabled by default) */
+static int adm1275_enable_vout_temp(struct i2c_client *client, int config)
+{
+ int ret;
+
+ if ((config & ADM1278_PMON_DEFCONFIG) != ADM1278_PMON_DEFCONFIG) {
+ config |= ADM1278_PMON_DEFCONFIG;
+ ret = i2c_smbus_write_word_data(client, ADM1275_PMON_CONFIG, config);
+ if (ret < 0) {
+ dev_err(&client->dev, "Failed to enable VOUT/TEMP1 monitoring\n");
+ return ret;
+ }
+ }
+ return 0;
+}
+
static int adm1275_probe(struct i2c_client *client)
{
s32 (*config_read_fn)(const struct i2c_client *client, u8 reg);
@@ -615,19 +634,10 @@ static int adm1275_probe(struct i2c_client *client)
PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT |
PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP;
- /* Enable VOUT & TEMP1 if not enabled (disabled by default) */
- if ((config & (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) !=
- (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) {
- config |= ADM1278_VOUT_EN | ADM1278_TEMP1_EN;
- ret = i2c_smbus_write_byte_data(client,
- ADM1275_PMON_CONFIG,
- config);
- if (ret < 0) {
- dev_err(&client->dev,
- "Failed to enable VOUT monitoring\n");
- return -ENODEV;
- }
- }
+ ret = adm1275_enable_vout_temp(client, config);
+ if (ret)
+ return ret;
+
if (config & ADM1278_VIN_EN)
info->func[0] |= PMBUS_HAVE_VIN;
break;
@@ -684,19 +694,9 @@ static int adm1275_probe(struct i2c_client *client)
PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT |
PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP;
- /* Enable VOUT & TEMP1 if not enabled (disabled by default) */
- if ((config & (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) !=
- (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) {
- config |= ADM1278_VOUT_EN | ADM1278_TEMP1_EN;
- ret = i2c_smbus_write_word_data(client,
- ADM1275_PMON_CONFIG,
- config);
- if (ret < 0) {
- dev_err(&client->dev,
- "Failed to enable VOUT monitoring\n");
- return -ENODEV;
- }
- }
+ ret = adm1275_enable_vout_temp(client, config);
+ if (ret)
+ return ret;
if (config & ADM1278_VIN_EN)
info->func[0] |= PMBUS_HAVE_VIN;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 233/591] ARM: dts: BCM5301X: fix duplex-full => full-duplex
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 232/591] hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272 Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 234/591] clk: Export clk_hw_forward_rate_request() Greg Kroah-Hartman
` (361 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Lamparter,
Florian Fainelli, Sasha Levin
From: Christian Lamparter <chunkeey@gmail.com>
[ Upstream commit fd274b733bfdde3ca72f0fa2a37f032f3a8c402c ]
this typo was found by the dtbs_check
| ports:port@5:fixed-link: 'oneOf' conditional failed,
| {'speed': [[1000]], 'duplex-full': True} is not of type 'array'
| 'duplex-full' does not match any of the regexes: 'pinctrl-[0-]..."
this should have been full-duplex;
Fixes: 935327a73553 ("ARM: dts: BCM5301X: Add DT for Meraki MR26")
Fixes: ec88a9c344d9 ("ARM: BCM5301X: Add DT for Meraki MR32")
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Link: https://lore.kernel.org/r/50522f45566951a9eabd22820647924cc6b4a264.1686238550.git.chunkeey@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm53015-meraki-mr26.dts | 2 +-
arch/arm/boot/dts/bcm53016-meraki-mr32.dts | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/bcm53015-meraki-mr26.dts b/arch/arm/boot/dts/bcm53015-meraki-mr26.dts
index 14f58033efeb9..ca2266b936ee2 100644
--- a/arch/arm/boot/dts/bcm53015-meraki-mr26.dts
+++ b/arch/arm/boot/dts/bcm53015-meraki-mr26.dts
@@ -128,7 +128,7 @@ port@5 {
fixed-link {
speed = <1000>;
- duplex-full;
+ full-duplex;
};
};
};
diff --git a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
index e678bc03d8165..008de8ee2584a 100644
--- a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
+++ b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
@@ -187,7 +187,7 @@ port@5 {
fixed-link {
speed = <1000>;
- duplex-full;
+ full-duplex;
};
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 234/591] clk: Export clk_hw_forward_rate_request()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 233/591] ARM: dts: BCM5301X: fix duplex-full => full-duplex Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 235/591] MIPS: DTS: CI20: Fix ACT8600 regulator node names Greg Kroah-Hartman
` (360 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Stephen Boyd,
Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit ed046ac74da0b5602566073023a1519b5ae657b7 ]
Commit 262ca38f4b6e ("clk: Stop forwarding clk_rate_requests to the
parent") introduced the public clk_hw_forward_rate_request() function,
but didn't export the symbol. Make sure it's the case.
Fixes: 262ca38f4b6e ("clk: Stop forwarding clk_rate_requests to the parent")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20221018-clk-range-checks-fixes-v4-1-971d5077e7d2@cerno.tech
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 57b83665e5c3a..d4a74759fe292 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1525,6 +1525,7 @@ void clk_hw_forward_rate_request(const struct clk_hw *hw,
parent->core, req,
parent_rate);
}
+EXPORT_SYMBOL_GPL(clk_hw_forward_rate_request);
static bool clk_core_can_round(struct clk_core * const core)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 235/591] MIPS: DTS: CI20: Fix ACT8600 regulator node names
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 234/591] clk: Export clk_hw_forward_rate_request() Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 236/591] drm/amd/display: Fix a test CalculatePrefetchSchedule() Greg Kroah-Hartman
` (359 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Cercueil, Thomas Bogendoerfer,
Sasha Levin
From: Paul Cercueil <paul@crapouillou.net>
[ Upstream commit 08384e80a70fb1942510ab5f0ce27bad134e634e ]
The Device Tree was using invalid node names for the ACT8600 regulators.
To be fair, it is not the original committer's fault, as the
documentation did gives invalid names as well.
In theory, the fix should have been to modify the driver to accept the
alternative names. However, even though the act8865 driver spits
warnings, the kernel seemed to work fine with what is currently
supported upstream. For that reason, I think it is okay to just update
the DTS.
I removed the "regulator-name" too, since they really didn't bring any
information. The node names are enough.
Fixes: 73f2b940474d ("MIPS: CI20: DTS: Add I2C nodes")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/boot/dts/ingenic/ci20.dts | 27 ++++++++-------------------
1 file changed, 8 insertions(+), 19 deletions(-)
diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts
index 8f21d2304737c..994c7ebfddc80 100644
--- a/arch/mips/boot/dts/ingenic/ci20.dts
+++ b/arch/mips/boot/dts/ingenic/ci20.dts
@@ -237,59 +237,49 @@ &i2c0 {
act8600: act8600@5a {
compatible = "active-semi,act8600";
reg = <0x5a>;
- status = "okay";
regulators {
- vddcore: SUDCDC1 {
- regulator-name = "DCDC_REG1";
+ vddcore: DCDC1 {
regulator-min-microvolt = <1100000>;
regulator-max-microvolt = <1100000>;
regulator-always-on;
};
- vddmem: SUDCDC2 {
- regulator-name = "DCDC_REG2";
+ vddmem: DCDC2 {
regulator-min-microvolt = <1500000>;
regulator-max-microvolt = <1500000>;
regulator-always-on;
};
- vcc_33: SUDCDC3 {
- regulator-name = "DCDC_REG3";
+ vcc_33: DCDC3 {
regulator-min-microvolt = <3300000>;
regulator-max-microvolt = <3300000>;
regulator-always-on;
};
- vcc_50: SUDCDC4 {
- regulator-name = "SUDCDC_REG4";
+ vcc_50: SUDCDC_REG4 {
regulator-min-microvolt = <5000000>;
regulator-max-microvolt = <5000000>;
regulator-always-on;
};
- vcc_25: LDO_REG5 {
- regulator-name = "LDO_REG5";
+ vcc_25: LDO5 {
regulator-min-microvolt = <2500000>;
regulator-max-microvolt = <2500000>;
regulator-always-on;
};
- wifi_io: LDO_REG6 {
- regulator-name = "LDO_REG6";
+ wifi_io: LDO6 {
regulator-min-microvolt = <2500000>;
regulator-max-microvolt = <2500000>;
regulator-always-on;
};
- vcc_28: LDO_REG7 {
- regulator-name = "LDO_REG7";
+ cim_io_28: LDO7 {
regulator-min-microvolt = <2800000>;
regulator-max-microvolt = <2800000>;
regulator-always-on;
};
- vcc_15: LDO_REG8 {
- regulator-name = "LDO_REG8";
+ cim_io_15: LDO8 {
regulator-min-microvolt = <1500000>;
regulator-max-microvolt = <1500000>;
regulator-always-on;
};
vrtc_18: LDO_REG9 {
- regulator-name = "LDO_REG9";
/* Despite the datasheet stating 3.3V
* for REG9 and the driver expecting that,
* REG9 outputs 1.8V.
@@ -303,7 +293,6 @@ vrtc_18: LDO_REG9 {
regulator-always-on;
};
vcc_11: LDO_REG10 {
- regulator-name = "LDO_REG10";
regulator-min-microvolt = <1200000>;
regulator-max-microvolt = <1200000>;
regulator-always-on;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 236/591] drm/amd/display: Fix a test CalculatePrefetchSchedule()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 235/591] MIPS: DTS: CI20: Fix ACT8600 regulator node names Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 237/591] drm/amd/display: Fix a test dml32_rq_dlg_get_rq_reg() Greg Kroah-Hartman
` (358 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Hamza Mahfooz,
Alex Deucher, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 960e27a5741cd3001996ff6ddfb3eb0ed3a4909d ]
It is likely Height was expected here, instead of Width.
Test the correct variable.
Fixes: 17529ea2acfa ("drm/amd/display: Optimizations for DML math")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
index b7c2844d0cbee..f294f2f8c75bc 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
@@ -810,7 +810,7 @@ static bool CalculatePrefetchSchedule(
*swath_width_chroma_ub = dml_ceil(SwathWidthY / 2 - 1, myPipe->BlockWidth256BytesC) + myPipe->BlockWidth256BytesC;
} else {
*swath_width_luma_ub = dml_ceil(SwathWidthY - 1, myPipe->BlockHeight256BytesY) + myPipe->BlockHeight256BytesY;
- if (myPipe->BlockWidth256BytesC > 0)
+ if (myPipe->BlockHeight256BytesC > 0)
*swath_width_chroma_ub = dml_ceil(SwathWidthY / 2 - 1, myPipe->BlockHeight256BytesC) + myPipe->BlockHeight256BytesC;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 237/591] drm/amd/display: Fix a test dml32_rq_dlg_get_rq_reg()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 236/591] drm/amd/display: Fix a test CalculatePrefetchSchedule() Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 238/591] drm/amdkfd: Fix potential deallocation of previously deallocated memory Greg Kroah-Hartman
` (357 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Hamza Mahfooz,
Alex Deucher, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit bafc31166aa7df5fa26ae0ad8196d1717e6cdea9 ]
It is likely p1_min_meta_chunk_bytes was expected here, instead of
min_meta_chunk_bytes.
Test the correct variable.
Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
index 395ae8761980f..9ba6cb67655f4 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
@@ -116,7 +116,7 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
else
rq_regs->rq_regs_l.min_meta_chunk_size = dml_log2(min_meta_chunk_bytes) - 6 + 1;
- if (min_meta_chunk_bytes == 0)
+ if (p1_min_meta_chunk_bytes == 0)
rq_regs->rq_regs_c.min_meta_chunk_size = 0;
else
rq_regs->rq_regs_c.min_meta_chunk_size = dml_log2(p1_min_meta_chunk_bytes) - 6 + 1;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 238/591] drm/amdkfd: Fix potential deallocation of previously deallocated memory.
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 237/591] drm/amd/display: Fix a test dml32_rq_dlg_get_rq_reg() Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 239/591] soc: mediatek: SVS: Fix MT8192 GPU node name Greg Kroah-Hartman
` (356 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniil Dulov, Felix Kuehling,
Alex Deucher, Sasha Levin
From: Daniil Dulov <d.dulov@aladdin.ru>
[ Upstream commit cabbdea1f1861098991768d7bbf5a49ed1608213 ]
Pointer mqd_mem_obj can be deallocated in kfd_gtt_sa_allocate().
The function then returns non-zero value, which causes the second deallocation.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: d1f8f0d17d40 ("drm/amdkfd: Move non-sdma mqd allocation out of init_mqd")
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
index 0778e587a2d68..eaf084acb706f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
@@ -115,18 +115,19 @@ static struct kfd_mem_obj *allocate_mqd(struct kfd_dev *kfd,
&(mqd_mem_obj->gtt_mem),
&(mqd_mem_obj->gpu_addr),
(void *)&(mqd_mem_obj->cpu_ptr), true);
+
+ if (retval) {
+ kfree(mqd_mem_obj);
+ return NULL;
+ }
} else {
retval = kfd_gtt_sa_allocate(kfd, sizeof(struct v9_mqd),
&mqd_mem_obj);
- }
-
- if (retval) {
- kfree(mqd_mem_obj);
- return NULL;
+ if (retval)
+ return NULL;
}
return mqd_mem_obj;
-
}
static void init_mqd(struct mqd_manager *mm, void **mqd,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 239/591] soc: mediatek: SVS: Fix MT8192 GPU node name
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 238/591] drm/amdkfd: Fix potential deallocation of previously deallocated memory Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 240/591] drm/amd/display: Fix artifacting on eDP panels when engaging freesync video mode Greg Kroah-Hartman
` (355 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai,
AngeloGioacchino Del Regno, Alexandre Mergnat, Matthias Brugger,
Sasha Levin
From: Chen-Yu Tsai <wenst@chromium.org>
[ Upstream commit 95094495401bdf6a0649d220dfd095e6079b5e39 ]
Device tree node names should be generic. The planned device node name
for the GPU, according to the bindings and posted DT changes, is "gpu",
not "mali".
Fix the GPU node name in the SVS driver to follow.
Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
Link: https://lore.kernel.org/r/20230531063532.2240038-1-wenst@chromium.org
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/mediatek/mtk-svs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
index e55fb16fdc5ac..f00cd5c723499 100644
--- a/drivers/soc/mediatek/mtk-svs.c
+++ b/drivers/soc/mediatek/mtk-svs.c
@@ -2114,9 +2114,9 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
svsb = &svsp->banks[idx];
if (svsb->type == SVSB_HIGH)
- svsb->opp_dev = svs_add_device_link(svsp, "mali");
+ svsb->opp_dev = svs_add_device_link(svsp, "gpu");
else if (svsb->type == SVSB_LOW)
- svsb->opp_dev = svs_get_subsys_device(svsp, "mali");
+ svsb->opp_dev = svs_get_subsys_device(svsp, "gpu");
if (IS_ERR(svsb->opp_dev))
return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 240/591] drm/amd/display: Fix artifacting on eDP panels when engaging freesync video mode
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 239/591] soc: mediatek: SVS: Fix MT8192 GPU node name Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 241/591] drm/radeon: fix possible division-by-zero errors Greg Kroah-Hartman
` (354 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aurabindo Pillai, Rodrigo Siqueira,
Alex Deucher, Sasha Levin
From: Aurabindo Pillai <aurabindo.pillai@amd.com>
[ Upstream commit b18f05a0666aecd5cb19c26a8305bcfa4e9d6502 ]
[Why]
When freesync video mode is enabled, switching resolution from native
mode to one of the freesync video compatible modes can trigger continous
artifacts on some eDP panels when running under KDE. The articating can be seen in the
attached bug report.
[How]
Fix this by restricting updates that require full commit by using the same checks
for stream and scaling changes in the the enable pass of dm_update_crtc_state()
along with the check for compatible timings for freesync vide mode.
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2162
Fixes: da5e14909776 ("drm/amd/display: Fix hang when skipping modeset")
Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 91c308cf27eb2..b854eec2787e2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -8873,6 +8873,8 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
/* Now check if we should set freesync video mode */
if (amdgpu_freesync_vid_mode && dm_new_crtc_state->stream &&
+ dc_is_stream_unchanged(new_stream, dm_old_crtc_state->stream) &&
+ dc_is_stream_scaling_unchanged(new_stream, dm_old_crtc_state->stream) &&
is_timing_unchanged_for_freesync(new_crtc_state,
old_crtc_state)) {
new_crtc_state->mode_changed = false;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 241/591] drm/radeon: fix possible division-by-zero errors
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 240/591] drm/amd/display: Fix artifacting on eDP panels when engaging freesync video mode Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 242/591] HID: uclogic: Modular KUnit tests should not depend on KUNIT=y Greg Kroah-Hartman
` (353 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich, Alex Deucher,
Sasha Levin
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit 1becc57cd1a905e2aa0e1eca60d2a37744525c4a ]
Function rv740_get_decoded_reference_divider() may return 0 due to
unpredictable reference divider value calculated in
radeon_atom_get_clock_dividers(). This will lead to
division-by-zero error once that value is used as a divider
in calculating 'clk_s'.
While unlikely, this issue should nonetheless be prevented so add a
sanity check for such cases by testing 'decoded_ref' value against 0.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
v2: minor coding style fixes (Alex)
In practice this should actually happen as the vbios should be
properly populated.
Fixes: 66229b200598 ("drm/radeon/kms: add dpm support for rv7xx (v4)")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/cypress_dpm.c | 8 ++++++--
drivers/gpu/drm/radeon/ni_dpm.c | 8 ++++++--
drivers/gpu/drm/radeon/rv740_dpm.c | 8 ++++++--
3 files changed, 18 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
index fdddbbaecbb74..72a0768df00f7 100644
--- a/drivers/gpu/drm/radeon/cypress_dpm.c
+++ b/drivers/gpu/drm/radeon/cypress_dpm.c
@@ -557,8 +557,12 @@ static int cypress_populate_mclk_value(struct radeon_device *rdev,
ASIC_INTERNAL_MEMORY_SS, vco_freq)) {
u32 reference_clock = rdev->clock.mpll.reference_freq;
u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div);
- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
- u32 clk_v = ss.percentage *
+ u32 clk_s, clk_v;
+
+ if (!decoded_ref)
+ return -EINVAL;
+ clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
+ clk_v = ss.percentage *
(0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625);
mpll_ss1 &= ~CLKV_MASK;
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 672d2239293e0..3e1c1a392fb7b 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -2241,8 +2241,12 @@ static int ni_populate_mclk_value(struct radeon_device *rdev,
ASIC_INTERNAL_MEMORY_SS, vco_freq)) {
u32 reference_clock = rdev->clock.mpll.reference_freq;
u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div);
- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
- u32 clk_v = ss.percentage *
+ u32 clk_s, clk_v;
+
+ if (!decoded_ref)
+ return -EINVAL;
+ clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
+ clk_v = ss.percentage *
(0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625);
mpll_ss1 &= ~CLKV_MASK;
diff --git a/drivers/gpu/drm/radeon/rv740_dpm.c b/drivers/gpu/drm/radeon/rv740_dpm.c
index d57a3e1df8d63..4464fd21a3029 100644
--- a/drivers/gpu/drm/radeon/rv740_dpm.c
+++ b/drivers/gpu/drm/radeon/rv740_dpm.c
@@ -249,8 +249,12 @@ int rv740_populate_mclk_value(struct radeon_device *rdev,
ASIC_INTERNAL_MEMORY_SS, vco_freq)) {
u32 reference_clock = rdev->clock.mpll.reference_freq;
u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div);
- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
- u32 clk_v = 0x40000 * ss.percentage *
+ u32 clk_s, clk_v;
+
+ if (!decoded_ref)
+ return -EINVAL;
+ clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
+ clk_v = 0x40000 * ss.percentage *
(dividers.whole_fb_div + (dividers.frac_fb_div / 8)) / (clk_s * 10000);
mpll_ss1 &= ~CLKV_MASK;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 242/591] HID: uclogic: Modular KUnit tests should not depend on KUNIT=y
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 241/591] drm/radeon: fix possible division-by-zero errors Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 243/591] RDMA/rxe: Add ibdev_dbg macros for rxe Greg Kroah-Hartman
` (352 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, David Gow,
José Expósito, Jiri Kosina, Sasha Levin
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 49904a0ebf23b15aad288a10f5354e7cd8193121 ]
While KUnit tests that cannot be built as a loadable module must depend
on "KUNIT=y", this is not true for modular tests, where it adds an
unnecessary limitation.
Fix this by relaxing the dependency to "KUNIT".
Fixes: 08809e482a1c44d9 ("HID: uclogic: KUnit best practices and naming conventions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: David Gow <davidgow@google.com>
Reviewed-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -1262,7 +1262,7 @@ config HID_MCP2221
config HID_KUNIT_TEST
tristate "KUnit tests for HID" if !KUNIT_ALL_TESTS
- depends on KUNIT=y
+ depends on KUNIT
depends on HID_UCLOGIC
default KUNIT_ALL_TESTS
help
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 243/591] RDMA/rxe: Add ibdev_dbg macros for rxe
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 242/591] HID: uclogic: Modular KUnit tests should not depend on KUNIT=y Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 244/591] RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_mw.c Greg Kroah-Hartman
` (351 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bob Pearson, Jason Gunthorpe,
Sasha Levin
From: Bob Pearson <rpearsonhpe@gmail.com>
[ Upstream commit 4554bac48a8c464ff00136a64efe8847e4da4ea8 ]
Add macros borrowed from siw to call dynamic debug macro ibdev_dbg.
Link: https://lore.kernel.org/r/20221103171013.20659-2-rpearsonhpe@gmail.com
Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Stable-dep-of: 425e1c9018fd ("RDMA/rxe: Fix access checks in rxe_check_bind_mw")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe.h | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
index 30fbdf3bc76a3..ab334900fcc3d 100644
--- a/drivers/infiniband/sw/rxe/rxe.h
+++ b/drivers/infiniband/sw/rxe/rxe.h
@@ -38,6 +38,25 @@
#define RXE_ROCE_V2_SPORT (0xc000)
+#define rxe_dbg(rxe, fmt, ...) ibdev_dbg(&(rxe)->ib_dev, \
+ "%s: " fmt, __func__, ##__VA_ARGS__)
+#define rxe_dbg_uc(uc, fmt, ...) ibdev_dbg((uc)->ibuc.device, \
+ "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__)
+#define rxe_dbg_pd(pd, fmt, ...) ibdev_dbg((pd)->ibpd.device, \
+ "pd#%d %s: " fmt, (pd)->elem.index, __func__, ##__VA_ARGS__)
+#define rxe_dbg_ah(ah, fmt, ...) ibdev_dbg((ah)->ibah.device, \
+ "ah#%d %s: " fmt, (ah)->elem.index, __func__, ##__VA_ARGS__)
+#define rxe_dbg_srq(srq, fmt, ...) ibdev_dbg((srq)->ibsrq.device, \
+ "srq#%d %s: " fmt, (srq)->elem.index, __func__, ##__VA_ARGS__)
+#define rxe_dbg_qp(qp, fmt, ...) ibdev_dbg((qp)->ibqp.device, \
+ "qp#%d %s: " fmt, (qp)->elem.index, __func__, ##__VA_ARGS__)
+#define rxe_dbg_cq(cq, fmt, ...) ibdev_dbg((cq)->ibcq.device, \
+ "cq#%d %s: " fmt, (cq)->elem.index, __func__, ##__VA_ARGS__)
+#define rxe_dbg_mr(mr, fmt, ...) ibdev_dbg((mr)->ibmr.device, \
+ "mr#%d %s: " fmt, (mr)->elem.index, __func__, ##__VA_ARGS__)
+#define rxe_dbg_mw(mw, fmt, ...) ibdev_dbg((mw)->ibmw.device, \
+ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__)
+
void rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu);
int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 244/591] RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_mw.c
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 243/591] RDMA/rxe: Add ibdev_dbg macros for rxe Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 245/591] RDMA/rxe: Fix access checks in rxe_check_bind_mw Greg Kroah-Hartman
` (350 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bob Pearson, Jason Gunthorpe,
Sasha Levin
From: Bob Pearson <rpearsonhpe@gmail.com>
[ Upstream commit e8a87efdf87455454d0a14fd486c679769bfeee2 ]
Replace calls to pr_xxx() int rxe_mw.c with rxe_dbg_xxx().
Link: https://lore.kernel.org/r/20221103171013.20659-6-rpearsonhpe@gmail.com
Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Stable-dep-of: 425e1c9018fd ("RDMA/rxe: Fix access checks in rxe_check_bind_mw")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_mw.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c
index 902b7df7aaedb..70252991320a0 100644
--- a/drivers/infiniband/sw/rxe/rxe_mw.c
+++ b/drivers/infiniband/sw/rxe/rxe_mw.c
@@ -52,14 +52,14 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
{
if (mw->ibmw.type == IB_MW_TYPE_1) {
if (unlikely(mw->state != RXE_MW_STATE_VALID)) {
- pr_err_once(
+ rxe_dbg_mw(mw,
"attempt to bind a type 1 MW not in the valid state\n");
return -EINVAL;
}
/* o10-36.2.2 */
if (unlikely((mw->access & IB_ZERO_BASED))) {
- pr_err_once("attempt to bind a zero based type 1 MW\n");
+ rxe_dbg_mw(mw, "attempt to bind a zero based type 1 MW\n");
return -EINVAL;
}
}
@@ -67,21 +67,21 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
if (mw->ibmw.type == IB_MW_TYPE_2) {
/* o10-37.2.30 */
if (unlikely(mw->state != RXE_MW_STATE_FREE)) {
- pr_err_once(
+ rxe_dbg_mw(mw,
"attempt to bind a type 2 MW not in the free state\n");
return -EINVAL;
}
/* C10-72 */
if (unlikely(qp->pd != to_rpd(mw->ibmw.pd))) {
- pr_err_once(
+ rxe_dbg_mw(mw,
"attempt to bind type 2 MW with qp with different PD\n");
return -EINVAL;
}
/* o10-37.2.40 */
if (unlikely(!mr || wqe->wr.wr.mw.length == 0)) {
- pr_err_once(
+ rxe_dbg_mw(mw,
"attempt to invalidate type 2 MW by binding with NULL or zero length MR\n");
return -EINVAL;
}
@@ -92,13 +92,13 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
return 0;
if (unlikely(mr->access & IB_ZERO_BASED)) {
- pr_err_once("attempt to bind MW to zero based MR\n");
+ rxe_dbg_mw(mw, "attempt to bind MW to zero based MR\n");
return -EINVAL;
}
/* C10-73 */
if (unlikely(!(mr->access & IB_ACCESS_MW_BIND))) {
- pr_err_once(
+ rxe_dbg_mw(mw,
"attempt to bind an MW to an MR without bind access\n");
return -EINVAL;
}
@@ -107,7 +107,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
if (unlikely((mw->access &
(IB_ACCESS_REMOTE_WRITE | IB_ACCESS_REMOTE_ATOMIC)) &&
!(mr->access & IB_ACCESS_LOCAL_WRITE))) {
- pr_err_once(
+ rxe_dbg_mw(mw,
"attempt to bind an Writable MW to an MR without local write access\n");
return -EINVAL;
}
@@ -115,7 +115,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
/* C10-75 */
if (mw->access & IB_ZERO_BASED) {
if (unlikely(wqe->wr.wr.mw.length > mr->ibmr.length)) {
- pr_err_once(
+ rxe_dbg_mw(mw,
"attempt to bind a ZB MW outside of the MR\n");
return -EINVAL;
}
@@ -123,7 +123,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
if (unlikely((wqe->wr.wr.mw.addr < mr->ibmr.iova) ||
((wqe->wr.wr.mw.addr + wqe->wr.wr.mw.length) >
(mr->ibmr.iova + mr->ibmr.length)))) {
- pr_err_once(
+ rxe_dbg_mw(mw,
"attempt to bind a VA MW outside of the MR\n");
return -EINVAL;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 245/591] RDMA/rxe: Fix access checks in rxe_check_bind_mw
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 244/591] RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_mw.c Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 246/591] amdgpu: validate offset_in_bo of drm_amdgpu_gem_va Greg Kroah-Hartman
` (349 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bob Pearson, Jason Gunthorpe,
Sasha Levin
From: Bob Pearson <rpearsonhpe@gmail.com>
[ Upstream commit 425e1c9018fdf25cb4531606cc92d9d01a55534f ]
The subroutine rxe_check_bind_mw() in rxe_mw.c performs checks on the mw
access flags before they are set so they always succeed. This patch
instead checks the access flags passed in the send wqe.
Fixes: 32a577b4c3a9 ("RDMA/rxe: Add support for bind MW work requests")
Link: https://lore.kernel.org/r/20230530221334.89432-4-rpearsonhpe@gmail.com
Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_mw.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c
index 70252991320a0..cebc9f0f428d8 100644
--- a/drivers/infiniband/sw/rxe/rxe_mw.c
+++ b/drivers/infiniband/sw/rxe/rxe_mw.c
@@ -48,7 +48,7 @@ int rxe_dealloc_mw(struct ib_mw *ibmw)
}
static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
- struct rxe_mw *mw, struct rxe_mr *mr)
+ struct rxe_mw *mw, struct rxe_mr *mr, int access)
{
if (mw->ibmw.type == IB_MW_TYPE_1) {
if (unlikely(mw->state != RXE_MW_STATE_VALID)) {
@@ -58,7 +58,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
}
/* o10-36.2.2 */
- if (unlikely((mw->access & IB_ZERO_BASED))) {
+ if (unlikely((access & IB_ZERO_BASED))) {
rxe_dbg_mw(mw, "attempt to bind a zero based type 1 MW\n");
return -EINVAL;
}
@@ -104,7 +104,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
}
/* C10-74 */
- if (unlikely((mw->access &
+ if (unlikely((access &
(IB_ACCESS_REMOTE_WRITE | IB_ACCESS_REMOTE_ATOMIC)) &&
!(mr->access & IB_ACCESS_LOCAL_WRITE))) {
rxe_dbg_mw(mw,
@@ -113,7 +113,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
}
/* C10-75 */
- if (mw->access & IB_ZERO_BASED) {
+ if (access & IB_ZERO_BASED) {
if (unlikely(wqe->wr.wr.mw.length > mr->ibmr.length)) {
rxe_dbg_mw(mw,
"attempt to bind a ZB MW outside of the MR\n");
@@ -133,12 +133,12 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
}
static void rxe_do_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
- struct rxe_mw *mw, struct rxe_mr *mr)
+ struct rxe_mw *mw, struct rxe_mr *mr, int access)
{
u32 key = wqe->wr.wr.mw.rkey & 0xff;
mw->rkey = (mw->rkey & ~0xff) | key;
- mw->access = wqe->wr.wr.mw.access;
+ mw->access = access;
mw->state = RXE_MW_STATE_VALID;
mw->addr = wqe->wr.wr.mw.addr;
mw->length = wqe->wr.wr.mw.length;
@@ -169,6 +169,7 @@ int rxe_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
u32 mw_rkey = wqe->wr.wr.mw.mw_rkey;
u32 mr_lkey = wqe->wr.wr.mw.mr_lkey;
+ int access = wqe->wr.wr.mw.access;
mw = rxe_pool_get_index(&rxe->mw_pool, mw_rkey >> 8);
if (unlikely(!mw)) {
@@ -198,11 +199,11 @@ int rxe_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
spin_lock_bh(&mw->lock);
- ret = rxe_check_bind_mw(qp, wqe, mw, mr);
+ ret = rxe_check_bind_mw(qp, wqe, mw, mr, access);
if (ret)
goto err_unlock;
- rxe_do_bind_mw(qp, wqe, mw, mr);
+ rxe_do_bind_mw(qp, wqe, mw, mr, access);
err_unlock:
spin_unlock_bh(&mw->lock);
err_drop_mr:
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 246/591] amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 245/591] RDMA/rxe: Fix access checks in rxe_check_bind_mw Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 247/591] drm/msm/a5xx: really check for A510 in a5xx_gpu_init Greg Kroah-Hartman
` (348 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Chia-I Wu,
Alex Deucher, Sasha Levin
From: Chia-I Wu <olvaffe@gmail.com>
[ Upstream commit 9f0bcf49e9895cb005d78b33a5eebfa11711b425 ]
This is motivated by OOB access in amdgpu_vm_update_range when
offset_in_bo+map_size overflows.
v2: keep the validations in amdgpu_vm_bo_map
v3: add the validations to amdgpu_vm_bo_map/amdgpu_vm_bo_replace_map
rather than to amdgpu_gem_va_ioctl
Fixes: 9f7eb5367d00 ("drm/amdgpu: actually use the VM map parameters")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 5a8a4cda7e987..58fe7279599f0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1427,14 +1427,14 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
uint64_t eaddr;
/* validate the parameters */
- if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK ||
- size == 0 || size & ~PAGE_MASK)
+ if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK)
+ return -EINVAL;
+ if (saddr + size <= saddr || offset + size <= offset)
return -EINVAL;
/* make sure object fit at this offset */
eaddr = saddr + size - 1;
- if (saddr >= eaddr ||
- (bo && offset + size > amdgpu_bo_size(bo)) ||
+ if ((bo && offset + size > amdgpu_bo_size(bo)) ||
(eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT))
return -EINVAL;
@@ -1493,14 +1493,14 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev,
int r;
/* validate the parameters */
- if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK ||
- size == 0 || size & ~PAGE_MASK)
+ if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK)
+ return -EINVAL;
+ if (saddr + size <= saddr || offset + size <= offset)
return -EINVAL;
/* make sure object fit at this offset */
eaddr = saddr + size - 1;
- if (saddr >= eaddr ||
- (bo && offset + size > amdgpu_bo_size(bo)) ||
+ if ((bo && offset + size > amdgpu_bo_size(bo)) ||
(eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT))
return -EINVAL;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 247/591] drm/msm/a5xx: really check for A510 in a5xx_gpu_init
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 246/591] amdgpu: validate offset_in_bo of drm_amdgpu_gem_va Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 248/591] RDMA/bnxt_re: wraparound mbox producer index Greg Kroah-Hartman
` (347 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adam Skladowski, Dmitry Baryshkov,
Rob Clark, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 736a9327365644b460e4498b1ce172ca411efcbc ]
The commit 010c8bbad2cb ("drm: msm: adreno: Disable preemption on Adreno
510") added special handling for a510 (this SKU doesn't seem to support
preemption, so the driver should clamp nr_rings to 1). However the
gpu->revn is not yet set (it is set later, in adreno_gpu_init()) and
thus the condition is always false. Check config->rev instead.
Fixes: 010c8bbad2cb ("drm: msm: adreno: Disable preemption on Adreno 510")
Reported-by: Adam Skladowski <a39.skl@gmail.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Tested-by: Adam Skladowski <a39.skl@gmail.com>
Patchwork: https://patchwork.freedesktop.org/patch/531511/
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
index 24feae285ccd6..0829eaf2cd4e8 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
@@ -1740,6 +1740,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev)
{
struct msm_drm_private *priv = dev->dev_private;
struct platform_device *pdev = priv->gpu_pdev;
+ struct adreno_platform_config *config = pdev->dev.platform_data;
struct a5xx_gpu *a5xx_gpu = NULL;
struct adreno_gpu *adreno_gpu;
struct msm_gpu *gpu;
@@ -1766,7 +1767,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev)
nr_rings = 4;
- if (adreno_is_a510(adreno_gpu))
+ if (adreno_cmp_rev(ADRENO_REV(5, 1, 0, ANY_ID), config->rev))
nr_rings = 1;
ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, nr_rings);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 248/591] RDMA/bnxt_re: wraparound mbox producer index
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 247/591] drm/msm/a5xx: really check for A510 in a5xx_gpu_init Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 249/591] RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context Greg Kroah-Hartman
` (346 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kashyap Desai, Selvin Xavier,
Leon Romanovsky, Sasha Levin
From: Kashyap Desai <kashyap.desai@broadcom.com>
[ Upstream commit 0af91306e17ef3d18e5f100aa58aa787869118af ]
Driver is not handling the wraparound of the mbox producer index correctly.
Currently the wraparound happens once u32 max is reached.
Bit 31 of the producer index register is special and should be set
only once for the first command. Because the producer index overflow
setting bit31 after a long time, FW goes to initialization sequence
and this causes FW hang.
Fix is to wraparound the mbox producer index once it reaches u16 max.
Fixes: cee0c7bba486 ("RDMA/bnxt_re: Refactor command queue management code")
Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Link: https://lore.kernel.org/r/1686308514-11996-2-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 9c63b8b62edfc..3d76fa71641a4 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -181,7 +181,7 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req,
} while (size > 0);
cmdq->seq_num++;
- cmdq_prod = hwq->prod;
+ cmdq_prod = hwq->prod & 0xFFFF;
if (test_bit(FIRMWARE_FIRST_FLAG, &cmdq->flags)) {
/* The very first doorbell write
* is required to set this flag
@@ -598,7 +598,7 @@ int bnxt_qplib_alloc_rcfw_channel(struct bnxt_qplib_res *res,
rcfw->cmdq_depth = BNXT_QPLIB_CMDQE_MAX_CNT_8192;
sginfo.pgsize = bnxt_qplib_cmdqe_page_size(rcfw->cmdq_depth);
- hwq_attr.depth = rcfw->cmdq_depth;
+ hwq_attr.depth = rcfw->cmdq_depth & 0x7FFFFFFF;
hwq_attr.stride = BNXT_QPLIB_CMDQE_UNITS;
hwq_attr.type = HWQ_TYPE_CTX;
if (bnxt_qplib_alloc_init_hwq(&cmdq->hwq, &hwq_attr)) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 249/591] RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 248/591] RDMA/bnxt_re: wraparound mbox producer index Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 250/591] clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probe Greg Kroah-Hartman
` (345 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kashyap Desai, Selvin Xavier,
Leon Romanovsky, Sasha Levin
From: Kashyap Desai <kashyap.desai@broadcom.com>
[ Upstream commit 3099bcdc19b701f732f638ee45679858c08559bb ]
bnxt_qplib_service_creq can be called from interrupt or tasklet or
process context. So the function take irq variant of spin_lock.
But when wake_up is invoked with the lock held, it is putting the
calling context to sleep.
[exception RIP: __wake_up_common+190]
RIP: ffffffffb7539d7e RSP: ffffa73300207ad8 RFLAGS: 00000083
RAX: 0000000000000001 RBX: ffff91fa295f69b8 RCX: dead000000000200
RDX: ffffa733344af940 RSI: ffffa73336527940 RDI: ffffa73336527940
RBP: 000000000000001c R8: 0000000000000002 R9: 00000000000299c0
R10: 0000017230de82c5 R11: 0000000000000002 R12: ffffa73300207b28
R13: 0000000000000000 R14: ffffa733341bf928 R15: 0000000000000000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
Call the wakeup after releasing the lock.
Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Link: https://lore.kernel.org/r/1686308514-11996-3-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 3d76fa71641a4..75e0c42f6f424 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -299,7 +299,8 @@ static int bnxt_qplib_process_func_event(struct bnxt_qplib_rcfw *rcfw,
}
static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
- struct creq_qp_event *qp_event)
+ struct creq_qp_event *qp_event,
+ u32 *num_wait)
{
struct creq_qp_error_notification *err_event;
struct bnxt_qplib_hwq *hwq = &rcfw->cmdq.hwq;
@@ -308,6 +309,7 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
u16 cbit, blocked = 0;
struct pci_dev *pdev;
unsigned long flags;
+ u32 wait_cmds = 0;
__le16 mcookie;
u16 cookie;
int rc = 0;
@@ -367,9 +369,10 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
crsqe->req_size = 0;
if (!blocked)
- wake_up(&rcfw->cmdq.waitq);
+ wait_cmds++;
spin_unlock_irqrestore(&hwq->lock, flags);
}
+ *num_wait += wait_cmds;
return rc;
}
@@ -383,6 +386,7 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t)
struct creq_base *creqe;
u32 sw_cons, raw_cons;
unsigned long flags;
+ u32 num_wakeup = 0;
/* Service the CREQ until budget is over */
spin_lock_irqsave(&hwq->lock, flags);
@@ -401,7 +405,8 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t)
switch (type) {
case CREQ_BASE_TYPE_QP_EVENT:
bnxt_qplib_process_qp_event
- (rcfw, (struct creq_qp_event *)creqe);
+ (rcfw, (struct creq_qp_event *)creqe,
+ &num_wakeup);
creq->stats.creq_qp_event_processed++;
break;
case CREQ_BASE_TYPE_FUNC_EVENT:
@@ -429,6 +434,8 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t)
rcfw->res->cctx, true);
}
spin_unlock_irqrestore(&hwq->lock, flags);
+ if (num_wakeup)
+ wake_up_nr(&rcfw->cmdq.waitq, num_wakeup);
}
static irqreturn_t bnxt_qplib_creq_irq(int irq, void *dev_instance)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 250/591] clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probe
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 249/591] RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 251/591] clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe Greg Kroah-Hartman
` (344 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kai Ma, Peng Fan, Jesse Taube,
Abel Vesa, Sasha Levin
From: Kai Ma <kaima@hust.edu.cn>
[ Upstream commit 1b280598ab3bd8a2dc8b96a12530d5b1ee7a8f4a ]
Use devm_of_iomap() instead of of_iomap() to automatically
handle the unused ioremap region. If any error occurs, regions allocated by
kzalloc() will leak, but using devm_kzalloc() instead will automatically
free the memory using devm_kfree().
Also, fix error handling of hws by adding unregister_hws label, which
unregisters remaining hws when iomap failed.
Fixes: 7154b046d8f3 ("clk: imx: Add initial support for i.MXRT1050 clock driver")
Signed-off-by: Kai Ma <kaima@hust.edu.cn>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Jesse Taube <Mr.Bossman075@gmail.com>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://lore.kernel.org/r/20230418113451.151312-1-kaima@hust.edu.cn
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk-imxrt1050.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/drivers/clk/imx/clk-imxrt1050.c b/drivers/clk/imx/clk-imxrt1050.c
index 26108e9f7e67a..64d8b65a81040 100644
--- a/drivers/clk/imx/clk-imxrt1050.c
+++ b/drivers/clk/imx/clk-imxrt1050.c
@@ -42,7 +42,7 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev)
struct device_node *anp;
int ret;
- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws,
IMXRT1050_CLK_END), GFP_KERNEL);
if (WARN_ON(!clk_hw_data))
return -ENOMEM;
@@ -53,10 +53,12 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev)
hws[IMXRT1050_CLK_OSC] = imx_obtain_fixed_clk_hw(np, "osc");
anp = of_find_compatible_node(NULL, NULL, "fsl,imxrt-anatop");
- pll_base = of_iomap(anp, 0);
+ pll_base = devm_of_iomap(dev, anp, 0, NULL);
of_node_put(anp);
- if (WARN_ON(!pll_base))
- return -ENOMEM;
+ if (WARN_ON(IS_ERR(pll_base))) {
+ ret = PTR_ERR(pll_base);
+ goto unregister_hws;
+ }
/* Anatop clocks */
hws[IMXRT1050_CLK_DUMMY] = imx_clk_hw_fixed("dummy", 0UL);
@@ -104,8 +106,10 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev)
/* CCM clocks */
ccm_base = devm_platform_ioremap_resource(pdev, 0);
- if (WARN_ON(IS_ERR(ccm_base)))
- return PTR_ERR(ccm_base);
+ if (WARN_ON(IS_ERR(ccm_base))) {
+ ret = PTR_ERR(ccm_base);
+ goto unregister_hws;
+ }
hws[IMXRT1050_CLK_ARM_PODF] = imx_clk_hw_divider("arm_podf", "pll1_arm", ccm_base + 0x10, 0, 3);
hws[IMXRT1050_CLK_PRE_PERIPH_SEL] = imx_clk_hw_mux("pre_periph_sel", ccm_base + 0x18, 18, 2,
@@ -148,8 +152,12 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev)
ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data);
if (ret < 0) {
dev_err(dev, "Failed to register clks for i.MXRT1050.\n");
- imx_unregister_hw_clocks(hws, IMXRT1050_CLK_END);
+ goto unregister_hws;
}
+ return 0;
+
+unregister_hws:
+ imx_unregister_hw_clocks(hws, IMXRT1050_CLK_END);
return ret;
}
static const struct of_device_id imxrt1050_clk_of_match[] = {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 251/591] clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 250/591] clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probe Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 252/591] clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe Greg Kroah-Hartman
` (343 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao Luo, Dongliang Mu, Peng Fan,
Abel Vesa, Sasha Levin
From: Hao Luo <m202171776@hust.edu.cn>
[ Upstream commit 188d070de9132667956f5aadd98d2bd87d3eac89 ]
Use devm_of_iomap() instead of of_iomap() to automatically handle
the unused ioremap region.
If any error occurs, regions allocated by kzalloc() will leak,
but using devm_kzalloc() instead will automatically free the memory
using devm_kfree().
Fixes: daeb14545514 ("clk: imx: imx8mn: Switch to clk_hw based API")
Fixes: 96d6392b54db ("clk: imx: Add support for i.MX8MN clock driver")
Signed-off-by: Hao Luo <m202171776@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Link: https://lore.kernel.org/r/20230411015107.2645-1-m202171776@hust.edu.cn
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk-imx8mn.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/clk/imx/clk-imx8mn.c b/drivers/clk/imx/clk-imx8mn.c
index 2afea905f7f3c..b2b8b8b3f0ab8 100644
--- a/drivers/clk/imx/clk-imx8mn.c
+++ b/drivers/clk/imx/clk-imx8mn.c
@@ -323,7 +323,7 @@ static int imx8mn_clocks_probe(struct platform_device *pdev)
void __iomem *base;
int ret;
- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws,
IMX8MN_CLK_END), GFP_KERNEL);
if (WARN_ON(!clk_hw_data))
return -ENOMEM;
@@ -340,10 +340,10 @@ static int imx8mn_clocks_probe(struct platform_device *pdev)
hws[IMX8MN_CLK_EXT4] = imx_obtain_fixed_clk_hw(np, "clk_ext4");
np = of_find_compatible_node(NULL, NULL, "fsl,imx8mn-anatop");
- base = of_iomap(np, 0);
+ base = devm_of_iomap(dev, np, 0, NULL);
of_node_put(np);
- if (WARN_ON(!base)) {
- ret = -ENOMEM;
+ if (WARN_ON(IS_ERR(base))) {
+ ret = PTR_ERR(base);
goto unregister_hws;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 252/591] clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 251/591] clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 253/591] clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() Greg Kroah-Hartman
` (342 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhanhao Hu, Abel Vesa, Sasha Levin
From: Zhanhao Hu <zero12113@hust.edu.cn>
[ Upstream commit e02ba11b457647050cb16e7cad16cec3c252fade ]
In function probe(), it returns directly without unregistered hws
when error occurs.
Fix this by adding 'goto unregister_hws;' on line 295 and
line 310.
Use devm_kzalloc() instead of kzalloc() to automatically
free the memory using devm_kfree() when error occurs.
Replace of_iomap() with devm_of_iomap() to automatically
handle the unused ioremap region and delete 'iounmap(anatop_base);'
in unregister_hws.
Fixes: 24defbe194b6 ("clk: imx: add i.MX93 clk")
Signed-off-by: Zhanhao Hu <zero12113@hust.edu.cn>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://lore.kernel.org/r/20230601033825.336558-1-zero12113@hust.edu.cn
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk-imx93.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/clk/imx/clk-imx93.c b/drivers/clk/imx/clk-imx93.c
index 02d6a9894521d..5e3d299190c89 100644
--- a/drivers/clk/imx/clk-imx93.c
+++ b/drivers/clk/imx/clk-imx93.c
@@ -261,7 +261,7 @@ static int imx93_clocks_probe(struct platform_device *pdev)
void __iomem *base, *anatop_base;
int i, ret;
- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws,
IMX93_CLK_END), GFP_KERNEL);
if (!clk_hw_data)
return -ENOMEM;
@@ -285,10 +285,12 @@ static int imx93_clocks_probe(struct platform_device *pdev)
"sys_pll_pfd2", 1, 2);
np = of_find_compatible_node(NULL, NULL, "fsl,imx93-anatop");
- anatop_base = of_iomap(np, 0);
+ anatop_base = devm_of_iomap(dev, np, 0, NULL);
of_node_put(np);
- if (WARN_ON(!anatop_base))
- return -ENOMEM;
+ if (WARN_ON(IS_ERR(anatop_base))) {
+ ret = PTR_ERR(base);
+ goto unregister_hws;
+ }
clks[IMX93_CLK_AUDIO_PLL] = imx_clk_fracn_gppll("audio_pll", "osc_24m", anatop_base + 0x1200,
&imx_fracn_gppll);
@@ -298,8 +300,8 @@ static int imx93_clocks_probe(struct platform_device *pdev)
np = dev->of_node;
base = devm_platform_ioremap_resource(pdev, 0);
if (WARN_ON(IS_ERR(base))) {
- iounmap(anatop_base);
- return PTR_ERR(base);
+ ret = PTR_ERR(base);
+ goto unregister_hws;
}
for (i = 0; i < ARRAY_SIZE(root_array); i++) {
@@ -329,7 +331,6 @@ static int imx93_clocks_probe(struct platform_device *pdev)
unregister_hws:
imx_unregister_hw_clocks(clks, IMX93_CLK_END);
- iounmap(anatop_base);
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 253/591] clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 252/591] clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 254/591] arm64: dts: qcom: sdm845: Flush RSC sleep & wake votes Greg Kroah-Hartman
` (341 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuxing Liu, Dongliang Mu, Abel Vesa,
Sasha Levin
From: Yuxing Liu <lyx2022@hust.edu.cn>
[ Upstream commit 878b02d5f3b56cb090dbe2c70c89273be144087f ]
Replace of_iomap() and kzalloc() with devm_of_iomap() and devm_kzalloc()
which can automatically release the related memory when the device
or driver is removed or unloaded to avoid potential memory leak.
In this case, iounmap(anatop_base) in line 427,433 are removed
as manual release is not required.
Besides, referring to clk-imx8mq.c, check the return code of
of_clk_add_hw_provider, if it returns negtive, print error info
and unregister hws, which makes the program more robust.
Fixes: 9c140d992676 ("clk: imx: Add support for i.MX8MP clock driver")
Signed-off-by: Yuxing Liu <lyx2022@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://lore.kernel.org/r/20230503070607.2462-1-lyx2022@hust.edu.cn
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk-imx8mp.c | 24 +++++++++++++-----------
1 file changed, 13 insertions(+), 11 deletions(-)
diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c
index 5d68d975b4eb1..05c02f4e2a143 100644
--- a/drivers/clk/imx/clk-imx8mp.c
+++ b/drivers/clk/imx/clk-imx8mp.c
@@ -413,25 +413,22 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
struct device *dev = &pdev->dev;
struct device_node *np;
void __iomem *anatop_base, *ccm_base;
+ int err;
np = of_find_compatible_node(NULL, NULL, "fsl,imx8mp-anatop");
- anatop_base = of_iomap(np, 0);
+ anatop_base = devm_of_iomap(dev, np, 0, NULL);
of_node_put(np);
- if (WARN_ON(!anatop_base))
- return -ENOMEM;
+ if (WARN_ON(IS_ERR(anatop_base)))
+ return PTR_ERR(anatop_base);
np = dev->of_node;
ccm_base = devm_platform_ioremap_resource(pdev, 0);
- if (WARN_ON(IS_ERR(ccm_base))) {
- iounmap(anatop_base);
+ if (WARN_ON(IS_ERR(ccm_base)))
return PTR_ERR(ccm_base);
- }
- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, IMX8MP_CLK_END), GFP_KERNEL);
- if (WARN_ON(!clk_hw_data)) {
- iounmap(anatop_base);
+ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws, IMX8MP_CLK_END), GFP_KERNEL);
+ if (WARN_ON(!clk_hw_data))
return -ENOMEM;
- }
clk_hw_data->num = IMX8MP_CLK_END;
hws = clk_hw_data->hws;
@@ -711,7 +708,12 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
imx_check_clk_hws(hws, IMX8MP_CLK_END);
- of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data);
+ err = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data);
+ if (err < 0) {
+ dev_err(dev, "failed to register hws for i.MX8MP\n");
+ imx_unregister_hw_clocks(hws, IMX8MP_CLK_END);
+ return err;
+ }
imx_register_uart_clocks(4);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 254/591] arm64: dts: qcom: sdm845: Flush RSC sleep & wake votes
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 253/591] clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 255/591] arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k Greg Kroah-Hartman
` (340 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bjorn Andersson,
Sasha Levin
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit 91e83140b5dd5598fbcfada3ee1f8b2b410c3731 ]
The rpmh driver will cache sleep and wake votes until the cluster
power-domain is about to enter idle, to avoid unnecessary writes. So
associate the apps_rsc with the cluster pd, so that it can be notified
about this event.
Without this, only AMC votes are being commited.
Fixes: c83545d95376 ("arm64: dts: sdm845: Add rpmh-rsc node")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230531-topic-rsc-v1-6-b4a985f57b8b@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
index 6f4cc3329400c..b7ba70857d0ad 100644
--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
@@ -5043,6 +5043,7 @@ apps_rsc: rsc@179c0000 {
<SLEEP_TCS 3>,
<WAKE_TCS 3>,
<CONTROL_TCS 1>;
+ power-domains = <&CLUSTER_PD>;
apps_bcm_voter: bcm-voter {
compatible = "qcom,bcm-voter";
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 255/591] arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 254/591] arm64: dts: qcom: sdm845: Flush RSC sleep & wake votes Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 256/591] clk: bcm: rpi: Fix off by one in raspberrypi_discover_clocks() Greg Kroah-Hartman
` (339 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marijn Suijten,
AngeloGioacchino Del Regno, Konrad Dybcio, Bjorn Andersson,
Sasha Levin
From: Marijn Suijten <marijn.suijten@somainline.org>
[ Upstream commit 223ce29c8b7e5b00f01a68387aabeefd77d97f06 ]
The framebuffer configuration for edo pdx203, written in edo dtsi (which
is overwritten in pdx206 dts for its smaller panel) has to use a
1096x2560 configuration as this is what the panel (and framebuffer area)
has been initialized to. Downstream userspace also has access to (and
uses) this 2.5k mode by default, and only switches the panel to 4k when
requested.
This is similar to commit be8de06dc397 ("arm64: dts: qcom:
sm8150-kumano: Panel framebuffer is 2.5k instead of 4k") which fixed the
same for the previous generation Sony platform.
Fixes: 69cdb97ef652 ("arm64: dts: qcom: sm8250: Add support for SONY Xperia 1 II / 5 II (Edo platform)")
Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230606211418.587676-1-marijn.suijten@somainline.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi
index e4769dcfaad7b..390b90a8ddf70 100644
--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi
@@ -26,9 +26,10 @@ chosen {
framebuffer: framebuffer@9c000000 {
compatible = "simple-framebuffer";
reg = <0 0x9c000000 0 0x2300000>;
- width = <1644>;
- height = <3840>;
- stride = <(1644 * 4)>;
+ /* pdx203 BL initializes in 2.5k mode, not 4k */
+ width = <1096>;
+ height = <2560>;
+ stride = <(1096 * 4)>;
format = "a8r8g8b8";
/*
* That's a lot of clocks, but it's necessary due
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 256/591] clk: bcm: rpi: Fix off by one in raspberrypi_discover_clocks()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 255/591] arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 257/591] clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider() Greg Kroah-Hartman
` (338 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Stefan Wahren,
Florian Fainelli, Stephen Boyd, Sasha Levin
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit da2edb3e3c09fd1451b7f400ccd1070ef086619a ]
Smatch detected an off by one in this code:
drivers/clk/bcm/clk-raspberrypi.c:374 raspberrypi_discover_clocks()
error: buffer overflow 'data->hws' 16 <= 16
The data->hws[] array has RPI_FIRMWARE_NUM_CLK_ID elements so the >
comparison needs to changed to >=.
Fixes: 12c90f3f27bb ("clk: bcm: rpi: Add variant structure")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/5a850b08-d2f5-4794-aceb-a6b468965139@kili.mountain
Reviewed-by: Stefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/bcm/clk-raspberrypi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/bcm/clk-raspberrypi.c b/drivers/clk/bcm/clk-raspberrypi.c
index 679f4649a7efd..278f845572813 100644
--- a/drivers/clk/bcm/clk-raspberrypi.c
+++ b/drivers/clk/bcm/clk-raspberrypi.c
@@ -375,9 +375,9 @@ static int raspberrypi_discover_clocks(struct raspberrypi_clk *rpi,
while (clks->id) {
struct raspberrypi_clk_variant *variant;
- if (clks->id > RPI_FIRMWARE_NUM_CLK_ID) {
+ if (clks->id >= RPI_FIRMWARE_NUM_CLK_ID) {
dev_err(rpi->dev, "Unknown clock id: %u (max: %u)\n",
- clks->id, RPI_FIRMWARE_NUM_CLK_ID);
+ clks->id, RPI_FIRMWARE_NUM_CLK_ID - 1);
return -EINVAL;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 257/591] clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 256/591] clk: bcm: rpi: Fix off by one in raspberrypi_discover_clocks() Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 258/591] clk: tegra: tegra124-emc: Fix potential memory leak Greg Kroah-Hartman
` (337 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Michal Simek,
Stephen Boyd, Sasha Levin
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 9c632a6396505a019ea6d12b5ab45e659a542a93 ]
Smatch detected this potential error pointer dereference
clk_wzrd_register_divider(). If devm_clk_hw_register() fails then
it sets "hw" to an error pointer and then dereferences it on the
next line. Return the error directly instead.
Fixes: 5a853722eb32 ("staging: clocking-wizard: Add support for dynamic reconfiguration")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/f0e39b5c-4554-41e0-80d9-54ca3fabd060@kili.mountain
Reviewed-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
index eb1dfe7ecc1b4..4a23583933bcc 100644
--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
@@ -354,7 +354,7 @@ static struct clk *clk_wzrd_register_divider(struct device *dev,
hw = &div->hw;
ret = devm_clk_hw_register(dev, hw);
if (ret)
- hw = ERR_PTR(ret);
+ return ERR_PTR(ret);
return hw->clk;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 258/591] clk: tegra: tegra124-emc: Fix potential memory leak
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 257/591] clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider() Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 259/591] ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer Greg Kroah-Hartman
` (336 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Can, Thierry Reding,
Stephen Boyd, Sasha Levin
From: Yuan Can <yuancan@huawei.com>
[ Upstream commit 53a06e5924c0d43c11379a08c5a78529c3e61595 ]
The tegra and tegra needs to be freed in the error handling path, otherwise
it will be leaked.
Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Link: https://lore.kernel.org/r/20221209094124.71043-1-yuancan@huawei.com
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/tegra/clk-tegra124-emc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
index 219c80653dbdb..2a6db04342815 100644
--- a/drivers/clk/tegra/clk-tegra124-emc.c
+++ b/drivers/clk/tegra/clk-tegra124-emc.c
@@ -464,6 +464,7 @@ static int load_timings_from_dt(struct tegra_clk_emc *tegra,
err = load_one_timing_from_dt(tegra, timing, child);
if (err) {
of_node_put(child);
+ kfree(tegra->timings);
return err;
}
@@ -515,6 +516,7 @@ struct clk *tegra124_clk_register_emc(void __iomem *base, struct device_node *np
err = load_timings_from_dt(tegra, node, node_ram_code);
if (err) {
of_node_put(node);
+ kfree(tegra);
return ERR_PTR(err);
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 259/591] ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 258/591] clk: tegra: tegra124-emc: Fix potential memory leak Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 260/591] drm/msm/dpu: do not enable color-management if DSPPs are not available Greg Kroah-Hartman
` (335 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Su Hui, Takashi Iwai, Sasha Levin
From: Su Hui <suhui@nfschina.com>
[ Upstream commit 79597c8bf64ca99eab385115743131d260339da5 ]
smatch error:
sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error:
we previously assumed 'rac97' could be null (see line 2072)
remove redundant assignment, return error if rac97 is NULL.
Fixes: da3cec35dd3c ("ALSA: Kill snd_assert() in sound/pci/*")
Signed-off-by: Su Hui <suhui@nfschina.com>
Link: https://lore.kernel.org/r/20230615021732.1972194-1-suhui@nfschina.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/ac97/ac97_codec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
index ff685321f1a11..534ea7a256ec3 100644
--- a/sound/pci/ac97/ac97_codec.c
+++ b/sound/pci/ac97/ac97_codec.c
@@ -2070,8 +2070,8 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
.dev_disconnect = snd_ac97_dev_disconnect,
};
- if (rac97)
- *rac97 = NULL;
+ if (!rac97)
+ return -EINVAL;
if (snd_BUG_ON(!bus || !template))
return -EINVAL;
if (snd_BUG_ON(template->num >= 4))
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 260/591] drm/msm/dpu: do not enable color-management if DSPPs are not available
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 259/591] ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 261/591] drm/msm/dpu: Fix slice_last_group_size calculation Greg Kroah-Hartman
` (334 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yongqin Liu, Dmitry Baryshkov,
Abhinav Kumar, Marijn Suijten, Sumit Semwal, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 3bcfc7b90465efd337d39b91b43972162f0d1908 ]
We can not support color management without DSPP blocks being provided
in the HW catalog. Do not enable color management for CRTCs if num_dspps
is 0.
Fixes: 4259ff7ae509 ("drm/msm/dpu: add support for pcc color block in dpu driver")
Reported-by: Yongqin Liu <yongqin.liu@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
Reviewed-by: Sumit Semwal <sumit.semwal@linaro.org>
Tested-by: Yongqin Liu <yongqin.liu@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/542141/
Link: https://lore.kernel.org/r/20230612182534.3345805-1-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
index c9d1c412628e9..6c0ffe8e4adbd 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
@@ -1579,6 +1579,8 @@ static const struct drm_crtc_helper_funcs dpu_crtc_helper_funcs = {
struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane,
struct drm_plane *cursor)
{
+ struct msm_drm_private *priv = dev->dev_private;
+ struct dpu_kms *dpu_kms = to_dpu_kms(priv->kms);
struct drm_crtc *crtc = NULL;
struct dpu_crtc *dpu_crtc = NULL;
int i;
@@ -1610,7 +1612,8 @@ struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane,
drm_crtc_helper_add(crtc, &dpu_crtc_helper_funcs);
- drm_crtc_enable_color_mgmt(crtc, 0, true, 0);
+ if (dpu_kms->catalog->dspp_count)
+ drm_crtc_enable_color_mgmt(crtc, 0, true, 0);
/* save user friendly CRTC name for later */
snprintf(dpu_crtc->name, DPU_CRTC_NAME_SIZE, "crtc%u", crtc->base.id);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 261/591] drm/msm/dpu: Fix slice_last_group_size calculation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 260/591] drm/msm/dpu: do not enable color-management if DSPPs are not available Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 262/591] drm/msm/dsi: Use DSC slice(s) packet size to compute word count Greg Kroah-Hartman
` (333 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Marijn Suijten,
Jessica Zhang, Sasha Levin
From: Jessica Zhang <quic_jesszhan@quicinc.com>
[ Upstream commit c223059e6f8340f7eac2319470984cbfc39c433b ]
Correct the math for slice_last_group_size so that it matches the
calculations downstream.
Fixes: c110cfd1753e ("drm/msm/disp/dpu1: Add support for DSC")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/539269/
Link: https://lore.kernel.org/r/20230329-rfc-msm-dsc-helper-v14-7-bafc7be95691@quicinc.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c
index 3662df698dae5..c8f14555834a8 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c
@@ -52,9 +52,10 @@ static void dpu_hw_dsc_config(struct dpu_hw_dsc *hw_dsc,
if (is_cmd_mode)
initial_lines += 1;
- slice_last_group_size = 3 - (dsc->slice_width % 3);
+ slice_last_group_size = (dsc->slice_width + 2) % 3;
+
data = (initial_lines << 20);
- data |= ((slice_last_group_size - 1) << 18);
+ data |= (slice_last_group_size << 18);
/* bpp is 6.4 format, 4 LSBs bits are for fractional part */
data |= (dsc->bits_per_pixel << 8);
data |= (dsc->block_pred_enable << 7);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 262/591] drm/msm/dsi: Use DSC slice(s) packet size to compute word count
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 261/591] drm/msm/dpu: Fix slice_last_group_size calculation Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 263/591] drm/msm/dsi: Flip greater-than check for slice_count and slice_per_intf Greg Kroah-Hartman
` (332 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marijn Suijten, Dmitry Baryshkov,
Abhinav Kumar, Sasha Levin
From: Marijn Suijten <marijn.suijten@somainline.org>
[ Upstream commit bc6b6ff8135c4b96787eda88f3baf653939a75ce ]
According to downstream the value to use for WORD_COUNT is
bytes_per_pkt, which denotes the number of bytes in a packet based on
how many slices have been configured by the panel driver times the
width of a slice times the number of bytes per pixel.
The DSC panels seen thus far use one byte per pixel, only one slice
per packet, and a slice width of half the panel width leading to the
desired bytes_per_pkt+1 value to be equal to hdisplay/2+1. This however
isn't the case anymore for panels that configure two slices per packet,
where the value should now be hdisplay+1.
Note that the aforementioned panel (on a Sony Xperia XZ3, sdm845) with
slice_count=1 has also been tested to successfully accept slice_count=2,
which would have shown corrupted output previously.
Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration")
Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/515694/
Link: https://lore.kernel.org/r/20221221231943.1961117-3-marijn.suijten@somainline.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Stable-dep-of: 155fa3a91d64 ("drm/msm/dsi: Remove incorrect references to slice_count")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index f167a45f1fbdd..5ab5e872c3cf1 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -987,7 +987,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)
if (!msm_host->dsc)
wc = hdisplay * dsi_get_bpp(msm_host->format) / 8 + 1;
else
- wc = mode->hdisplay / 2 + 1;
+ wc = msm_host->dsc->slice_chunk_size * msm_host->dsc->slice_count + 1;
dsi_write(msm_host, REG_DSI_CMD_MDP_STREAM0_CTRL,
DSI_CMD_MDP_STREAM0_CTRL_WORD_COUNT(wc) |
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 263/591] drm/msm/dsi: Flip greater-than check for slice_count and slice_per_intf
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 262/591] drm/msm/dsi: Use DSC slice(s) packet size to compute word count Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 264/591] drm/msm/dsi: Remove incorrect references to slice_count Greg Kroah-Hartman
` (331 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marijn Suijten, Dmitry Baryshkov,
Abhinav Kumar, Sasha Levin
From: Marijn Suijten <marijn.suijten@somainline.org>
[ Upstream commit 82e72fd22a8f9eff4e75c08be68319008ea90a29 ]
According to downstream /and the comment copied from it/ this comparison
should be the other way around. In other words, when the panel driver
requests to use more slices per packet than what could be sent over this
interface, it is bumped down to only use a single slice per packet (and
strangely not the number of slices that could fit on the interface).
Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration")
Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/515686/
Link: https://lore.kernel.org/r/20221221231943.1961117-4-marijn.suijten@somainline.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Stable-dep-of: 155fa3a91d64 ("drm/msm/dsi: Remove incorrect references to slice_count")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/dsi_host.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 5ab5e872c3cf1..ef988e4c21045 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -853,11 +853,12 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod
*/
slice_per_intf = DIV_ROUND_UP(hdisplay, dsc->slice_width);
- /* If slice_per_pkt is greater than slice_per_intf
+ /*
+ * If slice_count is greater than slice_per_intf
* then default to 1. This can happen during partial
* update.
*/
- if (slice_per_intf > dsc->slice_count)
+ if (dsc->slice_count > slice_per_intf)
dsc->slice_count = 1;
total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 264/591] drm/msm/dsi: Remove incorrect references to slice_count
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 263/591] drm/msm/dsi: Flip greater-than check for slice_count and slice_per_intf Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 265/591] drm/msm/dp: Free resources after unregistering them Greg Kroah-Hartman
` (330 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marijn Suijten, Jessica Zhang,
Dmitry Baryshkov, Sasha Levin
From: Jessica Zhang <quic_jesszhan@quicinc.com>
[ Upstream commit 155fa3a91d64221eb0885fd221cc8085dbef908f ]
Currently, slice_count is being used to calculate word count and
pkt_per_line. Instead, these values should be calculated using slice per
packet, which is not the same as slice_count.
Slice count represents the number of slices per interface, and its value
will not always match that of slice per packet. For example, it is possible
to have cases where there are multiple slices per interface but the panel
specifies only one slice per packet.
Thus, use the default value of one slice per packet and remove slice_count
from the aforementioned calculations.
Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration")
Fixes: bc6b6ff8135c ("drm/msm/dsi: Use DSC slice(s) packet size to compute word count")
Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/541965/
Link: https://lore.kernel.org/r/20230405-add-dsc-support-v6-5-95eab864d1b6@quicinc.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/dsi_host.c | 26 ++++++++++++++++----------
1 file changed, 16 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index ef988e4c21045..b433ccfe4d7da 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -853,18 +853,17 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod
*/
slice_per_intf = DIV_ROUND_UP(hdisplay, dsc->slice_width);
- /*
- * If slice_count is greater than slice_per_intf
- * then default to 1. This can happen during partial
- * update.
- */
- if (dsc->slice_count > slice_per_intf)
- dsc->slice_count = 1;
-
total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf;
eol_byte_num = total_bytes_per_intf % 3;
- pkt_per_line = slice_per_intf / dsc->slice_count;
+
+ /*
+ * Typically, pkt_per_line = slice_per_intf * slice_per_pkt.
+ *
+ * Since the current driver only supports slice_per_pkt = 1,
+ * pkt_per_line will be equal to slice per intf for now.
+ */
+ pkt_per_line = slice_per_intf;
if (is_cmd_mode) /* packet data type */
reg = DSI_COMMAND_COMPRESSION_MODE_CTRL_STREAM0_DATATYPE(MIPI_DSI_DCS_LONG_WRITE);
@@ -988,7 +987,14 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)
if (!msm_host->dsc)
wc = hdisplay * dsi_get_bpp(msm_host->format) / 8 + 1;
else
- wc = msm_host->dsc->slice_chunk_size * msm_host->dsc->slice_count + 1;
+ /*
+ * When DSC is enabled, WC = slice_chunk_size * slice_per_pkt + 1.
+ * Currently, the driver only supports default value of slice_per_pkt = 1
+ *
+ * TODO: Expand mipi_dsi_device struct to hold slice_per_pkt info
+ * and adjust DSC math to account for slice_per_pkt.
+ */
+ wc = msm_host->dsc->slice_chunk_size + 1;
dsi_write(msm_host, REG_DSI_CMD_MDP_STREAM0_CTRL,
DSI_CMD_MDP_STREAM0_CTRL_WORD_COUNT(wc) |
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 265/591] drm/msm/dp: Free resources after unregistering them
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 264/591] drm/msm/dsi: Remove incorrect references to slice_count Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 266/591] arm64: dts: mediatek: Add cpufreq nodes for MT8192 Greg Kroah-Hartman
` (329 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Andersson, Dmitry Baryshkov,
Sasha Levin
From: Bjorn Andersson <quic_bjorande@quicinc.com>
[ Upstream commit fa0048a4b1fa7a50c8b0e514f5b428abdf69a6f8 ]
The DP component's unbind operation walks through the submodules to
unregister and clean things up. But if the unbind happens because the DP
controller itself is being removed, all the memory for those submodules
has just been freed.
Change the order of these operations to avoid the many use-after-free
that otherwise happens in this code path.
Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support")
Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/542166/
Link: https://lore.kernel.org/r/20230612220259.1884381-1-quic_bjorande@quicinc.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dp/dp_display.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 57b82e5d0ab12..d16c12351adb6 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -1342,9 +1342,9 @@ static int dp_display_remove(struct platform_device *pdev)
{
struct dp_display_private *dp = dev_get_dp_display_private(&pdev->dev);
+ component_del(&pdev->dev, &dp_display_comp_ops);
dp_display_deinit_sub_modules(dp);
- component_del(&pdev->dev, &dp_display_comp_ops);
platform_set_drvdata(pdev, NULL);
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 266/591] arm64: dts: mediatek: Add cpufreq nodes for MT8192
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 265/591] drm/msm/dp: Free resources after unregistering them Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 267/591] arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz Greg Kroah-Hartman
` (328 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Allen-KH Cheng, Chen-Yu Tsai,
Nícolas F . R . A . Prado, AngeloGioacchino Del Regno,
Matthias Brugger, Sasha Levin
From: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
[ Upstream commit 9d498cce9298a71e3896e2d1aee24a1a4c531d81 ]
Add the cpufreq nodes for MT8192 SoC.
Signed-off-by: Allen-KH Cheng <allen-kh.cheng@mediatek.com>
Tested-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20230317061944.15434-1-allen-kh.cheng@mediatek.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Stable-dep-of: a4366b5695c9 ("arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8192.dtsi | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
index ef1294d960145..ff2310fe3f1d2 100644
--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
@@ -64,6 +64,7 @@ cpu0: cpu@0 {
clock-frequency = <1701000000>;
cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
next-level-cache = <&l2_0>;
+ performance-domains = <&performance 0>;
capacity-dmips-mhz = <530>;
};
@@ -75,6 +76,7 @@ cpu1: cpu@100 {
clock-frequency = <1701000000>;
cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
next-level-cache = <&l2_0>;
+ performance-domains = <&performance 0>;
capacity-dmips-mhz = <530>;
};
@@ -86,6 +88,7 @@ cpu2: cpu@200 {
clock-frequency = <1701000000>;
cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
next-level-cache = <&l2_0>;
+ performance-domains = <&performance 0>;
capacity-dmips-mhz = <530>;
};
@@ -97,6 +100,7 @@ cpu3: cpu@300 {
clock-frequency = <1701000000>;
cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
next-level-cache = <&l2_0>;
+ performance-domains = <&performance 0>;
capacity-dmips-mhz = <530>;
};
@@ -108,6 +112,7 @@ cpu4: cpu@400 {
clock-frequency = <2171000000>;
cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>;
next-level-cache = <&l2_1>;
+ performance-domains = <&performance 1>;
capacity-dmips-mhz = <1024>;
};
@@ -119,6 +124,7 @@ cpu5: cpu@500 {
clock-frequency = <2171000000>;
cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>;
next-level-cache = <&l2_1>;
+ performance-domains = <&performance 1>;
capacity-dmips-mhz = <1024>;
};
@@ -130,6 +136,7 @@ cpu6: cpu@600 {
clock-frequency = <2171000000>;
cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>;
next-level-cache = <&l2_1>;
+ performance-domains = <&performance 1>;
capacity-dmips-mhz = <1024>;
};
@@ -141,6 +148,7 @@ cpu7: cpu@700 {
clock-frequency = <2171000000>;
cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>;
next-level-cache = <&l2_1>;
+ performance-domains = <&performance 1>;
capacity-dmips-mhz = <1024>;
};
@@ -257,6 +265,12 @@ soc {
compatible = "simple-bus";
ranges;
+ performance: performance-controller@11bc10 {
+ compatible = "mediatek,cpufreq-hw";
+ reg = <0 0x0011bc10 0 0x120>, <0 0x0011bd30 0 0x120>;
+ #performance-domain-cells = <1>;
+ };
+
gic: interrupt-controller@c000000 {
compatible = "arm,gic-v3";
#interrupt-cells = <4>;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 267/591] arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 266/591] arm64: dts: mediatek: Add cpufreq nodes for MT8192 Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 268/591] drm/amdgpu: Fix memcpy() in sienna_cichlid_append_powerplay_table function Greg Kroah-Hartman
` (327 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nícolas F . R . A . Prado,
AngeloGioacchino Del Regno, Matthias Brugger, Sasha Levin
From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
[ Upstream commit a4366b5695c984b8a3fc8b31de9e758c8f6d1aed ]
The capacity-dmips-mhz parameter was miscalculated: this SoC runs
the first (Cortex-A55) cluster at a maximum of 2000MHz and the
second (Cortex-A76) cluster at a maximum of 2200MHz.
In order to calculate the right capacity-dmips-mhz, the following
test was performed:
1. CPUFREQ governor was set to 'performance' on both clusters
2. Ran dhrystone with 500000000 iterations for 10 times on each cluster
3. Calculated the mean result for each cluster
4. Calculated DMIPS/MHz: dmips_mhz = dmips_per_second / cpu_mhz
5. Scaled results to 1024:
result_c0 = dmips_mhz_c0 / dmips_mhz_c1 * 1024
The mean results for this SoC are:
Cluster 0 (LITTLE): 12016411 Dhry/s
Cluster 1 (BIG): 31702034 Dhry/s
The calculated scaled results are:
Cluster 0: 426.953226899238 (rounded to 427)
Cluster 1: 1024
Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile")
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20230602183515.3778780-1-nfraprado@collabora.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8192.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
index ff2310fe3f1d2..2f40c6cc407c1 100644
--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
@@ -65,7 +65,7 @@ cpu0: cpu@0 {
cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
next-level-cache = <&l2_0>;
performance-domains = <&performance 0>;
- capacity-dmips-mhz = <530>;
+ capacity-dmips-mhz = <427>;
};
cpu1: cpu@100 {
@@ -77,7 +77,7 @@ cpu1: cpu@100 {
cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
next-level-cache = <&l2_0>;
performance-domains = <&performance 0>;
- capacity-dmips-mhz = <530>;
+ capacity-dmips-mhz = <427>;
};
cpu2: cpu@200 {
@@ -89,7 +89,7 @@ cpu2: cpu@200 {
cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
next-level-cache = <&l2_0>;
performance-domains = <&performance 0>;
- capacity-dmips-mhz = <530>;
+ capacity-dmips-mhz = <427>;
};
cpu3: cpu@300 {
@@ -101,7 +101,7 @@ cpu3: cpu@300 {
cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>;
next-level-cache = <&l2_0>;
performance-domains = <&performance 0>;
- capacity-dmips-mhz = <530>;
+ capacity-dmips-mhz = <427>;
};
cpu4: cpu@400 {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 268/591] drm/amdgpu: Fix memcpy() in sienna_cichlid_append_powerplay_table function.
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 267/591] arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 269/591] drm/amdgpu: Fix usage of UMC fill record in RAS Greg Kroah-Hartman
` (326 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Evan Quan, Chengming Gui,
Christian König, Alex Deucher, Srinivasan Shanmugam,
Evan Quan, Sasha Levin
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
[ Upstream commit d50dc746ff72b9c48812dac3344fa87fbde940a3 ]
Fixes the following gcc with W=1:
In file included from ./include/linux/string.h:253,
from ./include/linux/bitmap.h:11,
from ./include/linux/cpumask.h:12,
from ./arch/x86/include/asm/cpumask.h:5,
from ./arch/x86/include/asm/msr.h:11,
from ./arch/x86/include/asm/processor.h:22,
from ./arch/x86/include/asm/cpufeature.h:5,
from ./arch/x86/include/asm/thread_info.h:53,
from ./include/linux/thread_info.h:60,
from ./arch/x86/include/asm/preempt.h:7,
from ./include/linux/preempt.h:78,
from ./include/linux/spinlock.h:56,
from ./include/linux/mmzone.h:8,
from ./include/linux/gfp.h:7,
from ./include/linux/firmware.h:7,
from drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:26:
In function ‘fortify_memcpy_chk’,
inlined from ‘sienna_cichlid_append_powerplay_table’ at drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:444:2,
inlined from ‘sienna_cichlid_setup_pptable’ at drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:506:8,
inlined from ‘sienna_cichlid_setup_pptable’ at drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:494:12:
./include/linux/fortify-string.h:413:4: warning: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
413 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
the compiler complains about the size calculation in the memcpy() -
"sizeof(*smc_dpm_table) - sizeof(smc_dpm_table->table_header)" is much
larger than what fits into table_member.
Hence, reuse 'smu_memcpy_trailing' for nv1x
Fixes: 7077b19a38240 ("drm/amd/pm: use macro to get pptable members")
Suggested-by: Evan Quan <Evan.Quan@amd.com>
Cc: Evan Quan <Evan.Quan@amd.com>
Cc: Chengming Gui <Jack.Gui@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Evan Quan <evan.quan@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index 85d53597eb07a..f7ed3e655e397 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -431,7 +431,13 @@ static int sienna_cichlid_append_powerplay_table(struct smu_context *smu)
{
struct atom_smc_dpm_info_v4_9 *smc_dpm_table;
int index, ret;
- I2cControllerConfig_t *table_member;
+ PPTable_beige_goby_t *ppt_beige_goby;
+ PPTable_t *ppt;
+
+ if (smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 13))
+ ppt_beige_goby = smu->smu_table.driver_pptable;
+ else
+ ppt = smu->smu_table.driver_pptable;
index = get_index_into_master_table(atom_master_list_of_data_tables_v2_1,
smc_dpm_info);
@@ -440,9 +446,13 @@ static int sienna_cichlid_append_powerplay_table(struct smu_context *smu)
(uint8_t **)&smc_dpm_table);
if (ret)
return ret;
- GET_PPTABLE_MEMBER(I2cControllers, &table_member);
- memcpy(table_member, smc_dpm_table->I2cControllers,
- sizeof(*smc_dpm_table) - sizeof(smc_dpm_table->table_header));
+
+ if (smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 13))
+ smu_memcpy_trailing(ppt_beige_goby, I2cControllers, BoardReserved,
+ smc_dpm_table, I2cControllers);
+ else
+ smu_memcpy_trailing(ppt, I2cControllers, BoardReserved,
+ smc_dpm_table, I2cControllers);
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 269/591] drm/amdgpu: Fix usage of UMC fill record in RAS
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 268/591] drm/amdgpu: Fix memcpy() in sienna_cichlid_append_powerplay_table function Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 270/591] drm/msm/dpu: correct MERGE_3D length Greg Kroah-Hartman
` (325 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tao Zhou, Hawking Zhang,
Alex Deucher, Luben Tuikov, Alex Deucher, Sasha Levin
From: Luben Tuikov <luben.tuikov@amd.com>
[ Upstream commit 71344a718a9fda8c551cdc4381d354f9a9907f6f ]
The fixed commit listed in the Fixes tag below, introduced a bug in
amdgpu_ras.c::amdgpu_reserve_page_direct(), in that when introducing the new
amdgpu_umc_fill_error_record() and internally in that new function the physical
address (argument "uint64_t retired_page"--wrong name) is right-shifted by
AMDGPU_GPU_PAGE_SHIFT. Thus, in amdgpu_reserve_page_direct() when we pass
"address" to that new function, we should NOT right-shift it, since this
results, erroneously, in the page address to be 0 for first
2^(2*AMDGPU_GPU_PAGE_SHIFT) memory addresses.
This commit fixes this bug.
Cc: Tao Zhou <tao.zhou1@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: Alex Deucher <Alexander.Deucher@amd.com>
Fixes: 400013b268cb ("drm/amdgpu: add umc_fill_error_record to make code more simple")
Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
Link: https://lore.kernel.org/r/20230610113536.10621-1-luben.tuikov@amd.com
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index a4b47e1bd111d..09fc464f5f128 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -170,8 +170,7 @@ static int amdgpu_reserve_page_direct(struct amdgpu_device *adev, uint64_t addre
memset(&err_rec, 0x0, sizeof(struct eeprom_table_record));
err_data.err_addr = &err_rec;
- amdgpu_umc_fill_error_record(&err_data, address,
- (address >> AMDGPU_GPU_PAGE_SHIFT), 0, 0);
+ amdgpu_umc_fill_error_record(&err_data, address, address, 0, 0);
if (amdgpu_bad_page_threshold != 0) {
amdgpu_ras_add_bad_pages(adev, err_data.err_addr,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 270/591] drm/msm/dpu: correct MERGE_3D length
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 269/591] drm/amdgpu: Fix usage of UMC fill record in RAS Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 271/591] clk: vc5: check memory returned by kasprintf() Greg Kroah-Hartman
` (324 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Abhinav Kumar,
Marijn Suijten, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 9a6c13b847d61b0c3796820ca6e976789df59cd8 ]
Each MERGE_3D block has just two registers. Correct the block length
accordingly.
Fixes: 4369c93cf36b ("drm/msm/dpu: initial support for merge3D hardware block")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/542177/
Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
Link: https://lore.kernel.org/r/20230613001004.3426676-3-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
index 80e59d3f9dd3e..b2f330e99b0cd 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
@@ -1203,7 +1203,7 @@ static struct dpu_pingpong_cfg qcm2290_pp[] = {
#define MERGE_3D_BLK(_name, _id, _base) \
{\
.name = _name, .id = _id, \
- .base = _base, .len = 0x100, \
+ .base = _base, .len = 0x8, \
.features = MERGE_3D_SM8150_MASK, \
.sblk = NULL \
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 271/591] clk: vc5: check memory returned by kasprintf()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 270/591] drm/msm/dpu: correct MERGE_3D length Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 272/591] clk: cdce925: check return value of kasprintf() Greg Kroah-Hartman
` (323 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Luca Ceresoli,
Stephen Boyd, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 144601f6228de5598f03e693822b60a95c367a17 ]
kasprintf() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: f491276a5168 ("clk: vc5: Allow Versaclock driver to support multiple instances")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230530093913.1656095-2-claudiu.beznea@microchip.com
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-versaclock5.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
index 5f2c9093c5b94..ef50ab78dd90d 100644
--- a/drivers/clk/clk-versaclock5.c
+++ b/drivers/clk/clk-versaclock5.c
@@ -1027,6 +1027,11 @@ static int vc5_probe(struct i2c_client *client)
}
init.name = kasprintf(GFP_KERNEL, "%pOFn.mux", client->dev.of_node);
+ if (!init.name) {
+ ret = -ENOMEM;
+ goto err_clk;
+ }
+
init.ops = &vc5_mux_ops;
init.flags = 0;
init.parent_names = parent_names;
@@ -1041,6 +1046,10 @@ static int vc5_probe(struct i2c_client *client)
memset(&init, 0, sizeof(init));
init.name = kasprintf(GFP_KERNEL, "%pOFn.dbl",
client->dev.of_node);
+ if (!init.name) {
+ ret = -ENOMEM;
+ goto err_clk;
+ }
init.ops = &vc5_dbl_ops;
init.flags = CLK_SET_RATE_PARENT;
init.parent_names = parent_names;
@@ -1056,6 +1065,10 @@ static int vc5_probe(struct i2c_client *client)
/* Register PFD */
memset(&init, 0, sizeof(init));
init.name = kasprintf(GFP_KERNEL, "%pOFn.pfd", client->dev.of_node);
+ if (!init.name) {
+ ret = -ENOMEM;
+ goto err_clk;
+ }
init.ops = &vc5_pfd_ops;
init.flags = CLK_SET_RATE_PARENT;
init.parent_names = parent_names;
@@ -1073,6 +1086,10 @@ static int vc5_probe(struct i2c_client *client)
/* Register PLL */
memset(&init, 0, sizeof(init));
init.name = kasprintf(GFP_KERNEL, "%pOFn.pll", client->dev.of_node);
+ if (!init.name) {
+ ret = -ENOMEM;
+ goto err_clk;
+ }
init.ops = &vc5_pll_ops;
init.flags = CLK_SET_RATE_PARENT;
init.parent_names = parent_names;
@@ -1092,6 +1109,10 @@ static int vc5_probe(struct i2c_client *client)
memset(&init, 0, sizeof(init));
init.name = kasprintf(GFP_KERNEL, "%pOFn.fod%d",
client->dev.of_node, idx);
+ if (!init.name) {
+ ret = -ENOMEM;
+ goto err_clk;
+ }
init.ops = &vc5_fod_ops;
init.flags = CLK_SET_RATE_PARENT;
init.parent_names = parent_names;
@@ -1110,6 +1131,10 @@ static int vc5_probe(struct i2c_client *client)
memset(&init, 0, sizeof(init));
init.name = kasprintf(GFP_KERNEL, "%pOFn.out0_sel_i2cb",
client->dev.of_node);
+ if (!init.name) {
+ ret = -ENOMEM;
+ goto err_clk;
+ }
init.ops = &vc5_clk_out_ops;
init.flags = CLK_SET_RATE_PARENT;
init.parent_names = parent_names;
@@ -1136,6 +1161,10 @@ static int vc5_probe(struct i2c_client *client)
memset(&init, 0, sizeof(init));
init.name = kasprintf(GFP_KERNEL, "%pOFn.out%d",
client->dev.of_node, idx + 1);
+ if (!init.name) {
+ ret = -ENOMEM;
+ goto err_clk;
+ }
init.ops = &vc5_clk_out_ops;
init.flags = CLK_SET_RATE_PARENT;
init.parent_names = parent_names;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 272/591] clk: cdce925: check return value of kasprintf()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 271/591] clk: vc5: check memory returned by kasprintf() Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 273/591] clk: si5341: return error if one synth clock registration fails Greg Kroah-Hartman
` (322 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Stephen Boyd,
Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit bb7d09ddbf361d51eae46f38e7c8a2b85914ea2a ]
kasprintf() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: 19fbbbbcd3a3 ("Add TI CDCE925 I2C controlled clock synthesizer driver")
Depends-on: e665f029a283 ("clk: Convert to using %pOFn instead of device_node.name")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230530093913.1656095-3-claudiu.beznea@microchip.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-cdce925.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/clk/clk-cdce925.c b/drivers/clk/clk-cdce925.c
index ef9a2d44e40c3..d88e1d681a2ce 100644
--- a/drivers/clk/clk-cdce925.c
+++ b/drivers/clk/clk-cdce925.c
@@ -714,6 +714,10 @@ static int cdce925_probe(struct i2c_client *client)
for (i = 0; i < data->chip_info->num_plls; ++i) {
pll_clk_name[i] = kasprintf(GFP_KERNEL, "%pOFn.pll%d",
client->dev.of_node, i);
+ if (!pll_clk_name[i]) {
+ err = -ENOMEM;
+ goto error;
+ }
init.name = pll_clk_name[i];
data->pll[i].chip = data;
data->pll[i].hw.init = &init;
@@ -755,6 +759,10 @@ static int cdce925_probe(struct i2c_client *client)
init.num_parents = 1;
init.parent_names = &parent_name; /* Mux Y1 to input */
init.name = kasprintf(GFP_KERNEL, "%pOFn.Y1", client->dev.of_node);
+ if (!init.name) {
+ err = -ENOMEM;
+ goto error;
+ }
data->clk[0].chip = data;
data->clk[0].hw.init = &init;
data->clk[0].index = 0;
@@ -773,6 +781,10 @@ static int cdce925_probe(struct i2c_client *client)
for (i = 1; i < data->chip_info->num_outputs; ++i) {
init.name = kasprintf(GFP_KERNEL, "%pOFn.Y%d",
client->dev.of_node, i+1);
+ if (!init.name) {
+ err = -ENOMEM;
+ goto error;
+ }
data->clk[i].chip = data;
data->clk[i].hw.init = &init;
data->clk[i].index = i;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 273/591] clk: si5341: return error if one synth clock registration fails
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 272/591] clk: cdce925: check return value of kasprintf() Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 274/591] clk: si5341: check return value of {devm_}kasprintf() Greg Kroah-Hartman
` (321 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Stephen Boyd,
Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 2560114c06d7a752b3f4639f28cece58fed11267 ]
In case devm_clk_hw_register() fails for one of synth clocks the probe
continues. Later on, when registering output clocks which have as parents
all the synth clocks, in case there is registration failure for at least
one synth clock the information passed to clk core for registering output
clock is not right: init.num_parents is fixed but init.parents may contain
an array with less parents.
Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230530093913.1656095-4-claudiu.beznea@microchip.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-si5341.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c
index 0e528d7ba656e..6dca3288c8940 100644
--- a/drivers/clk/clk-si5341.c
+++ b/drivers/clk/clk-si5341.c
@@ -1553,7 +1553,7 @@ static int si5341_probe(struct i2c_client *client)
struct clk_init_data init;
struct clk *input;
const char *root_clock_name;
- const char *synth_clock_names[SI5341_NUM_SYNTH];
+ const char *synth_clock_names[SI5341_NUM_SYNTH] = { NULL };
int err;
unsigned int i;
struct clk_si5341_output_config config[SI5341_MAX_NUM_OUTPUTS];
@@ -1705,6 +1705,7 @@ static int si5341_probe(struct i2c_client *client)
if (err) {
dev_err(&client->dev,
"synth N%u registration failed\n", i);
+ goto free_clk_names;
}
}
@@ -1782,16 +1783,17 @@ static int si5341_probe(struct i2c_client *client)
goto cleanup;
}
+free_clk_names:
/* Free the names, clk framework makes copies */
for (i = 0; i < data->num_synth; ++i)
devm_kfree(&client->dev, (void *)synth_clock_names[i]);
- return 0;
-
cleanup:
- for (i = 0; i < SI5341_MAX_NUM_OUTPUTS; ++i) {
- if (data->clk[i].vddo_reg)
- regulator_disable(data->clk[i].vddo_reg);
+ if (err) {
+ for (i = 0; i < SI5341_MAX_NUM_OUTPUTS; ++i) {
+ if (data->clk[i].vddo_reg)
+ regulator_disable(data->clk[i].vddo_reg);
+ }
}
return err;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 274/591] clk: si5341: check return value of {devm_}kasprintf()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 273/591] clk: si5341: return error if one synth clock registration fails Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 275/591] clk: si5341: free unused memory on probe failure Greg Kroah-Hartman
` (320 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Stephen Boyd,
Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 36e4ef82016a2b785cf2317eade77e76699b7bff ]
{devm_}kasprintf() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230530093913.1656095-5-claudiu.beznea@microchip.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-si5341.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c
index 6dca3288c8940..b2cf7edc8b308 100644
--- a/drivers/clk/clk-si5341.c
+++ b/drivers/clk/clk-si5341.c
@@ -1697,6 +1697,10 @@ static int si5341_probe(struct i2c_client *client)
for (i = 0; i < data->num_synth; ++i) {
synth_clock_names[i] = devm_kasprintf(&client->dev, GFP_KERNEL,
"%s.N%u", client->dev.of_node->name, i);
+ if (!synth_clock_names[i]) {
+ err = -ENOMEM;
+ goto free_clk_names;
+ }
init.name = synth_clock_names[i];
data->synth[i].index = i;
data->synth[i].data = data;
@@ -1715,6 +1719,10 @@ static int si5341_probe(struct i2c_client *client)
for (i = 0; i < data->num_outputs; ++i) {
init.name = kasprintf(GFP_KERNEL, "%s.%d",
client->dev.of_node->name, i);
+ if (!init.name) {
+ err = -ENOMEM;
+ goto free_clk_names;
+ }
init.flags = config[i].synth_master ? CLK_SET_RATE_PARENT : 0;
data->clk[i].index = i;
data->clk[i].data = data;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 275/591] clk: si5341: free unused memory on probe failure
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 274/591] clk: si5341: check return value of {devm_}kasprintf() Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 276/591] clk: keystone: sci-clk: check return value of kasprintf() Greg Kroah-Hartman
` (319 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Stephen Boyd,
Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 267ad94b13c53d8c99a336f0841b1fa1595b1d0f ]
Pointers from synth_clock_names[] should be freed at the end of probe
either on probe success or failure path.
Fixes: b7bbf6ec4940 ("clk: si5341: Allow different output VDD_SEL values")
Fixes: 9b13ff4340df ("clk: si5341: Add sysfs properties to allow checking/resetting device faults")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230530093913.1656095-6-claudiu.beznea@microchip.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-si5341.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c
index b2cf7edc8b308..c7d8cbd22bacc 100644
--- a/drivers/clk/clk-si5341.c
+++ b/drivers/clk/clk-si5341.c
@@ -1744,7 +1744,7 @@ static int si5341_probe(struct i2c_client *client)
if (err) {
dev_err(&client->dev,
"output %u registration failed\n", i);
- goto cleanup;
+ goto free_clk_names;
}
if (config[i].always_on)
clk_prepare(data->clk[i].hw.clk);
@@ -1754,7 +1754,7 @@ static int si5341_probe(struct i2c_client *client)
data);
if (err) {
dev_err(&client->dev, "unable to add clk provider\n");
- goto cleanup;
+ goto free_clk_names;
}
if (initialization_required) {
@@ -1762,11 +1762,11 @@ static int si5341_probe(struct i2c_client *client)
regcache_cache_only(data->regmap, false);
err = regcache_sync(data->regmap);
if (err < 0)
- goto cleanup;
+ goto free_clk_names;
err = si5341_finalize_defaults(data);
if (err < 0)
- goto cleanup;
+ goto free_clk_names;
}
/* wait for device to report input clock present and PLL lock */
@@ -1775,21 +1775,19 @@ static int si5341_probe(struct i2c_client *client)
10000, 250000);
if (err) {
dev_err(&client->dev, "Error waiting for input clock or PLL lock\n");
- goto cleanup;
+ goto free_clk_names;
}
/* clear sticky alarm bits from initialization */
err = regmap_write(data->regmap, SI5341_STATUS_STICKY, 0);
if (err) {
dev_err(&client->dev, "unable to clear sticky status\n");
- goto cleanup;
+ goto free_clk_names;
}
err = sysfs_create_files(&client->dev.kobj, si5341_attributes);
- if (err) {
+ if (err)
dev_err(&client->dev, "unable to create sysfs files\n");
- goto cleanup;
- }
free_clk_names:
/* Free the names, clk framework makes copies */
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 276/591] clk: keystone: sci-clk: check return value of kasprintf()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 275/591] clk: si5341: free unused memory on probe failure Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 277/591] clk: ti: clkctrl: " Greg Kroah-Hartman
` (318 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Tony Lindgren,
Stephen Boyd, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit b73ed981da6d25c921aaefa7ca3df85bbd85b7fc ]
kasprintf() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: b745c0794e2f ("clk: keystone: Add sci-clk driver support")
Depends-on: 96488c09b0f4 ("clk: keystone: sci-clk: cut down the clock name length")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230530093913.1656095-7-claudiu.beznea@microchip.com
Reviewed-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/keystone/sci-clk.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/clk/keystone/sci-clk.c b/drivers/clk/keystone/sci-clk.c
index d4b4e74e22da6..254f2cf24be21 100644
--- a/drivers/clk/keystone/sci-clk.c
+++ b/drivers/clk/keystone/sci-clk.c
@@ -294,6 +294,8 @@ static int _sci_clk_build(struct sci_clk_provider *provider,
name = kasprintf(GFP_KERNEL, "clk:%d:%d", sci_clk->dev_id,
sci_clk->clk_id);
+ if (!name)
+ return -ENOMEM;
init.name = name;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 277/591] clk: ti: clkctrl: check return value of kasprintf()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 276/591] clk: keystone: sci-clk: check return value of kasprintf() Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 278/591] drivers: meson: secure-pwrc: always enable DMA domain Greg Kroah-Hartman
` (317 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Tony Lindgren,
Stephen Boyd, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit bd46cd0b802d9c9576ca78007aa084ae3e74907b ]
kasprintf() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: 852049594b9a ("clk: ti: clkctrl: convert subclocks to use proper names also")
Fixes: 6c3090520554 ("clk: ti: clkctrl: Fix hidden dependency to node name")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230530093913.1656095-8-claudiu.beznea@microchip.com
Reviewed-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/ti/clkctrl.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
index ae58628794176..57611bfb299c1 100644
--- a/drivers/clk/ti/clkctrl.c
+++ b/drivers/clk/ti/clkctrl.c
@@ -258,6 +258,9 @@ static const char * __init clkctrl_get_clock_name(struct device_node *np,
if (clkctrl_name && !legacy_naming) {
clock_name = kasprintf(GFP_KERNEL, "%s-clkctrl:%04x:%d",
clkctrl_name, offset, index);
+ if (!clock_name)
+ return NULL;
+
strreplace(clock_name, '_', '-');
return clock_name;
@@ -586,6 +589,10 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node)
if (clkctrl_name) {
provider->clkdm_name = kasprintf(GFP_KERNEL,
"%s_clkdm", clkctrl_name);
+ if (!provider->clkdm_name) {
+ kfree(provider);
+ return;
+ }
goto clkdm_found;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 278/591] drivers: meson: secure-pwrc: always enable DMA domain
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 277/591] clk: ti: clkctrl: " Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 279/591] ovl: update of dentry revalidate flags after copy up Greg Kroah-Hartman
` (316 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Romanov, Neil Armstrong,
Sasha Levin
From: Alexey Romanov <avromanov@sberdevices.ru>
[ Upstream commit 0bb4644d583789c97e74d3e3047189f0c59c4742 ]
Starting from commit e45f243409db ("firmware: meson_sm:
populate platform devices from sm device tree data") pwrc
is probed successfully and disables unused pwr domains.
By A1 SoC family design, any TEE requires DMA pwr domain
always enabled.
Fixes: b3dde5013e13 ("soc: amlogic: Add support for Secure power domains controller")
Signed-off-by: Alexey Romanov <avromanov@sberdevices.ru>
Acked-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20230610090414.90529-1-avromanov@sberdevices.ru
[narmstrong: added fixes tag]
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/amlogic/meson-secure-pwrc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/amlogic/meson-secure-pwrc.c b/drivers/soc/amlogic/meson-secure-pwrc.c
index e935187635267..25b4b71df9b89 100644
--- a/drivers/soc/amlogic/meson-secure-pwrc.c
+++ b/drivers/soc/amlogic/meson-secure-pwrc.c
@@ -105,7 +105,7 @@ static struct meson_secure_pwrc_domain_desc a1_pwrc_domains[] = {
SEC_PD(ACODEC, 0),
SEC_PD(AUDIO, 0),
SEC_PD(OTP, 0),
- SEC_PD(DMA, 0),
+ SEC_PD(DMA, GENPD_FLAG_ALWAYS_ON | GENPD_FLAG_IRQ_SAFE),
SEC_PD(SD_EMMC, 0),
SEC_PD(RAMA, 0),
/* SRAMB is used as ATF runtime memory, and should be always on */
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 279/591] ovl: update of dentry revalidate flags after copy up
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 278/591] drivers: meson: secure-pwrc: always enable DMA domain Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:46 ` [PATCH 6.1 280/591] ASoC: imx-audmix: check return value of devm_kasprintf() Greg Kroah-Hartman
` (315 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gao Xiang, Amir Goldstein,
Miklos Szeredi, Sasha Levin
From: Amir Goldstein <amir73il@gmail.com>
[ Upstream commit b07d5cc93e1b28df47a72c519d09d0a836043613 ]
After copy up, we may need to update d_flags if upper dentry is on a
remote fs and lower dentries are not.
Add helpers to allow incremental update of the revalidate flags.
Fixes: bccece1ead36 ("ovl: allow remote upper")
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/overlayfs/copy_up.c | 2 ++
fs/overlayfs/dir.c | 3 +--
fs/overlayfs/export.c | 3 +--
fs/overlayfs/namei.c | 3 +--
fs/overlayfs/overlayfs.h | 6 ++++--
fs/overlayfs/super.c | 2 +-
fs/overlayfs/util.c | 24 ++++++++++++++++++++----
7 files changed, 30 insertions(+), 13 deletions(-)
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 91a95bfad0d1c..edc1ebff33f5a 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -538,6 +538,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c)
/* Restore timestamps on parent (best effort) */
ovl_set_timestamps(ofs, upperdir, &c->pstat);
ovl_dentry_set_upper_alias(c->dentry);
+ ovl_dentry_update_reval(c->dentry, upper);
}
}
inode_unlock(udir);
@@ -857,6 +858,7 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
inode_unlock(udir);
ovl_dentry_set_upper_alias(c->dentry);
+ ovl_dentry_update_reval(c->dentry, ovl_dentry_upper(c->dentry));
}
out:
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index c3032cef391ef..5339ff08bd0f4 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -269,8 +269,7 @@ static int ovl_instantiate(struct dentry *dentry, struct inode *inode,
ovl_dir_modified(dentry->d_parent, false);
ovl_dentry_set_upper_alias(dentry);
- ovl_dentry_update_reval(dentry, newdentry,
- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);
+ ovl_dentry_init_reval(dentry, newdentry);
if (!hardlink) {
/*
diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c
index ac9c3ad04016e..e55363d343dc6 100644
--- a/fs/overlayfs/export.c
+++ b/fs/overlayfs/export.c
@@ -326,8 +326,7 @@ static struct dentry *ovl_obtain_alias(struct super_block *sb,
if (upper_alias)
ovl_dentry_set_upper_alias(dentry);
- ovl_dentry_update_reval(dentry, upper,
- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);
+ ovl_dentry_init_reval(dentry, upper);
return d_instantiate_anon(dentry, inode);
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index 0fd1d5fdfc728..655d08d6f3f17 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -1116,8 +1116,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
ovl_set_flag(OVL_UPPERDATA, inode);
}
- ovl_dentry_update_reval(dentry, upperdentry,
- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);
+ ovl_dentry_init_reval(dentry, upperdentry);
revert_creds(old_cred);
if (origin_path) {
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index e74a610a117ec..052226aa7de09 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -360,8 +360,10 @@ bool ovl_index_all(struct super_block *sb);
bool ovl_verify_lower(struct super_block *sb);
struct ovl_entry *ovl_alloc_entry(unsigned int numlower);
bool ovl_dentry_remote(struct dentry *dentry);
-void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *upperdentry,
- unsigned int mask);
+void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *realdentry);
+void ovl_dentry_init_reval(struct dentry *dentry, struct dentry *upperdentry);
+void ovl_dentry_init_flags(struct dentry *dentry, struct dentry *upperdentry,
+ unsigned int mask);
bool ovl_dentry_weird(struct dentry *dentry);
enum ovl_path_type ovl_path_type(struct dentry *dentry);
void ovl_path_upper(struct dentry *dentry, struct path *path);
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 3d14a3f1465d1..51eec4a8e82b2 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1980,7 +1980,7 @@ static struct dentry *ovl_get_root(struct super_block *sb,
ovl_dentry_set_flag(OVL_E_CONNECTED, root);
ovl_set_upperdata(d_inode(root));
ovl_inode_init(d_inode(root), &oip, ino, fsid);
- ovl_dentry_update_reval(root, upperdentry, DCACHE_OP_WEAK_REVALIDATE);
+ ovl_dentry_init_flags(root, upperdentry, DCACHE_OP_WEAK_REVALIDATE);
return root;
}
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index 81a57a8d80d9a..850e8d1bf8296 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -94,14 +94,30 @@ struct ovl_entry *ovl_alloc_entry(unsigned int numlower)
return oe;
}
+#define OVL_D_REVALIDATE (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE)
+
bool ovl_dentry_remote(struct dentry *dentry)
{
- return dentry->d_flags &
- (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);
+ return dentry->d_flags & OVL_D_REVALIDATE;
+}
+
+void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *realdentry)
+{
+ if (!ovl_dentry_remote(realdentry))
+ return;
+
+ spin_lock(&dentry->d_lock);
+ dentry->d_flags |= realdentry->d_flags & OVL_D_REVALIDATE;
+ spin_unlock(&dentry->d_lock);
+}
+
+void ovl_dentry_init_reval(struct dentry *dentry, struct dentry *upperdentry)
+{
+ return ovl_dentry_init_flags(dentry, upperdentry, OVL_D_REVALIDATE);
}
-void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *upperdentry,
- unsigned int mask)
+void ovl_dentry_init_flags(struct dentry *dentry, struct dentry *upperdentry,
+ unsigned int mask)
{
struct ovl_entry *oe = OVL_E(dentry);
unsigned int i, flags = 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 280/591] ASoC: imx-audmix: check return value of devm_kasprintf()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 279/591] ovl: update of dentry revalidate flags after copy up Greg Kroah-Hartman
@ 2023-07-16 19:46 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 281/591] clk: Fix memory leak in devm_clk_notifier_register() Greg Kroah-Hartman
` (314 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Mark Brown,
Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 2f76e1d6ca524a888d29aafe29f2ad2003857971 ]
devm_kasprintf() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: b86ef5367761 ("ASoC: fsl: Add Audio Mixer machine driver")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230614121509.443926-1-claudiu.beznea@microchip.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/imx-audmix.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/sound/soc/fsl/imx-audmix.c b/sound/soc/fsl/imx-audmix.c
index 1292a845c4244..d8e99b263ab21 100644
--- a/sound/soc/fsl/imx-audmix.c
+++ b/sound/soc/fsl/imx-audmix.c
@@ -228,6 +228,8 @@ static int imx_audmix_probe(struct platform_device *pdev)
dai_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s%s",
fe_name_pref, args.np->full_name + 1);
+ if (!dai_name)
+ return -ENOMEM;
dev_info(pdev->dev.parent, "DAI FE name:%s\n", dai_name);
@@ -236,6 +238,8 @@ static int imx_audmix_probe(struct platform_device *pdev)
capture_dai_name =
devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s %s",
dai_name, "CPU-Capture");
+ if (!capture_dai_name)
+ return -ENOMEM;
}
priv->dai[i].cpus = &dlc[0];
@@ -266,6 +270,8 @@ static int imx_audmix_probe(struct platform_device *pdev)
"AUDMIX-Playback-%d", i);
be_cp = devm_kasprintf(&pdev->dev, GFP_KERNEL,
"AUDMIX-Capture-%d", i);
+ if (!be_name || !be_pb || !be_cp)
+ return -ENOMEM;
priv->dai[num_dai + i].cpus = &dlc[3];
priv->dai[num_dai + i].codecs = &dlc[4];
@@ -293,6 +299,9 @@ static int imx_audmix_probe(struct platform_device *pdev)
priv->dapm_routes[i].source =
devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s %s",
dai_name, "CPU-Playback");
+ if (!priv->dapm_routes[i].source)
+ return -ENOMEM;
+
priv->dapm_routes[i].sink = be_pb;
priv->dapm_routes[num_dai + i].source = be_pb;
priv->dapm_routes[num_dai + i].sink = be_cp;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 281/591] clk: Fix memory leak in devm_clk_notifier_register()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2023-07-16 19:46 ` [PATCH 6.1 280/591] ASoC: imx-audmix: check return value of devm_kasprintf() Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 282/591] ARM: dts: lan966x: kontron-d10: fix board reset Greg Kroah-Hartman
` (313 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fei Shao, Dan Carpenter,
Stephen Boyd, Sasha Levin
From: Fei Shao <fshao@chromium.org>
[ Upstream commit 7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff ]
devm_clk_notifier_register() allocates a devres resource for clk
notifier but didn't register that to the device, so the notifier didn't
get unregistered on device detach and the allocated resource was leaked.
Fix the issue by registering the resource through devres_add().
This issue was found with kmemleak on a Chromebook.
Fixes: 6d30d50d037d ("clk: add devm variant of clk_notifier_register")
Signed-off-by: Fei Shao <fshao@chromium.org>
Link: https://lore.kernel.org/r/20230619112253.v2.1.I13f060c10549ef181603e921291bdea95f83033c@changeid
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index d4a74759fe292..e0de6565800d2 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -4651,6 +4651,7 @@ int devm_clk_notifier_register(struct device *dev, struct clk *clk,
if (!ret) {
devres->clk = clk;
devres->nb = nb;
+ devres_add(dev, devres);
} else {
devres_free(devres);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 282/591] ARM: dts: lan966x: kontron-d10: fix board reset
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 281/591] clk: Fix memory leak in devm_clk_notifier_register() Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 283/591] ARM: dts: lan966x: kontron-d10: fix SPI CS Greg Kroah-Hartman
` (312 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Walle, Claudiu Beznea,
Sasha Levin
From: Michael Walle <mwalle@kernel.org>
[ Upstream commit bfcd5714f6424c03e385e0e9296dcd69855cfea7 ]
The pinctrl node was missing which change the pin mux to GPIO mode. Add
it.
Fixes: 79d83b3a458e ("ARM: dts: lan966x: add basic Kontron KSwitch D10 support")
Signed-off-by: Michael Walle <mwalle@kernel.org>
[claudiu.beznea: moved pinctrl-* bindings after compatible]
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230616-feature-d10-dt-cleanups-v1-1-50dd0452b8fe@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
index 0097e72e3fb22..42be207509a46 100644
--- a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
+++ b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
@@ -18,6 +18,8 @@ chosen {
gpio-restart {
compatible = "gpio-restart";
+ pinctrl-0 = <&reset_pins>;
+ pinctrl-names = "default";
gpios = <&gpio 56 GPIO_ACTIVE_LOW>;
priority = <200>;
};
@@ -59,6 +61,12 @@ miim_c_pins: miim-c-pins {
function = "miim_c";
};
+ reset_pins: reset-pins {
+ /* SYS_RST# */
+ pins = "GPIO_56";
+ function = "gpio";
+ };
+
sgpio_a_pins: sgpio-a-pins {
/* SCK, D0, D1 */
pins = "GPIO_32", "GPIO_33", "GPIO_34";
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 283/591] ARM: dts: lan966x: kontron-d10: fix SPI CS
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 282/591] ARM: dts: lan966x: kontron-d10: fix board reset Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 284/591] ASoC: amd: acp: clear pdm dma interrupt mask Greg Kroah-Hartman
` (311 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Walle, Claudiu Beznea,
Sasha Levin
From: Michael Walle <mwalle@kernel.org>
[ Upstream commit fcb79ee3f0b15ed15f35eca5f24e952fdced9c61 ]
The pinctrl node was missing which change the pin mux to GPIO mode.
Add it so we don't have to rely on the bootloader to set the correct
mode.
Fixes: 79d83b3a458e ("ARM: dts: lan966x: add basic Kontron KSwitch D10 support")
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230616-feature-d10-dt-cleanups-v1-2-50dd0452b8fe@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
index 42be207509a46..f4df4cc1dfa5e 100644
--- a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
+++ b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi
@@ -41,7 +41,7 @@ &flx3 {
status = "okay";
spi3: spi@400 {
- pinctrl-0 = <&fc3_b_pins>;
+ pinctrl-0 = <&fc3_b_pins>, <&spi3_cs_pins>;
pinctrl-names = "default";
status = "okay";
cs-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
@@ -79,6 +79,12 @@ sgpio_b_pins: sgpio-b-pins {
function = "sgpio_b";
};
+ spi3_cs_pins: spi3-cs-pins {
+ /* CS# */
+ pins = "GPIO_46";
+ function = "gpio";
+ };
+
usart0_pins: usart0-pins {
/* RXD, TXD */
pins = "GPIO_25", "GPIO_26";
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 284/591] ASoC: amd: acp: clear pdm dma interrupt mask
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 283/591] ARM: dts: lan966x: kontron-d10: fix SPI CS Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 285/591] PCI: cadence: Fix Gen2 Link Retraining process Greg Kroah-Hartman
` (310 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Syed Saba Kareem, Mark Brown,
Sasha Levin
From: Syed Saba Kareem <Syed.SabaKareem@amd.com>
[ Upstream commit ad60672394bd1f95c58d3d9336902f47e05126fc ]
Clear pdm dma interrupt mask in acp_dmic_shutdown().
'Fixes: c32bd332ce5c9 ("ASoC: amd: acp: Add generic support for
PDM controller on ACP")'
Signed-off-by: Syed Saba Kareem <Syed.SabaKareem@amd.com>
Link: https://lore.kernel.org/r/Message-Id: <20230622152406.3709231-1-Syed.SabaKareem@amd.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/amd/acp/acp-pdm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/amd/acp/acp-pdm.c b/sound/soc/amd/acp/acp-pdm.c
index 66ec6b6a59723..f8030b79ac17c 100644
--- a/sound/soc/amd/acp/acp-pdm.c
+++ b/sound/soc/amd/acp/acp-pdm.c
@@ -176,7 +176,7 @@ static void acp_dmic_dai_shutdown(struct snd_pcm_substream *substream,
/* Disable DMIC interrupts */
ext_int_ctrl = readl(ACP_EXTERNAL_INTR_CNTL(adata, 0));
- ext_int_ctrl |= ~PDM_DMA_INTR_MASK;
+ ext_int_ctrl &= ~PDM_DMA_INTR_MASK;
writel(ext_int_ctrl, ACP_EXTERNAL_INTR_CNTL(adata, 0));
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 285/591] PCI: cadence: Fix Gen2 Link Retraining process
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 284/591] ASoC: amd: acp: clear pdm dma interrupt mask Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 286/591] PCI: vmd: Reset VMD config register between soft reboots Greg Kroah-Hartman
` (309 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siddharth Vadapalli,
Lorenzo Pieralisi, Vignesh Raghavendra, Sasha Levin
From: Siddharth Vadapalli <s-vadapalli@ti.com>
[ Upstream commit 0e12f830236928b6fadf40d917a7527f0a048d2f ]
The Link Retraining process is initiated to account for the Gen2 defect in
the Cadence PCIe controller in J721E SoC. The errata corresponding to this
is i2085, documented at:
https://www.ti.com/lit/er/sprz455c/sprz455c.pdf
The existing workaround implemented for the errata waits for the Data Link
initialization to complete and assumes that the link retraining process
at the Physical Layer has completed. However, it is possible that the
Physical Layer training might be ongoing as indicated by the
PCI_EXP_LNKSTA_LT bit in the PCI_EXP_LNKSTA register.
Fix the existing workaround, to ensure that the Physical Layer training
has also completed, in addition to the Data Link initialization.
Link: https://lore.kernel.org/r/20230315070800.1615527-1-s-vadapalli@ti.com
Fixes: 4740b969aaf5 ("PCI: cadence: Retrain Link to work around Gen2 training defect")
Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../controller/cadence/pcie-cadence-host.c | 27 +++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
index 940c7dd701d68..5b14f7ee3c798 100644
--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
+++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
@@ -12,6 +12,8 @@
#include "pcie-cadence.h"
+#define LINK_RETRAIN_TIMEOUT HZ
+
static u64 bar_max_size[] = {
[RP_BAR0] = _ULL(128 * SZ_2G),
[RP_BAR1] = SZ_2G,
@@ -77,6 +79,27 @@ static struct pci_ops cdns_pcie_host_ops = {
.write = pci_generic_config_write,
};
+static int cdns_pcie_host_training_complete(struct cdns_pcie *pcie)
+{
+ u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
+ unsigned long end_jiffies;
+ u16 lnk_stat;
+
+ /* Wait for link training to complete. Exit after timeout. */
+ end_jiffies = jiffies + LINK_RETRAIN_TIMEOUT;
+ do {
+ lnk_stat = cdns_pcie_rp_readw(pcie, pcie_cap_off + PCI_EXP_LNKSTA);
+ if (!(lnk_stat & PCI_EXP_LNKSTA_LT))
+ break;
+ usleep_range(0, 1000);
+ } while (time_before(jiffies, end_jiffies));
+
+ if (!(lnk_stat & PCI_EXP_LNKSTA_LT))
+ return 0;
+
+ return -ETIMEDOUT;
+}
+
static int cdns_pcie_host_wait_for_link(struct cdns_pcie *pcie)
{
struct device *dev = pcie->dev;
@@ -118,6 +141,10 @@ static int cdns_pcie_retrain(struct cdns_pcie *pcie)
cdns_pcie_rp_writew(pcie, pcie_cap_off + PCI_EXP_LNKCTL,
lnk_ctl);
+ ret = cdns_pcie_host_training_complete(pcie);
+ if (ret)
+ return ret;
+
ret = cdns_pcie_host_wait_for_link(pcie);
}
return ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 286/591] PCI: vmd: Reset VMD config register between soft reboots
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 285/591] PCI: cadence: Fix Gen2 Link Retraining process Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 287/591] scsi: qedf: Fix NULL dereference in error handling Greg Kroah-Hartman
` (308 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nirmal Patel, Lorenzo Pieralisi,
Jon Derrick, Sasha Levin
From: Nirmal Patel <nirmal.patel@linux.intel.com>
[ Upstream commit b61cf04c49c3dfa70a0d6725d3eb40bf9b35cf71 ]
VMD driver can disable or enable MSI remapping by changing
VMCONFIG_MSI_REMAP register. This register needs to be set to the
default value during soft reboots. Drives failed to enumerate
when Windows boots after performing a soft reboot from Linux.
Windows doesn't support MSI remapping disable feature and stale
register value hinders Windows VMD driver initialization process.
Adding vmd_shutdown function to make sure to set the VMCONFIG
register to the default value.
Link: https://lore.kernel.org/r/20230224202811.644370-1-nirmal.patel@linux.intel.com
Fixes: ee81ee84f873 ("PCI: vmd: Disable MSI-X remapping when possible")
Signed-off-by: Nirmal Patel <nirmal.patel@linux.intel.com>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Reviewed-by: Jon Derrick <jonathan.derrick@linux.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/vmd.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
index 769eedeb8802a..50a187a29a1d8 100644
--- a/drivers/pci/controller/vmd.c
+++ b/drivers/pci/controller/vmd.c
@@ -979,6 +979,13 @@ static void vmd_remove(struct pci_dev *dev)
ida_simple_remove(&vmd_instance_ida, vmd->instance);
}
+static void vmd_shutdown(struct pci_dev *dev)
+{
+ struct vmd_dev *vmd = pci_get_drvdata(dev);
+
+ vmd_remove_irq_domain(vmd);
+}
+
#ifdef CONFIG_PM_SLEEP
static int vmd_suspend(struct device *dev)
{
@@ -1056,6 +1063,7 @@ static struct pci_driver vmd_drv = {
.id_table = vmd_ids,
.probe = vmd_probe,
.remove = vmd_remove,
+ .shutdown = vmd_shutdown,
.driver = {
.pm = &vmd_dev_pm_ops,
},
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 287/591] scsi: qedf: Fix NULL dereference in error handling
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 286/591] PCI: vmd: Reset VMD config register between soft reboots Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 288/591] pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors Greg Kroah-Hartman
` (307 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinhong Zhu, Dan Carpenter,
Martin K. Petersen, Sasha Levin
From: Jinhong Zhu <jinhongzhu@hust.edu.cn>
[ Upstream commit f025312b089474a54e4859f3453771314d9e3d4f ]
Smatch reported:
drivers/scsi/qedf/qedf_main.c:3056 qedf_alloc_global_queues()
warn: missing unwind goto?
At this point in the function, nothing has been allocated so we can return
directly. In particular the "qedf->global_queues" have not been allocated
so calling qedf_free_global_queues() will lead to a NULL dereference when
we check if (!gl[i]) and "gl" is NULL.
Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
Signed-off-by: Jinhong Zhu <jinhongzhu@hust.edu.cn>
Link: https://lore.kernel.org/r/20230502140022.2852-1-jinhongzhu@hust.edu.cn
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qedf/qedf_main.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index e045c6e250902..ecff2ec83a002 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -3046,9 +3046,8 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)
* addresses of our queues
*/
if (!qedf->p_cpuq) {
- status = -EINVAL;
QEDF_ERR(&qedf->dbg_ctx, "p_cpuq is NULL.\n");
- goto mem_alloc_failure;
+ return -EINVAL;
}
qedf->global_queues = kzalloc((sizeof(struct global_queue *)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 288/591] pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 287/591] scsi: qedf: Fix NULL dereference in error handling Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 289/591] platform/x86: lenovo-yogabook: Fix work race on remove() Greg Kroah-Hartman
` (306 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Linus Walleij,
Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit cdf7e616120065007687fe1df0412154f259daec ]
gpiochip_add_pin_range() can fail, so better return its error code than
a hard coded '0'.
Fixes: d2b67744fd99 ("pinctrl: bcm2835: implement hook for missing gpio-ranges")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/98c3b5890bb72415145c9fe4e1d974711edae376.1681681402.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/bcm/pinctrl-bcm2835.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index 0f1ab0829ffe6..fe8da3ccb0b5a 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -376,10 +376,8 @@ static int bcm2835_of_gpio_ranges_fallback(struct gpio_chip *gc,
if (!pctldev)
return 0;
- gpiochip_add_pin_range(gc, pinctrl_dev_get_devname(pctldev), 0, 0,
- gc->ngpio);
-
- return 0;
+ return gpiochip_add_pin_range(gc, pinctrl_dev_get_devname(pctldev), 0, 0,
+ gc->ngpio);
}
static const struct gpio_chip bcm2835_gpio_chip = {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 289/591] platform/x86: lenovo-yogabook: Fix work race on remove()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 288/591] pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 290/591] platform/x86: lenovo-yogabook: Reprobe devices " Greg Kroah-Hartman
` (305 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans de Goede, Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 9148cd2eb4450a8e9c49c8a14201fb82f651128f ]
When yogabook_wmi_remove() runs yogabook_wmi_work might still be running
and using the devices which yogabook_wmi_remove() puts.
To avoid this move to explicitly cancelling the work rather then using
devm_work_autocancel().
This requires also making the yogabook_backside_hall_irq handler non
devm managed, so that it cannot re-queue the work while
yogabook_wmi_remove() runs.
Fixes: c0549b72d99d ("platform/x86: lenovo-yogabook-wmi: Add driver for Lenovo Yoga Book")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20230430165807.472798-3-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/lenovo-yogabook-wmi.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/platform/x86/lenovo-yogabook-wmi.c b/drivers/platform/x86/lenovo-yogabook-wmi.c
index 5f4bd1eec38a9..3a6de4ab74a41 100644
--- a/drivers/platform/x86/lenovo-yogabook-wmi.c
+++ b/drivers/platform/x86/lenovo-yogabook-wmi.c
@@ -2,7 +2,6 @@
/* WMI driver for Lenovo Yoga Book YB1-X90* / -X91* tablets */
#include <linux/acpi.h>
-#include <linux/devm-helpers.h>
#include <linux/gpio/consumer.h>
#include <linux/gpio/machine.h>
#include <linux/interrupt.h>
@@ -248,10 +247,7 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context)
data->brightness = YB_KBD_BL_DEFAULT;
set_bit(YB_KBD_IS_ON, &data->flags);
set_bit(YB_DIGITIZER_IS_ON, &data->flags);
-
- r = devm_work_autocancel(&wdev->dev, &data->work, yogabook_wmi_work);
- if (r)
- return r;
+ INIT_WORK(&data->work, yogabook_wmi_work);
data->kbd_adev = acpi_dev_get_first_match_dev("GDIX1001", NULL, -1);
if (!data->kbd_adev) {
@@ -299,10 +295,9 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context)
}
data->backside_hall_irq = r;
- r = devm_request_irq(&wdev->dev, data->backside_hall_irq,
- yogabook_backside_hall_irq,
- IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
- "backside_hall_sw", data);
+ r = request_irq(data->backside_hall_irq, yogabook_backside_hall_irq,
+ IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
+ "backside_hall_sw", data);
if (r) {
dev_err_probe(&wdev->dev, r, "Requesting backside_hall_sw IRQ\n");
goto error_put_devs;
@@ -318,11 +313,14 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context)
r = devm_led_classdev_register(&wdev->dev, &data->kbd_bl_led);
if (r < 0) {
dev_err_probe(&wdev->dev, r, "Registering backlight LED device\n");
- goto error_put_devs;
+ goto error_free_irq;
}
return 0;
+error_free_irq:
+ free_irq(data->backside_hall_irq, data);
+ cancel_work_sync(&data->work);
error_put_devs:
put_device(data->dig_dev);
put_device(data->kbd_dev);
@@ -335,6 +333,8 @@ static void yogabook_wmi_remove(struct wmi_device *wdev)
{
struct yogabook_wmi *data = dev_get_drvdata(&wdev->dev);
+ free_irq(data->backside_hall_irq, data);
+ cancel_work_sync(&data->work);
put_device(data->dig_dev);
put_device(data->kbd_dev);
acpi_dev_put(data->dig_adev);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 290/591] platform/x86: lenovo-yogabook: Reprobe devices on remove()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 289/591] platform/x86: lenovo-yogabook: Fix work race on remove() Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 291/591] platform/x86: lenovo-yogabook: Set default keyboard backligh brightness on probe() Greg Kroah-Hartman
` (304 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans de Goede, Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 711bcc0cb34e96a60e88d7b0260862781de3e530 ]
Ensure that both the keyboard touchscreen and the digitizer have their
driver bound after remove(). Without this modprobing lenovo-yogabook-wmi
after a rmmod fails because lenovo-yogabook-wmi defers probing until
both devices have their driver bound.
Fixes: c0549b72d99d ("platform/x86: lenovo-yogabook-wmi: Add driver for Lenovo Yoga Book")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20230430165807.472798-4-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/lenovo-yogabook-wmi.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/platform/x86/lenovo-yogabook-wmi.c b/drivers/platform/x86/lenovo-yogabook-wmi.c
index 3a6de4ab74a41..5948ffa74acd5 100644
--- a/drivers/platform/x86/lenovo-yogabook-wmi.c
+++ b/drivers/platform/x86/lenovo-yogabook-wmi.c
@@ -332,9 +332,20 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context)
static void yogabook_wmi_remove(struct wmi_device *wdev)
{
struct yogabook_wmi *data = dev_get_drvdata(&wdev->dev);
+ int r = 0;
free_irq(data->backside_hall_irq, data);
cancel_work_sync(&data->work);
+
+ if (!test_bit(YB_KBD_IS_ON, &data->flags))
+ r |= device_reprobe(data->kbd_dev);
+
+ if (!test_bit(YB_DIGITIZER_IS_ON, &data->flags))
+ r |= device_reprobe(data->dig_dev);
+
+ if (r)
+ dev_warn(&wdev->dev, "Reprobe of devices failed\n");
+
put_device(data->dig_dev);
put_device(data->kbd_dev);
acpi_dev_put(data->dig_adev);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 291/591] platform/x86: lenovo-yogabook: Set default keyboard backligh brightness on probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 290/591] platform/x86: lenovo-yogabook: Reprobe devices " Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 292/591] PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free Greg Kroah-Hartman
` (303 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans de Goede, Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 9e6380d6573181c555ca1b5019b08d19a9ee581c ]
Set default keyboard backlight brightness on probe(), this fixes
the backlight being off after a rmmod + modprobe.
Fixes: c0549b72d99d ("platform/x86: lenovo-yogabook-wmi: Add driver for Lenovo Yoga Book")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20230430165807.472798-5-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/lenovo-yogabook-wmi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/platform/x86/lenovo-yogabook-wmi.c b/drivers/platform/x86/lenovo-yogabook-wmi.c
index 5948ffa74acd5..d57fcc8388519 100644
--- a/drivers/platform/x86/lenovo-yogabook-wmi.c
+++ b/drivers/platform/x86/lenovo-yogabook-wmi.c
@@ -295,6 +295,9 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context)
}
data->backside_hall_irq = r;
+ /* Set default brightness before enabling the IRQ */
+ yogabook_wmi_set_kbd_backlight(data->wdev, YB_KBD_BL_DEFAULT);
+
r = request_irq(data->backside_hall_irq, yogabook_backside_hall_irq,
IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
"backside_hall_sw", data);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 292/591] PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 291/591] platform/x86: lenovo-yogabook: Set default keyboard backligh brightness on probe() Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 293/591] scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() Greg Kroah-Hartman
` (302 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Helgaas, Ding Hui, Sasha Levin,
Zongquan Qin
From: Ding Hui <dinghui@sangfor.com.cn>
[ Upstream commit 456d8aa37d0f56fc9e985e812496e861dcd6f2f2 ]
Struct pcie_link_state->downstream is a pointer to the pci_dev of function
0. Previously we retained that pointer when removing function 0, and
subsequent ASPM policy changes dereferenced it, resulting in a
use-after-free warning from KASAN, e.g.:
# echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove
# echo powersave > /sys/module/pcie_aspm/parameters/policy
BUG: KASAN: slab-use-after-free in pcie_config_aspm_link+0x42d/0x500
Call Trace:
kasan_report+0xae/0xe0
pcie_config_aspm_link+0x42d/0x500
pcie_aspm_set_policy+0x8e/0x1a0
param_attr_store+0x162/0x2c0
module_attr_store+0x3e/0x80
PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM
Control value in all functions of multi-function devices.
Disable ASPM and free the pcie_link_state when any child function is
removed so we can discard the dangling pcie_link_state->downstream pointer
and maintain the same ASPM Control configuration for all functions.
[bhelgaas: commit log and comment]
Debugged-by: Zongquan Qin <qinzongquan@sangfor.com.cn>
Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
Fixes: b5a0a9b59c81 ("PCI/ASPM: Read and set up L1 substate capabilities")
Link: https://lore.kernel.org/r/20230507034057.20970-1-dinghui@sangfor.com.cn
Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pcie/aspm.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 4b4184563a927..74b8183c305df 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -1010,21 +1010,24 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
down_read(&pci_bus_sem);
mutex_lock(&aspm_lock);
- /*
- * All PCIe functions are in one slot, remove one function will remove
- * the whole slot, so just wait until we are the last function left.
- */
- if (!list_empty(&parent->subordinate->devices))
- goto out;
link = parent->link_state;
root = link->root;
parent_link = link->parent;
- /* All functions are removed, so just disable ASPM for the link */
+ /*
+ * link->downstream is a pointer to the pci_dev of function 0. If
+ * we remove that function, the pci_dev is about to be deallocated,
+ * so we can't use link->downstream again. Free the link state to
+ * avoid this.
+ *
+ * If we're removing a non-0 function, it's possible we could
+ * retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends
+ * programming the same ASPM Control value for all functions of
+ * multi-function devices, so disable ASPM for all of them.
+ */
pcie_config_aspm_link(link, 0);
list_del(&link->sibling);
- /* Clock PM is for endpoint device */
free_link_state(link);
/* Recheck latencies and configure upstream links */
@@ -1032,7 +1035,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
pcie_update_aspm_capable(root);
pcie_config_aspm_path(parent_link);
}
-out:
+
mutex_unlock(&aspm_lock);
up_read(&pci_bus_sem);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 293/591] scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 292/591] PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 294/591] PCI: pciehp: Cancel bringup sequence if card is not present Greg Kroah-Hartman
` (301 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuchen Yang, Dan Carpenter,
Martin K. Petersen, Sasha Levin
From: Yuchen Yang <u202114568@hust.edu.cn>
[ Upstream commit 2e2fe5ac695a00ab03cab4db1f4d6be07168ed9d ]
Smatch complains that:
tw_probe() warn: missing error code 'retval'
This patch adds error checking to tw_probe() to handle initialization
failure. If tw_reset_sequence() function returns a non-zero value, the
function will return -EINVAL to indicate initialization failure.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yuchen Yang <u202114568@hust.edu.cn>
Link: https://lore.kernel.org/r/20230505141259.7730-1-u202114568@hust.edu.cn
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/3w-xxxx.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index ffdecb12d654c..9bd70e4618d52 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -2305,8 +2305,10 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
TW_DISABLE_INTERRUPTS(tw_dev);
/* Initialize the card */
- if (tw_reset_sequence(tw_dev))
+ if (tw_reset_sequence(tw_dev)) {
+ retval = -EINVAL;
goto out_release_mem_region;
+ }
/* Set host specific parameters */
host->max_id = TW_MAX_UNITS;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 294/591] PCI: pciehp: Cancel bringup sequence if card is not present
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 293/591] scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 295/591] PCI: ftpci100: Release the clock resources Greg Kroah-Hartman
` (300 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Rongguang Wei,
Bjorn Helgaas, Sasha Levin
From: Rongguang Wei <weirongguang@kylinos.cn>
[ Upstream commit e8afd0d9fccc27c8ad263db5cf5952cfcf72d6fe ]
If a PCIe hotplug slot has an Attention Button, the normal hot-add flow is:
- Slot is empty and slot power is off
- User inserts card in slot and presses Attention Button
- OS blinks Power Indicator for 5 seconds
- After 5 seconds, OS turns on Power Indicator, turns on slot power, and
enumerates the device
Previously, if a user pressed the Attention Button on an *empty* slot,
pciehp logged the following messages and blinked the Power Indicator
until a second button press:
[0.000] pciehp: Button press: will power on in 5 sec
[0.001] # Power Indicator starts blinking
[5.001] # 5 second timeout; slot is empty, so we should cancel the
request to power on and turn off Power Indicator
[7.000] # Power Indicator still blinking
[8.000] # possible card insertion
[9.000] pciehp: Button press: canceling request to power on
The first button press incorrectly left the slot in BLINKINGON_STATE, so
the second was interpreted as a "cancel power on" event regardless of
whether a card was present.
If the slot is empty, turn off the Power Indicator and return from
BLINKINGON_STATE to OFF_STATE after 5 seconds, effectively canceling the
request to power on. Putting the slot in OFF_STATE also means the second
button press will correctly request a slot power on if the slot is
occupied.
[bhelgaas: commit log]
Link: https://lore.kernel.org/r/20230512021518.336460-1-clementwei90@163.com
Fixes: d331710ea78f ("PCI: pciehp: Become resilient to missed events")
Suggested-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Rongguang Wei <weirongguang@kylinos.cn>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/hotplug/pciehp_ctrl.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index 529c348084401..32baba1b7f131 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -256,6 +256,14 @@ void pciehp_handle_presence_or_link_change(struct controller *ctrl, u32 events)
present = pciehp_card_present(ctrl);
link_active = pciehp_check_link_active(ctrl);
if (present <= 0 && link_active <= 0) {
+ if (ctrl->state == BLINKINGON_STATE) {
+ ctrl->state = OFF_STATE;
+ cancel_delayed_work(&ctrl->button_work);
+ pciehp_set_indicators(ctrl, PCI_EXP_SLTCTL_PWR_IND_OFF,
+ INDICATOR_NOOP);
+ ctrl_info(ctrl, "Slot(%s): Card not present\n",
+ slot_name(ctrl));
+ }
mutex_unlock(&ctrl->state_lock);
return;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 295/591] PCI: ftpci100: Release the clock resources
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 294/591] PCI: pciehp: Cancel bringup sequence if card is not present Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 296/591] pinctrl: sunplus: Add check for kmalloc Greg Kroah-Hartman
` (299 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junyan Ye, Lorenzo Pieralisi,
Dongliang Mu, Linus Walleij, Sasha Levin
From: Junyan Ye <yejunyan@hust.edu.cn>
[ Upstream commit c60738de85f40b0b9f5cb23c21f9246e5a47908c ]
Smatch reported:
1. drivers/pci/controller/pci-ftpci100.c:526 faraday_pci_probe() warn:
'clk' from clk_prepare_enable() not released on lines: 442,451,462,478,512,517.
2. drivers/pci/controller/pci-ftpci100.c:526 faraday_pci_probe() warn:
'p->bus_clk' from clk_prepare_enable() not released on lines: 451,462,478,512,517.
The clock resource is obtained by devm_clk_get(), and then
clk_prepare_enable() makes the clock resource ready for use. After that,
clk_disable_unprepare() should be called to release the clock resource
when it is no longer needed. However, while doing some error handling
in faraday_pci_probe(), clk_disable_unprepare() is not called to release
clk and p->bus_clk before returning. These return lines are exactly 442,
451, 462, 478, 512, 517.
Fix this warning by replacing devm_clk_get() with devm_clk_get_enabled(),
which is equivalent to devm_clk_get() + clk_prepare_enable(). And with
devm_clk_get_enabled(), the clock will automatically be disabled,
unprepared and freed when the device is unbound from the bus.
Link: https://lore.kernel.org/r/20230508043641.23807-1-yejunyan@hust.edu.cn
Fixes: b3c433efb8a3 ("PCI: faraday: Fix wrong pointer passed to PTR_ERR()")
Fixes: 2eeb02b28579 ("PCI: faraday: Add clock handling")
Fixes: 783a862563f7 ("PCI: faraday: Use pci_parse_request_of_pci_ranges()")
Fixes: d3c68e0a7e34 ("PCI: faraday: Add Faraday Technology FTPCI100 PCI Host Bridge driver")
Fixes: f1e8bd21e39e ("PCI: faraday: Convert IRQ masking to raw PCI config accessors")
Signed-off-by: Junyan Ye <yejunyan@hust.edu.cn>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pci-ftpci100.c | 14 ++------------
1 file changed, 2 insertions(+), 12 deletions(-)
diff --git a/drivers/pci/controller/pci-ftpci100.c b/drivers/pci/controller/pci-ftpci100.c
index 0cfd9d5a497c9..f7e61e169d838 100644
--- a/drivers/pci/controller/pci-ftpci100.c
+++ b/drivers/pci/controller/pci-ftpci100.c
@@ -429,22 +429,12 @@ static int faraday_pci_probe(struct platform_device *pdev)
p->dev = dev;
/* Retrieve and enable optional clocks */
- clk = devm_clk_get(dev, "PCLK");
+ clk = devm_clk_get_enabled(dev, "PCLK");
if (IS_ERR(clk))
return PTR_ERR(clk);
- ret = clk_prepare_enable(clk);
- if (ret) {
- dev_err(dev, "could not prepare PCLK\n");
- return ret;
- }
- p->bus_clk = devm_clk_get(dev, "PCICLK");
+ p->bus_clk = devm_clk_get_enabled(dev, "PCICLK");
if (IS_ERR(p->bus_clk))
return PTR_ERR(p->bus_clk);
- ret = clk_prepare_enable(p->bus_clk);
- if (ret) {
- dev_err(dev, "could not prepare PCICLK\n");
- return ret;
- }
p->base = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(p->base))
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 296/591] pinctrl: sunplus: Add check for kmalloc
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 295/591] PCI: ftpci100: Release the clock resources Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 297/591] PCI: Add pci_clear_master() stub for non-CONFIG_PCI Greg Kroah-Hartman
` (298 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wells Lu, Andy Shevchenko,
Linus Walleij, Sasha Levin
From: Wells Lu <wellslutw@gmail.com>
[ Upstream commit a5961bed5429cf1134d7f539b4ed60317012f84d ]
Fix Smatch static checker warning:
potential null dereference 'configs'. (kmalloc returns null)
Fixes: aa74c44be19c ("pinctrl: Add driver for Sunplus SP7021")
Signed-off-by: Wells Lu <wellslutw@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/1685277277-12209-1-git-send-email-wellslutw@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/sunplus/sppctl.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
diff --git a/drivers/pinctrl/sunplus/sppctl.c b/drivers/pinctrl/sunplus/sppctl.c
index 2b3335ab56c66..0449595b943cf 100644
--- a/drivers/pinctrl/sunplus/sppctl.c
+++ b/drivers/pinctrl/sunplus/sppctl.c
@@ -838,11 +838,6 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
int i, size = 0;
list = of_get_property(np_config, "sunplus,pins", &size);
-
- if (nmG <= 0)
- nmG = 0;
-
- parent = of_get_parent(np_config);
*num_maps = size / sizeof(*list);
/*
@@ -870,10 +865,14 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
}
}
+ if (nmG <= 0)
+ nmG = 0;
+
*map = kcalloc(*num_maps + nmG, sizeof(**map), GFP_KERNEL);
- if (*map == NULL)
+ if (!(*map))
return -ENOMEM;
+ parent = of_get_parent(np_config);
for (i = 0; i < (*num_maps); i++) {
dt_pin = be32_to_cpu(list[i]);
pin_num = FIELD_GET(GENMASK(31, 24), dt_pin);
@@ -887,6 +886,8 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
(*map)[i].data.configs.num_configs = 1;
(*map)[i].data.configs.group_or_pin = pin_get_name(pctldev, pin_num);
configs = kmalloc(sizeof(*configs), GFP_KERNEL);
+ if (!configs)
+ goto sppctl_map_err;
*configs = FIELD_GET(GENMASK(7, 0), dt_pin);
(*map)[i].data.configs.configs = configs;
@@ -900,6 +901,8 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
(*map)[i].data.configs.num_configs = 1;
(*map)[i].data.configs.group_or_pin = pin_get_name(pctldev, pin_num);
configs = kmalloc(sizeof(*configs), GFP_KERNEL);
+ if (!configs)
+ goto sppctl_map_err;
*configs = SPPCTL_IOP_CONFIGS;
(*map)[i].data.configs.configs = configs;
@@ -969,6 +972,15 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
of_node_put(parent);
dev_dbg(pctldev->dev, "%d pins mapped\n", *num_maps);
return 0;
+
+sppctl_map_err:
+ for (i = 0; i < (*num_maps); i++)
+ if (((*map)[i].type == PIN_MAP_TYPE_CONFIGS_PIN) &&
+ (*map)[i].data.configs.configs)
+ kfree((*map)[i].data.configs.configs);
+ kfree(*map);
+ of_node_put(parent);
+ return -ENOMEM;
}
static const struct pinctrl_ops sppctl_pctl_ops = {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 297/591] PCI: Add pci_clear_master() stub for non-CONFIG_PCI
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 296/591] pinctrl: sunplus: Add check for kmalloc Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 298/591] scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state Greg Kroah-Hartman
` (297 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sui Jingfeng, Bjorn Helgaas,
Geert Uytterhoeven, Sasha Levin
From: Sui Jingfeng <suijingfeng@loongson.cn>
[ Upstream commit 2aa5ac633259843f656eb6ecff4cf01e8e810c5e ]
Add a pci_clear_master() stub when CONFIG_PCI is not set so drivers that
support both PCI and platform devices don't need #ifdefs or extra Kconfig
symbols for the PCI parts.
[bhelgaas: commit log]
Fixes: 6a479079c072 ("PCI: Add pci_clear_master() as opposite of pci_set_master()")
Link: https://lore.kernel.org/r/20230531102744.2354313-1-suijingfeng@loongson.cn
Signed-off-by: Sui Jingfeng <suijingfeng@loongson.cn>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/pci.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/linux/pci.h b/include/linux/pci.h
index d20695184e0b9..9f617ffdb863f 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1809,6 +1809,7 @@ static inline int pci_dev_present(const struct pci_device_id *ids)
#define pci_dev_put(dev) do { } while (0)
static inline void pci_set_master(struct pci_dev *dev) { }
+static inline void pci_clear_master(struct pci_dev *dev) { }
static inline int pci_enable_device(struct pci_dev *dev) { return -EIO; }
static inline void pci_disable_device(struct pci_dev *dev) { }
static inline int pcim_enable_device(struct pci_dev *pdev) { return -EIO; }
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 298/591] scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 297/591] PCI: Add pci_clear_master() stub for non-CONFIG_PCI Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 299/591] perf bench: Add missing setlocale() call to allow usage of %d style formatting Greg Kroah-Hartman
` (296 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Tee, Martin K. Petersen,
Sasha Levin
From: Justin Tee <justin.tee@broadcom.com>
[ Upstream commit 9914a3d033d3e1d836a43e93e9738e7dd44a096a ]
When NPIV ports are zoned to devices that support both initiator and target
mode, a remote device's initiated PRLI results in unintended final kref
clean up of the device's ndlp structure. This disrupts NPIV ports'
discovery for target devices that support both initiator and target mode.
Modify the NPIV lpfc_drop_node clause such that we allow the ndlp to live
so long as it was in NLP_STE_PLOGI_ISSUE, NLP_STE_REG_LOGIN_ISSUE, or
NLP_STE_PRLI_ISSUE nlp_state. This allows lpfc's issued PRLI completion
routine to determine if the final kref clean up should execute rather than
a remote device's issued PRLI.
Fixes: db651ec22524 ("scsi: lpfc: Correct used_rpi count when devloss tmo fires with no recovery")
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Link: https://lore.kernel.org/r/20230523183206.7728-5-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_els.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index ddd5949d8fc01..e21c73a3803ec 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -5413,9 +5413,19 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
ndlp->nlp_flag &= ~NLP_RELEASE_RPI;
spin_unlock_irq(&ndlp->lock);
}
+ lpfc_drop_node(vport, ndlp);
+ } else if (ndlp->nlp_state != NLP_STE_PLOGI_ISSUE &&
+ ndlp->nlp_state != NLP_STE_REG_LOGIN_ISSUE &&
+ ndlp->nlp_state != NLP_STE_PRLI_ISSUE) {
+ /* Drop ndlp if there is no planned or outstanding
+ * issued PRLI.
+ *
+ * In cases when the ndlp is acting as both an initiator
+ * and target function, let our issued PRLI determine
+ * the final ndlp kref drop.
+ */
+ lpfc_drop_node(vport, ndlp);
}
-
- lpfc_drop_node(vport, ndlp);
}
/* Release the originating I/O reference. */
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 299/591] perf bench: Add missing setlocale() call to allow usage of %d style formatting
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 298/591] scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 300/591] pinctrl: cherryview: Return correct value if pin in push-pull mode Greg Kroah-Hartman
` (295 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Andre Fredette,
Clark Williams, Dave Tucker, Davidlohr Bueso, Derek Barbosa,
Ian Rogers, Jiri Olsa, Namhyung Kim, Tiezhu Yang,
Arnaldo Carvalho de Melo, Sasha Levin
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 16203e9cd01896b4244100a8e3fb9f6e612ab2b1 ]
Without this we were not getting the thousands separator for big
numbers.
Noticed while developing 'perf bench uprobe', but the use of %' predates
that, for instance 'perf bench syscall' uses it.
Before:
# perf bench uprobe all
# Running uprobe/baseline benchmark...
# Executed 1000 usleep(1000) calls
Total time: 1054082243ns
1054082.243000 nsecs/op
#
After:
# perf bench uprobe all
# Running uprobe/baseline benchmark...
# Executed 1,000 usleep(1000) calls
Total time: 1,053,715,144ns
1,053,715.144000 nsecs/op
#
Fixes: c2a08203052f8975 ("perf bench: Add basic syscall benchmark")
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andre Fredette <anfredet@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: Dave Tucker <datucker@redhat.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Derek Barbosa <debarbos@redhat.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
Link: https://lore.kernel.org/lkml/ZH3lcepZ4tBYr1jv@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-bench.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/perf/builtin-bench.c b/tools/perf/builtin-bench.c
index 334ab897aae3b..a5c2a6938b4e4 100644
--- a/tools/perf/builtin-bench.c
+++ b/tools/perf/builtin-bench.c
@@ -21,6 +21,7 @@
#include "builtin.h"
#include "bench/bench.h"
+#include <locale.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -256,6 +257,7 @@ int cmd_bench(int argc, const char **argv)
/* Unbuffered output */
setvbuf(stdout, NULL, _IONBF, 0);
+ setlocale(LC_ALL, "");
if (argc < 2) {
/* No collection specified. */
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 300/591] pinctrl: cherryview: Return correct value if pin in push-pull mode
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 299/591] perf bench: Add missing setlocale() call to allow usage of %d style formatting Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 301/591] platform/x86: think-lmi: mutex protection around multiple WMI calls Greg Kroah-Hartman
` (294 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mika Westerberg, Andy Shevchenko,
Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 5835196a17be5cfdcad0b617f90cf4abe16951a4 ]
Currently the getter returns ENOTSUPP on pin configured in
the push-pull mode. Fix this by adding the missed switch case.
Fixes: ccdf81d08dbe ("pinctrl: cherryview: add option to set open-drain pin config")
Fixes: 6e08d6bbebeb ("pinctrl: Add Intel Cherryview/Braswell pin controller support")
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/intel/pinctrl-cherryview.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 5c4fd16e5b010..0d6b5fab2f7e4 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -947,11 +947,6 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned int pin,
break;
- case PIN_CONFIG_DRIVE_OPEN_DRAIN:
- if (!(ctrl1 & CHV_PADCTRL1_ODEN))
- return -EINVAL;
- break;
-
case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: {
u32 cfg;
@@ -961,6 +956,16 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned int pin,
return -EINVAL;
break;
+
+ case PIN_CONFIG_DRIVE_PUSH_PULL:
+ if (ctrl1 & CHV_PADCTRL1_ODEN)
+ return -EINVAL;
+ break;
+
+ case PIN_CONFIG_DRIVE_OPEN_DRAIN:
+ if (!(ctrl1 & CHV_PADCTRL1_ODEN))
+ return -EINVAL;
+ break;
}
default:
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 301/591] platform/x86: think-lmi: mutex protection around multiple WMI calls
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 300/591] pinctrl: cherryview: Return correct value if pin in push-pull mode Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 302/591] platform/x86: think-lmi: Correct System password interface Greg Kroah-Hartman
` (293 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Pearson, Ilpo Järvinen,
Hans de Goede, Sasha Levin
From: Mark Pearson <mpearson-lenovo@squebb.ca>
[ Upstream commit c41e0121a1221894a1a9c4666156db9e1def4d6c ]
When an attribute is being changed if the Admin account is enabled, or if
a password is being updated then multiple WMI calls are needed.
Add mutex protection to ensure no race conditions are introduced.
Fixes: b49f72e7f96d ("platform/x86: think-lmi: Certificate authentication support")
Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20230601200552.4396-1-mpearson-lenovo@squebb.ca
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/think-lmi.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
index 336b9029d1515..4e6040c0a2201 100644
--- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -14,6 +14,7 @@
#include <linux/acpi.h>
#include <linux/errno.h>
#include <linux/fs.h>
+#include <linux/mutex.h>
#include <linux/string.h>
#include <linux/types.h>
#include <linux/dmi.h>
@@ -195,6 +196,7 @@ static const char * const level_options[] = {
};
static struct think_lmi tlmi_priv;
static struct class *fw_attr_class;
+static DEFINE_MUTEX(tlmi_mutex);
/* ------ Utility functions ------------*/
/* Strip out CR if one is present */
@@ -437,6 +439,9 @@ static ssize_t new_password_store(struct kobject *kobj,
/* Strip out CR if one is present, setting password won't work if it is present */
strip_cr(new_pwd);
+ /* Use lock in case multiple WMI operations needed */
+ mutex_lock(&tlmi_mutex);
+
pwdlen = strlen(new_pwd);
/* pwdlen == 0 is allowed to clear the password */
if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) {
@@ -493,6 +498,7 @@ static ssize_t new_password_store(struct kobject *kobj,
kfree(auth_str);
}
out:
+ mutex_unlock(&tlmi_mutex);
kfree(new_pwd);
return ret ?: count;
}
@@ -982,6 +988,9 @@ static ssize_t current_value_store(struct kobject *kobj,
/* Strip out CR if one is present */
strip_cr(new_setting);
+ /* Use lock in case multiple WMI operations needed */
+ mutex_lock(&tlmi_mutex);
+
/* Check if certificate authentication is enabled and active */
if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) {
if (!tlmi_priv.pwd_admin->signature || !tlmi_priv.pwd_admin->save_signature) {
@@ -1040,6 +1049,7 @@ static ssize_t current_value_store(struct kobject *kobj,
kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
}
out:
+ mutex_unlock(&tlmi_mutex);
kfree(auth_str);
kfree(set_str);
kfree(new_setting);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 302/591] platform/x86: think-lmi: Correct System password interface
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 301/591] platform/x86: think-lmi: mutex protection around multiple WMI calls Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 303/591] platform/x86: think-lmi: Correct NVME password handling Greg Kroah-Hartman
` (292 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Pearson, Ilpo Järvinen,
Hans de Goede, Sasha Levin
From: Mark Pearson <mpearson-lenovo@squebb.ca>
[ Upstream commit 97eef5983372d7aee6549d644d788fd0c10d2b6e ]
The system password identification was incorrect. This means that if
the password was enabled it wouldn't be detected correctly; and setting
it would not work.
Also updated code to use TLMI_SMP_PWD instead of TLMI_SYS_PWD to be in
sync with Lenovo documentation.
Fixes: 640a5fa50a42 ("platform/x86: think-lmi: Opcode support")
Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20230601200552.4396-3-mpearson-lenovo@squebb.ca
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/think-lmi.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
index 4e6040c0a2201..3a511c0f13e45 100644
--- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -172,7 +172,7 @@ MODULE_PARM_DESC(debug_support, "Enable debug command support");
#define TLMI_POP_PWD (1 << 0)
#define TLMI_PAP_PWD (1 << 1)
#define TLMI_HDD_PWD (1 << 2)
-#define TLMI_SYS_PWD (1 << 3)
+#define TLMI_SMP_PWD (1 << 6) /* System Management */
#define TLMI_CERT (1 << 7)
#define to_tlmi_pwd_setting(kobj) container_of(kobj, struct tlmi_pwd_setting, kobj)
@@ -1522,11 +1522,11 @@ static int tlmi_analyze(void)
tlmi_priv.pwd_power->valid = true;
if (tlmi_priv.opcode_support) {
- tlmi_priv.pwd_system = tlmi_create_auth("sys", "system");
+ tlmi_priv.pwd_system = tlmi_create_auth("smp", "system");
if (!tlmi_priv.pwd_system)
goto fail_clear_attr;
- if (tlmi_priv.pwdcfg.core.password_state & TLMI_SYS_PWD)
+ if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD)
tlmi_priv.pwd_system->valid = true;
tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd");
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 303/591] platform/x86: think-lmi: Correct NVME password handling
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 302/591] platform/x86: think-lmi: Correct System password interface Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 304/591] pinctrl:sunplus: Add check for kmalloc Greg Kroah-Hartman
` (291 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Pearson, Ilpo Järvinen,
Hans de Goede, Sasha Levin
From: Mark Pearson <mpearson-lenovo@squebb.ca>
[ Upstream commit 4cebb42412248d28df6de01420cfac5654428d41 ]
NVME passwords identifier have been standardised across the Lenovo
systems and now use udrp and adrp (user and admin level) instead of
unvp and mnvp.
This should apparently be backwards compatible.
Fixes: 640a5fa50a42 ("platform/x86: think-lmi: Opcode support")
Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20230601200552.4396-6-mpearson-lenovo@squebb.ca
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/think-lmi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
index 3a511c0f13e45..3cbb92b6c5215 100644
--- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -461,9 +461,9 @@ static ssize_t new_password_store(struct kobject *kobj,
sprintf(pwd_type, "mhdp%d", setting->index);
} else if (setting == tlmi_priv.pwd_nvme) {
if (setting->level == TLMI_LEVEL_USER)
- sprintf(pwd_type, "unvp%d", setting->index);
+ sprintf(pwd_type, "udrp%d", setting->index);
else
- sprintf(pwd_type, "mnvp%d", setting->index);
+ sprintf(pwd_type, "adrp%d", setting->index);
} else {
sprintf(pwd_type, "%s", setting->pwd_type);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 304/591] pinctrl:sunplus: Add check for kmalloc
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 303/591] platform/x86: think-lmi: Correct NVME password handling Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 305/591] pinctrl: npcm7xx: Add missing check for ioremap Greg Kroah-Hartman
` (290 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wells Lu, Andy Shevchenko,
Linus Walleij, Sasha Levin
From: Wells Lu <wellslutw@gmail.com>
[ Upstream commit 73f8ce7f961afcb3be49352efeb7c26cc1c00cc4 ]
Fix Smatch static checker warning:
potential null dereference 'configs'. (kmalloc returns null)
Changes in v2:
1. Add free allocated memory before returned -ENOMEM.
2. Add call of_node_put() before returned -ENOMEM.
Fixes: aa74c44be19c ("pinctrl: Add driver for Sunplus SP7021")
Signed-off-by: Wells Lu <wellslutw@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/1685277277-12209-1-git-send-email-wellslutw@gmail.com
[Rebased on the patch from Lu Hongfei]
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/sunplus/sppctl.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/pinctrl/sunplus/sppctl.c b/drivers/pinctrl/sunplus/sppctl.c
index 0449595b943cf..6b24fa0e63c0f 100644
--- a/drivers/pinctrl/sunplus/sppctl.c
+++ b/drivers/pinctrl/sunplus/sppctl.c
@@ -975,8 +975,7 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node
sppctl_map_err:
for (i = 0; i < (*num_maps); i++)
- if (((*map)[i].type == PIN_MAP_TYPE_CONFIGS_PIN) &&
- (*map)[i].data.configs.configs)
+ if ((*map)[i].type == PIN_MAP_TYPE_CONFIGS_PIN)
kfree((*map)[i].data.configs.configs);
kfree(*map);
of_node_put(parent);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 305/591] pinctrl: npcm7xx: Add missing check for ioremap
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 304/591] pinctrl:sunplus: Add check for kmalloc Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 306/591] kcsan: Dont expect 64 bits atomic builtins from 32 bits architectures Greg Kroah-Hartman
` (289 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Andy Shevchenko,
Linus Walleij, Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit ad64639417161e90b30dda00486570eb150aeee5 ]
Add check for ioremap() and return the error if it fails in order to
guarantee the success of ioremap().
Fixes: 3b588e43ee5c ("pinctrl: nuvoton: add NPCM7xx pinctrl and GPIO driver")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20230607095829.1345-1-jiasheng@iscas.ac.cn
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
index 1c4e89b046de1..ac4c69132fa03 100644
--- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
+++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
@@ -1878,6 +1878,8 @@ static int npcm7xx_gpio_of(struct npcm7xx_pinctrl *pctrl)
}
pctrl->gpio_bank[id].base = ioremap(res.start, resource_size(&res));
+ if (!pctrl->gpio_bank[id].base)
+ return -EINVAL;
ret = bgpio_init(&pctrl->gpio_bank[id].gc, dev, 4,
pctrl->gpio_bank[id].base + NPCM7XX_GP_N_DIN,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 306/591] kcsan: Dont expect 64 bits atomic builtins from 32 bits architectures
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 305/591] pinctrl: npcm7xx: Add missing check for ioremap Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 307/591] powerpc/interrupt: Dont read MSR from interrupt_exit_kernel_prepare() Greg Kroah-Hartman
` (288 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marco Elver, Christophe Leroy,
Michael Ellerman, Sasha Levin
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 353e7300a1db928e427462f2745f9a2cd1625b3d ]
Activating KCSAN on a 32 bits architecture leads to the following
link-time failure:
LD .tmp_vmlinux.kallsyms1
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_load':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_load_8'
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_store':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_store_8'
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_exchange':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_exchange_8'
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_add':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_add_8'
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_sub':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_sub_8'
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_and':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_and_8'
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_or':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_or_8'
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_xor':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_xor_8'
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_nand':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_nand_8'
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_strong':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8'
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_weak':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8'
powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_val':
kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8'
32 bits architectures don't have 64 bits atomic builtins. Only
include DEFINE_TSAN_ATOMIC_OPS(64) on 64 bits architectures.
Fixes: 0f8ad5f2e934 ("kcsan: Add support for atomic builtins")
Suggested-by: Marco Elver <elver@google.com>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Reviewed-by: Marco Elver <elver@google.com>
Acked-by: Marco Elver <elver@google.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/d9c6afc28d0855240171a4e0ad9ffcdb9d07fceb.1683892665.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/kcsan/core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/kcsan/core.c b/kernel/kcsan/core.c
index 5a60cc52adc0c..8a7baf4e332e3 100644
--- a/kernel/kcsan/core.c
+++ b/kernel/kcsan/core.c
@@ -1270,7 +1270,9 @@ static __always_inline void kcsan_atomic_builtin_memorder(int memorder)
DEFINE_TSAN_ATOMIC_OPS(8);
DEFINE_TSAN_ATOMIC_OPS(16);
DEFINE_TSAN_ATOMIC_OPS(32);
+#ifdef CONFIG_64BIT
DEFINE_TSAN_ATOMIC_OPS(64);
+#endif
void __tsan_atomic_thread_fence(int memorder);
void __tsan_atomic_thread_fence(int memorder)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 307/591] powerpc/interrupt: Dont read MSR from interrupt_exit_kernel_prepare()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 306/591] kcsan: Dont expect 64 bits atomic builtins from 32 bits architectures Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 308/591] powerpc/signal32: Force inlining of __unsafe_save_user_regs() and save_tm_user_regs_unsafe() Greg Kroah-Hartman
` (287 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe Leroy, Nicholas Piggin,
Michael Ellerman, Sasha Levin
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 0eb089a72fda3f7969e6277804bde75dc1474a14 ]
A disassembly of interrupt_exit_kernel_prepare() shows a useless read
of MSR register. This is shown by r9 being re-used immediately without
doing anything with the value read.
c000e0e0: 60 00 00 00 nop
c000e0e4: 7d 3a c2 a6 mfmd_ap r9
c000e0e8: 7d 20 00 a6 mfmsr r9
c000e0ec: 7c 51 13 a6 mtspr 81,r2
c000e0f0: 81 3f 00 84 lwz r9,132(r31)
c000e0f4: 71 29 80 00 andi. r9,r9,32768
This is due to the use of local_irq_save(). The flags read by
local_irq_save() are never used, use local_irq_disable() instead.
Fixes: 13799748b957 ("powerpc/64: use interrupt restart table to speed up return from interrupt")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/df36c6205ab64326fb1b991993c82057e92ace2f.1685955214.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/interrupt.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/powerpc/kernel/interrupt.c b/arch/powerpc/kernel/interrupt.c
index 0ec1581619db5..cf770d86c03c6 100644
--- a/arch/powerpc/kernel/interrupt.c
+++ b/arch/powerpc/kernel/interrupt.c
@@ -368,7 +368,6 @@ void preempt_schedule_irq(void);
notrace unsigned long interrupt_exit_kernel_prepare(struct pt_regs *regs)
{
- unsigned long flags;
unsigned long ret = 0;
unsigned long kuap;
bool stack_store = read_thread_flags() & _TIF_EMULATE_STACK_STORE;
@@ -392,7 +391,7 @@ notrace unsigned long interrupt_exit_kernel_prepare(struct pt_regs *regs)
kuap = kuap_get_and_assert_locked();
- local_irq_save(flags);
+ local_irq_disable();
if (!arch_irq_disabled_regs(regs)) {
/* Returning to a kernel context with local irqs enabled. */
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 308/591] powerpc/signal32: Force inlining of __unsafe_save_user_regs() and save_tm_user_regs_unsafe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 307/591] powerpc/interrupt: Dont read MSR from interrupt_exit_kernel_prepare() Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 309/591] perf script: Fix allocation of evsel->priv related to per-event dump files Greg Kroah-Hartman
` (286 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe Leroy, Michael Ellerman,
Sasha Levin
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit a03b1a0b19398a47489fdcef02ec19c2ba05a15d ]
Looking at generated code for handle_signal32() shows calls to a
function called __unsafe_save_user_regs.constprop.0 while user access
is open.
And that __unsafe_save_user_regs.constprop.0 function has two nops at
the begining, allowing it to be traced, which is unexpected during
user access open window.
The solution could be to mark __unsafe_save_user_regs() no trace, but
to be on the safe side the most efficient is to flag it __always_inline
as already done for function __unsafe_restore_general_regs(). The
function is relatively small and only called twice, so the size
increase will remain in the noise.
Do the same with save_tm_user_regs_unsafe() as it may suffer the
same issue.
Fixes: ef75e7318294 ("powerpc/signal32: Transform save_user_regs() and save_tm_user_regs() in 'unsafe' version")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/7e469c8f01860a69c1ada3ca6a5e2aa65f0f74b2.1685955220.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/signal_32.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index c114c7f25645c..7a718ed32b277 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -264,8 +264,9 @@ static void prepare_save_user_regs(int ctx_has_vsx_region)
#endif
}
-static int __unsafe_save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
- struct mcontext __user *tm_frame, int ctx_has_vsx_region)
+static __always_inline int
+__unsafe_save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+ struct mcontext __user *tm_frame, int ctx_has_vsx_region)
{
unsigned long msr = regs->msr;
@@ -364,8 +365,9 @@ static void prepare_save_tm_user_regs(void)
current->thread.ckvrsave = mfspr(SPRN_VRSAVE);
}
-static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame,
- struct mcontext __user *tm_frame, unsigned long msr)
+static __always_inline int
+save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame,
+ struct mcontext __user *tm_frame, unsigned long msr)
{
/* Save both sets of general registers */
unsafe_save_general_regs(¤t->thread.ckpt_regs, frame, failed);
@@ -444,8 +446,9 @@ static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user
#else
static void prepare_save_tm_user_regs(void) { }
-static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame,
- struct mcontext __user *tm_frame, unsigned long msr)
+static __always_inline int
+save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame,
+ struct mcontext __user *tm_frame, unsigned long msr)
{
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 309/591] perf script: Fix allocation of evsel->priv related to per-event dump files
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 308/591] powerpc/signal32: Force inlining of __unsafe_save_user_regs() and save_tm_user_regs_unsafe() Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 310/591] platform/x86: thinkpad_acpi: Fix lkp-tests warnings for platform profiles Greg Kroah-Hartman
` (285 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Adrian Hunter, Jiri Olsa,
Namhyung Kim, Ravi Bangoria, Arnaldo Carvalho de Melo,
Sasha Levin
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 36d3e4138e1b6cc9ab179f3f397b5548f8b1eaae ]
When printing output we may want to generate per event files, where the
--per-event-dump option should be used, creating perf.data.EVENT.dump
files instead of printing to stdout.
The callback thar processes event thus expects that evsel->priv->fp
should point to either the per-event FILE descriptor or to stdout.
The a3af66f51bd0bca7 ("perf script: Fix crash because of missing
evsel->priv") changeset fixed a case where evsel->priv wasn't setup,
thus set to NULL, causing a segfault when trying to access
evsel->priv->fp.
But it did it for the non --per-event-dump case by allocating a 'struct
perf_evsel_script' just to set its ->fp to stdout.
Since evsel->priv is only freed when --per-event-dump is used, we ended
up with a memory leak, detected using ASAN.
Fix it by using the same method as perf_script__setup_per_event_dump(),
and reuse that static 'struct perf_evsel_script'.
Also check if evsel_script__new() failed.
Fixes: a3af66f51bd0bca7 ("perf script: Fix crash because of missing evsel->priv")
Reported-by: Ian Rogers <irogers@google.com>
Tested-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Link: https://lore.kernel.org/lkml/ZH+F0wGAWV14zvMP@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-script.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index 7ca238277d835..a794a3d2e47b7 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -2390,6 +2390,9 @@ static int process_sample_event(struct perf_tool *tool,
return ret;
}
+// Used when scr->per_event_dump is not set
+static struct evsel_script es_stdout;
+
static int process_attr(struct perf_tool *tool, union perf_event *event,
struct evlist **pevlist)
{
@@ -2398,7 +2401,6 @@ static int process_attr(struct perf_tool *tool, union perf_event *event,
struct evsel *evsel, *pos;
u64 sample_type;
int err;
- static struct evsel_script *es;
err = perf_event__process_attr(tool, event, pevlist);
if (err)
@@ -2408,14 +2410,13 @@ static int process_attr(struct perf_tool *tool, union perf_event *event,
evsel = evlist__last(*pevlist);
if (!evsel->priv) {
- if (scr->per_event_dump) {
+ if (scr->per_event_dump) {
evsel->priv = evsel_script__new(evsel, scr->session->data);
- } else {
- es = zalloc(sizeof(*es));
- if (!es)
+ if (!evsel->priv)
return -ENOMEM;
- es->fp = stdout;
- evsel->priv = es;
+ } else { // Replicate what is done in perf_script__setup_per_event_dump()
+ es_stdout.fp = stdout;
+ evsel->priv = &es_stdout;
}
}
@@ -2721,7 +2722,6 @@ static int perf_script__fopen_per_event_dump(struct perf_script *script)
static int perf_script__setup_per_event_dump(struct perf_script *script)
{
struct evsel *evsel;
- static struct evsel_script es_stdout;
if (script->per_event_dump)
return perf_script__fopen_per_event_dump(script);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 310/591] platform/x86: thinkpad_acpi: Fix lkp-tests warnings for platform profiles
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 309/591] perf script: Fix allocation of evsel->priv related to per-event dump files Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 311/591] perf dwarf-aux: Fix off-by-one in die_get_varname() Greg Kroah-Hartman
` (284 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Mark Pearson, Hans de Goede, Sasha Levin
From: Mark Pearson <mpearson-lenovo@squebb.ca>
[ Upstream commit f999e23ce66c1555d7b653fba171a88ecee53704 ]
Fix issues identified in dytc_profile_refresh identified by lkp-tests.
drivers/platform/x86/thinkpad_acpi.c:10538
dytc_profile_refresh() error: uninitialized symbol 'funcmode'.
drivers/platform/x86/thinkpad_acpi.c:10531
dytc_profile_refresh() error: uninitialized symbol 'output'.
drivers/platform/x86/thinkpad_acpi.c:10537
dytc_profile_refresh() error: uninitialized symbol 'output'.
These issues should not lead to real problems in the field as the refresh
function should only be called if MMC or PSC mode enabled. But good to fix.
Thanks to Dan Carpenter and the lkp-tests project for flagging these.
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202306011202.1hbgLRD4-lkp@intel.com/
Fixes: 1bc5d819f0b9 ("platform/x86: thinkpad_acpi: Fix profile modes on Intel platforms")
Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Link: https://lore.kernel.org/r/20230606151804.8819-1-mpearson-lenovo@squebb.ca
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/thinkpad_acpi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 5b2c8dd2861b7..e7ece2738de94 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -10528,8 +10528,8 @@ static int dytc_profile_set(struct platform_profile_handler *pprof,
static void dytc_profile_refresh(void)
{
enum platform_profile_option profile;
- int output, err = 0;
- int perfmode, funcmode;
+ int output = 0, err = 0;
+ int perfmode, funcmode = 0;
mutex_lock(&dytc_mutex);
if (dytc_capabilities & BIT(DYTC_FC_MMC)) {
@@ -10542,6 +10542,8 @@ static void dytc_profile_refresh(void)
err = dytc_command(DYTC_CMD_GET, &output);
/* Check if we are PSC mode, or have AMT enabled */
funcmode = (output >> DYTC_GET_FUNCTION_BIT) & 0xF;
+ } else { /* Unknown profile mode */
+ err = -ENODEV;
}
mutex_unlock(&dytc_mutex);
if (err)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 311/591] perf dwarf-aux: Fix off-by-one in die_get_varname()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 310/591] platform/x86: thinkpad_acpi: Fix lkp-tests warnings for platform profiles Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 312/591] platform/x86/dell/dell-rbtn: Fix resources leaking on error path Greg Kroah-Hartman
` (283 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namhyung Kim, Adrian Hunter,
Ian Rogers, Ingo Molnar, Jiri Olsa, Masami Hiramatsu,
Peter Zijlstra, Arnaldo Carvalho de Melo, Sasha Levin
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 3abfcfd847717d232e36963f31a361747c388fe7 ]
The die_get_varname() returns "(unknown_type)" string if it failed to
find a type for the variable. But it had a space before the opening
parenthesis and it made the closing parenthesis cut off due to the
off-by-one in the string length (14).
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Fixes: 88fd633cdfa19060 ("perf probe: No need to use formatting strbuf method")
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20230612234102.3909116-1-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/dwarf-aux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
index 623527edeac1e..b125eaadcec4d 100644
--- a/tools/perf/util/dwarf-aux.c
+++ b/tools/perf/util/dwarf-aux.c
@@ -1081,7 +1081,7 @@ int die_get_varname(Dwarf_Die *vr_die, struct strbuf *buf)
ret = die_get_typename(vr_die, buf);
if (ret < 0) {
pr_debug("Failed to get type, make it unknown.\n");
- ret = strbuf_add(buf, " (unknown_type)", 14);
+ ret = strbuf_add(buf, "(unknown_type)", 14);
}
return ret < 0 ? ret : strbuf_addf(buf, "\t%s", dwarf_diename(vr_die));
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 312/591] platform/x86/dell/dell-rbtn: Fix resources leaking on error path
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 311/591] perf dwarf-aux: Fix off-by-one in die_get_varname() Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 313/591] perf tool x86: Consolidate is_amd check into single function Greg Kroah-Hartman
` (282 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Pali Rohár,
Michal Wilczynski, Andy Shevchenko, Rafael J. Wysocki,
Hans de Goede, Sasha Levin
From: Michal Wilczynski <michal.wilczynski@intel.com>
[ Upstream commit 966cca72ab20289083521a385fa56035d85a222d ]
Currently rbtn_add() in case of failure is leaking resources. Fix this
by adding a proper rollback. Move devm_kzalloc() before rbtn_acquire(),
so it doesn't require rollback in case of failure. While at it, remove
unnecessary assignment of NULL to device->driver_data and unnecessary
whitespace, plus add a break for the default case in a switch.
Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Suggested-by: Pali Rohár <pali@kernel.org>
Fixes: 817a5cdb40c8 ("dell-rbtn: Dell Airplane Mode Switch driver")
Signed-off-by: Michal Wilczynski <michal.wilczynski@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Rafael J. Wysocki <rafael@kernel.org>
Reviewed-by: Pali Rohár <pali@kernel.org>
Link: https://lore.kernel.org/r/20230613084310.2775896-1-michal.wilczynski@intel.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/dell/dell-rbtn.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/drivers/platform/x86/dell/dell-rbtn.c
+++ b/drivers/platform/x86/dell/dell-rbtn.c
@@ -395,16 +395,16 @@ static int rbtn_add(struct acpi_device *
return -EINVAL;
}
+ rbtn_data = devm_kzalloc(&device->dev, sizeof(*rbtn_data), GFP_KERNEL);
+ if (!rbtn_data)
+ return -ENOMEM;
+
ret = rbtn_acquire(device, true);
if (ret < 0) {
dev_err(&device->dev, "Cannot enable device\n");
return ret;
}
- rbtn_data = devm_kzalloc(&device->dev, sizeof(*rbtn_data), GFP_KERNEL);
- if (!rbtn_data)
- return -ENOMEM;
-
rbtn_data->type = type;
device->driver_data = rbtn_data;
@@ -420,10 +420,12 @@ static int rbtn_add(struct acpi_device *
break;
default:
ret = -EINVAL;
+ break;
}
+ if (ret)
+ rbtn_acquire(device, false);
return ret;
-
}
static int rbtn_remove(struct acpi_device *device)
@@ -442,7 +444,6 @@ static int rbtn_remove(struct acpi_devic
}
rbtn_acquire(device, false);
- device->driver_data = NULL;
return 0;
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 313/591] perf tool x86: Consolidate is_amd check into single function
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 312/591] platform/x86/dell/dell-rbtn: Fix resources leaking on error path Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 314/591] perf tool x86: Fix perf_env memory leak Greg Kroah-Hartman
` (281 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ravi Bangoria, Ian Rogers,
Adrian Hunter, Ali Saidi, Ananth Narayan, James Clark, Jiri Olsa,
Kan Liang, Leo Yan, Madhavan Srinivasan, Mark Rutland,
Namhyung Kim, Peter Zijlstra, Sandipan Das, Santosh Shukla,
Arnaldo Carvalho de Melo, Sasha Levin
From: Ravi Bangoria <ravi.bangoria@amd.com>
[ Upstream commit 0cd1ca4650c9cf5f318110f67d39cbebae3693b3 ]
There are multiple places where x86 specific code determines AMD vs
Intel arch and acts based on that. Consolidate those checks into a
single function.
Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
Acked-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ali Saidi <alisaidi@amazon.com>
Cc: Ananth Narayan <ananth.narayan@amd.com>
Cc: James Clark <james.clark@arm.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sandipan Das <sandipan.das@amd.com>
Cc: Santosh Shukla <santosh.shukla@amd.com>
Link: https://lore.kernel.org/r/20230613095506.547-3-ravi.bangoria@amd.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 99d4850062a8 ("perf tool x86: Fix perf_env memory leak")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/arch/x86/util/Build | 1 +
tools/perf/arch/x86/util/env.c | 19 +++++++++++++++++++
tools/perf/arch/x86/util/env.h | 7 +++++++
tools/perf/arch/x86/util/evsel.c | 16 ++--------------
tools/perf/arch/x86/util/mem-events.c | 19 ++-----------------
5 files changed, 31 insertions(+), 31 deletions(-)
create mode 100644 tools/perf/arch/x86/util/env.c
create mode 100644 tools/perf/arch/x86/util/env.h
diff --git a/tools/perf/arch/x86/util/Build b/tools/perf/arch/x86/util/Build
index dbeb04cb336e0..93c3ee5f95430 100644
--- a/tools/perf/arch/x86/util/Build
+++ b/tools/perf/arch/x86/util/Build
@@ -10,6 +10,7 @@ perf-y += evlist.o
perf-y += mem-events.o
perf-y += evsel.o
perf-y += iostat.o
+perf-y += env.o
perf-$(CONFIG_DWARF) += dwarf-regs.o
perf-$(CONFIG_BPF_PROLOGUE) += dwarf-regs.o
diff --git a/tools/perf/arch/x86/util/env.c b/tools/perf/arch/x86/util/env.c
new file mode 100644
index 0000000000000..33b87f8ac1cc1
--- /dev/null
+++ b/tools/perf/arch/x86/util/env.c
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "linux/string.h"
+#include "util/env.h"
+#include "env.h"
+
+bool x86__is_amd_cpu(void)
+{
+ struct perf_env env = { .total_mem = 0, };
+ static int is_amd; /* 0: Uninitialized, 1: Yes, -1: No */
+
+ if (is_amd)
+ goto ret;
+
+ perf_env__cpuid(&env);
+ is_amd = env.cpuid && strstarts(env.cpuid, "AuthenticAMD") ? 1 : -1;
+
+ret:
+ return is_amd >= 1 ? true : false;
+}
diff --git a/tools/perf/arch/x86/util/env.h b/tools/perf/arch/x86/util/env.h
new file mode 100644
index 0000000000000..d78f080b6b3f8
--- /dev/null
+++ b/tools/perf/arch/x86/util/env.h
@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _X86_ENV_H
+#define _X86_ENV_H
+
+bool x86__is_amd_cpu(void);
+
+#endif /* _X86_ENV_H */
diff --git a/tools/perf/arch/x86/util/evsel.c b/tools/perf/arch/x86/util/evsel.c
index ea3972d785d10..d72390cdf391d 100644
--- a/tools/perf/arch/x86/util/evsel.c
+++ b/tools/perf/arch/x86/util/evsel.c
@@ -7,6 +7,7 @@
#include "linux/string.h"
#include "evsel.h"
#include "util/debug.h"
+#include "env.h"
#define IBS_FETCH_L3MISSONLY (1ULL << 59)
#define IBS_OP_L3MISSONLY (1ULL << 16)
@@ -97,23 +98,10 @@ void arch__post_evsel_config(struct evsel *evsel, struct perf_event_attr *attr)
{
struct perf_pmu *evsel_pmu, *ibs_fetch_pmu, *ibs_op_pmu;
static int warned_once;
- /* 0: Uninitialized, 1: Yes, -1: No */
- static int is_amd;
- if (warned_once || is_amd == -1)
+ if (warned_once || !x86__is_amd_cpu())
return;
- if (!is_amd) {
- struct perf_env *env = evsel__env(evsel);
-
- if (!perf_env__cpuid(env) || !env->cpuid ||
- !strstarts(env->cpuid, "AuthenticAMD")) {
- is_amd = -1;
- return;
- }
- is_amd = 1;
- }
-
evsel_pmu = evsel__find_pmu(evsel);
if (!evsel_pmu)
return;
diff --git a/tools/perf/arch/x86/util/mem-events.c b/tools/perf/arch/x86/util/mem-events.c
index f683ac702247c..efc0fae9ed0a7 100644
--- a/tools/perf/arch/x86/util/mem-events.c
+++ b/tools/perf/arch/x86/util/mem-events.c
@@ -4,6 +4,7 @@
#include "map_symbol.h"
#include "mem-events.h"
#include "linux/string.h"
+#include "env.h"
static char mem_loads_name[100];
static bool mem_loads_name__init;
@@ -26,28 +27,12 @@ static struct perf_mem_event perf_mem_events_amd[PERF_MEM_EVENTS__MAX] = {
E("mem-ldst", "ibs_op//", "ibs_op"),
};
-static int perf_mem_is_amd_cpu(void)
-{
- struct perf_env env = { .total_mem = 0, };
-
- perf_env__cpuid(&env);
- if (env.cpuid && strstarts(env.cpuid, "AuthenticAMD"))
- return 1;
- return -1;
-}
-
struct perf_mem_event *perf_mem_events__ptr(int i)
{
- /* 0: Uninitialized, 1: Yes, -1: No */
- static int is_amd;
-
if (i >= PERF_MEM_EVENTS__MAX)
return NULL;
- if (!is_amd)
- is_amd = perf_mem_is_amd_cpu();
-
- if (is_amd == 1)
+ if (x86__is_amd_cpu())
return &perf_mem_events_amd[i];
return &perf_mem_events_intel[i];
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 314/591] perf tool x86: Fix perf_env memory leak
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 313/591] perf tool x86: Consolidate is_amd check into single function Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 315/591] powerpc/64s: Fix VAS mm use after free Greg Kroah-Hartman
` (280 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Ravi Bangoria,
Arnaldo Carvalho de Melo, Adrian Hunter, Alexander Shishkin,
Ingo Molnar, Jiri Olsa, Mark Rutland, Namhyung Kim,
Peter Zijlstra, Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit 99d4850062a84564f36923764bb93935ef2ed108 ]
Found by leak sanitizer:
```
==1632594==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 21 byte(s) in 1 object(s) allocated from:
#0 0x7f2953a7077b in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:439
#1 0x556701d6fbbf in perf_env__read_cpuid util/env.c:369
#2 0x556701d70589 in perf_env__cpuid util/env.c:465
#3 0x55670204bba2 in x86__is_amd_cpu arch/x86/util/env.c:14
#4 0x5567020487a2 in arch__post_evsel_config arch/x86/util/evsel.c:83
#5 0x556701d8f78b in evsel__config util/evsel.c:1366
#6 0x556701ef5872 in evlist__config util/record.c:108
#7 0x556701cd6bcd in test__PERF_RECORD tests/perf-record.c:112
#8 0x556701cacd07 in run_test tests/builtin-test.c:236
#9 0x556701cacfac in test_and_print tests/builtin-test.c:265
#10 0x556701cadddb in __cmd_test tests/builtin-test.c:402
#11 0x556701caf2aa in cmd_test tests/builtin-test.c:559
#12 0x556701d3b557 in run_builtin tools/perf/perf.c:323
#13 0x556701d3bac8 in handle_internal_command tools/perf/perf.c:377
#14 0x556701d3be90 in run_argv tools/perf/perf.c:421
#15 0x556701d3c3f8 in main tools/perf/perf.c:537
#16 0x7f2952a46189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
SUMMARY: AddressSanitizer: 21 byte(s) leaked in 1 allocation(s).
```
Fixes: f7b58cbdb3ff36eb ("perf mem/c2c: Add load store event mappings for AMD")
Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Ravi Bangoria <ravi.bangoria@amd.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ravi Bangoria <ravi.bangoria@amd.com>
Link: https://lore.kernel.org/r/20230613235416.1650755-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/arch/x86/util/env.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/arch/x86/util/env.c b/tools/perf/arch/x86/util/env.c
index 33b87f8ac1cc1..3e537ffb1353a 100644
--- a/tools/perf/arch/x86/util/env.c
+++ b/tools/perf/arch/x86/util/env.c
@@ -13,7 +13,7 @@ bool x86__is_amd_cpu(void)
perf_env__cpuid(&env);
is_amd = env.cpuid && strstarts(env.cpuid, "AuthenticAMD") ? 1 : -1;
-
+ perf_env__exit(&env);
ret:
return is_amd >= 1 ? true : false;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 315/591] powerpc/64s: Fix VAS mm use after free
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 314/591] perf tool x86: Fix perf_env memory leak Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 316/591] pinctrl: microchip-sgpio: check return value of devm_kasprintf() Greg Kroah-Hartman
` (279 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sachin Sant, Nicholas Piggin,
Michael Ellerman, Sasha Levin
From: Nicholas Piggin <npiggin@gmail.com>
[ Upstream commit b4bda59b47879cce38a6ec5a01cd3cac702b5331 ]
The refcount on mm is dropped before the coprocessor is detached.
Reported-by: Sachin Sant <sachinp@linux.ibm.com>
Fixes: 7bc6f71bdff5f ("powerpc/vas: Define and use common vas_window struct")
Fixes: b22f2d88e435c ("powerpc/pseries/vas: Integrate API with open/close windows")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Tested-by: Sachin Sant <sachinp@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230607101024.14559-1-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/powernv/vas-window.c | 2 +-
arch/powerpc/platforms/pseries/vas.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/platforms/powernv/vas-window.c b/arch/powerpc/platforms/powernv/vas-window.c
index 0072682531d80..b664838008c12 100644
--- a/arch/powerpc/platforms/powernv/vas-window.c
+++ b/arch/powerpc/platforms/powernv/vas-window.c
@@ -1310,8 +1310,8 @@ int vas_win_close(struct vas_window *vwin)
/* if send window, drop reference to matching receive window */
if (window->tx_win) {
if (window->user_win) {
- put_vas_user_win_ref(&vwin->task_ref);
mm_context_remove_vas_window(vwin->task_ref.mm);
+ put_vas_user_win_ref(&vwin->task_ref);
}
put_rx_win(window->rxwin);
}
diff --git a/arch/powerpc/platforms/pseries/vas.c b/arch/powerpc/platforms/pseries/vas.c
index 94c023bb13e05..880b962afc057 100644
--- a/arch/powerpc/platforms/pseries/vas.c
+++ b/arch/powerpc/platforms/pseries/vas.c
@@ -507,8 +507,8 @@ static int vas_deallocate_window(struct vas_window *vwin)
vascaps[win->win_type].nr_open_windows--;
mutex_unlock(&vas_pseries_mutex);
- put_vas_user_win_ref(&vwin->task_ref);
mm_context_remove_vas_window(vwin->task_ref.mm);
+ put_vas_user_win_ref(&vwin->task_ref);
kfree(win);
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 316/591] pinctrl: microchip-sgpio: check return value of devm_kasprintf()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 315/591] powerpc/64s: Fix VAS mm use after free Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 317/591] pinctrl: at91-pio4: " Greg Kroah-Hartman
` (278 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Andy Shevchenko,
Linus Walleij, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 310cd4c206cd04696ccbfd1927b5ab6973e8cc8e ]
devm_kasprintf() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: 7e5ea974e61c ("pinctrl: pinctrl-microchip-sgpio: Add pinctrl driver for Microsemi Serial GPIO")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20230615105333.585304-3-claudiu.beznea@microchip.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-microchip-sgpio.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/pinctrl/pinctrl-microchip-sgpio.c b/drivers/pinctrl/pinctrl-microchip-sgpio.c
index af27b72c89586..96a20ce94f5e9 100644
--- a/drivers/pinctrl/pinctrl-microchip-sgpio.c
+++ b/drivers/pinctrl/pinctrl-microchip-sgpio.c
@@ -816,6 +816,9 @@ static int microchip_sgpio_register_bank(struct device *dev,
pctl_desc->name = devm_kasprintf(dev, GFP_KERNEL, "%s-%sput",
dev_name(dev),
bank->is_input ? "in" : "out");
+ if (!pctl_desc->name)
+ return -ENOMEM;
+
pctl_desc->pctlops = &sgpio_pctl_ops;
pctl_desc->pmxops = &sgpio_pmx_ops;
pctl_desc->confops = &sgpio_confops;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 317/591] pinctrl: at91-pio4: check return value of devm_kasprintf()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 316/591] pinctrl: microchip-sgpio: check return value of devm_kasprintf() Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 318/591] powerpc/powernv/sriov: perform null check on iov before dereferencing iov Greg Kroah-Hartman
` (277 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Andy Shevchenko,
Linus Walleij, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit f6fd5d4ff8ca0b24cee1af4130bcb1fa96b61aa0 ]
devm_kasprintf() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller")
Depends-on: 1c4e5c470a56 ("pinctrl: at91: use devm_kasprintf() to avoid potential leaks")
Depends-on: 5a8f9cf269e8 ("pinctrl: at91-pio4: use proper format specifier for unsigned int")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20230615105333.585304-4-claudiu.beznea@microchip.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-at91-pio4.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
index 0b7cc6f063e00..f71c6457e3509 100644
--- a/drivers/pinctrl/pinctrl-at91-pio4.c
+++ b/drivers/pinctrl/pinctrl-at91-pio4.c
@@ -1122,6 +1122,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
/* Pin naming convention: P(bank_name)(bank_pin_number). */
pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d",
bank + 'A', line);
+ if (!pin_desc[i].name)
+ return -ENOMEM;
group->name = group_names[i] = pin_desc[i].name;
group->pin = pin_desc[i].number;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 318/591] powerpc/powernv/sriov: perform null check on iov before dereferencing iov
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 317/591] pinctrl: at91-pio4: " Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 319/591] powerpc: simplify ppc_save_regs Greg Kroah-Hartman
` (276 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Colin Ian King, Michael Ellerman,
Sasha Levin
From: Colin Ian King <colin.i.king@gmail.com>
[ Upstream commit f4f913c980bc6abe0ccfe88fe3909c125afe4a2d ]
Currently pointer iov is being dereferenced before the null check of iov
which can lead to null pointer dereference errors. Fix this by moving the
iov null check before the dereferencing.
Detected using cppcheck static analysis:
linux/arch/powerpc/platforms/powernv/pci-sriov.c:597:12: warning: Either
the condition '!iov' is redundant or there is possible null pointer
dereference: iov. [nullPointerRedundantCheck]
num_vfs = iov->num_vfs;
^
Fixes: 052da31d45fc ("powerpc/powernv/sriov: De-indent setup and teardown")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230608095849.1147969-1-colin.i.king@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/powernv/pci-sriov.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/platforms/powernv/pci-sriov.c b/arch/powerpc/platforms/powernv/pci-sriov.c
index 7195133b26bb9..59882da3e7425 100644
--- a/arch/powerpc/platforms/powernv/pci-sriov.c
+++ b/arch/powerpc/platforms/powernv/pci-sriov.c
@@ -594,12 +594,12 @@ static void pnv_pci_sriov_disable(struct pci_dev *pdev)
struct pnv_iov_data *iov;
iov = pnv_iov_get(pdev);
- num_vfs = iov->num_vfs;
- base_pe = iov->vf_pe_arr[0].pe_number;
-
if (WARN_ON(!iov))
return;
+ num_vfs = iov->num_vfs;
+ base_pe = iov->vf_pe_arr[0].pe_number;
+
/* Release VF PEs */
pnv_ioda_release_vf_PE(pdev);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 319/591] powerpc: simplify ppc_save_regs
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 318/591] powerpc/powernv/sriov: perform null check on iov before dereferencing iov Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 320/591] powerpc: update ppc_save_regs to save current r1 in pt_regs Greg Kroah-Hartman
` (275 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicholas Piggin, Michael Ellerman,
Sasha Levin
From: Nicholas Piggin <npiggin@gmail.com>
[ Upstream commit 37195b820d32c23bdefce3f460ed7de48a57e5e4 ]
Adjust the pt_regs pointer so the interrupt frame offsets can be used
to save registers.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20221127124942.1665522-7-npiggin@gmail.com
Stable-dep-of: b684c09f09e7 ("powerpc: update ppc_save_regs to save current r1 in pt_regs")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/ppc_save_regs.S | 57 ++++++++---------------------
1 file changed, 15 insertions(+), 42 deletions(-)
diff --git a/arch/powerpc/kernel/ppc_save_regs.S b/arch/powerpc/kernel/ppc_save_regs.S
index 2d4d21bb46a97..6e86f3bf46735 100644
--- a/arch/powerpc/kernel/ppc_save_regs.S
+++ b/arch/powerpc/kernel/ppc_save_regs.S
@@ -21,60 +21,33 @@
* different ABIs, though).
*/
_GLOBAL(ppc_save_regs)
- PPC_STL r0,0*SZL(r3)
+ /* This allows stack frame accessor macros and offsets to be used */
+ subi r3,r3,STACK_FRAME_OVERHEAD
+ PPC_STL r0,GPR0(r3)
#ifdef CONFIG_PPC32
- stmw r2, 2*SZL(r3)
+ stmw r2,GPR2(r3)
#else
- PPC_STL r2,2*SZL(r3)
- PPC_STL r3,3*SZL(r3)
- PPC_STL r4,4*SZL(r3)
- PPC_STL r5,5*SZL(r3)
- PPC_STL r6,6*SZL(r3)
- PPC_STL r7,7*SZL(r3)
- PPC_STL r8,8*SZL(r3)
- PPC_STL r9,9*SZL(r3)
- PPC_STL r10,10*SZL(r3)
- PPC_STL r11,11*SZL(r3)
- PPC_STL r12,12*SZL(r3)
- PPC_STL r13,13*SZL(r3)
- PPC_STL r14,14*SZL(r3)
- PPC_STL r15,15*SZL(r3)
- PPC_STL r16,16*SZL(r3)
- PPC_STL r17,17*SZL(r3)
- PPC_STL r18,18*SZL(r3)
- PPC_STL r19,19*SZL(r3)
- PPC_STL r20,20*SZL(r3)
- PPC_STL r21,21*SZL(r3)
- PPC_STL r22,22*SZL(r3)
- PPC_STL r23,23*SZL(r3)
- PPC_STL r24,24*SZL(r3)
- PPC_STL r25,25*SZL(r3)
- PPC_STL r26,26*SZL(r3)
- PPC_STL r27,27*SZL(r3)
- PPC_STL r28,28*SZL(r3)
- PPC_STL r29,29*SZL(r3)
- PPC_STL r30,30*SZL(r3)
- PPC_STL r31,31*SZL(r3)
+ SAVE_GPRS(2, 31, r3)
lbz r0,PACAIRQSOFTMASK(r13)
- PPC_STL r0,SOFTE-STACK_FRAME_OVERHEAD(r3)
+ PPC_STL r0,SOFTE(r3)
#endif
/* go up one stack frame for SP */
PPC_LL r4,0(r1)
- PPC_STL r4,1*SZL(r3)
+ PPC_STL r4,GPR1(r3)
/* get caller's LR */
PPC_LL r0,LRSAVE(r4)
- PPC_STL r0,_LINK-STACK_FRAME_OVERHEAD(r3)
+ PPC_STL r0,_LINK(r3)
mflr r0
- PPC_STL r0,_NIP-STACK_FRAME_OVERHEAD(r3)
+ PPC_STL r0,_NIP(r3)
mfmsr r0
- PPC_STL r0,_MSR-STACK_FRAME_OVERHEAD(r3)
+ PPC_STL r0,_MSR(r3)
mfctr r0
- PPC_STL r0,_CTR-STACK_FRAME_OVERHEAD(r3)
+ PPC_STL r0,_CTR(r3)
mfxer r0
- PPC_STL r0,_XER-STACK_FRAME_OVERHEAD(r3)
+ PPC_STL r0,_XER(r3)
mfcr r0
- PPC_STL r0,_CCR-STACK_FRAME_OVERHEAD(r3)
+ PPC_STL r0,_CCR(r3)
li r0,0
- PPC_STL r0,_TRAP-STACK_FRAME_OVERHEAD(r3)
- PPC_STL r0,ORIG_GPR3-STACK_FRAME_OVERHEAD(r3)
+ PPC_STL r0,_TRAP(r3)
+ PPC_STL r0,ORIG_GPR3(r3)
blr
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 320/591] powerpc: update ppc_save_regs to save current r1 in pt_regs
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 319/591] powerpc: simplify ppc_save_regs Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 321/591] PCI: qcom: Remove PCIE20_ prefix from register definitions Greg Kroah-Hartman
` (274 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aditya Gupta, Michael Ellerman,
Sasha Levin, Nicholas Piggin
From: Aditya Gupta <adityag@linux.ibm.com>
[ Upstream commit b684c09f09e7a6af3794d4233ef785819e72db79 ]
ppc_save_regs() skips one stack frame while saving the CPU register states.
Instead of saving current R1, it pulls the previous stack frame pointer.
When vmcores caused by direct panic call (such as `echo c >
/proc/sysrq-trigger`), are debugged with gdb, gdb fails to show the
backtrace correctly. On further analysis, it was found that it was because
of mismatch between r1 and NIP.
GDB uses NIP to get current function symbol and uses corresponding debug
info of that function to unwind previous frames, but due to the
mismatching r1 and NIP, the unwinding does not work, and it fails to
unwind to the 2nd frame and hence does not show the backtrace.
GDB backtrace with vmcore of kernel without this patch:
---------
(gdb) bt
#0 0xc0000000002a53e8 in crash_setup_regs (oldregs=<optimized out>,
newregs=0xc000000004f8f8d8) at ./arch/powerpc/include/asm/kexec.h:69
#1 __crash_kexec (regs=<optimized out>) at kernel/kexec_core.c:974
#2 0x0000000000000063 in ?? ()
#3 0xc000000003579320 in ?? ()
---------
Further analysis revealed that the mismatch occurred because
"ppc_save_regs" was saving the previous stack's SP instead of the current
r1. This patch fixes this by storing current r1 in the saved pt_regs.
GDB backtrace with vmcore of patched kernel:
--------
(gdb) bt
#0 0xc0000000002a53e8 in crash_setup_regs (oldregs=0x0, newregs=0xc00000000670b8d8)
at ./arch/powerpc/include/asm/kexec.h:69
#1 __crash_kexec (regs=regs@entry=0x0) at kernel/kexec_core.c:974
#2 0xc000000000168918 in panic (fmt=fmt@entry=0xc000000001654a60 "sysrq triggered crash\n")
at kernel/panic.c:358
#3 0xc000000000b735f8 in sysrq_handle_crash (key=<optimized out>) at drivers/tty/sysrq.c:155
#4 0xc000000000b742cc in __handle_sysrq (key=key@entry=99, check_mask=check_mask@entry=false)
at drivers/tty/sysrq.c:602
#5 0xc000000000b7506c in write_sysrq_trigger (file=<optimized out>, buf=<optimized out>,
count=2, ppos=<optimized out>) at drivers/tty/sysrq.c:1163
#6 0xc00000000069a7bc in pde_write (ppos=<optimized out>, count=<optimized out>,
buf=<optimized out>, file=<optimized out>, pde=0xc00000000362cb40) at fs/proc/inode.c:340
#7 proc_reg_write (file=<optimized out>, buf=<optimized out>, count=<optimized out>,
ppos=<optimized out>) at fs/proc/inode.c:352
#8 0xc0000000005b3bbc in vfs_write (file=file@entry=0xc000000006aa6b00,
buf=buf@entry=0x61f498b4f60 <error: Cannot access memory at address 0x61f498b4f60>,
count=count@entry=2, pos=pos@entry=0xc00000000670bda0) at fs/read_write.c:582
#9 0xc0000000005b4264 in ksys_write (fd=<optimized out>,
buf=0x61f498b4f60 <error: Cannot access memory at address 0x61f498b4f60>, count=2)
at fs/read_write.c:637
#10 0xc00000000002ea2c in system_call_exception (regs=0xc00000000670be80, r0=<optimized out>)
at arch/powerpc/kernel/syscall.c:171
#11 0xc00000000000c270 in system_call_vectored_common ()
at arch/powerpc/kernel/interrupt_64.S:192
--------
Nick adds:
So this now saves regs as though it was an interrupt taken in the
caller, at the instruction after the call to ppc_save_regs, whereas
previously the NIP was there, but R1 came from the caller's caller and
that mismatch is what causes gdb's dwarf unwinder to go haywire.
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Fixes: d16a58f8854b1 ("powerpc: Improve ppc_save_regs()")
Reivewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230615091047.90433-1-adityag@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/ppc_save_regs.S | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/kernel/ppc_save_regs.S b/arch/powerpc/kernel/ppc_save_regs.S
index 6e86f3bf46735..235ae24284519 100644
--- a/arch/powerpc/kernel/ppc_save_regs.S
+++ b/arch/powerpc/kernel/ppc_save_regs.S
@@ -31,10 +31,10 @@ _GLOBAL(ppc_save_regs)
lbz r0,PACAIRQSOFTMASK(r13)
PPC_STL r0,SOFTE(r3)
#endif
- /* go up one stack frame for SP */
- PPC_LL r4,0(r1)
- PPC_STL r4,GPR1(r3)
+ /* store current SP */
+ PPC_STL r1,GPR1(r3)
/* get caller's LR */
+ PPC_LL r4,0(r1)
PPC_LL r0,LRSAVE(r4)
PPC_STL r0,_LINK(r3)
mflr r0
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 321/591] PCI: qcom: Remove PCIE20_ prefix from register definitions
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 320/591] powerpc: update ppc_save_regs to save current r1 in pt_regs Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 322/591] PCI: qcom: Sort and group registers and bitfield definitions Greg Kroah-Hartman
` (273 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Lorenzo Pieralisi, Sasha Levin
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
[ Upstream commit 39171b33f6523f28c1c1256427e5f50c74b69639 ]
The PCIE part is redundant and 20 doesn't represent anything across the
SoCs supported now. So let's get rid of the prefix.
This involves adding the IP version suffix to one definition of
PARF_SLV_ADDR_SPACE_SIZE that defines offset specific to that version.
The other definition is generic for the rest of the versions.
Also, the register PCIE20_LNK_CONTROL2_LINK_STATUS2 is not used anywhere,
hence removed.
Link: https://lore.kernel.org/r/20230316081117.14288-3-manivannan.sadhasivam@linaro.org
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Stable-dep-of: 60f0072d7fb7 ("PCI: qcom: Use DWC helpers for modifying the read-only DBI registers")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom.c | 184 ++++++++++++-------------
1 file changed, 91 insertions(+), 93 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index dbe6df0cb6118..b587957211c3f 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -31,7 +31,7 @@
#include "../../pci.h"
#include "pcie-designware.h"
-#define PCIE20_PARF_SYS_CTRL 0x00
+#define PARF_SYS_CTRL 0x00
#define MST_WAKEUP_EN BIT(13)
#define SLV_WAKEUP_EN BIT(12)
#define MSTR_ACLK_CGC_DIS BIT(10)
@@ -41,39 +41,39 @@
#define L23_CLK_RMV_DIS BIT(2)
#define L1_CLK_RMV_DIS BIT(1)
-#define PCIE20_PARF_PM_CTRL 0x20
+#define PARF_PM_CTRL 0x20
#define REQ_NOT_ENTR_L1 BIT(5)
-#define PCIE20_PARF_PHY_CTRL 0x40
+#define PARF_PHY_CTRL 0x40
#define PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK GENMASK(20, 16)
#define PHY_CTRL_PHY_TX0_TERM_OFFSET(x) ((x) << 16)
-#define PCIE20_PARF_PHY_REFCLK 0x4C
+#define PARF_PHY_REFCLK 0x4C
#define PHY_REFCLK_SSP_EN BIT(16)
#define PHY_REFCLK_USE_PAD BIT(12)
-#define PCIE20_PARF_DBI_BASE_ADDR 0x168
-#define PCIE20_PARF_SLV_ADDR_SPACE_SIZE 0x16C
-#define PCIE20_PARF_MHI_CLOCK_RESET_CTRL 0x174
+#define PARF_DBI_BASE_ADDR 0x168
+#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP rev 2.3.3 */
+#define PARF_MHI_CLOCK_RESET_CTRL 0x174
#define AHB_CLK_EN BIT(0)
#define MSTR_AXI_CLK_EN BIT(1)
#define BYPASS BIT(4)
-#define PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT 0x178
-#define PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8
-#define PCIE20_PARF_LTSSM 0x1B0
-#define PCIE20_PARF_SID_OFFSET 0x234
-#define PCIE20_PARF_BDF_TRANSLATE_CFG 0x24C
-#define PCIE20_PARF_DEVICE_TYPE 0x1000
-#define PCIE20_PARF_BDF_TO_SID_TABLE_N 0x2000
+#define PARF_AXI_MSTR_WR_ADDR_HALT 0x178
+#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8
+#define PARF_LTSSM 0x1B0
+#define PARF_SID_OFFSET 0x234
+#define PARF_BDF_TRANSLATE_CFG 0x24C
+#define PARF_DEVICE_TYPE 0x1000
+#define PARF_BDF_TO_SID_TABLE_N 0x2000
-#define PCIE20_ELBI_SYS_CTRL 0x04
-#define PCIE20_ELBI_SYS_CTRL_LT_ENABLE BIT(0)
+#define ELBI_SYS_CTRL 0x04
+#define ELBI_SYS_CTRL_LT_ENABLE BIT(0)
-#define PCIE20_AXI_MSTR_RESP_COMP_CTRL0 0x818
+#define AXI_MSTR_RESP_COMP_CTRL0 0x818
#define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_2K 0x4
#define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_4K 0x5
-#define PCIE20_AXI_MSTR_RESP_COMP_CTRL1 0x81c
+#define AXI_MSTR_RESP_COMP_CTRL1 0x81c
#define CFG_BRIDGE_SB_INIT BIT(0)
#define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, \
@@ -91,30 +91,28 @@
PCIE_CAP_SLOT_POWER_LIMIT_VAL | \
PCIE_CAP_SLOT_POWER_LIMIT_SCALE)
-#define PCIE20_PARF_Q2A_FLUSH 0x1AC
+#define PARF_Q2A_FLUSH 0x1AC
-#define PCIE20_MISC_CONTROL_1_REG 0x8BC
+#define MISC_CONTROL_1_REG 0x8BC
#define DBI_RO_WR_EN 1
#define PERST_DELAY_US 1000
/* PARF registers */
-#define PCIE20_PARF_PCS_DEEMPH 0x34
+#define PARF_PCS_DEEMPH 0x34
#define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16)
#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8)
#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0)
-#define PCIE20_PARF_PCS_SWING 0x38
+#define PARF_PCS_SWING 0x38
#define PCS_SWING_TX_SWING_FULL(x) ((x) << 8)
#define PCS_SWING_TX_SWING_LOW(x) ((x) << 0)
-#define PCIE20_PARF_CONFIG_BITS 0x50
+#define PARF_CONFIG_BITS 0x50
#define PHY_RX0_EQ(x) ((x) << 24)
-#define PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE 0x358
+#define PARF_SLV_ADDR_SPACE_SIZE 0x358
#define SLV_ADDR_SPACE_SZ 0x10000000
-#define PCIE20_LNK_CONTROL2_LINK_STATUS2 0xa0
-
#define DEVICE_TYPE_RC 0x4
#define QCOM_PCIE_2_1_0_MAX_SUPPLY 3
@@ -258,9 +256,9 @@ static void qcom_pcie_2_1_0_ltssm_enable(struct qcom_pcie *pcie)
u32 val;
/* enable link training */
- val = readl(pcie->elbi + PCIE20_ELBI_SYS_CTRL);
- val |= PCIE20_ELBI_SYS_CTRL_LT_ENABLE;
- writel(val, pcie->elbi + PCIE20_ELBI_SYS_CTRL);
+ val = readl(pcie->elbi + ELBI_SYS_CTRL);
+ val |= ELBI_SYS_CTRL_LT_ENABLE;
+ writel(val, pcie->elbi + ELBI_SYS_CTRL);
}
static int qcom_pcie_get_resources_2_1_0(struct qcom_pcie *pcie)
@@ -330,7 +328,7 @@ static void qcom_pcie_deinit_2_1_0(struct qcom_pcie *pcie)
reset_control_assert(res->ext_reset);
reset_control_assert(res->phy_reset);
- writel(1, pcie->parf + PCIE20_PARF_PHY_CTRL);
+ writel(1, pcie->parf + PARF_PHY_CTRL);
regulator_bulk_disable(ARRAY_SIZE(res->supplies), res->supplies);
}
@@ -420,9 +418,9 @@ static int qcom_pcie_post_init_2_1_0(struct qcom_pcie *pcie)
int ret;
/* enable PCIe clocks and resets */
- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
+ val = readl(pcie->parf + PARF_PHY_CTRL);
val &= ~BIT(0);
- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
+ writel(val, pcie->parf + PARF_PHY_CTRL);
ret = clk_bulk_prepare_enable(ARRAY_SIZE(res->clks), res->clks);
if (ret)
@@ -433,37 +431,37 @@ static int qcom_pcie_post_init_2_1_0(struct qcom_pcie *pcie)
writel(PCS_DEEMPH_TX_DEEMPH_GEN1(24) |
PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(24) |
PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(34),
- pcie->parf + PCIE20_PARF_PCS_DEEMPH);
+ pcie->parf + PARF_PCS_DEEMPH);
writel(PCS_SWING_TX_SWING_FULL(120) |
PCS_SWING_TX_SWING_LOW(120),
- pcie->parf + PCIE20_PARF_PCS_SWING);
- writel(PHY_RX0_EQ(4), pcie->parf + PCIE20_PARF_CONFIG_BITS);
+ pcie->parf + PARF_PCS_SWING);
+ writel(PHY_RX0_EQ(4), pcie->parf + PARF_CONFIG_BITS);
}
if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) {
/* set TX termination offset */
- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
+ val = readl(pcie->parf + PARF_PHY_CTRL);
val &= ~PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK;
val |= PHY_CTRL_PHY_TX0_TERM_OFFSET(7);
- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
+ writel(val, pcie->parf + PARF_PHY_CTRL);
}
/* enable external reference clock */
- val = readl(pcie->parf + PCIE20_PARF_PHY_REFCLK);
+ val = readl(pcie->parf + PARF_PHY_REFCLK);
/* USE_PAD is required only for ipq806x */
if (!of_device_is_compatible(node, "qcom,pcie-apq8064"))
val &= ~PHY_REFCLK_USE_PAD;
val |= PHY_REFCLK_SSP_EN;
- writel(val, pcie->parf + PCIE20_PARF_PHY_REFCLK);
+ writel(val, pcie->parf + PARF_PHY_REFCLK);
/* wait for clock acquisition */
usleep_range(1000, 1500);
/* Set the Max TLP size to 2K, instead of using default of 4K */
writel(CFG_REMOTE_RD_REQ_BRIDGE_SIZE_2K,
- pci->dbi_base + PCIE20_AXI_MSTR_RESP_COMP_CTRL0);
+ pci->dbi_base + AXI_MSTR_RESP_COMP_CTRL0);
writel(CFG_BRIDGE_SB_INIT,
- pci->dbi_base + PCIE20_AXI_MSTR_RESP_COMP_CTRL1);
+ pci->dbi_base + AXI_MSTR_RESP_COMP_CTRL1);
return 0;
}
@@ -571,13 +569,13 @@ static int qcom_pcie_init_1_0_0(struct qcom_pcie *pcie)
static int qcom_pcie_post_init_1_0_0(struct qcom_pcie *pcie)
{
/* change DBI base address */
- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
+ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
if (IS_ENABLED(CONFIG_PCI_MSI)) {
- u32 val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT);
+ u32 val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT);
val |= BIT(31);
- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT);
+ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT);
}
return 0;
@@ -588,9 +586,9 @@ static void qcom_pcie_2_3_2_ltssm_enable(struct qcom_pcie *pcie)
u32 val;
/* enable link training */
- val = readl(pcie->parf + PCIE20_PARF_LTSSM);
+ val = readl(pcie->parf + PARF_LTSSM);
val |= BIT(8);
- writel(val, pcie->parf + PCIE20_PARF_LTSSM);
+ writel(val, pcie->parf + PARF_LTSSM);
}
static int qcom_pcie_get_resources_2_3_2(struct qcom_pcie *pcie)
@@ -695,25 +693,25 @@ static int qcom_pcie_post_init_2_3_2(struct qcom_pcie *pcie)
u32 val;
/* enable PCIe clocks and resets */
- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
+ val = readl(pcie->parf + PARF_PHY_CTRL);
val &= ~BIT(0);
- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
+ writel(val, pcie->parf + PARF_PHY_CTRL);
/* change DBI base address */
- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
+ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
/* MAC PHY_POWERDOWN MUX DISABLE */
- val = readl(pcie->parf + PCIE20_PARF_SYS_CTRL);
+ val = readl(pcie->parf + PARF_SYS_CTRL);
val &= ~BIT(29);
- writel(val, pcie->parf + PCIE20_PARF_SYS_CTRL);
+ writel(val, pcie->parf + PARF_SYS_CTRL);
- val = readl(pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
+ val = readl(pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
val |= BIT(4);
- writel(val, pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
+ writel(val, pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
- val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+ val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
val |= BIT(31);
- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
return 0;
}
@@ -974,25 +972,25 @@ static int qcom_pcie_post_init_2_4_0(struct qcom_pcie *pcie)
u32 val;
/* enable PCIe clocks and resets */
- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
+ val = readl(pcie->parf + PARF_PHY_CTRL);
val &= ~BIT(0);
- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
+ writel(val, pcie->parf + PARF_PHY_CTRL);
/* change DBI base address */
- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
+ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
/* MAC PHY_POWERDOWN MUX DISABLE */
- val = readl(pcie->parf + PCIE20_PARF_SYS_CTRL);
+ val = readl(pcie->parf + PARF_SYS_CTRL);
val &= ~BIT(29);
- writel(val, pcie->parf + PCIE20_PARF_SYS_CTRL);
+ writel(val, pcie->parf + PARF_SYS_CTRL);
- val = readl(pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
+ val = readl(pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
val |= BIT(4);
- writel(val, pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
+ writel(val, pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
- val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+ val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
val |= BIT(31);
- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
return 0;
}
@@ -1137,22 +1135,22 @@ static int qcom_pcie_post_init_2_3_3(struct qcom_pcie *pcie)
u32 val;
writel(SLV_ADDR_SPACE_SZ,
- pcie->parf + PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE);
+ pcie->parf + PARF_SLV_ADDR_SPACE_SIZE_2_3_3);
- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
+ val = readl(pcie->parf + PARF_PHY_CTRL);
val &= ~BIT(0);
- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
+ writel(val, pcie->parf + PARF_PHY_CTRL);
- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
+ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
writel(MST_WAKEUP_EN | SLV_WAKEUP_EN | MSTR_ACLK_CGC_DIS
| SLV_ACLK_CGC_DIS | CORE_CLK_CGC_DIS |
AUX_PWR_DET | L23_CLK_RMV_DIS | L1_CLK_RMV_DIS,
- pcie->parf + PCIE20_PARF_SYS_CTRL);
- writel(0, pcie->parf + PCIE20_PARF_Q2A_FLUSH);
+ pcie->parf + PARF_SYS_CTRL);
+ writel(0, pcie->parf + PARF_Q2A_FLUSH);
writel(PCI_COMMAND_MASTER, pci->dbi_base + PCI_COMMAND);
- writel(DBI_RO_WR_EN, pci->dbi_base + PCIE20_MISC_CONTROL_1_REG);
+ writel(DBI_RO_WR_EN, pci->dbi_base + MISC_CONTROL_1_REG);
writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP);
val = readl(pci->dbi_base + offset + PCI_EXP_LNKCAP);
@@ -1252,33 +1250,33 @@ static int qcom_pcie_init_2_7_0(struct qcom_pcie *pcie)
usleep_range(1000, 1500);
/* configure PCIe to RC mode */
- writel(DEVICE_TYPE_RC, pcie->parf + PCIE20_PARF_DEVICE_TYPE);
+ writel(DEVICE_TYPE_RC, pcie->parf + PARF_DEVICE_TYPE);
/* enable PCIe clocks and resets */
- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
+ val = readl(pcie->parf + PARF_PHY_CTRL);
val &= ~BIT(0);
- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
+ writel(val, pcie->parf + PARF_PHY_CTRL);
/* change DBI base address */
- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
+ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
/* MAC PHY_POWERDOWN MUX DISABLE */
- val = readl(pcie->parf + PCIE20_PARF_SYS_CTRL);
+ val = readl(pcie->parf + PARF_SYS_CTRL);
val &= ~BIT(29);
- writel(val, pcie->parf + PCIE20_PARF_SYS_CTRL);
+ writel(val, pcie->parf + PARF_SYS_CTRL);
- val = readl(pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
+ val = readl(pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
val |= BIT(4);
- writel(val, pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
+ writel(val, pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
/* Enable L1 and L1SS */
- val = readl(pcie->parf + PCIE20_PARF_PM_CTRL);
+ val = readl(pcie->parf + PARF_PM_CTRL);
val &= ~REQ_NOT_ENTR_L1;
- writel(val, pcie->parf + PCIE20_PARF_PM_CTRL);
+ writel(val, pcie->parf + PARF_PM_CTRL);
- val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+ val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
val |= BIT(31);
- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
return 0;
err_disable_clocks:
@@ -1366,17 +1364,17 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie)
int i;
writel(SLV_ADDR_SPACE_SZ,
- pcie->parf + PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE);
+ pcie->parf + PARF_SLV_ADDR_SPACE_SIZE);
- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
+ val = readl(pcie->parf + PARF_PHY_CTRL);
val &= ~BIT(0);
- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
+ writel(val, pcie->parf + PARF_PHY_CTRL);
- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR);
+ writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
- writel(DEVICE_TYPE_RC, pcie->parf + PCIE20_PARF_DEVICE_TYPE);
+ writel(DEVICE_TYPE_RC, pcie->parf + PARF_DEVICE_TYPE);
writel(BYPASS | MSTR_AXI_CLK_EN | AHB_CLK_EN,
- pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL);
+ pcie->parf + PARF_MHI_CLOCK_RESET_CTRL);
writel(GEN3_RELATED_OFF_RXEQ_RGRDLESS_RXTS |
GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL,
pci->dbi_base + GEN3_RELATED_OFF);
@@ -1384,9 +1382,9 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie)
writel(MST_WAKEUP_EN | SLV_WAKEUP_EN | MSTR_ACLK_CGC_DIS |
SLV_ACLK_CGC_DIS | CORE_CLK_CGC_DIS |
AUX_PWR_DET | L23_CLK_RMV_DIS | L1_CLK_RMV_DIS,
- pcie->parf + PCIE20_PARF_SYS_CTRL);
+ pcie->parf + PARF_SYS_CTRL);
- writel(0, pcie->parf + PCIE20_PARF_Q2A_FLUSH);
+ writel(0, pcie->parf + PARF_Q2A_FLUSH);
dw_pcie_dbi_ro_wr_en(pci);
writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP);
@@ -1399,7 +1397,7 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie)
PCI_EXP_DEVCTL2);
for (i = 0; i < 256; i++)
- writel(0, pcie->parf + PCIE20_PARF_BDF_TO_SID_TABLE_N + (4 * i));
+ writel(0, pcie->parf + PARF_BDF_TO_SID_TABLE_N + (4 * i));
return 0;
}
@@ -1421,7 +1419,7 @@ static int qcom_pcie_config_sid_sm8250(struct qcom_pcie *pcie)
u32 smmu_sid;
u32 smmu_sid_len;
} *map;
- void __iomem *bdf_to_sid_base = pcie->parf + PCIE20_PARF_BDF_TO_SID_TABLE_N;
+ void __iomem *bdf_to_sid_base = pcie->parf + PARF_BDF_TO_SID_TABLE_N;
struct device *dev = pcie->pci->dev;
u8 qcom_pcie_crc8_table[CRC8_TABLE_SIZE];
int i, nr_map, size = 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 322/591] PCI: qcom: Sort and group registers and bitfield definitions
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 321/591] PCI: qcom: Remove PCIE20_ prefix from register definitions Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 323/591] PCI: qcom: Use lower case for hex Greg Kroah-Hartman
` (272 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Lorenzo Pieralisi, Sasha Levin
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
[ Upstream commit 769e49d87b15c302c9aadd87c7d114cfe7052320 ]
Sorting the registers and their bit definitions will make it easier to add
more definitions in the future and it also helps in maintenance.
While at it, let's also group the registers and bit definitions separately
as done in the pcie-qcom-ep driver.
Link: https://lore.kernel.org/r/20230316081117.14288-4-manivannan.sadhasivam@linaro.org
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Stable-dep-of: 60f0072d7fb7 ("PCI: qcom: Use DWC helpers for modifying the read-only DBI registers")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom.c | 108 ++++++++++++++-----------
1 file changed, 63 insertions(+), 45 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index b587957211c3f..1c8200656aef9 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -31,7 +31,36 @@
#include "../../pci.h"
#include "pcie-designware.h"
+/* PARF registers */
#define PARF_SYS_CTRL 0x00
+#define PARF_PM_CTRL 0x20
+#define PARF_PCS_DEEMPH 0x34
+#define PARF_PCS_SWING 0x38
+#define PARF_PHY_CTRL 0x40
+#define PARF_PHY_REFCLK 0x4C
+#define PARF_CONFIG_BITS 0x50
+#define PARF_DBI_BASE_ADDR 0x168
+#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP ver 2.3.3 */
+#define PARF_MHI_CLOCK_RESET_CTRL 0x174
+#define PARF_AXI_MSTR_WR_ADDR_HALT 0x178
+#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8
+#define PARF_Q2A_FLUSH 0x1AC
+#define PARF_LTSSM 0x1B0
+#define PARF_SID_OFFSET 0x234
+#define PARF_BDF_TRANSLATE_CFG 0x24C
+#define PARF_SLV_ADDR_SPACE_SIZE 0x358
+#define PARF_DEVICE_TYPE 0x1000
+#define PARF_BDF_TO_SID_TABLE_N 0x2000
+
+/* ELBI registers */
+#define ELBI_SYS_CTRL 0x04
+
+/* DBI registers */
+#define AXI_MSTR_RESP_COMP_CTRL0 0x818
+#define AXI_MSTR_RESP_COMP_CTRL1 0x81c
+#define MISC_CONTROL_1_REG 0x8BC
+
+/* PARF_SYS_CTRL register fields */
#define MST_WAKEUP_EN BIT(13)
#define SLV_WAKEUP_EN BIT(12)
#define MSTR_ACLK_CGC_DIS BIT(10)
@@ -41,45 +70,56 @@
#define L23_CLK_RMV_DIS BIT(2)
#define L1_CLK_RMV_DIS BIT(1)
-#define PARF_PM_CTRL 0x20
+/* PARF_PM_CTRL register fields */
#define REQ_NOT_ENTR_L1 BIT(5)
-#define PARF_PHY_CTRL 0x40
+/* PARF_PCS_DEEMPH register fields */
+#define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16)
+#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8)
+#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0)
+
+/* PARF_PCS_SWING register fields */
+#define PCS_SWING_TX_SWING_FULL(x) ((x) << 8)
+#define PCS_SWING_TX_SWING_LOW(x) ((x) << 0)
+
+/* PARF_PHY_CTRL register fields */
#define PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK GENMASK(20, 16)
#define PHY_CTRL_PHY_TX0_TERM_OFFSET(x) ((x) << 16)
-#define PARF_PHY_REFCLK 0x4C
+/* PARF_PHY_REFCLK register fields */
#define PHY_REFCLK_SSP_EN BIT(16)
#define PHY_REFCLK_USE_PAD BIT(12)
-#define PARF_DBI_BASE_ADDR 0x168
-#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP rev 2.3.3 */
-#define PARF_MHI_CLOCK_RESET_CTRL 0x174
+/* PARF_CONFIG_BITS register fields */
+#define PHY_RX0_EQ(x) ((x) << 24)
+
+/* PARF_SLV_ADDR_SPACE_SIZE register value */
+#define SLV_ADDR_SPACE_SZ 0x10000000
+
+/* PARF_MHI_CLOCK_RESET_CTRL register fields */
#define AHB_CLK_EN BIT(0)
#define MSTR_AXI_CLK_EN BIT(1)
#define BYPASS BIT(4)
-#define PARF_AXI_MSTR_WR_ADDR_HALT 0x178
-#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8
-#define PARF_LTSSM 0x1B0
-#define PARF_SID_OFFSET 0x234
-#define PARF_BDF_TRANSLATE_CFG 0x24C
-#define PARF_DEVICE_TYPE 0x1000
-#define PARF_BDF_TO_SID_TABLE_N 0x2000
+/* PARF_DEVICE_TYPE register fields */
+#define DEVICE_TYPE_RC 0x4
-#define ELBI_SYS_CTRL 0x04
+/* ELBI_SYS_CTRL register fields */
#define ELBI_SYS_CTRL_LT_ENABLE BIT(0)
-#define AXI_MSTR_RESP_COMP_CTRL0 0x818
+/* AXI_MSTR_RESP_COMP_CTRL0 register fields */
#define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_2K 0x4
#define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_4K 0x5
-#define AXI_MSTR_RESP_COMP_CTRL1 0x81c
+
+/* AXI_MSTR_RESP_COMP_CTRL1 register fields */
#define CFG_BRIDGE_SB_INIT BIT(0)
-#define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, \
- 250)
-#define PCIE_CAP_SLOT_POWER_LIMIT_SCALE FIELD_PREP(PCI_EXP_SLTCAP_SPLS, \
- 1)
+/* MISC_CONTROL_1_REG register fields */
+#define DBI_RO_WR_EN 1
+
+/* PCI_EXP_SLTCAP register fields */
+#define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, 250)
+#define PCIE_CAP_SLOT_POWER_LIMIT_SCALE FIELD_PREP(PCI_EXP_SLTCAP_SPLS, 1)
#define PCIE_CAP_SLOT_VAL (PCI_EXP_SLTCAP_ABP | \
PCI_EXP_SLTCAP_PCP | \
PCI_EXP_SLTCAP_MRLSP | \
@@ -91,34 +131,12 @@
PCIE_CAP_SLOT_POWER_LIMIT_VAL | \
PCIE_CAP_SLOT_POWER_LIMIT_SCALE)
-#define PARF_Q2A_FLUSH 0x1AC
-
-#define MISC_CONTROL_1_REG 0x8BC
-#define DBI_RO_WR_EN 1
-
#define PERST_DELAY_US 1000
-/* PARF registers */
-#define PARF_PCS_DEEMPH 0x34
-#define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16)
-#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8)
-#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0)
-
-#define PARF_PCS_SWING 0x38
-#define PCS_SWING_TX_SWING_FULL(x) ((x) << 8)
-#define PCS_SWING_TX_SWING_LOW(x) ((x) << 0)
-
-#define PARF_CONFIG_BITS 0x50
-#define PHY_RX0_EQ(x) ((x) << 24)
-
-#define PARF_SLV_ADDR_SPACE_SIZE 0x358
-#define SLV_ADDR_SPACE_SZ 0x10000000
-
-#define DEVICE_TYPE_RC 0x4
-#define QCOM_PCIE_2_1_0_MAX_SUPPLY 3
-#define QCOM_PCIE_2_1_0_MAX_CLOCKS 5
+#define QCOM_PCIE_2_1_0_MAX_SUPPLY 3
+#define QCOM_PCIE_2_1_0_MAX_CLOCKS 5
-#define QCOM_PCIE_CRC8_POLYNOMIAL (BIT(2) | BIT(1) | BIT(0))
+#define QCOM_PCIE_CRC8_POLYNOMIAL (BIT(2) | BIT(1) | BIT(0))
struct qcom_pcie_resources_2_1_0 {
struct clk_bulk_data clks[QCOM_PCIE_2_1_0_MAX_CLOCKS];
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 323/591] PCI: qcom: Use lower case for hex
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 322/591] PCI: qcom: Sort and group registers and bitfield definitions Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 324/591] PCI: qcom: Use DWC helpers for modifying the read-only DBI registers Greg Kroah-Hartman
` (271 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Lorenzo Pieralisi, Sasha Levin
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
[ Upstream commit 94ebd232dbc84dfdfbf0c406137a8b2aa8b37a01 ]
To maintain uniformity, let's use lower case for representing hexadecimal
numbers.
Link: https://lore.kernel.org/r/20230316081117.14288-7-manivannan.sadhasivam@linaro.org
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Stable-dep-of: 60f0072d7fb7 ("PCI: qcom: Use DWC helpers for modifying the read-only DBI registers")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index 1c8200656aef9..e65f4bf50f928 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -37,17 +37,17 @@
#define PARF_PCS_DEEMPH 0x34
#define PARF_PCS_SWING 0x38
#define PARF_PHY_CTRL 0x40
-#define PARF_PHY_REFCLK 0x4C
+#define PARF_PHY_REFCLK 0x4c
#define PARF_CONFIG_BITS 0x50
#define PARF_DBI_BASE_ADDR 0x168
-#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP ver 2.3.3 */
+#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16c /* Register offset specific to IP ver 2.3.3 */
#define PARF_MHI_CLOCK_RESET_CTRL 0x174
#define PARF_AXI_MSTR_WR_ADDR_HALT 0x178
-#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8
-#define PARF_Q2A_FLUSH 0x1AC
-#define PARF_LTSSM 0x1B0
+#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1a8
+#define PARF_Q2A_FLUSH 0x1ac
+#define PARF_LTSSM 0x1b0
#define PARF_SID_OFFSET 0x234
-#define PARF_BDF_TRANSLATE_CFG 0x24C
+#define PARF_BDF_TRANSLATE_CFG 0x24c
#define PARF_SLV_ADDR_SPACE_SIZE 0x358
#define PARF_DEVICE_TYPE 0x1000
#define PARF_BDF_TO_SID_TABLE_N 0x2000
@@ -58,7 +58,7 @@
/* DBI registers */
#define AXI_MSTR_RESP_COMP_CTRL0 0x818
#define AXI_MSTR_RESP_COMP_CTRL1 0x81c
-#define MISC_CONTROL_1_REG 0x8BC
+#define MISC_CONTROL_1_REG 0x8bc
/* PARF_SYS_CTRL register fields */
#define MST_WAKEUP_EN BIT(13)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 324/591] PCI: qcom: Use DWC helpers for modifying the read-only DBI registers
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 323/591] PCI: qcom: Use lower case for hex Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 325/591] PCI: qcom: Disable write access to read only registers for IP v2.9.0 Greg Kroah-Hartman
` (270 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Lorenzo Pieralisi, Dmitry Baryshkov, Sasha Levin
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
[ Upstream commit 60f0072d7fb7996b9a524ef0d152e21205473192 ]
DWC core already exposes dw_pcie_dbi_ro_wr_{en/dis} helper APIs for
enabling and disabling the write access to read only DBI registers. So
let's use them instead of doing it manually.
Also, the existing code doesn't disable the write access when it's done.
This is also fixed now.
Link: https://lore.kernel.org/r/20230619150408.8468-3-manivannan.sadhasivam@linaro.org
Fixes: 5d76117f070d ("PCI: qcom: Add support for IPQ8074 PCIe controller")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index e65f4bf50f928..77f4dc244b3f7 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -58,7 +58,6 @@
/* DBI registers */
#define AXI_MSTR_RESP_COMP_CTRL0 0x818
#define AXI_MSTR_RESP_COMP_CTRL1 0x81c
-#define MISC_CONTROL_1_REG 0x8bc
/* PARF_SYS_CTRL register fields */
#define MST_WAKEUP_EN BIT(13)
@@ -114,9 +113,6 @@
/* AXI_MSTR_RESP_COMP_CTRL1 register fields */
#define CFG_BRIDGE_SB_INIT BIT(0)
-/* MISC_CONTROL_1_REG register fields */
-#define DBI_RO_WR_EN 1
-
/* PCI_EXP_SLTCAP register fields */
#define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, 250)
#define PCIE_CAP_SLOT_POWER_LIMIT_SCALE FIELD_PREP(PCI_EXP_SLTCAP_SPLS, 1)
@@ -1168,7 +1164,9 @@ static int qcom_pcie_post_init_2_3_3(struct qcom_pcie *pcie)
writel(0, pcie->parf + PARF_Q2A_FLUSH);
writel(PCI_COMMAND_MASTER, pci->dbi_base + PCI_COMMAND);
- writel(DBI_RO_WR_EN, pci->dbi_base + MISC_CONTROL_1_REG);
+
+ dw_pcie_dbi_ro_wr_en(pci);
+
writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP);
val = readl(pci->dbi_base + offset + PCI_EXP_LNKCAP);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 325/591] PCI: qcom: Disable write access to read only registers for IP v2.9.0
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 324/591] PCI: qcom: Use DWC helpers for modifying the read-only DBI registers Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 326/591] riscv: uprobes: Restore thread.bad_cause Greg Kroah-Hartman
` (269 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Lorenzo Pieralisi, Dmitry Baryshkov, Sasha Levin
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
[ Upstream commit 200b8f85f2021362adcc8efb575652a2aa44c099 ]
In the post init sequence of v2.9.0, write access to read only registers
are not disabled after updating the registers. Fix it by disabling the
access after register update.
While at it, let's also add a newline after existing dw_pcie_dbi_ro_wr_en()
guard function to align with rest of the driver.
Link: https://lore.kernel.org/r/20230619150408.8468-4-manivannan.sadhasivam@linaro.org
Fixes: 0cf7c2efe8ac ("PCI: qcom: Add IPQ60xx support")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index 77f4dc244b3f7..49905b2a99607 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -1403,6 +1403,7 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie)
writel(0, pcie->parf + PARF_Q2A_FLUSH);
dw_pcie_dbi_ro_wr_en(pci);
+
writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP);
val = readl(pci->dbi_base + offset + PCI_EXP_LNKCAP);
@@ -1412,6 +1413,8 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie)
writel(PCI_EXP_DEVCTL2_COMP_TMOUT_DIS, pci->dbi_base + offset +
PCI_EXP_DEVCTL2);
+ dw_pcie_dbi_ro_wr_dis(pci);
+
for (i = 0; i < 256; i++)
writel(0, pcie->parf + PARF_BDF_TO_SID_TABLE_N + (4 * i));
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 326/591] riscv: uprobes: Restore thread.bad_cause
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 325/591] PCI: qcom: Disable write access to read only registers for IP v2.9.0 Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 327/591] powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo Greg Kroah-Hartman
` (268 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Oleg Nesterov, Guo Ren,
Palmer Dabbelt, Sasha Levin
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 58b1294dd1d65bb62f08dddbf418f954210c2057 ]
thread.bad_cause is saved in arch_uprobe_pre_xol(), it should be restored
in arch_uprobe_{post,abort}_xol() accordingly, otherwise the save operation
is meaningless, this change is similar with x86 and powerpc.
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Guo Ren <guoren@kernel.org>
Fixes: 74784081aac8 ("riscv: Add uprobes supported")
Link: https://lore.kernel.org/r/1682214146-3756-1-git-send-email-yangtiezhu@loongson.cn
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/probes/uprobes.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/riscv/kernel/probes/uprobes.c b/arch/riscv/kernel/probes/uprobes.c
index c976a21cd4bd5..194f166b2cc40 100644
--- a/arch/riscv/kernel/probes/uprobes.c
+++ b/arch/riscv/kernel/probes/uprobes.c
@@ -67,6 +67,7 @@ int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
struct uprobe_task *utask = current->utask;
WARN_ON_ONCE(current->thread.bad_cause != UPROBE_TRAP_NR);
+ current->thread.bad_cause = utask->autask.saved_cause;
instruction_pointer_set(regs, utask->vaddr + auprobe->insn_size);
@@ -102,6 +103,7 @@ void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
{
struct uprobe_task *utask = current->utask;
+ current->thread.bad_cause = utask->autask.saved_cause;
/*
* Task has received a fatal signal, so reset back to probbed
* address.
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 327/591] powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 326/591] riscv: uprobes: Restore thread.bad_cause Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 328/591] powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary Greg Kroah-Hartman
` (267 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aneesh Kumar K.V, Michael Ellerman,
Sasha Levin, Sachin Sant
From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
[ Upstream commit 0da90af431abc3f497a38ec9ef6e43b0d0dabe80 ]
On memory unplug reduce DirectMap page count correctly.
root@ubuntu-guest:# grep Direct /proc/meminfo
DirectMap4k: 0 kB
DirectMap64k: 0 kB
DirectMap2M: 115343360 kB
DirectMap1G: 0 kB
Before fix:
root@ubuntu-guest:# ndctl disable-namespace all
disabled 1 namespace
root@ubuntu-guest:# grep Direct /proc/meminfo
DirectMap4k: 0 kB
DirectMap64k: 0 kB
DirectMap2M: 115343360 kB
DirectMap1G: 0 kB
After fix:
root@ubuntu-guest:# ndctl disable-namespace all
disabled 1 namespace
root@ubuntu-guest:# grep Direct /proc/meminfo
DirectMap4k: 0 kB
DirectMap64k: 0 kB
DirectMap2M: 104857600 kB
DirectMap1G: 0 kB
Fixes: a2dc009afa9a ("powerpc/mm/book3s/radix: Add mapping statistics")
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Tested-by: Sachin Sant <sachinp@linux.ibm.com <mailto:sachinp@linux.ibm.com>>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230616110826.344417-4-aneesh.kumar@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/mm/book3s64/radix_pgtable.c | 34 +++++++++++++++---------
1 file changed, 22 insertions(+), 12 deletions(-)
diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c
index 2297aa764ecdb..e8db8c8efe359 100644
--- a/arch/powerpc/mm/book3s64/radix_pgtable.c
+++ b/arch/powerpc/mm/book3s64/radix_pgtable.c
@@ -745,9 +745,9 @@ static void free_pud_table(pud_t *pud_start, p4d_t *p4d)
}
static void remove_pte_table(pte_t *pte_start, unsigned long addr,
- unsigned long end)
+ unsigned long end, bool direct)
{
- unsigned long next;
+ unsigned long next, pages = 0;
pte_t *pte;
pte = pte_start + pte_index(addr);
@@ -769,13 +769,16 @@ static void remove_pte_table(pte_t *pte_start, unsigned long addr,
}
pte_clear(&init_mm, addr, pte);
+ pages++;
}
+ if (direct)
+ update_page_count(mmu_virtual_psize, -pages);
}
static void __meminit remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
- unsigned long end)
+ unsigned long end, bool direct)
{
- unsigned long next;
+ unsigned long next, pages = 0;
pte_t *pte_base;
pmd_t *pmd;
@@ -793,19 +796,22 @@ static void __meminit remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
continue;
}
pte_clear(&init_mm, addr, (pte_t *)pmd);
+ pages++;
continue;
}
pte_base = (pte_t *)pmd_page_vaddr(*pmd);
- remove_pte_table(pte_base, addr, next);
+ remove_pte_table(pte_base, addr, next, direct);
free_pte_table(pte_base, pmd);
}
+ if (direct)
+ update_page_count(MMU_PAGE_2M, -pages);
}
static void __meminit remove_pud_table(pud_t *pud_start, unsigned long addr,
- unsigned long end)
+ unsigned long end, bool direct)
{
- unsigned long next;
+ unsigned long next, pages = 0;
pmd_t *pmd_base;
pud_t *pud;
@@ -823,16 +829,20 @@ static void __meminit remove_pud_table(pud_t *pud_start, unsigned long addr,
continue;
}
pte_clear(&init_mm, addr, (pte_t *)pud);
+ pages++;
continue;
}
pmd_base = pud_pgtable(*pud);
- remove_pmd_table(pmd_base, addr, next);
+ remove_pmd_table(pmd_base, addr, next, direct);
free_pmd_table(pmd_base, pud);
}
+ if (direct)
+ update_page_count(MMU_PAGE_1G, -pages);
}
-static void __meminit remove_pagetable(unsigned long start, unsigned long end)
+static void __meminit remove_pagetable(unsigned long start, unsigned long end,
+ bool direct)
{
unsigned long addr, next;
pud_t *pud_base;
@@ -861,7 +871,7 @@ static void __meminit remove_pagetable(unsigned long start, unsigned long end)
}
pud_base = p4d_pgtable(*p4d);
- remove_pud_table(pud_base, addr, next);
+ remove_pud_table(pud_base, addr, next, direct);
free_pud_table(pud_base, p4d);
}
@@ -884,7 +894,7 @@ int __meminit radix__create_section_mapping(unsigned long start,
int __meminit radix__remove_section_mapping(unsigned long start, unsigned long end)
{
- remove_pagetable(start, end);
+ remove_pagetable(start, end, true);
return 0;
}
#endif /* CONFIG_MEMORY_HOTPLUG */
@@ -920,7 +930,7 @@ int __meminit radix__vmemmap_create_mapping(unsigned long start,
#ifdef CONFIG_MEMORY_HOTPLUG
void __meminit radix__vmemmap_remove_mapping(unsigned long start, unsigned long page_size)
{
- remove_pagetable(start, start + page_size);
+ remove_pagetable(start, start + page_size, false);
}
#endif
#endif
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 328/591] powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 327/591] powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 329/591] PCI: endpoint: Fix Kconfig indent style Greg Kroah-Hartman
` (266 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aneesh Kumar K.V, Michael Ellerman,
Sasha Levin, Sachin Sant
From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
[ Upstream commit c8eebc4a99f15280654f23e914e746c40a516e50 ]
Without this fix, the last subsection vmemmap can end up in memory even if
the namespace is created with -M mem and has sufficient space in the altmap
area.
Fixes: cf387d9644d8 ("libnvdimm/altmap: Track namespace boundaries in altmap")
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Tested-by: Sachin Sant <sachinp@linux.ibm.com <mailto:sachinp@linux.ibm.com>>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230616110826.344417-6-aneesh.kumar@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/mm/init_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
index 05b0d584e50b8..fe1b83020e0df 100644
--- a/arch/powerpc/mm/init_64.c
+++ b/arch/powerpc/mm/init_64.c
@@ -189,7 +189,7 @@ static bool altmap_cross_boundary(struct vmem_altmap *altmap, unsigned long star
unsigned long nr_pfn = page_size / sizeof(struct page);
unsigned long start_pfn = page_to_pfn((struct page *)start);
- if ((start_pfn + nr_pfn) > altmap->end_pfn)
+ if ((start_pfn + nr_pfn - 1) > altmap->end_pfn)
return true;
if (start_pfn < altmap->base_pfn)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 329/591] PCI: endpoint: Fix Kconfig indent style
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 328/591] powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 330/591] PCI: endpoint: Fix a Kconfig prompt of vNTB driver Greg Kroah-Hartman
` (265 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shunsuke Mie, Lorenzo Pieralisi,
Sasha Levin
From: Shunsuke Mie <mie@igel.co.jp>
[ Upstream commit 2759ddf7535d63381f9b9b1412e4c46e13ed773a ]
Change to follow the Kconfig style guide. This patch fixes to use tab
rather than space to indent, while help text is indented an additional
two spaces.
Link: https://lore.kernel.org/r/20220815025006.48167-1-mie@igel.co.jp
Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP")
Signed-off-by: Shunsuke Mie <mie@igel.co.jp>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Stable-dep-of: 37587673cda9 ("PCI: endpoint: Fix a Kconfig prompt of vNTB driver")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/endpoint/functions/Kconfig | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/pci/endpoint/functions/Kconfig b/drivers/pci/endpoint/functions/Kconfig
index 295a033ee9a27..9fd5608868718 100644
--- a/drivers/pci/endpoint/functions/Kconfig
+++ b/drivers/pci/endpoint/functions/Kconfig
@@ -27,13 +27,13 @@ config PCI_EPF_NTB
If in doubt, say "N" to disable Endpoint NTB driver.
config PCI_EPF_VNTB
- tristate "PCI Endpoint NTB driver"
- depends on PCI_ENDPOINT
- depends on NTB
- select CONFIGFS_FS
- help
- Select this configuration option to enable the Non-Transparent
- Bridge (NTB) driver for PCIe Endpoint. NTB driver implements NTB
- between PCI Root Port and PCIe Endpoint.
+ tristate "PCI Endpoint NTB driver"
+ depends on PCI_ENDPOINT
+ depends on NTB
+ select CONFIGFS_FS
+ help
+ Select this configuration option to enable the Non-Transparent
+ Bridge (NTB) driver for PCIe Endpoint. NTB driver implements NTB
+ between PCI Root Port and PCIe Endpoint.
- If in doubt, say "N" to disable Endpoint NTB driver.
+ If in doubt, say "N" to disable Endpoint NTB driver.
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 330/591] PCI: endpoint: Fix a Kconfig prompt of vNTB driver
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 329/591] PCI: endpoint: Fix Kconfig indent style Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 331/591] PCI: endpoint: functions/pci-epf-test: Fix dma_chan direction Greg Kroah-Hartman
` (264 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shunsuke Mie, Lorenzo Pieralisi,
Bjorn Helgaas, Manivannan Sadhasivam, Sasha Levin
From: Shunsuke Mie <mie@igel.co.jp>
[ Upstream commit 37587673cda963ec950e4983db5023802f9b5ff2 ]
vNTB driver and NTB driver have same Kconfig prompt. Changed to make it
distinguishable.
Link: https://lore.kernel.org/r/20230202103832.2038286-1-mie@igel.co.jp
Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP")
Signed-off-by: Shunsuke Mie <mie@igel.co.jp>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/endpoint/functions/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/endpoint/functions/Kconfig b/drivers/pci/endpoint/functions/Kconfig
index 9fd5608868718..8efb6a869e7ce 100644
--- a/drivers/pci/endpoint/functions/Kconfig
+++ b/drivers/pci/endpoint/functions/Kconfig
@@ -27,7 +27,7 @@ config PCI_EPF_NTB
If in doubt, say "N" to disable Endpoint NTB driver.
config PCI_EPF_VNTB
- tristate "PCI Endpoint NTB driver"
+ tristate "PCI Endpoint Virtual NTB driver"
depends on PCI_ENDPOINT
depends on NTB
select CONFIGFS_FS
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 331/591] PCI: endpoint: functions/pci-epf-test: Fix dma_chan direction
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 330/591] PCI: endpoint: Fix a Kconfig prompt of vNTB driver Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 332/591] PCI: vmd: Fix uninitialized variable usage in vmd_enable_domain() Greg Kroah-Hartman
` (263 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kunihiko Hayashi, Yoshihiro Shimoda,
Lorenzo Pieralisi, Bjorn Helgaas, Frank Li, Sasha Levin
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
[ Upstream commit 880d51c729a3fa944794feb19f605eefe55916fc ]
In pci_epf_test_init_dma_chan() epf_test->dma_chan_rx is assigned from
dma_request_channel() with DMA_DEV_TO_MEM as filter.dma_mask.
However, in pci_epf_test_data_transfer() if the dir is DMA_DEV_TO_MEM,
epf->dma_chan_rx should be used but instead we are using
epf_test->dma_chan_tx.
Fix it.
Link: https://lore.kernel.org/r/20230412063447.2841177-1-yoshihiro.shimoda.uh@renesas.com
Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities")
Tested-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/endpoint/functions/pci-epf-test.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
index 55283d2379a6a..f0c4d0f77453a 100644
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -112,7 +112,7 @@ static int pci_epf_test_data_transfer(struct pci_epf_test *epf_test,
size_t len, dma_addr_t dma_remote,
enum dma_transfer_direction dir)
{
- struct dma_chan *chan = (dir == DMA_DEV_TO_MEM) ?
+ struct dma_chan *chan = (dir == DMA_MEM_TO_DEV) ?
epf_test->dma_chan_tx : epf_test->dma_chan_rx;
dma_addr_t dma_local = (dir == DMA_MEM_TO_DEV) ? dma_src : dma_dst;
enum dma_ctrl_flags flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 332/591] PCI: vmd: Fix uninitialized variable usage in vmd_enable_domain()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 331/591] PCI: endpoint: functions/pci-epf-test: Fix dma_chan direction Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 333/591] vfio/mdev: Move the compat_class initialization to module init Greg Kroah-Hartman
` (262 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Xinghui Li, Krzysztof Wilczyński, Nirmal Patel, Sasha Levin
From: Xinghui Li <korantli@tencent.com>
[ Upstream commit 0c0206dc4f5ba2d18b15e24d2047487d6f73916b ]
The ret variable in the vmd_enable_domain() function was used
uninitialized when printing a warning message upon failure of
the pci_reset_bus() function.
Thus, fix the issue by assigning ret with the value returned from
pci_reset_bus() before referencing it in the warning message.
This was detected by Smatch:
drivers/pci/controller/vmd.c:931 vmd_enable_domain() error: uninitialized symbol 'ret'.
[kwilczynski: drop the second patch from the series, add missing reported
by tag, commit log]
Fixes: 0a584655ef89 ("PCI: vmd: Fix secondary bus reset for Intel bridges")
Link: https://lore.kernel.org/all/202305270219.B96IiIfv-lkp@intel.com
Link: https://lore.kernel.org/linux-pci/20230420094332.1507900-2-korantwork@gmail.com
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Xinghui Li <korantli@tencent.com>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Reviewed-by: Nirmal Patel <nirmal.patel@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/vmd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
index 50a187a29a1d8..d1eb17e3f1474 100644
--- a/drivers/pci/controller/vmd.c
+++ b/drivers/pci/controller/vmd.c
@@ -872,7 +872,8 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
if (!list_empty(&child->devices)) {
dev = list_first_entry(&child->devices,
struct pci_dev, bus_list);
- if (pci_reset_bus(dev))
+ ret = pci_reset_bus(dev);
+ if (ret)
pci_warn(dev, "can't reset device: %d\n", ret);
break;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 333/591] vfio/mdev: Move the compat_class initialization to module init
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 332/591] PCI: vmd: Fix uninitialized variable usage in vmd_enable_domain() Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 334/591] hwrng: virtio - Fix race on data_avail and actual data Greg Kroah-Hartman
` (261 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Egorenkov, Eric Farman,
Kevin Tian, Christoph Hellwig, Tony Krowiak, Jason Gunthorpe,
Alex Williamson, Sasha Levin
From: Eric Farman <farman@linux.ibm.com>
[ Upstream commit ff598081e5b9d0bdd6874bfe340811bbb75b35e4 ]
The pointer to mdev_bus_compat_class is statically defined at the top
of mdev_core, and was originally (commit 7b96953bc640 ("vfio: Mediated
device Core driver") serialized by the parent_list_lock. The blamed
commit removed this mutex, leaving the pointer initialization
unserialized. As a result, the creation of multiple MDEVs in parallel
(such as during boot) can encounter errors during the creation of the
sysfs entries, such as:
[ 8.337509] sysfs: cannot create duplicate filename '/class/mdev_bus'
[ 8.337514] vfio_ccw 0.0.01d8: MDEV: Registered
[ 8.337516] CPU: 13 PID: 946 Comm: driverctl Not tainted 6.4.0-rc7 #20
[ 8.337522] Hardware name: IBM 3906 M05 780 (LPAR)
[ 8.337525] Call Trace:
[ 8.337528] [<0000000162b0145a>] dump_stack_lvl+0x62/0x80
[ 8.337540] [<00000001622aeb30>] sysfs_warn_dup+0x78/0x88
[ 8.337549] [<00000001622aeca6>] sysfs_create_dir_ns+0xe6/0xf8
[ 8.337552] [<0000000162b04504>] kobject_add_internal+0xf4/0x340
[ 8.337557] [<0000000162b04d48>] kobject_add+0x78/0xd0
[ 8.337561] [<0000000162b04e0a>] kobject_create_and_add+0x6a/0xb8
[ 8.337565] [<00000001627a110e>] class_compat_register+0x5e/0x90
[ 8.337572] [<000003ff7fd815da>] mdev_register_parent+0x102/0x130 [mdev]
[ 8.337581] [<000003ff7fdc7f2c>] vfio_ccw_sch_probe+0xe4/0x178 [vfio_ccw]
[ 8.337588] [<0000000162a7833c>] css_probe+0x44/0x80
[ 8.337599] [<000000016279f4da>] really_probe+0xd2/0x460
[ 8.337603] [<000000016279fa08>] driver_probe_device+0x40/0xf0
[ 8.337606] [<000000016279fb78>] __device_attach_driver+0xc0/0x140
[ 8.337610] [<000000016279cbe0>] bus_for_each_drv+0x90/0xd8
[ 8.337618] [<00000001627a00b0>] __device_attach+0x110/0x190
[ 8.337621] [<000000016279c7c8>] bus_rescan_devices_helper+0x60/0xb0
[ 8.337626] [<000000016279cd48>] drivers_probe_store+0x48/0x80
[ 8.337632] [<00000001622ac9b0>] kernfs_fop_write_iter+0x138/0x1f0
[ 8.337635] [<00000001621e5e14>] vfs_write+0x1ac/0x2f8
[ 8.337645] [<00000001621e61d8>] ksys_write+0x70/0x100
[ 8.337650] [<0000000162b2bdc4>] __do_syscall+0x1d4/0x200
[ 8.337656] [<0000000162b3c828>] system_call+0x70/0x98
[ 8.337664] kobject: kobject_add_internal failed for mdev_bus with -EEXIST, don't try to register things with the same name in the same directory.
[ 8.337668] kobject: kobject_create_and_add: kobject_add error: -17
[ 8.337674] vfio_ccw: probe of 0.0.01d9 failed with error -12
[ 8.342941] vfio_ccw_mdev aeb9ca91-10c6-42bc-a168-320023570aea: Adding to iommu group 2
Move the initialization of the mdev_bus_compat_class pointer to the
init path, to match the cleanup in module exit. This way the code
in mdev_register_parent() can simply link the new parent to it,
rather than determining whether initialization is required first.
Fixes: 89345d5177aa ("vfio/mdev: embedd struct mdev_parent in the parent data structure")
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Tony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20230626133642.2939168-1-farman@linux.ibm.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/mdev/mdev_core.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
index 58f91b3bd670c..ed4737de45289 100644
--- a/drivers/vfio/mdev/mdev_core.c
+++ b/drivers/vfio/mdev/mdev_core.c
@@ -72,12 +72,6 @@ int mdev_register_parent(struct mdev_parent *parent, struct device *dev,
parent->nr_types = nr_types;
atomic_set(&parent->available_instances, mdev_driver->max_instances);
- if (!mdev_bus_compat_class) {
- mdev_bus_compat_class = class_compat_register("mdev_bus");
- if (!mdev_bus_compat_class)
- return -ENOMEM;
- }
-
ret = parent_create_sysfs_files(parent);
if (ret)
return ret;
@@ -251,13 +245,24 @@ int mdev_device_remove(struct mdev_device *mdev)
static int __init mdev_init(void)
{
- return bus_register(&mdev_bus_type);
+ int ret;
+
+ ret = bus_register(&mdev_bus_type);
+ if (ret)
+ return ret;
+
+ mdev_bus_compat_class = class_compat_register("mdev_bus");
+ if (!mdev_bus_compat_class) {
+ bus_unregister(&mdev_bus_type);
+ return -ENOMEM;
+ }
+
+ return 0;
}
static void __exit mdev_exit(void)
{
- if (mdev_bus_compat_class)
- class_compat_unregister(mdev_bus_compat_class);
+ class_compat_unregister(mdev_bus_compat_class);
bus_unregister(&mdev_bus_type);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 334/591] hwrng: virtio - Fix race on data_avail and actual data
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 333/591] vfio/mdev: Move the compat_class initialization to module init Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 335/591] modpost: remove broken calculation of exception_table_entry size Greg Kroah-Hartman
` (260 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+726dc8c62c3536431ceb,
Herbert Xu, Michael S. Tsirkin, Sasha Levin
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit ac52578d6e8d300dd50f790f29a24169b1edd26c ]
The virtio rng device kicks off a new entropy request whenever the
data available reaches zero. When a new request occurs at the end
of a read operation, that is, when the result of that request is
only needed by the next reader, then there is a race between the
writing of the new data and the next reader.
This is because there is no synchronisation whatsoever between the
writer and the reader.
Fix this by writing data_avail with smp_store_release and reading
it with smp_load_acquire when we first enter read. The subsequent
reads are safe because they're either protected by the first load
acquire, or by the completion mechanism.
Also remove the redundant zeroing of data_idx in random_recv_done
(data_idx must already be zero at this point) and data_avail in
request_entropy (ditto).
Reported-by: syzbot+726dc8c62c3536431ceb@syzkaller.appspotmail.com
Fixes: f7f510ec1957 ("virtio: An entropy device, as suggested by hpa.")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/virtio-rng.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
index a6f3a8a2aca6d..35304117338ab 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -4,6 +4,7 @@
* Copyright (C) 2007, 2008 Rusty Russell IBM Corporation
*/
+#include <asm/barrier.h>
#include <linux/err.h>
#include <linux/hw_random.h>
#include <linux/scatterlist.h>
@@ -37,13 +38,13 @@ struct virtrng_info {
static void random_recv_done(struct virtqueue *vq)
{
struct virtrng_info *vi = vq->vdev->priv;
+ unsigned int len;
/* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */
- if (!virtqueue_get_buf(vi->vq, &vi->data_avail))
+ if (!virtqueue_get_buf(vi->vq, &len))
return;
- vi->data_idx = 0;
-
+ smp_store_release(&vi->data_avail, len);
complete(&vi->have_data);
}
@@ -52,7 +53,6 @@ static void request_entropy(struct virtrng_info *vi)
struct scatterlist sg;
reinit_completion(&vi->have_data);
- vi->data_avail = 0;
vi->data_idx = 0;
sg_init_one(&sg, vi->data, sizeof(vi->data));
@@ -88,7 +88,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait)
read = 0;
/* copy available data */
- if (vi->data_avail) {
+ if (smp_load_acquire(&vi->data_avail)) {
chunk = copy_data(vi, buf, size);
size -= chunk;
read += chunk;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 335/591] modpost: remove broken calculation of exception_table_entry size
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 334/591] hwrng: virtio - Fix race on data_avail and actual data Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 336/591] crypto: nx - fix build warnings when DEBUG_FS is not enabled Greg Kroah-Hartman
` (259 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masahiro Yamada, Sasha Levin
From: Masahiro Yamada <masahiroy@kernel.org>
[ Upstream commit d0acc76a49aa917c1a455d11d32d34a01e8b2835 ]
find_extable_entry_size() is completely broken. It has awesome comments
about how to calculate sizeof(struct exception_table_entry).
It was based on these assumptions:
- struct exception_table_entry has two fields
- both of the fields have the same size
Then, we came up with this equation:
(offset of the second field) * 2 == (size of struct)
It was true for all architectures when commit 52dc0595d540 ("modpost:
handle relocations mismatch in __ex_table.") was applied.
Our mathematics broke when commit 548acf19234d ("x86/mm: Expand the
exception table logic to allow new handling options") introduced the
third field.
Now, the definition of exception_table_entry is highly arch-dependent.
For x86, sizeof(struct exception_table_entry) is apparently 12, but
find_extable_entry_size() sets extable_entry_size to 8.
I could fix it, but I do not see much value in this code.
extable_entry_size is used just for selecting a slightly different
error message.
If the first field ("insn") references to a non-executable section,
The relocation at %s+0x%lx references
section "%s" which is not executable, IOW
it is not possible for the kernel to fault
at that address. Something is seriously wrong
and should be fixed.
If the second field ("fixup") references to a non-executable section,
The relocation at %s+0x%lx references
section "%s" which is not executable, IOW
the kernel will fault if it ever tries to
jump to it. Something is seriously wrong
and should be fixed.
Merge the two error messages rather than adding even more complexity.
Change fatal() to error() to make it continue running and catch more
possible errors.
Fixes: 548acf19234d ("x86/mm: Expand the exception table logic to allow new handling options")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/mod/modpost.c | 60 +++----------------------------------------
1 file changed, 3 insertions(+), 57 deletions(-)
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 1dfa80c6b471e..d08cf73e4a3ff 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1299,43 +1299,6 @@ static int is_executable_section(struct elf_info* elf, unsigned int section_inde
return ((elf->sechdrs[section_index].sh_flags & SHF_EXECINSTR) == SHF_EXECINSTR);
}
-/*
- * We rely on a gross hack in section_rel[a]() calling find_extable_entry_size()
- * to know the sizeof(struct exception_table_entry) for the target architecture.
- */
-static unsigned int extable_entry_size = 0;
-static void find_extable_entry_size(const char* const sec, const Elf_Rela* r)
-{
- /*
- * If we're currently checking the second relocation within __ex_table,
- * that relocation offset tells us the offsetof(struct
- * exception_table_entry, fixup) which is equal to sizeof(struct
- * exception_table_entry) divided by two. We use that to our advantage
- * since there's no portable way to get that size as every architecture
- * seems to go with different sized types. Not pretty but better than
- * hard-coding the size for every architecture..
- */
- if (!extable_entry_size)
- extable_entry_size = r->r_offset * 2;
-}
-
-static inline bool is_extable_fault_address(Elf_Rela *r)
-{
- /*
- * extable_entry_size is only discovered after we've handled the
- * _second_ relocation in __ex_table, so only abort when we're not
- * handling the first reloc and extable_entry_size is zero.
- */
- if (r->r_offset && extable_entry_size == 0)
- fatal("extable_entry size hasn't been discovered!\n");
-
- return ((r->r_offset == 0) ||
- (r->r_offset % extable_entry_size == 0));
-}
-
-#define is_second_extable_reloc(Start, Cur, Sec) \
- (((Cur) == (Start) + 1) && (strcmp("__ex_table", (Sec)) == 0))
-
static void report_extable_warnings(const char* modname, struct elf_info* elf,
const struct sectioncheck* const mismatch,
Elf_Rela* r, Elf_Sym* sym,
@@ -1392,22 +1355,9 @@ static void extable_mismatch_handler(const char* modname, struct elf_info *elf,
"You might get more information about where this is\n"
"coming from by using scripts/check_extable.sh %s\n",
fromsec, (long)r->r_offset, tosec, modname);
- else if (!is_executable_section(elf, get_secindex(elf, sym))) {
- if (is_extable_fault_address(r))
- fatal("The relocation at %s+0x%lx references\n"
- "section \"%s\" which is not executable, IOW\n"
- "it is not possible for the kernel to fault\n"
- "at that address. Something is seriously wrong\n"
- "and should be fixed.\n",
- fromsec, (long)r->r_offset, tosec);
- else
- fatal("The relocation at %s+0x%lx references\n"
- "section \"%s\" which is not executable, IOW\n"
- "the kernel will fault if it ever tries to\n"
- "jump to it. Something is seriously wrong\n"
- "and should be fixed.\n",
- fromsec, (long)r->r_offset, tosec);
- }
+ else if (!is_executable_section(elf, get_secindex(elf, sym)))
+ error("%s+0x%lx references non-executable section '%s'\n",
+ fromsec, (long)r->r_offset, tosec);
}
static void check_section_mismatch(const char *modname, struct elf_info *elf,
@@ -1569,8 +1519,6 @@ static void section_rela(const char *modname, struct elf_info *elf,
/* Skip special sections */
if (is_shndx_special(sym->st_shndx))
continue;
- if (is_second_extable_reloc(start, rela, fromsec))
- find_extable_entry_size(fromsec, &r);
check_section_mismatch(modname, elf, &r, sym, fromsec);
}
}
@@ -1628,8 +1576,6 @@ static void section_rel(const char *modname, struct elf_info *elf,
/* Skip special sections */
if (is_shndx_special(sym->st_shndx))
continue;
- if (is_second_extable_reloc(start, rel, fromsec))
- find_extable_entry_size(fromsec, &r);
check_section_mismatch(modname, elf, &r, sym, fromsec);
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 336/591] crypto: nx - fix build warnings when DEBUG_FS is not enabled
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 335/591] modpost: remove broken calculation of exception_table_entry size Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 337/591] modpost: fix section mismatch message for R_ARM_ABS32 Greg Kroah-Hartman
` (258 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Breno Leitão,
Nayna Jain, Paulo Flabiano Smorigo, Herbert Xu, David S. Miller,
linux-crypto, Michael Ellerman, Nicholas Piggin, Christophe Leroy,
linuxppc-dev, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit b04b076fb56560b39d695ac3744db457e12278fd ]
Fix build warnings when DEBUG_FS is not enabled by using an empty
do-while loop instead of a value:
In file included from ../drivers/crypto/nx/nx.c:27:
../drivers/crypto/nx/nx.c: In function 'nx_register_algs':
../drivers/crypto/nx/nx.h:173:33: warning: statement with no effect [-Wunused-value]
173 | #define NX_DEBUGFS_INIT(drv) (0)
../drivers/crypto/nx/nx.c:573:9: note: in expansion of macro 'NX_DEBUGFS_INIT'
573 | NX_DEBUGFS_INIT(&nx_driver);
../drivers/crypto/nx/nx.c: In function 'nx_remove':
../drivers/crypto/nx/nx.h:174:33: warning: statement with no effect [-Wunused-value]
174 | #define NX_DEBUGFS_FINI(drv) (0)
../drivers/crypto/nx/nx.c:793:17: note: in expansion of macro 'NX_DEBUGFS_FINI'
793 | NX_DEBUGFS_FINI(&nx_driver);
Also, there is no need to build nx_debugfs.o when DEBUG_FS is not
enabled, so change the Makefile to accommodate that.
Fixes: ae0222b7289d ("powerpc/crypto: nx driver code supporting nx encryption")
Fixes: aef7b31c8833 ("powerpc/crypto: Build files for the nx device driver")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Breno Leitão <leitao@debian.org>
Cc: Nayna Jain <nayna@linux.ibm.com>
Cc: Paulo Flabiano Smorigo <pfsmorigo@gmail.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: linux-crypto@vger.kernel.org
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/nx/Makefile | 2 +-
drivers/crypto/nx/nx.h | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/nx/Makefile b/drivers/crypto/nx/Makefile
index d00181a26dd65..483cef62acee8 100644
--- a/drivers/crypto/nx/Makefile
+++ b/drivers/crypto/nx/Makefile
@@ -1,7 +1,6 @@
# SPDX-License-Identifier: GPL-2.0
obj-$(CONFIG_CRYPTO_DEV_NX_ENCRYPT) += nx-crypto.o
nx-crypto-objs := nx.o \
- nx_debugfs.o \
nx-aes-cbc.o \
nx-aes-ecb.o \
nx-aes-gcm.o \
@@ -11,6 +10,7 @@ nx-crypto-objs := nx.o \
nx-sha256.o \
nx-sha512.o
+nx-crypto-$(CONFIG_DEBUG_FS) += nx_debugfs.o
obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_PSERIES) += nx-compress-pseries.o nx-compress.o
obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_POWERNV) += nx-compress-powernv.o nx-compress.o
nx-compress-objs := nx-842.o
diff --git a/drivers/crypto/nx/nx.h b/drivers/crypto/nx/nx.h
index c6233173c612e..2697baebb6a35 100644
--- a/drivers/crypto/nx/nx.h
+++ b/drivers/crypto/nx/nx.h
@@ -170,8 +170,8 @@ struct nx_sg *nx_walk_and_build(struct nx_sg *, unsigned int,
void nx_debugfs_init(struct nx_crypto_driver *);
void nx_debugfs_fini(struct nx_crypto_driver *);
#else
-#define NX_DEBUGFS_INIT(drv) (0)
-#define NX_DEBUGFS_FINI(drv) (0)
+#define NX_DEBUGFS_INIT(drv) do {} while (0)
+#define NX_DEBUGFS_FINI(drv) do {} while (0)
#endif
#define NX_PAGE_NUM(x) ((u64)(x) & 0xfffffffffffff000ULL)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 337/591] modpost: fix section mismatch message for R_ARM_ABS32
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 336/591] crypto: nx - fix build warnings when DEBUG_FS is not enabled Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 338/591] modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} Greg Kroah-Hartman
` (257 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masahiro Yamada, Sasha Levin
From: Masahiro Yamada <masahiroy@kernel.org>
[ Upstream commit b7c63520f6703a25eebb4f8138fed764fcae1c6f ]
addend_arm_rel() processes R_ARM_ABS32 in a wrong way.
Here, test code.
[test code 1]
#include <linux/init.h>
int __initdata foo;
int get_foo(void) { return foo; }
If you compile it with ARM versatile_defconfig, modpost will show the
symbol name, (unknown).
WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> (unknown) (section: .init.data)
(You need to use GNU linker instead of LLD to reproduce it.)
If you compile it for other architectures, modpost will show the correct
symbol name.
WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> foo (section: .init.data)
For R_ARM_ABS32, addend_arm_rel() sets r->r_addend to a wrong value.
I just mimicked the code in arch/arm/kernel/module.c.
However, there is more difficulty for ARM.
Here, test code.
[test code 2]
#include <linux/init.h>
int __initdata foo;
int get_foo(void) { return foo; }
int __initdata bar;
int get_bar(void) { return bar; }
With this commit applied, modpost will show the following messages
for ARM versatile_defconfig:
WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> foo (section: .init.data)
WARNING: modpost: vmlinux.o: section mismatch in reference: get_bar (section: .text) -> foo (section: .init.data)
The reference from 'get_bar' to 'foo' seems wrong.
I have no solution for this because it is true in assembly level.
In the following output, relocation at 0x1c is no longer associated
with 'bar'. The two relocation entries point to the same symbol, and
the offset to 'bar' is encoded in the instruction 'r0, [r3, #4]'.
Disassembly of section .text:
00000000 <get_foo>:
0: e59f3004 ldr r3, [pc, #4] @ c <get_foo+0xc>
4: e5930000 ldr r0, [r3]
8: e12fff1e bx lr
c: 00000000 .word 0x00000000
00000010 <get_bar>:
10: e59f3004 ldr r3, [pc, #4] @ 1c <get_bar+0xc>
14: e5930004 ldr r0, [r3, #4]
18: e12fff1e bx lr
1c: 00000000 .word 0x00000000
Relocation section '.rel.text' at offset 0x244 contains 2 entries:
Offset Info Type Sym.Value Sym. Name
0000000c 00000c02 R_ARM_ABS32 00000000 .init.data
0000001c 00000c02 R_ARM_ABS32 00000000 .init.data
When find_elf_symbol() gets into a situation where relsym->st_name is
zero, there is no guarantee to get the symbol name as written in C.
I am keeping the current logic because it is useful in many architectures,
but the symbol name is not always correct depending on the optimization.
I left some comments in find_tosym().
Fixes: 56a974fa2d59 ("kbuild: make better section mismatch reports on arm")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/mod/modpost.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index d08cf73e4a3ff..f7a67f111d846 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1157,6 +1157,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
if (relsym->st_name != 0)
return relsym;
+ /*
+ * Strive to find a better symbol name, but the resulting name may not
+ * match the symbol referenced in the original code.
+ */
relsym_secindex = get_secindex(elf, relsym);
for (sym = elf->symtab_start; sym < elf->symtab_stop; sym++) {
if (get_secindex(elf, sym) != relsym_secindex)
@@ -1418,12 +1422,14 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
{
unsigned int r_typ = ELF_R_TYPE(r->r_info);
+ Elf_Sym *sym = elf->symtab_start + ELF_R_SYM(r->r_info);
+ void *loc = reloc_location(elf, sechdr, r);
+ uint32_t inst;
switch (r_typ) {
case R_ARM_ABS32:
- /* From ARM ABI: (S + A) | T */
- r->r_addend = (int)(long)
- (elf->symtab_start + ELF_R_SYM(r->r_info));
+ inst = TO_NATIVE(*(uint32_t *)loc);
+ r->r_addend = inst + sym->st_value;
break;
case R_ARM_PC24:
case R_ARM_CALL:
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 338/591] modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 337/591] modpost: fix section mismatch message for R_ARM_ABS32 Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 339/591] crypto: marvell/cesa - Fix type mismatch warning Greg Kroah-Hartman
` (256 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masahiro Yamada, Sasha Levin
From: Masahiro Yamada <masahiroy@kernel.org>
[ Upstream commit 56a24b8ce6a7f9c4a21b2276a8644f6f3d8fc14d ]
addend_arm_rel() processes R_ARM_PC24, R_ARM_CALL, R_ARM_JUMP24 in a
wrong way.
Here, test code.
[test code for R_ARM_JUMP24]
.section .init.text,"ax"
bar:
bx lr
.section .text,"ax"
.globl foo
foo:
b bar
[test code for R_ARM_CALL]
.section .init.text,"ax"
bar:
bx lr
.section .text,"ax"
.globl foo
foo:
push {lr}
bl bar
pop {pc}
If you compile it with ARM multi_v7_defconfig, modpost will show the
symbol name, (unknown).
WARNING: modpost: vmlinux.o: section mismatch in reference: foo (section: .text) -> (unknown) (section: .init.text)
(You need to use GNU linker instead of LLD to reproduce it.)
Fix the code to make modpost show the correct symbol name.
I imported (with adjustment) sign_extend32() from include/linux/bitops.h.
The '+8' is the compensation for pc-relative instruction. It is
documented in "ELF for the Arm Architecture" [1].
"If the relocation is pc-relative then compensation for the PC bias
(the PC value is 8 bytes ahead of the executing instruction in Arm
state and 4 bytes in Thumb state) must be encoded in the relocation
by the object producer."
[1]: https://github.com/ARM-software/abi-aa/blob/main/aaelf32/aaelf32.rst
Fixes: 56a974fa2d59 ("kbuild: make better section mismatch reports on arm")
Fixes: 6e2e340b59d2 ("ARM: 7324/1: modpost: Fix section warnings for ARM for many compilers")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/mod/modpost.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index f7a67f111d846..9e370e77f52d1 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1419,12 +1419,20 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
#define R_ARM_THM_JUMP19 51
#endif
+static int32_t sign_extend32(int32_t value, int index)
+{
+ uint8_t shift = 31 - index;
+
+ return (int32_t)(value << shift) >> shift;
+}
+
static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
{
unsigned int r_typ = ELF_R_TYPE(r->r_info);
Elf_Sym *sym = elf->symtab_start + ELF_R_SYM(r->r_info);
void *loc = reloc_location(elf, sechdr, r);
uint32_t inst;
+ int32_t offset;
switch (r_typ) {
case R_ARM_ABS32:
@@ -1434,6 +1442,10 @@ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
case R_ARM_PC24:
case R_ARM_CALL:
case R_ARM_JUMP24:
+ inst = TO_NATIVE(*(uint32_t *)loc);
+ offset = sign_extend32((inst & 0x00ffffff) << 2, 25);
+ r->r_addend = offset + sym->st_value + 8;
+ break;
case R_ARM_THM_CALL:
case R_ARM_THM_JUMP24:
case R_ARM_THM_JUMP19:
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 339/591] crypto: marvell/cesa - Fix type mismatch warning
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 338/591] modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:47 ` [PATCH 6.1 340/591] crypto: jitter - correct health test during initialization Greg Kroah-Hartman
` (255 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kees Cook, Gustavo A. R. Silva,
Arnd Bergmann, Herbert Xu, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit efbc7764c4446566edb76ca05e903b5905673d2e ]
Commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") uncovered
a type mismatch in cesa 3des support that leads to a memcpy beyond the
end of a structure:
In function 'fortify_memcpy_chk',
inlined from 'mv_cesa_des3_ede_setkey' at drivers/crypto/marvell/cesa/cipher.c:307:2:
include/linux/fortify-string.h:583:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
583 | __write_overflow_field(p_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This is probably harmless as the actual data that is copied has the correct
type, but clearly worth fixing nonetheless.
Fixes: 4ada48397823 ("crypto: marvell/cesa - add Triple-DES support")
Cc: Kees Cook <keescook@chromium.org>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/marvell/cesa/cipher.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/marvell/cesa/cipher.c b/drivers/crypto/marvell/cesa/cipher.c
index c6f2fa753b7c0..0f37dfd42d850 100644
--- a/drivers/crypto/marvell/cesa/cipher.c
+++ b/drivers/crypto/marvell/cesa/cipher.c
@@ -297,7 +297,7 @@ static int mv_cesa_des_setkey(struct crypto_skcipher *cipher, const u8 *key,
static int mv_cesa_des3_ede_setkey(struct crypto_skcipher *cipher,
const u8 *key, unsigned int len)
{
- struct mv_cesa_des_ctx *ctx = crypto_skcipher_ctx(cipher);
+ struct mv_cesa_des3_ctx *ctx = crypto_skcipher_ctx(cipher);
int err;
err = verify_skcipher_des3_key(cipher, key);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 340/591] crypto: jitter - correct health test during initialization
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 339/591] crypto: marvell/cesa - Fix type mismatch warning Greg Kroah-Hartman
@ 2023-07-16 19:47 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 341/591] modpost: fix off by one in is_executable_section() Greg Kroah-Hartman
` (254 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joachim Vandersmissen,
Stephan Mueller, Herbert Xu, Sasha Levin
From: Stephan Müller <smueller@chronox.de>
[ Upstream commit d23659769ad1bf2cbafaa0efcbae20ef1a74f77e ]
With the update of the permanent and intermittent health errors, the
actual indicator for the health test indicates a potential error only
for the one offending time stamp gathered in the current iteration
round. The next iteration round will "overwrite" the health test result.
Thus, the entropy collection loop in jent_gen_entropy checks for
the health test failure upon each loop iteration. However, the
initialization operation checked for the APT health test once for
an APT window which implies it would not catch most errors.
Thus, the check for all health errors is now invoked unconditionally
during each loop iteration for the startup test.
With the change, the error JENT_ERCT becomes unused as all health
errors are only reported with the JENT_HEALTH return code. This
allows the removal of the error indicator.
Fixes: 3fde2fe99aa6 ("crypto: jitter - permanent and intermittent health errors"
)
Reported-by: Joachim Vandersmissen <git@jvdsn.com>
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/jitterentropy.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/crypto/jitterentropy.c b/crypto/jitterentropy.c
index 22f48bf4c6f57..227cedfa4f0ae 100644
--- a/crypto/jitterentropy.c
+++ b/crypto/jitterentropy.c
@@ -117,7 +117,6 @@ struct rand_data {
* zero). */
#define JENT_ESTUCK 8 /* Too many stuck results during init. */
#define JENT_EHEALTH 9 /* Health test failed during initialization */
-#define JENT_ERCT 10 /* RCT failed during initialization */
/*
* The output n bits can receive more than n bits of min entropy, of course,
@@ -762,14 +761,12 @@ int jent_entropy_init(void)
if ((nonstuck % JENT_APT_WINDOW_SIZE) == 0) {
jent_apt_reset(&ec,
delta & JENT_APT_WORD_MASK);
- if (jent_health_failure(&ec))
- return JENT_EHEALTH;
}
}
- /* Validate RCT */
- if (jent_rct_failure(&ec))
- return JENT_ERCT;
+ /* Validate health test result */
+ if (jent_health_failure(&ec))
+ return JENT_EHEALTH;
/* test whether we have an increasing timer */
if (!(time2 > time))
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 341/591] modpost: fix off by one in is_executable_section()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2023-07-16 19:47 ` [PATCH 6.1 340/591] crypto: jitter - correct health test during initialization Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 342/591] ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard Greg Kroah-Hartman
` (253 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Masahiro Yamada,
Sasha Levin
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 3a3f1e573a105328a2cca45a7cfbebabbf5e3192 ]
The > comparison should be >= to prevent an out of bounds array
access.
Fixes: 52dc0595d540 ("modpost: handle relocations mismatch in __ex_table.")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/mod/modpost.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 9e370e77f52d1..e6be7fc2625fd 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1297,7 +1297,7 @@ static void default_mismatch_handler(const char *modname, struct elf_info *elf,
static int is_executable_section(struct elf_info* elf, unsigned int section_index)
{
- if (section_index > elf->num_sections)
+ if (section_index >= elf->num_sections)
fatal("section_index is outside elf->num_sections!\n");
return ((elf->sechdrs[section_index].sh_flags & SHF_EXECINSTR) == SHF_EXECINSTR);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 342/591] ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 341/591] modpost: fix off by one in is_executable_section() Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 343/591] crypto: kpp - Add helper to set reqsize Greg Kroah-Hartman
` (252 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masahiro Yamada, Sasha Levin
From: Masahiro Yamada <masahiroy@kernel.org>
[ Upstream commit 92e2921eeafdfca9acd9b83f07d2b7ca099bac24 ]
ASM_NL is useful not only in *.S files but also in .c files for using
inline assembler in C code.
On ARC, however, ASM_NL is evaluated inconsistently. It is expanded to
a backquote (`) in *.S files, but a semicolon (;) in *.c files because
arch/arc/include/asm/linkage.h defines it inside #ifdef __ASSEMBLY__,
so the definition for C code falls back to the default value defined in
include/linux/linkage.h.
If ASM_NL is used in inline assembler in .c files, it will result in
wrong assembly code because a semicolon is not an instruction separator,
but the start of a comment for ARC.
Move ASM_NL (also __ALIGN and __ALIGN_STR) out of the #ifdef.
Fixes: 9df62f054406 ("arch: use ASM_NL instead of ';' for assembler new line character in the macro")
Fixes: 8d92e992a785 ("ARC: define __ALIGN_STR and __ALIGN symbols for ARC")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arc/include/asm/linkage.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h
index c9434ff3aa4ce..8a3fb71e9cfad 100644
--- a/arch/arc/include/asm/linkage.h
+++ b/arch/arc/include/asm/linkage.h
@@ -8,6 +8,10 @@
#include <asm/dwarf.h>
+#define ASM_NL ` /* use '`' to mark new line in macro */
+#define __ALIGN .align 4
+#define __ALIGN_STR __stringify(__ALIGN)
+
#ifdef __ASSEMBLY__
.macro ST2 e, o, off
@@ -28,10 +32,6 @@
#endif
.endm
-#define ASM_NL ` /* use '`' to mark new line in macro */
-#define __ALIGN .align 4
-#define __ALIGN_STR __stringify(__ALIGN)
-
/* annotation for data we want in DCCM - if enabled in .config */
.macro ARCFP_DATA nm
#ifdef CONFIG_ARC_HAS_DCCM
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 343/591] crypto: kpp - Add helper to set reqsize
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 342/591] ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 344/591] crypto: qat - Use " Greg Kroah-Hartman
` (251 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Herbert Xu, Sasha Levin
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 56861cbde1b9f3b34d300e6ba87f2c3de1a9c309 ]
The value of reqsize should only be changed through a helper.
To do so we need to first add a helper for this.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: eb7713f5ca97 ("crypto: qat - unmap buffer before free for DH")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/crypto/internal/kpp.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/include/crypto/internal/kpp.h b/include/crypto/internal/kpp.h
index 9cb0662ebe871..31ff3c1986ef0 100644
--- a/include/crypto/internal/kpp.h
+++ b/include/crypto/internal/kpp.h
@@ -50,6 +50,12 @@ static inline void *kpp_request_ctx(struct kpp_request *req)
return req->__ctx;
}
+static inline void kpp_set_reqsize(struct crypto_kpp *kpp,
+ unsigned int reqsize)
+{
+ crypto_kpp_alg(kpp)->reqsize = reqsize;
+}
+
static inline void *kpp_tfm_ctx(struct crypto_kpp *tfm)
{
return tfm->base.__crt_ctx;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 344/591] crypto: qat - Use helper to set reqsize
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 343/591] crypto: kpp - Add helper to set reqsize Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 345/591] crypto: qat - unmap buffer before free for DH Greg Kroah-Hartman
` (250 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Herbert Xu, Giovanni Cabiddu,
Sasha Levin
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 80e62ad58db084920d8cf23323b713391e09f374 ]
The value of reqsize must only be changed through the helper.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: eb7713f5ca97 ("crypto: qat - unmap buffer before free for DH")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/qat_asym_algs.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c
index 94a26702aeae1..935a7e012946e 100644
--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c
@@ -494,6 +494,8 @@ static int qat_dh_init_tfm(struct crypto_kpp *tfm)
if (!inst)
return -EINVAL;
+ kpp_set_reqsize(tfm, sizeof(struct qat_asym_request) + 64);
+
ctx->p_size = 0;
ctx->g2 = false;
ctx->inst = inst;
@@ -1230,6 +1232,8 @@ static int qat_rsa_init_tfm(struct crypto_akcipher *tfm)
if (!inst)
return -EINVAL;
+ akcipher_set_reqsize(tfm, sizeof(struct qat_asym_request) + 64);
+
ctx->key_sz = 0;
ctx->inst = inst;
return 0;
@@ -1252,7 +1256,6 @@ static struct akcipher_alg rsa = {
.max_size = qat_rsa_max_size,
.init = qat_rsa_init_tfm,
.exit = qat_rsa_exit_tfm,
- .reqsize = sizeof(struct qat_asym_request) + 64,
.base = {
.cra_name = "rsa",
.cra_driver_name = "qat-rsa",
@@ -1269,7 +1272,6 @@ static struct kpp_alg dh = {
.max_size = qat_dh_max_size,
.init = qat_dh_init_tfm,
.exit = qat_dh_exit_tfm,
- .reqsize = sizeof(struct qat_asym_request) + 64,
.base = {
.cra_name = "dh",
.cra_driver_name = "qat-dh",
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 345/591] crypto: qat - unmap buffer before free for DH
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 344/591] crypto: qat - Use " Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 346/591] crypto: qat - unmap buffers before free for RSA Greg Kroah-Hartman
` (249 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hareshx Sankar Raj,
Bolemx Sivanagaleela, Giovanni Cabiddu, Andy Shevchenko,
Herbert Xu, Sasha Levin
From: Hareshx Sankar Raj <hareshx.sankar.raj@intel.com>
[ Upstream commit eb7713f5ca97697b92f225127440d1525119b8de ]
The callback function for DH frees the memory allocated for the
destination buffer before unmapping it.
This sequence is wrong.
Change the cleanup sequence to unmap the buffer before freeing it.
Fixes: 029aa4624a7f ("crypto: qat - remove dma_free_coherent() for DH")
Signed-off-by: Hareshx Sankar Raj <hareshx.sankar.raj@intel.com>
Co-developed-by: Bolemx Sivanagaleela <bolemx.sivanagaleela@intel.com>
Signed-off-by: Bolemx Sivanagaleela <bolemx.sivanagaleela@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/qat_asym_algs.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c
index 935a7e012946e..8806242469a06 100644
--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c
@@ -170,15 +170,14 @@ static void qat_dh_cb(struct icp_qat_fw_pke_resp *resp)
}
areq->dst_len = req->ctx.dh->p_size;
+ dma_unmap_single(dev, req->out.dh.r, req->ctx.dh->p_size,
+ DMA_FROM_DEVICE);
if (req->dst_align) {
scatterwalk_map_and_copy(req->dst_align, areq->dst, 0,
areq->dst_len, 1);
kfree_sensitive(req->dst_align);
}
- dma_unmap_single(dev, req->out.dh.r, req->ctx.dh->p_size,
- DMA_FROM_DEVICE);
-
dma_unmap_single(dev, req->phy_in, sizeof(struct qat_dh_input_params),
DMA_TO_DEVICE);
dma_unmap_single(dev, req->phy_out,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 346/591] crypto: qat - unmap buffers before free for RSA
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 345/591] crypto: qat - unmap buffer before free for DH Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 347/591] NFSv4.2: fix wrong shrinker_id Greg Kroah-Hartman
` (248 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hareshx Sankar Raj,
Bolemx Sivanagaleela, Giovanni Cabiddu, Andy Shevchenko,
Herbert Xu, Sasha Levin
From: Hareshx Sankar Raj <hareshx.sankar.raj@intel.com>
[ Upstream commit d776b25495f2c71b9dbf1f5e53b642215ba72f3c ]
The callback function for RSA frees the memory allocated for the source
and destination buffers before unmapping them.
This sequence is wrong.
Change the cleanup sequence to unmap the buffers before freeing them.
Fixes: 3dfaf0071ed7 ("crypto: qat - remove dma_free_coherent() for RSA")
Signed-off-by: Hareshx Sankar Raj <hareshx.sankar.raj@intel.com>
Co-developed-by: Bolemx Sivanagaleela <bolemx.sivanagaleela@intel.com>
Signed-off-by: Bolemx Sivanagaleela <bolemx.sivanagaleela@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/qat_asym_algs.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c
index 8806242469a06..4128200a90329 100644
--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c
@@ -520,12 +520,14 @@ static void qat_rsa_cb(struct icp_qat_fw_pke_resp *resp)
err = (err == ICP_QAT_FW_COMN_STATUS_FLAG_OK) ? 0 : -EINVAL;
- kfree_sensitive(req->src_align);
-
dma_unmap_single(dev, req->in.rsa.enc.m, req->ctx.rsa->key_sz,
DMA_TO_DEVICE);
+ kfree_sensitive(req->src_align);
+
areq->dst_len = req->ctx.rsa->key_sz;
+ dma_unmap_single(dev, req->out.rsa.enc.c, req->ctx.rsa->key_sz,
+ DMA_FROM_DEVICE);
if (req->dst_align) {
scatterwalk_map_and_copy(req->dst_align, areq->dst, 0,
areq->dst_len, 1);
@@ -533,9 +535,6 @@ static void qat_rsa_cb(struct icp_qat_fw_pke_resp *resp)
kfree_sensitive(req->dst_align);
}
- dma_unmap_single(dev, req->out.rsa.enc.c, req->ctx.rsa->key_sz,
- DMA_FROM_DEVICE);
-
dma_unmap_single(dev, req->phy_in, sizeof(struct qat_rsa_input_params),
DMA_TO_DEVICE);
dma_unmap_single(dev, req->phy_out,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 347/591] NFSv4.2: fix wrong shrinker_id
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 346/591] crypto: qat - unmap buffers before free for RSA Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 348/591] NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION Greg Kroah-Hartman
` (247 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qi Zheng, Trond Myklebust,
Sasha Levin
From: Qi Zheng <zhengqi.arch@bytedance.com>
[ Upstream commit 7f7ab336898f281e58540ef781a8fb375acc32a9 ]
Currently, the list_lru::shrinker_id corresponding to the nfs4_xattr
shrinkers is wrong:
>>> prog["nfs4_xattr_cache_lru"].shrinker_id
(int)0
>>> prog["nfs4_xattr_entry_lru"].shrinker_id
(int)0
>>> prog["nfs4_xattr_large_entry_lru"].shrinker_id
(int)0
>>> prog["nfs4_xattr_cache_shrinker"].id
(int)18
>>> prog["nfs4_xattr_entry_shrinker"].id
(int)19
>>> prog["nfs4_xattr_large_entry_shrinker"].id
(int)20
This is not what we expect, which will cause these shrinkers
not to be found in shrink_slab_memcg().
We should assign shrinker::id before calling list_lru_init_memcg(),
so that the corresponding list_lru::shrinker_id will be assigned
the correct value like below:
>>> prog["nfs4_xattr_cache_lru"].shrinker_id
(int)16
>>> prog["nfs4_xattr_entry_lru"].shrinker_id
(int)17
>>> prog["nfs4_xattr_large_entry_lru"].shrinker_id
(int)18
>>> prog["nfs4_xattr_cache_shrinker"].id
(int)16
>>> prog["nfs4_xattr_entry_shrinker"].id
(int)17
>>> prog["nfs4_xattr_large_entry_shrinker"].id
(int)18
So just do it.
Fixes: 95ad37f90c33 ("NFSv4.2: add client side xattr caching.")
Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs42xattr.c | 79 +++++++++++++++++++++++++--------------------
1 file changed, 44 insertions(+), 35 deletions(-)
diff --git a/fs/nfs/nfs42xattr.c b/fs/nfs/nfs42xattr.c
index 76ae118342066..911f634ba3da7 100644
--- a/fs/nfs/nfs42xattr.c
+++ b/fs/nfs/nfs42xattr.c
@@ -991,6 +991,29 @@ static void nfs4_xattr_cache_init_once(void *p)
INIT_LIST_HEAD(&cache->dispose);
}
+static int nfs4_xattr_shrinker_init(struct shrinker *shrinker,
+ struct list_lru *lru, const char *name)
+{
+ int ret = 0;
+
+ ret = register_shrinker(shrinker, name);
+ if (ret)
+ return ret;
+
+ ret = list_lru_init_memcg(lru, shrinker);
+ if (ret)
+ unregister_shrinker(shrinker);
+
+ return ret;
+}
+
+static void nfs4_xattr_shrinker_destroy(struct shrinker *shrinker,
+ struct list_lru *lru)
+{
+ unregister_shrinker(shrinker);
+ list_lru_destroy(lru);
+}
+
int __init nfs4_xattr_cache_init(void)
{
int ret = 0;
@@ -1002,44 +1025,30 @@ int __init nfs4_xattr_cache_init(void)
if (nfs4_xattr_cache_cachep == NULL)
return -ENOMEM;
- ret = list_lru_init_memcg(&nfs4_xattr_large_entry_lru,
- &nfs4_xattr_large_entry_shrinker);
- if (ret)
- goto out4;
-
- ret = list_lru_init_memcg(&nfs4_xattr_entry_lru,
- &nfs4_xattr_entry_shrinker);
- if (ret)
- goto out3;
-
- ret = list_lru_init_memcg(&nfs4_xattr_cache_lru,
- &nfs4_xattr_cache_shrinker);
- if (ret)
- goto out2;
-
- ret = register_shrinker(&nfs4_xattr_cache_shrinker, "nfs-xattr_cache");
+ ret = nfs4_xattr_shrinker_init(&nfs4_xattr_cache_shrinker,
+ &nfs4_xattr_cache_lru,
+ "nfs-xattr_cache");
if (ret)
goto out1;
- ret = register_shrinker(&nfs4_xattr_entry_shrinker, "nfs-xattr_entry");
+ ret = nfs4_xattr_shrinker_init(&nfs4_xattr_entry_shrinker,
+ &nfs4_xattr_entry_lru,
+ "nfs-xattr_entry");
if (ret)
- goto out;
+ goto out2;
- ret = register_shrinker(&nfs4_xattr_large_entry_shrinker,
- "nfs-xattr_large_entry");
+ ret = nfs4_xattr_shrinker_init(&nfs4_xattr_large_entry_shrinker,
+ &nfs4_xattr_large_entry_lru,
+ "nfs-xattr_large_entry");
if (!ret)
return 0;
- unregister_shrinker(&nfs4_xattr_entry_shrinker);
-out:
- unregister_shrinker(&nfs4_xattr_cache_shrinker);
-out1:
- list_lru_destroy(&nfs4_xattr_cache_lru);
+ nfs4_xattr_shrinker_destroy(&nfs4_xattr_entry_shrinker,
+ &nfs4_xattr_entry_lru);
out2:
- list_lru_destroy(&nfs4_xattr_entry_lru);
-out3:
- list_lru_destroy(&nfs4_xattr_large_entry_lru);
-out4:
+ nfs4_xattr_shrinker_destroy(&nfs4_xattr_cache_shrinker,
+ &nfs4_xattr_cache_lru);
+out1:
kmem_cache_destroy(nfs4_xattr_cache_cachep);
return ret;
@@ -1047,11 +1056,11 @@ int __init nfs4_xattr_cache_init(void)
void nfs4_xattr_cache_exit(void)
{
- unregister_shrinker(&nfs4_xattr_large_entry_shrinker);
- unregister_shrinker(&nfs4_xattr_entry_shrinker);
- unregister_shrinker(&nfs4_xattr_cache_shrinker);
- list_lru_destroy(&nfs4_xattr_large_entry_lru);
- list_lru_destroy(&nfs4_xattr_entry_lru);
- list_lru_destroy(&nfs4_xattr_cache_lru);
+ nfs4_xattr_shrinker_destroy(&nfs4_xattr_large_entry_shrinker,
+ &nfs4_xattr_large_entry_lru);
+ nfs4_xattr_shrinker_destroy(&nfs4_xattr_entry_shrinker,
+ &nfs4_xattr_entry_lru);
+ nfs4_xattr_shrinker_destroy(&nfs4_xattr_cache_shrinker,
+ &nfs4_xattr_cache_lru);
kmem_cache_destroy(nfs4_xattr_cache_cachep);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 348/591] NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 347/591] NFSv4.2: fix wrong shrinker_id Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 349/591] SMB3: Do not send lease break acknowledgment if all file handles have been closed Greg Kroah-Hartman
` (246 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Kornievskaia, Trond Myklebust,
Sasha Levin
From: Olga Kornievskaia <kolga@netapp.com>
[ Upstream commit c907e72f58ed979a24a9fdcadfbc447c51d5e509 ]
When the client received NFS4ERR_BADSESSION, it schedules recovery
and start the state manager thread which in turn freezes the
session table and does not allow for any new requests to use the
no-longer valid session. However, it is possible that before
the state manager thread runs, a new operation would use the
released slot that received BADSESSION and was therefore not
updated its sequence number. Such re-use of the slot can lead
the application errors.
Fixes: 5c441544f045 ("NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process()")
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 70e76359909cc..177cb7b089b9a 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -921,6 +921,7 @@ static int nfs41_sequence_process(struct rpc_task *task,
out_noaction:
return ret;
session_recover:
+ set_bit(NFS4_SLOT_TBL_DRAINING, &session->fc_slot_table.slot_tbl_state);
nfs4_schedule_session_recovery(session, status);
dprintk("%s ERROR: %d Reset session\n", __func__, status);
nfs41_sequence_free_slot(res);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 349/591] SMB3: Do not send lease break acknowledgment if all file handles have been closed
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 348/591] NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 350/591] dax: Fix dax_mapping_release() use after free Greg Kroah-Hartman
` (245 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Talpey, Bharath SM, Steve French,
Sasha Levin
From: Bharath SM <bharathsm@microsoft.com>
[ Upstream commit da787d5b74983f7525d1eb4b9c0b4aff2821511a ]
In case if all existing file handles are deferred handles and if all of
them gets closed due to handle lease break then we dont need to send
lease break acknowledgment to server, because last handle close will be
considered as lease break ack.
After closing deferred handels, we check for openfile list of inode,
if its empty then we skip sending lease break ack.
Fixes: 59a556aebc43 ("SMB3: drop reference to cfile before sending oplock break")
Reviewed-by: Tom Talpey <tom@talpey.com>
Signed-off-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/file.c | 25 ++++++++++++-------------
1 file changed, 12 insertions(+), 13 deletions(-)
diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c
index 87dcffece7623..9a367d4c74e47 100644
--- a/fs/smb/client/file.c
+++ b/fs/smb/client/file.c
@@ -5140,20 +5140,19 @@ void cifs_oplock_break(struct work_struct *work)
_cifsFileInfo_put(cfile, false /* do not wait for ourself */, false);
/*
- * releasing stale oplock after recent reconnect of smb session using
- * a now incorrect file handle is not a data integrity issue but do
- * not bother sending an oplock release if session to server still is
- * disconnected since oplock already released by the server
+ * MS-SMB2 3.2.5.19.1 and 3.2.5.19.2 (and MS-CIFS 3.2.5.42) do not require
+ * an acknowledgment to be sent when the file has already been closed.
+ * check for server null, since can race with kill_sb calling tree disconnect.
*/
- if (!oplock_break_cancelled) {
- /* check for server null since can race with kill_sb calling tree disconnect */
- if (tcon->ses && tcon->ses->server) {
- rc = tcon->ses->server->ops->oplock_response(tcon, persistent_fid,
- volatile_fid, net_fid, cinode);
- cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
- } else
- pr_warn_once("lease break not sent for unmounted share\n");
- }
+ spin_lock(&cinode->open_file_lock);
+ if (tcon->ses && tcon->ses->server && !oplock_break_cancelled &&
+ !list_empty(&cinode->openFileList)) {
+ spin_unlock(&cinode->open_file_lock);
+ rc = tcon->ses->server->ops->oplock_response(tcon, persistent_fid,
+ volatile_fid, net_fid, cinode);
+ cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
+ } else
+ spin_unlock(&cinode->open_file_lock);
cifs_done_oplock_break(cinode);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 350/591] dax: Fix dax_mapping_release() use after free
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 349/591] SMB3: Do not send lease break acknowledgment if all file handles have been closed Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 351/591] dax: Introduce alloc_dev_dax_id() Greg Kroah-Hartman
` (244 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Williams, Dave Jiang, Fan Ni,
Ira Weiny, Vishal Verma, Sasha Levin
From: Dan Williams <dan.j.williams@intel.com>
[ Upstream commit 6d24b170a9db0456f577b1ab01226a2254c016a8 ]
A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region
provider (like modprobe -r dax_hmem) yields:
kobject: 'mapping0' (ffff93eb460e8800): kobject_release, parent 0000000000000000 (delayed 2000)
[..]
DEBUG_LOCKS_WARN_ON(1)
WARNING: CPU: 23 PID: 282 at kernel/locking/lockdep.c:232 __lock_acquire+0x9fc/0x2260
[..]
RIP: 0010:__lock_acquire+0x9fc/0x2260
[..]
Call Trace:
<TASK>
[..]
lock_acquire+0xd4/0x2c0
? ida_free+0x62/0x130
_raw_spin_lock_irqsave+0x47/0x70
? ida_free+0x62/0x130
ida_free+0x62/0x130
dax_mapping_release+0x1f/0x30
device_release+0x36/0x90
kobject_delayed_cleanup+0x46/0x150
Due to attempting ida_free() on an ida object that has already been
freed. Devices typically only hold a reference on their parent while
registered. If a child needs a parent object to complete its release it
needs to hold a reference that it drops from its release callback.
Arrange for a dax_mapping to pin its parent dev_dax instance until
dax_mapping_release().
Fixes: 0b07ce872a9e ("device-dax: introduce 'mapping' devices")
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Link: https://lore.kernel.org/r/168577283412.1672036.16111545266174261446.stgit@dwillia2-xfh.jf.intel.com
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dax/bus.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
index c64e7076537cb..d7a838f651813 100644
--- a/drivers/dax/bus.c
+++ b/drivers/dax/bus.c
@@ -621,10 +621,12 @@ EXPORT_SYMBOL_GPL(alloc_dax_region);
static void dax_mapping_release(struct device *dev)
{
struct dax_mapping *mapping = to_dax_mapping(dev);
- struct dev_dax *dev_dax = to_dev_dax(dev->parent);
+ struct device *parent = dev->parent;
+ struct dev_dax *dev_dax = to_dev_dax(parent);
ida_free(&dev_dax->ida, mapping->id);
kfree(mapping);
+ put_device(parent);
}
static void unregister_dax_mapping(void *data)
@@ -764,6 +766,7 @@ static int devm_register_dax_mapping(struct dev_dax *dev_dax, int range_id)
dev = &mapping->dev;
device_initialize(dev);
dev->parent = &dev_dax->dev;
+ get_device(dev->parent);
dev->type = &dax_mapping_type;
dev_set_name(dev, "mapping%d", mapping->id);
rc = device_add(dev);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 351/591] dax: Introduce alloc_dev_dax_id()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 350/591] dax: Fix dax_mapping_release() use after free Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 352/591] dax/kmem: Pass valid argument to memory_group_register_static Greg Kroah-Hartman
` (243 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yongqiang Liu, Paul Cassella,
Ira Weiny, Dan Williams, Vishal Verma, Sasha Levin
From: Dan Williams <dan.j.williams@intel.com>
[ Upstream commit 70aab281e18c68a1284bc387de127c2fc0bed3f8 ]
The reference counting of dax_region objects is needlessly complicated,
has lead to confusion [1], and has hidden a bug [2]. Towards cleaning up
that mess introduce alloc_dev_dax_id() to minimize the holding of a
dax_region reference to only what dev_dax_release() needs, the
dax_region->ida.
Part of the reason for the mess was the design to dereference a
dax_region in all cases in free_dev_dax_id() even if the id was
statically assigned by the upper level dax_region driver. Remove the
need to call "is_static(dax_region)" by tracking whether the id is
dynamic directly in the dev_dax instance itself.
With that flag the dax_region pinning and release per dev_dax instance
can move to alloc_dev_dax_id() and free_dev_dax_id() respectively.
A follow-on cleanup address the unnecessary references in the dax_region
setup and drivers.
Fixes: 0f3da14a4f05 ("device-dax: introduce 'seed' devices")
Link: http://lore.kernel.org/r/20221203095858.612027-1-liuyongqiang13@huawei.com [1]
Link: http://lore.kernel.org/r/3cf0890b-4eb0-e70e-cd9c-2ecc3d496263@hpe.com [2]
Reported-by: Yongqiang Liu <liuyongqiang13@huawei.com>
Reported-by: Paul Cassella <cassella@hpe.com>
Reported-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Link: https://lore.kernel.org/r/168577284563.1672036.13493034988900989554.stgit@dwillia2-xfh.jf.intel.com
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dax/bus.c | 56 ++++++++++++++++++++++++---------------
drivers/dax/dax-private.h | 4 ++-
2 files changed, 37 insertions(+), 23 deletions(-)
diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
index d7a838f651813..3a9348c7f7289 100644
--- a/drivers/dax/bus.c
+++ b/drivers/dax/bus.c
@@ -432,18 +432,34 @@ static void unregister_dev_dax(void *dev)
put_device(dev);
}
+static void dax_region_free(struct kref *kref)
+{
+ struct dax_region *dax_region;
+
+ dax_region = container_of(kref, struct dax_region, kref);
+ kfree(dax_region);
+}
+
+void dax_region_put(struct dax_region *dax_region)
+{
+ kref_put(&dax_region->kref, dax_region_free);
+}
+EXPORT_SYMBOL_GPL(dax_region_put);
+
/* a return value >= 0 indicates this invocation invalidated the id */
static int __free_dev_dax_id(struct dev_dax *dev_dax)
{
- struct dax_region *dax_region = dev_dax->region;
struct device *dev = &dev_dax->dev;
+ struct dax_region *dax_region;
int rc = dev_dax->id;
device_lock_assert(dev);
- if (is_static(dax_region) || dev_dax->id < 0)
+ if (!dev_dax->dyn_id || dev_dax->id < 0)
return -1;
+ dax_region = dev_dax->region;
ida_free(&dax_region->ida, dev_dax->id);
+ dax_region_put(dax_region);
dev_dax->id = -1;
return rc;
}
@@ -459,6 +475,20 @@ static int free_dev_dax_id(struct dev_dax *dev_dax)
return rc;
}
+static int alloc_dev_dax_id(struct dev_dax *dev_dax)
+{
+ struct dax_region *dax_region = dev_dax->region;
+ int id;
+
+ id = ida_alloc(&dax_region->ida, GFP_KERNEL);
+ if (id < 0)
+ return id;
+ kref_get(&dax_region->kref);
+ dev_dax->dyn_id = true;
+ dev_dax->id = id;
+ return id;
+}
+
static ssize_t delete_store(struct device *dev, struct device_attribute *attr,
const char *buf, size_t len)
{
@@ -546,20 +576,6 @@ static const struct attribute_group *dax_region_attribute_groups[] = {
NULL,
};
-static void dax_region_free(struct kref *kref)
-{
- struct dax_region *dax_region;
-
- dax_region = container_of(kref, struct dax_region, kref);
- kfree(dax_region);
-}
-
-void dax_region_put(struct dax_region *dax_region)
-{
- kref_put(&dax_region->kref, dax_region_free);
-}
-EXPORT_SYMBOL_GPL(dax_region_put);
-
static void dax_region_unregister(void *region)
{
struct dax_region *dax_region = region;
@@ -1284,12 +1300,10 @@ static const struct attribute_group *dax_attribute_groups[] = {
static void dev_dax_release(struct device *dev)
{
struct dev_dax *dev_dax = to_dev_dax(dev);
- struct dax_region *dax_region = dev_dax->region;
struct dax_device *dax_dev = dev_dax->dax_dev;
put_dax(dax_dev);
free_dev_dax_id(dev_dax);
- dax_region_put(dax_region);
kfree(dev_dax->pgmap);
kfree(dev_dax);
}
@@ -1313,6 +1327,7 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
if (!dev_dax)
return ERR_PTR(-ENOMEM);
+ dev_dax->region = dax_region;
if (is_static(dax_region)) {
if (dev_WARN_ONCE(parent, data->id < 0,
"dynamic id specified to static region\n")) {
@@ -1328,13 +1343,11 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
goto err_id;
}
- rc = ida_alloc(&dax_region->ida, GFP_KERNEL);
+ rc = alloc_dev_dax_id(dev_dax);
if (rc < 0)
goto err_id;
- dev_dax->id = rc;
}
- dev_dax->region = dax_region;
dev = &dev_dax->dev;
device_initialize(dev);
dev_set_name(dev, "dax%d.%d", dax_region->id, dev_dax->id);
@@ -1375,7 +1388,6 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
dev_dax->target_node = dax_region->target_node;
dev_dax->align = dax_region->align;
ida_init(&dev_dax->ida);
- kref_get(&dax_region->kref);
inode = dax_inode(dax_dev);
dev->devt = inode->i_rdev;
diff --git a/drivers/dax/dax-private.h b/drivers/dax/dax-private.h
index 1c974b7caae6e..afcada6fd2eda 100644
--- a/drivers/dax/dax-private.h
+++ b/drivers/dax/dax-private.h
@@ -52,7 +52,8 @@ struct dax_mapping {
* @region - parent region
* @dax_dev - core dax functionality
* @target_node: effective numa node if dev_dax memory range is onlined
- * @id: ida allocated id
+ * @dyn_id: is this a dynamic or statically created instance
+ * @id: ida allocated id when the dax_region is not static
* @ida: mapping id allocator
* @dev - device core
* @pgmap - pgmap for memmap setup / lifetime (driver owned)
@@ -64,6 +65,7 @@ struct dev_dax {
struct dax_device *dax_dev;
unsigned int align;
int target_node;
+ bool dyn_id;
int id;
struct ida ida;
struct device dev;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 352/591] dax/kmem: Pass valid argument to memory_group_register_static
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 351/591] dax: Introduce alloc_dev_dax_id() Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 353/591] hwrng: st - keep clock enabled while hwrng is registered Greg Kroah-Hartman
` (242 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tarun Sahu, Vishal Verma,
Sasha Levin
From: Tarun Sahu <tsahu@linux.ibm.com>
[ Upstream commit 46e66dab8565f742374e9cc4ff7d35f344d774e2 ]
memory_group_register_static takes maximum number of pages as the argument
while dev_dax_kmem_probe passes total_len (in bytes) as the argument.
IIUC, I don't see any crash/panic impact as such. As,
memory_group_register_static just set the max_pages limit which is used in
auto_movable_zone_for_pfn to determine the zone.
which might cause these condition to behave differently,
This will be true always so jump will happen to kernel_zone
...
if (!auto_movable_can_online_movable(NUMA_NO_NODE, group, nr_pages))
goto kernel_zone;
...
kernel_zone:
return default_kernel_zone_for_pfn(nid, pfn, nr_pages);
Here, In below, zone_intersects compare range will be larger as nr_pages
will be higher (derived from total_len passed in dev_dax_kmem_probe).
...
static struct zone *default_kernel_zone_for_pfn(int nid, unsigned long start_pfn,
unsigned long nr_pages)
{
struct pglist_data *pgdat = NODE_DATA(nid);
int zid;
for (zid = 0; zid < ZONE_NORMAL; zid++) {
struct zone *zone = &pgdat->node_zones[zid];
if (zone_intersects(zone, start_pfn, nr_pages))
return zone;
}
return &pgdat->node_zones[ZONE_NORMAL];
}
Incorrect zone will be returned here, which in later time might cause bigger
problem.
Fixes: eedf634aac3b ("dax/kmem: use a single static memory group for a single probed unit")
Signed-off-by: Tarun Sahu <tsahu@linux.ibm.com>
Link: https://lore.kernel.org/r/20230621155025.370672-1-tsahu@linux.ibm.com
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dax/kmem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dax/kmem.c b/drivers/dax/kmem.c
index 4aa758a2b3d1b..1a33616ceb06e 100644
--- a/drivers/dax/kmem.c
+++ b/drivers/dax/kmem.c
@@ -99,7 +99,7 @@ static int dev_dax_kmem_probe(struct dev_dax *dev_dax)
if (!data->res_name)
goto err_res_name;
- rc = memory_group_register_static(numa_node, total_len);
+ rc = memory_group_register_static(numa_node, PFN_UP(total_len));
if (rc < 0)
goto err_reg_mgid;
data->mgid = rc;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 353/591] hwrng: st - keep clock enabled while hwrng is registered
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 352/591] dax/kmem: Pass valid argument to memory_group_register_static Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 354/591] kbuild: Disable GCOV for *.mod.o Greg Kroah-Hartman
` (241 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Martin Kaiser, Herbert Xu,
Sasha Levin
From: Martin Kaiser <martin@kaiser.cx>
[ Upstream commit 501e197a02d4aef157f53ba3a0b9049c3e52fedc ]
The st-rng driver uses devres to register itself with the hwrng core,
the driver will be unregistered from hwrng when its device goes out of
scope. This happens after the driver's remove function is called.
However, st-rng's clock is disabled in the remove function. There's a
short timeframe where st-rng is still registered with the hwrng core
although its clock is disabled. I suppose the clock must be active to
access the hardware and serve requests from the hwrng core.
Switch to devm_clk_get_enabled and let devres disable the clock and
unregister the hwrng. This avoids the race condition.
Fixes: 3e75241be808 ("hwrng: drivers - Use device-managed registration API")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/st-rng.c | 21 +--------------------
1 file changed, 1 insertion(+), 20 deletions(-)
diff --git a/drivers/char/hw_random/st-rng.c b/drivers/char/hw_random/st-rng.c
index 15ba1e6fae4d2..6e9dfac9fc9f4 100644
--- a/drivers/char/hw_random/st-rng.c
+++ b/drivers/char/hw_random/st-rng.c
@@ -42,7 +42,6 @@
struct st_rng_data {
void __iomem *base;
- struct clk *clk;
struct hwrng ops;
};
@@ -85,26 +84,18 @@ static int st_rng_probe(struct platform_device *pdev)
if (IS_ERR(base))
return PTR_ERR(base);
- clk = devm_clk_get(&pdev->dev, NULL);
+ clk = devm_clk_get_enabled(&pdev->dev, NULL);
if (IS_ERR(clk))
return PTR_ERR(clk);
- ret = clk_prepare_enable(clk);
- if (ret)
- return ret;
-
ddata->ops.priv = (unsigned long)ddata;
ddata->ops.read = st_rng_read;
ddata->ops.name = pdev->name;
ddata->base = base;
- ddata->clk = clk;
-
- dev_set_drvdata(&pdev->dev, ddata);
ret = devm_hwrng_register(&pdev->dev, &ddata->ops);
if (ret) {
dev_err(&pdev->dev, "Failed to register HW RNG\n");
- clk_disable_unprepare(clk);
return ret;
}
@@ -113,15 +104,6 @@ static int st_rng_probe(struct platform_device *pdev)
return 0;
}
-static int st_rng_remove(struct platform_device *pdev)
-{
- struct st_rng_data *ddata = dev_get_drvdata(&pdev->dev);
-
- clk_disable_unprepare(ddata->clk);
-
- return 0;
-}
-
static const struct of_device_id st_rng_match[] __maybe_unused = {
{ .compatible = "st,rng" },
{},
@@ -134,7 +116,6 @@ static struct platform_driver st_rng_driver = {
.of_match_table = of_match_ptr(st_rng_match),
},
.probe = st_rng_probe,
- .remove = st_rng_remove
};
module_platform_driver(st_rng_driver);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 354/591] kbuild: Disable GCOV for *.mod.o
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 353/591] hwrng: st - keep clock enabled while hwrng is registered Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 355/591] efi/libstub: Disable PCI DMA before grabbing the EFI memory map Greg Kroah-Hartman
` (240 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joe Fradley, Sami Tolvanen,
Peter Zijlstra (Intel), Kees Cook, Nick Desaulniers,
Masahiro Yamada, Sasha Levin
From: Sami Tolvanen <samitolvanen@google.com>
[ Upstream commit 25a21fbb934a0d989e1858f83c2ddf4cfb2ebe30 ]
With GCOV_PROFILE_ALL, Clang injects __llvm_gcov_* functions to each
object file, including the *.mod.o. As we filter out CC_FLAGS_CFI
for *.mod.o, the compiler won't generate type hashes for the
injected functions, and therefore indirectly calling them during
module loading trips indirect call checking.
Enabling CFI for *.mod.o isn't sufficient to fix this issue after
commit 0c3e806ec0f9 ("x86/cfi: Add boot time hash randomization"),
as *.mod.o aren't processed by objtool, which means any hashes
emitted there won't be randomized. Therefore, in addition to
disabling CFI for *.mod.o, also disable GCOV, as the object files
don't otherwise contain any executable code.
Fixes: cf68fffb66d6 ("add support for Clang CFI")
Reported-by: Joe Fradley <joefradley@google.com>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/Makefile.modfinal | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/Makefile.modfinal b/scripts/Makefile.modfinal
index 25bedd83644b0..3af5e5807983a 100644
--- a/scripts/Makefile.modfinal
+++ b/scripts/Makefile.modfinal
@@ -23,7 +23,7 @@ modname = $(notdir $(@:.mod.o=))
part-of-module = y
quiet_cmd_cc_o_c = CC [M] $@
- cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI), $(c_flags)) -c -o $@ $<
+ cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV), $(c_flags)) -c -o $@ $<
%.mod.o: %.mod.c FORCE
$(call if_changed_dep,cc_o_c)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 355/591] efi/libstub: Disable PCI DMA before grabbing the EFI memory map
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 354/591] kbuild: Disable GCOV for *.mod.o Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 356/591] cifs: prevent use-after-free by freeing the cfile later Greg Kroah-Hartman
` (239 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Glenn Washburn, Matthew Garrett,
Ard Biesheuvel, Sasha Levin
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit 2e28a798c3092ea42b968fa16ac835969d124898 ]
Currently, the EFI stub will disable PCI DMA as the very last thing it
does before calling ExitBootServices(), to avoid interfering with the
firmware's normal operation as much as possible.
However, the stub will invoke DisconnectController() on all endpoints
downstream of the PCI bridges it disables, and this may affect the
layout of the EFI memory map, making it substantially more likely that
ExitBootServices() will fail the first time around, and that the EFI
memory map needs to be reloaded.
This, in turn, increases the likelihood that the slack space we
allocated is insufficient (and we can no longer allocate memory via boot
services after having called ExitBootServices() once), causing the
second call to GetMemoryMap (and therefore the boot) to fail. This makes
the PCI DMA disable feature a bit more fragile than it already is, so
let's make it more robust, by allocating the space for the EFI memory
map after disabling PCI DMA.
Fixes: 4444f8541dad16fe ("efi: Allow disabling PCI busmastering on bridges during boot")
Reported-by: Glenn Washburn <development@efficientek.com>
Acked-by: Matthew Garrett <mjg59@srcf.ucam.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/libstub/efi-stub-helper.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 0c493521b25b8..3d9b2469a0dfd 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -521,6 +521,9 @@ efi_status_t efi_exit_boot_services(void *handle, void *priv,
struct efi_boot_memmap *map;
efi_status_t status;
+ if (efi_disable_pci_dma)
+ efi_pci_disable_bridge_busmaster();
+
status = efi_get_memory_map(&map, true);
if (status != EFI_SUCCESS)
return status;
@@ -531,9 +534,6 @@ efi_status_t efi_exit_boot_services(void *handle, void *priv,
return status;
}
- if (efi_disable_pci_dma)
- efi_pci_disable_bridge_busmaster();
-
status = efi_bs_call(exit_boot_services, handle, map->map_key);
if (status == EFI_INVALID_PARAMETER) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 356/591] cifs: prevent use-after-free by freeing the cfile later
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 355/591] efi/libstub: Disable PCI DMA before grabbing the EFI memory map Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 357/591] cifs: do all necessary checks for credits within or before locking Greg Kroah-Hartman
` (238 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (SUSE),
Shyam Prasad N, Steve French, Sasha Levin
From: Shyam Prasad N <sprasad@microsoft.com>
[ Upstream commit 33f736187d08f6bc822117629f263b97d3df4165 ]
In smb2_compound_op we have a possible use-after-free
which can cause hard to debug problems later on.
This was revealed during stress testing with KASAN enabled
kernel. Fixing it by moving the cfile free call to
a few lines below, after the usage.
Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2inode.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
index c97e049e29dd3..57526bdbab171 100644
--- a/fs/smb/client/smb2inode.c
+++ b/fs/smb/client/smb2inode.c
@@ -397,9 +397,6 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
rsp_iov);
finished:
- if (cfile)
- cifsFileInfo_put(cfile);
-
SMB2_open_free(&rqst[0]);
if (rc == -EREMCHG) {
pr_warn_once("server share %s deleted\n", tcon->tree_name);
@@ -513,6 +510,9 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
break;
}
+ if (cfile)
+ cifsFileInfo_put(cfile);
+
if (rc && err_iov && err_buftype) {
memcpy(err_iov, rsp_iov, 3 * sizeof(*err_iov));
memcpy(err_buftype, resp_buftype, 3 * sizeof(*err_buftype));
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 357/591] cifs: do all necessary checks for credits within or before locking
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 356/591] cifs: prevent use-after-free by freeing the cfile later Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 358/591] smb: client: fix broken file attrs with nodfs mounts Greg Kroah-Hartman
` (237 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shyam Prasad N, Steve French,
Sasha Levin
From: Shyam Prasad N <sprasad@microsoft.com>
[ Upstream commit 326a8d04f147e2bf393f6f9cdb74126ee6900607 ]
All the server credits and in-flight info is protected by req_lock.
Once the req_lock is held, and we've determined that we have enough
credits to continue, this lock cannot be dropped till we've made the
changes to credits and in-flight count.
However, we used to drop the lock in order to avoid deadlock with
the recent srv_lock. This could cause the checks already made to be
invalidated.
Fixed it by moving the server status check to before locking req_lock.
Fixes: d7d7a66aacd6 ("cifs: avoid use of global locks for high contention data")
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2ops.c | 19 ++++++++++---------
fs/smb/client/transport.c | 20 ++++++++++----------
2 files changed, 20 insertions(+), 19 deletions(-)
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index d512440d35b6f..e6a191a7499e8 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -208,6 +208,16 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
spin_lock(&server->req_lock);
while (1) {
+ spin_unlock(&server->req_lock);
+
+ spin_lock(&server->srv_lock);
+ if (server->tcpStatus == CifsExiting) {
+ spin_unlock(&server->srv_lock);
+ return -ENOENT;
+ }
+ spin_unlock(&server->srv_lock);
+
+ spin_lock(&server->req_lock);
if (server->credits <= 0) {
spin_unlock(&server->req_lock);
cifs_num_waiters_inc(server);
@@ -218,15 +228,6 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
return rc;
spin_lock(&server->req_lock);
} else {
- spin_unlock(&server->req_lock);
- spin_lock(&server->srv_lock);
- if (server->tcpStatus == CifsExiting) {
- spin_unlock(&server->srv_lock);
- return -ENOENT;
- }
- spin_unlock(&server->srv_lock);
-
- spin_lock(&server->req_lock);
scredits = server->credits;
/* can deadlock with reopen */
if (scredits <= 8) {
diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c
index c961b90f92b9f..e03ffcf7e201c 100644
--- a/fs/smb/client/transport.c
+++ b/fs/smb/client/transport.c
@@ -549,6 +549,16 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits,
}
while (1) {
+ spin_unlock(&server->req_lock);
+
+ spin_lock(&server->srv_lock);
+ if (server->tcpStatus == CifsExiting) {
+ spin_unlock(&server->srv_lock);
+ return -ENOENT;
+ }
+ spin_unlock(&server->srv_lock);
+
+ spin_lock(&server->req_lock);
if (*credits < num_credits) {
scredits = *credits;
spin_unlock(&server->req_lock);
@@ -574,15 +584,6 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits,
return -ERESTARTSYS;
spin_lock(&server->req_lock);
} else {
- spin_unlock(&server->req_lock);
-
- spin_lock(&server->srv_lock);
- if (server->tcpStatus == CifsExiting) {
- spin_unlock(&server->srv_lock);
- return -ENOENT;
- }
- spin_unlock(&server->srv_lock);
-
/*
* For normal commands, reserve the last MAX_COMPOUND
* credits to compound requests.
@@ -596,7 +597,6 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits,
* for servers that are slow to hand out credits on
* new sessions.
*/
- spin_lock(&server->req_lock);
if (!optype && num_credits == 1 &&
server->in_flight > 2 * MAX_COMPOUND &&
*credits <= MAX_COMPOUND) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 358/591] smb: client: fix broken file attrs with nodfs mounts
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 357/591] cifs: do all necessary checks for credits within or before locking Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 359/591] ksmbd: avoid field overflow warning Greg Kroah-Hartman
` (236 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (SUSE), Steve French,
Sasha Levin
From: Paulo Alcantara <pc@manguebit.com>
[ Upstream commit d439b29057e26464120fc6c18f97433aa003b5fe ]
*_get_inode_info() functions expect -EREMOTE when query path info
calls find a DFS link, regardless whether !CONFIG_CIFS_DFS_UPCALL or
'nodfs' mount option. Otherwise, those files will miss the fake DFS
file attributes.
Before patch
$ mount.cifs //srv/dfs /mnt/1 -o ...,nodfs
$ ls -l /mnt/1
ls: cannot access '/mnt/1/link': Operation not supported
total 0
-rwxr-xr-x 1 root root 0 Jul 26 2022 dfstest2_file1.txt
drwxr-xr-x 2 root root 0 Aug 8 2022 dir1
d????????? ? ? ? ? ? link
After patch
$ mount.cifs //srv/dfs /mnt/1 -o ...,nodfs
$ ls -l /mnt/1
total 0
-rwxr-xr-x 1 root root 0 Jul 26 2022 dfstest2_file1.txt
drwxr-xr-x 2 root root 0 Aug 8 2022 dir1
drwx--x--x 2 root root 0 Jun 26 20:29 link
Fixes: c877ce47e137 ("cifs: reduce roundtrips on create/qinfo requests")
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2inode.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
index 57526bdbab171..5ddc629e62168 100644
--- a/fs/smb/client/smb2inode.c
+++ b/fs/smb/client/smb2inode.c
@@ -592,9 +592,6 @@ int smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
if (islink)
rc = -EREMOTE;
}
- if (rc == -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && cifs_sb &&
- (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS))
- rc = -EOPNOTSUPP;
}
out:
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 359/591] ksmbd: avoid field overflow warning
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 358/591] smb: client: fix broken file attrs with nodfs mounts Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 360/591] arm64: sme: Use STR P to clear FFR context field in streaming SVE mode Greg Kroah-Hartman
` (235 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Namjae Jeon,
Steve French, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 9cedc58bdbe9fff9aacd0ca19ee5777659f28fd7 ]
clang warns about a possible field overflow in a memcpy:
In file included from fs/smb/server/smb_common.c:7:
include/linux/fortify-string.h:583:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
__write_overflow_field(p_size_field, size);
It appears to interpret the "&out[baselen + 4]" as referring to a single
byte of the character array, while the equivalen "out + baselen + 4" is
seen as an offset into the array.
I don't see that kind of warning elsewhere, so just go with the simple
rework.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/smb_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c
index 05d7f3e910bf4..d937e2f45c829 100644
--- a/fs/smb/server/smb_common.c
+++ b/fs/smb/server/smb_common.c
@@ -536,7 +536,7 @@ int ksmbd_extract_shortname(struct ksmbd_conn *conn, const char *longname,
out[baselen + 3] = PERIOD;
if (dot_present)
- memcpy(&out[baselen + 4], extension, 4);
+ memcpy(out + baselen + 4, extension, 4);
else
out[baselen + 4] = '\0';
smbConvertToUTF16((__le16 *)shortname, out, PATH_MAX,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 360/591] arm64: sme: Use STR P to clear FFR context field in streaming SVE mode
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 359/591] ksmbd: avoid field overflow warning Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 361/591] x86/efi: Make efi_set_virtual_address_map IBT safe Greg Kroah-Hartman
` (234 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Brown, Mark Rutland,
Naresh Kamboju, Linux Kernel Functional Testing, Will Deacon,
Anders Roxell, Catalin Marinas, Sasha Levin
From: Will Deacon <will@kernel.org>
[ Upstream commit 893b24181b4c4bf1fa2841b1ed192e5413a97cb1 ]
The FFR is a predicate register which can vary between 16 and 256 bits
in size depending upon the configured vector length. When saving the
SVE state in streaming SVE mode, the FFR register is inaccessible and
so commit 9f5848665788 ("arm64/sve: Make access to FFR optional") simply
clears the FFR field of the in-memory context structure. Unfortunately,
it achieves this using an unconditional 8-byte store and so if the SME
vector length is anything other than 64 bytes in size we will either
fail to clear the entire field or, worse, we will corrupt memory
immediately following the structure. This has led to intermittent kfence
splats in CI [1] and can trigger kmalloc Redzone corruption messages
when running the 'fp-stress' kselftest:
| =============================================================================
| BUG kmalloc-1k (Not tainted): kmalloc Redzone overwritten
| -----------------------------------------------------------------------------
|
| 0xffff000809bf1e22-0xffff000809bf1e27 @offset=7714. First byte 0x0 instead of 0xcc
| Allocated in do_sme_acc+0x9c/0x220 age=2613 cpu=1 pid=531
| __kmalloc+0x8c/0xcc
| do_sme_acc+0x9c/0x220
| ...
Replace the 8-byte store with a store of a predicate register which has
been zero-initialised with PFALSE, ensuring that the entire field is
cleared in memory.
[1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com
Cc: Mark Brown <broonie@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
Fixes: 9f5848665788 ("arm64/sve: Make access to FFR optional")
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Tested-by: Anders Roxell <anders.roxell@linaro.org>
Link: https://lore.kernel.org/r/20230628155605.22296-1-will@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/fpsimdmacros.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/include/asm/fpsimdmacros.h b/arch/arm64/include/asm/fpsimdmacros.h
index 5e0910cf48321..696d247cf8fb0 100644
--- a/arch/arm64/include/asm/fpsimdmacros.h
+++ b/arch/arm64/include/asm/fpsimdmacros.h
@@ -294,12 +294,12 @@
_for n, 0, 15, _sve_str_p \n, \nxbase, \n - 16
cbz \save_ffr, 921f
_sve_rdffr 0
- _sve_str_p 0, \nxbase
- _sve_ldr_p 0, \nxbase, -16
b 922f
921:
- str xzr, [x\nxbase] // Zero out FFR
+ _sve_pfalse 0 // Zero out FFR
922:
+ _sve_str_p 0, \nxbase
+ _sve_ldr_p 0, \nxbase, -16
mrs x\nxtmp, fpsr
str w\nxtmp, [\xpfpsr]
mrs x\nxtmp, fpcr
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 361/591] x86/efi: Make efi_set_virtual_address_map IBT safe
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 360/591] arm64: sme: Use STR P to clear FFR context field in streaming SVE mode Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 362/591] md/raid1-10: fix casting from randomized structure in raid1_submit_write() Greg Kroah-Hartman
` (233 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklāvs Koļesņikovs,
Thomas Gleixner, Ard Biesheuvel, Sasha Levin
From: Thomas Gleixner <tglx@linutronix.de>
[ Upstream commit 0303c9729afc4094ef53e552b7b8cff7436028d6 ]
Niklāvs reported a boot regression on an Alderlake machine and bisected it
to commit 9df9d2f0471b ("init: Invoke arch_cpu_finalize_init() earlier").
By moving the invocation of arch_cpu_finalize_init() further down he
identified that efi_enter_virtual_mode() is the function which causes the
boot hang.
The main difference of the earlier invocation is that the boot CPU is
already fully initialized and mitigations and alternatives are applied.
But the only really interesting change turned out to be IBT, which is now
enabled before efi_enter_virtual_mode(). "ibt=off" on the kernel command
line cured the problem.
Inspection of the involved calls in efi_enter_virtual_mode() unearthed that
efi_set_virtual_address_map() is the only place in the kernel which invokes
an EFI call without the IBT safe wrapper. This went obviously unnoticed so
far as IBT was enabled later.
Use arch_efi_call_virt() instead of efi_call() to cure that.
Fixes: fe379fa4d199 ("x86/ibt: Disable IBT around firmware")
Fixes: 9df9d2f0471b ("init: Invoke arch_cpu_finalize_init() earlier")
Reported-by: Niklāvs Koļesņikovs <pinkflames.linux@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217602
Link: https://lore.kernel.org/r/87jzvm12q0.ffs@tglx
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/platform/efi/efi_64.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index b36596bf0fc38..601908bdbeadc 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -847,9 +847,9 @@ efi_set_virtual_address_map(unsigned long memory_map_size,
/* Disable interrupts around EFI calls: */
local_irq_save(flags);
- status = efi_call(efi.runtime->set_virtual_address_map,
- memory_map_size, descriptor_size,
- descriptor_version, virtual_map);
+ status = arch_efi_call_virt(efi.runtime, set_virtual_address_map,
+ memory_map_size, descriptor_size,
+ descriptor_version, virtual_map);
local_irq_restore(flags);
efi_fpu_end();
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 362/591] md/raid1-10: fix casting from randomized structure in raid1_submit_write()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 361/591] x86/efi: Make efi_set_virtual_address_map IBT safe Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 363/591] USB: serial: option: add LARA-R6 01B PIDs Greg Kroah-Hartman
` (232 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, kernel test robot, Yu Kuai, Song Liu
From: Yu Kuai <yukuai3@huawei.com>
commit b5a99602b74bbfa655be509c615181dd95b0719e upstream.
Following build error triggered while build with clang version 17.0.0
with W=1(this can't be reporduced with gcc 13.1.0):
drivers/md/raid1-10.c:117:25: error: casting from randomized structure
pointer type 'struct block_device *' to 'struct md_rdev *'
117 | struct md_rdev *rdev = (struct md_rdev *)bio->bi_bdev;
| ^
Fix this by casting 'bio->bi_bdev' to 'void *', as it used to be.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202306142042.fmjfmTF8-lkp@intel.com/
Fixes: 8295efbe68c0 ("md/raid1-10: factor out a helper to submit normal write")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230616012136.3047071-1-yukuai1@huaweicloud.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid1-10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/raid1-10.c
+++ b/drivers/md/raid1-10.c
@@ -113,7 +113,7 @@ static void md_bio_reset_resync_pages(st
static inline void raid1_submit_write(struct bio *bio)
{
- struct md_rdev *rdev = (struct md_rdev *)bio->bi_bdev;
+ struct md_rdev *rdev = (void *)bio->bi_bdev;
bio->bi_next = NULL;
bio_set_dev(bio, rdev->bdev);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 363/591] USB: serial: option: add LARA-R6 01B PIDs
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 362/591] md/raid1-10: fix casting from randomized structure in raid1_submit_write() Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 364/591] usb: dwc3: gadget: Propagate core init errors to UDC during pullup Greg Kroah-Hartman
` (231 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Davide Tronchin, Johan Hovold
From: Davide Tronchin <davide.tronchin.94@gmail.com>
commit ffa5f7a3bf28c1306eef85d4056539c2d4b8eb09 upstream.
The new LARA-R6 product variant identified by the "01B" string can be
configured (by AT interface) in three different USB modes:
* Default mode (Vendor ID: 0x1546 Product ID: 0x1311) with 4 serial
interfaces
* RmNet mode (Vendor ID: 0x1546 Product ID: 0x1312) with 4 serial
interfaces and 1 RmNet virtual network interface
* CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1313) with 4 serial
interface and 1 CDC-ECM virtual network interface
The first 4 interfaces of all the 3 USB configurations (default, RmNet,
CDC-ECM) are the same.
In default mode LARA-R6 01B exposes the following interfaces:
If 0: Diagnostic
If 1: AT parser
If 2: AT parser
If 3: AT parser/alternative functions
In RmNet mode LARA-R6 01B exposes the following interfaces:
If 0: Diagnostic
If 1: AT parser
If 2: AT parser
If 3: AT parser/alternative functions
If 4: RMNET interface
In CDC-ECM mode LARA-R6 01B exposes the following interfaces:
If 0: Diagnostic
If 1: AT parser
If 2: AT parser
If 3: AT parser/alternative functions
If 4: CDC-ECM interface
Signed-off-by: Davide Tronchin <davide.tronchin.94@gmail.com>
Link: https://lore.kernel.org/r/20230622092921.12651-1-davide.tronchin.94@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1151,6 +1151,10 @@ static const struct usb_device_id option
{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa),
.driver_info = RSVD(3) },
/* u-blox products */
+ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1311) }, /* u-blox LARA-R6 01B */
+ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1312), /* u-blox LARA-R6 01B (RMNET) */
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(UBLOX_VENDOR_ID, 0x1313, 0xff) }, /* u-blox LARA-R6 01B (ECM) */
{ USB_DEVICE(UBLOX_VENDOR_ID, 0x1341) }, /* u-blox LARA-L6 */
{ USB_DEVICE(UBLOX_VENDOR_ID, 0x1342), /* u-blox LARA-L6 (RMNET) */
.driver_info = RSVD(4) },
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 364/591] usb: dwc3: gadget: Propagate core init errors to UDC during pullup
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 363/591] USB: serial: option: add LARA-R6 01B PIDs Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 365/591] phy: tegra: xusb: Clear the driver reference in usb-phy dev Greg Kroah-Hartman
` (230 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Krishna Kurapati,
Thinh Nguyen
From: Krishna Kurapati <quic_kriskura@quicinc.com>
commit c0aabed9cabe057309779a9e26fe86a113d24dad upstream.
In scenarios where pullup relies on resume (get sync) to initialize
the controller and set the run stop bit, then core_init is followed by
gadget_resume which will eventually set run stop bit.
But in cases where the core_init fails, the return value is not sent
back to udc appropriately. So according to UDC the controller has
started but in reality we never set the run stop bit.
On systems like Android, there are uevents sent to HAL depending on
whether the configfs_bind / configfs_disconnect were invoked. In the
above mentioned scnenario, if the core init fails, the run stop won't
be set and the cable plug-out won't result in generation of any
disconnect event and userspace would never get any uevent regarding
cable plug out and we never call pullup(0) again. Furthermore none of
the next Plug-In/Plug-Out's would be known to configfs.
Return back the appropriate result to UDC to let the userspace/
configfs know that the pullup failed so they can take appropriate
action.
Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded")
Cc: stable <stable@kernel.org>
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Message-ID: <20230618120949.14868-1-quic_kriskura@quicinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/gadget.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2631,7 +2631,9 @@ static int dwc3_gadget_pullup(struct usb
ret = pm_runtime_get_sync(dwc->dev);
if (!ret || ret < 0) {
pm_runtime_put(dwc->dev);
- return 0;
+ if (ret < 0)
+ pm_runtime_set_suspended(dwc->dev);
+ return ret;
}
if (dwc->pullups_connected == is_on) {
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 365/591] phy: tegra: xusb: Clear the driver reference in usb-phy dev
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 364/591] usb: dwc3: gadget: Propagate core init errors to UDC during pullup Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 366/591] iio: adc: ad7192: Fix null ad7192_state pointer access Greg Kroah-Hartman
` (229 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, EJ Hsu, Haotien Hsu, Thierry Reding,
Jon Hunter, Vinod Koul
From: EJ Hsu <ejh@nvidia.com>
commit c0c2fcb1325d0d4f3b322b5ee49385f8eca2560d upstream.
For the dual-role port, it will assign the phy dev to usb-phy dev and
use the port dev driver as the dev driver of usb-phy.
When we try to destroy the port dev, it will destroy its dev driver
as well. But we did not remove the reference from usb-phy dev. This
might cause the use-after-free issue in KASAN.
Fixes: e8f7d2f409a1 ("phy: tegra: xusb: Add usb-phy support")
Cc: stable@vger.kernel.org
Signed-off-by: EJ Hsu <ejh@nvidia.com>
Signed-off-by: Haotien Hsu <haotienh@nvidia.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20230609062932.3276509-1-haotienh@nvidia.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/tegra/xusb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/phy/tegra/xusb.c
+++ b/drivers/phy/tegra/xusb.c
@@ -562,6 +562,7 @@ static void tegra_xusb_port_unregister(s
usb_role_switch_unregister(port->usb_role_sw);
cancel_work_sync(&port->usb_phy_work);
usb_remove_phy(&port->usb_phy);
+ port->usb_phy.dev->driver = NULL;
}
if (port->ops->remove)
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 366/591] iio: adc: ad7192: Fix null ad7192_state pointer access
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 365/591] phy: tegra: xusb: Clear the driver reference in usb-phy dev Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 367/591] iio: adc: ad7192: Fix internal/external clock selection Greg Kroah-Hartman
` (228 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabrizio Lamarque, Nuno Sa, Stable,
Jonathan Cameron
From: Fabrizio Lamarque <fl.scratchpad@gmail.com>
commit 9e58e3a6f8e1c483c86a04903b7b7aa0923e4426 upstream.
Pointer to indio_dev structure is obtained via spi_get_drvdata() at
the beginning of function ad7192_setup(), but the spi->dev->driver_data
member is not initialized, hence a NULL pointer is returned.
Fix by changing ad7192_setup() signature to take pointer to struct
iio_dev, and get ad7192_state pointer via st = iio_priv(indio_dev);
Fixes: bd5dcdeb3fd0 ("iio: adc: ad7192: convert to device-managed functions")
Signed-off-by: Fabrizio Lamarque <fl.scratchpad@gmail.com>
Reviewed-by: Nuno Sa <nuno.sa@analog.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230530075311.400686-2-fl.scratchpad@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad7192.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/iio/adc/ad7192.c
+++ b/drivers/iio/adc/ad7192.c
@@ -381,9 +381,9 @@ static int ad7192_of_clock_select(struct
return clock_sel;
}
-static int ad7192_setup(struct ad7192_state *st, struct device_node *np)
+static int ad7192_setup(struct iio_dev *indio_dev, struct device_node *np)
{
- struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi);
+ struct ad7192_state *st = iio_priv(indio_dev);
bool rej60_en, refin2_en;
bool buf_en, bipolar, burnout_curr_en;
unsigned long long scale_uv;
@@ -1078,7 +1078,7 @@ static int ad7192_probe(struct spi_devic
}
}
- ret = ad7192_setup(st, spi->dev.of_node);
+ ret = ad7192_setup(indio_dev, spi->dev.of_node);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 367/591] iio: adc: ad7192: Fix internal/external clock selection
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 366/591] iio: adc: ad7192: Fix null ad7192_state pointer access Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 368/591] iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF Greg Kroah-Hartman
` (227 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabrizio Lamarque, Nuno Sa, Stable,
Jonathan Cameron
From: Fabrizio Lamarque <fl.scratchpad@gmail.com>
commit f7d9e21dd274b97dc0a8dbc136a2ea8506063a96 upstream.
Fix wrong selection of internal clock when mclk is defined.
Resolve a logical inversion introduced in c9ec2cb328e3.
Fixes: c9ec2cb328e3 ("iio: adc: ad7192: use devm_clk_get_optional() for mclk")
Signed-off-by: Fabrizio Lamarque <fl.scratchpad@gmail.com>
Reviewed-by: Nuno Sa <nuno.sa@analog.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230530075311.400686-3-fl.scratchpad@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad7192.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/adc/ad7192.c
+++ b/drivers/iio/adc/ad7192.c
@@ -368,7 +368,7 @@ static int ad7192_of_clock_select(struct
clock_sel = AD7192_CLK_INT;
/* use internal clock */
- if (st->mclk) {
+ if (!st->mclk) {
if (of_property_read_bool(np, "adi,int-clock-output-enable"))
clock_sel = AD7192_CLK_INT_CO;
} else {
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 368/591] iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 367/591] iio: adc: ad7192: Fix internal/external clock selection Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 369/591] iio: accel: fxls8962af: fixup buffer scan element type Greg Kroah-Hartman
` (226 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Nyekjaer, Jonathan Cameron
From: Sean Nyekjaer <sean@geanix.com>
commit b410a9307bc3a7cdee3c930c98f6fc9cf1d2c484 upstream.
Remove special errata handling if FXLS8964AF is used.
Fixes: af959b7b96b8 ("iio: accel: fxls8962af: fix errata bug E3 - I2C burst reads")
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230605103223.1400980-2-sean@geanix.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/fxls8962af-core.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/iio/accel/fxls8962af-core.c
+++ b/drivers/iio/accel/fxls8962af-core.c
@@ -905,9 +905,10 @@ static int fxls8962af_fifo_transfer(stru
int total_length = samples * sample_length;
int ret;
- if (i2c_verify_client(dev))
+ if (i2c_verify_client(dev) &&
+ data->chip_info->chip_id == FXLS8962AF_DEVICE_ID)
/*
- * Due to errata bug:
+ * Due to errata bug (only applicable on fxls8962af):
* E3: FIFO burst read operation error using I2C interface
* We have to avoid burst reads on I2C..
*/
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 369/591] iio: accel: fxls8962af: fixup buffer scan element type
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 368/591] iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 370/591] Revert "drm/amd/display: edp do not add non-edid timings" Greg Kroah-Hartman
` (225 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Nyekjaer, Jonathan Cameron
From: Sean Nyekjaer <sean@geanix.com>
commit d1cfbd52ede5e5fabc09992894c5733b4057f159 upstream.
Scan elements for x,y,z channels is little endian and requires no bit shifts.
LE vs. BE is controlled in register SENS_CONFIG2 and bit LE_BE, default
value is LE.
Fixes: a3e0b51884ee ("iio: accel: add support for FXLS8962AF/FXLS8964AF accelerometers")
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230605103223.1400980-1-sean@geanix.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/fxls8962af-core.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/iio/accel/fxls8962af-core.c
+++ b/drivers/iio/accel/fxls8962af-core.c
@@ -725,8 +725,7 @@ static const struct iio_event_spec fxls8
.sign = 's', \
.realbits = 12, \
.storagebits = 16, \
- .shift = 4, \
- .endianness = IIO_BE, \
+ .endianness = IIO_LE, \
}, \
.event_spec = fxls8962af_event, \
.num_event_specs = ARRAY_SIZE(fxls8962af_event), \
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 370/591] Revert "drm/amd/display: edp do not add non-edid timings"
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 369/591] iio: accel: fxls8962af: fixup buffer scan element type Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 371/591] mm/mmap: Fix VM_LOCKED check in do_vmi_align_munmap() Greg Kroah-Hartman
` (224 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hersen Wu, Mario Limonciello,
Alex Deucher
From: Hersen Wu <hersenxs.wu@amd.com>
commit d6149086b45e150c170beaa4546495fd1880724c upstream.
This change causes regression when eDP and external display in mirror
mode. When external display supports low resolution than eDP, use eDP
timing to driver external display may cause corruption on external
display.
This reverts commit e749dd10e5f292061ad63d2b030194bf7d7d452c.
Cc: stable@vger.kernel.org
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2655
Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -6972,13 +6972,7 @@ static int amdgpu_dm_connector_get_modes
drm_add_modes_noedid(connector, 640, 480);
} else {
amdgpu_dm_connector_ddc_get_modes(connector, edid);
- /* most eDP supports only timings from its edid,
- * usually only detailed timings are available
- * from eDP edid. timings which are not from edid
- * may damage eDP
- */
- if (connector->connector_type != DRM_MODE_CONNECTOR_eDP)
- amdgpu_dm_connector_add_common_modes(encoder, connector);
+ amdgpu_dm_connector_add_common_modes(encoder, connector);
amdgpu_dm_connector_add_freesync_modes(connector, edid);
}
amdgpu_dm_fbc_init(connector);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 371/591] mm/mmap: Fix VM_LOCKED check in do_vmi_align_munmap()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 370/591] Revert "drm/amd/display: edp do not add non-edid timings" Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 372/591] ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook Greg Kroah-Hartman
` (223 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches,
Liam.Howlett@oracle.com, torvalds@linux-foundation.org, vegard.nossum@oracle.com, stable@vger.kernel.org, Suren Baghdasaryan,
Suren Baghdasaryan
From: Suren Baghdasaryan <surenb@google.com>
6.1 backport of the patch [1] uses 'next' vma instead of 'split' vma.
Fix the mistake.
[1] commit 606c812eb1d5 ("mm/mmap: Fix error path in do_vmi_align_munmap()")
Fixes: a149174ff8bb ("mm/mmap: Fix error path in do_vmi_align_munmap()")
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2484,7 +2484,7 @@ do_mas_align_munmap(struct ma_state *mas
error = mas_store_gfp(&mas_detach, split, GFP_KERNEL);
if (error)
goto munmap_gather_failed;
- if (next->vm_flags & VM_LOCKED)
+ if (split->vm_flags & VM_LOCKED)
locked_vm += vma_pages(split);
count++;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 372/591] ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 371/591] mm/mmap: Fix VM_LOCKED check in do_vmi_align_munmap() Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 373/591] ALSA: hda/realtek: Add quirk for Clevo NPx0SNx Greg Kroah-Hartman
` (222 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andy Chi, Takashi Iwai
From: Andy Chi <andy.chi@canonical.com>
commit e94f1f96f108ba96c0ed8bf3fbdd8ee6a6703880 upstream.
On HP EliteBook 835/845/845W G10, the audio LEDs can be enabled by
ALC285_FIXUP_HP_MUTE_LED. So use it accordingly.
Signed-off-by: Andy Chi <andy.chi@canonical.com>
Cc: <stable@vger.kernel.org>
Fixes: 3e10f6ca76c4 ("ALSA: hda/realtek: Add quirk for HP EliteBook G10 laptops")
Link: https://lore.kernel.org/r/20230626130301.301712-1-andy.chi@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index dabfdecece26..f64dd09692b5 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9490,9 +9490,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x103c, 0x8b63, "HP Elite Dragonfly 13.5 inch G4", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x8b65, "HP ProBook 455 15.6 inch G10 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
SND_PCI_QUIRK(0x103c, 0x8b66, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
- SND_PCI_QUIRK(0x103c, 0x8b70, "HP EliteBook 835 G10", ALC287_FIXUP_CS35L41_I2C_2),
- SND_PCI_QUIRK(0x103c, 0x8b72, "HP EliteBook 845 G10", ALC287_FIXUP_CS35L41_I2C_2),
- SND_PCI_QUIRK(0x103c, 0x8b74, "HP EliteBook 845W G10", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8b70, "HP EliteBook 835 G10", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8b72, "HP EliteBook 845 G10", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8b74, "HP EliteBook 845W G10", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x8b77, "HP ElieBook 865 G10", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x103c, 0x8b7a, "HP", ALC236_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x8b7d, "HP", ALC236_FIXUP_HP_GPIO_LED),
--
2.41.0
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 373/591] ALSA: hda/realtek: Add quirk for Clevo NPx0SNx
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 372/591] ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 374/591] ALSA: jack: Fix mutex call in snd_jack_report() Greg Kroah-Hartman
` (221 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Werner Sembach, Takashi Iwai
From: Werner Sembach <wse@tuxedocomputers.com>
commit 22065e4214c1196b54fc164892c2e193a743caf3 upstream.
This applies a SND_PCI_QUIRK(...) to the Clevo NPx0SNx barebones fixing the
microphone not being detected on the headset combo port.
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230628155434.584159-1-wse@tuxedocomputers.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9680,6 +9680,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL5[03]RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1558, 0xa600, "Clevo NL50NU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0xa650, "Clevo NP[567]0SN[CD]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1558, 0xa671, "Clevo NP70SN[CDE]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 374/591] ALSA: jack: Fix mutex call in snd_jack_report()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 373/591] ALSA: hda/realtek: Add quirk for Clevo NPx0SNx Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 375/591] ALSA: pcm: Fix potential data race at PCM memory allocation helpers Greg Kroah-Hartman
` (220 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter,
Amadeusz Sławiński, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit 89dbb335cb6a627a4067bc42caa09c8bc3326d40 upstream.
snd_jack_report() is supposed to be callable from an IRQ context, too,
and it's indeed used in that way from virtsnd driver. The fix for
input_dev race in commit 1b6a6fc5280e ("ALSA: jack: Access input_dev
under mutex"), however, introduced a mutex lock in snd_jack_report(),
and this resulted in a potential sleep-in-atomic.
For addressing that problem, this patch changes the relevant code to
use the object get/put and removes the mutex usage. That is,
snd_jack_report(), it takes input_get_device() and leaves with
input_put_device() for assuring the input_dev being assigned.
Although the whole mutex could be reduced, we keep it because it can
be still a protection for potential races between creation and
deletion.
Fixes: 1b6a6fc5280e ("ALSA: jack: Access input_dev under mutex")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/cf95f7fe-a748-4990-8378-000491b40329@moroto.mountain
Tested-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230706155357.3470-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/jack.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--- a/sound/core/jack.c
+++ b/sound/core/jack.c
@@ -654,6 +654,7 @@ void snd_jack_report(struct snd_jack *ja
struct snd_jack_kctl *jack_kctl;
unsigned int mask_bits = 0;
#ifdef CONFIG_SND_JACK_INPUT_DEV
+ struct input_dev *idev;
int i;
#endif
@@ -670,17 +671,15 @@ void snd_jack_report(struct snd_jack *ja
status & jack_kctl->mask_bits);
#ifdef CONFIG_SND_JACK_INPUT_DEV
- mutex_lock(&jack->input_dev_lock);
- if (!jack->input_dev) {
- mutex_unlock(&jack->input_dev_lock);
+ idev = input_get_device(jack->input_dev);
+ if (!idev)
return;
- }
for (i = 0; i < ARRAY_SIZE(jack->key); i++) {
int testbit = ((SND_JACK_BTN_0 >> i) & ~mask_bits);
if (jack->type & testbit)
- input_report_key(jack->input_dev, jack->key[i],
+ input_report_key(idev, jack->key[i],
status & testbit);
}
@@ -688,13 +687,13 @@ void snd_jack_report(struct snd_jack *ja
int testbit = ((1 << i) & ~mask_bits);
if (jack->type & testbit)
- input_report_switch(jack->input_dev,
+ input_report_switch(idev,
jack_switch_types[i],
status & testbit);
}
- input_sync(jack->input_dev);
- mutex_unlock(&jack->input_dev_lock);
+ input_sync(idev);
+ input_put_device(idev);
#endif /* CONFIG_SND_JACK_INPUT_DEV */
}
EXPORT_SYMBOL(snd_jack_report);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 375/591] ALSA: pcm: Fix potential data race at PCM memory allocation helpers
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 374/591] ALSA: jack: Fix mutex call in snd_jack_report() Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 376/591] block: fix signed int overflow in Amiga partition support Greg Kroah-Hartman
` (219 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, BassCheck, Tuo Li, Jaroslav Kysela,
Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit bd55842ed998a622ba6611fe59b3358c9f76773d upstream.
The PCM memory allocation helpers have a sanity check against too many
buffer allocations. However, the check is performed without a proper
lock and the allocation isn't serialized; this allows user to allocate
more memories than predefined max size.
Practically seen, this isn't really a big problem, as it's more or
less some "soft limit" as a sanity check, and it's not possible to
allocate unlimitedly. But it's still better to address this for more
consistent behavior.
The patch covers the size check in do_alloc_pages() with the
card->memory_mutex, and increases the allocated size there for
preventing the further overflow. When the actual allocation fails,
the size is decreased accordingly.
Reported-by: BassCheck <bass@buaa.edu.cn>
Reported-by: Tuo Li <islituo@gmail.com>
Link: https://lore.kernel.org/r/CADm8Tek6t0WedK+3Y6rbE5YEt19tML8BUL45N2ji4ZAz1KcN_A@mail.gmail.com
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230703112430.30634-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/pcm_memory.c | 44 ++++++++++++++++++++++++++++++++++++--------
1 file changed, 36 insertions(+), 8 deletions(-)
--- a/sound/core/pcm_memory.c
+++ b/sound/core/pcm_memory.c
@@ -31,15 +31,41 @@ static unsigned long max_alloc_per_card
module_param(max_alloc_per_card, ulong, 0644);
MODULE_PARM_DESC(max_alloc_per_card, "Max total allocation bytes per card.");
+static void __update_allocated_size(struct snd_card *card, ssize_t bytes)
+{
+ card->total_pcm_alloc_bytes += bytes;
+}
+
+static void update_allocated_size(struct snd_card *card, ssize_t bytes)
+{
+ mutex_lock(&card->memory_mutex);
+ __update_allocated_size(card, bytes);
+ mutex_unlock(&card->memory_mutex);
+}
+
+static void decrease_allocated_size(struct snd_card *card, size_t bytes)
+{
+ mutex_lock(&card->memory_mutex);
+ WARN_ON(card->total_pcm_alloc_bytes < bytes);
+ __update_allocated_size(card, -(ssize_t)bytes);
+ mutex_unlock(&card->memory_mutex);
+}
+
static int do_alloc_pages(struct snd_card *card, int type, struct device *dev,
int str, size_t size, struct snd_dma_buffer *dmab)
{
enum dma_data_direction dir;
int err;
+ /* check and reserve the requested size */
+ mutex_lock(&card->memory_mutex);
if (max_alloc_per_card &&
- card->total_pcm_alloc_bytes + size > max_alloc_per_card)
+ card->total_pcm_alloc_bytes + size > max_alloc_per_card) {
+ mutex_unlock(&card->memory_mutex);
return -ENOMEM;
+ }
+ __update_allocated_size(card, size);
+ mutex_unlock(&card->memory_mutex);
if (str == SNDRV_PCM_STREAM_PLAYBACK)
dir = DMA_TO_DEVICE;
@@ -47,9 +73,14 @@ static int do_alloc_pages(struct snd_car
dir = DMA_FROM_DEVICE;
err = snd_dma_alloc_dir_pages(type, dev, dir, size, dmab);
if (!err) {
- mutex_lock(&card->memory_mutex);
- card->total_pcm_alloc_bytes += dmab->bytes;
- mutex_unlock(&card->memory_mutex);
+ /* the actual allocation size might be bigger than requested,
+ * and we need to correct the account
+ */
+ if (dmab->bytes != size)
+ update_allocated_size(card, dmab->bytes - size);
+ } else {
+ /* take back on allocation failure */
+ decrease_allocated_size(card, size);
}
return err;
}
@@ -58,10 +89,7 @@ static void do_free_pages(struct snd_car
{
if (!dmab->area)
return;
- mutex_lock(&card->memory_mutex);
- WARN_ON(card->total_pcm_alloc_bytes < dmab->bytes);
- card->total_pcm_alloc_bytes -= dmab->bytes;
- mutex_unlock(&card->memory_mutex);
+ decrease_allocated_size(card, dmab->bytes);
snd_dma_free_pages(dmab);
dmab->area = NULL;
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 376/591] block: fix signed int overflow in Amiga partition support
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 375/591] ALSA: pcm: Fix potential data race at PCM memory allocation helpers Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 377/591] block: add overflow checks for " Greg Kroah-Hartman
` (218 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Steigerwald, Michael Schmitz,
Geert Uytterhoeven, Christoph Hellwig, Jens Axboe
From: Michael Schmitz <schmitzmic@gmail.com>
commit fc3d092c6bb48d5865fec15ed5b333c12f36288c upstream.
The Amiga partition parser module uses signed int for partition sector
address and count, which will overflow for disks larger than 1 TB.
Use sector_t as type for sector address and size to allow using disks
up to 2 TB without LBD support, and disks larger than 2 TB with LBD.
This bug was reported originally in 2012, and the fix was created by
the RDB author, Joanne Dow <jdow@earthlink.net>. A patch had been
discussed and reviewed on linux-m68k at that time but never officially
submitted. This patch differs from Joanne's patch only in its use of
sector_t instead of unsigned int. No checking for overflows is done
(see patch 3 of this series for that).
Reported-by: Martin Steigerwald <Martin@lichtvoll.de>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Message-ID: <201206192146.09327.Martin@lichtvoll.de>
Cc: <stable@vger.kernel.org> # 5.2
Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Tested-by: Martin Steigerwald <Martin@lichtvoll.de>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230620201725.7020-2-schmitzmic@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/partitions/amiga.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/block/partitions/amiga.c
+++ b/block/partitions/amiga.c
@@ -31,7 +31,8 @@ int amiga_partition(struct parsed_partit
unsigned char *data;
struct RigidDiskBlock *rdb;
struct PartitionBlock *pb;
- int start_sect, nr_sects, blk, part, res = 0;
+ sector_t start_sect, nr_sects;
+ int blk, part, res = 0;
int blksize = 1; /* Multiplier for disk block size */
int slot = 1;
@@ -96,14 +97,14 @@ int amiga_partition(struct parsed_partit
/* Tell Kernel about it */
- nr_sects = (be32_to_cpu(pb->pb_Environment[10]) + 1 -
- be32_to_cpu(pb->pb_Environment[9])) *
+ nr_sects = ((sector_t)be32_to_cpu(pb->pb_Environment[10]) + 1 -
+ be32_to_cpu(pb->pb_Environment[9])) *
be32_to_cpu(pb->pb_Environment[3]) *
be32_to_cpu(pb->pb_Environment[5]) *
blksize;
if (!nr_sects)
continue;
- start_sect = be32_to_cpu(pb->pb_Environment[9]) *
+ start_sect = (sector_t)be32_to_cpu(pb->pb_Environment[9]) *
be32_to_cpu(pb->pb_Environment[3]) *
be32_to_cpu(pb->pb_Environment[5]) *
blksize;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 377/591] block: add overflow checks for Amiga partition support
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 376/591] block: fix signed int overflow in Amiga partition support Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 378/591] block: change all __u32 annotations to __be32 in affs_hardblocks.h Greg Kroah-Hartman
` (217 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Steigerwald, Michael Schmitz,
Geert Uytterhoeven, Christoph Hellwig, Jens Axboe
From: Michael Schmitz <schmitzmic@gmail.com>
commit b6f3f28f604ba3de4724ad82bea6adb1300c0b5f upstream.
The Amiga partition parser module uses signed int for partition sector
address and count, which will overflow for disks larger than 1 TB.
Use u64 as type for sector address and size to allow using disks up to
2 TB without LBD support, and disks larger than 2 TB with LBD. The RBD
format allows to specify disk sizes up to 2^128 bytes (though native
OS limitations reduce this somewhat, to max 2^68 bytes), so check for
u64 overflow carefully to protect against overflowing sector_t.
Bail out if sector addresses overflow 32 bits on kernels without LBD
support.
This bug was reported originally in 2012, and the fix was created by
the RDB author, Joanne Dow <jdow@earthlink.net>. A patch had been
discussed and reviewed on linux-m68k at that time but never officially
submitted (now resubmitted as patch 1 in this series).
This patch adds additional error checking and warning messages.
Reported-by: Martin Steigerwald <Martin@lichtvoll.de>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Message-ID: <201206192146.09327.Martin@lichtvoll.de>
Cc: <stable@vger.kernel.org> # 5.2
Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Christoph Hellwig <hch@infradead.org>
Link: https://lore.kernel.org/r/20230620201725.7020-4-schmitzmic@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/partitions/amiga.c | 103 ++++++++++++++++++++++++++++++++++++++---------
1 file changed, 85 insertions(+), 18 deletions(-)
--- a/block/partitions/amiga.c
+++ b/block/partitions/amiga.c
@@ -11,10 +11,18 @@
#define pr_fmt(fmt) fmt
#include <linux/types.h>
+#include <linux/mm_types.h>
+#include <linux/overflow.h>
#include <linux/affs_hardblocks.h>
#include "check.h"
+/* magic offsets in partition DosEnvVec */
+#define NR_HD 3
+#define NR_SECT 5
+#define LO_CYL 9
+#define HI_CYL 10
+
static __inline__ u32
checksum_block(__be32 *m, int size)
{
@@ -31,9 +39,12 @@ int amiga_partition(struct parsed_partit
unsigned char *data;
struct RigidDiskBlock *rdb;
struct PartitionBlock *pb;
- sector_t start_sect, nr_sects;
- int blk, part, res = 0;
- int blksize = 1; /* Multiplier for disk block size */
+ u64 start_sect, nr_sects;
+ sector_t blk, end_sect;
+ u32 cylblk; /* rdb_CylBlocks = nr_heads*sect_per_track */
+ u32 nr_hd, nr_sect, lo_cyl, hi_cyl;
+ int part, res = 0;
+ unsigned int blksize = 1; /* Multiplier for disk block size */
int slot = 1;
for (blk = 0; ; blk++, put_dev_sector(sect)) {
@@ -41,7 +52,7 @@ int amiga_partition(struct parsed_partit
goto rdb_done;
data = read_part_sector(state, blk, §);
if (!data) {
- pr_err("Dev %s: unable to read RDB block %d\n",
+ pr_err("Dev %s: unable to read RDB block %llu\n",
state->disk->disk_name, blk);
res = -1;
goto rdb_done;
@@ -58,12 +69,12 @@ int amiga_partition(struct parsed_partit
*(__be32 *)(data+0xdc) = 0;
if (checksum_block((__be32 *)data,
be32_to_cpu(rdb->rdb_SummedLongs) & 0x7F)==0) {
- pr_err("Trashed word at 0xd0 in block %d ignored in checksum calculation\n",
+ pr_err("Trashed word at 0xd0 in block %llu ignored in checksum calculation\n",
blk);
break;
}
- pr_err("Dev %s: RDB in block %d has bad checksum\n",
+ pr_err("Dev %s: RDB in block %llu has bad checksum\n",
state->disk->disk_name, blk);
}
@@ -80,10 +91,15 @@ int amiga_partition(struct parsed_partit
blk = be32_to_cpu(rdb->rdb_PartitionList);
put_dev_sector(sect);
for (part = 1; blk>0 && part<=16; part++, put_dev_sector(sect)) {
- blk *= blksize; /* Read in terms partition table understands */
+ /* Read in terms partition table understands */
+ if (check_mul_overflow(blk, (sector_t) blksize, &blk)) {
+ pr_err("Dev %s: overflow calculating partition block %llu! Skipping partitions %u and beyond\n",
+ state->disk->disk_name, blk, part);
+ break;
+ }
data = read_part_sector(state, blk, §);
if (!data) {
- pr_err("Dev %s: unable to read partition block %d\n",
+ pr_err("Dev %s: unable to read partition block %llu\n",
state->disk->disk_name, blk);
res = -1;
goto rdb_done;
@@ -95,19 +111,70 @@ int amiga_partition(struct parsed_partit
if (checksum_block((__be32 *)pb, be32_to_cpu(pb->pb_SummedLongs) & 0x7F) != 0 )
continue;
- /* Tell Kernel about it */
+ /* RDB gives us more than enough rope to hang ourselves with,
+ * many times over (2^128 bytes if all fields max out).
+ * Some careful checks are in order, so check for potential
+ * overflows.
+ * We are multiplying four 32 bit numbers to one sector_t!
+ */
+
+ nr_hd = be32_to_cpu(pb->pb_Environment[NR_HD]);
+ nr_sect = be32_to_cpu(pb->pb_Environment[NR_SECT]);
+
+ /* CylBlocks is total number of blocks per cylinder */
+ if (check_mul_overflow(nr_hd, nr_sect, &cylblk)) {
+ pr_err("Dev %s: heads*sects %u overflows u32, skipping partition!\n",
+ state->disk->disk_name, cylblk);
+ continue;
+ }
+
+ /* check for consistency with RDB defined CylBlocks */
+ if (cylblk > be32_to_cpu(rdb->rdb_CylBlocks)) {
+ pr_warn("Dev %s: cylblk %u > rdb_CylBlocks %u!\n",
+ state->disk->disk_name, cylblk,
+ be32_to_cpu(rdb->rdb_CylBlocks));
+ }
+
+ /* RDB allows for variable logical block size -
+ * normalize to 512 byte blocks and check result.
+ */
+
+ if (check_mul_overflow(cylblk, blksize, &cylblk)) {
+ pr_err("Dev %s: partition %u bytes per cyl. overflows u32, skipping partition!\n",
+ state->disk->disk_name, part);
+ continue;
+ }
+
+ /* Calculate partition start and end. Limit of 32 bit on cylblk
+ * guarantees no overflow occurs if LBD support is enabled.
+ */
+
+ lo_cyl = be32_to_cpu(pb->pb_Environment[LO_CYL]);
+ start_sect = ((u64) lo_cyl * cylblk);
+
+ hi_cyl = be32_to_cpu(pb->pb_Environment[HI_CYL]);
+ nr_sects = (((u64) hi_cyl - lo_cyl + 1) * cylblk);
- nr_sects = ((sector_t)be32_to_cpu(pb->pb_Environment[10]) + 1 -
- be32_to_cpu(pb->pb_Environment[9])) *
- be32_to_cpu(pb->pb_Environment[3]) *
- be32_to_cpu(pb->pb_Environment[5]) *
- blksize;
if (!nr_sects)
continue;
- start_sect = (sector_t)be32_to_cpu(pb->pb_Environment[9]) *
- be32_to_cpu(pb->pb_Environment[3]) *
- be32_to_cpu(pb->pb_Environment[5]) *
- blksize;
+
+ /* Warn user if partition end overflows u32 (AmigaDOS limit) */
+
+ if ((start_sect + nr_sects) > UINT_MAX) {
+ pr_warn("Dev %s: partition %u (%llu-%llu) needs 64 bit device support!\n",
+ state->disk->disk_name, part,
+ start_sect, start_sect + nr_sects);
+ }
+
+ if (check_add_overflow(start_sect, nr_sects, &end_sect)) {
+ pr_err("Dev %s: partition %u (%llu-%llu) needs LBD device support, skipping partition!\n",
+ state->disk->disk_name, part,
+ start_sect, end_sect);
+ continue;
+ }
+
+ /* Tell Kernel about it */
+
put_partition(state,slot++,start_sect,nr_sects);
{
/* Be even more informative to aid mounting */
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 378/591] block: change all __u32 annotations to __be32 in affs_hardblocks.h
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 377/591] block: add overflow checks for " Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 379/591] block: increment diskseq on all media change events Greg Kroah-Hartman
` (216 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Steigerwald, Michael Schmitz,
Christoph Hellwig, Geert Uytterhoeven, Jens Axboe
From: Michael Schmitz <schmitzmic@gmail.com>
commit 95a55437dc49fb3342c82e61f5472a71c63d9ed0 upstream.
The Amiga partition parser module uses signed int for partition sector
address and count, which will overflow for disks larger than 1 TB.
Use u64 as type for sector address and size to allow using disks up to
2 TB without LBD support, and disks larger than 2 TB with LBD. The RBD
format allows to specify disk sizes up to 2^128 bytes (though native
OS limitations reduce this somewhat, to max 2^68 bytes), so check for
u64 overflow carefully to protect against overflowing sector_t.
This bug was reported originally in 2012, and the fix was created by
the RDB author, Joanne Dow <jdow@earthlink.net>. A patch had been
discussed and reviewed on linux-m68k at that time but never officially
submitted (now resubmitted as patch 1 of this series).
Patch 3 (this series) adds additional error checking and warning
messages. One of the error checks now makes use of the previously
unused rdb_CylBlocks field, which causes a 'sparse' warning
(cast to restricted __be32).
Annotate all 32 bit fields in affs_hardblocks.h as __be32, as the
on-disk format of RDB and partition blocks is always big endian.
Reported-by: Martin Steigerwald <Martin@lichtvoll.de>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Message-ID: <201206192146.09327.Martin@lichtvoll.de>
Cc: <stable@vger.kernel.org> # 5.2
Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/r/20230620201725.7020-3-schmitzmic@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/uapi/linux/affs_hardblocks.h | 68 +++++++++++++++++------------------
1 file changed, 34 insertions(+), 34 deletions(-)
--- a/include/uapi/linux/affs_hardblocks.h
+++ b/include/uapi/linux/affs_hardblocks.h
@@ -7,42 +7,42 @@
/* Just the needed definitions for the RDB of an Amiga HD. */
struct RigidDiskBlock {
- __u32 rdb_ID;
+ __be32 rdb_ID;
__be32 rdb_SummedLongs;
- __s32 rdb_ChkSum;
- __u32 rdb_HostID;
+ __be32 rdb_ChkSum;
+ __be32 rdb_HostID;
__be32 rdb_BlockBytes;
- __u32 rdb_Flags;
- __u32 rdb_BadBlockList;
+ __be32 rdb_Flags;
+ __be32 rdb_BadBlockList;
__be32 rdb_PartitionList;
- __u32 rdb_FileSysHeaderList;
- __u32 rdb_DriveInit;
- __u32 rdb_Reserved1[6];
- __u32 rdb_Cylinders;
- __u32 rdb_Sectors;
- __u32 rdb_Heads;
- __u32 rdb_Interleave;
- __u32 rdb_Park;
- __u32 rdb_Reserved2[3];
- __u32 rdb_WritePreComp;
- __u32 rdb_ReducedWrite;
- __u32 rdb_StepRate;
- __u32 rdb_Reserved3[5];
- __u32 rdb_RDBBlocksLo;
- __u32 rdb_RDBBlocksHi;
- __u32 rdb_LoCylinder;
- __u32 rdb_HiCylinder;
- __u32 rdb_CylBlocks;
- __u32 rdb_AutoParkSeconds;
- __u32 rdb_HighRDSKBlock;
- __u32 rdb_Reserved4;
+ __be32 rdb_FileSysHeaderList;
+ __be32 rdb_DriveInit;
+ __be32 rdb_Reserved1[6];
+ __be32 rdb_Cylinders;
+ __be32 rdb_Sectors;
+ __be32 rdb_Heads;
+ __be32 rdb_Interleave;
+ __be32 rdb_Park;
+ __be32 rdb_Reserved2[3];
+ __be32 rdb_WritePreComp;
+ __be32 rdb_ReducedWrite;
+ __be32 rdb_StepRate;
+ __be32 rdb_Reserved3[5];
+ __be32 rdb_RDBBlocksLo;
+ __be32 rdb_RDBBlocksHi;
+ __be32 rdb_LoCylinder;
+ __be32 rdb_HiCylinder;
+ __be32 rdb_CylBlocks;
+ __be32 rdb_AutoParkSeconds;
+ __be32 rdb_HighRDSKBlock;
+ __be32 rdb_Reserved4;
char rdb_DiskVendor[8];
char rdb_DiskProduct[16];
char rdb_DiskRevision[4];
char rdb_ControllerVendor[8];
char rdb_ControllerProduct[16];
char rdb_ControllerRevision[4];
- __u32 rdb_Reserved5[10];
+ __be32 rdb_Reserved5[10];
};
#define IDNAME_RIGIDDISK 0x5244534B /* "RDSK" */
@@ -50,16 +50,16 @@ struct RigidDiskBlock {
struct PartitionBlock {
__be32 pb_ID;
__be32 pb_SummedLongs;
- __s32 pb_ChkSum;
- __u32 pb_HostID;
+ __be32 pb_ChkSum;
+ __be32 pb_HostID;
__be32 pb_Next;
- __u32 pb_Flags;
- __u32 pb_Reserved1[2];
- __u32 pb_DevFlags;
+ __be32 pb_Flags;
+ __be32 pb_Reserved1[2];
+ __be32 pb_DevFlags;
__u8 pb_DriveName[32];
- __u32 pb_Reserved2[15];
+ __be32 pb_Reserved2[15];
__be32 pb_Environment[17];
- __u32 pb_EReserved[15];
+ __be32 pb_EReserved[15];
};
#define IDNAME_PARTITION 0x50415254 /* "PART" */
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 379/591] block: increment diskseq on all media change events
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 378/591] block: change all __u32 annotations to __be32 in affs_hardblocks.h Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 380/591] btrfs: fix race when deleting free space root from the dirty cow roots list Greg Kroah-Hartman
` (215 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Demi Marie Obenour, Christoph Hellwig, Jens Axboe
From: Demi Marie Obenour <demi@invisiblethingslab.com>
commit b90ecc0379eb7bbe79337b0c7289390a98752646 upstream.
Currently, associating a loop device with a different file descriptor
does not increment its diskseq. This allows the following race
condition:
1. Program X opens a loop device
2. Program X gets the diskseq of the loop device.
3. Program X associates a file with the loop device.
4. Program X passes the loop device major, minor, and diskseq to
something.
5. Program X exits.
6. Program Y detaches the file from the loop device.
7. Program Y attaches a different file to the loop device.
8. The opener finally gets around to opening the loop device and checks
that the diskseq is what it expects it to be. Even though the
diskseq is the expected value, the result is that the opener is
accessing the wrong file.
>From discussions with Christoph Hellwig, it appears that
disk_force_media_change() was supposed to call inc_diskseq(), but in
fact it does not. Adding a Fixes: tag to indicate this. Christoph's
Reported-by is because he stated that disk_force_media_change()
calls inc_diskseq(), which is what led me to discover that it should but
does not.
Reported-by: Christoph Hellwig <hch@infradead.org>
Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Fixes: e6138dc12de9 ("block: add a helper to raise a media changed event")
Cc: stable@vger.kernel.org # 5.15+
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230607170837.1559-1-demi@invisiblethingslab.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/disk-events.c | 1 +
1 file changed, 1 insertion(+)
--- a/block/disk-events.c
+++ b/block/disk-events.c
@@ -307,6 +307,7 @@ bool disk_force_media_change(struct gend
if (!(events & DISK_EVENT_MEDIA_CHANGE))
return false;
+ inc_diskseq(disk);
if (__invalidate_device(disk->part0, true))
pr_warn("VFS: busy inodes on changed media %s\n",
disk->disk_name);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 380/591] btrfs: fix race when deleting free space root from the dirty cow roots list
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 379/591] block: increment diskseq on all media change events Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 381/591] SUNRPC: Fix UAF in svc_tcp_listen_data_ready() Greg Kroah-Hartman
` (214 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Filipe Manana, David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit babebf023e661b90b1c78b2baa384fb03a226879 upstream.
When deleting the free space tree we are deleting the free space root
from the list fs_info->dirty_cowonly_roots without taking the lock that
protects it, which is struct btrfs_fs_info::trans_lock.
This unsynchronized list manipulation may cause chaos if there's another
concurrent manipulation of this list, such as when adding a root to it
with ctree.c:add_root_to_dirty_list().
This can result in all sorts of weird failures caused by a race, such as
the following crash:
[337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI
[337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1
[337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]
[337571.279928] Code: 85 38 06 00 (...)
[337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206
[337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000
[337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070
[337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b
[337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600
[337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48
[337571.281723] FS: 00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000
[337571.281950] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0
[337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[337571.282874] Call Trace:
[337571.283101] <TASK>
[337571.283327] ? __die_body+0x1b/0x60
[337571.283570] ? die_addr+0x39/0x60
[337571.283796] ? exc_general_protection+0x22e/0x430
[337571.284022] ? asm_exc_general_protection+0x22/0x30
[337571.284251] ? commit_cowonly_roots+0x11f/0x250 [btrfs]
[337571.284531] btrfs_commit_transaction+0x42e/0xf90 [btrfs]
[337571.284803] ? _raw_spin_unlock+0x15/0x30
[337571.285031] ? release_extent_buffer+0x103/0x130 [btrfs]
[337571.285305] reset_balance_state+0x152/0x1b0 [btrfs]
[337571.285578] btrfs_balance+0xa50/0x11e0 [btrfs]
[337571.285864] ? __kmem_cache_alloc_node+0x14a/0x410
[337571.286086] btrfs_ioctl+0x249a/0x3320 [btrfs]
[337571.286358] ? mod_objcg_state+0xd2/0x360
[337571.286577] ? refill_obj_stock+0xb0/0x160
[337571.286798] ? seq_release+0x25/0x30
[337571.287016] ? __rseq_handle_notify_resume+0x3ba/0x4b0
[337571.287235] ? percpu_counter_add_batch+0x2e/0xa0
[337571.287455] ? __x64_sys_ioctl+0x88/0xc0
[337571.287675] __x64_sys_ioctl+0x88/0xc0
[337571.287901] do_syscall_64+0x38/0x90
[337571.288126] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[337571.288352] RIP: 0033:0x7f478aaffe9b
So fix this by locking struct btrfs_fs_info::trans_lock before deleting
the free space root from that list.
Fixes: a5ed91828518 ("Btrfs: implement the free space B-tree")
CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/free-space-tree.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/btrfs/free-space-tree.c
+++ b/fs/btrfs/free-space-tree.c
@@ -1275,7 +1275,10 @@ int btrfs_delete_free_space_tree(struct
goto abort;
btrfs_global_root_delete(free_space_root);
+
+ spin_lock(&fs_info->trans_lock);
list_del(&free_space_root->dirty_list);
+ spin_unlock(&fs_info->trans_lock);
btrfs_tree_lock(free_space_root->node);
btrfs_clean_tree_block(free_space_root->node);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 381/591] SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 380/591] btrfs: fix race when deleting free space root from the dirty cow roots list Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 382/591] w1: w1_therm: fix locking behavior in convert_t Greg Kroah-Hartman
` (213 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ding Hui, Chuck Lever
From: Ding Hui <dinghui@sangfor.com.cn>
commit fc80fc2d4e39137869da3150ee169b40bf879287 upstream.
After the listener svc_sock is freed, and before invoking svc_tcp_accept()
for the established child sock, there is a window that the newsock
retaining a freed listener svc_sock in sk_user_data which cloning from
parent. In the race window, if data is received on the newsock, we will
observe use-after-free report in svc_tcp_listen_data_ready().
Reproduce by two tasks:
1. while :; do rpc.nfsd 0 ; rpc.nfsd; done
2. while :; do echo "" | ncat -4 127.0.0.1 2049 ; done
KASAN report:
==================================================================
BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]
Read of size 8 at addr ffff888139d96228 by task nc/102553
CPU: 7 PID: 102553 Comm: nc Not tainted 6.3.0+ #18
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
Call Trace:
<IRQ>
dump_stack_lvl+0x33/0x50
print_address_description.constprop.0+0x27/0x310
print_report+0x3e/0x70
kasan_report+0xae/0xe0
svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]
tcp_data_queue+0x9f4/0x20e0
tcp_rcv_established+0x666/0x1f60
tcp_v4_do_rcv+0x51c/0x850
tcp_v4_rcv+0x23fc/0x2e80
ip_protocol_deliver_rcu+0x62/0x300
ip_local_deliver_finish+0x267/0x350
ip_local_deliver+0x18b/0x2d0
ip_rcv+0x2fb/0x370
__netif_receive_skb_one_core+0x166/0x1b0
process_backlog+0x24c/0x5e0
__napi_poll+0xa2/0x500
net_rx_action+0x854/0xc90
__do_softirq+0x1bb/0x5de
do_softirq+0xcb/0x100
</IRQ>
<TASK>
...
</TASK>
Allocated by task 102371:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_kmalloc+0x7b/0x90
svc_setup_socket+0x52/0x4f0 [sunrpc]
svc_addsock+0x20d/0x400 [sunrpc]
__write_ports_addfd+0x209/0x390 [nfsd]
write_ports+0x239/0x2c0 [nfsd]
nfsctl_transaction_write+0xac/0x110 [nfsd]
vfs_write+0x1c3/0xae0
ksys_write+0xed/0x1c0
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Freed by task 102551:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x50
__kasan_slab_free+0x106/0x190
__kmem_cache_free+0x133/0x270
svc_xprt_free+0x1e2/0x350 [sunrpc]
svc_xprt_destroy_all+0x25a/0x440 [sunrpc]
nfsd_put+0x125/0x240 [nfsd]
nfsd_svc+0x2cb/0x3c0 [nfsd]
write_threads+0x1ac/0x2a0 [nfsd]
nfsctl_transaction_write+0xac/0x110 [nfsd]
vfs_write+0x1c3/0xae0
ksys_write+0xed/0x1c0
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Fix the UAF by simply doing nothing in svc_tcp_listen_data_ready()
if state != TCP_LISTEN, that will avoid dereferencing svsk for all
child socket.
Link: https://lore.kernel.org/lkml/20230507091131.23540-1-dinghui@sangfor.com.cn/
Fixes: fa9251afc33c ("SUNRPC: Call the default socket callbacks instead of open coding")
Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svcsock.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -688,12 +688,6 @@ static void svc_tcp_listen_data_ready(st
{
struct svc_sock *svsk = (struct svc_sock *)sk->sk_user_data;
- if (svsk) {
- /* Refer to svc_setup_socket() for details. */
- rmb();
- svsk->sk_odata(sk);
- }
-
/*
* This callback may called twice when a new connection
* is established as a child socket inherits everything
@@ -702,13 +696,18 @@ static void svc_tcp_listen_data_ready(st
* when one of child sockets become ESTABLISHED.
* 2) data_ready method of the child socket may be called
* when it receives data before the socket is accepted.
- * In case of 2, we should ignore it silently.
+ * In case of 2, we should ignore it silently and DO NOT
+ * dereference svsk.
*/
- if (sk->sk_state == TCP_LISTEN) {
- if (svsk) {
- set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags);
- svc_xprt_enqueue(&svsk->sk_xprt);
- }
+ if (sk->sk_state != TCP_LISTEN)
+ return;
+
+ if (svsk) {
+ /* Refer to svc_setup_socket() for details. */
+ rmb();
+ svsk->sk_odata(sk);
+ set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags);
+ svc_xprt_enqueue(&svsk->sk_xprt);
}
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 382/591] w1: w1_therm: fix locking behavior in convert_t
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 381/591] SUNRPC: Fix UAF in svc_tcp_listen_data_ready() Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 383/591] w1: fix loop in w1_fini() Greg Kroah-Hartman
` (212 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Wahren, Krzysztof Kozlowski,
Sasha Levin
From: Stefan Wahren <stefan.wahren@i2se.com>
[ Upstream commit dca5480ab7b77a889088ab7cac81934604510ac7 ]
The commit 67b392f7b8ed ("w1_therm: optimizing temperature read timings")
accidentially inverted the logic for lock handling of the bus mutex.
Before:
pullup -> release lock before sleep
no pullup -> release lock after sleep
After:
pullup -> release lock after sleep
no pullup -> release lock before sleep
This cause spurious measurements of 85 degree (powerup value) on the
Tarragon board with connected 1-w temperature sensor
(w1_therm.w1_strong_pull=0).
In the meantime a new feature for polling the conversion
completion has been integrated in these branches with
commit 021da53e65fd ("w1: w1_therm: Add sysfs entries to control
conversion time and driver features"). But this feature isn't
available for parasite power mode, so handle this separately.
Link: https://lore.kernel.org/regressions/2023042645-attentive-amends-7b0b@gregkh/T/
Fixes: 67b392f7b8ed ("w1_therm: optimizing temperature read timings")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Link: https://lore.kernel.org/r/20230427112152.12313-1-stefan.wahren@i2se.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/w1/slaves/w1_therm.c | 31 ++++++++++++++-----------------
1 file changed, 14 insertions(+), 17 deletions(-)
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 067692626cf07..99c58bd9d2df0 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -1159,29 +1159,26 @@ static int convert_t(struct w1_slave *sl, struct therm_info *info)
w1_write_8(dev_master, W1_CONVERT_TEMP);
- if (strong_pullup) { /*some device need pullup */
+ if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) {
+ ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP);
+ if (ret) {
+ dev_dbg(&sl->dev, "%s: Timeout\n", __func__);
+ goto mt_unlock;
+ }
+ mutex_unlock(&dev_master->bus_mutex);
+ } else if (!strong_pullup) { /*no device need pullup */
sleep_rem = msleep_interruptible(t_conv);
if (sleep_rem != 0) {
ret = -EINTR;
goto mt_unlock;
}
mutex_unlock(&dev_master->bus_mutex);
- } else { /*no device need pullup */
- if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) {
- ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP);
- if (ret) {
- dev_dbg(&sl->dev, "%s: Timeout\n", __func__);
- goto mt_unlock;
- }
- mutex_unlock(&dev_master->bus_mutex);
- } else {
- /* Fixed delay */
- mutex_unlock(&dev_master->bus_mutex);
- sleep_rem = msleep_interruptible(t_conv);
- if (sleep_rem != 0) {
- ret = -EINTR;
- goto dec_refcnt;
- }
+ } else { /*some device need pullup */
+ mutex_unlock(&dev_master->bus_mutex);
+ sleep_rem = msleep_interruptible(t_conv);
+ if (sleep_rem != 0) {
+ ret = -EINTR;
+ goto dec_refcnt;
}
}
ret = read_scratchpad(sl, info);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 383/591] w1: fix loop in w1_fini()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 382/591] w1: w1_therm: fix locking behavior in convert_t Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 384/591] dt-bindings: power: reset: qcom-pon: Only allow reboot-mode pre-pmk8350 Greg Kroah-Hartman
` (211 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Krzysztof Kozlowski,
Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 83f3fcf96fcc7e5405b37d9424c7ef26bfa203f8 ]
The __w1_remove_master_device() function calls:
list_del(&dev->w1_master_entry);
So presumably this can cause an endless loop.
Fixes: 7785925dd8e0 ("[PATCH] w1: cleanups.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/w1/w1.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index 4a2ddf730a3ac..2eee26b7fc4a3 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -1263,10 +1263,10 @@ static int __init w1_init(void)
static void __exit w1_fini(void)
{
- struct w1_master *dev;
+ struct w1_master *dev, *n;
/* Set netlink removal messages and some cleanup */
- list_for_each_entry(dev, &w1_masters, w1_master_entry)
+ list_for_each_entry_safe(dev, n, &w1_masters, w1_master_entry)
__w1_remove_master_device(dev);
w1_fini_netlink();
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 384/591] dt-bindings: power: reset: qcom-pon: Only allow reboot-mode pre-pmk8350
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 383/591] w1: fix loop in w1_fini() Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 385/591] f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED Greg Kroah-Hartman
` (210 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Rob Herring,
Sebastian Reichel, Sasha Levin
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit d41dab4c031edaa460a484113394327aa52dc0bd ]
As pointed out by Shazad [1], PMICs using a separate HLOS+PBS scheme
(so PMK8350 and newer) are expected to pass reboot mode data through SDAM,
as the reboot mode registers are absent in the HLOS reg space.
Limit the reboot-mode.yaml inclusion to PMICs without a separate PBS
region.
[1] https://lore.kernel.org/linux-arm-msm/12f13183-c381-25f7-459e-62e0c2b19498@quicinc.com/
Fixes: 03fccdc76dce ("dt-bindings: power: reset: qcom-pon: Add new compatible "qcom,pmk8350-pon"")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/devicetree/bindings/power/reset/qcom,pon.yaml | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml b/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml
index d96170eecbd22..0b1eca734d3b1 100644
--- a/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml
+++ b/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml
@@ -56,7 +56,6 @@ required:
unevaluatedProperties: false
allOf:
- - $ref: reboot-mode.yaml#
- if:
properties:
compatible:
@@ -66,6 +65,9 @@ allOf:
- qcom,pms405-pon
- qcom,pm8998-pon
then:
+ allOf:
+ - $ref: reboot-mode.yaml#
+
properties:
reg:
maxItems: 1
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 385/591] f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 384/591] dt-bindings: power: reset: qcom-pon: Only allow reboot-mode pre-pmk8350 Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 386/591] sh: j2: Use ioremap() to translate device tree address into kernel memory Greg Kroah-Hartman
` (209 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qi Han, Yangtao Li, Chao Yu,
Jaegeuk Kim, Sasha Levin
From: Yangtao Li <frank.li@vivo.com>
[ Upstream commit 7cd2e5f75b86a1befa99834f3ed1d735eeff69e6 ]
If a file has FI_COMPRESS_RELEASED, all writes for it should not be
allowed.
Fixes: 5fdb322ff2c2 ("f2fs: add F2FS_IOC_DECOMPRESS_FILE and F2FS_IOC_COMPRESS_FILE")
Signed-off-by: Qi Han <hanqi@vivo.com>
Signed-off-by: Yangtao Li <frank.li@vivo.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index dbad2db68f1bc..370c40858b42f 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -2588,6 +2588,11 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi,
inode_lock(inode);
+ if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
+ err = -EINVAL;
+ goto unlock_out;
+ }
+
/* if in-place-update policy is enabled, don't waste time here */
set_inode_flag(inode, FI_OPU_WRITE);
if (f2fs_should_update_inplace(inode, NULL)) {
@@ -2712,6 +2717,7 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi,
clear_inode_flag(inode, FI_SKIP_WRITES);
out:
clear_inode_flag(inode, FI_OPU_WRITE);
+unlock_out:
inode_unlock(inode);
if (!err)
range->len = (u64)total << PAGE_SHIFT;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 386/591] sh: j2: Use ioremap() to translate device tree address into kernel memory
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 385/591] f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 387/591] usb: dwc2: platform: Improve error reporting for problems during .remove() Greg Kroah-Hartman
` (208 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Rob Landley,
John Paul Adrian Glaubitz, Sasha Levin
From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
[ Upstream commit bc9d1f0cecd2407cfb2364a7d4be2f52d1d46a9d ]
Addresses the following warning when building j2_defconfig:
arch/sh/kernel/cpu/sh2/probe.c: In function 'scan_cache':
arch/sh/kernel/cpu/sh2/probe.c:24:16: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
24 | j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node);
|
Fixes: 5a846abad07f ("sh: add support for J-Core J2 processor")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Rob Landley <rob@landley.net>
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Link: https://lore.kernel.org/r/20230503125746.331835-1-glaubitz@physik.fu-berlin.de
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sh/kernel/cpu/sh2/probe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c
index d342ea08843f6..70a07f4f2142f 100644
--- a/arch/sh/kernel/cpu/sh2/probe.c
+++ b/arch/sh/kernel/cpu/sh2/probe.c
@@ -21,7 +21,7 @@ static int __init scan_cache(unsigned long node, const char *uname,
if (!of_flat_dt_is_compatible(node, "jcore,cache"))
return 0;
- j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node);
+ j2_ccr_base = ioremap(of_flat_dt_translate_address(node), 4);
return 1;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 387/591] usb: dwc2: platform: Improve error reporting for problems during .remove()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 386/591] sh: j2: Use ioremap() to translate device tree address into kernel memory Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 388/591] usb: dwc2: Fix some error handling paths Greg Kroah-Hartman
` (207 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Minas Harutyunyan, Sasha Levin
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 55f223b8b408cbfd85fb1c5b74ab85ccab319a69 ]
Returning an error value in a platform driver's remove callback results in
a generic error message being emitted by the driver core, but otherwise it
doesn't make a difference. The device goes away anyhow.
For each case where ret is non-zero the driver already emits an error
message, so suppress the generic error message by returning zero
unconditionally. (Side note: The return value handling was unreliable
anyhow as the value returned by dwc2_exit_hibernation() was overwritten
anyhow if hsotg->in_ppd was non-zero.)
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Link: https://lore.kernel.org/r/20221017195914.1426297-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: ada050c69108 ("usb: dwc2: Fix some error handling paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc2/platform.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index 0c02ef7628fd5..d1589ba7d322d 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -309,7 +309,7 @@ static int dwc2_driver_remove(struct platform_device *dev)
reset_control_assert(hsotg->reset);
reset_control_assert(hsotg->reset_ecc);
- return ret;
+ return 0;
}
/**
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 388/591] usb: dwc2: Fix some error handling paths
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 387/591] usb: dwc2: platform: Improve error reporting for problems during .remove() Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 389/591] serial: 8250: omap: Fix freeing of resources on failed register Greg Kroah-Hartman
` (206 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit ada050c69108bc34be13ecc11f7fad0f20ebadc4 ]
dwc2_driver_probe() calls dwc2_lowlevel_hw_init() which deassert some reset
lines.
Should an error happen in dwc2_lowlevel_hw_init() after calling
reset_control_deassert() or in the probe after calling
dwc2_lowlevel_hw_init(), the reset lines remain deasserted.
Add some devm_add_action_or_reset() calls to re-assert the lines if needed.
Update the remove function accordingly.
This change is compile-tested only.
Fixes: 83f8da562f8b ("usb: dwc2: Add reset control to dwc2")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/c64537b5339342bd00f7c2152b8fc23792b9f95a.1683306479.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc2/platform.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index d1589ba7d322d..58f53faab340f 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -175,6 +175,11 @@ int dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg)
return ret;
}
+static void dwc2_reset_control_assert(void *data)
+{
+ reset_control_assert(data);
+}
+
static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
{
int i, ret;
@@ -185,6 +190,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
"error getting reset control\n");
reset_control_deassert(hsotg->reset);
+ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert,
+ hsotg->reset);
+ if (ret)
+ return ret;
hsotg->reset_ecc = devm_reset_control_get_optional(hsotg->dev, "dwc2-ecc");
if (IS_ERR(hsotg->reset_ecc))
@@ -192,6 +201,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
"error getting reset control for ecc\n");
reset_control_deassert(hsotg->reset_ecc);
+ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert,
+ hsotg->reset_ecc);
+ if (ret)
+ return ret;
/*
* Attempt to find a generic PHY, then look for an old style
@@ -306,9 +319,6 @@ static int dwc2_driver_remove(struct platform_device *dev)
if (hsotg->ll_hw_enabled)
dwc2_lowlevel_hw_disable(hsotg);
- reset_control_assert(hsotg->reset);
- reset_control_assert(hsotg->reset_ecc);
-
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 389/591] serial: 8250: omap: Fix freeing of resources on failed register
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 388/591] usb: dwc2: Fix some error handling paths Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 390/591] clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk Greg Kroah-Hartman
` (205 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tony Lindgren, Ilpo Järvinen,
Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit b9ab22c2bc8652324a803b3e2be69838920b4025 ]
If serial8250_register_8250_port() fails, the SoC can hang as the
deferred PMQoS work will still run as is not flushed and removed.
Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://lore.kernel.org/r/20230508082014.23083-2-tony@atomide.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_omap.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index 3f33014022f0e..79bdf933c67e6 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -1453,7 +1453,9 @@ static int omap8250_probe(struct platform_device *pdev)
err:
pm_runtime_dont_use_autosuspend(&pdev->dev);
pm_runtime_put_sync(&pdev->dev);
+ flush_work(&priv->qos_work);
pm_runtime_disable(&pdev->dev);
+ cpu_latency_qos_remove_request(&priv->pm_qos_request);
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 390/591] clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 389/591] serial: 8250: omap: Fix freeing of resources on failed register Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 391/591] clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs Greg Kroah-Hartman
` (204 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Luca Weiss, Bjorn Andersson, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 853c064b57491d739bfd0cc35ff75c5ea9c5e8f5 ]
After the internal discussions, it looks like this clock is managed by
RPM itself. Linux kernel should not touch it on its own, as this causes
disagreement with RPM. Shutting down this clock causes the OCMEM<->GPU
interface to stop working, resulting in GPU hangchecks/timeouts.
Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)")
Suggested-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Tested-by: Luca Weiss <luca@z3ntu.xyz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230508153319.2371645-1-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/mmcc-msm8974.c | 19 -------------------
1 file changed, 19 deletions(-)
--- a/drivers/clk/qcom/mmcc-msm8974.c
+++ b/drivers/clk/qcom/mmcc-msm8974.c
@@ -2192,23 +2192,6 @@ static struct clk_branch ocmemcx_ocmemno
},
};
-static struct clk_branch oxili_ocmemgx_clk = {
- .halt_reg = 0x402c,
- .clkr = {
- .enable_reg = 0x402c,
- .enable_mask = BIT(0),
- .hw.init = &(struct clk_init_data){
- .name = "oxili_ocmemgx_clk",
- .parent_names = (const char *[]){
- "gfx3d_clk_src",
- },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
- .ops = &clk_branch2_ops,
- },
- },
-};
-
static struct clk_branch ocmemnoc_clk = {
.halt_reg = 0x50b4,
.clkr = {
@@ -2500,7 +2483,6 @@ static struct clk_regmap *mmcc_msm8226_c
[MMSS_MMSSNOC_AXI_CLK] = &mmss_mmssnoc_axi_clk.clkr,
[MMSS_S0_AXI_CLK] = &mmss_s0_axi_clk.clkr,
[OCMEMCX_AHB_CLK] = &ocmemcx_ahb_clk.clkr,
- [OXILI_OCMEMGX_CLK] = &oxili_ocmemgx_clk.clkr,
[OXILI_GFX3D_CLK] = &oxili_gfx3d_clk.clkr,
[OXILICX_AHB_CLK] = &oxilicx_ahb_clk.clkr,
[OXILICX_AXI_CLK] = &oxilicx_axi_clk.clkr,
@@ -2658,7 +2640,6 @@ static struct clk_regmap *mmcc_msm8974_c
[MMSS_S0_AXI_CLK] = &mmss_s0_axi_clk.clkr,
[OCMEMCX_AHB_CLK] = &ocmemcx_ahb_clk.clkr,
[OCMEMCX_OCMEMNOC_CLK] = &ocmemcx_ocmemnoc_clk.clkr,
- [OXILI_OCMEMGX_CLK] = &oxili_ocmemgx_clk.clkr,
[OCMEMNOC_CLK] = &ocmemnoc_clk.clkr,
[OXILI_GFX3D_CLK] = &oxili_gfx3d_clk.clkr,
[OXILICX_AHB_CLK] = &oxilicx_ahb_clk.clkr,
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 391/591] clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 390/591] clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 392/591] clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks Greg Kroah-Hartman
` (203 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Taniya Das, Stephen Boyd,
Bryan ODonoghue, Bjorn Andersson, Sasha Levin
From: Taniya Das <quic_tdas@quicinc.com>
[ Upstream commit 3e4d179532423f299554cd0dedabdd9d2fdd238d ]
Camera titan top GDSC is a parent supply to all other camera GDSCs. Titan
top GDSC is required to be enabled before enabling any other camera GDSCs
and it should be disabled only after all other camera GDSCs are disabled.
Ensure this behavior by marking titan top GDSC as parent of all other
camera GDSCs.
Fixes: 15d09e830bbc ("clk: qcom: camcc: Add camera clock controller driver for SC7180")
Signed-off-by: Taniya Das <quic_tdas@quicinc.com>
Acked-by: Stephen Boyd <sboyd@kernel.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230501142932.13049-1-quic_tdas@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/camcc-sc7180.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/drivers/clk/qcom/camcc-sc7180.c b/drivers/clk/qcom/camcc-sc7180.c
index e2b4804695f37..8a4ba7a19ed12 100644
--- a/drivers/clk/qcom/camcc-sc7180.c
+++ b/drivers/clk/qcom/camcc-sc7180.c
@@ -1480,12 +1480,21 @@ static struct clk_branch cam_cc_sys_tmr_clk = {
},
};
+static struct gdsc titan_top_gdsc = {
+ .gdscr = 0xb134,
+ .pd = {
+ .name = "titan_top_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
+};
+
static struct gdsc bps_gdsc = {
.gdscr = 0x6004,
.pd = {
.name = "bps_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &titan_top_gdsc.pd,
.flags = HW_CTRL,
};
@@ -1495,6 +1504,7 @@ static struct gdsc ife_0_gdsc = {
.name = "ife_0_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &titan_top_gdsc.pd,
};
static struct gdsc ife_1_gdsc = {
@@ -1503,6 +1513,7 @@ static struct gdsc ife_1_gdsc = {
.name = "ife_1_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &titan_top_gdsc.pd,
};
static struct gdsc ipe_0_gdsc = {
@@ -1512,15 +1523,9 @@ static struct gdsc ipe_0_gdsc = {
},
.pwrsts = PWRSTS_OFF_ON,
.flags = HW_CTRL,
+ .parent = &titan_top_gdsc.pd,
};
-static struct gdsc titan_top_gdsc = {
- .gdscr = 0xb134,
- .pd = {
- .name = "titan_top_gdsc",
- },
- .pwrsts = PWRSTS_OFF_ON,
-};
static struct clk_hw *cam_cc_sc7180_hws[] = {
[CAM_CC_PLL2_OUT_EARLY] = &cam_cc_pll2_out_early.hw,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 392/591] clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 391/591] clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 393/591] clk: qcom: gcc-qcm2290: Mark RCGs shared where applicable Greg Kroah-Hartman
` (202 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mantas Pucka, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Mantas Pucka <mantas@8devices.com>
[ Upstream commit 56e5ae0116aef87273cf1812d608645b076e4f02 ]
SDCC clocks must be rounded down to avoid overclocking the controller.
Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support")
Signed-off-by: Mantas Pucka <mantas@8devices.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/1682413909-24927-1-git-send-email-mantas@8devices.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-ipq6018.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c
index 3f9c2f61a5d93..5c5d1b04ea7af 100644
--- a/drivers/clk/qcom/gcc-ipq6018.c
+++ b/drivers/clk/qcom/gcc-ipq6018.c
@@ -1654,7 +1654,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = {
.name = "sdcc1_apps_clk_src",
.parent_data = gcc_xo_gpll0_gpll2_gpll0_out_main_div2,
.num_parents = 4,
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_floor_ops,
},
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 393/591] clk: qcom: gcc-qcm2290: Mark RCGs shared where applicable
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 392/591] clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 394/591] media: usb: Check az6007_read() return value Greg Kroah-Hartman
` (201 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Shawn Guo,
Bjorn Andersson, Sasha Levin
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit 7bf654a0d95e75b415f454e10627309d650762d0 ]
The vast majority of shared RCGs were not marked as such. Fix it.
Fixes: 496d1a13d405 ("clk: qcom: Add Global Clock Controller driver for QCM2290")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230403174807.345185-1-konrad.dybcio@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-qcm2290.c | 62 +++++++++++++++++-----------------
1 file changed, 31 insertions(+), 31 deletions(-)
diff --git a/drivers/clk/qcom/gcc-qcm2290.c b/drivers/clk/qcom/gcc-qcm2290.c
index 096deff2ba257..48995e50c6bd7 100644
--- a/drivers/clk/qcom/gcc-qcm2290.c
+++ b/drivers/clk/qcom/gcc-qcm2290.c
@@ -650,7 +650,7 @@ static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = {
.name = "gcc_usb30_prim_mock_utmi_clk_src",
.parent_data = gcc_parents_0,
.num_parents = ARRAY_SIZE(gcc_parents_0),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -686,7 +686,7 @@ static struct clk_rcg2 gcc_camss_axi_clk_src = {
.name = "gcc_camss_axi_clk_src",
.parent_data = gcc_parents_4,
.num_parents = ARRAY_SIZE(gcc_parents_4),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -706,7 +706,7 @@ static struct clk_rcg2 gcc_camss_cci_clk_src = {
.name = "gcc_camss_cci_clk_src",
.parent_data = gcc_parents_9,
.num_parents = ARRAY_SIZE(gcc_parents_9),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -728,7 +728,7 @@ static struct clk_rcg2 gcc_camss_csi0phytimer_clk_src = {
.name = "gcc_camss_csi0phytimer_clk_src",
.parent_data = gcc_parents_5,
.num_parents = ARRAY_SIZE(gcc_parents_5),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -742,7 +742,7 @@ static struct clk_rcg2 gcc_camss_csi1phytimer_clk_src = {
.name = "gcc_camss_csi1phytimer_clk_src",
.parent_data = gcc_parents_5,
.num_parents = ARRAY_SIZE(gcc_parents_5),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -764,7 +764,7 @@ static struct clk_rcg2 gcc_camss_mclk0_clk_src = {
.parent_data = gcc_parents_3,
.num_parents = ARRAY_SIZE(gcc_parents_3),
.flags = CLK_OPS_PARENT_ENABLE,
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -779,7 +779,7 @@ static struct clk_rcg2 gcc_camss_mclk1_clk_src = {
.parent_data = gcc_parents_3,
.num_parents = ARRAY_SIZE(gcc_parents_3),
.flags = CLK_OPS_PARENT_ENABLE,
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -794,7 +794,7 @@ static struct clk_rcg2 gcc_camss_mclk2_clk_src = {
.parent_data = gcc_parents_3,
.num_parents = ARRAY_SIZE(gcc_parents_3),
.flags = CLK_OPS_PARENT_ENABLE,
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -809,7 +809,7 @@ static struct clk_rcg2 gcc_camss_mclk3_clk_src = {
.parent_data = gcc_parents_3,
.num_parents = ARRAY_SIZE(gcc_parents_3),
.flags = CLK_OPS_PARENT_ENABLE,
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -830,7 +830,7 @@ static struct clk_rcg2 gcc_camss_ope_ahb_clk_src = {
.name = "gcc_camss_ope_ahb_clk_src",
.parent_data = gcc_parents_6,
.num_parents = ARRAY_SIZE(gcc_parents_6),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -854,7 +854,7 @@ static struct clk_rcg2 gcc_camss_ope_clk_src = {
.parent_data = gcc_parents_6,
.num_parents = ARRAY_SIZE(gcc_parents_6),
.flags = CLK_SET_RATE_PARENT,
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -888,7 +888,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_clk_src = {
.name = "gcc_camss_tfe_0_clk_src",
.parent_data = gcc_parents_7,
.num_parents = ARRAY_SIZE(gcc_parents_7),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -912,7 +912,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_csid_clk_src = {
.name = "gcc_camss_tfe_0_csid_clk_src",
.parent_data = gcc_parents_8,
.num_parents = ARRAY_SIZE(gcc_parents_8),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -926,7 +926,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_clk_src = {
.name = "gcc_camss_tfe_1_clk_src",
.parent_data = gcc_parents_7,
.num_parents = ARRAY_SIZE(gcc_parents_7),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -940,7 +940,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_csid_clk_src = {
.name = "gcc_camss_tfe_1_csid_clk_src",
.parent_data = gcc_parents_8,
.num_parents = ARRAY_SIZE(gcc_parents_8),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -963,7 +963,7 @@ static struct clk_rcg2 gcc_camss_tfe_cphy_rx_clk_src = {
.parent_data = gcc_parents_10,
.num_parents = ARRAY_SIZE(gcc_parents_10),
.flags = CLK_OPS_PARENT_ENABLE,
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -984,7 +984,7 @@ static struct clk_rcg2 gcc_camss_top_ahb_clk_src = {
.name = "gcc_camss_top_ahb_clk_src",
.parent_data = gcc_parents_4,
.num_parents = ARRAY_SIZE(gcc_parents_4),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -1006,7 +1006,7 @@ static struct clk_rcg2 gcc_gp1_clk_src = {
.name = "gcc_gp1_clk_src",
.parent_data = gcc_parents_2,
.num_parents = ARRAY_SIZE(gcc_parents_2),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -1020,7 +1020,7 @@ static struct clk_rcg2 gcc_gp2_clk_src = {
.name = "gcc_gp2_clk_src",
.parent_data = gcc_parents_2,
.num_parents = ARRAY_SIZE(gcc_parents_2),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -1034,7 +1034,7 @@ static struct clk_rcg2 gcc_gp3_clk_src = {
.name = "gcc_gp3_clk_src",
.parent_data = gcc_parents_2,
.num_parents = ARRAY_SIZE(gcc_parents_2),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -1054,7 +1054,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = {
.name = "gcc_pdm2_clk_src",
.parent_data = gcc_parents_0,
.num_parents = ARRAY_SIZE(gcc_parents_0),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -1082,7 +1082,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = {
.name = "gcc_qupv3_wrap0_s0_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
@@ -1098,7 +1098,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = {
.name = "gcc_qupv3_wrap0_s1_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = {
@@ -1114,7 +1114,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = {
.name = "gcc_qupv3_wrap0_s2_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
@@ -1130,7 +1130,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = {
.name = "gcc_qupv3_wrap0_s3_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
@@ -1146,7 +1146,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = {
.name = "gcc_qupv3_wrap0_s4_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
@@ -1162,7 +1162,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = {
.name = "gcc_qupv3_wrap0_s5_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
@@ -1219,7 +1219,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = {
.name = "gcc_sdcc1_ice_core_clk_src",
.parent_data = gcc_parents_0,
.num_parents = ARRAY_SIZE(gcc_parents_0),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -1266,7 +1266,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = {
.name = "gcc_usb30_prim_master_clk_src",
.parent_data = gcc_parents_0,
.num_parents = ARRAY_SIZE(gcc_parents_0),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -1280,7 +1280,7 @@ static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = {
.name = "gcc_usb3_prim_phy_aux_clk_src",
.parent_data = gcc_parents_13,
.num_parents = ARRAY_SIZE(gcc_parents_13),
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
@@ -1303,7 +1303,7 @@ static struct clk_rcg2 gcc_video_venus_clk_src = {
.parent_data = gcc_parents_14,
.num_parents = ARRAY_SIZE(gcc_parents_14),
.flags = CLK_SET_RATE_PARENT,
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 394/591] media: usb: Check az6007_read() return value
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 393/591] clk: qcom: gcc-qcm2290: Mark RCGs shared where applicable Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 395/591] media: amphion: drop repeated codec data for vc1l format Greg Kroah-Hartman
` (200 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daniil Dulov, Hans Verkuil,
Sasha Levin
From: Daniil Dulov <d.dulov@aladdin.ru>
[ Upstream commit fdaca63186f59fc664b346c45b76576624b48e57 ]
If az6007_read() returns error, there is no sence to continue.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 3af2f4f15a61 ("[media] az6007: Change the az6007 read/write routine parameter")
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/az6007.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c
index 62ee09f28a0bc..7524c90f5da61 100644
--- a/drivers/media/usb/dvb-usb-v2/az6007.c
+++ b/drivers/media/usb/dvb-usb-v2/az6007.c
@@ -202,7 +202,8 @@ static int az6007_rc_query(struct dvb_usb_device *d)
unsigned code;
enum rc_proto proto;
- az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10);
+ if (az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10) < 0)
+ return -EIO;
if (st->data[1] == 0x44)
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 395/591] media: amphion: drop repeated codec data for vc1l format
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 394/591] media: usb: Check az6007_read() return value Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 396/591] media: amphion: drop repeated codec data for vc1g format Greg Kroah-Hartman
` (199 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming Qian, xiahong.bao, Hans Verkuil,
Sasha Levin
From: Ming Qian <ming.qian@nxp.com>
[ Upstream commit 668ee1a3a1870381225002c246972419b98e4253 ]
For format V4L2_PIX_FMT_VC1_ANNEX_L,
the codec data is replaced with startcode,
and then driver drop it, otherwise it may led to decoding error.
It's amphion vpu's limitation
Driver has dropped the first codec data,
but need to drop the repeated codec data too.
Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Tested-by: xiahong.bao <xiahong.bao@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vpu_malone.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c
index ae094cdc9bfc8..36e563d29621f 100644
--- a/drivers/media/platform/amphion/vpu_malone.c
+++ b/drivers/media/platform/amphion/vpu_malone.c
@@ -1317,6 +1317,8 @@ static int vpu_malone_insert_scode_vc1_l_seq(struct malone_scode_t *scode)
int size = 0;
u8 rcv_seqhdr[MALONE_VC1_RCV_SEQ_HEADER_LEN];
+ if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb)))
+ scode->need_data = 0;
if (scode->inst->total_input_count)
return 0;
scode->need_data = 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 396/591] media: amphion: drop repeated codec data for vc1g format
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 395/591] media: amphion: drop repeated codec data for vc1l format Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 397/591] media: amphion: initiate a drain of the capture queue in dynamic resolution change Greg Kroah-Hartman
` (198 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming Qian, xiahong.bao, Hans Verkuil,
Sasha Levin
From: Ming Qian <ming.qian@nxp.com>
[ Upstream commit e1d2ccc2cdd6333584aa3d5386dc667d0837c48f ]
For format V4L2_PIX_FMT_VC1_ANNEX_G,
the separate codec data is required only once.
The repeated codec data may introduce some decoding error.
so drop the repeated codec data.
It's amphion vpu's limitation
Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Tested-by: xiahong.bao <xiahong.bao@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vpu_malone.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c
index 36e563d29621f..c2f4fb12c3b64 100644
--- a/drivers/media/platform/amphion/vpu_malone.c
+++ b/drivers/media/platform/amphion/vpu_malone.c
@@ -1286,6 +1286,15 @@ static int vpu_malone_insert_scode_pic(struct malone_scode_t *scode, u32 codec_i
return sizeof(hdr);
}
+static int vpu_malone_insert_scode_vc1_g_seq(struct malone_scode_t *scode)
+{
+ if (!scode->inst->total_input_count)
+ return 0;
+ if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb)))
+ scode->need_data = 0;
+ return 0;
+}
+
static int vpu_malone_insert_scode_vc1_g_pic(struct malone_scode_t *scode)
{
struct vb2_v4l2_buffer *vbuf;
@@ -1423,6 +1432,7 @@ static const struct malone_scode_handler scode_handlers[] = {
},
{
.pixelformat = V4L2_PIX_FMT_VC1_ANNEX_G,
+ .insert_scode_seq = vpu_malone_insert_scode_vc1_g_seq,
.insert_scode_pic = vpu_malone_insert_scode_vc1_g_pic,
},
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 397/591] media: amphion: initiate a drain of the capture queue in dynamic resolution change
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 396/591] media: amphion: drop repeated codec data for vc1g format Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 398/591] media: videodev2.h: Fix struct v4l2_input tuner index comment Greg Kroah-Hartman
` (197 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ming Qian, Hans Verkuil, Sasha Levin
From: Ming Qian <ming.qian@nxp.com>
[ Upstream commit 076b6289b2c12d76fab248659896682830fa7766 ]
The last buffer from before the change must be marked
with the V4L2_BUF_FLAG_LAST flag,
similarly to the Drain sequence above.
initiate a drain of the capture queue in dynamic resolution change
Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vdec.c | 7 ++++---
drivers/media/platform/amphion/venc.c | 4 ++--
drivers/media/platform/amphion/vpu_v4l2.c | 5 +++--
drivers/media/platform/amphion/vpu_v4l2.h | 2 +-
4 files changed, 10 insertions(+), 8 deletions(-)
diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c
index 4918547793dc1..c08b5a2bfc1df 100644
--- a/drivers/media/platform/amphion/vdec.c
+++ b/drivers/media/platform/amphion/vdec.c
@@ -229,6 +229,7 @@ static void vdec_handle_resolution_change(struct vpu_inst *inst)
vdec->source_change--;
vpu_notify_source_change(inst);
+ vpu_set_last_buffer_dequeued(inst, false);
}
static int vdec_update_state(struct vpu_inst *inst, enum vpu_codec_state state, u32 force)
@@ -264,7 +265,7 @@ static void vdec_set_last_buffer_dequeued(struct vpu_inst *inst)
return;
if (vdec->eos_received) {
- if (!vpu_set_last_buffer_dequeued(inst)) {
+ if (!vpu_set_last_buffer_dequeued(inst, true)) {
vdec->eos_received--;
vdec_update_state(inst, VPU_CODEC_STATE_DRAIN, 0);
}
@@ -517,7 +518,7 @@ static int vdec_drain(struct vpu_inst *inst)
return 0;
if (!vdec->params.frame_count) {
- vpu_set_last_buffer_dequeued(inst);
+ vpu_set_last_buffer_dequeued(inst, true);
return 0;
}
@@ -556,7 +557,7 @@ static int vdec_cmd_stop(struct vpu_inst *inst)
vpu_trace(inst->dev, "[%d]\n", inst->id);
if (inst->state == VPU_CODEC_STATE_DEINIT) {
- vpu_set_last_buffer_dequeued(inst);
+ vpu_set_last_buffer_dequeued(inst, true);
} else {
vdec->drain = 1;
vdec_drain(inst);
diff --git a/drivers/media/platform/amphion/venc.c b/drivers/media/platform/amphion/venc.c
index 37212f087fdd9..e8cb22da938e6 100644
--- a/drivers/media/platform/amphion/venc.c
+++ b/drivers/media/platform/amphion/venc.c
@@ -468,7 +468,7 @@ static int venc_encoder_cmd(struct file *file, void *fh, struct v4l2_encoder_cmd
vpu_inst_lock(inst);
if (cmd->cmd == V4L2_ENC_CMD_STOP) {
if (inst->state == VPU_CODEC_STATE_DEINIT)
- vpu_set_last_buffer_dequeued(inst);
+ vpu_set_last_buffer_dequeued(inst, true);
else
venc_request_eos(inst);
}
@@ -888,7 +888,7 @@ static void venc_set_last_buffer_dequeued(struct vpu_inst *inst)
struct venc_t *venc = inst->priv;
if (venc->stopped && list_empty(&venc->frames))
- vpu_set_last_buffer_dequeued(inst);
+ vpu_set_last_buffer_dequeued(inst, true);
}
static void venc_stop_done(struct vpu_inst *inst)
diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
index 590d1084e5a5d..a74953191c221 100644
--- a/drivers/media/platform/amphion/vpu_v4l2.c
+++ b/drivers/media/platform/amphion/vpu_v4l2.c
@@ -100,7 +100,7 @@ int vpu_notify_source_change(struct vpu_inst *inst)
return 0;
}
-int vpu_set_last_buffer_dequeued(struct vpu_inst *inst)
+int vpu_set_last_buffer_dequeued(struct vpu_inst *inst, bool eos)
{
struct vb2_queue *q;
@@ -116,7 +116,8 @@ int vpu_set_last_buffer_dequeued(struct vpu_inst *inst)
vpu_trace(inst->dev, "last buffer dequeued\n");
q->last_buffer_dequeued = true;
wake_up(&q->done_wq);
- vpu_notify_eos(inst);
+ if (eos)
+ vpu_notify_eos(inst);
return 0;
}
diff --git a/drivers/media/platform/amphion/vpu_v4l2.h b/drivers/media/platform/amphion/vpu_v4l2.h
index 795ca33a6a507..000af24a06ba0 100644
--- a/drivers/media/platform/amphion/vpu_v4l2.h
+++ b/drivers/media/platform/amphion/vpu_v4l2.h
@@ -26,7 +26,7 @@ struct vb2_v4l2_buffer *vpu_find_buf_by_idx(struct vpu_inst *inst, u32 type, u32
void vpu_v4l2_set_error(struct vpu_inst *inst);
int vpu_notify_eos(struct vpu_inst *inst);
int vpu_notify_source_change(struct vpu_inst *inst);
-int vpu_set_last_buffer_dequeued(struct vpu_inst *inst);
+int vpu_set_last_buffer_dequeued(struct vpu_inst *inst, bool eos);
void vpu_vb2_buffers_return(struct vpu_inst *inst, unsigned int type, enum vb2_buffer_state state);
int vpu_get_num_buffers(struct vpu_inst *inst, u32 type);
bool vpu_is_source_empty(struct vpu_inst *inst);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 398/591] media: videodev2.h: Fix struct v4l2_input tuner index comment
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 397/591] media: amphion: initiate a drain of the capture queue in dynamic resolution change Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 399/591] media: usb: siano: Fix warning due to null work_func_t function pointer Greg Kroah-Hartman
` (196 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Hans Verkuil,
Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit 26ae58f65e64fa7ba61d64bae752e59e08380c6a ]
VIDIOC_ENUMINPUT documentation describes the tuner field of
struct v4l2_input as index:
Documentation/userspace-api/media/v4l/vidioc-enuminput.rst
"
* - __u32
- ``tuner``
- Capture devices can have zero or more tuners (RF demodulators).
When the ``type`` is set to ``V4L2_INPUT_TYPE_TUNER`` this is an
RF connector and this field identifies the tuner. It corresponds
to struct :c:type:`v4l2_tuner` field ``index``. For
details on tuners see :ref:`tuner`.
"
Drivers I could find also use the 'tuner' field as an index, e.g.:
drivers/media/pci/bt8xx/bttv-driver.c bttv_enum_input()
drivers/media/usb/go7007/go7007-v4l2.c vidioc_enum_input()
However, the UAPI comment claims this field is 'enum v4l2_tuner_type':
include/uapi/linux/videodev2.h
This field being 'enum v4l2_tuner_type' is unlikely as it seems to be
never used that way in drivers, and documentation confirms it. It seem
this comment got in accidentally in the commit which this patch fixes.
Fix the UAPI comment to stop confusion.
This was pointed out by Dmitry while reviewing VIDIOC_ENUMINPUT
support for strace.
Fixes: 6016af82eafc ("[media] v4l2: use __u32 rather than enums in ioctl() structs")
Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/videodev2.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
index 29da1f4b4578e..45fa03882ef18 100644
--- a/include/uapi/linux/videodev2.h
+++ b/include/uapi/linux/videodev2.h
@@ -1693,7 +1693,7 @@ struct v4l2_input {
__u8 name[32]; /* Label */
__u32 type; /* Type of input */
__u32 audioset; /* Associated audios (bitfield) */
- __u32 tuner; /* enum v4l2_tuner_type */
+ __u32 tuner; /* Tuner index */
v4l2_std_id std;
__u32 status;
__u32 capabilities;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 399/591] media: usb: siano: Fix warning due to null work_func_t function pointer
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 398/591] media: videodev2.h: Fix struct v4l2_input tuner index comment Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:48 ` [PATCH 6.1 400/591] media: i2c: Correct format propagation for st-mipid02 Greg Kroah-Hartman
` (195 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+27b0b464864741b18b99,
Duoming Zhou, Hans Verkuil, Sasha Levin
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit 6f489a966fbeb0da63d45c2c66a8957eab604bf6 ]
The previous commit ebad8e731c1c ("media: usb: siano: Fix use after
free bugs caused by do_submit_urb") adds cancel_work_sync() in
smsusb_stop_streaming(). But smsusb_stop_streaming() may be called,
even if the work_struct surb->wq has not been initialized. As a result,
the warning will occur. One of the processes that could lead to warning
is shown below:
smsusb_probe()
smsusb_init_device()
if (!dev->in_ep || !dev->out_ep || align < 0) {
smsusb_term_device(intf);
smsusb_stop_streaming()
cancel_work_sync(&dev->surbs[i].wq);
__cancel_work_timer()
__flush_work()
if (WARN_ON(!work->func)) // work->func is null
The log reported by syzbot is shown below:
WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063
Modules linked in:
CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0
RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066
...
RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246
RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8
RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8
R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160
smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline]
smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344
smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419
smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567
...
This patch adds check before cancel_work_sync(). If surb->wq has not
been initialized, the cancel_work_sync() will not be executed.
Reported-by: syzbot+27b0b464864741b18b99@syzkaller.appspotmail.com
Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/siano/smsusb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
index 6f443c542c6da..640737d3b8aeb 100644
--- a/drivers/media/usb/siano/smsusb.c
+++ b/drivers/media/usb/siano/smsusb.c
@@ -179,7 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev)
for (i = 0; i < MAX_URBS; i++) {
usb_kill_urb(&dev->surbs[i].urb);
- cancel_work_sync(&dev->surbs[i].wq);
+ if (dev->surbs[i].wq.func)
+ cancel_work_sync(&dev->surbs[i].wq);
if (dev->surbs[i].cb) {
smscore_putbuffer(dev->coredev, dev->surbs[i].cb);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 400/591] media: i2c: Correct format propagation for st-mipid02
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 399/591] media: usb: siano: Fix warning due to null work_func_t function pointer Greg Kroah-Hartman
@ 2023-07-16 19:48 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 401/591] media: hi846: fix usage of pm_runtime_get_if_in_use() Greg Kroah-Hartman
` (194 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Scally, Sakari Ailus,
Hans Verkuil, Sasha Levin
From: Daniel Scally <dan.scally@ideasonboard.com>
[ Upstream commit 306c3190b30d4d6a098888b9d7d4cefaa0ddcb91 ]
Format propagation in the st-mipid02 driver is incorrect in that when
setting format for V4L2_SUBDEV_FORMAT_TRY on the source pad, the
_active_ rather than _try_ format from the sink pad is propagated.
This causes problems with format negotiation - update the function to
propagate the correct format.
Fixes: 642bb5e88fed ("media: st-mipid02: MIPID02 CSI-2 to PARALLEL bridge driver")
Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/st-mipid02.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/media/i2c/st-mipid02.c b/drivers/media/i2c/st-mipid02.c
index 31b89aff0e86a..f20f87562bf11 100644
--- a/drivers/media/i2c/st-mipid02.c
+++ b/drivers/media/i2c/st-mipid02.c
@@ -736,8 +736,13 @@ static void mipid02_set_fmt_source(struct v4l2_subdev *sd,
{
struct mipid02_dev *bridge = to_mipid02_dev(sd);
- /* source pad mirror active sink pad */
- format->format = bridge->fmt;
+ /* source pad mirror sink pad */
+ if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE)
+ format->format = bridge->fmt;
+ else
+ format->format = *v4l2_subdev_get_try_format(sd, sd_state,
+ MIPID02_SINK_0);
+
/* but code may need to be converted */
format->format.code = serial_to_parallel_code(format->format.code);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 401/591] media: hi846: fix usage of pm_runtime_get_if_in_use()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2023-07-16 19:48 ` [PATCH 6.1 400/591] media: i2c: Correct format propagation for st-mipid02 Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 402/591] media: mediatek: vcodec: using decoder status instead of core work count Greg Kroah-Hartman
` (193 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Kepplinger, Sakari Ailus,
Hans Verkuil, Sasha Levin
From: Martin Kepplinger <martin.kepplinger@puri.sm>
[ Upstream commit 04fc06f6dc1592ed5d675311ac50d8fba5db62ab ]
pm_runtime_get_if_in_use() does not only return nonzero values when
the device is in use, it can return a negative errno too.
And especially during resuming from system suspend, when runtime pm
is not yet up again, -EAGAIN is being returned, so the subsequent
pm_runtime_put() call results in a refcount underflow.
Fix system-resume by handling -EAGAIN of pm_runtime_get_if_in_use().
Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm>
Fixes: e8c0882685f9 ("media: i2c: add driver for the SK Hynix Hi-846 8M pixel camera")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/hi846.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/hi846.c b/drivers/media/i2c/hi846.c
index 306dc35e925fd..f8709cdf28b39 100644
--- a/drivers/media/i2c/hi846.c
+++ b/drivers/media/i2c/hi846.c
@@ -1353,7 +1353,8 @@ static int hi846_set_ctrl(struct v4l2_ctrl *ctrl)
exposure_max);
}
- if (!pm_runtime_get_if_in_use(&client->dev))
+ ret = pm_runtime_get_if_in_use(&client->dev);
+ if (!ret || ret == -EAGAIN)
return 0;
switch (ctrl->id) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 402/591] media: mediatek: vcodec: using decoder status instead of core work count
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 401/591] media: hi846: fix usage of pm_runtime_get_if_in_use() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 403/591] clk: qcom: reset: support resetting multiple bits Greg Kroah-Hartman
` (192 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yunfei Dong,
AngeloGioacchino Del Regno, Hans Verkuil, Mauro Carvalho Chehab,
Sasha Levin
From: Yunfei Dong <yunfei.dong@mediatek.com>
[ Upstream commit 2864e304faec04c2674328aad0e820a9cd84cdec ]
Adding the definition of decoder status to separate different decoder
period for core hardware.
core_work_cnt is the number of core work queued to work queue, the control
is very complex, leading to some unreasonable test result.
Using parameter status to indicate whether queue core work to work queue.
Fixes: 2e0ef56d81cb ("media: mediatek: vcodec: making sure queue_work successfully")
Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/mediatek/vcodec/vdec_msg_queue.c | 33 ++++++++-----------
.../platform/mediatek/vcodec/vdec_msg_queue.h | 16 +++++++--
2 files changed, 28 insertions(+), 21 deletions(-)
diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
index f3073d1e7f420..03f8d7cd8eddc 100644
--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
@@ -71,7 +71,6 @@ static void vdec_msg_queue_dec(struct vdec_msg_queue *msg_queue, int hardware_in
int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf *buf)
{
struct list_head *head;
- int status;
head = vdec_get_buf_list(msg_ctx->hardware_index, buf);
if (!head) {
@@ -87,12 +86,9 @@ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf
if (msg_ctx->hardware_index != MTK_VDEC_CORE) {
wake_up_all(&msg_ctx->ready_to_use);
} else {
- if (buf->ctx->msg_queue.core_work_cnt <
- atomic_read(&buf->ctx->msg_queue.core_list_cnt)) {
- status = queue_work(buf->ctx->dev->core_workqueue,
- &buf->ctx->msg_queue.core_work);
- if (status)
- buf->ctx->msg_queue.core_work_cnt++;
+ if (!(buf->ctx->msg_queue.status & CONTEXT_LIST_QUEUED)) {
+ queue_work(buf->ctx->dev->core_workqueue, &buf->ctx->msg_queue.core_work);
+ buf->ctx->msg_queue.status |= CONTEXT_LIST_QUEUED;
}
}
@@ -261,7 +257,10 @@ static void vdec_msg_queue_core_work(struct work_struct *work)
container_of(msg_queue, struct mtk_vcodec_ctx, msg_queue);
struct mtk_vcodec_dev *dev = ctx->dev;
struct vdec_lat_buf *lat_buf;
- int status;
+
+ spin_lock(&ctx->dev->msg_queue_core_ctx.ready_lock);
+ ctx->msg_queue.status &= ~CONTEXT_LIST_QUEUED;
+ spin_unlock(&ctx->dev->msg_queue_core_ctx.ready_lock);
lat_buf = vdec_msg_queue_dqbuf(&dev->msg_queue_core_ctx);
if (!lat_buf)
@@ -278,17 +277,13 @@ static void vdec_msg_queue_core_work(struct work_struct *work)
vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf);
wake_up_all(&ctx->msg_queue.core_dec_done);
- spin_lock(&dev->msg_queue_core_ctx.ready_lock);
- lat_buf->ctx->msg_queue.core_work_cnt--;
-
- if (lat_buf->ctx->msg_queue.core_work_cnt <
- atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) {
- status = queue_work(lat_buf->ctx->dev->core_workqueue,
- &lat_buf->ctx->msg_queue.core_work);
- if (status)
- lat_buf->ctx->msg_queue.core_work_cnt++;
+ if (!(ctx->msg_queue.status & CONTEXT_LIST_QUEUED) &&
+ atomic_read(&msg_queue->core_list_cnt)) {
+ spin_lock(&ctx->dev->msg_queue_core_ctx.ready_lock);
+ ctx->msg_queue.status |= CONTEXT_LIST_QUEUED;
+ spin_unlock(&ctx->dev->msg_queue_core_ctx.ready_lock);
+ queue_work(ctx->dev->core_workqueue, &msg_queue->core_work);
}
- spin_unlock(&dev->msg_queue_core_ctx.ready_lock);
}
int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue,
@@ -303,13 +298,13 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue,
return 0;
msg_queue->ctx = ctx;
- msg_queue->core_work_cnt = 0;
vdec_msg_queue_init_ctx(&msg_queue->lat_ctx, MTK_VDEC_LAT0);
INIT_WORK(&msg_queue->core_work, vdec_msg_queue_core_work);
atomic_set(&msg_queue->lat_list_cnt, 0);
atomic_set(&msg_queue->core_list_cnt, 0);
init_waitqueue_head(&msg_queue->core_dec_done);
+ msg_queue->status = CONTEXT_LIST_EMPTY;
msg_queue->wdma_addr.size =
vde_msg_queue_get_trans_size(ctx->picinfo.buf_w,
diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
index a5d44bc97c16b..8f82d14847726 100644
--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
+++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h
@@ -21,6 +21,18 @@ struct mtk_vcodec_ctx;
struct mtk_vcodec_dev;
typedef int (*core_decode_cb_t)(struct vdec_lat_buf *lat_buf);
+/**
+ * enum core_ctx_status - Context decode status for core hardwre.
+ * @CONTEXT_LIST_EMPTY: No buffer queued on core hardware(must always be 0)
+ * @CONTEXT_LIST_QUEUED: Buffer queued to core work list
+ * @CONTEXT_LIST_DEC_DONE: context decode done
+ */
+enum core_ctx_status {
+ CONTEXT_LIST_EMPTY = 0,
+ CONTEXT_LIST_QUEUED,
+ CONTEXT_LIST_DEC_DONE,
+};
+
/**
* struct vdec_msg_queue_ctx - represents a queue for buffers ready to be processed
* @ready_to_use: ready used queue used to signalize when get a job queue
@@ -77,7 +89,7 @@ struct vdec_lat_buf {
* @lat_list_cnt: used to record each instance lat list count
* @core_list_cnt: used to record each instance core list count
* @core_dec_done: core work queue decode done event
- * @core_work_cnt: the number of core work in work queue
+ * @status: current context decode status for core hardware
*/
struct vdec_msg_queue {
struct vdec_lat_buf lat_buf[NUM_BUFFER_COUNT];
@@ -93,7 +105,7 @@ struct vdec_msg_queue {
atomic_t lat_list_cnt;
atomic_t core_list_cnt;
wait_queue_head_t core_dec_done;
- int core_work_cnt;
+ int status;
};
/**
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 403/591] clk: qcom: reset: support resetting multiple bits
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 402/591] media: mediatek: vcodec: using decoder status instead of core work count Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 404/591] clk: qcom: ipq6018: fix networking resets Greg Kroah-Hartman
` (191 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Marko, Bjorn Andersson,
Sasha Levin
From: Robert Marko <robimarko@gmail.com>
[ Upstream commit 4a5210893625f89723ea210d7c630b730abb37ad ]
This patch adds the support for giving the complete bitmask
in reset structure and reset operation will use this bitmask
for all reset operations.
Currently, reset structure only takes a single bit for each reset
and then calculates the bitmask by using the BIT() macro.
However, this is not sufficient anymore for newer SoC-s like IPQ8074,
IPQ6018 and more, since their networking resets require multiple bits
to be asserted in order to properly reset the HW block completely.
So, in order to allow asserting multiple bits add "bitmask" field to
qcom_reset_map, and then use that bitmask value if its populated in the
driver, if its not populated, then we just default to existing behaviour
and calculate the bitmask on the fly.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221107132901.489240-1-robimarko@gmail.com
Stable-dep-of: 349b5bed539b ("clk: qcom: ipq6018: fix networking resets")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/reset.c | 4 ++--
drivers/clk/qcom/reset.h | 1 +
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c
index 2a16adb572d2b..0e914ec7aeae1 100644
--- a/drivers/clk/qcom/reset.c
+++ b/drivers/clk/qcom/reset.c
@@ -30,7 +30,7 @@ qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
rst = to_qcom_reset_controller(rcdev);
map = &rst->reset_map[id];
- mask = BIT(map->bit);
+ mask = map->bitmask ? map->bitmask : BIT(map->bit);
return regmap_update_bits(rst->regmap, map->reg, mask, mask);
}
@@ -44,7 +44,7 @@ qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id)
rst = to_qcom_reset_controller(rcdev);
map = &rst->reset_map[id];
- mask = BIT(map->bit);
+ mask = map->bitmask ? map->bitmask : BIT(map->bit);
return regmap_update_bits(rst->regmap, map->reg, mask, 0);
}
diff --git a/drivers/clk/qcom/reset.h b/drivers/clk/qcom/reset.h
index b8c113582072b..9a47c838d9b1b 100644
--- a/drivers/clk/qcom/reset.h
+++ b/drivers/clk/qcom/reset.h
@@ -12,6 +12,7 @@ struct qcom_reset_map {
unsigned int reg;
u8 bit;
u8 udelay;
+ u32 bitmask;
};
struct regmap;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 404/591] clk: qcom: ipq6018: fix networking resets
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 403/591] clk: qcom: reset: support resetting multiple bits Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 405/591] clk: qcom: dispcc-qcm2290: Fix BI_TCXO_AO handling Greg Kroah-Hartman
` (190 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Marko, Bjorn Andersson,
Sasha Levin
From: Robert Marko <robimarko@gmail.com>
[ Upstream commit 349b5bed539b491b7894a5186a895751fd8ba6c7 ]
Networking resets in IPQ6018 all use bitmask as they require multiple
bits to be set and cleared instead of a single bit.
So, current networking resets have the same register and bit 0 set which
is clearly incorrect.
Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support")
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230526190855.2941291-2-robimarko@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-ipq6018.c | 32 ++++++++++++++++----------------
1 file changed, 16 insertions(+), 16 deletions(-)
diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c
index 5c5d1b04ea7af..cde62a11f5736 100644
--- a/drivers/clk/qcom/gcc-ipq6018.c
+++ b/drivers/clk/qcom/gcc-ipq6018.c
@@ -4517,24 +4517,24 @@ static const struct qcom_reset_map gcc_ipq6018_resets[] = {
[GCC_PCIE0_AHB_ARES] = { 0x75040, 5 },
[GCC_PCIE0_AXI_MASTER_STICKY_ARES] = { 0x75040, 6 },
[GCC_PCIE0_AXI_SLAVE_STICKY_ARES] = { 0x75040, 7 },
- [GCC_PPE_FULL_RESET] = { 0x68014, 0 },
- [GCC_UNIPHY0_SOFT_RESET] = { 0x56004, 0 },
+ [GCC_PPE_FULL_RESET] = { .reg = 0x68014, .bitmask = 0xf0000 },
+ [GCC_UNIPHY0_SOFT_RESET] = { .reg = 0x56004, .bitmask = 0x3ff2 },
[GCC_UNIPHY0_XPCS_RESET] = { 0x56004, 2 },
- [GCC_UNIPHY1_SOFT_RESET] = { 0x56104, 0 },
+ [GCC_UNIPHY1_SOFT_RESET] = { .reg = 0x56104, .bitmask = 0x32 },
[GCC_UNIPHY1_XPCS_RESET] = { 0x56104, 2 },
- [GCC_EDMA_HW_RESET] = { 0x68014, 0 },
- [GCC_NSSPORT1_RESET] = { 0x68014, 0 },
- [GCC_NSSPORT2_RESET] = { 0x68014, 0 },
- [GCC_NSSPORT3_RESET] = { 0x68014, 0 },
- [GCC_NSSPORT4_RESET] = { 0x68014, 0 },
- [GCC_NSSPORT5_RESET] = { 0x68014, 0 },
- [GCC_UNIPHY0_PORT1_ARES] = { 0x56004, 0 },
- [GCC_UNIPHY0_PORT2_ARES] = { 0x56004, 0 },
- [GCC_UNIPHY0_PORT3_ARES] = { 0x56004, 0 },
- [GCC_UNIPHY0_PORT4_ARES] = { 0x56004, 0 },
- [GCC_UNIPHY0_PORT5_ARES] = { 0x56004, 0 },
- [GCC_UNIPHY0_PORT_4_5_RESET] = { 0x56004, 0 },
- [GCC_UNIPHY0_PORT_4_RESET] = { 0x56004, 0 },
+ [GCC_EDMA_HW_RESET] = { .reg = 0x68014, .bitmask = 0x300000 },
+ [GCC_NSSPORT1_RESET] = { .reg = 0x68014, .bitmask = 0x1000003 },
+ [GCC_NSSPORT2_RESET] = { .reg = 0x68014, .bitmask = 0x200000c },
+ [GCC_NSSPORT3_RESET] = { .reg = 0x68014, .bitmask = 0x4000030 },
+ [GCC_NSSPORT4_RESET] = { .reg = 0x68014, .bitmask = 0x8000300 },
+ [GCC_NSSPORT5_RESET] = { .reg = 0x68014, .bitmask = 0x10000c00 },
+ [GCC_UNIPHY0_PORT1_ARES] = { .reg = 0x56004, .bitmask = 0x30 },
+ [GCC_UNIPHY0_PORT2_ARES] = { .reg = 0x56004, .bitmask = 0xc0 },
+ [GCC_UNIPHY0_PORT3_ARES] = { .reg = 0x56004, .bitmask = 0x300 },
+ [GCC_UNIPHY0_PORT4_ARES] = { .reg = 0x56004, .bitmask = 0xc00 },
+ [GCC_UNIPHY0_PORT5_ARES] = { .reg = 0x56004, .bitmask = 0x3000 },
+ [GCC_UNIPHY0_PORT_4_5_RESET] = { .reg = 0x56004, .bitmask = 0x3c02 },
+ [GCC_UNIPHY0_PORT_4_RESET] = { .reg = 0x56004, .bitmask = 0xc02 },
[GCC_LPASS_BCR] = {0x1F000, 0},
[GCC_UBI32_TBU_BCR] = {0x65000, 0},
[GCC_LPASS_TBU_BCR] = {0x6C000, 0},
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 405/591] clk: qcom: dispcc-qcm2290: Fix BI_TCXO_AO handling
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 404/591] clk: qcom: ipq6018: fix networking resets Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 406/591] clk: qcom: dispcc-qcm2290: Fix GPLL0_OUT_DIV handling Greg Kroah-Hartman
` (189 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bjorn Andersson,
Sasha Levin
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit 92dfee0fc889b5b00ffb6b1de87ce64c483bcb7b ]
BI_TCXO_AO (.fw_name = "bi_tcxo_ao") was previously made to reuse the
same parent enum entry as BI_TCXO (.fw_name = "bi_tcxo") in parent_map_2.
Resolve it by introducing its own entry in the parent enum and
correctly assigning it in disp_cc_parent_map_2[].
Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v2-1-bce7dd512fe4@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/dispcc-qcm2290.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c
index 24755dc841f9d..4a4993470852b 100644
--- a/drivers/clk/qcom/dispcc-qcm2290.c
+++ b/drivers/clk/qcom/dispcc-qcm2290.c
@@ -23,6 +23,7 @@
enum {
P_BI_TCXO,
+ P_BI_TCXO_AO,
P_DISP_CC_PLL0_OUT_MAIN,
P_DSI0_PHY_PLL_OUT_BYTECLK,
P_DSI0_PHY_PLL_OUT_DSICLK,
@@ -81,7 +82,7 @@ static const struct clk_parent_data disp_cc_parent_data_1[] = {
};
static const struct parent_map disp_cc_parent_map_2[] = {
- { P_BI_TCXO, 0 },
+ { P_BI_TCXO_AO, 0 },
{ P_GPLL0_OUT_MAIN, 4 },
};
@@ -150,7 +151,7 @@ static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = {
};
static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = {
- F(19200000, P_BI_TCXO, 1, 0, 0),
+ F(19200000, P_BI_TCXO_AO, 1, 0, 0),
F(37500000, P_GPLL0_OUT_MAIN, 8, 0, 0),
F(75000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
{ }
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 406/591] clk: qcom: dispcc-qcm2290: Fix GPLL0_OUT_DIV handling
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 405/591] clk: qcom: dispcc-qcm2290: Fix BI_TCXO_AO handling Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 407/591] clk: qcom: mmcc-msm8974: use clk_rcg2_shared_ops for mdp_clk_src clock Greg Kroah-Hartman
` (188 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bjorn Andersson,
Sasha Levin
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit 63d56adf04b5795e54440dc5b7afddecb2966863 ]
GPLL0_OUT_DIV (.fw_name = "gcc_disp_gpll0_div_clk_src") was previously
made to reuse the same parent enum entry as GPLL0_OUT_MAIN
(.fw_name = "gcc_disp_gpll0_clk_src") in parent_map_2.
Resolve it by introducing its own entry in the parent enum and
correctly assigning it in disp_cc_parent_map_2[].
Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v2-2-bce7dd512fe4@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/dispcc-qcm2290.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c
index 4a4993470852b..5cec98c4e8372 100644
--- a/drivers/clk/qcom/dispcc-qcm2290.c
+++ b/drivers/clk/qcom/dispcc-qcm2290.c
@@ -27,6 +27,7 @@ enum {
P_DISP_CC_PLL0_OUT_MAIN,
P_DSI0_PHY_PLL_OUT_BYTECLK,
P_DSI0_PHY_PLL_OUT_DSICLK,
+ P_GPLL0_OUT_DIV,
P_GPLL0_OUT_MAIN,
P_SLEEP_CLK,
};
@@ -83,7 +84,7 @@ static const struct clk_parent_data disp_cc_parent_data_1[] = {
static const struct parent_map disp_cc_parent_map_2[] = {
{ P_BI_TCXO_AO, 0 },
- { P_GPLL0_OUT_MAIN, 4 },
+ { P_GPLL0_OUT_DIV, 4 },
};
static const struct clk_parent_data disp_cc_parent_data_2[] = {
@@ -152,8 +153,8 @@ static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = {
static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = {
F(19200000, P_BI_TCXO_AO, 1, 0, 0),
- F(37500000, P_GPLL0_OUT_MAIN, 8, 0, 0),
- F(75000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
+ F(37500000, P_GPLL0_OUT_DIV, 8, 0, 0),
+ F(75000000, P_GPLL0_OUT_DIV, 4, 0, 0),
{ }
};
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 407/591] clk: qcom: mmcc-msm8974: use clk_rcg2_shared_ops for mdp_clk_src clock
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 406/591] clk: qcom: dispcc-qcm2290: Fix GPLL0_OUT_DIV handling Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 408/591] staging: vchiq_arm: mark vchiq_platform_init() static Greg Kroah-Hartman
` (187 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Luca Weiss,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 8fd492e77ff71f68f7311c22f7bc960182465cd7 ]
The mdp_clk_src clock should not be turned off. Instead it should be
'parked' to the XO, as most of other mdp_clk_src clocks. Fix that by
using the clk_rcg2_shared_ops.
Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Tested-by: Luca Weiss <luca@z3ntu.xyz>
Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230507175335.2321503-1-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/mmcc-msm8974.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/qcom/mmcc-msm8974.c
+++ b/drivers/clk/qcom/mmcc-msm8974.c
@@ -473,7 +473,7 @@ static struct clk_rcg2 mdp_clk_src = {
.name = "mdp_clk_src",
.parent_names = mmcc_xo_mmpll0_dsi_hdmi_gpll0,
.num_parents = 6,
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 408/591] staging: vchiq_arm: mark vchiq_platform_init() static
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 407/591] clk: qcom: mmcc-msm8974: use clk_rcg2_shared_ops for mdp_clk_src clock Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 409/591] usb: dwc3: qcom: Fix potential memory leak Greg Kroah-Hartman
` (186 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Florian Fainelli,
Umang Jain, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit e152c58d7a48194d6b530d8e004d650fd01568b6 ]
This function has no callers from other files, and the declaration
was removed a while ago, causing a W=1 warning:
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:465:5: error: no previous prototype for 'vchiq_platform_init'
Marking it static solves this problem but introduces a new warning
since gcc determines that 'g_fragments_base' is never initialized
in some kernel configurations:
In file included from include/linux/string.h:254,
from include/linux/bitmap.h:11,
from include/linux/cpumask.h:12,
from include/linux/mm_types_task.h:14,
from include/linux/mm_types.h:5,
from include/linux/buildid.h:5,
from include/linux/module.h:14,
from drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:8:
In function 'memcpy_to_page',
inlined from 'free_pagelist' at drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:433:4:
include/linux/fortify-string.h:57:33: error: argument 2 null where non-null expected [-Werror=nonnull]
include/linux/highmem.h:427:9: note: in expansion of macro 'memcpy'
427 | memcpy(to + offset, from, len);
| ^~~~~~
Add a NULL pointer check for this in addition to the static annotation
to avoid both.
Fixes: 89cc4218f640 ("staging: vchiq_arm: drop unnecessary declarations")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Umang Jain <umang.jain@ideasonboard.com>
Link: https://lore.kernel.org/r/20230516202603.560554-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index dc33490ba7fbb..705c5e283c27b 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -415,7 +415,7 @@ free_pagelist(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagel
pagelistinfo->scatterlist_mapped = 0;
/* Deal with any partial cache lines (fragments) */
- if (pagelist->type >= PAGELIST_READ_WITH_FRAGMENTS) {
+ if (pagelist->type >= PAGELIST_READ_WITH_FRAGMENTS && g_fragments_base) {
char *fragments = g_fragments_base +
(pagelist->type - PAGELIST_READ_WITH_FRAGMENTS) *
g_fragments_size;
@@ -462,7 +462,7 @@ free_pagelist(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagel
cleanup_pagelistinfo(instance, pagelistinfo);
}
-int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state)
+static int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state)
{
struct device *dev = &pdev->dev;
struct vchiq_drvdata *drvdata = platform_get_drvdata(pdev);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 409/591] usb: dwc3: qcom: Fix potential memory leak
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 408/591] staging: vchiq_arm: mark vchiq_platform_init() static Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 410/591] usb: gadget: u_serial: Add null pointer check in gserial_suspend Greg Kroah-Hartman
` (185 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladislav Efanov, Shawn Guo,
Sasha Levin
From: Vladislav Efanov <VEfanov@ispras.ru>
[ Upstream commit 097fb3ee710d4de83b8d4f5589e8ee13e0f0541e ]
Function dwc3_qcom_probe() allocates memory for resource structure
which is pointed by parent_res pointer. This memory is not
freed. This leads to memory leak. Use stack memory to prevent
memory leak.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Link: https://lore.kernel.org/r/20230517172518.442591-1-VEfanov@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc3/dwc3-qcom.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
index 79b22abf97276..482260182d656 100644
--- a/drivers/usb/dwc3/dwc3-qcom.c
+++ b/drivers/usb/dwc3/dwc3-qcom.c
@@ -800,6 +800,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
struct device *dev = &pdev->dev;
struct dwc3_qcom *qcom;
struct resource *res, *parent_res = NULL;
+ struct resource local_res;
int ret, i;
bool ignore_pipe_clk;
bool wakeup_source;
@@ -851,9 +852,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
if (np) {
parent_res = res;
} else {
- parent_res = kmemdup(res, sizeof(struct resource), GFP_KERNEL);
- if (!parent_res)
- return -ENOMEM;
+ memcpy(&local_res, res, sizeof(struct resource));
+ parent_res = &local_res;
parent_res->start = res->start +
qcom->acpi_pdata->qscratch_base_offset;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 410/591] usb: gadget: u_serial: Add null pointer check in gserial_suspend
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 409/591] usb: dwc3: qcom: Fix potential memory leak Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 411/591] extcon: Fix kernel doc of property fields to avoid warnings Greg Kroah-Hartman
` (184 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Prashanth K, Sasha Levin
From: Prashanth K <quic_prashk@quicinc.com>
[ Upstream commit 2f6ecb89fe8feb2b60a53325b0eeb9866d88909a ]
Consider a case where gserial_disconnect has already cleared
gser->ioport. And if gserial_suspend gets called afterwards,
it will lead to accessing of gser->ioport and thus causing
null pointer dereference.
Avoid this by adding a null pointer check. Added a static
spinlock to prevent gser->ioport from becoming null after
the newly added null pointer check.
Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks")
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Link: https://lore.kernel.org/r/1683278317-11774-1-git-send-email-quic_prashk@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/u_serial.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index db6fd0238d4b4..ea2c5b6cde8cd 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -1419,10 +1419,19 @@ EXPORT_SYMBOL_GPL(gserial_disconnect);
void gserial_suspend(struct gserial *gser)
{
- struct gs_port *port = gser->ioport;
+ struct gs_port *port;
unsigned long flags;
- spin_lock_irqsave(&port->port_lock, flags);
+ spin_lock_irqsave(&serial_port_lock, flags);
+ port = gser->ioport;
+
+ if (!port) {
+ spin_unlock_irqrestore(&serial_port_lock, flags);
+ return;
+ }
+
+ spin_lock(&port->port_lock);
+ spin_unlock(&serial_port_lock);
port->suspended = true;
spin_unlock_irqrestore(&port->port_lock, flags);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 411/591] extcon: Fix kernel doc of property fields to avoid warnings
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 410/591] usb: gadget: u_serial: Add null pointer check in gserial_suspend Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 412/591] extcon: Fix kernel doc of property capability " Greg Kroah-Hartman
` (183 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Chanwoo Choi,
Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 7e77e0b7a9f4cdf91cb0950749b40c840ea63efc ]
Kernel documentation has to be synchronized with a code, otherwise
the validator is not happy:
Function parameter or member 'usb_propval' not described in 'extcon_cable'
Function parameter or member 'chg_propval' not described in 'extcon_cable'
Function parameter or member 'jack_propval' not described in 'extcon_cable'
Function parameter or member 'disp_propval' not described in 'extcon_cable'
Describe the fields added in the past.
Fixes: 067c1652e7a7 ("extcon: Add the support for extcon property according to extcon type")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/extcon/extcon.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
index e1c71359b6051..01fd920685c2c 100644
--- a/drivers/extcon/extcon.c
+++ b/drivers/extcon/extcon.c
@@ -206,6 +206,10 @@ static const struct __extcon_info {
* @attr_name: "name" sysfs entry
* @attr_state: "state" sysfs entry
* @attrs: the array pointing to attr_name and attr_state for attr_g
+ * @usb_propval: the array of USB connector properties
+ * @chg_propval: the array of charger connector properties
+ * @jack_propval: the array of jack connector properties
+ * @disp_propval: the array of display connector properties
*/
struct extcon_cable {
struct extcon_dev *edev;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 412/591] extcon: Fix kernel doc of property capability fields to avoid warnings
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 411/591] extcon: Fix kernel doc of property fields to avoid warnings Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 413/591] usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() Greg Kroah-Hartman
` (182 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Chanwoo Choi,
Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 73346b9965ebda2feb7fef8629e9b28baee820e3 ]
Kernel documentation has to be synchronized with a code, otherwise
the validator is not happy:
Function parameter or member 'usb_bits' not described in 'extcon_cable'
Function parameter or member 'chg_bits' not described in 'extcon_cable'
Function parameter or member 'jack_bits' not described in 'extcon_cable'
Function parameter or member 'disp_bits' not described in 'extcon_cable'
Describe the fields added in the past.
Fixes: ceaa98f442cf ("extcon: Add the support for the capability of each property")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/extcon/extcon.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
index 01fd920685c2c..7141dd0d407d8 100644
--- a/drivers/extcon/extcon.c
+++ b/drivers/extcon/extcon.c
@@ -210,6 +210,10 @@ static const struct __extcon_info {
* @chg_propval: the array of charger connector properties
* @jack_propval: the array of jack connector properties
* @disp_propval: the array of display connector properties
+ * @usb_bits: the bit array of the USB connector property capabilities
+ * @chg_bits: the bit array of the charger connector property capabilities
+ * @jack_bits: the bit array of the jack connector property capabilities
+ * @disp_bits: the bit array of the display connector property capabilities
*/
struct extcon_cable {
struct extcon_dev *edev;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 413/591] usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 412/591] extcon: Fix kernel doc of property capability " Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 414/591] usb: hide unused usbfs_notify_suspend/resume functions Greg Kroah-Hartman
` (181 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Yang, Dongliang Mu, Sasha Levin
From: Li Yang <lidaxian@hust.edu.cn>
[ Upstream commit 342161c11403ea00e9febc16baab1d883d589d04 ]
Smatch reports:
drivers/usb/phy/phy-tahvo.c: tahvo_usb_probe()
warn: missing unwind goto?
After geting irq, if ret < 0, it will return without error handling to
free memory.
Just add error handling to fix this problem.
Fixes: 0d45a1373e66 ("usb: phy: tahvo: add IRQ check")
Signed-off-by: Li Yang <lidaxian@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Link: https://lore.kernel.org/r/20230420140832.9110-1-lidaxian@hust.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/phy/phy-tahvo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c
index f2d2cc586c5b7..da63d7e4d2709 100644
--- a/drivers/usb/phy/phy-tahvo.c
+++ b/drivers/usb/phy/phy-tahvo.c
@@ -391,7 +391,7 @@ static int tahvo_usb_probe(struct platform_device *pdev)
tu->irq = ret = platform_get_irq(pdev, 0);
if (ret < 0)
- return ret;
+ goto err_remove_phy;
ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt,
IRQF_ONESHOT,
"tahvo-vbus", tu);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 414/591] usb: hide unused usbfs_notify_suspend/resume functions
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 413/591] usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 415/591] usb: misc: eud: Fix eud sysfs path (use qcom_eud) Greg Kroah-Hartman
` (180 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Sebastian Reichel,
Alan Stern, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 8e6bd945e6dde64fbc60ec3fe252164493a8d3a2 ]
The declaration is in an #ifdef, which causes warnings when building
with 'make W=1' and without CONFIG_PM:
drivers/usb/core/devio.c:742:6: error: no previous prototype for 'usbfs_notify_suspend'
drivers/usb/core/devio.c:747:6: error: no previous prototype for 'usbfs_notify_resume'
Use the same #ifdef check around the function definitions to avoid
the warnings and slightly shrink the USB core.
Fixes: 7794f486ed0b ("usbfs: Add ioctls for runtime power management")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20230516202103.558301-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/devio.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 984de3f5e8eb9..4184cd65a6aac 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -747,6 +747,7 @@ static int driver_resume(struct usb_interface *intf)
return 0;
}
+#ifdef CONFIG_PM
/* The following routines apply to the entire device, not interfaces */
void usbfs_notify_suspend(struct usb_device *udev)
{
@@ -765,6 +766,7 @@ void usbfs_notify_resume(struct usb_device *udev)
}
mutex_unlock(&usbfs_mutex);
}
+#endif
struct usb_driver usbfs_driver = {
.name = "usbfs",
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 415/591] usb: misc: eud: Fix eud sysfs path (use qcom_eud)
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 414/591] usb: hide unused usbfs_notify_suspend/resume functions Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 416/591] serial: core: lock port for stop_rx() in uart_suspend_port() Greg Kroah-Hartman
` (179 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Manivannan Sadhasivam,
Bhupesh Sharma, Sasha Levin
From: Bhupesh Sharma <bhupesh.sharma@linaro.org>
[ Upstream commit f16135918b5f8b510db014ecf0a069e34c02382e ]
The eud sysfs enablement path is currently mentioned in the
Documentation as:
/sys/bus/platform/drivers/eud/.../enable
Instead it should be:
/sys/bus/platform/drivers/qcom_eud/.../enable
Fix the same.
Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)")
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Bhupesh Sharma <bhupesh.sharma@linaro.org>
Link: https://lore.kernel.org/r/20230517211756.2483552-2-bhupesh.sharma@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/ABI/testing/sysfs-driver-eud | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/ABI/testing/sysfs-driver-eud b/Documentation/ABI/testing/sysfs-driver-eud
index 83f3872182a40..2bab0db2d2f0f 100644
--- a/Documentation/ABI/testing/sysfs-driver-eud
+++ b/Documentation/ABI/testing/sysfs-driver-eud
@@ -1,4 +1,4 @@
-What: /sys/bus/platform/drivers/eud/.../enable
+What: /sys/bus/platform/drivers/qcom_eud/.../enable
Date: February 2022
Contact: Souradeep Chowdhury <quic_schowdhu@quicinc.com>
Description:
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 416/591] serial: core: lock port for stop_rx() in uart_suspend_port()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 415/591] usb: misc: eud: Fix eud sysfs path (use qcom_eud) Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 417/591] serial: 8250: lock port for stop_rx() in omap8250_irq() Greg Kroah-Hartman
` (178 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Ogness, Douglas Anderson,
Sasha Levin
From: John Ogness <john.ogness@linutronix.de>
[ Upstream commit abcb0cf1f5b2d99b1d117a4dbce334120e358d6d ]
The uarts_ops stop_rx() callback expects that the port->lock is
taken and interrupts are disabled.
Fixes: c9d2325cdb92 ("serial: core: Do stop_rx in suspend path for console if console_suspend is disabled")
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20230525093159.223817-3-john.ogness@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/serial_core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 23a7ab0de4445..b0a4677172062 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2334,8 +2334,11 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
* able to Re-start_rx later.
*/
if (!console_suspend_enabled && uart_console(uport)) {
- if (uport->ops->start_rx)
+ if (uport->ops->start_rx) {
+ spin_lock_irq(&uport->lock);
uport->ops->stop_rx(uport);
+ spin_unlock_irq(&uport->lock);
+ }
goto unlock;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 417/591] serial: 8250: lock port for stop_rx() in omap8250_irq()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 416/591] serial: core: lock port for stop_rx() in uart_suspend_port() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 418/591] serial: core: lock port for start_rx() in uart_resume_port() Greg Kroah-Hartman
` (177 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, John Ogness, Tony Lindgren,
Sasha Levin
From: John Ogness <john.ogness@linutronix.de>
[ Upstream commit ca73a892c5bec4b08a2fa22b3015e98ed905abb7 ]
The uarts_ops stop_rx() callback expects that the port->lock is
taken and interrupts are disabled.
Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property")
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20230525093159.223817-4-john.ogness@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_omap.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index 79bdf933c67e6..7ecd2d379292b 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -641,7 +641,9 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
up->ier = port->serial_in(port, UART_IER);
if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
+ spin_lock(&port->lock);
port->ops->stop_rx(port);
+ spin_unlock(&port->lock);
} else {
/* Keep restarting the timer until
* the input overrun subsides.
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 418/591] serial: core: lock port for start_rx() in uart_resume_port()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 417/591] serial: 8250: lock port for stop_rx() in omap8250_irq() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 419/591] serial: 8250: lock port for UART_IER access in omap8250_irq() Greg Kroah-Hartman
` (176 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Ogness, Douglas Anderson,
Sasha Levin
From: John Ogness <john.ogness@linutronix.de>
[ Upstream commit 51e45fba14bf08b66bca764a083c7f2e2ff62f01 ]
The only user of the start_rx() callback (qcom_geni) directly calls
its own stop_rx() callback. Since stop_rx() requires that the
port->lock is taken and interrupts are disabled, the start_rx()
callback has the same requirement.
Fixes: cfab87c2c271 ("serial: core: Introduce callback for start_rx and do stop_rx in suspend only if this callback implementation is present.")
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20230525093159.223817-5-john.ogness@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/serial_core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index b0a4677172062..2cc5c68c8689f 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2431,8 +2431,11 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
if (console_suspend_enabled)
uart_change_pm(state, UART_PM_STATE_ON);
uport->ops->set_termios(uport, &termios, NULL);
- if (!console_suspend_enabled && uport->ops->start_rx)
+ if (!console_suspend_enabled && uport->ops->start_rx) {
+ spin_lock_irq(&uport->lock);
uport->ops->start_rx(uport);
+ spin_unlock_irq(&uport->lock);
+ }
if (console_suspend_enabled)
console_start(uport->cons);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 419/591] serial: 8250: lock port for UART_IER access in omap8250_irq()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 418/591] serial: core: lock port for start_rx() in uart_resume_port() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 420/591] kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR Greg Kroah-Hartman
` (175 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, John Ogness, Tony Lindgren,
Sasha Levin
From: John Ogness <john.ogness@linutronix.de>
[ Upstream commit 25614735a647693c1260f253dc3ab32127697806 ]
omap8250_irq() accesses UART_IER. This register is modified twice
by each console write (serial8250_console_write()) under the port
lock. omap8250_irq() must also take the port lock to guanentee
synchronized access to UART_IER.
Since the port lock is already being taken for the stop_rx() callback
and since it is safe to call cancel_delayed_work() while holding the
port lock, simply extend the port lock region to include UART_IER
access.
Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property")
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20230525093159.223817-8-john.ogness@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_omap.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index 7ecd2d379292b..17a230281ebe0 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -639,17 +639,18 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
if ((lsr & UART_LSR_OE) && up->overrun_backoff_time_ms > 0) {
unsigned long delay;
+ /* Synchronize UART_IER access against the console. */
+ spin_lock(&port->lock);
up->ier = port->serial_in(port, UART_IER);
if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
- spin_lock(&port->lock);
port->ops->stop_rx(port);
- spin_unlock(&port->lock);
} else {
/* Keep restarting the timer until
* the input overrun subsides.
*/
cancel_delayed_work(&up->overrun_backoff);
}
+ spin_unlock(&port->lock);
delay = msecs_to_jiffies(up->overrun_backoff_time_ms);
schedule_delayed_work(&up->overrun_backoff, delay);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 420/591] kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 419/591] serial: 8250: lock port for UART_IER access in omap8250_irq() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 421/591] lkdtm: replace ll_rw_block with submit_bh Greg Kroah-Hartman
` (174 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muchun Song, Tejun Heo, Sasha Levin
From: Muchun Song <songmuchun@bytedance.com>
[ Upstream commit 30480b988f88c279752f3202a26b6fee5f586aef ]
The root->ino_idr is supposed to be protected by kernfs_idr_lock, fix
it.
Fixes: 488dee96bb62 ("kernfs: allow creating kernfs objects with arbitrary uid/gid")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/20230523024017.24851-1-songmuchun@bytedance.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/kernfs/dir.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
index f33b3baad07cb..44842e6cf0a9b 100644
--- a/fs/kernfs/dir.c
+++ b/fs/kernfs/dir.c
@@ -652,7 +652,9 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
return kn;
err_out3:
+ spin_lock(&kernfs_idr_lock);
idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
+ spin_unlock(&kernfs_idr_lock);
err_out2:
kmem_cache_free(kernfs_node_cache, kn);
err_out1:
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 421/591] lkdtm: replace ll_rw_block with submit_bh
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 420/591] kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 422/591] i3c: master: svc: fix cpu schedule in spin lock Greg Kroah-Hartman
` (173 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yue Zhao, Kees Cook, Sasha Levin
From: Yue Zhao <findns94@gmail.com>
[ Upstream commit b290df06811852d4cc36f4b8a2a30c2063197a74 ]
Function ll_rw_block was removed in commit 79f597842069 ("fs/buffer:
remove ll_rw_block() helper"). There is no unified function to sumbit
read or write buffer in block layer for now. Consider similar sematics,
we can choose submit_bh() to replace ll_rw_block() as predefined crash
point. In submit_bh(), it also takes read or write flag as the first
argument and invoke submit_bio() to submit I/O request to block layer.
Fixes: 79f597842069 ("fs/buffer: remove ll_rw_block() helper")
Signed-off-by: Yue Zhao <findns94@gmail.com>
Acked-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230503162944.3969-1-findns94@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/fault-injection/provoke-crashes.rst | 2 +-
drivers/misc/lkdtm/core.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst
index 3abe842256139..1f087e502ca6d 100644
--- a/Documentation/fault-injection/provoke-crashes.rst
+++ b/Documentation/fault-injection/provoke-crashes.rst
@@ -29,7 +29,7 @@ recur_count
cpoint_name
Where in the kernel to trigger the action. It can be
one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
- FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT.
+ FS_SUBMIT_BH, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT.
cpoint_type
Indicates the action to be taken on hitting the crash point.
diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c
index b4712ff196b4e..0772e4a4757e9 100644
--- a/drivers/misc/lkdtm/core.c
+++ b/drivers/misc/lkdtm/core.c
@@ -79,7 +79,7 @@ static struct crashpoint crashpoints[] = {
CRASHPOINT("INT_HARDWARE_ENTRY", "do_IRQ"),
CRASHPOINT("INT_HW_IRQ_EN", "handle_irq_event"),
CRASHPOINT("INT_TASKLET_ENTRY", "tasklet_action"),
- CRASHPOINT("FS_DEVRW", "ll_rw_block"),
+ CRASHPOINT("FS_SUBMIT_BH", "submit_bh"),
CRASHPOINT("MEM_SWAPOUT", "shrink_inactive_list"),
CRASHPOINT("TIMERADD", "hrtimer_start"),
CRASHPOINT("SCSI_QUEUE_RQ", "scsi_queue_rq"),
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 422/591] i3c: master: svc: fix cpu schedule in spin lock
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 421/591] lkdtm: replace ll_rw_block with submit_bh Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 423/591] coresight: Fix loss of connection info when a module is unloaded Greg Kroah-Hartman
` (172 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Clark Wang, Miquel Raynal,
Alexandre Belloni, Sasha Levin
From: Clark Wang <xiaoning.wang@nxp.com>
[ Upstream commit 33beadb3b1ab74e69db2c49d9663f3a93a273943 ]
pm_runtime_resume_and_get() may call sleep(). It cannot be used in
svc_i3c_master_start_xfer_locked(), because it is in a spin lock.
Move the pm runtime operations to svc_i3c_master_enqueue_xfer().
Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
Fixes: 05be23ef78f7 ("i3c: master: svc: add runtime pm support")
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/r/20230517033030.3068085-2-xiaoning.wang@nxp.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/svc-i3c-master.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index d6e9ed74cdcf4..d47360f8a1f36 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -1090,12 +1090,6 @@ static void svc_i3c_master_start_xfer_locked(struct svc_i3c_master *master)
if (!xfer)
return;
- ret = pm_runtime_resume_and_get(master->dev);
- if (ret < 0) {
- dev_err(master->dev, "<%s> Cannot get runtime PM.\n", __func__);
- return;
- }
-
svc_i3c_master_clear_merrwarn(master);
svc_i3c_master_flush_fifo(master);
@@ -1110,9 +1104,6 @@ static void svc_i3c_master_start_xfer_locked(struct svc_i3c_master *master)
break;
}
- pm_runtime_mark_last_busy(master->dev);
- pm_runtime_put_autosuspend(master->dev);
-
xfer->ret = ret;
complete(&xfer->comp);
@@ -1133,6 +1124,13 @@ static void svc_i3c_master_enqueue_xfer(struct svc_i3c_master *master,
struct svc_i3c_xfer *xfer)
{
unsigned long flags;
+ int ret;
+
+ ret = pm_runtime_resume_and_get(master->dev);
+ if (ret < 0) {
+ dev_err(master->dev, "<%s> Cannot get runtime PM.\n", __func__);
+ return;
+ }
init_completion(&xfer->comp);
spin_lock_irqsave(&master->xferqueue.lock, flags);
@@ -1143,6 +1141,9 @@ static void svc_i3c_master_enqueue_xfer(struct svc_i3c_master *master,
svc_i3c_master_start_xfer_locked(master);
}
spin_unlock_irqrestore(&master->xferqueue.lock, flags);
+
+ pm_runtime_mark_last_busy(master->dev);
+ pm_runtime_put_autosuspend(master->dev);
}
static bool
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 423/591] coresight: Fix loss of connection info when a module is unloaded
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 422/591] i3c: master: svc: fix cpu schedule in spin lock Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 424/591] mfd: rt5033: Drop rt5033-battery sub-device Greg Kroah-Hartman
` (171 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suzuki K Poulose, Mike Leach,
James Clark, Sasha Levin
From: James Clark <james.clark@arm.com>
[ Upstream commit c45b2835e7b205783bdfe08cc98fa86a7c5eeb74 ]
child_fwnode should be a read only property based on the DT or ACPI. If
it's cleared on the parent device when a child is unloaded, then when
the child is loaded again the connection won't be remade.
child_dev should be cleared instead which signifies that the connection
should be remade when the child_fwnode registers a new coresight_device.
Similarly the reference count shouldn't be decremented as long as the
parent device exists. The correct place to drop the reference is in
coresight_release_platform_data() which is already done.
Reproducible on Juno with the following steps:
# load all coresight modules.
$ cd /sys/bus/coresight/devices/
$ echo 1 > tmc_etr0/enable_sink
$ echo 1 > etm0/enable_source
# Works fine ^
$ echo 0 > etm0/enable_source
$ rmmod coresight-funnel
$ modprobe coresight-funnel
$ echo 1 > etm0/enable_source
-bash: echo: write error: Invalid argument
Fixes: 37ea1ffddffa ("coresight: Use fwnode handle instead of device names")
Fixes: 2af89ebacf29 ("coresight: Clear the connection field properly")
Tested-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Signed-off-by: James Clark <james.clark@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20230425143542.2305069-2-james.clark@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-core.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
index f3068175ca9d9..bcb08fadccf21 100644
--- a/drivers/hwtracing/coresight/coresight-core.c
+++ b/drivers/hwtracing/coresight/coresight-core.c
@@ -1446,13 +1446,8 @@ static int coresight_remove_match(struct device *dev, void *data)
if (csdev->dev.fwnode == conn->child_fwnode) {
iterator->orphan = true;
coresight_remove_links(iterator, conn);
- /*
- * Drop the reference to the handle for the remote
- * device acquired in parsing the connections from
- * platform data.
- */
- fwnode_handle_put(conn->child_fwnode);
- conn->child_fwnode = NULL;
+
+ conn->child_dev = NULL;
/* No need to continue */
break;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 424/591] mfd: rt5033: Drop rt5033-battery sub-device
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 423/591] coresight: Fix loss of connection info when a module is unloaded Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 425/591] media: venus: helpers: Fix ALIGN() of non power of two Greg Kroah-Hartman
` (170 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephan Gerhold, Jakob Hauser,
Linus Walleij, Lee Jones, Sasha Levin
From: Stephan Gerhold <stephan@gerhold.net>
[ Upstream commit 43db1344e0f8c1eb687a1d6cd5b0de3009ab66cb ]
The fuel gauge in the RT5033 PMIC (rt5033-battery) has its own I2C bus
and interrupt lines. Therefore, it is not part of the MFD device
and needs to be specified separately in the device tree.
Fixes: 0b271258544b ("mfd: rt5033: Add Richtek RT5033 driver core.")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Signed-off-by: Jakob Hauser <jahau@rocketmail.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Lee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/6a8a19bc67b5be3732882e8131ad2ffcb546ac03.1684182964.git.jahau@rocketmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/rt5033.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c
index f1236a9acf304..df095e91e2666 100644
--- a/drivers/mfd/rt5033.c
+++ b/drivers/mfd/rt5033.c
@@ -41,9 +41,6 @@ static const struct mfd_cell rt5033_devs[] = {
{
.name = "rt5033-charger",
.of_compatible = "richtek,rt5033-charger",
- }, {
- .name = "rt5033-battery",
- .of_compatible = "richtek,rt5033-battery",
}, {
.name = "rt5033-led",
.of_compatible = "richtek,rt5033-led",
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 425/591] media: venus: helpers: Fix ALIGN() of non power of two
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 424/591] mfd: rt5033: Drop rt5033-battery sub-device Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 426/591] media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var() Greg Kroah-Hartman
` (169 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rikard Falkeborn, Stanimir Varbanov,
Mauro Carvalho Chehab, Sasha Levin
From: Rikard Falkeborn <rikard.falkeborn@gmail.com>
[ Upstream commit 927e78ac8bc58155316cf6f46026e1912bbbbcfc ]
ALIGN() expects its second argument to be a power of 2, otherwise
incorrect results are produced for some inputs. The output can be
both larger or smaller than what is expected.
For example, ALIGN(304, 192) equals 320 instead of 384, and
ALIGN(65, 192) equals 256 instead of 192.
However, nestling two ALIGN() as is done in this case seem to only
produce results equal to or bigger than the expected result if ALIGN()
had handled non powers of two, and that in turn results in framesizes
that are either the correct size or too large.
Fortunately, since 192 * 4 / 3 equals 256, it turns out that one ALIGN()
is sufficient.
Fixes: ab1eda449c6e ("media: venus: vdec: handle 10bit bitstreams")
Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/helpers.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
index ab6a29ffc81e2..ca6555bdc92fa 100644
--- a/drivers/media/platform/qcom/venus/helpers.c
+++ b/drivers/media/platform/qcom/venus/helpers.c
@@ -1036,8 +1036,8 @@ static u32 get_framesize_raw_yuv420_tp10_ubwc(u32 width, u32 height)
u32 extradata = SZ_16K;
u32 size;
- y_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256);
- uv_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256);
+ y_stride = ALIGN(width * 4 / 3, 256);
+ uv_stride = ALIGN(width * 4 / 3, 256);
y_sclines = ALIGN(height, 16);
uv_sclines = ALIGN((height + 1) >> 1, 16);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 426/591] media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 425/591] media: venus: helpers: Fix ALIGN() of non power of two Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 427/591] sh: Avoid using IRQ0 on SH3 and SH4 Greg Kroah-Hartman
` (168 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Hans de Goede,
Mauro Carvalho Chehab, Sasha Levin
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 1657f2934daf89e8d9fa4b2697008909eb22c73e ]
Ideally, strlen(cur->string.pointer) and strlen(out) would be the same.
But this code is using strscpy() to avoid a potential buffer overflow.
So in the same way we should take the strlen() of the smaller string to
avoid a buffer overflow in the caller, gmin_get_var_int().
Link: https://lore.kernel.org/r/26124bcd-8132-4483-9d67-225c87d424e8@kili.mountain
Fixes: 387041cda44e ("media: atomisp: improve sensor detection code to use _DSM table")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
index 3d41fab661cf0..789b13db80b2f 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
@@ -1280,7 +1280,7 @@ static int gmin_get_config_dsm_var(struct device *dev,
dev_info(dev, "found _DSM entry for '%s': %s\n", var,
cur->string.pointer);
strscpy(out, cur->string.pointer, *out_len);
- *out_len = strlen(cur->string.pointer);
+ *out_len = strlen(out);
ACPI_FREE(obj);
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 427/591] sh: Avoid using IRQ0 on SH3 and SH4
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 426/591] media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 428/591] gfs2: Fix duplicate should_fault_in_pages() call Greg Kroah-Hartman
` (167 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Shtylyov, Geert Uytterhoeven,
John Paul Adrian Glaubitz, Sasha Levin
From: Sergey Shtylyov <s.shtylyov@omp.ru>
[ Upstream commit a8ac2961148e8c720dc760f2e06627cd5c55a154 ]
IRQ0 is no longer returned by platform_get_irq() and its ilk -- they now
return -EINVAL instead. However, the kernel code supporting SH3/4-based
SoCs still maps the IRQ #s starting at 0 -- modify that code to start the
IRQ #s from 16 instead.
The patch should mostly affect the AP-SH4A-3A/AP-SH4AD-0A boards as they
indeed are using IRQ0 for the SMSC911x compatible Ethernet chip.
Fixes: ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Link: https://lore.kernel.org/r/71105dbf-cdb0-72e1-f9eb-eeda8e321696@omp.ru
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sh/include/mach-common/mach/highlander.h | 2 +-
arch/sh/include/mach-common/mach/r2d.h | 2 +-
arch/sh/include/mach-dreamcast/mach/sysasic.h | 2 +-
arch/sh/include/mach-se/mach/se7724.h | 2 +-
arch/sh/kernel/cpu/sh3/entry.S | 4 ++--
include/linux/sh_intc.h | 6 +++---
6 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/arch/sh/include/mach-common/mach/highlander.h b/arch/sh/include/mach-common/mach/highlander.h
index fb44c299d0337..b12c795584225 100644
--- a/arch/sh/include/mach-common/mach/highlander.h
+++ b/arch/sh/include/mach-common/mach/highlander.h
@@ -176,7 +176,7 @@
#define IVDR_CK_ON 4 /* iVDR Clock ON */
#endif
-#define HL_FPGA_IRQ_BASE 200
+#define HL_FPGA_IRQ_BASE (200 + 16)
#define HL_NR_IRL 15
#define IRQ_AX88796 (HL_FPGA_IRQ_BASE + 0)
diff --git a/arch/sh/include/mach-common/mach/r2d.h b/arch/sh/include/mach-common/mach/r2d.h
index 0d7e483c7d3f5..69bc1907c5637 100644
--- a/arch/sh/include/mach-common/mach/r2d.h
+++ b/arch/sh/include/mach-common/mach/r2d.h
@@ -47,7 +47,7 @@
#define IRLCNTR1 (PA_BCR + 0) /* Interrupt Control Register1 */
-#define R2D_FPGA_IRQ_BASE 100
+#define R2D_FPGA_IRQ_BASE (100 + 16)
#define IRQ_VOYAGER (R2D_FPGA_IRQ_BASE + 0)
#define IRQ_EXT (R2D_FPGA_IRQ_BASE + 1)
diff --git a/arch/sh/include/mach-dreamcast/mach/sysasic.h b/arch/sh/include/mach-dreamcast/mach/sysasic.h
index ed69ce7f20301..3b27be9a527ea 100644
--- a/arch/sh/include/mach-dreamcast/mach/sysasic.h
+++ b/arch/sh/include/mach-dreamcast/mach/sysasic.h
@@ -22,7 +22,7 @@
takes.
*/
-#define HW_EVENT_IRQ_BASE 48
+#define HW_EVENT_IRQ_BASE (48 + 16)
/* IRQ 13 */
#define HW_EVENT_VSYNC (HW_EVENT_IRQ_BASE + 5) /* VSync */
diff --git a/arch/sh/include/mach-se/mach/se7724.h b/arch/sh/include/mach-se/mach/se7724.h
index 1fe28820dfa95..ea6c46633b337 100644
--- a/arch/sh/include/mach-se/mach/se7724.h
+++ b/arch/sh/include/mach-se/mach/se7724.h
@@ -37,7 +37,7 @@
#define IRQ2_IRQ evt2irq(0x640)
/* Bits in IRQ012 registers */
-#define SE7724_FPGA_IRQ_BASE 220
+#define SE7724_FPGA_IRQ_BASE (220 + 16)
/* IRQ0 */
#define IRQ0_BASE SE7724_FPGA_IRQ_BASE
diff --git a/arch/sh/kernel/cpu/sh3/entry.S b/arch/sh/kernel/cpu/sh3/entry.S
index e48b3dd996f58..b1f5b3c58a018 100644
--- a/arch/sh/kernel/cpu/sh3/entry.S
+++ b/arch/sh/kernel/cpu/sh3/entry.S
@@ -470,9 +470,9 @@ ENTRY(handle_interrupt)
mov r4, r0 ! save vector->jmp table offset for later
shlr2 r4 ! vector to IRQ# conversion
- add #-0x10, r4
- cmp/pz r4 ! is it a valid IRQ?
+ mov #0x10, r5
+ cmp/hs r5, r4 ! is it a valid IRQ?
bt 10f
/*
diff --git a/include/linux/sh_intc.h b/include/linux/sh_intc.h
index 37ad81058d6ae..27ae79191bdc3 100644
--- a/include/linux/sh_intc.h
+++ b/include/linux/sh_intc.h
@@ -13,9 +13,9 @@
/*
* Convert back and forth between INTEVT and IRQ values.
*/
-#ifdef CONFIG_CPU_HAS_INTEVT
-#define evt2irq(evt) (((evt) >> 5) - 16)
-#define irq2evt(irq) (((irq) + 16) << 5)
+#ifdef CONFIG_CPU_HAS_INTEVT /* Avoid IRQ0 (invalid for platform devices) */
+#define evt2irq(evt) ((evt) >> 5)
+#define irq2evt(irq) ((irq) << 5)
#else
#define evt2irq(evt) (evt)
#define irq2evt(irq) (irq)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 428/591] gfs2: Fix duplicate should_fault_in_pages() call
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 427/591] sh: Avoid using IRQ0 on SH3 and SH4 Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 429/591] f2fs: fix potential deadlock due to unpaired node_write lock use Greg Kroah-Hartman
` (166 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bob Peterson, Andreas Gruenbacher,
Sasha Levin
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit c8ed1b35931245087968fd95b2ec3dfc50f77769 ]
In gfs2_file_buffered_write(), we currently jump from the second call of
function should_fault_in_pages() to above the first call, so
should_fault_in_pages() is getting called twice in a row, causing it to
accidentally fall back to single-page writes rather than trying the more
efficient multi-page writes first.
Fix that by moving the retry label to the correct place, behind the
first call to should_fault_in_pages().
Fixes: e1fa9ea85ce8 ("gfs2: Stop using glock holder auto-demotion for now")
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index bc6cd5f4b1077..c367f1678d5dc 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -1029,8 +1029,8 @@ static ssize_t gfs2_file_buffered_write(struct kiocb *iocb,
}
gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, gh);
-retry:
if (should_fault_in_pages(from, iocb, &prev_count, &window_size)) {
+retry:
window_size -= fault_in_iov_iter_readable(from, window_size);
if (!window_size) {
ret = -EFAULT;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 429/591] f2fs: fix potential deadlock due to unpaired node_write lock use
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 428/591] gfs2: Fix duplicate should_fault_in_pages() call Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 430/591] f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() Greg Kroah-Hartman
` (165 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
From: Chao Yu <chao@kernel.org>
[ Upstream commit f082c6b205a06953f26c40bdc7621cc5a58ceb7c ]
If S_NOQUOTA is cleared from inode during data page writeback of quota
file, it may miss to unlock node_write lock, result in potential
deadlock, fix to use the lock in paired.
Kworker Thread
- writepage
if (IS_NOQUOTA())
f2fs_down_read(&sbi->node_write);
- vfs_cleanup_quota_inode
- inode->i_flags &= ~S_NOQUOTA;
if (IS_NOQUOTA())
f2fs_up_read(&sbi->node_write);
Fixes: 79963d967b49 ("f2fs: shrink node_write lock coverage")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/compress.c | 7 ++++---
fs/f2fs/data.c | 7 ++++---
2 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index b160863eca141..e50d5848c1001 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -1235,6 +1235,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
unsigned int last_index = cc->cluster_size - 1;
loff_t psize;
int i, err;
+ bool quota_inode = IS_NOQUOTA(inode);
/* we should bypass data pages to proceed the kworkder jobs */
if (unlikely(f2fs_cp_error(sbi))) {
@@ -1242,7 +1243,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
goto out_free;
}
- if (IS_NOQUOTA(inode)) {
+ if (quota_inode) {
/*
* We need to wait for node_write to avoid block allocation during
* checkpoint. This can only happen to quota writes which can cause
@@ -1364,7 +1365,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
set_inode_flag(inode, FI_FIRST_BLOCK_WRITTEN);
f2fs_put_dnode(&dn);
- if (IS_NOQUOTA(inode))
+ if (quota_inode)
f2fs_up_read(&sbi->node_write);
else
f2fs_unlock_op(sbi);
@@ -1390,7 +1391,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
out_put_dnode:
f2fs_put_dnode(&dn);
out_unlock_op:
- if (IS_NOQUOTA(inode))
+ if (quota_inode)
f2fs_up_read(&sbi->node_write);
else
f2fs_unlock_op(sbi);
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 36db9aab47790..c230824ab5e6e 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2759,6 +2759,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
loff_t psize = (loff_t)(page->index + 1) << PAGE_SHIFT;
unsigned offset = 0;
bool need_balance_fs = false;
+ bool quota_inode = IS_NOQUOTA(inode);
int err = 0;
struct f2fs_io_info fio = {
.sbi = sbi,
@@ -2816,19 +2817,19 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
goto out;
/* Dentry/quota blocks are controlled by checkpoint */
- if (S_ISDIR(inode->i_mode) || IS_NOQUOTA(inode)) {
+ if (S_ISDIR(inode->i_mode) || quota_inode) {
/*
* We need to wait for node_write to avoid block allocation during
* checkpoint. This can only happen to quota writes which can cause
* the below discard race condition.
*/
- if (IS_NOQUOTA(inode))
+ if (quota_inode)
f2fs_down_read(&sbi->node_write);
fio.need_lock = LOCK_DONE;
err = f2fs_do_write_data_page(&fio);
- if (IS_NOQUOTA(inode))
+ if (quota_inode)
f2fs_up_read(&sbi->node_write);
goto done;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 430/591] f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 429/591] f2fs: fix potential deadlock due to unpaired node_write lock use Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 431/591] KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes Greg Kroah-Hartman
` (164 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, butt3rflyh4ck, Chao Yu, Jaegeuk Kim,
Sasha Levin
From: Chao Yu <chao@kernel.org>
[ Upstream commit d8189834d4348ae608083e1f1f53792cfcc2a9bc ]
butt3rflyh4ck reports a bug as below:
When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize fs is
failed, f2fs kernel thread would invoke callback function to update f2fs io
info, it would call f2fs_write_end_io and may trigger null-ptr-deref in
NODE_MAPPING.
general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline]
RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370
<TASK>
bio_endio+0x5af/0x6c0 block/bio.c:1608
req_bio_endio block/blk-mq.c:761 [inline]
blk_update_request+0x5cc/0x1690 block/blk-mq.c:906
blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
__do_softirq+0x1d4/0x8ef kernel/softirq.c:571
run_ksoftirqd kernel/softirq.c:939 [inline]
run_ksoftirqd+0x31/0x60 kernel/softirq.c:931
smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164
kthread+0x33e/0x440 kernel/kthread.c:379
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The root cause is below race case can cause leaving dirty metadata
in f2fs after filesystem is remount as ro:
Thread A Thread B
- f2fs_ioc_resize_fs
- f2fs_readonly --- return false
- f2fs_resize_fs
- f2fs_remount
- write_checkpoint
- set f2fs as ro
- free_segment_range
- update meta_inode's data
Then, if f2fs_put_super() fails to write_checkpoint due to readonly
status, and meta_inode's dirty data will be writebacked after node_inode
is put, finally, f2fs_write_end_io will access NULL pointer on
sbi->node_inode.
Thread A IRQ context
- f2fs_put_super
- write_checkpoint fails
- iput(node_inode)
- node_inode = NULL
- iput(meta_inode)
- write_inode_now
- f2fs_write_meta_page
- f2fs_write_end_io
- NODE_MAPPING(sbi)
: access NULL pointer on node_inode
Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress")
Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Closes: https://lore.kernel.org/r/1684480657-2375-1-git-send-email-yangtiezhu@loongson.cn
Tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/f2fs.h | 2 +-
fs/f2fs/file.c | 2 +-
fs/f2fs/gc.c | 21 ++++++++++++++++++---
3 files changed, 20 insertions(+), 5 deletions(-)
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 8d7dc76e6f935..4d1e48c676fab 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -3817,7 +3817,7 @@ void f2fs_stop_gc_thread(struct f2fs_sb_info *sbi);
block_t f2fs_start_bidx_of_node(unsigned int node_ofs, struct inode *inode);
int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control);
void f2fs_build_gc_manager(struct f2fs_sb_info *sbi);
-int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count);
+int f2fs_resize_fs(struct file *filp, __u64 block_count);
int __init f2fs_create_garbage_collection_cache(void);
void f2fs_destroy_garbage_collection_cache(void);
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 370c40858b42f..7b94f047cbf79 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3279,7 +3279,7 @@ static int f2fs_ioc_resize_fs(struct file *filp, unsigned long arg)
sizeof(block_count)))
return -EFAULT;
- return f2fs_resize_fs(sbi, block_count);
+ return f2fs_resize_fs(filp, block_count);
}
static int f2fs_ioc_enable_verity(struct file *filp, unsigned long arg)
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index 7e497f5b349ce..3de887d07c060 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -2110,8 +2110,9 @@ static void update_fs_metadata(struct f2fs_sb_info *sbi, int secs)
}
}
-int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count)
+int f2fs_resize_fs(struct file *filp, __u64 block_count)
{
+ struct f2fs_sb_info *sbi = F2FS_I_SB(file_inode(filp));
__u64 old_block_count, shrunk_blocks;
struct cp_control cpc = { CP_RESIZE, 0, 0, 0 };
unsigned int secs;
@@ -2149,12 +2150,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count)
return -EINVAL;
}
+ err = mnt_want_write_file(filp);
+ if (err)
+ return err;
+
shrunk_blocks = old_block_count - block_count;
secs = div_u64(shrunk_blocks, BLKS_PER_SEC(sbi));
/* stop other GC */
- if (!f2fs_down_write_trylock(&sbi->gc_lock))
- return -EAGAIN;
+ if (!f2fs_down_write_trylock(&sbi->gc_lock)) {
+ err = -EAGAIN;
+ goto out_drop_write;
+ }
/* stop CP to protect MAIN_SEC in free_segment_range */
f2fs_lock_op(sbi);
@@ -2174,10 +2181,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count)
out_unlock:
f2fs_unlock_op(sbi);
f2fs_up_write(&sbi->gc_lock);
+out_drop_write:
+ mnt_drop_write_file(filp);
if (err)
return err;
freeze_super(sbi->sb);
+
+ if (f2fs_readonly(sbi->sb)) {
+ thaw_super(sbi->sb);
+ return -EROFS;
+ }
+
f2fs_down_write(&sbi->gc_lock);
f2fs_down_write(&sbi->cp_global_sem);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 431/591] KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 430/591] f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 432/591] usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() Greg Kroah-Hartman
` (163 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nico Boehr, Claudio Imbrenda,
Janosch Frank, Sasha Levin
From: Nico Boehr <nrb@linux.ibm.com>
[ Upstream commit 285cff4c0454340a4dc53f46e67f2cb1c293bd74 ]
The KVM_S390_GET_CMMA_BITS ioctl may return incorrect values when userspace
specifies a start_gfn outside of memslots.
This can occur when a VM has multiple memslots with a hole in between:
+-----+----------+--------+--------+
| ... | Slot N-1 | <hole> | Slot N |
+-----+----------+--------+--------+
^ ^ ^ ^
| | | |
GFN A A+B | |
A+B+C |
A+B+C+D
When userspace specifies a GFN in [A+B, A+B+C), it would expect to get the
CMMA values of the first dirty page in Slot N. However, userspace may get a
start_gfn of A+B+C+D with a count of 0, hence completely skipping over any
dirty pages in slot N.
The error is in kvm_s390_next_dirty_cmma(), which assumes
gfn_to_memslot_approx() will return the memslot _below_ the specified GFN
when the specified GFN lies outside a memslot. In reality it may return
either the memslot below or above the specified GFN.
When a memslot above the specified GFN is returned this happens:
- ofs is calculated, but since the memslot's base_gfn is larger than the
specified cur_gfn, ofs will underflow to a huge number.
- ofs is passed to find_next_bit(). Since ofs will exceed the memslot's
number of pages, the number of pages in the memslot is returned,
completely skipping over all bits in the memslot userspace would be
interested in.
Fix this by resetting ofs to zero when a memslot _above_ cur_gfn is
returned (cur_gfn < ms->base_gfn).
Signed-off-by: Nico Boehr <nrb@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots")
Message-Id: <20230324145424.293889-2-nrb@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kvm/kvm-s390.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 26f89ec3062ba..3775363471f0c 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -2147,6 +2147,10 @@ static unsigned long kvm_s390_next_dirty_cmma(struct kvm_memslots *slots,
ms = container_of(mnode, struct kvm_memory_slot, gfn_node[slots->node_idx]);
ofs = 0;
}
+
+ if (cur_gfn < ms->base_gfn)
+ ofs = 0;
+
ofs = find_next_bit(kvm_second_dirty_bitmap(ms), ms->npages, ofs);
while (ofs >= ms->npages && (mnode = rb_next(mnode))) {
ms = container_of(mnode, struct kvm_memory_slot, gfn_node[slots->node_idx]);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 432/591] usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 431/591] KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 433/591] usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() Greg Kroah-Hartman
` (162 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Andrew Halaney,
Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 8fd95da2cfb5046c4bb5a3cdc9eb7963ba8b10dd ]
In the probe, some resources are allocated with
dwc3_qcom_of_register_core() or dwc3_qcom_acpi_register_core(). The
corresponding resources are already coorectly freed in the error handling
path of the probe, but not in the remove function.
Fix it.
Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
Message-ID: <c0215a84cdf18fb3514c81842783ec53cf149deb.1685891059.git.christophe.jaillet@wanadoo.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc3/dwc3-qcom.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
index 482260182d656..9c01e963ae467 100644
--- a/drivers/usb/dwc3/dwc3-qcom.c
+++ b/drivers/usb/dwc3/dwc3-qcom.c
@@ -950,11 +950,15 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
static int dwc3_qcom_remove(struct platform_device *pdev)
{
struct dwc3_qcom *qcom = platform_get_drvdata(pdev);
+ struct device_node *np = pdev->dev.of_node;
struct device *dev = &pdev->dev;
int i;
device_remove_software_node(&qcom->dwc3->dev);
- of_platform_depopulate(dev);
+ if (np)
+ of_platform_depopulate(&pdev->dev);
+ else
+ platform_device_put(pdev);
for (i = qcom->num_clocks - 1; i >= 0; i--) {
clk_disable_unprepare(qcom->clks[i]);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 433/591] usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 432/591] usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 434/591] usb: common: usb-conn-gpio: Set last role to unknown before initial detection Greg Kroah-Hartman
` (161 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Andrew Halaney,
Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 4a944da707123686d372ec01ea60056902fadf35 ]
If dwc3_qcom_create_urs_usb_platdev() fails, some resources still need to
be released, as already done in the other error handling path of the
probe.
Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
Message-ID: <b69fa8dd68d816e7d24c88d3eda776ceb28c5dc5.1685890571.git.christophe.jaillet@wanadoo.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc3/dwc3-qcom.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
index 9c01e963ae467..72c22851d7eef 100644
--- a/drivers/usb/dwc3/dwc3-qcom.c
+++ b/drivers/usb/dwc3/dwc3-qcom.c
@@ -865,9 +865,10 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
if (IS_ERR_OR_NULL(qcom->urs_usb)) {
dev_err(dev, "failed to create URS USB platdev\n");
if (!qcom->urs_usb)
- return -ENODEV;
+ ret = -ENODEV;
else
- return PTR_ERR(qcom->urs_usb);
+ ret = PTR_ERR(qcom->urs_usb);
+ goto clk_disable;
}
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 434/591] usb: common: usb-conn-gpio: Set last role to unknown before initial detection
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 433/591] usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 435/591] usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe() Greg Kroah-Hartman
` (160 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prashanth K,
AngeloGioacchino Del Regno, Sasha Levin
From: Prashanth K <quic_prashk@quicinc.com>
[ Upstream commit edd60d24bd858cef165274e4cd6cab43bdc58d15 ]
Currently if we bootup a device without cable connected, then
usb-conn-gpio won't call set_role() since last_role is same as
current role. This happens because during probe last_role gets
initialised to zero.
To avoid this, added a new constant in enum usb_role, last_role
is set to USB_ROLE_UNKNOWN before performing initial detection.
While at it, also handle default case for the usb_role switch
in cdns3, intel-xhci-usb-role-switch & musb/jz4740 to avoid
build warnings.
Fixes: 4602f3bff266 ("usb: common: add USB GPIO based connection detection driver")
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Message-ID: <1685544074-17337-1-git-send-email-quic_prashk@quicinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/cdns3/core.c | 2 ++
drivers/usb/common/usb-conn-gpio.c | 3 +++
drivers/usb/musb/jz4740.c | 2 ++
drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 ++
include/linux/usb/role.h | 1 +
5 files changed, 10 insertions(+)
diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index dbcdf3b24b477..69d2921f2d3b5 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -252,6 +252,8 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns)
if (!vbus)
role = USB_ROLE_NONE;
break;
+ default:
+ break;
}
dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role);
diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c
index e20874caba363..30bdb81934bc8 100644
--- a/drivers/usb/common/usb-conn-gpio.c
+++ b/drivers/usb/common/usb-conn-gpio.c
@@ -257,6 +257,9 @@ static int usb_conn_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, info);
device_set_wakeup_capable(&pdev->dev, true);
+ /* Set last role to unknown before performing the initial detection */
+ info->last_role = USB_ROLE_UNKNOWN;
+
/* Perform initial detection */
usb_conn_queue_dwork(info, 0);
diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c
index d1e4e0deb7535..df4e9d397d986 100644
--- a/drivers/usb/musb/jz4740.c
+++ b/drivers/usb/musb/jz4740.c
@@ -91,6 +91,8 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw,
case USB_ROLE_HOST:
atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy);
break;
+ default:
+ break;
}
return 0;
diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c
index 5c96e929acea0..4d6a3dd06e011 100644
--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c
+++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c
@@ -97,6 +97,8 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw,
val |= SW_VBUS_VALID;
drd_config = DRD_CONFIG_STATIC_DEVICE;
break;
+ default:
+ break;
}
val |= SW_IDPIN_EN;
if (data->enable_sw_switch) {
diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h
index b5deafd91f67b..65e790a28913e 100644
--- a/include/linux/usb/role.h
+++ b/include/linux/usb/role.h
@@ -11,6 +11,7 @@ enum usb_role {
USB_ROLE_NONE,
USB_ROLE_HOST,
USB_ROLE_DEVICE,
+ USB_ROLE_UNKNOWN,
};
typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 435/591] usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 434/591] usb: common: usb-conn-gpio: Set last role to unknown before initial detection Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 436/591] mfd: wcd934x: Fix an error handling path in wcd934x_slim_probe() Greg Kroah-Hartman
` (159 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET,
Martin Blumenstingl, Neil Armstrong, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 01052b91c9808e3c3b068ae2721cb728ec9aa4c0 ]
If dwc3_meson_g12a_otg_init() fails, resources allocated by the previous
of_platform_populate() call should be released, as already done in the
error handling path.
Fixes: 1e355f21d3fb ("usb: dwc3: Add Amlogic A1 DWC3 glue")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Message-ID: <9d28466de1808ccc756b4cc25fc72c482d133d13.1686403934.git.christophe.jaillet@wanadoo.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc3/dwc3-meson-g12a.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c
index b282ad0e69c6d..eaea944ebd2ce 100644
--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
+++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
@@ -805,7 +805,7 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
ret = dwc3_meson_g12a_otg_init(pdev, priv);
if (ret)
- goto err_phys_power;
+ goto err_plat_depopulate;
pm_runtime_set_active(dev);
pm_runtime_enable(dev);
@@ -813,6 +813,9 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
return 0;
+err_plat_depopulate:
+ of_platform_depopulate(dev);
+
err_phys_power:
for (i = 0 ; i < PHY_COUNT ; ++i)
phy_power_off(priv->phys[i]);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 436/591] mfd: wcd934x: Fix an error handling path in wcd934x_slim_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 435/591] usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 437/591] mfd: intel-lpss: Add missing check for platform_get_resource Greg Kroah-Hartman
` (158 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Lee Jones,
Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit f190b4891a3f9fac123a7afd378d4143a2723313 ]
If devm_gpiod_get_optional() fails, some resources need to be released, as
already done in the .remove() function.
While at it, remove the unneeded error code from a dev_err_probe() call.
It is already added in a human readable way by dev_err_probe() itself.
Fixes: 6a0ee2a61a31 ("mfd: wcd934x: Replace legacy gpio interface for gpiod")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/02d8447f6d1df52cc8357aae698152e9a9be67c6.1684565021.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/wcd934x.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 68e2fa2fda99c..32ed2bd863758 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -253,8 +253,9 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
usleep_range(600, 650);
reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
if (IS_ERR(reset_gpio)) {
- return dev_err_probe(dev, PTR_ERR(reset_gpio),
- "Failed to get reset gpio: err = %ld\n", PTR_ERR(reset_gpio));
+ ret = dev_err_probe(dev, PTR_ERR(reset_gpio),
+ "Failed to get reset gpio\n");
+ goto err_disable_regulators;
}
msleep(20);
gpiod_set_value(reset_gpio, 1);
@@ -264,6 +265,10 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
dev_set_drvdata(dev, ddata);
return 0;
+
+err_disable_regulators:
+ regulator_bulk_disable(WCD934X_MAX_SUPPLY, ddata->supplies);
+ return ret;
}
static void wcd934x_slim_remove(struct slim_device *sdev)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 437/591] mfd: intel-lpss: Add missing check for platform_get_resource
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 436/591] mfd: wcd934x: Fix an error handling path in wcd934x_slim_probe() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 438/591] Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection" Greg Kroah-Hartman
` (157 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Lee Jones,
Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit d918e0d5824495a75d00b879118b098fcab36fdb ]
Add the missing check for platform_get_resource and return error
if it fails.
Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Lee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20230609014818.28475-1-jiasheng@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/intel-lpss-acpi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c
index a143c8dca2d93..212818aef93e2 100644
--- a/drivers/mfd/intel-lpss-acpi.c
+++ b/drivers/mfd/intel-lpss-acpi.c
@@ -183,6 +183,9 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev)
return -ENOMEM;
info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!info->mem)
+ return -ENODEV;
+
info->irq = platform_get_irq(pdev, 0);
ret = intel_lpss_probe(&pdev->dev, info);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 438/591] Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection"
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 437/591] mfd: intel-lpss: Add missing check for platform_get_resource Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 439/591] serial: 8250_omap: Use force_suspend and resume for system suspend Greg Kroah-Hartman
` (156 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heikki Krogerus, Prashanth K,
AngeloGioacchino Del Regno, Sasha Levin
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit df49f2a0ac4a34c0cb4b5c233fcfa0add644c43c ]
This reverts commit edd60d24bd858cef165274e4cd6cab43bdc58d15.
Heikki reports that this should not be a global flag just to work around
one broken driver and should be fixed differently, so revert it.
Reported-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Fixes: edd60d24bd85 ("usb: common: usb-conn-gpio: Set last role to unknown before initial detection")
Link: https://lore.kernel.org/r/ZImE4L3YgABnCIsP@kuha.fi.intel.com
Cc: Prashanth K <quic_prashk@quicinc.com>
Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/cdns3/core.c | 2 --
drivers/usb/common/usb-conn-gpio.c | 3 ---
drivers/usb/musb/jz4740.c | 2 --
drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 --
include/linux/usb/role.h | 1 -
5 files changed, 10 deletions(-)
diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 69d2921f2d3b5..dbcdf3b24b477 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -252,8 +252,6 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns)
if (!vbus)
role = USB_ROLE_NONE;
break;
- default:
- break;
}
dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role);
diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c
index 30bdb81934bc8..e20874caba363 100644
--- a/drivers/usb/common/usb-conn-gpio.c
+++ b/drivers/usb/common/usb-conn-gpio.c
@@ -257,9 +257,6 @@ static int usb_conn_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, info);
device_set_wakeup_capable(&pdev->dev, true);
- /* Set last role to unknown before performing the initial detection */
- info->last_role = USB_ROLE_UNKNOWN;
-
/* Perform initial detection */
usb_conn_queue_dwork(info, 0);
diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c
index df4e9d397d986..d1e4e0deb7535 100644
--- a/drivers/usb/musb/jz4740.c
+++ b/drivers/usb/musb/jz4740.c
@@ -91,8 +91,6 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw,
case USB_ROLE_HOST:
atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy);
break;
- default:
- break;
}
return 0;
diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c
index 4d6a3dd06e011..5c96e929acea0 100644
--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c
+++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c
@@ -97,8 +97,6 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw,
val |= SW_VBUS_VALID;
drd_config = DRD_CONFIG_STATIC_DEVICE;
break;
- default:
- break;
}
val |= SW_IDPIN_EN;
if (data->enable_sw_switch) {
diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h
index 65e790a28913e..b5deafd91f67b 100644
--- a/include/linux/usb/role.h
+++ b/include/linux/usb/role.h
@@ -11,7 +11,6 @@ enum usb_role {
USB_ROLE_NONE,
USB_ROLE_HOST,
USB_ROLE_DEVICE,
- USB_ROLE_UNKNOWN,
};
typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 439/591] serial: 8250_omap: Use force_suspend and resume for system suspend
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 438/591] Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection" Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 440/591] device property: Fix documentation for fwnode_get_next_parent() Greg Kroah-Hartman
` (155 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tony Lindgren, Dhruva Gole,
Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 20a41a62618df85f3a2981008edec5cadd785e0a ]
We should not rely on autosuspend timeout for system suspend. Instead,
let's use force_suspend and force_resume functions. Otherwise the serial
port controller device may not be idled on suspend.
As we are doing a register write on suspend to configure the serial port,
we still need to runtime PM resume the port on suspend.
While at it, let's switch to pm_runtime_resume_and_get() and check for
errors returned. And let's add the missing line break before return to the
suspend function while at it.
Fixes: 09d8b2bdbc5c ("serial: 8250: omap: Provide ability to enable/disable UART as wakeup source")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Tested-by: Dhruva Gole <d-gole@ti.com>
Message-ID: <20230614045922.4798-1-tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_omap.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index 17a230281ebe0..adc85e250822c 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -1505,25 +1505,35 @@ static int omap8250_suspend(struct device *dev)
{
struct omap8250_priv *priv = dev_get_drvdata(dev);
struct uart_8250_port *up = serial8250_get_port(priv->line);
+ int err;
serial8250_suspend_port(priv->line);
- pm_runtime_get_sync(dev);
+ err = pm_runtime_resume_and_get(dev);
+ if (err)
+ return err;
if (!device_may_wakeup(dev))
priv->wer = 0;
serial_out(up, UART_OMAP_WER, priv->wer);
- pm_runtime_mark_last_busy(dev);
- pm_runtime_put_autosuspend(dev);
-
+ err = pm_runtime_force_suspend(dev);
flush_work(&priv->qos_work);
- return 0;
+
+ return err;
}
static int omap8250_resume(struct device *dev)
{
struct omap8250_priv *priv = dev_get_drvdata(dev);
+ int err;
+ err = pm_runtime_force_resume(dev);
+ if (err)
+ return err;
serial8250_resume_port(priv->line);
+ /* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */
+ pm_runtime_mark_last_busy(dev);
+ pm_runtime_put_autosuspend(dev);
+
return 0;
}
#else
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 440/591] device property: Fix documentation for fwnode_get_next_parent()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 439/591] serial: 8250_omap: Use force_suspend and resume for system suspend Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 441/591] device property: Clarify description of returned value in some functions Greg Kroah-Hartman
` (154 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Daniel Scally,
Sakari Ailus, Miaoqian Lin, Sasha Levin
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit f18caf261398a7f2de4fa3f600deb87072fe7b8d ]
Use fwnode_handle_put() on the node pointer to release the refcount.
Change fwnode_handle_node() to fwnode_handle_put().
Fixes: 233872585de1 ("device property: Add fwnode_get_next_parent()")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Daniel Scally <djrscally@gmail.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://lore.kernel.org/r/20221207112219.2652411-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 39d422555e43 ("drivers: fwnode: fix fwnode_irq_get[_byname]()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/property.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/base/property.c b/drivers/base/property.c
index 7f338cb4fb7b8..f2f7829ad36b9 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -601,7 +601,7 @@ EXPORT_SYMBOL_GPL(fwnode_get_parent);
* node's parents.
*
* Returns a node pointer with refcount incremented, use
- * fwnode_handle_node() on it when done.
+ * fwnode_handle_put() on it when done.
*/
struct fwnode_handle *fwnode_get_next_parent(struct fwnode_handle *fwnode)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 441/591] device property: Clarify description of returned value in some functions
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 440/591] device property: Fix documentation for fwnode_get_next_parent() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 442/591] drivers: fwnode: fix fwnode_irq_get[_byname]() Greg Kroah-Hartman
` (153 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Kaehn, Andy Shevchenko,
Sakari Ailus, Rafael J. Wysocki, Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 295209ca7b5b3aa6375d6190311b2ae804dbcf65 ]
Some of the functions do not provide Return: section on absence of which
kernel-doc complains. Besides that several functions return the fwnode
handle with incremented reference count. Add a respective note to make sure
that the caller decrements it when it's not needed anymore.
While at it, unify the style of the Return: sections.
Reported-by: Daniel Kaehn <kaehndan@gmail.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Rafael J. Wysocki <rafael@kernel.org>
Link: https://lore.kernel.org/r/20230217133344.79278-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 39d422555e43 ("drivers: fwnode: fix fwnode_irq_get[_byname]()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/property.c | 124 +++++++++++++++++++++++++++++-----------
1 file changed, 90 insertions(+), 34 deletions(-)
diff --git a/drivers/base/property.c b/drivers/base/property.c
index f2f7829ad36b9..868adeac2a843 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -30,6 +30,8 @@ EXPORT_SYMBOL_GPL(dev_fwnode);
* @propname: Name of the property
*
* Check if property @propname is present in the device firmware description.
+ *
+ * Return: true if property @propname is present. Otherwise, returns false.
*/
bool device_property_present(struct device *dev, const char *propname)
{
@@ -41,6 +43,8 @@ EXPORT_SYMBOL_GPL(device_property_present);
* fwnode_property_present - check if a property of a firmware node is present
* @fwnode: Firmware node whose property to check
* @propname: Name of the property
+ *
+ * Return: true if property @propname is present. Otherwise, returns false.
*/
bool fwnode_property_present(const struct fwnode_handle *fwnode,
const char *propname)
@@ -500,10 +504,10 @@ EXPORT_SYMBOL_GPL(fwnode_property_match_string);
* Obtain a reference based on a named property in an fwnode, with
* integer arguments.
*
- * Caller is responsible to call fwnode_handle_put() on the returned
- * args->fwnode pointer.
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * @args->fwnode pointer.
*
- * Returns: %0 on success
+ * Return: %0 on success
* %-ENOENT when the index is out of bounds, the index has an empty
* reference or the property was not found
* %-EINVAL on parse error
@@ -539,8 +543,11 @@ EXPORT_SYMBOL_GPL(fwnode_property_get_reference_args);
*
* @index can be used when the named reference holds a table of references.
*
- * Returns pointer to the reference fwnode, or ERR_PTR. Caller is responsible to
- * call fwnode_handle_put() on the returned fwnode pointer.
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer.
+ *
+ * Return: a pointer to the reference fwnode, when found. Otherwise,
+ * returns an error pointer.
*/
struct fwnode_handle *fwnode_find_reference(const struct fwnode_handle *fwnode,
const char *name,
@@ -559,7 +566,7 @@ EXPORT_SYMBOL_GPL(fwnode_find_reference);
* fwnode_get_name - Return the name of a node
* @fwnode: The firmware node
*
- * Returns a pointer to the node name.
+ * Return: a pointer to the node name, or %NULL.
*/
const char *fwnode_get_name(const struct fwnode_handle *fwnode)
{
@@ -571,7 +578,7 @@ EXPORT_SYMBOL_GPL(fwnode_get_name);
* fwnode_get_name_prefix - Return the prefix of node for printing purposes
* @fwnode: The firmware node
*
- * Returns the prefix of a node, intended to be printed right before the node.
+ * Return: the prefix of a node, intended to be printed right before the node.
* The prefix works also as a separator between the nodes.
*/
const char *fwnode_get_name_prefix(const struct fwnode_handle *fwnode)
@@ -583,7 +590,10 @@ const char *fwnode_get_name_prefix(const struct fwnode_handle *fwnode)
* fwnode_get_parent - Return parent firwmare node
* @fwnode: Firmware whose parent is retrieved
*
- * Return parent firmware node of the given node if possible or %NULL if no
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer.
+ *
+ * Return: parent firmware node of the given node if possible or %NULL if no
* parent was available.
*/
struct fwnode_handle *fwnode_get_parent(const struct fwnode_handle *fwnode)
@@ -600,8 +610,12 @@ EXPORT_SYMBOL_GPL(fwnode_get_parent);
* on the passed node, making it suitable for iterating through a
* node's parents.
*
- * Returns a node pointer with refcount incremented, use
- * fwnode_handle_put() on it when done.
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer. Note that this function also puts a reference to @fwnode
+ * unconditionally.
+ *
+ * Return: parent firmware node of the given node if possible or %NULL if no
+ * parent was available.
*/
struct fwnode_handle *fwnode_get_next_parent(struct fwnode_handle *fwnode)
{
@@ -621,8 +635,10 @@ EXPORT_SYMBOL_GPL(fwnode_get_next_parent);
* firmware node that has a corresponding struct device and returns that struct
* device.
*
- * The caller of this function is expected to call put_device() on the returned
- * device when they are done.
+ * The caller is responsible for calling put_device() on the returned device
+ * pointer.
+ *
+ * Return: a pointer to the device of the @fwnode's closest ancestor.
*/
struct device *fwnode_get_next_parent_dev(struct fwnode_handle *fwnode)
{
@@ -643,7 +659,7 @@ struct device *fwnode_get_next_parent_dev(struct fwnode_handle *fwnode)
* fwnode_count_parents - Return the number of parents a node has
* @fwnode: The node the parents of which are to be counted
*
- * Returns the number of parents a node has.
+ * Return: the number of parents a node has.
*/
unsigned int fwnode_count_parents(const struct fwnode_handle *fwnode)
{
@@ -662,12 +678,12 @@ EXPORT_SYMBOL_GPL(fwnode_count_parents);
* @fwnode: The node the parent of which is requested
* @depth: Distance of the parent from the node
*
- * Returns the nth parent of a node. If there is no parent at the requested
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer.
+ *
+ * Return: the nth parent of a node. If there is no parent at the requested
* @depth, %NULL is returned. If @depth is 0, the functionality is equivalent to
* fwnode_handle_get(). For @depth == 1, it is fwnode_get_parent() and so on.
- *
- * The caller is responsible for calling fwnode_handle_put() for the returned
- * node.
*/
struct fwnode_handle *fwnode_get_nth_parent(struct fwnode_handle *fwnode,
unsigned int depth)
@@ -692,7 +708,7 @@ EXPORT_SYMBOL_GPL(fwnode_get_nth_parent);
*
* A node is considered an ancestor of itself too.
*
- * Returns true if @ancestor is an ancestor of @child. Otherwise, returns false.
+ * Return: true if @ancestor is an ancestor of @child. Otherwise, returns false.
*/
bool fwnode_is_ancestor_of(struct fwnode_handle *ancestor, struct fwnode_handle *child)
{
@@ -717,6 +733,10 @@ bool fwnode_is_ancestor_of(struct fwnode_handle *ancestor, struct fwnode_handle
* fwnode_get_next_child_node - Return the next child node handle for a node
* @fwnode: Firmware node to find the next child node for.
* @child: Handle to one of the node's child nodes or a %NULL handle.
+ *
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer. Note that this function also puts a reference to @child
+ * unconditionally.
*/
struct fwnode_handle *
fwnode_get_next_child_node(const struct fwnode_handle *fwnode,
@@ -727,10 +747,13 @@ fwnode_get_next_child_node(const struct fwnode_handle *fwnode,
EXPORT_SYMBOL_GPL(fwnode_get_next_child_node);
/**
- * fwnode_get_next_available_child_node - Return the next
- * available child node handle for a node
+ * fwnode_get_next_available_child_node - Return the next available child node handle for a node
* @fwnode: Firmware node to find the next child node for.
* @child: Handle to one of the node's child nodes or a %NULL handle.
+ *
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer. Note that this function also puts a reference to @child
+ * unconditionally.
*/
struct fwnode_handle *
fwnode_get_next_available_child_node(const struct fwnode_handle *fwnode,
@@ -754,7 +777,11 @@ EXPORT_SYMBOL_GPL(fwnode_get_next_available_child_node);
/**
* device_get_next_child_node - Return the next child node handle for a device
* @dev: Device to find the next child node for.
- * @child: Handle to one of the device's child nodes or a null handle.
+ * @child: Handle to one of the device's child nodes or a %NULL handle.
+ *
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer. Note that this function also puts a reference to @child
+ * unconditionally.
*/
struct fwnode_handle *device_get_next_child_node(struct device *dev,
struct fwnode_handle *child)
@@ -779,6 +806,9 @@ EXPORT_SYMBOL_GPL(device_get_next_child_node);
* fwnode_get_named_child_node - Return first matching named child node handle
* @fwnode: Firmware node to find the named child node for.
* @childname: String to match child node name against.
+ *
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer.
*/
struct fwnode_handle *
fwnode_get_named_child_node(const struct fwnode_handle *fwnode,
@@ -792,6 +822,9 @@ EXPORT_SYMBOL_GPL(fwnode_get_named_child_node);
* device_get_named_child_node - Return first matching named child node handle
* @dev: Device to find the named child node for.
* @childname: String to match child node name against.
+ *
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer.
*/
struct fwnode_handle *device_get_named_child_node(struct device *dev,
const char *childname)
@@ -804,7 +837,10 @@ EXPORT_SYMBOL_GPL(device_get_named_child_node);
* fwnode_handle_get - Obtain a reference to a device node
* @fwnode: Pointer to the device node to obtain the reference to.
*
- * Returns the fwnode handle.
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer.
+ *
+ * Return: the fwnode handle.
*/
struct fwnode_handle *fwnode_handle_get(struct fwnode_handle *fwnode)
{
@@ -833,6 +869,8 @@ EXPORT_SYMBOL_GPL(fwnode_handle_put);
* fwnode_device_is_available - check if a device is available for use
* @fwnode: Pointer to the fwnode of the device.
*
+ * Return: true if device is available for use. Otherwise, returns false.
+ *
* For fwnode node types that don't implement the .device_is_available()
* operation, this function returns true.
*/
@@ -851,6 +889,8 @@ EXPORT_SYMBOL_GPL(fwnode_device_is_available);
/**
* device_get_child_node_count - return the number of child nodes for device
* @dev: Device to cound the child nodes for
+ *
+ * Return: the number of child nodes for a given device.
*/
unsigned int device_get_child_node_count(struct device *dev)
{
@@ -926,7 +966,7 @@ EXPORT_SYMBOL_GPL(device_get_phy_mode);
* @fwnode: Pointer to the firmware node
* @index: Index of the IO range
*
- * Returns a pointer to the mapped memory.
+ * Return: a pointer to the mapped memory.
*/
void __iomem *fwnode_iomap(struct fwnode_handle *fwnode, int index)
{
@@ -939,8 +979,8 @@ EXPORT_SYMBOL(fwnode_iomap);
* @fwnode: Pointer to the firmware node
* @index: Zero-based index of the IRQ
*
- * Returns Linux IRQ number on success. Other values are determined
- * accordingly to acpi_/of_ irq_get() operation.
+ * Return: Linux IRQ number on success. Other values are determined
+ * according to acpi_irq_get() or of_irq_get() operation.
*/
int fwnode_irq_get(const struct fwnode_handle *fwnode, unsigned int index)
{
@@ -959,8 +999,7 @@ EXPORT_SYMBOL(fwnode_irq_get);
* number of the IRQ resource corresponding to the index of the matched
* string.
*
- * Return:
- * Linux IRQ number on success, or negative errno otherwise.
+ * Return: Linux IRQ number on success, or negative errno otherwise.
*/
int fwnode_irq_get_byname(const struct fwnode_handle *fwnode, const char *name)
{
@@ -982,7 +1021,11 @@ EXPORT_SYMBOL(fwnode_irq_get_byname);
* @fwnode: Pointer to the parent firmware node
* @prev: Previous endpoint node or %NULL to get the first
*
- * Returns an endpoint firmware node pointer or %NULL if no more endpoints
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer. Note that this function also puts a reference to @prev
+ * unconditionally.
+ *
+ * Return: an endpoint firmware node pointer or %NULL if no more endpoints
* are available.
*/
struct fwnode_handle *
@@ -1022,6 +1065,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_next_endpoint);
* fwnode_graph_get_port_parent - Return the device fwnode of a port endpoint
* @endpoint: Endpoint firmware node of the port
*
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer.
+ *
* Return: the firmware node of the device the @endpoint belongs to.
*/
struct fwnode_handle *
@@ -1043,6 +1089,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_port_parent);
* @fwnode: Endpoint firmware node pointing to the remote endpoint
*
* Extracts firmware node of a remote device the @fwnode points to.
+ *
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer.
*/
struct fwnode_handle *
fwnode_graph_get_remote_port_parent(const struct fwnode_handle *fwnode)
@@ -1063,6 +1112,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_remote_port_parent);
* @fwnode: Endpoint firmware node pointing to the remote endpoint
*
* Extracts firmware node of a remote port the @fwnode points to.
+ *
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer.
*/
struct fwnode_handle *
fwnode_graph_get_remote_port(const struct fwnode_handle *fwnode)
@@ -1076,6 +1128,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_remote_port);
* @fwnode: Endpoint firmware node pointing to the remote endpoint
*
* Extracts firmware node of a remote endpoint the @fwnode points to.
+ *
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer.
*/
struct fwnode_handle *
fwnode_graph_get_remote_endpoint(const struct fwnode_handle *fwnode)
@@ -1103,8 +1158,11 @@ static bool fwnode_graph_remote_available(struct fwnode_handle *ep)
* @endpoint: identifier of the endpoint node under the port node
* @flags: fwnode lookup flags
*
- * Return the fwnode handle of the local endpoint corresponding the port and
- * endpoint IDs or NULL if not found.
+ * The caller is responsible for calling fwnode_handle_put() on the returned
+ * fwnode pointer.
+ *
+ * Return: the fwnode handle of the local endpoint corresponding the port and
+ * endpoint IDs or %NULL if not found.
*
* If FWNODE_GRAPH_ENDPOINT_NEXT is passed in @flags and the specified endpoint
* has not been found, look for the closest endpoint ID greater than the
@@ -1112,9 +1170,6 @@ static bool fwnode_graph_remote_available(struct fwnode_handle *ep)
*
* Does not return endpoints that belong to disabled devices or endpoints that
* are unconnected, unless FWNODE_GRAPH_DEVICE_DISABLED is passed in @flags.
- *
- * The returned endpoint needs to be released by calling fwnode_handle_put() on
- * it when it is not needed any more.
*/
struct fwnode_handle *
fwnode_graph_get_endpoint_by_id(const struct fwnode_handle *fwnode,
@@ -1320,7 +1375,8 @@ EXPORT_SYMBOL_GPL(fwnode_connection_find_match);
* @fwnode and other device nodes. @match will be used to convert the
* connection description to data the caller is expecting to be returned
* through the @matches array.
- * If @matches is NULL @matches_len is ignored and the total number of resolved
+ *
+ * If @matches is %NULL @matches_len is ignored and the total number of resolved
* matches is returned.
*
* Return: Number of matches resolved, or negative errno.
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 442/591] drivers: fwnode: fix fwnode_irq_get[_byname]()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 441/591] device property: Clarify description of returned value in some functions Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 443/591] nvmem: sunplus-ocotp: release otp->clk before return Greg Kroah-Hartman
` (152 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Jonathan Cameron,
Matti Vaittinen, Andy Shevchenko, Jonathan Cameron, Sasha Levin
From: Matti Vaittinen <mazziesaccount@gmail.com>
[ Upstream commit 39d422555e43379516d4d13f5b7162a3dee6e646 ]
The fwnode_irq_get() and the fwnode_irq_get_byname() return 0 upon
device-tree IRQ mapping failure. This is contradicting the
fwnode_irq_get_byname() function documentation and can potentially be a
source of errors like:
int probe(...) {
...
irq = fwnode_irq_get_byname();
if (irq <= 0)
return irq;
...
}
Here we do correctly check the return value from fwnode_irq_get_byname()
but the driver probe will now return success. (There was already one
such user in-tree).
Change the fwnode_irq_get_byname() to work as documented and make also the
fwnode_irq_get() follow same common convention returning a negative errno
upon failure.
Fixes: ca0acb511c21 ("device property: Add fwnode_irq_get_byname")
Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Suggested-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-ID: <3e64fe592dc99e27ef9a0b247fc49fa26b6b8a58.1685340157.git.mazziesaccount@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/property.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/base/property.c b/drivers/base/property.c
index 868adeac2a843..b0c40d9734847 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -979,12 +979,18 @@ EXPORT_SYMBOL(fwnode_iomap);
* @fwnode: Pointer to the firmware node
* @index: Zero-based index of the IRQ
*
- * Return: Linux IRQ number on success. Other values are determined
- * according to acpi_irq_get() or of_irq_get() operation.
+ * Return: Linux IRQ number on success. Negative errno on failure.
*/
int fwnode_irq_get(const struct fwnode_handle *fwnode, unsigned int index)
{
- return fwnode_call_int_op(fwnode, irq_get, index);
+ int ret;
+
+ ret = fwnode_call_int_op(fwnode, irq_get, index);
+ /* We treat mapping errors as invalid case */
+ if (ret == 0)
+ return -EINVAL;
+
+ return ret;
}
EXPORT_SYMBOL(fwnode_irq_get);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 443/591] nvmem: sunplus-ocotp: release otp->clk before return
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 442/591] drivers: fwnode: fix fwnode_irq_get[_byname]() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 444/591] nvmem: rmem: Use NVMEM_DEVID_AUTO Greg Kroah-Hartman
` (151 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yi Yingao, Dongliang Mu, Sasha Levin
From: Yi Yingao <m202271736@hust.edu.cn>
[ Upstream commit 095bb8ba45f28ed15296eb5b7662e03e57d5e34e ]
Smatch reports:
drivers/nvmem/sunplus-ocotp.c:205 sp_ocotp_probe()
warn: 'otp->clk' from clk_prepare() not released on lines: 196.
In the function sp_ocotp_probe(struct platform_device *pdev), otp->clk may
not be released before return.
To fix this issue, using function clk_unprepare() to release otp->clk.
Fixes: 8747ec2e9762 ("nvmem: Add driver for OCOTP in Sunplus SP7021")
Signed-off-by: Yi Yingao <m202271736@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Message-ID: <20230509085237.5917-1-m202271736@hust.edu.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvmem/sunplus-ocotp.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/nvmem/sunplus-ocotp.c b/drivers/nvmem/sunplus-ocotp.c
index 52b928a7a6d58..f85350b17d672 100644
--- a/drivers/nvmem/sunplus-ocotp.c
+++ b/drivers/nvmem/sunplus-ocotp.c
@@ -192,9 +192,11 @@ static int sp_ocotp_probe(struct platform_device *pdev)
sp_ocotp_nvmem_config.dev = dev;
nvmem = devm_nvmem_register(dev, &sp_ocotp_nvmem_config);
- if (IS_ERR(nvmem))
- return dev_err_probe(&pdev->dev, PTR_ERR(nvmem),
+ if (IS_ERR(nvmem)) {
+ ret = dev_err_probe(&pdev->dev, PTR_ERR(nvmem),
"register nvmem device fail\n");
+ goto err;
+ }
platform_set_drvdata(pdev, nvmem);
@@ -203,6 +205,9 @@ static int sp_ocotp_probe(struct platform_device *pdev)
(int)OTP_WORD_SIZE, (int)QAC628_OTP_SIZE);
return 0;
+err:
+ clk_unprepare(otp->clk);
+ return ret;
}
static const struct of_device_id sp_ocotp_dt_ids[] = {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 444/591] nvmem: rmem: Use NVMEM_DEVID_AUTO
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 443/591] nvmem: sunplus-ocotp: release otp->clk before return Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 445/591] bus: fsl-mc: dont assume child devices are all fsl-mc devices Greg Kroah-Hartman
` (150 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Phil Elwell, Ivan T. Ivanov,
Stefan Wahren, Srinivas Kandagatla, Sasha Levin
From: Phil Elwell <phil@raspberrypi.com>
[ Upstream commit 09dd7b993eddb3b48634fd5ddf27aa799785a9ee ]
It is reasonable to declare multiple nvmem blocks. Unless a unique 'id'
is passed in for each block there may be name clashes.
Avoid this by using the magic token NVMEM_DEVID_AUTO.
Fixes: 5a3fa75a4d9c ("nvmem: Add driver to expose reserved memory as nvmem")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
Reviewed-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Message-ID: <20230611140330.154222-6-srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvmem/rmem.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/nvmem/rmem.c b/drivers/nvmem/rmem.c
index 80cb187f14817..752d0bf4445ee 100644
--- a/drivers/nvmem/rmem.c
+++ b/drivers/nvmem/rmem.c
@@ -71,6 +71,7 @@ static int rmem_probe(struct platform_device *pdev)
config.dev = dev;
config.priv = priv;
config.name = "rmem";
+ config.id = NVMEM_DEVID_AUTO;
config.size = mem->size;
config.reg_read = rmem_read;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 445/591] bus: fsl-mc: dont assume child devices are all fsl-mc devices
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 444/591] nvmem: rmem: Use NVMEM_DEVID_AUTO Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 446/591] mfd: stmfx: Fix error path in stmfx_chip_init Greg Kroah-Hartman
` (149 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurentiu Tudor, Ioana Ciornei,
Sasha Levin
From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
[ Upstream commit 303c9c63abb9390e906052863f82bb4e9824e5c0 ]
Changes in VFIO caused a pseudo-device to be created as child of
fsl-mc devices causing a crash [1] when trying to bind a fsl-mc
device to VFIO. Fix this by checking the device type when enumerating
fsl-mc child devices.
[1]
Modules linked in:
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
CPU: 6 PID: 1289 Comm: sh Not tainted 6.2.0-rc5-00047-g7c46948a6e9c #2
Hardware name: NXP Layerscape LX2160ARDB (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : mc_send_command+0x24/0x1f0
lr : dprc_get_obj_region+0xfc/0x1c0
sp : ffff80000a88b900
x29: ffff80000a88b900 x28: ffff48a9429e1400 x27: 00000000000002b2
x26: ffff48a9429e1718 x25: 0000000000000000 x24: 0000000000000000
x23: ffffd59331ba3918 x22: ffffd59331ba3000 x21: 0000000000000000
x20: ffff80000a88b9b8 x19: 0000000000000000 x18: 0000000000000001
x17: 7270642f636d2d6c x16: 73662e3030303030 x15: ffffffffffffffff
x14: ffffd59330f1d668 x13: ffff48a8727dc389 x12: ffff48a8727dc386
x11: 0000000000000002 x10: 00008ceaf02f35d4 x9 : 0000000000000012
x8 : 0000000000000000 x7 : 0000000000000006 x6 : ffff80000a88bab0
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000a88b9e8
x2 : ffff80000a88b9e8 x1 : 0000000000000000 x0 : ffff48a945142b80
Call trace:
mc_send_command+0x24/0x1f0
dprc_get_obj_region+0xfc/0x1c0
fsl_mc_device_add+0x340/0x590
fsl_mc_obj_device_add+0xd0/0xf8
dprc_scan_objects+0x1c4/0x340
dprc_scan_container+0x38/0x60
vfio_fsl_mc_probe+0x9c/0xf8
fsl_mc_driver_probe+0x24/0x70
really_probe+0xbc/0x2a8
__driver_probe_device+0x78/0xe0
device_driver_attach+0x30/0x68
bind_store+0xa8/0x130
drv_attr_store+0x24/0x38
sysfs_kf_write+0x44/0x60
kernfs_fop_write_iter+0x128/0x1b8
vfs_write+0x334/0x448
ksys_write+0x68/0xf0
__arm64_sys_write+0x1c/0x28
invoke_syscall+0x44/0x108
el0_svc_common.constprop.1+0x94/0xf8
do_el0_svc+0x38/0xb0
el0_svc+0x20/0x50
el0t_64_sync_handler+0x98/0xc0
el0t_64_sync+0x174/0x178
Code: aa0103f4 a9025bf5 d5384100 b9400801 (79401260)
---[ end trace 0000000000000000 ]---
Fixes: 3c28a76124b2 ("vfio: Add struct device to vfio_device")
Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Message-ID: <20230613160718.29500-1-laurentiu.tudor@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/fsl-mc/dprc-driver.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/bus/fsl-mc/dprc-driver.c b/drivers/bus/fsl-mc/dprc-driver.c
index 5e70f9775a0e3..d1e2d2987dd38 100644
--- a/drivers/bus/fsl-mc/dprc-driver.c
+++ b/drivers/bus/fsl-mc/dprc-driver.c
@@ -46,6 +46,9 @@ static int __fsl_mc_device_remove_if_not_in_mc(struct device *dev, void *data)
struct fsl_mc_child_objs *objs;
struct fsl_mc_device *mc_dev;
+ if (!dev_is_fsl_mc(dev))
+ return 0;
+
mc_dev = to_fsl_mc_device(dev);
objs = data;
@@ -65,6 +68,9 @@ static int __fsl_mc_device_remove_if_not_in_mc(struct device *dev, void *data)
static int __fsl_mc_device_remove(struct device *dev, void *data)
{
+ if (!dev_is_fsl_mc(dev))
+ return 0;
+
fsl_mc_device_remove(to_fsl_mc_device(dev));
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 446/591] mfd: stmfx: Fix error path in stmfx_chip_init
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 445/591] bus: fsl-mc: dont assume child devices are all fsl-mc devices Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 447/591] mfd: stmfx: Nullify stmfx->vdd in case of error Greg Kroah-Hartman
` (148 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Amelie Delaunay, Lee Jones,
Sasha Levin
From: Amelie Delaunay <amelie.delaunay@foss.st.com>
[ Upstream commit f592cf624531286f8b52e40dcfc157a5a7fb115c ]
In error path, disable vdd regulator if it exists, but don't overload ret.
Because if regulator_disable() is successful, stmfx_chip_init will exit
successfully while chip init failed.
Fixes: 06252ade9156 ("mfd: Add ST Multi-Function eXpander (STMFX) core driver")
Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Link: https://lore.kernel.org/r/20230609092804.793100-1-amelie.delaunay@foss.st.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/stmfx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
index 5dd7d96884596..61a8aad564a4e 100644
--- a/drivers/mfd/stmfx.c
+++ b/drivers/mfd/stmfx.c
@@ -387,7 +387,7 @@ static int stmfx_chip_init(struct i2c_client *client)
err:
if (stmfx->vdd)
- return regulator_disable(stmfx->vdd);
+ regulator_disable(stmfx->vdd);
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 447/591] mfd: stmfx: Nullify stmfx->vdd in case of error
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 446/591] mfd: stmfx: Fix error path in stmfx_chip_init Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 448/591] KVM: s390: vsie: fix the length of APCB bitmap Greg Kroah-Hartman
` (147 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Amelie Delaunay, Lee Jones,
Sasha Levin
From: Amelie Delaunay <amelie.delaunay@foss.st.com>
[ Upstream commit 7c81582c0bccb4757186176f0ee12834597066ad ]
Nullify stmfx->vdd in case devm_regulator_get_optional() returns an error.
And simplify code by returning an error only if return code is not -ENODEV,
which means there is no vdd regulator and it is not an issue.
Fixes: d75846ed08e6 ("mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()")
Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Link: https://lore.kernel.org/r/20230609092804.793100-2-amelie.delaunay@foss.st.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/stmfx.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
index 61a8aad564a4e..b1ecd85ad2a8a 100644
--- a/drivers/mfd/stmfx.c
+++ b/drivers/mfd/stmfx.c
@@ -330,9 +330,8 @@ static int stmfx_chip_init(struct i2c_client *client)
stmfx->vdd = devm_regulator_get_optional(&client->dev, "vdd");
ret = PTR_ERR_OR_ZERO(stmfx->vdd);
if (ret) {
- if (ret == -ENODEV)
- stmfx->vdd = NULL;
- else
+ stmfx->vdd = NULL;
+ if (ret != -ENODEV)
return dev_err_probe(&client->dev, ret, "Failed to get VDD regulator\n");
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 448/591] KVM: s390: vsie: fix the length of APCB bitmap
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 447/591] mfd: stmfx: Nullify stmfx->vdd in case of error Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 449/591] KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler Greg Kroah-Hartman
` (146 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Morel, Janosch Frank,
Sasha Levin
From: Pierre Morel <pmorel@linux.ibm.com>
[ Upstream commit 246be7d2720ea9a795b576067ecc5e5c7a1e7848 ]
bit_and() uses the count of bits as the woking length.
Fix the previous implementation and effectively use
the right bitmap size.
Fixes: 19fd83a64718 ("KVM: s390: vsie: allow CRYCB FORMAT-1")
Fixes: 56019f9aca22 ("KVM: s390: vsie: Allow CRYCB FORMAT-2")
Signed-off-by: Pierre Morel <pmorel@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Link: https://lore.kernel.org/kvm/20230511094719.9691-1-pmorel@linux.ibm.com/
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kvm/vsie.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index ace2541ababd3..740f8b56e63f9 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -169,7 +169,8 @@ static int setup_apcb00(struct kvm_vcpu *vcpu, unsigned long *apcb_s,
sizeof(struct kvm_s390_apcb0)))
return -EFAULT;
- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb0));
+ bitmap_and(apcb_s, apcb_s, apcb_h,
+ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb0));
return 0;
}
@@ -191,7 +192,8 @@ static int setup_apcb11(struct kvm_vcpu *vcpu, unsigned long *apcb_s,
sizeof(struct kvm_s390_apcb1)))
return -EFAULT;
- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb1));
+ bitmap_and(apcb_s, apcb_s, apcb_h,
+ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb1));
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 449/591] KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 448/591] KVM: s390: vsie: fix the length of APCB bitmap Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 450/591] cpufreq: mediatek: correct voltages for MT7622 and MT7623 Greg Kroah-Hartman
` (145 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Morel, Marc Hartmayer,
Nico Boehr, Christian Borntraeger, Janosch Frank, Sasha Levin
From: Christian Borntraeger <borntraeger@linux.ibm.com>
[ Upstream commit 0bc380beb78aa352eadbc21d934dd9606fcee808 ]
We do check for target CPU == -1, but this might change at the time we
are going to use it. Hold the physical target CPU in a local variable to
avoid out-of-bound accesses to the cpu arrays.
Cc: Pierre Morel <pmorel@linux.ibm.com>
Fixes: 87e28a15c42c ("KVM: s390: diag9c (directed yield) forwarding")
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Nico Boehr <nrb@linux.ibm.com>
Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kvm/diag.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
index 807fa9da1e721..3c65b8258ae67 100644
--- a/arch/s390/kvm/diag.c
+++ b/arch/s390/kvm/diag.c
@@ -166,6 +166,7 @@ static int diag9c_forwarding_overrun(void)
static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
{
struct kvm_vcpu *tcpu;
+ int tcpu_cpu;
int tid;
tid = vcpu->run->s.regs.gprs[(vcpu->arch.sie_block->ipa & 0xf0) >> 4];
@@ -181,14 +182,15 @@ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
goto no_yield;
/* target guest VCPU already running */
- if (READ_ONCE(tcpu->cpu) >= 0) {
+ tcpu_cpu = READ_ONCE(tcpu->cpu);
+ if (tcpu_cpu >= 0) {
if (!diag9c_forwarding_hz || diag9c_forwarding_overrun())
goto no_yield;
/* target host CPU already running */
- if (!vcpu_is_preempted(tcpu->cpu))
+ if (!vcpu_is_preempted(tcpu_cpu))
goto no_yield;
- smp_yield_cpu(tcpu->cpu);
+ smp_yield_cpu(tcpu_cpu);
VCPU_EVENT(vcpu, 5,
"diag time slice end directed to %d: yield forwarded",
tid);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 450/591] cpufreq: mediatek: correct voltages for MT7622 and MT7623
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 449/591] KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 451/591] misc: fastrpc: check return value of devm_kasprintf() Greg Kroah-Hartman
` (144 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jia-wei Chang, Daniel Golle,
AngeloGioacchino Del Regno, Viresh Kumar, Sasha Levin
From: Daniel Golle <daniel@makrotopia.org>
[ Upstream commit f85534113f5ae90a52521cdb9e9977a43ee42626 ]
The MT6380 regulator typically used together with MT7622 does not
support the current maximum processor and SRAM voltage in the cpufreq
driver (1360000uV).
For MT7622 limit processor and SRAM supply voltages to 1350000uV to
avoid having the tracking algorithm request unsupported voltages from
the regulator.
On MT7623 there is no separate SRAM supply and the maximum voltage used
is 1300000uV. Create dedicated platform data for MT7623 to cover that
case as well.
Fixes: 0883426fd07e3 ("cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623")
Suggested-by: Jia-wei Chang <Jia-wei.Chang@mediatek.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/mediatek-cpufreq.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
index 9a39a7ccfae96..fef68cb2b38f7 100644
--- a/drivers/cpufreq/mediatek-cpufreq.c
+++ b/drivers/cpufreq/mediatek-cpufreq.c
@@ -696,9 +696,16 @@ static const struct mtk_cpufreq_platform_data mt2701_platform_data = {
static const struct mtk_cpufreq_platform_data mt7622_platform_data = {
.min_volt_shift = 100000,
.max_volt_shift = 200000,
- .proc_max_volt = 1360000,
+ .proc_max_volt = 1350000,
.sram_min_volt = 0,
- .sram_max_volt = 1360000,
+ .sram_max_volt = 1350000,
+ .ccifreq_supported = false,
+};
+
+static const struct mtk_cpufreq_platform_data mt7623_platform_data = {
+ .min_volt_shift = 100000,
+ .max_volt_shift = 200000,
+ .proc_max_volt = 1300000,
.ccifreq_supported = false,
};
@@ -734,7 +741,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
{ .compatible = "mediatek,mt2701", .data = &mt2701_platform_data },
{ .compatible = "mediatek,mt2712", .data = &mt2701_platform_data },
{ .compatible = "mediatek,mt7622", .data = &mt7622_platform_data },
- { .compatible = "mediatek,mt7623", .data = &mt7622_platform_data },
+ { .compatible = "mediatek,mt7623", .data = &mt7623_platform_data },
{ .compatible = "mediatek,mt8167", .data = &mt8516_platform_data },
{ .compatible = "mediatek,mt817x", .data = &mt2701_platform_data },
{ .compatible = "mediatek,mt8173", .data = &mt2701_platform_data },
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 451/591] misc: fastrpc: check return value of devm_kasprintf()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 450/591] cpufreq: mediatek: correct voltages for MT7622 and MT7623 Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 452/591] clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags Greg Kroah-Hartman
` (143 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit af2e19d82a116bc622eea84c9faadd5f7e20bec4 ]
devm_kasprintf() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: 3abe3ab3cdab ("misc: fastrpc: add secure domain support")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230615102546.581899-1-claudiu.beznea@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/fastrpc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 8b1e8661c3d73..e5cabb9012135 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -2030,6 +2030,9 @@ static int fastrpc_device_register(struct device *dev, struct fastrpc_channel_ct
fdev->miscdev.fops = &fastrpc_fops;
fdev->miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "fastrpc-%s%s",
domain, is_secured ? "-secure" : "");
+ if (!fdev->miscdev.name)
+ return -ENOMEM;
+
err = misc_register(&fdev->miscdev);
if (!err) {
if (is_secured)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 452/591] clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 451/591] misc: fastrpc: check return value of devm_kasprintf() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 453/591] hwtracing: hisi_ptt: Fix potential sleep in atomic context Greg Kroah-Hartman
` (142 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Rajendra Nayak,
Luca Weiss, Bjorn Andersson, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 4e13c7a55cf752887f2b8d8008711dbbc64ea796 ]
Using PWRSTS_RET on msm8974's MDSS_GDSC causes display to stop working.
The gdsc doesn't fully come out of retention mode. Change it's pwrsts
flags to PWRSTS_OFF_ON.
Fixes: d399723950c4 ("clk: qcom: gdsc: Fix the handling of PWRSTS_RET support")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Rajendra Nayak <quic_rjendra@quicinc.com>
Tested-by: Luca Weiss <luca@z3ntu.xyz>
Link: https://lore.kernel.org/r/20230507175335.2321503-2-dmitry.baryshkov@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/mmcc-msm8974.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/qcom/mmcc-msm8974.c
+++ b/drivers/clk/qcom/mmcc-msm8974.c
@@ -2372,7 +2372,7 @@ static struct gdsc mdss_gdsc = {
.pd = {
.name = "mdss",
},
- .pwrsts = PWRSTS_RET_ON,
+ .pwrsts = PWRSTS_OFF_ON,
};
static struct gdsc camss_jpeg_gdsc = {
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 453/591] hwtracing: hisi_ptt: Fix potential sleep in atomic context
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 452/591] clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 454/591] mfd: stmpe: Only disable the regulators if they are enabled Greg Kroah-Hartman
` (141 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Cameron, Yicong Yang,
Suzuki K Poulose, Sasha Levin
From: Yicong Yang <yangyicong@hisilicon.com>
[ Upstream commit 6c50384ef8b94a527445e3694ae6549e1f15d859 ]
We're using pci_irq_vector() to obtain the interrupt number and then
bind it to the CPU start perf under the protection of spinlock in
pmu::start(). pci_irq_vector() might sleep since [1] because it will
call msi_domain_get_virq() to get the MSI interrupt number and it
needs to acquire dev->msi.data->mutex. Getting a mutex will sleep on
contention. So use pci_irq_vector() in an atomic context is problematic.
This patch cached the interrupt number in the probe() and uses the
cached data instead to avoid potential sleep.
[1] commit 82ff8e6b78fc ("PCI/MSI: Use msi_get_virq() in pci_get_vector()")
Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device")
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20230621092804.15120-6-yangyicong@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/ptt/hisi_ptt.c | 12 +++++-------
drivers/hwtracing/ptt/hisi_ptt.h | 2 ++
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c
index 30f1525639b57..4140efd664097 100644
--- a/drivers/hwtracing/ptt/hisi_ptt.c
+++ b/drivers/hwtracing/ptt/hisi_ptt.c
@@ -341,13 +341,13 @@ static int hisi_ptt_register_irq(struct hisi_ptt *hisi_ptt)
if (ret < 0)
return ret;
- ret = devm_request_threaded_irq(&pdev->dev,
- pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ),
+ hisi_ptt->trace_irq = pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ);
+ ret = devm_request_threaded_irq(&pdev->dev, hisi_ptt->trace_irq,
NULL, hisi_ptt_isr, 0,
DRV_NAME, hisi_ptt);
if (ret) {
pci_err(pdev, "failed to request irq %d, ret = %d\n",
- pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ), ret);
+ hisi_ptt->trace_irq, ret);
return ret;
}
@@ -757,8 +757,7 @@ static void hisi_ptt_pmu_start(struct perf_event *event, int flags)
* core in event_function_local(). If CPU passed is offline we'll fail
* here, just log it since we can do nothing here.
*/
- ret = irq_set_affinity(pci_irq_vector(hisi_ptt->pdev, HISI_PTT_TRACE_DMA_IRQ),
- cpumask_of(cpu));
+ ret = irq_set_affinity(hisi_ptt->trace_irq, cpumask_of(cpu));
if (ret)
dev_warn(dev, "failed to set the affinity of trace interrupt\n");
@@ -1018,8 +1017,7 @@ static int hisi_ptt_cpu_teardown(unsigned int cpu, struct hlist_node *node)
* Also make sure the interrupt bind to the migrated CPU as well. Warn
* the user on failure here.
*/
- if (irq_set_affinity(pci_irq_vector(hisi_ptt->pdev, HISI_PTT_TRACE_DMA_IRQ),
- cpumask_of(target)))
+ if (irq_set_affinity(hisi_ptt->trace_irq, cpumask_of(target)))
dev_warn(dev, "failed to set the affinity of trace interrupt\n");
hisi_ptt->trace_ctrl.on_cpu = target;
diff --git a/drivers/hwtracing/ptt/hisi_ptt.h b/drivers/hwtracing/ptt/hisi_ptt.h
index 5beb1648c93ab..948a4c4231527 100644
--- a/drivers/hwtracing/ptt/hisi_ptt.h
+++ b/drivers/hwtracing/ptt/hisi_ptt.h
@@ -166,6 +166,7 @@ struct hisi_ptt_pmu_buf {
* @pdev: pci_dev of this PTT device
* @tune_lock: lock to serialize the tune process
* @pmu_lock: lock to serialize the perf process
+ * @trace_irq: interrupt number used by trace
* @upper_bdf: the upper BDF range of the PCI devices managed by this PTT device
* @lower_bdf: the lower BDF range of the PCI devices managed by this PTT device
* @port_filters: the filter list of root ports
@@ -180,6 +181,7 @@ struct hisi_ptt {
struct pci_dev *pdev;
struct mutex tune_lock;
spinlock_t pmu_lock;
+ int trace_irq;
u32 upper_bdf;
u32 lower_bdf;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 454/591] mfd: stmpe: Only disable the regulators if they are enabled
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 453/591] hwtracing: hisi_ptt: Fix potential sleep in atomic context Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 455/591] phy: tegra: xusb: check return value of devm_kzalloc() Greg Kroah-Hartman
` (140 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Linus Walleij,
Lee Jones, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 104d32bd81f620bb9f67fbf7d1159c414e89f05f ]
In stmpe_probe(), if some regulator_enable() calls fail, probing continues
and there is only a dev_warn().
So, if stmpe_probe() is called the regulator may not be enabled. It is
cleaner to test it before calling regulator_disable() in the remove
function.
Fixes: 9c9e321455fb ("mfd: stmpe: add optional regulators")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/8de3aaf297931d655b9ad6aed548f4de8b85425a.1686998575.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/stmpe.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index 0c4f74197d3e0..aef29221d7c12 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -1485,9 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
void stmpe_remove(struct stmpe *stmpe)
{
- if (!IS_ERR(stmpe->vio))
+ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
regulator_disable(stmpe->vio);
- if (!IS_ERR(stmpe->vcc))
+ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
regulator_disable(stmpe->vcc);
__stmpe_disable(stmpe, STMPE_BLOCK_ADC);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 455/591] phy: tegra: xusb: check return value of devm_kzalloc()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 454/591] mfd: stmpe: Only disable the regulators if they are enabled Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 456/591] lib/bitmap: drop optimization of bitmap_{from,to}_arr64 Greg Kroah-Hartman
` (139 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Thierry Reding,
Vinod Koul, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 44faada0f38fc333d392af04c343b0e23f8f5d81 ]
devm_kzalloc() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: f67213cee2b3 ("phy: tegra: xusb: Add usb-role-switch support")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20230531073950.145339-1-claudiu.beznea@microchip.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/tegra/xusb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
index c3fa22ee2d8d4..4d5b4071d47d5 100644
--- a/drivers/phy/tegra/xusb.c
+++ b/drivers/phy/tegra/xusb.c
@@ -670,6 +670,9 @@ static int tegra_xusb_setup_usb_role_switch(struct tegra_xusb_port *port)
port->dev.driver = devm_kzalloc(&port->dev,
sizeof(struct device_driver),
GFP_KERNEL);
+ if (!port->dev.driver)
+ return -ENOMEM;
+
port->dev.driver->owner = THIS_MODULE;
port->usb_role_sw = usb_role_switch_register(&port->dev,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 456/591] lib/bitmap: drop optimization of bitmap_{from,to}_arr64
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 455/591] phy: tegra: xusb: check return value of devm_kzalloc() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 457/591] pwm: imx-tpm: force real_period to be zero in suspend Greg Kroah-Hartman
` (138 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Yury Norov,
Andy Shevchenko, Alexander Lobakin, Sasha Levin
From: Yury Norov <yury.norov@gmail.com>
[ Upstream commit c1d2ba10f594046831d14b03f194e8d05e78abad ]
bitmap_{from,to}_arr64() optimization is overly optimistic on 32-bit LE
architectures when it's wired to bitmap_copy_clear_tail().
bitmap_copy_clear_tail() takes care of unused bits in the bitmap up to
the next word boundary. But on 32-bit machines when copying bits from
bitmap to array of 64-bit words, it's expected that the unused part of
a recipient array must be cleared up to 64-bit boundary, so the last 4
bytes may stay untouched when nbits % 64 <= 32.
While the copying part of the optimization works correct, that clear-tail
trick makes corresponding tests reasonably fail:
test_bitmap: bitmap_to_arr64(nbits == 1): tail is not safely cleared: 0xa5a5a5a500000001 (must be 0x0000000000000001)
Fix it by removing bitmap_{from,to}_arr64() optimization for 32-bit LE
arches.
Reported-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/lkml/20230225184702.GA3587246@roeck-us.net/
Fixes: 0a97953fd221 ("lib: add bitmap_{from,to}_arr64")
Signed-off-by: Yury Norov <yury.norov@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/bitmap.h | 8 +++-----
lib/bitmap.c | 2 +-
2 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
index 7d6d73b781472..03644237e1efb 100644
--- a/include/linux/bitmap.h
+++ b/include/linux/bitmap.h
@@ -302,12 +302,10 @@ void bitmap_to_arr32(u32 *buf, const unsigned long *bitmap,
#endif
/*
- * On 64-bit systems bitmaps are represented as u64 arrays internally. On LE32
- * machines the order of hi and lo parts of numbers match the bitmap structure.
- * In both cases conversion is not needed when copying data from/to arrays of
- * u64.
+ * On 64-bit systems bitmaps are represented as u64 arrays internally. So,
+ * the conversion is not needed when copying data from/to arrays of u64.
*/
-#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN)
+#if BITS_PER_LONG == 32
void bitmap_from_arr64(unsigned long *bitmap, const u64 *buf, unsigned int nbits);
void bitmap_to_arr64(u64 *buf, const unsigned long *bitmap, unsigned int nbits);
#else
diff --git a/lib/bitmap.c b/lib/bitmap.c
index 1c81413c51f86..ddb31015e38ae 100644
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -1495,7 +1495,7 @@ void bitmap_to_arr32(u32 *buf, const unsigned long *bitmap, unsigned int nbits)
EXPORT_SYMBOL(bitmap_to_arr32);
#endif
-#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN)
+#if BITS_PER_LONG == 32
/**
* bitmap_from_arr64 - copy the contents of u64 array of bits to bitmap
* @bitmap: array of unsigned longs, the destination bitmap
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 457/591] pwm: imx-tpm: force real_period to be zero in suspend
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 456/591] lib/bitmap: drop optimization of bitmap_{from,to}_arr64 Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 458/591] pwm: sysfs: Do not apply state to already disabled PWMs Greg Kroah-Hartman
` (137 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fancy Fang, Clark Wang,
Uwe Kleine-König, Thierry Reding, Sasha Levin
From: Fancy Fang <chen.fang@nxp.com>
[ Upstream commit 661dfb7f46298e53f6c3deaa772fa527aae86193 ]
During suspend, all the tpm registers will lose values.
So the 'real_period' value of struct 'imx_tpm_pwm_chip'
should be forced to be zero to force the period update
code can be executed after system resume back.
Signed-off-by: Fancy Fang <chen.fang@nxp.com>
Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support")
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-imx-tpm.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c
index ed1aad96fff04..318dc0be974b4 100644
--- a/drivers/pwm/pwm-imx-tpm.c
+++ b/drivers/pwm/pwm-imx-tpm.c
@@ -399,6 +399,13 @@ static int __maybe_unused pwm_imx_tpm_suspend(struct device *dev)
if (tpm->enable_count > 0)
return -EBUSY;
+ /*
+ * Force 'real_period' to be zero to force period update code
+ * can be executed after system resume back, since suspend causes
+ * the period related registers to become their reset values.
+ */
+ tpm->real_period = 0;
+
clk_disable_unprepare(tpm->clk);
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 458/591] pwm: sysfs: Do not apply state to already disabled PWMs
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 457/591] pwm: imx-tpm: force real_period to be zero in suspend Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 459/591] pwm: ab8500: Fix error code in probe() Greg Kroah-Hartman
` (136 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Brian Norris,
Uwe Kleine-König, Thierry Reding, Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit 38ba83598633373f47951384cfc389181c8d1bed ]
If the PWM is exported but not enabled, do not call pwm_class_apply_state().
First of all, in this case, period may still be unconfigured and this would
make pwm_class_apply_state() return -EINVAL, and then suspend would fail.
Second, it makes little sense to apply state onto PWM that is not enabled
before suspend.
Failing case:
"
$ echo 1 > /sys/class/pwm/pwmchip4/export
$ echo mem > /sys/power/state
...
pwm pwmchip4: PM: dpm_run_callback(): pwm_class_suspend+0x1/0xa8 returns -22
pwm pwmchip4: PM: failed to suspend: error -22
PM: Some devices failed to suspend, or early wake event detected
"
Working case:
"
$ echo 1 > /sys/class/pwm/pwmchip4/export
$ echo 100 > /sys/class/pwm/pwmchip4/pwm1/period
$ echo 10 > /sys/class/pwm/pwmchip4/pwm1/duty_cycle
$ echo mem > /sys/power/state
...
"
Do not call pwm_class_apply_state() in case the PWM is disabled
to fix this issue.
Fixes: 7fd4edc57bbae ("pwm: sysfs: Add suspend/resume support")
Signed-off-by: Marek Vasut <marex@denx.de>
Fixes: ef2bf4997f7d ("pwm: Improve args checking in pwm_apply_state()")
Reviewed-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/sysfs.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
index e7db8e45001cf..ba125253857ea 100644
--- a/drivers/pwm/sysfs.c
+++ b/drivers/pwm/sysfs.c
@@ -424,6 +424,13 @@ static int pwm_class_resume_npwm(struct device *parent, unsigned int npwm)
if (!export)
continue;
+ /* If pwmchip was not enabled before suspend, do nothing. */
+ if (!export->suspend.enabled) {
+ /* release lock taken in pwm_class_get_state */
+ mutex_unlock(&export->lock);
+ continue;
+ }
+
state.enabled = export->suspend.enabled;
ret = pwm_class_apply_state(export, pwm, &state);
if (ret < 0)
@@ -448,7 +455,17 @@ static int pwm_class_suspend(struct device *parent)
if (!export)
continue;
+ /*
+ * If pwmchip was not enabled before suspend, save
+ * state for resume time and do nothing else.
+ */
export->suspend = state;
+ if (!state.enabled) {
+ /* release lock taken in pwm_class_get_state */
+ mutex_unlock(&export->lock);
+ continue;
+ }
+
state.enabled = false;
ret = pwm_class_apply_state(export, pwm, &state);
if (ret < 0) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 459/591] pwm: ab8500: Fix error code in probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 458/591] pwm: sysfs: Do not apply state to already disabled PWMs Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:49 ` [PATCH 6.1 460/591] pwm: mtk_disp: Fix the disable flow of disp_pwm Greg Kroah-Hartman
` (135 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Uwe Kleine-König,
Linus Walleij, Thierry Reding, Sasha Levin
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit cdcffafc4d845cc0c6392cba168c7a942734cce7 ]
This code accidentally return positive EINVAL instead of negative
-EINVAL.
Fixes: eb41f334589d ("pwm: ab8500: Fix register offset calculation to not depend on probe order")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-ab8500.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pwm/pwm-ab8500.c b/drivers/pwm/pwm-ab8500.c
index ad37bc46f2721..5fa91f4cda7ac 100644
--- a/drivers/pwm/pwm-ab8500.c
+++ b/drivers/pwm/pwm-ab8500.c
@@ -96,7 +96,7 @@ static int ab8500_pwm_probe(struct platform_device *pdev)
int err;
if (pdev->id < 1 || pdev->id > 31)
- return dev_err_probe(&pdev->dev, EINVAL, "Invalid device id %d\n", pdev->id);
+ return dev_err_probe(&pdev->dev, -EINVAL, "Invalid device id %d\n", pdev->id);
/*
* Nothing to be done in probe, this is required to get the
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 460/591] pwm: mtk_disp: Fix the disable flow of disp_pwm
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 459/591] pwm: ab8500: Fix error code in probe() Greg Kroah-Hartman
@ 2023-07-16 19:49 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 461/591] md/raid10: fix the condition to call bio_end_io_acct() Greg Kroah-Hartman
` (134 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuijing Li, Matthias Brugger,
Fei Shao, Uwe Kleine-König, Alexandre Mergnat,
AngeloGioacchino Del Regno, Thierry Reding, Sasha Levin
From: Shuijing Li <shuijing.li@mediatek.com>
[ Upstream commit bc13d60e4e1e945b34769a4a4c2b172e8552abe5 ]
There is a flow error in the original mtk_disp_pwm_apply() function.
If this function is called when the clock is disabled, there will be a
chance to operate the disp_pwm register, resulting in disp_pwm exception.
Fix this accordingly.
Fixes: 888a623db5d0 ("pwm: mtk-disp: Implement atomic API .apply()")
Signed-off-by: Shuijing Li <shuijing.li@mediatek.com>
Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
Tested-by: Fei Shao <fshao@chromium.org>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-mtk-disp.c | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
index 3811578fcff05..db286284f3ee0 100644
--- a/drivers/pwm/pwm-mtk-disp.c
+++ b/drivers/pwm/pwm-mtk-disp.c
@@ -79,14 +79,11 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
if (state->polarity != PWM_POLARITY_NORMAL)
return -EINVAL;
- if (!state->enabled) {
- mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask,
- 0x0);
-
- if (mdp->enabled) {
- clk_disable_unprepare(mdp->clk_mm);
- clk_disable_unprepare(mdp->clk_main);
- }
+ if (!state->enabled && mdp->enabled) {
+ mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN,
+ mdp->data->enable_mask, 0x0);
+ clk_disable_unprepare(mdp->clk_mm);
+ clk_disable_unprepare(mdp->clk_main);
mdp->enabled = false;
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 461/591] md/raid10: fix the condition to call bio_end_io_acct()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2023-07-16 19:49 ` [PATCH 6.1 460/591] pwm: mtk_disp: Fix the disable flow of disp_pwm Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 462/591] blk-cgroup: Optimize blkcg_rstat_flush() Greg Kroah-Hartman
` (133 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Nan, Song Liu, Sasha Levin
From: Li Nan <linan122@huawei.com>
[ Upstream commit 125bfc7cd750e68c99f1d446e2c22abea08c237f ]
/sys/block/[device]/queue/iostats is used to control whether to count io
stat. Write 0 to it will clear queue_flags QUEUE_FLAG_IO_STAT which means
iostats is disabled. If we disable iostats and later endable it, the io
issued during this period will be counted incorrectly, inflight will be
decreased to -1.
//T1 set iostats
echo 0 > /sys/block/md0/queue/iostats
clear QUEUE_FLAG_IO_STAT
//T2 issue io
if (QUEUE_FLAG_IO_STAT) -> false
bio_start_io_acct
inflight++
echo 1 > /sys/block/md0/queue/iostats
set QUEUE_FLAG_IO_STAT
//T3 io end
if (QUEUE_FLAG_IO_STAT) -> true
bio_end_io_acct
inflight-- -> -1
Also, if iostats is enabled while issuing io but disabled while io end,
inflight will never be decreased.
Fix it by checking start_time when io end. If start_time is not 0, call
bio_end_io_acct().
Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting")
Signed-off-by: Li Nan <linan122@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230609094320.2397604-1-linan666@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index ea6228ff3bb5e..d2098fcd6a270 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -325,7 +325,7 @@ static void raid_end_bio_io(struct r10bio *r10_bio)
if (!test_bit(R10BIO_Uptodate, &r10_bio->state))
bio->bi_status = BLK_STS_IOERR;
- if (blk_queue_io_stat(bio->bi_bdev->bd_disk->queue))
+ if (r10_bio->start_time)
bio_end_io_acct(bio, r10_bio->start_time);
bio_endio(bio);
/*
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 462/591] blk-cgroup: Optimize blkcg_rstat_flush()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 461/591] md/raid10: fix the condition to call bio_end_io_acct() Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 463/591] blk-cgroup: dont update io stat for root cgroup Greg Kroah-Hartman
` (132 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Waiman Long, Tejun Heo, Jens Axboe,
Sasha Levin
From: Waiman Long <longman@redhat.com>
[ Upstream commit 3b8cc6298724021da845f2f9fd7dd4b6829a6817 ]
For a system with many CPUs and block devices, the time to do
blkcg_rstat_flush() from cgroup_rstat_flush() can be rather long. It
can be especially problematic as interrupt is disabled during the flush.
It was reported that it might take seconds to complete in some extreme
cases leading to hard lockup messages.
As it is likely that not all the percpu blkg_iostat_set's has been
updated since the last flush, those stale blkg_iostat_set's don't need
to be flushed in this case. This patch optimizes blkcg_rstat_flush()
by keeping a lockless list of recently updated blkg_iostat_set's in a
newly added percpu blkcg->lhead pointer.
The blkg_iostat_set is added to a lockless list on the update side
in blk_cgroup_bio_start(). It is removed from the lockless list when
flushed in blkcg_rstat_flush(). Due to racing, it is possible that
blk_iostat_set's in the lockless list may have no new IO stats to be
flushed, but that is OK.
To protect against destruction of blkg, a percpu reference is gotten
when putting into the lockless list and put back when removed.
When booting up an instrumented test kernel with this patch on a
2-socket 96-thread system with cgroup v2, out of the 2051 calls to
cgroup_rstat_flush() after bootup, 1788 of the calls were exited
immediately because of empty lockless list. After an all-cpu kernel
build, the ratio became 6295424/6340513. That was more than 99%.
Signed-off-by: Waiman Long <longman@redhat.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/20221105005902.407297-3-longman@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: ad7c3b41e86b ("blk-throttle: Fix io statistics for cgroup v1")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-cgroup.c | 76 ++++++++++++++++++++++++++++++++++++++++++----
block/blk-cgroup.h | 10 ++++++
2 files changed, 80 insertions(+), 6 deletions(-)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 60f366f98fa2b..2c7be256ff879 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -60,6 +60,37 @@ static struct workqueue_struct *blkcg_punt_bio_wq;
#define BLKG_DESTROY_BATCH_SIZE 64
+/*
+ * Lockless lists for tracking IO stats update
+ *
+ * New IO stats are stored in the percpu iostat_cpu within blkcg_gq (blkg).
+ * There are multiple blkg's (one for each block device) attached to each
+ * blkcg. The rstat code keeps track of which cpu has IO stats updated,
+ * but it doesn't know which blkg has the updated stats. If there are many
+ * block devices in a system, the cost of iterating all the blkg's to flush
+ * out the IO stats can be high. To reduce such overhead, a set of percpu
+ * lockless lists (lhead) per blkcg are used to track the set of recently
+ * updated iostat_cpu's since the last flush. An iostat_cpu will be put
+ * onto the lockless list on the update side [blk_cgroup_bio_start()] if
+ * not there yet and then removed when being flushed [blkcg_rstat_flush()].
+ * References to blkg are gotten and then put back in the process to
+ * protect against blkg removal.
+ *
+ * Return: 0 if successful or -ENOMEM if allocation fails.
+ */
+static int init_blkcg_llists(struct blkcg *blkcg)
+{
+ int cpu;
+
+ blkcg->lhead = alloc_percpu_gfp(struct llist_head, GFP_KERNEL);
+ if (!blkcg->lhead)
+ return -ENOMEM;
+
+ for_each_possible_cpu(cpu)
+ init_llist_head(per_cpu_ptr(blkcg->lhead, cpu));
+ return 0;
+}
+
/**
* blkcg_css - find the current css
*
@@ -237,8 +268,10 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct gendisk *disk,
blkg->blkcg = blkcg;
u64_stats_init(&blkg->iostat.sync);
- for_each_possible_cpu(cpu)
+ for_each_possible_cpu(cpu) {
u64_stats_init(&per_cpu_ptr(blkg->iostat_cpu, cpu)->sync);
+ per_cpu_ptr(blkg->iostat_cpu, cpu)->blkg = blkg;
+ }
for (i = 0; i < BLKCG_MAX_POLS; i++) {
struct blkcg_policy *pol = blkcg_policy[i];
@@ -831,7 +864,9 @@ static void blkcg_iostat_update(struct blkcg_gq *blkg, struct blkg_iostat *cur,
static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu)
{
struct blkcg *blkcg = css_to_blkcg(css);
- struct blkcg_gq *blkg;
+ struct llist_head *lhead = per_cpu_ptr(blkcg->lhead, cpu);
+ struct llist_node *lnode;
+ struct blkg_iostat_set *bisc, *next_bisc;
/* Root-level stats are sourced from system-wide IO stats */
if (!cgroup_parent(css->cgroup))
@@ -839,12 +874,21 @@ static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu)
rcu_read_lock();
- hlist_for_each_entry_rcu(blkg, &blkcg->blkg_list, blkcg_node) {
+ lnode = llist_del_all(lhead);
+ if (!lnode)
+ goto out;
+
+ /*
+ * Iterate only the iostat_cpu's queued in the lockless list.
+ */
+ llist_for_each_entry_safe(bisc, next_bisc, lnode, lnode) {
+ struct blkcg_gq *blkg = bisc->blkg;
struct blkcg_gq *parent = blkg->parent;
- struct blkg_iostat_set *bisc = per_cpu_ptr(blkg->iostat_cpu, cpu);
struct blkg_iostat cur;
unsigned int seq;
+ WRITE_ONCE(bisc->lqueued, false);
+
/* fetch the current per-cpu values */
do {
seq = u64_stats_fetch_begin(&bisc->sync);
@@ -857,8 +901,10 @@ static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu)
if (parent && parent->parent)
blkcg_iostat_update(parent, &blkg->iostat.cur,
&blkg->iostat.last);
+ percpu_ref_put(&blkg->refcnt);
}
+out:
rcu_read_unlock();
}
@@ -1136,6 +1182,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
mutex_unlock(&blkcg_pol_mutex);
+ free_percpu(blkcg->lhead);
kfree(blkcg);
}
@@ -1158,6 +1205,9 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
}
}
+ if (init_blkcg_llists(blkcg))
+ goto free_blkcg;
+
for (i = 0; i < BLKCG_MAX_POLS ; i++) {
struct blkcg_policy *pol = blkcg_policy[i];
struct blkcg_policy_data *cpd;
@@ -1199,7 +1249,8 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
for (i--; i >= 0; i--)
if (blkcg->cpd[i])
blkcg_policy[i]->cpd_free_fn(blkcg->cpd[i]);
-
+ free_percpu(blkcg->lhead);
+free_blkcg:
if (blkcg != &blkcg_root)
kfree(blkcg);
unlock:
@@ -1952,6 +2003,7 @@ static int blk_cgroup_io_type(struct bio *bio)
void blk_cgroup_bio_start(struct bio *bio)
{
+ struct blkcg *blkcg = bio->bi_blkg->blkcg;
int rwd = blk_cgroup_io_type(bio), cpu;
struct blkg_iostat_set *bis;
unsigned long flags;
@@ -1970,9 +2022,21 @@ void blk_cgroup_bio_start(struct bio *bio)
}
bis->cur.ios[rwd]++;
+ /*
+ * If the iostat_cpu isn't in a lockless list, put it into the
+ * list to indicate that a stat update is pending.
+ */
+ if (!READ_ONCE(bis->lqueued)) {
+ struct llist_head *lhead = this_cpu_ptr(blkcg->lhead);
+
+ llist_add(&bis->lnode, lhead);
+ WRITE_ONCE(bis->lqueued, true);
+ percpu_ref_get(&bis->blkg->refcnt);
+ }
+
u64_stats_update_end_irqrestore(&bis->sync, flags);
if (cgroup_subsys_on_dfl(io_cgrp_subsys))
- cgroup_rstat_updated(bio->bi_blkg->blkcg->css.cgroup, cpu);
+ cgroup_rstat_updated(blkcg->css.cgroup, cpu);
put_cpu();
}
diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
index aa2b286bc825f..1e94e404eaa80 100644
--- a/block/blk-cgroup.h
+++ b/block/blk-cgroup.h
@@ -18,6 +18,7 @@
#include <linux/cgroup.h>
#include <linux/kthread.h>
#include <linux/blk-mq.h>
+#include <linux/llist.h>
struct blkcg_gq;
struct blkg_policy_data;
@@ -43,6 +44,9 @@ struct blkg_iostat {
struct blkg_iostat_set {
struct u64_stats_sync sync;
+ struct blkcg_gq *blkg;
+ struct llist_node lnode;
+ int lqueued; /* queued in llist */
struct blkg_iostat cur;
struct blkg_iostat last;
};
@@ -97,6 +101,12 @@ struct blkcg {
struct blkcg_policy_data *cpd[BLKCG_MAX_POLS];
struct list_head all_blkcgs_node;
+
+ /*
+ * List of updated percpu blkg_iostat_set's since the last flush.
+ */
+ struct llist_head __percpu *lhead;
+
#ifdef CONFIG_BLK_CGROUP_FC_APPID
char fc_app_id[FC_APPID_LEN];
#endif
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 463/591] blk-cgroup: dont update io stat for root cgroup
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 462/591] blk-cgroup: Optimize blkcg_rstat_flush() Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 464/591] blk-throttle: Fix io statistics for cgroup v1 Greg Kroah-Hartman
` (131 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bart van Assche, Tejun Heo,
Waiman Long, Ming Lei, Jens Axboe, Sasha Levin
From: Ming Lei <ming.lei@redhat.com>
[ Upstream commit 0416f3be58c6b1ea066cd52e354b857693feb01e ]
We source root cgroup stats from the system-wide stats, see blkcg_print_stat
and blkcg_rstat_flush, so don't update io state for root cgroup.
Fixes blkg leak issue introduced in commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
which starts to grab blkg's reference when adding iostat_cpu into percpu
blkcg list, but this state won't be consumed by blkcg_rstat_flush() where
the blkg reference is dropped.
Tested-by: Bart van Assche <bvanassche@acm.org>
Reported-by: Bart van Assche <bvanassche@acm.org>
Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
Cc: Tejun Heo <tj@kernel.org>
Cc: Waiman Long <longman@redhat.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20230202021804.278582-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: ad7c3b41e86b ("blk-throttle: Fix io statistics for cgroup v1")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-cgroup.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 2c7be256ff879..5ee0ae8ddbf6f 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -2008,6 +2008,10 @@ void blk_cgroup_bio_start(struct bio *bio)
struct blkg_iostat_set *bis;
unsigned long flags;
+ /* Root-level stats are sourced from system-wide IO stats */
+ if (!cgroup_parent(blkcg->css.cgroup))
+ return;
+
cpu = get_cpu();
bis = per_cpu_ptr(bio->bi_blkg->iostat_cpu, cpu);
flags = u64_stats_update_begin_irqsave(&bis->sync);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 464/591] blk-throttle: Fix io statistics for cgroup v1
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 463/591] blk-cgroup: dont update io stat for root cgroup Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 465/591] rtc: st-lpc: Release some resources in st_rtc_probe() in case of error Greg Kroah-Hartman
` (130 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrea Righi, Jinke Han, Muchun Song,
Tejun Heo, Jens Axboe, Sasha Levin
From: Jinke Han <hanjinke.666@bytedance.com>
[ Upstream commit ad7c3b41e86b59943a903d23c7b037d820e6270c ]
After commit f382fb0bcef4 ("block: remove legacy IO schedulers"),
blkio.throttle.io_serviced and blkio.throttle.io_service_bytes become
the only stable io stats interface of cgroup v1, and these statistics
are done in the blk-throttle code. But the current code only counts the
bios that are actually throttled. When the user does not add the throttle
limit, the io stats for cgroup v1 has nothing. I fix it according to the
statistical method of v2, and made it count all ios accurately.
Fixes: a7b36ee6ba29 ("block: move blk-throtl fast path inline")
Tested-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Jinke Han <hanjinke.666@bytedance.com>
Acked-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/20230507170631.89607-1-hanjinke.666@bytedance.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-cgroup.c | 6 ++++--
block/blk-throttle.c | 6 ------
block/blk-throttle.h | 9 +++++++++
3 files changed, 13 insertions(+), 8 deletions(-)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 5ee0ae8ddbf6f..e812e48d5bb8a 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -2008,6 +2008,9 @@ void blk_cgroup_bio_start(struct bio *bio)
struct blkg_iostat_set *bis;
unsigned long flags;
+ if (!cgroup_subsys_on_dfl(io_cgrp_subsys))
+ return;
+
/* Root-level stats are sourced from system-wide IO stats */
if (!cgroup_parent(blkcg->css.cgroup))
return;
@@ -2039,8 +2042,7 @@ void blk_cgroup_bio_start(struct bio *bio)
}
u64_stats_update_end_irqrestore(&bis->sync, flags);
- if (cgroup_subsys_on_dfl(io_cgrp_subsys))
- cgroup_rstat_updated(blkcg->css.cgroup, cpu);
+ cgroup_rstat_updated(blkcg->css.cgroup, cpu);
put_cpu();
}
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index f1bc600c4ded6..d88147d1358fc 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -2167,12 +2167,6 @@ bool __blk_throtl_bio(struct bio *bio)
rcu_read_lock();
- if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) {
- blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf,
- bio->bi_iter.bi_size);
- blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1);
- }
-
spin_lock_irq(&q->queue_lock);
throtl_update_latency_buckets(td);
diff --git a/block/blk-throttle.h b/block/blk-throttle.h
index ef4b7a4de987d..d1ccbfe9f7978 100644
--- a/block/blk-throttle.h
+++ b/block/blk-throttle.h
@@ -185,6 +185,15 @@ static inline bool blk_should_throtl(struct bio *bio)
struct throtl_grp *tg = blkg_to_tg(bio->bi_blkg);
int rw = bio_data_dir(bio);
+ if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) {
+ if (!bio_flagged(bio, BIO_CGROUP_ACCT)) {
+ bio_set_flag(bio, BIO_CGROUP_ACCT);
+ blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf,
+ bio->bi_iter.bi_size);
+ }
+ blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1);
+ }
+
/* iops limit is always counted */
if (tg->has_rules_iops[rw])
return true;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 465/591] rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 464/591] blk-throttle: Fix io statistics for cgroup v1 Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 466/591] drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake times Greg Kroah-Hartman
` (129 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET,
Alexandre Belloni, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 06c6e1b01d9261f03629cefd1f3553503291e6cf ]
If an error occurs after clk_get(), the corresponding resources should be
released.
Use devm_clk_get() to fix it.
Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/866af6adbc7454a7b4505eb6c28fbdc86ccff39e.1686251455.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-st-lpc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c
index 0f8e4231098ef..d04d46f9cc65a 100644
--- a/drivers/rtc/rtc-st-lpc.c
+++ b/drivers/rtc/rtc-st-lpc.c
@@ -228,7 +228,7 @@ static int st_rtc_probe(struct platform_device *pdev)
enable_irq_wake(rtc->irq);
disable_irq(rtc->irq);
- rtc->clk = clk_get(&pdev->dev, NULL);
+ rtc->clk = devm_clk_get(&pdev->dev, NULL);
if (IS_ERR(rtc->clk)) {
dev_err(&pdev->dev, "Unable to request clock\n");
return PTR_ERR(rtc->clk);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 466/591] drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake times
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 465/591] rtc: st-lpc: Release some resources in st_rtc_probe() in case of error Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 467/591] drm/i915/guc/slpc: Apply min softlimit correctly Greg Kroah-Hartman
` (128 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanislav Lisovskiy,
Jouni Högander, Mika Kahola, Tvrtko Ursulin, Sasha Levin
From: Jouni Högander <jouni.hogander@intel.com>
[ Upstream commit 5311892a0ad1d301aafd53ca0154091b3eb407ea ]
Encoder compute config is changing hw.adjusted mode. Uapi.adjusted mode
doesn't get updated before psr compute config gets called. This causes io
and fast wake line calculation using adjusted mode containing values before
encoder adjustments. Fix this by using hw.adjusted mode instead of
uapi.adjusted mode.
Cc: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8475
Fixes: cb42e8ede5b4 ("drm/i915/psr: Use calculated io and fast wake lines")
Reviewed-by: Mika Kahola <mika.kahola@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230620111745.2870706-1-jouni.hogander@intel.com
(cherry picked from commit ef0af9db2a21257885116949f471fe5565b2f0ab)
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_psr.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c
index bf18423c7a005..e2d7c0a6802aa 100644
--- a/drivers/gpu/drm/i915/display/intel_psr.c
+++ b/drivers/gpu/drm/i915/display/intel_psr.c
@@ -857,9 +857,9 @@ static bool _compute_psr2_wake_times(struct intel_dp *intel_dp,
}
io_wake_lines = intel_usecs_to_scanlines(
- &crtc_state->uapi.adjusted_mode, io_wake_time);
+ &crtc_state->hw.adjusted_mode, io_wake_time);
fast_wake_lines = intel_usecs_to_scanlines(
- &crtc_state->uapi.adjusted_mode, fast_wake_time);
+ &crtc_state->hw.adjusted_mode, fast_wake_time);
if (io_wake_lines > max_wake_lines ||
fast_wake_lines > max_wake_lines)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 467/591] drm/i915/guc/slpc: Apply min softlimit correctly
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 466/591] drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake times Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 468/591] f2fs: check return value of freeze_super() Greg Kroah-Hartman
` (127 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ashutosh Dixit, Vinay Belgaumkar,
Daniele Ceraolo Spurio, Tvrtko Ursulin, Sasha Levin
From: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
[ Upstream commit 3e49de73fb89272dea01ba420c7ccbcf6b96aed7 ]
The scenario being fixed here is depicted in the following sequence-
modprobe i915
echo 1 > /sys/class/drm/card0/gt/gt0/slpc_ignore_eff_freq
echo 300 > /sys/class/drm/card0/gt_min_freq_mhz (RPn)
cat /sys/class/drm/card0/gt_cur_freq_mhz --> cur == RPn as expected
echo 1 > /sys/kernel/debug/dri/0/gt0/reset --> reset
cat /sys/class/drm/card0/gt_min_freq_mhz --> cached freq is RPn
cat /sys/class/drm/card0/gt_cur_freq_mhz --> it's not RPn, but RPe!!
When SLPC reinitializes, it sets SLPC min freq to efficient frequency.
Even if we disable efficient freq post that, we should restore the cached
min freq (via H2G) for it to take effect.
v2: Clarify commit message (Ashutosh)
Fixes: 95ccf312a1e4 ("drm/i915/guc/slpc: Allow SLPC to use efficient frequency")
Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230621014257.1769564-1-vinay.belgaumkar@intel.com
(cherry picked from commit da86b2b13f1d1ca26745b951ac94421f3137539a)
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c
index fdd895f73f9f1..72ba1c758ca79 100644
--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c
+++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c
@@ -580,7 +580,7 @@ static int slpc_set_softlimits(struct intel_guc_slpc *slpc)
if (unlikely(ret))
return ret;
slpc_to_gt(slpc)->defaults.min_freq = slpc->min_freq_softlimit;
- } else if (slpc->min_freq_softlimit != slpc->min_freq) {
+ } else {
return intel_guc_slpc_set_min_freq(slpc,
slpc->min_freq_softlimit);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 468/591] f2fs: check return value of freeze_super()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 467/591] drm/i915/guc/slpc: Apply min softlimit correctly Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 469/591] media: cec: i2c: ch7322: also select REGMAP Greg Kroah-Hartman
` (126 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
From: Chao Yu <chao@kernel.org>
[ Upstream commit 8bec7dd1b3f7d7769d433d67bde404de948a2d95 ]
freeze_super() can fail, it needs to check its return value and do
error handling in f2fs_resize_fs().
Fixes: 04f0b2eaa3b3 ("f2fs: ioctl for removing a range from F2FS")
Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/gc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index 3de887d07c060..aa4d513daa8f8 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -2186,7 +2186,9 @@ int f2fs_resize_fs(struct file *filp, __u64 block_count)
if (err)
return err;
- freeze_super(sbi->sb);
+ err = freeze_super(sbi->sb);
+ if (err)
+ return err;
if (f2fs_readonly(sbi->sb)) {
thaw_super(sbi->sb);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 469/591] media: cec: i2c: ch7322: also select REGMAP
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 468/591] f2fs: check return value of freeze_super() Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 470/591] sctp: fix potential deadlock on &net->sctp.addr_wq_lock Greg Kroah-Hartman
` (125 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Jeff Chase,
Hans Verkuil, Joe Tessler, Arnd Bergmann, Mark Brown,
Masahiro Yamada, Mauro Carvalho Chehab, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 29f96ac23648b2259f42d40703c47dd18fd172ca ]
Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors,
so also select REGMAP to prevent the build errors.
../drivers/media/cec/i2c/ch7322.c:158:21: error: variable 'ch7322_regmap' has initializer but incomplete type
158 | static const struct regmap_config ch7322_regmap = {
../drivers/media/cec/i2c/ch7322.c:159:10: error: 'const struct regmap_config' has no member named 'reg_bits'
159 | .reg_bits = 8,
../drivers/media/cec/i2c/ch7322.c:159:21: warning: excess elements in struct initializer
159 | .reg_bits = 8,
../drivers/media/cec/i2c/ch7322.c:160:10: error: 'const struct regmap_config' has no member named 'val_bits'
160 | .val_bits = 8,
../drivers/media/cec/i2c/ch7322.c:160:21: warning: excess elements in struct initializer
160 | .val_bits = 8,
../drivers/media/cec/i2c/ch7322.c:161:10: error: 'const struct regmap_config' has no member named 'max_register'
161 | .max_register = 0x7f,
../drivers/media/cec/i2c/ch7322.c:161:25: warning: excess elements in struct initializer
161 | .max_register = 0x7f,
../drivers/media/cec/i2c/ch7322.c:162:10: error: 'const struct regmap_config' has no member named 'disable_locking'
162 | .disable_locking = true,
../drivers/media/cec/i2c/ch7322.c:162:28: warning: excess elements in struct initializer
162 | .disable_locking = true,
../drivers/media/cec/i2c/ch7322.c: In function 'ch7322_probe':
../drivers/media/cec/i2c/ch7322.c:468:26: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration]
468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap);
../drivers/media/cec/i2c/ch7322.c:468:24: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap);
../drivers/media/cec/i2c/ch7322.c: At top level:
../drivers/media/cec/i2c/ch7322.c:158:35: error: storage size of 'ch7322_regmap' isn't known
158 | static const struct regmap_config ch7322_regmap = {
Link: https://lore.kernel.org/linux-media/20230608025435.29249-1-rdunlap@infradead.org
Fixes: 21b9a47e0ec7 ("media: cec: i2c: ch7322: Add ch7322 CEC controller driver")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Jeff Chase <jnchase@google.com>
Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: Joe Tessler <jrt@google.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Mark Brown <broonie@kernel.org>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/cec/i2c/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/cec/i2c/Kconfig b/drivers/media/cec/i2c/Kconfig
index 70432a1d69186..d912d143fb312 100644
--- a/drivers/media/cec/i2c/Kconfig
+++ b/drivers/media/cec/i2c/Kconfig
@@ -5,6 +5,7 @@
config CEC_CH7322
tristate "Chrontel CH7322 CEC controller"
depends on I2C
+ select REGMAP
select REGMAP_I2C
select CEC_CORE
help
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 470/591] sctp: fix potential deadlock on &net->sctp.addr_wq_lock
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 469/591] media: cec: i2c: ch7322: also select REGMAP Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 471/591] net/sched: act_ipt: add sanity checks on table name and hook locations Greg Kroah-Hartman
` (124 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Xin Long, Paolo Abeni,
Sasha Levin
From: Chengfeng Ye <dg573847474@gmail.com>
[ Upstream commit 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a ]
As &net->sctp.addr_wq_lock is also acquired by the timer
sctp_addr_wq_timeout_handler() in protocal.c, the same lock acquisition
at sctp_auto_asconf_init() seems should disable irq since it is called
from sctp_accept() under process context.
Possible deadlock scenario:
sctp_accept()
-> sctp_sock_migrate()
-> sctp_auto_asconf_init()
-> spin_lock(&net->sctp.addr_wq_lock)
<timer interrupt>
-> sctp_addr_wq_timeout_handler()
-> spin_lock_bh(&net->sctp.addr_wq_lock); (deadlock here)
This flaw was found using an experimental static analysis tool we are
developing for irq-related deadlock.
The tentative patch fix the potential deadlock by spin_lock_bh().
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Fixes: 34e5b0118685 ("sctp: delay auto_asconf init until binding the first addr")
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/20230627120340.19432-1-dg573847474@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/socket.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index e1011311bc877..c806d272107ac 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -363,9 +363,9 @@ static void sctp_auto_asconf_init(struct sctp_sock *sp)
struct net *net = sock_net(&sp->inet.sk);
if (net->sctp.default_auto_asconf) {
- spin_lock(&net->sctp.addr_wq_lock);
+ spin_lock_bh(&net->sctp.addr_wq_lock);
list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist);
- spin_unlock(&net->sctp.addr_wq_lock);
+ spin_unlock_bh(&net->sctp.addr_wq_lock);
sp->do_auto_asconf = 1;
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 471/591] net/sched: act_ipt: add sanity checks on table name and hook locations
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 470/591] sctp: fix potential deadlock on &net->sctp.addr_wq_lock Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 472/591] net: add a couple of helpers for iph tot_len Greg Kroah-Hartman
` (123 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Simon Horman,
Jamal Hadi Salim, Paolo Abeni, Sasha Levin
From: Florian Westphal <fw@strlen.de>
[ Upstream commit b4ee93380b3c891fea996af8d1d3ca0e36ad31f0 ]
Looks like "tc" hard-codes "mangle" as the only supported table
name, but on kernel side there are no checks.
This is wrong. Not all xtables targets are safe to call from tc.
E.g. "nat" targets assume skb has a conntrack object assigned to it.
Normally those get called from netfilter nat core which consults the
nat table to obtain the address mapping.
"tc" userspace either sets PRE or POSTROUTING as hook number, but there
is no validation of this on kernel side, so update netlink policy to
reject bogus numbers. Some targets may assume skb_dst is set for
input/forward hooks, so prevent those from being used.
act_ipt uses the hook number in two places:
1. the state hook number, this is fine as-is
2. to set par.hook_mask
The latter is a bit mask, so update the assignment to make
xt_check_target() to the right thing.
Followup patch adds required checks for the skb/packet headers before
calling the targets evaluation function.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/act_ipt.c | 27 ++++++++++++++++++++-------
1 file changed, 20 insertions(+), 7 deletions(-)
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 1625e10374161..dc92975a9374f 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -47,7 +47,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
par.entryinfo = &e;
par.target = target;
par.targinfo = t->data;
- par.hook_mask = hook;
+ par.hook_mask = 1 << hook;
par.family = NFPROTO_IPV4;
ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false);
@@ -84,7 +84,8 @@ static void tcf_ipt_release(struct tc_action *a)
static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = {
[TCA_IPT_TABLE] = { .type = NLA_STRING, .len = IFNAMSIZ },
- [TCA_IPT_HOOK] = { .type = NLA_U32 },
+ [TCA_IPT_HOOK] = NLA_POLICY_RANGE(NLA_U32, NF_INET_PRE_ROUTING,
+ NF_INET_NUMHOOKS),
[TCA_IPT_INDEX] = { .type = NLA_U32 },
[TCA_IPT_TARG] = { .len = sizeof(struct xt_entry_target) },
};
@@ -157,15 +158,27 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla,
return -EEXIST;
}
}
+
+ err = -EINVAL;
hook = nla_get_u32(tb[TCA_IPT_HOOK]);
+ switch (hook) {
+ case NF_INET_PRE_ROUTING:
+ break;
+ case NF_INET_POST_ROUTING:
+ break;
+ default:
+ goto err1;
+ }
+
+ if (tb[TCA_IPT_TABLE]) {
+ /* mangle only for now */
+ if (nla_strcmp(tb[TCA_IPT_TABLE], "mangle"))
+ goto err1;
+ }
- err = -ENOMEM;
- tname = kmalloc(IFNAMSIZ, GFP_KERNEL);
+ tname = kstrdup("mangle", GFP_KERNEL);
if (unlikely(!tname))
goto err1;
- if (tb[TCA_IPT_TABLE] == NULL ||
- nla_strscpy(tname, tb[TCA_IPT_TABLE], IFNAMSIZ) >= IFNAMSIZ)
- strcpy(tname, "mangle");
t = kmemdup(td, td->u.target_size, GFP_KERNEL);
if (unlikely(!t))
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 472/591] net: add a couple of helpers for iph tot_len
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 471/591] net/sched: act_ipt: add sanity checks on table name and hook locations Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 473/591] net/sched: act_ipt: add sanity checks on skb before calling target Greg Kroah-Hartman
` (122 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xin Long, David Ahern, Eric Dumazet,
Jakub Kicinski, Sasha Levin
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit 058a8f7f73aae1cc22b53fcefec031b9e391b54d ]
This patch adds three APIs to replace the iph->tot_len setting
and getting in all places where IPv4 BIG TCP packets may reach,
they will be used in the following patches.
Note that iph_totlen() will be used when iph is not in linear
data of the skb.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: b2dc32dcba08 ("net/sched: act_ipt: add sanity checks on skb before calling target")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/ip.h | 21 +++++++++++++++++++++
include/net/route.h | 3 ---
2 files changed, 21 insertions(+), 3 deletions(-)
diff --git a/include/linux/ip.h b/include/linux/ip.h
index 3d9c6750af627..d11c25f5030a0 100644
--- a/include/linux/ip.h
+++ b/include/linux/ip.h
@@ -35,4 +35,25 @@ static inline unsigned int ip_transport_len(const struct sk_buff *skb)
{
return ntohs(ip_hdr(skb)->tot_len) - skb_network_header_len(skb);
}
+
+static inline unsigned int iph_totlen(const struct sk_buff *skb, const struct iphdr *iph)
+{
+ u32 len = ntohs(iph->tot_len);
+
+ return (len || !skb_is_gso(skb) || !skb_is_gso_tcp(skb)) ?
+ len : skb->len - skb_network_offset(skb);
+}
+
+static inline unsigned int skb_ip_totlen(const struct sk_buff *skb)
+{
+ return iph_totlen(skb, ip_hdr(skb));
+}
+
+/* IPv4 datagram length is stored into 16bit field (tot_len) */
+#define IP_MAX_MTU 0xFFFFU
+
+static inline void iph_set_totlen(struct iphdr *iph, unsigned int len)
+{
+ iph->tot_len = len <= IP_MAX_MTU ? htons(len) : 0;
+}
#endif /* _LINUX_IP_H */
diff --git a/include/net/route.h b/include/net/route.h
index 6e92dd5bcd613..fe00b0a2e4759 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -35,9 +35,6 @@
#include <linux/cache.h>
#include <linux/security.h>
-/* IPv4 datagram length is stored into 16bit field (tot_len) */
-#define IP_MAX_MTU 0xFFFFU
-
#define RTO_ONLINK 0x01
#define RT_CONN_FLAGS(sk) (RT_TOS(inet_sk(sk)->tos) | sock_flag(sk, SOCK_LOCALROUTE))
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 473/591] net/sched: act_ipt: add sanity checks on skb before calling target
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 472/591] net: add a couple of helpers for iph tot_len Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 474/591] spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode Greg Kroah-Hartman
` (121 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Simon Horman,
Jamal Hadi Salim, Paolo Abeni, Sasha Levin
From: Florian Westphal <fw@strlen.de>
[ Upstream commit b2dc32dcba08bf55cec600caa76f4afd2e3614df ]
Netfilter targets make assumptions on the skb state, for example
iphdr is supposed to be in the linear area.
This is normally done by IP stack, but in act_ipt case no
such checks are made.
Some targets can even assume that skb_dst will be valid.
Make a minimum effort to check for this:
- Don't call the targets eval function for non-ipv4 skbs.
- Don't call the targets eval function for POSTROUTING
emulation when the skb has no dst set.
v3: use skb_protocol helper (Davide Caratti)
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/act_ipt.c | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -229,6 +229,26 @@ static int tcf_xt_init(struct net *net,
a, &act_xt_ops, tp, flags);
}
+static bool tcf_ipt_act_check(struct sk_buff *skb)
+{
+ const struct iphdr *iph;
+ unsigned int nhoff, len;
+
+ if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+ return false;
+
+ nhoff = skb_network_offset(skb);
+ iph = ip_hdr(skb);
+ if (iph->ihl < 5 || iph->version != 4)
+ return false;
+
+ len = skb_ip_totlen(skb);
+ if (skb->len < nhoff + len || len < (iph->ihl * 4u))
+ return false;
+
+ return pskb_may_pull(skb, iph->ihl * 4u);
+}
+
static int tcf_ipt_act(struct sk_buff *skb, const struct tc_action *a,
struct tcf_result *res)
{
@@ -242,9 +262,22 @@ static int tcf_ipt_act(struct sk_buff *s
.pf = NFPROTO_IPV4,
};
+ if (skb_protocol(skb, false) != htons(ETH_P_IP))
+ return TC_ACT_UNSPEC;
+
if (skb_unclone(skb, GFP_ATOMIC))
return TC_ACT_UNSPEC;
+ if (!tcf_ipt_act_check(skb))
+ return TC_ACT_UNSPEC;
+
+ if (state.hook == NF_INET_POST_ROUTING) {
+ if (!skb_dst(skb))
+ return TC_ACT_UNSPEC;
+
+ state.out = skb->dev;
+ }
+
spin_lock(&ipt->tcf_lock);
tcf_lastuse_update(&ipt->tcf_tm);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 474/591] spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 473/591] net/sched: act_ipt: add sanity checks on skb before calling target Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 475/591] net: mscc: ocelot: dont report that RX timestamping is enabled by default Greg Kroah-Hartman
` (120 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Mark Brown,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit d10005837be83906bbd2078c3b4f9dfcbd6c95b6 ]
The GPI DMA mode requires for TX DMA to be prepared. Force SPI core to
provide TX buffer even if the caller didn't provide one by setting the
SPI_CONTROLLER_MUST_TX flag.
Fixes: b59c122484ec ("spi: spi-geni-qcom: Add support for GPI dma")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20230629095847.3648597-1-dmitry.baryshkov@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-geni-qcom.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
index 689b94fc5570a..7b76dcd11e2bb 100644
--- a/drivers/spi/spi-geni-qcom.c
+++ b/drivers/spi/spi-geni-qcom.c
@@ -979,6 +979,12 @@ static int spi_geni_probe(struct platform_device *pdev)
if (mas->cur_xfer_mode == GENI_SE_FIFO)
spi->set_cs = spi_geni_set_cs;
+ /*
+ * TX is required per GSI spec, see setup_gsi_xfer().
+ */
+ if (mas->cur_xfer_mode == GENI_GPI_DMA)
+ spi->flags = SPI_CONTROLLER_MUST_TX;
+
ret = request_irq(mas->irq, geni_spi_isr, 0, dev_name(dev), spi);
if (ret)
goto spi_geni_release_dma;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 475/591] net: mscc: ocelot: dont report that RX timestamping is enabled by default
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 474/591] spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 476/591] net: mscc: ocelot: dont keep PTP configuration of all ports in single structure Greg Kroah-Hartman
` (119 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Paolo Abeni,
Sasha Levin
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 4fd44b82b7aceaa35c2901c6546d2c4198e0799d ]
PTP RX timestamping should be enabled when the user requests it, not by
default. If it is enabled by default, it can be problematic when the
ocelot driver is a DSA master, and it sidesteps what DSA tries to avoid
through __dsa_master_hwtstamp_validate().
Additionally, after the change which made ocelot trap PTP packets only
to the CPU at ocelot_hwtstamp_set() time, it is no longer even true that
RX timestamping is enabled by default, because until ocelot_hwtstamp_set()
is called, the PTP traps are actually not set up. So the rx_filter field
of ocelot->hwtstamp_config reflects an incorrect reality.
Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets")
Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mscc/ocelot_ptp.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/net/ethernet/mscc/ocelot_ptp.c b/drivers/net/ethernet/mscc/ocelot_ptp.c
index 2180ae94c7447..673bfd70867a6 100644
--- a/drivers/net/ethernet/mscc/ocelot_ptp.c
+++ b/drivers/net/ethernet/mscc/ocelot_ptp.c
@@ -824,11 +824,6 @@ int ocelot_init_timestamp(struct ocelot *ocelot,
ocelot_write(ocelot, PTP_CFG_MISC_PTP_EN, PTP_CFG_MISC);
- /* There is no device reconfiguration, PTP Rx stamping is always
- * enabled.
- */
- ocelot->hwtstamp_config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
-
return 0;
}
EXPORT_SYMBOL(ocelot_init_timestamp);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 476/591] net: mscc: ocelot: dont keep PTP configuration of all ports in single structure
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 475/591] net: mscc: ocelot: dont report that RX timestamping is enabled by default Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 477/591] net: dsa: felix: dont drop PTP frames with tag_8021q when RX timestamping is disabled Greg Kroah-Hartman
` (118 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Paolo Abeni,
Sasha Levin
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 45d0fcb5bc9558d0bf3d2fa7fabc5d8a88d35439 ]
In a future change, the driver will need to determine whether PTP RX
timestamping is enabled on a port (including whether traps were set up
on that port in particular) and that is currently not possible.
The driver supports different RX filters (L2, L4) and kinds of TX
timestamping (one-step, two-step) on its ports, but it saves all
configuration in a single struct hwtstamp_config that is global to the
switch. So, the latest timestamping configuration on one port
(including a request to disable timestamping) affects what gets reported
for all ports, even though the configuration itself is still individual
to each port.
The port timestamping configurations are only coupled because of the
common structure, so replace the hwtstamp_config with a mask of trapped
protocols saved per port. We also have the ptp_cmd to distinguish
between one-step and two-step PTP timestamping, so with those 2 bits of
information we can fully reconstruct a descriptive struct
hwtstamp_config for each port, during the SIOCGHWTSTAMP ioctl.
Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support")
Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mscc/ocelot.c | 1 -
drivers/net/ethernet/mscc/ocelot_ptp.c | 61 +++++++++++++++++---------
include/soc/mscc/ocelot.h | 10 +++--
3 files changed, 48 insertions(+), 24 deletions(-)
diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index 13b14110a0603..01b6e13f4692f 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -2728,7 +2728,6 @@ int ocelot_init(struct ocelot *ocelot)
}
}
- mutex_init(&ocelot->ptp_lock);
mutex_init(&ocelot->mact_lock);
mutex_init(&ocelot->fwd_domain_lock);
mutex_init(&ocelot->tas_lock);
diff --git a/drivers/net/ethernet/mscc/ocelot_ptp.c b/drivers/net/ethernet/mscc/ocelot_ptp.c
index 673bfd70867a6..cb32234a5bf1b 100644
--- a/drivers/net/ethernet/mscc/ocelot_ptp.c
+++ b/drivers/net/ethernet/mscc/ocelot_ptp.c
@@ -439,8 +439,12 @@ static int ocelot_ipv6_ptp_trap_del(struct ocelot *ocelot, int port)
static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port,
bool l2, bool l4)
{
+ struct ocelot_port *ocelot_port = ocelot->ports[port];
int err;
+ ocelot_port->trap_proto &= ~(OCELOT_PROTO_PTP_L2 |
+ OCELOT_PROTO_PTP_L4);
+
if (l2)
err = ocelot_l2_ptp_trap_add(ocelot, port);
else
@@ -464,6 +468,11 @@ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port,
if (err)
return err;
+ if (l2)
+ ocelot_port->trap_proto |= OCELOT_PROTO_PTP_L2;
+ if (l4)
+ ocelot_port->trap_proto |= OCELOT_PROTO_PTP_L4;
+
return 0;
err_ipv6:
@@ -474,10 +483,38 @@ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port,
return err;
}
+static int ocelot_traps_to_ptp_rx_filter(unsigned int proto)
+{
+ if ((proto & OCELOT_PROTO_PTP_L2) && (proto & OCELOT_PROTO_PTP_L4))
+ return HWTSTAMP_FILTER_PTP_V2_EVENT;
+ else if (proto & OCELOT_PROTO_PTP_L2)
+ return HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+ else if (proto & OCELOT_PROTO_PTP_L4)
+ return HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
+
+ return HWTSTAMP_FILTER_NONE;
+}
+
int ocelot_hwstamp_get(struct ocelot *ocelot, int port, struct ifreq *ifr)
{
- return copy_to_user(ifr->ifr_data, &ocelot->hwtstamp_config,
- sizeof(ocelot->hwtstamp_config)) ? -EFAULT : 0;
+ struct ocelot_port *ocelot_port = ocelot->ports[port];
+ struct hwtstamp_config cfg = {};
+
+ switch (ocelot_port->ptp_cmd) {
+ case IFH_REW_OP_TWO_STEP_PTP:
+ cfg.tx_type = HWTSTAMP_TX_ON;
+ break;
+ case IFH_REW_OP_ORIGIN_PTP:
+ cfg.tx_type = HWTSTAMP_TX_ONESTEP_SYNC;
+ break;
+ default:
+ cfg.tx_type = HWTSTAMP_TX_OFF;
+ break;
+ }
+
+ cfg.rx_filter = ocelot_traps_to_ptp_rx_filter(ocelot_port->trap_proto);
+
+ return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0;
}
EXPORT_SYMBOL(ocelot_hwstamp_get);
@@ -509,8 +546,6 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr)
return -ERANGE;
}
- mutex_lock(&ocelot->ptp_lock);
-
switch (cfg.rx_filter) {
case HWTSTAMP_FILTER_NONE:
break;
@@ -531,28 +566,14 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr)
l4 = true;
break;
default:
- mutex_unlock(&ocelot->ptp_lock);
return -ERANGE;
}
err = ocelot_setup_ptp_traps(ocelot, port, l2, l4);
- if (err) {
- mutex_unlock(&ocelot->ptp_lock);
+ if (err)
return err;
- }
-
- if (l2 && l4)
- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
- else if (l2)
- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
- else if (l4)
- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
- else
- cfg.rx_filter = HWTSTAMP_FILTER_NONE;
- /* Commit back the result & save it */
- memcpy(&ocelot->hwtstamp_config, &cfg, sizeof(cfg));
- mutex_unlock(&ocelot->ptp_lock);
+ cfg.rx_filter = ocelot_traps_to_ptp_rx_filter(ocelot_port->trap_proto);
return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0;
}
diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h
index 967ba30ea6363..195ca8f0b6f9d 100644
--- a/include/soc/mscc/ocelot.h
+++ b/include/soc/mscc/ocelot.h
@@ -902,6 +902,11 @@ enum macaccess_entry_type {
ENTRYTYPE_MACv6,
};
+enum ocelot_proto {
+ OCELOT_PROTO_PTP_L2 = BIT(0),
+ OCELOT_PROTO_PTP_L4 = BIT(1),
+};
+
#define OCELOT_QUIRK_PCS_PERFORMS_RATE_ADAPTATION BIT(0)
#define OCELOT_QUIRK_QSGMII_PORTS_MUST_BE_UP BIT(1)
@@ -939,6 +944,8 @@ struct ocelot_port {
unsigned int ptp_skbs_in_flight;
struct sk_buff_head tx_skbs;
+ unsigned int trap_proto;
+
u16 mrp_ring_id;
u8 ptp_cmd;
@@ -1032,12 +1039,9 @@ struct ocelot {
u8 ptp:1;
struct ptp_clock *ptp_clock;
struct ptp_clock_info ptp_info;
- struct hwtstamp_config hwtstamp_config;
unsigned int ptp_skbs_in_flight;
/* Protects the 2-step TX timestamp ID logic */
spinlock_t ts_id_lock;
- /* Protects the PTP interface state */
- struct mutex ptp_lock;
/* Protects the PTP clock */
spinlock_t ptp_clock_lock;
struct ptp_pin_desc ptp_pins[OCELOT_PTP_PINS_NUM];
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 477/591] net: dsa: felix: dont drop PTP frames with tag_8021q when RX timestamping is disabled
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 476/591] net: mscc: ocelot: dont keep PTP configuration of all ports in single structure Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 478/591] net: dsa: sja1105: always enable the INCL_SRCPT option Greg Kroah-Hartman
` (117 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Paolo Abeni,
Sasha Levin
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 2edcfcbb3c5946609be1d8875473a240b170673b ]
The driver implements a workaround for the fact that it doesn't have an
IRQ source to tell it whether PTP frames are available through the
extraction registers, for those frames to be processed and passed
towards the network stack. That workaround is to configure the switch,
through felix_hwtstamp_set() -> felix_update_trapping_destinations(),
to create two copies of PTP packets: one sent over Ethernet to the DSA
master, and one to be consumed through the aforementioned CPU extraction
queue registers.
The reason why we want PTP packets to be consumed through the CPU
extraction registers in the first place is because we want to see their
hardware RX timestamp. With tag_8021q, that is only visible that way,
and it isn't visible with the copy of the packet that's transmitted over
Ethernet.
The problem with the workaround implementation is that it drops the
packet received over Ethernet, in expectation of its copy being present
in the CPU extraction registers. However, if felix_hwtstamp_set() hasn't
run (aka PTP RX timestamping is disabled), the driver will drop the
original PTP frame and there will be no copy of it in the CPU extraction
registers. So, the network stack will simply not see any PTP frame.
Look at the port's trapping configuration to see whether the driver has
previously enabled the CPU extraction registers. If it hasn't, just
don't RX timestamp the frame and let it be passed up the stack by DSA,
which is perfectly fine.
Fixes: 0a6f17c6ae21 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/ocelot/felix.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
index dd3a18cc89dd2..4faabc4364aa7 100644
--- a/drivers/net/dsa/ocelot/felix.c
+++ b/drivers/net/dsa/ocelot/felix.c
@@ -1705,6 +1705,18 @@ static bool felix_rxtstamp(struct dsa_switch *ds, int port,
u32 tstamp_hi;
u64 tstamp;
+ switch (type & PTP_CLASS_PMASK) {
+ case PTP_CLASS_L2:
+ if (!(ocelot->ports[port]->trap_proto & OCELOT_PROTO_PTP_L2))
+ return false;
+ break;
+ case PTP_CLASS_IPV4:
+ case PTP_CLASS_IPV6:
+ if (!(ocelot->ports[port]->trap_proto & OCELOT_PROTO_PTP_L4))
+ return false;
+ break;
+ }
+
/* If the "no XTR IRQ" workaround is in use, tell DSA to defer this skb
* for RX timestamping. Then free it, and poll for its copy through
* MMIO in the CPU port module, and inject that into the stack from
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 478/591] net: dsa: sja1105: always enable the INCL_SRCPT option
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 477/591] net: dsa: felix: dont drop PTP frames with tag_8021q when RX timestamping is disabled Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 479/591] net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT Greg Kroah-Hartman
` (116 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Simon Horman,
Paolo Abeni, Sasha Levin
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit b4638af8885af93cd70351081da1909c59342440 ]
Link-local traffic on bridged SJA1105 ports is sometimes tagged by the
hardware with source port information (when the port is under a VLAN
aware bridge).
The tag_8021q source port identification has become more loose
("imprecise") and will report a plausible rather than exact bridge port,
when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local
traffic always needs to know the precise source port.
Modify the driver logic (and therefore: the tagging protocol itself) to
always include the source port information with link-local packets,
regardless of whether the port is standalone, under a VLAN-aware or
VLAN-unaware bridge. This makes it possible for the tagging driver to
give priority to that information over the tag_8021q VLAN header.
The big drawback with INCL_SRCPT is that it makes it impossible to
distinguish between an original MAC DA of 01:80:C2:XX:YY:ZZ and
01:80:C2:AA:BB:ZZ, because the tagger just patches MAC DA bytes 3 and 4
with zeroes. Only if PTP RX timestamping is enabled, the switch will
generate a META follow-up frame containing the RX timestamp and the
original bytes 3 and 4 of the MAC DA. Those will be used to patch up the
original packet. Nonetheless, in the absence of PTP RX timestamping, we
have to live with this limitation, since it is more important to have
the more precise source port information for link-local traffic.
Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID")
Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/sja1105/sja1105_main.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
index b70dcf32a26dc..8bd61f2ebb2ad 100644
--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -866,11 +866,11 @@ static int sja1105_init_general_params(struct sja1105_private *priv)
.hostprio = 7,
.mac_fltres1 = SJA1105_LINKLOCAL_FILTER_A,
.mac_flt1 = SJA1105_LINKLOCAL_FILTER_A_MASK,
- .incl_srcpt1 = false,
+ .incl_srcpt1 = true,
.send_meta1 = false,
.mac_fltres0 = SJA1105_LINKLOCAL_FILTER_B,
.mac_flt0 = SJA1105_LINKLOCAL_FILTER_B_MASK,
- .incl_srcpt0 = false,
+ .incl_srcpt0 = true,
.send_meta0 = false,
/* Default to an invalid value */
.mirr_port = priv->ds->num_ports,
@@ -2407,11 +2407,6 @@ int sja1105_vlan_filtering(struct dsa_switch *ds, int port, bool enabled,
general_params->tpid = tpid;
/* EtherType used to identify outer tagged (S-tag) VLAN traffic */
general_params->tpid2 = tpid2;
- /* When VLAN filtering is on, we need to at least be able to
- * decode management traffic through the "backup plan".
- */
- general_params->incl_srcpt1 = enabled;
- general_params->incl_srcpt0 = enabled;
for (port = 0; port < ds->num_ports; port++) {
if (dsa_is_unused_port(ds, port))
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 479/591] net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 478/591] net: dsa: sja1105: always enable the INCL_SRCPT option Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 480/591] Add MODULE_FIRMWARE() for FIRMWARE_TG357766 Greg Kroah-Hartman
` (115 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Simon Horman,
Paolo Abeni, Sasha Levin
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit c1ae02d876898b1b8ca1e12c6f84d7b406263800 ]
Currently the sja1105 tagging protocol prefers using the source port
information from the VLAN header if that is available, falling back to
the INCL_SRCPT option if it isn't. The VLAN header is available for all
frames except for META frames initiated by the switch (containing RX
timestamps), and thus, the "if (is_link_local)" branch is practically
dead.
The tag_8021q source port identification has become more loose
("imprecise") and will report a plausible rather than exact bridge port,
when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local
traffic always needs to know the precise source port. With incorrect
source port reporting, for example PTP traffic over 2 bridged ports will
all be seen on sockets opened on the first such port, which is incorrect.
Now that the tagging protocol has been changed to make link-local frames
always contain source port information, we can reverse the order of the
checks so that we always give precedence to that information (which is
always precise) in lieu of the tag_8021q VID which is only precise for a
standalone port.
Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID")
Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/dsa/tag_sja1105.c | 38 +++++++++++++++++++++++++++++---------
1 file changed, 29 insertions(+), 9 deletions(-)
diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
index 1a85125bda6da..731dc3a111ef3 100644
--- a/net/dsa/tag_sja1105.c
+++ b/net/dsa/tag_sja1105.c
@@ -540,10 +540,7 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
is_link_local = sja1105_is_link_local(skb);
is_meta = sja1105_is_meta_frame(skb);
- if (sja1105_skb_has_tag_8021q(skb)) {
- /* Normal traffic path. */
- sja1105_vlan_rcv(skb, &source_port, &switch_id, &vbid, &vid);
- } else if (is_link_local) {
+ if (is_link_local) {
/* Management traffic path. Switch embeds the switch ID and
* port ID into bytes of the destination MAC, courtesy of
* the incl_srcpt options.
@@ -557,16 +554,39 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
sja1105_meta_unpack(skb, &meta);
source_port = meta.source_port;
switch_id = meta.switch_id;
- } else {
+ }
+
+ /* Normal data plane traffic and link-local frames are tagged with
+ * a tag_8021q VLAN which we have to strip
+ */
+ if (sja1105_skb_has_tag_8021q(skb)) {
+ int tmp_source_port = -1, tmp_switch_id = -1;
+
+ sja1105_vlan_rcv(skb, &tmp_source_port, &tmp_switch_id, &vbid,
+ &vid);
+ /* Preserve the source information from the INCL_SRCPT option,
+ * if available. This allows us to not overwrite a valid source
+ * port and switch ID with zeroes when receiving link-local
+ * frames from a VLAN-unaware bridged port (non-zero vbid) or a
+ * VLAN-aware bridged port (non-zero vid).
+ */
+ if (source_port == -1)
+ source_port = tmp_source_port;
+ if (switch_id == -1)
+ switch_id = tmp_switch_id;
+ } else if (source_port == -1 && switch_id == -1) {
+ /* Packets with no source information have no chance of
+ * getting accepted, drop them straight away.
+ */
return NULL;
}
- if (vbid >= 1)
+ if (source_port != -1 && switch_id != -1)
+ skb->dev = dsa_master_find_slave(netdev, switch_id, source_port);
+ else if (vbid >= 1)
skb->dev = dsa_tag_8021q_find_port_by_vbid(netdev, vbid);
- else if (source_port == -1 || switch_id == -1)
- skb->dev = dsa_find_designated_bridge_port_by_vid(netdev, vid);
else
- skb->dev = dsa_master_find_slave(netdev, switch_id, source_port);
+ skb->dev = dsa_find_designated_bridge_port_by_vid(netdev, vid);
if (!skb->dev) {
netdev_warn(netdev, "Couldn't decode source port\n");
return NULL;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 480/591] Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 479/591] net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 481/591] Bluetooth: fix invalid-bdaddr quirk for non-persistent setup Greg Kroah-Hartman
` (114 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tobias Heider, Michael Chan,
Jakub Kicinski, Sasha Levin
From: Tobias Heider <me@tobhe.de>
[ Upstream commit 046f753da6143ee16452966915087ec8b0de3c70 ]
Fixes a bug where on the M1 mac mini initramfs-tools fails to
include the necessary firmware into the initrd.
Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware")
Signed-off-by: Tobias Heider <me@tobhe.de>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/tg3.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index af9ea5e4371b3..9609041016776 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -224,6 +224,7 @@ MODULE_AUTHOR("David S. Miller (davem@redhat.com) and Jeff Garzik (jgarzik@pobox
MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver");
MODULE_LICENSE("GPL");
MODULE_FIRMWARE(FIRMWARE_TG3);
+MODULE_FIRMWARE(FIRMWARE_TG357766);
MODULE_FIRMWARE(FIRMWARE_TG3TSO);
MODULE_FIRMWARE(FIRMWARE_TG3TSO5);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 481/591] Bluetooth: fix invalid-bdaddr quirk for non-persistent setup
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 480/591] Add MODULE_FIRMWARE() for FIRMWARE_TG357766 Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 482/591] Bluetooth: ISO: use hci_sync for setting CIG parameters Greg Kroah-Hartman
` (113 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Luiz Augusto von Dentz,
Jakub Kicinski, Sasha Levin
From: Johan Hovold <johan+linaro@kernel.org>
[ Upstream commit 0cb7365850bacb8c2a9975cae672d65714d8daa1 ]
Devices that lack persistent storage for the device address can indicate
this by setting the HCI_QUIRK_INVALID_BDADDR which causes the controller
to be marked as unconfigured until user space has set a valid address.
Once configured, the device address must be set on every setup for
controllers with HCI_QUIRK_NON_PERSISTENT_SETUP to avoid marking the
controller as unconfigured and requiring the address to be set again.
Fixes: 740011cfe948 ("Bluetooth: Add new quirk for non-persistent setup settings")
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_sync.c | 28 +++++++++++-----------------
1 file changed, 11 insertions(+), 17 deletions(-)
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 1805ddee0cd02..37131a36700a1 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -4567,23 +4567,17 @@ static int hci_dev_setup_sync(struct hci_dev *hdev)
invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
if (!ret) {
- if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) {
- if (!bacmp(&hdev->public_addr, BDADDR_ANY))
- hci_dev_get_bd_addr_from_property(hdev);
-
- if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
- hdev->set_bdaddr) {
- ret = hdev->set_bdaddr(hdev,
- &hdev->public_addr);
-
- /* If setting of the BD_ADDR from the device
- * property succeeds, then treat the address
- * as valid even if the invalid BD_ADDR
- * quirk indicates otherwise.
- */
- if (!ret)
- invalid_bdaddr = false;
- }
+ if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) &&
+ !bacmp(&hdev->public_addr, BDADDR_ANY))
+ hci_dev_get_bd_addr_from_property(hdev);
+
+ if ((invalid_bdaddr ||
+ test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
+ bacmp(&hdev->public_addr, BDADDR_ANY) &&
+ hdev->set_bdaddr) {
+ ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
+ if (!ret)
+ invalid_bdaddr = false;
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 482/591] Bluetooth: ISO: use hci_sync for setting CIG parameters
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 481/591] Bluetooth: fix invalid-bdaddr quirk for non-persistent setup Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 483/591] Bluetooth: MGMT: add CIS feature bits to controller information Greg Kroah-Hartman
` (112 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pauli Virtanen,
Luiz Augusto von Dentz, Jakub Kicinski, Sasha Levin
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit 6b9545dc9f8ff01d8bc1229103960d9cd265343f ]
When reconfiguring CIG after disconnection of the last CIS, LE Remove
CIG shall be sent before LE Set CIG Parameters. Otherwise, it fails
because CIG is in the inactive state and not configurable (Core v5.3
Vol 6 Part B Sec. 4.5.14.3). This ordering is currently wrong under
suitable timing conditions, because LE Remove CIG is sent via the
hci_sync queue and may be delayed, but Set CIG Parameters is via
hci_send_cmd.
Make the ordering well-defined by sending also Set CIG Parameters via
hci_sync.
Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_conn.c | 47 +++++++++++++++++++++++++++++++++-------
1 file changed, 39 insertions(+), 8 deletions(-)
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index ab9f00252dc2a..fef09d2121384 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -770,6 +770,11 @@ static void le_conn_timeout(struct work_struct *work)
hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
}
+struct iso_cig_params {
+ struct hci_cp_le_set_cig_params cp;
+ struct hci_cis_params cis[0x1f];
+};
+
struct iso_list_data {
union {
u8 cig;
@@ -781,10 +786,7 @@ struct iso_list_data {
u16 sync_handle;
};
int count;
- struct {
- struct hci_cp_le_set_cig_params cp;
- struct hci_cis_params cis[0x11];
- } pdu;
+ struct iso_cig_params pdu;
};
static void bis_list(struct hci_conn *conn, void *data)
@@ -1705,10 +1707,33 @@ static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp);
}
+static void set_cig_params_complete(struct hci_dev *hdev, void *data, int err)
+{
+ struct iso_cig_params *pdu = data;
+
+ bt_dev_dbg(hdev, "");
+
+ if (err)
+ bt_dev_err(hdev, "Unable to set CIG parameters: %d", err);
+
+ kfree(pdu);
+}
+
+static int set_cig_params_sync(struct hci_dev *hdev, void *data)
+{
+ struct iso_cig_params *pdu = data;
+ u32 plen;
+
+ plen = sizeof(pdu->cp) + pdu->cp.num_cis * sizeof(pdu->cis[0]);
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS, plen, pdu,
+ HCI_CMD_TIMEOUT);
+}
+
static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
{
struct hci_dev *hdev = conn->hdev;
struct iso_list_data data;
+ struct iso_cig_params *pdu;
memset(&data, 0, sizeof(data));
@@ -1779,12 +1804,18 @@ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
if (qos->cis == BT_ISO_QOS_CIS_UNSET || !data.pdu.cp.num_cis)
return false;
- if (hci_send_cmd(hdev, HCI_OP_LE_SET_CIG_PARAMS,
- sizeof(data.pdu.cp) +
- (data.pdu.cp.num_cis * sizeof(*data.pdu.cis)),
- &data.pdu) < 0)
+ pdu = kzalloc(sizeof(*pdu), GFP_KERNEL);
+ if (!pdu)
return false;
+ memcpy(pdu, &data.pdu, sizeof(*pdu));
+
+ if (hci_cmd_sync_queue(hdev, set_cig_params_sync, pdu,
+ set_cig_params_complete) < 0) {
+ kfree(pdu);
+ return false;
+ }
+
return true;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 483/591] Bluetooth: MGMT: add CIS feature bits to controller information
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 482/591] Bluetooth: ISO: use hci_sync for setting CIG parameters Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 484/591] Bluetooth: MGMT: Use BIT macro when defining bitfields Greg Kroah-Hartman
` (111 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit 2394186a2cefb9a45a029281a55749804dd8c556 ]
Userspace needs to know whether the adapter has feature support for
Connected Isochronous Stream - Central/Peripheral, so it can set up
LE Audio features accordingly.
Expose these feature bits as settings in MGMT controller info.
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 73f55453ea52 ("Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/mgmt.h | 2 ++
net/bluetooth/mgmt.c | 12 ++++++++++++
2 files changed, 14 insertions(+)
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 743f6f59dff81..e18a927669c0a 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -109,6 +109,8 @@ struct mgmt_rp_read_index_list {
#define MGMT_SETTING_STATIC_ADDRESS 0x00008000
#define MGMT_SETTING_PHY_CONFIGURATION 0x00010000
#define MGMT_SETTING_WIDEBAND_SPEECH 0x00020000
+#define MGMT_SETTING_CIS_CENTRAL 0x00040000
+#define MGMT_SETTING_CIS_PERIPHERAL 0x00080000
#define MGMT_OP_READ_INFO 0x0004
#define MGMT_READ_INFO_SIZE 0
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index fc4ba0884da96..815f2abe918ef 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -859,6 +859,12 @@ static u32 get_supported_settings(struct hci_dev *hdev)
hdev->set_bdaddr)
settings |= MGMT_SETTING_CONFIGURATION;
+ if (cis_central_capable(hdev))
+ settings |= MGMT_SETTING_CIS_CENTRAL;
+
+ if (cis_peripheral_capable(hdev))
+ settings |= MGMT_SETTING_CIS_PERIPHERAL;
+
settings |= MGMT_SETTING_PHY_CONFIGURATION;
return settings;
@@ -932,6 +938,12 @@ static u32 get_current_settings(struct hci_dev *hdev)
if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
settings |= MGMT_SETTING_WIDEBAND_SPEECH;
+ if (cis_central_capable(hdev))
+ settings |= MGMT_SETTING_CIS_CENTRAL;
+
+ if (cis_peripheral_capable(hdev))
+ settings |= MGMT_SETTING_CIS_PERIPHERAL;
+
return settings;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 484/591] Bluetooth: MGMT: Use BIT macro when defining bitfields
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 483/591] Bluetooth: MGMT: add CIS feature bits to controller information Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 485/591] Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable Greg Kroah-Hartman
` (110 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit a80d2c545ded86d0350b9a870735565d8b749786 ]
This makes use of BIT macro when defining bitfields which makes it
clearer what bit it is toggling.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 73f55453ea52 ("Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/mgmt.h | 80 ++++++++++++++++++------------------
1 file changed, 40 insertions(+), 40 deletions(-)
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index e18a927669c0a..a5801649f6196 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -91,26 +91,26 @@ struct mgmt_rp_read_index_list {
#define MGMT_MAX_NAME_LENGTH (HCI_MAX_NAME_LENGTH + 1)
#define MGMT_MAX_SHORT_NAME_LENGTH (HCI_MAX_SHORT_NAME_LENGTH + 1)
-#define MGMT_SETTING_POWERED 0x00000001
-#define MGMT_SETTING_CONNECTABLE 0x00000002
-#define MGMT_SETTING_FAST_CONNECTABLE 0x00000004
-#define MGMT_SETTING_DISCOVERABLE 0x00000008
-#define MGMT_SETTING_BONDABLE 0x00000010
-#define MGMT_SETTING_LINK_SECURITY 0x00000020
-#define MGMT_SETTING_SSP 0x00000040
-#define MGMT_SETTING_BREDR 0x00000080
-#define MGMT_SETTING_HS 0x00000100
-#define MGMT_SETTING_LE 0x00000200
-#define MGMT_SETTING_ADVERTISING 0x00000400
-#define MGMT_SETTING_SECURE_CONN 0x00000800
-#define MGMT_SETTING_DEBUG_KEYS 0x00001000
-#define MGMT_SETTING_PRIVACY 0x00002000
-#define MGMT_SETTING_CONFIGURATION 0x00004000
-#define MGMT_SETTING_STATIC_ADDRESS 0x00008000
-#define MGMT_SETTING_PHY_CONFIGURATION 0x00010000
-#define MGMT_SETTING_WIDEBAND_SPEECH 0x00020000
-#define MGMT_SETTING_CIS_CENTRAL 0x00040000
-#define MGMT_SETTING_CIS_PERIPHERAL 0x00080000
+#define MGMT_SETTING_POWERED BIT(0)
+#define MGMT_SETTING_CONNECTABLE BIT(1)
+#define MGMT_SETTING_FAST_CONNECTABLE BIT(2)
+#define MGMT_SETTING_DISCOVERABLE BIT(3)
+#define MGMT_SETTING_BONDABLE BIT(4)
+#define MGMT_SETTING_LINK_SECURITY BIT(5)
+#define MGMT_SETTING_SSP BIT(6)
+#define MGMT_SETTING_BREDR BIT(7)
+#define MGMT_SETTING_HS BIT(8)
+#define MGMT_SETTING_LE BIT(9)
+#define MGMT_SETTING_ADVERTISING BIT(10)
+#define MGMT_SETTING_SECURE_CONN BIT(11)
+#define MGMT_SETTING_DEBUG_KEYS BIT(12)
+#define MGMT_SETTING_PRIVACY BIT(13)
+#define MGMT_SETTING_CONFIGURATION BIT(14)
+#define MGMT_SETTING_STATIC_ADDRESS BIT(15)
+#define MGMT_SETTING_PHY_CONFIGURATION BIT(16)
+#define MGMT_SETTING_WIDEBAND_SPEECH BIT(17)
+#define MGMT_SETTING_CIS_CENTRAL BIT(18)
+#define MGMT_SETTING_CIS_PERIPHERAL BIT(19)
#define MGMT_OP_READ_INFO 0x0004
#define MGMT_READ_INFO_SIZE 0
@@ -635,21 +635,21 @@ struct mgmt_rp_get_phy_configuration {
} __packed;
#define MGMT_GET_PHY_CONFIGURATION_SIZE 0
-#define MGMT_PHY_BR_1M_1SLOT 0x00000001
-#define MGMT_PHY_BR_1M_3SLOT 0x00000002
-#define MGMT_PHY_BR_1M_5SLOT 0x00000004
-#define MGMT_PHY_EDR_2M_1SLOT 0x00000008
-#define MGMT_PHY_EDR_2M_3SLOT 0x00000010
-#define MGMT_PHY_EDR_2M_5SLOT 0x00000020
-#define MGMT_PHY_EDR_3M_1SLOT 0x00000040
-#define MGMT_PHY_EDR_3M_3SLOT 0x00000080
-#define MGMT_PHY_EDR_3M_5SLOT 0x00000100
-#define MGMT_PHY_LE_1M_TX 0x00000200
-#define MGMT_PHY_LE_1M_RX 0x00000400
-#define MGMT_PHY_LE_2M_TX 0x00000800
-#define MGMT_PHY_LE_2M_RX 0x00001000
-#define MGMT_PHY_LE_CODED_TX 0x00002000
-#define MGMT_PHY_LE_CODED_RX 0x00004000
+#define MGMT_PHY_BR_1M_1SLOT BIT(0)
+#define MGMT_PHY_BR_1M_3SLOT BIT(1)
+#define MGMT_PHY_BR_1M_5SLOT BIT(2)
+#define MGMT_PHY_EDR_2M_1SLOT BIT(3)
+#define MGMT_PHY_EDR_2M_3SLOT BIT(4)
+#define MGMT_PHY_EDR_2M_5SLOT BIT(5)
+#define MGMT_PHY_EDR_3M_1SLOT BIT(6)
+#define MGMT_PHY_EDR_3M_3SLOT BIT(7)
+#define MGMT_PHY_EDR_3M_5SLOT BIT(8)
+#define MGMT_PHY_LE_1M_TX BIT(9)
+#define MGMT_PHY_LE_1M_RX BIT(10)
+#define MGMT_PHY_LE_2M_TX BIT(11)
+#define MGMT_PHY_LE_2M_RX BIT(12)
+#define MGMT_PHY_LE_CODED_TX BIT(13)
+#define MGMT_PHY_LE_CODED_RX BIT(14)
#define MGMT_PHY_BREDR_MASK (MGMT_PHY_BR_1M_1SLOT | MGMT_PHY_BR_1M_3SLOT | \
MGMT_PHY_BR_1M_5SLOT | MGMT_PHY_EDR_2M_1SLOT | \
@@ -974,11 +974,11 @@ struct mgmt_ev_auth_failed {
__u8 status;
} __packed;
-#define MGMT_DEV_FOUND_CONFIRM_NAME 0x01
-#define MGMT_DEV_FOUND_LEGACY_PAIRING 0x02
-#define MGMT_DEV_FOUND_NOT_CONNECTABLE 0x04
-#define MGMT_DEV_FOUND_INITIATED_CONN 0x08
-#define MGMT_DEV_FOUND_NAME_REQUEST_FAILED 0x10
+#define MGMT_DEV_FOUND_CONFIRM_NAME BIT(0)
+#define MGMT_DEV_FOUND_LEGACY_PAIRING BIT(1)
+#define MGMT_DEV_FOUND_NOT_CONNECTABLE BIT(2)
+#define MGMT_DEV_FOUND_INITIATED_CONN BIT(3)
+#define MGMT_DEV_FOUND_NAME_REQUEST_FAILED BIT(4)
#define MGMT_EV_DEVICE_FOUND 0x0012
struct mgmt_ev_device_found {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 485/591] Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 484/591] Bluetooth: MGMT: Use BIT macro when defining bitfields Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 486/591] ibmvnic: Do not reset dql stats on NON_FATAL err Greg Kroah-Hartman
` (109 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz,
Jakub Kicinski, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 73f55453ea5236a586a7f1b3d5e2ee051d655351 ]
When receiving a scan response there is no way to know if the remote
device is connectable or not, so when it cannot be merged don't
make any assumption and instead just mark it with a new flag defined as
MGMT_DEV_FOUND_SCAN_RSP so userspace can tell it is a standalone
SCAN_RSP.
Link: https://lore.kernel.org/linux-bluetooth/CABBYNZ+CYMsDSPTxBn09Js3BcdC-x7vZFfyLJ3ppZGGwJKmUTw@mail.gmail.com/
Fixes: c70a7e4cc8d2 ("Bluetooth: Add support for Not Connectable flag for Device Found events")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/mgmt.h | 1 +
net/bluetooth/hci_event.c | 15 +++++----------
2 files changed, 6 insertions(+), 10 deletions(-)
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index a5801649f6196..5e68b3dd44222 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -979,6 +979,7 @@ struct mgmt_ev_auth_failed {
#define MGMT_DEV_FOUND_NOT_CONNECTABLE BIT(2)
#define MGMT_DEV_FOUND_INITIATED_CONN BIT(3)
#define MGMT_DEV_FOUND_NAME_REQUEST_FAILED BIT(4)
+#define MGMT_DEV_FOUND_SCAN_RSP BIT(5)
#define MGMT_EV_DEVICE_FOUND 0x0012
struct mgmt_ev_device_found {
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 21416ccc30ab2..b272cc1f36481 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6307,23 +6307,18 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
return;
}
- /* When receiving non-connectable or scannable undirected
- * advertising reports, this means that the remote device is
- * not connectable and then clearly indicate this in the
- * device found event.
- *
- * When receiving a scan response, then there is no way to
+ /* When receiving a scan response, then there is no way to
* know if the remote device is connectable or not. However
* since scan responses are merged with a previously seen
* advertising report, the flags field from that report
* will be used.
*
- * In the really unlikely case that a controller get confused
- * and just sends a scan response event, then it is marked as
- * not connectable as well.
+ * In the unlikely case that a controller just sends a scan
+ * response event that doesn't match the pending report, then
+ * it is marked as a standalone SCAN_RSP.
*/
if (type == LE_ADV_SCAN_RSP)
- flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
+ flags = MGMT_DEV_FOUND_SCAN_RSP;
/* If there's nothing pending either store the data from this
* event or send an immediate device found event if the data
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 486/591] ibmvnic: Do not reset dql stats on NON_FATAL err
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 485/591] Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 487/591] net: dsa: vsc73xx: fix MTU configuration Greg Kroah-Hartman
` (108 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nick Child, Jakub Kicinski,
Sasha Levin
From: Nick Child <nnac123@linux.ibm.com>
[ Upstream commit 48538ccb825b05544ec308a509e2cc9c013402db ]
All ibmvnic resets, make a call to netdev_tx_reset_queue() when
re-opening the device. netdev_tx_reset_queue() resets the num_queued
and num_completed byte counters. These stats are used in Byte Queue
Limit (BQL) algorithms. The difference between these two stats tracks
the number of bytes currently sitting on the physical NIC. ibmvnic
increases the number of queued bytes though calls to
netdev_tx_sent_queue() in the drivers xmit function. When, VIOS reports
that it is done transmitting bytes, the ibmvnic device increases the
number of completed bytes through calls to netdev_tx_completed_queue().
It is important to note that the driver batches its transmit calls and
num_queued is increased every time that an skb is added to the next
batch, not necessarily when the batch is sent to VIOS for transmission.
Unlike other reset types, a NON FATAL reset will not flush the sub crq
tx buffers. Therefore, it is possible for the batched skb array to be
partially full. So if there is call to netdev_tx_reset_queue() when
re-opening the device, the value of num_queued (0) would not account
for the skb's that are currently batched. Eventually, when the batch
is sent to VIOS, the call to netdev_tx_completed_queue() would increase
num_completed to a value greater than the num_queued. This causes a
BUG_ON crash:
ibmvnic 30000002: Firmware reports error, cause: adapter problem.
Starting recovery...
ibmvnic 30000002: tx error 600
ibmvnic 30000002: tx error 600
ibmvnic 30000002: tx error 600
ibmvnic 30000002: tx error 600
------------[ cut here ]------------
kernel BUG at lib/dynamic_queue_limits.c:27!
Oops: Exception in kernel mode, sig: 5
[....]
NIP dql_completed+0x28/0x1c0
LR ibmvnic_complete_tx.isra.0+0x23c/0x420 [ibmvnic]
Call Trace:
ibmvnic_complete_tx.isra.0+0x3f8/0x420 [ibmvnic] (unreliable)
ibmvnic_interrupt_tx+0x40/0x70 [ibmvnic]
__handle_irq_event_percpu+0x98/0x270
---[ end trace ]---
Therefore, do not reset the dql stats when performing a NON_FATAL reset.
Fixes: 0d973388185d ("ibmvnic: Introduce xmit_more support using batched subCRQ hcalls")
Signed-off-by: Nick Child <nnac123@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ibm/ibmvnic.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 9282381a438fe..bc97f24b08270 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1625,7 +1625,14 @@ static int __ibmvnic_open(struct net_device *netdev)
if (prev_state == VNIC_CLOSED)
enable_irq(adapter->tx_scrq[i]->irq);
enable_scrq_irq(adapter, adapter->tx_scrq[i]);
- netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i));
+ /* netdev_tx_reset_queue will reset dql stats. During NON_FATAL
+ * resets, don't reset the stats because there could be batched
+ * skb's waiting to be sent. If we reset dql stats, we risk
+ * num_completed being greater than num_queued. This will cause
+ * a BUG_ON in dql_completed().
+ */
+ if (adapter->reset_reason != VNIC_RESET_NON_FATAL)
+ netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i));
}
rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_UP);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 487/591] net: dsa: vsc73xx: fix MTU configuration
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 486/591] ibmvnic: Do not reset dql stats on NON_FATAL err Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 488/591] mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init Greg Kroah-Hartman
` (107 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Pawel Dembicki,
Vladimir Oltean, Jakub Kicinski, Sasha Levin
From: Pawel Dembicki <paweldembicki@gmail.com>
[ Upstream commit 3cf62c8177adb0db9e15c8b898c44f997acf3ebf ]
Switch in MAXLEN register stores the maximum size of a data frame.
The MTU size is 18 bytes smaller than the frame size.
The current settings are causing problems with packet forwarding.
This patch fixes the MTU settings to proper values.
Fixes: fb77ffc6ec86 ("net: dsa: vsc73xx: make the MTU configurable")
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://lore.kernel.org/r/20230628194327.1765644-1-paweldembicki@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/vitesse-vsc73xx-core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c
index ae55167ce0a6f..ef1a4a7c47b23 100644
--- a/drivers/net/dsa/vitesse-vsc73xx-core.c
+++ b/drivers/net/dsa/vitesse-vsc73xx-core.c
@@ -1025,17 +1025,17 @@ static int vsc73xx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
struct vsc73xx *vsc = ds->priv;
return vsc73xx_write(vsc, VSC73XX_BLOCK_MAC, port,
- VSC73XX_MAXLEN, new_mtu);
+ VSC73XX_MAXLEN, new_mtu + ETH_HLEN + ETH_FCS_LEN);
}
/* According to application not "VSC7398 Jumbo Frames" setting
- * up the MTU to 9.6 KB does not affect the performance on standard
+ * up the frame size to 9.6 KB does not affect the performance on standard
* frames. It is clear from the application note that
* "9.6 kilobytes" == 9600 bytes.
*/
static int vsc73xx_get_max_mtu(struct dsa_switch *ds, int port)
{
- return 9600;
+ return 9600 - ETH_HLEN - ETH_FCS_LEN;
}
static const struct dsa_switch_ops vsc73xx_ds_ops = {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 488/591] mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 487/591] net: dsa: vsc73xx: fix MTU configuration Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 489/591] spi: bcm-qspi: return error if neither hif_mspi nor mspi is available Greg Kroah-Hartman
` (106 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhengchao Shao, Petr Machata,
Ido Schimmel, Jakub Kicinski, Sasha Levin
From: Zhengchao Shao <shaozhengchao@huawei.com>
[ Upstream commit 08fc75735fda3be97194bfbf3c899c87abb3d0fe ]
The line cards array is not freed in the error path of
mlxsw_m_linecards_init(), which can lead to a memory leak. Fix by
freeing the array in the error path, thereby making the error path
identical to mlxsw_m_linecards_fini().
Fixes: 01328e23a476 ("mlxsw: minimal: Extend module to port mapping with slot index")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://lore.kernel.org/r/20230630012647.1078002-1-shaozhengchao@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlxsw/minimal.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/minimal.c b/drivers/net/ethernet/mellanox/mlxsw/minimal.c
index 55b3c42bb0071..15116d9305f8e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/minimal.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/minimal.c
@@ -430,6 +430,7 @@ static int mlxsw_m_linecards_init(struct mlxsw_m *mlxsw_m)
err_kmalloc_array:
for (i--; i >= 0; i--)
kfree(mlxsw_m->line_cards[i]);
+ kfree(mlxsw_m->line_cards);
err_kcalloc:
kfree(mlxsw_m->ports);
return err;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 489/591] spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 488/591] mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 490/591] drm/amdgpu: fix number of fence calculations Greg Kroah-Hartman
` (105 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Kamal Dasu, Mark Brown,
Sasha Levin
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 7c1f23ad34fcdace50275a6aa1e1969b41c6233f ]
If neither a "hif_mspi" nor "mspi" resource is present, the driver will
just early exit in probe but still return success. Apart from not doing
anything meaningful, this would then also lead to a null pointer access
on removal, as platform_get_drvdata() would return NULL, which it would
then try to dereference when trying to unregister the spi master.
Fix this by unconditionally calling devm_ioremap_resource(), as it can
handle a NULL res and will then return a viable ERR_PTR() if we get one.
The "return 0;" was previously a "goto qspi_resource_err;" where then
ret was returned, but since ret was still initialized to 0 at this place
this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix
use-after-free on unbind"). The issue was not introduced by this commit,
only made more obvious.
Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Kamal Dasu <kamal.dasu@broadcom.com>
Link: https://lore.kernel.org/r/20230629134306.95823-1-jonas.gorski@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-bcm-qspi.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
index cad2d55dcd3d2..137e7315a3cfd 100644
--- a/drivers/spi/spi-bcm-qspi.c
+++ b/drivers/spi/spi-bcm-qspi.c
@@ -1543,13 +1543,9 @@ int bcm_qspi_probe(struct platform_device *pdev,
res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
"mspi");
- if (res) {
- qspi->base[MSPI] = devm_ioremap_resource(dev, res);
- if (IS_ERR(qspi->base[MSPI]))
- return PTR_ERR(qspi->base[MSPI]);
- } else {
- return 0;
- }
+ qspi->base[MSPI] = devm_ioremap_resource(dev, res);
+ if (IS_ERR(qspi->base[MSPI]))
+ return PTR_ERR(qspi->base[MSPI]);
res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
if (res) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 490/591] drm/amdgpu: fix number of fence calculations
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 489/591] spi: bcm-qspi: return error if neither hif_mspi nor mspi is available Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 491/591] drm/amd: Dont try to enable secure display TA multiple times Greg Kroah-Hartman
` (104 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Alex Deucher,
Sasha Levin
From: Christian König <christian.koenig@amd.com>
[ Upstream commit 570b295248b00c3cf4cf59e397de5cb2361e10c2 ]
Since adding gang submit we need to take the gang size into account
while reserving fences.
Signed-off-by: Christian König <christian.koenig@amd.com>
Fixes: 4624459c84d7 ("drm/amdgpu: add gang submit frontend v6")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 365e3fb6a9e5b..b60b6e6149bf7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -129,9 +129,6 @@ static int amdgpu_cs_p1_user_fence(struct amdgpu_cs_parser *p,
bo = amdgpu_bo_ref(gem_to_amdgpu_bo(gobj));
p->uf_entry.priority = 0;
p->uf_entry.tv.bo = &bo->tbo;
- /* One for TTM and two for the CS job */
- p->uf_entry.tv.num_shared = 3;
-
drm_gem_object_put(gobj);
size = amdgpu_bo_size(bo);
@@ -883,15 +880,19 @@ static int amdgpu_cs_parser_bos(struct amdgpu_cs_parser *p,
mutex_lock(&p->bo_list->bo_list_mutex);
- /* One for TTM and one for the CS job */
+ /* One for TTM and one for each CS job */
amdgpu_bo_list_for_each_entry(e, p->bo_list)
- e->tv.num_shared = 2;
+ e->tv.num_shared = 1 + p->gang_size;
+ p->uf_entry.tv.num_shared = 1 + p->gang_size;
amdgpu_bo_list_get_list(p->bo_list, &p->validated);
INIT_LIST_HEAD(&duplicates);
amdgpu_vm_get_pd_bo(&fpriv->vm, &p->validated, &p->vm_pd);
+ /* Two for VM updates, one for TTM and one for each CS job */
+ p->vm_pd.tv.num_shared = 3 + p->gang_size;
+
if (p->uf_entry.tv.bo && !ttm_to_amdgpu_bo(p->uf_entry.tv.bo)->parent)
list_add(&p->uf_entry.tv.head, &p->validated);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 491/591] drm/amd: Dont try to enable secure display TA multiple times
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 490/591] drm/amdgpu: fix number of fence calculations Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 492/591] mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 Greg Kroah-Hartman
` (103 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filip Hejsek, Mario Limonciello,
Alex Deucher, Sasha Levin
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit 5c6d52ff4b61e5267b25be714eb5a9ba2a338199 ]
If the securedisplay TA failed to load the first time, it's unlikely
to work again after a suspend/resume cycle or reset cycle and it appears
to be causing problems in futher attempts.
Fixes: e42dfa66d592 ("drm/amdgpu: Add secure display TA load for Renoir")
Reported-by: Filip Hejsek <filip.hejsek@gmail.com>
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2633
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
index a3cd816f98a14..0af9fb4098e8a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -1959,6 +1959,8 @@ static int psp_securedisplay_initialize(struct psp_context *psp)
psp_securedisplay_parse_resp_status(psp, securedisplay_cmd->status);
dev_err(psp->adev->dev, "SECUREDISPLAY: query securedisplay TA failed. ret 0x%x\n",
securedisplay_cmd->securedisplay_out_message.query_ta.query_cmd_ret);
+ /* don't try again */
+ psp->securedisplay_context.context.bin_desc.size_bytes = 0;
}
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 492/591] mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 491/591] drm/amd: Dont try to enable secure display TA multiple times Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 493/591] f2fs: fix error path handling in truncate_dnode() Greg Kroah-Hartman
` (102 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nishanth Menon, Jassi Brar,
Sasha Levin
From: Nishanth Menon <nm@ti.com>
[ Upstream commit 1b712f18c461bd75f018033a15cf381e712806b5 ]
Sec proxy/message manager data buffer is 60 bytes with the last of the
registers indicating transmission completion. This however poses a bit
of a challenge.
The backing memory for sec_proxy / message manager is regular memory,
and all sec proxy does is to trigger a burst of all 60 bytes of data
over to the target thread backing ring accelerator. It doesn't do a
memory scrub when it moves data out in the burst. When we transmit
multiple messages, remnants of previous message is also transmitted
which results in some random data being set in TISCI fields of
messages that have been expanded forward.
The entire concept of backward compatibility hinges on the fact that
the unused message fields remain 0x0 allowing for 0x0 value to be
specially considered when backward compatibility of message extension
is done.
So, instead of just writing the completion register, we continue
to fill the message buffer up with 0x0 (note: for partial message
involving completion, we already do this).
This allows us to scale and introduce ABI changes back also work with
other boot stages that may have left data in the internal memory.
While at this, be consistent and explicit with the data_reg pointer
increment.
Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver")
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/ti-msgmgr.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c
index ddac423ac1a91..03048cbda525e 100644
--- a/drivers/mailbox/ti-msgmgr.c
+++ b/drivers/mailbox/ti-msgmgr.c
@@ -430,14 +430,20 @@ static int ti_msgmgr_send_data(struct mbox_chan *chan, void *data)
/* Ensure all unused data is 0 */
data_trail &= 0xFFFFFFFF >> (8 * (sizeof(u32) - trail_bytes));
writel(data_trail, data_reg);
- data_reg++;
+ data_reg += sizeof(u32);
}
+
/*
* 'data_reg' indicates next register to write. If we did not already
* write on tx complete reg(last reg), we must do so for transmit
+ * In addition, we also need to make sure all intermediate data
+ * registers(if any required), are reset to 0 for TISCI backward
+ * compatibility to be maintained.
*/
- if (data_reg <= qinst->queue_buff_end)
- writel(0, qinst->queue_buff_end);
+ while (data_reg <= qinst->queue_buff_end) {
+ writel(0, data_reg);
+ data_reg += sizeof(u32);
+ }
/* If we are in polled mode, wait for a response before proceeding */
if (ti_msgmgr_chan_has_polled_queue_rx(message->chan_rx))
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 493/591] f2fs: fix error path handling in truncate_dnode()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 492/591] mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 494/591] octeontx2-af: Fix mapping for NIX block from CGX connection Greg Kroah-Hartman
` (101 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
From: Chao Yu <chao@kernel.org>
[ Upstream commit 0135c482fa97e2fd8245cb462784112a00ed1211 ]
If truncate_node() fails in truncate_dnode(), it missed to call
f2fs_put_page(), fix it.
Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/node.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 07419c3e42a52..a010b4bc36d2c 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -941,8 +941,10 @@ static int truncate_dnode(struct dnode_of_data *dn)
dn->ofs_in_node = 0;
f2fs_truncate_data_blocks(dn);
err = truncate_node(dn);
- if (err)
+ if (err) {
+ f2fs_put_page(page, 1);
return err;
+ }
return 1;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 494/591] octeontx2-af: Fix mapping for NIX block from CGX connection
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 493/591] f2fs: fix error path handling in truncate_dnode() Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 495/591] octeontx2-af: Add validation before accessing cgx and lmac Greg Kroah-Hartman
` (100 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hariprasad Kelam, Sunil Goutham,
Simon Horman, David S. Miller, Sasha Levin
From: Hariprasad Kelam <hkelam@marvell.com>
[ Upstream commit 2e7bc57b976bb016c6569a54d95c1b8d88f9450a ]
Firmware configures NIX block mapping for all MAC blocks.
The current implementation reads the configuration and
creates the mapping between RVU PF and NIX blocks. But
this configuration is only valid for silicons that support
multiple blocks. For all other silicons, all MAC blocks
map to NIX0.
This patch corrects the mapping by adding a check for the same.
Fixes: c5a73b632b90 ("octeontx2-af: Map NIX block from CGX connection")
Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 11 +++++++++++
drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +-
2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
index d493b533cf76e..a3346ea7876c5 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
@@ -23,6 +23,7 @@
#define PCI_DEVID_OCTEONTX2_LBK 0xA061
/* Subsystem Device ID */
+#define PCI_SUBSYS_DEVID_98XX 0xB100
#define PCI_SUBSYS_DEVID_96XX 0xB200
#define PCI_SUBSYS_DEVID_CN10K_A 0xB900
#define PCI_SUBSYS_DEVID_CNF10K_B 0xBC00
@@ -646,6 +647,16 @@ static inline u16 rvu_nix_chan_cpt(struct rvu *rvu, u8 chan)
return rvu->hw->cpt_chan_base + chan;
}
+static inline bool is_rvu_supports_nix1(struct rvu *rvu)
+{
+ struct pci_dev *pdev = rvu->pdev;
+
+ if (pdev->subsystem_device == PCI_SUBSYS_DEVID_98XX)
+ return true;
+
+ return false;
+}
+
/* Function Prototypes
* RVU
*/
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
index 9eca38547b783..e284a14ca1203 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
@@ -112,7 +112,7 @@ static void rvu_map_cgx_nix_block(struct rvu *rvu, int pf,
p2x = cgx_lmac_get_p2x(cgx_id, lmac_id);
/* Firmware sets P2X_SELECT as either NIX0 or NIX1 */
pfvf->nix_blkaddr = BLKADDR_NIX0;
- if (p2x == CMR_P2X_SEL_NIX1)
+ if (is_rvu_supports_nix1(rvu) && p2x == CMR_P2X_SEL_NIX1)
pfvf->nix_blkaddr = BLKADDR_NIX1;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 495/591] octeontx2-af: Add validation before accessing cgx and lmac
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 494/591] octeontx2-af: Fix mapping for NIX block from CGX connection Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 496/591] ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() Greg Kroah-Hartman
` (99 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hariprasad Kelam, Sunil Goutham,
Simon Horman, David S. Miller, Sasha Levin
From: Hariprasad Kelam <hkelam@marvell.com>
[ Upstream commit 79ebb53772c95d3a6ae51b3c65f9985fdd430df6 ]
with the addition of new MAC blocks like CN10K RPM and CN10KB
RPM_USX, LMACs are noncontiguous and CGX blocks are also
noncontiguous. But during RVU driver initialization, the driver
is assuming they are contiguous and trying to access
cgx or lmac with their id which is resulting in kernel panic.
This patch fixes the issue by adding proper checks.
[ 23.219150] pc : cgx_lmac_read+0x38/0x70
[ 23.219154] lr : rvu_program_channels+0x3f0/0x498
[ 23.223852] sp : ffff000100d6fc80
[ 23.227158] x29: ffff000100d6fc80 x28: ffff00010009f880 x27:
000000000000005a
[ 23.234288] x26: ffff000102586768 x25: 0000000000002500 x24:
fffffffffff0f000
Fixes: 91c6945ea1f9 ("octeontx2-af: cn10k: Add RPM MAC support")
Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
index afdddfced7e69..65c0373d34d12 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
@@ -167,6 +167,9 @@ void cgx_lmac_write(int cgx_id, int lmac_id, u64 offset, u64 val)
{
struct cgx *cgx_dev = cgx_get_pdata(cgx_id);
+ /* Software must not access disabled LMAC registers */
+ if (!is_lmac_valid(cgx_dev, lmac_id))
+ return;
cgx_write(cgx_dev, lmac_id, offset, val);
}
@@ -174,6 +177,10 @@ u64 cgx_lmac_read(int cgx_id, int lmac_id, u64 offset)
{
struct cgx *cgx_dev = cgx_get_pdata(cgx_id);
+ /* Software must not access disabled LMAC registers */
+ if (!is_lmac_valid(cgx_dev, lmac_id))
+ return 0;
+
return cgx_read(cgx_dev, lmac_id, offset);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 496/591] ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 495/591] octeontx2-af: Add validation before accessing cgx and lmac Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 497/591] powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y Greg Kroah-Hartman
` (98 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+9fcea5ef6dc4dc72d334,
Zeng Heng, Konstantin Komarov, Sasha Levin
From: Zeng Heng <zengheng4@huawei.com>
[ Upstream commit 3c675ddffb17a8b1e32efad5c983254af18b12c2 ]
Here is a BUG report from syzbot:
BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline]
BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710
Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632
Call Trace:
ntfs_list_ea fs/ntfs3/xattr.c:191 [inline]
ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710
vfs_listxattr fs/xattr.c:457 [inline]
listxattr+0x293/0x2d0 fs/xattr.c:804
Fix the logic of ea_all iteration. When the ea->name_len is 0,
return immediately, or Add2Ptr() would visit invalid memory
in the next loop.
Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations")
Reported-by: syzbot+9fcea5ef6dc4dc72d334@syzkaller.appspotmail.com
Signed-off-by: Zeng Heng <zengheng4@huawei.com>
[almaz.alexandrovich@paragon-software.com: lines of the patch have changed]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/xattr.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
index ea582b4fe1d9d..88866bcd1a218 100644
--- a/fs/ntfs3/xattr.c
+++ b/fs/ntfs3/xattr.c
@@ -178,6 +178,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer,
for (ret = 0, off = 0; off < size; off += unpacked_ea_size(ea)) {
ea = Add2Ptr(ea_all, off);
+ if (!ea->name_len)
+ break;
+
if (buffer) {
if (ret + ea->name_len + 1 > bytes_per_buffer) {
err = -ERANGE;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 497/591] powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 496/591] ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 498/591] powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node Greg Kroah-Hartman
` (97 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Pali Rohár,
Christophe Leroy, Michael Ellerman, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 39f49684036d24af800ff194c33c7b2653c591d7 ]
In a randconfig with CONFIG_SERIAL_CPM=m and
CONFIG_PPC_EARLY_DEBUG_CPM=y, there is a build error:
ERROR: modpost: "udbg_putc" [drivers/tty/serial/cpm_uart/cpm_uart.ko] undefined!
Prevent the build error by allowing PPC_EARLY_DEBUG_CPM only when
SERIAL_CPM=y.
Fixes: c374e00e17f1 ("[POWERPC] Add early debug console for CPM serial ports.")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230701054714.30512-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/Kconfig.debug | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
index 6aaf8dc60610d..2a54fadbeaf51 100644
--- a/arch/powerpc/Kconfig.debug
+++ b/arch/powerpc/Kconfig.debug
@@ -240,7 +240,7 @@ config PPC_EARLY_DEBUG_40x
config PPC_EARLY_DEBUG_CPM
bool "Early serial debugging for Freescale CPM-based serial ports"
- depends on SERIAL_CPM
+ depends on SERIAL_CPM=y
help
Select this to enable early debugging for Freescale chips
using a CPM-based serial port. This assumes that the bootwrapper
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 498/591] powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 497/591] powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 499/591] net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode Greg Kroah-Hartman
` (96 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pali Rohár, Michael Ellerman,
Sasha Levin
From: Pali Rohár <pali@kernel.org>
[ Upstream commit abaa02fc944f2f9f2c2e1925ddaceaf35c48528c ]
Freescale PCIe controllers on their PCIe Root Ports do not have any
mappable PCI BAR allocate from PCIe MEM.
Information about 1MB window on BAR0 of PCIe Root Port was misleading
because Freescale PCIe controllers have at BAR0 position different register
PEXCSRBAR, and kernel correctly skipts BAR0 for these Freescale PCIe Root
Ports.
So update comment about P2020 PCIe Root Port and decrease PCIe MEM size
required for PCIe controller (pci2 node) on which is on-board xHCI
controller.
lspci confirms that on P2020 PCIe Root Port is no PCI BAR and /proc/iomem
sees that only c0000000-c000ffff and c0010000-c0011fff ranges are used.
Fixes: 54c15ec3b738 ("powerpc: dts: Add DTS file for CZ.NIC Turris 1.x routers")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230505172818.18416-1-pali@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/boot/dts/turris1x.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/boot/dts/turris1x.dts b/arch/powerpc/boot/dts/turris1x.dts
index e9cda34a140e0..9377055d5565c 100644
--- a/arch/powerpc/boot/dts/turris1x.dts
+++ b/arch/powerpc/boot/dts/turris1x.dts
@@ -453,12 +453,12 @@ pci2: pcie@ffe08000 {
* channel 1 (but only USB 2.0 subset) to USB 2.0 pins on mPCIe
* slot 1 (CN5), channels 2 and 3 to connector P600.
*
- * P2020 PCIe Root Port uses 1MB of PCIe MEM and xHCI controller
+ * P2020 PCIe Root Port does not use PCIe MEM and xHCI controller
* uses 64kB + 8kB of PCIe MEM. No PCIe IO is used or required.
- * So allocate 2MB of PCIe MEM for this PCIe bus.
+ * So allocate 128kB of PCIe MEM for this PCIe bus.
*/
reg = <0 0xffe08000 0 0x1000>;
- ranges = <0x02000000 0x0 0xc0000000 0 0xc0000000 0x0 0x00200000>, /* MEM */
+ ranges = <0x02000000 0x0 0xc0000000 0 0xc0000000 0x0 0x00020000>, /* MEM */
<0x01000000 0x0 0x00000000 0 0xffc20000 0x0 0x00010000>; /* IO */
pcie@0 {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 499/591] net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 498/591] powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 500/591] net: dsa: tag_sja1105: fix source port decoding in vlan_filtering=0 bridge mode Greg Kroah-Hartman
` (95 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Ido Schimmel,
David S. Miller, Sasha Levin
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 6ca3c005d0604e8d2b439366e3923ea58db99641 ]
According to the synchronization rules for .ndo_get_stats() as seen in
Documentation/networking/netdevices.rst, acquiring a plain spin_lock()
should not be illegal, but the bridge driver implementation makes it so.
After running these commands, I am being faced with the following
lockdep splat:
$ ip link add link swp0 name macsec0 type macsec encrypt on && ip link set swp0 up
$ ip link add dev br0 type bridge vlan_filtering 1 && ip link set br0 up
$ ip link set macsec0 master br0 && ip link set macsec0 up
========================================================
WARNING: possible irq lock inversion dependency detected
6.4.0-04295-g31b577b4bd4a #603 Not tainted
--------------------------------------------------------
swapper/1/0 just changed the state of lock:
ffff6bd348724cd8 (&br->lock){+.-.}-{3:3}, at: br_forward_delay_timer_expired+0x34/0x198
but this lock took another, SOFTIRQ-unsafe lock in the past:
(&ocelot->stats_lock){+.+.}-{3:3}
and interrupts could create inverse lock ordering between them.
other info that might help us debug this:
Chain exists of:
&br->lock --> &br->hash_lock --> &ocelot->stats_lock
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ocelot->stats_lock);
local_irq_disable();
lock(&br->lock);
lock(&br->hash_lock);
<Interrupt>
lock(&br->lock);
*** DEADLOCK ***
(details about the 3 locks skipped)
swp0 is instantiated by drivers/net/dsa/ocelot/felix.c, and this
only matters to the extent that its .ndo_get_stats64() method calls
spin_lock(&ocelot->stats_lock).
Documentation/locking/lockdep-design.rst says:
| A lock is irq-safe means it was ever used in an irq context, while a lock
| is irq-unsafe means it was ever acquired with irq enabled.
(...)
| Furthermore, the following usage based lock dependencies are not allowed
| between any two lock-classes::
|
| <hardirq-safe> -> <hardirq-unsafe>
| <softirq-safe> -> <softirq-unsafe>
Lockdep marks br->hash_lock as softirq-safe, because it is sometimes
taken in softirq context (for example br_fdb_update() which runs in
NET_RX softirq), and when it's not in softirq context it blocks softirqs
by using spin_lock_bh().
Lockdep marks ocelot->stats_lock as softirq-unsafe, because it never
blocks softirqs from running, and it is never taken from softirq
context. So it can always be interrupted by softirqs.
There is a call path through which a function that holds br->hash_lock:
fdb_add_hw_addr() will call a function that acquires ocelot->stats_lock:
ocelot_port_get_stats64(). This can be seen below:
ocelot_port_get_stats64+0x3c/0x1e0
felix_get_stats64+0x20/0x38
dsa_slave_get_stats64+0x3c/0x60
dev_get_stats+0x74/0x2c8
rtnl_fill_stats+0x4c/0x150
rtnl_fill_ifinfo+0x5cc/0x7b8
rtmsg_ifinfo_build_skb+0xe4/0x150
rtmsg_ifinfo+0x5c/0xb0
__dev_notify_flags+0x58/0x200
__dev_set_promiscuity+0xa0/0x1f8
dev_set_promiscuity+0x30/0x70
macsec_dev_change_rx_flags+0x68/0x88
__dev_set_promiscuity+0x1a8/0x1f8
__dev_set_rx_mode+0x74/0xa8
dev_uc_add+0x74/0xa0
fdb_add_hw_addr+0x68/0xd8
fdb_add_local+0xc4/0x110
br_fdb_add_local+0x54/0x88
br_add_if+0x338/0x4a0
br_add_slave+0x20/0x38
do_setlink+0x3a4/0xcb8
rtnl_newlink+0x758/0x9d0
rtnetlink_rcv_msg+0x2f0/0x550
netlink_rcv_skb+0x128/0x148
rtnetlink_rcv+0x24/0x38
the plain English explanation for it is:
The macsec0 bridge port is created without p->flags & BR_PROMISC,
because it is what br_manage_promisc() decides for a VLAN filtering
bridge with a single auto port.
As part of the br_add_if() procedure, br_fdb_add_local() is called for
the MAC address of the device, and this results in a call to
dev_uc_add() for macsec0 while the softirq-safe br->hash_lock is taken.
Because macsec0 does not have IFF_UNICAST_FLT, dev_uc_add() ends up
calling __dev_set_promiscuity() for macsec0, which is propagated by its
implementation, macsec_dev_change_rx_flags(), to the lower device: swp0.
This triggers the call path:
dev_set_promiscuity(swp0)
-> rtmsg_ifinfo()
-> dev_get_stats()
-> ocelot_port_get_stats64()
with a calling context that lockdep doesn't like (br->hash_lock held).
Normally we don't see this, because even though many drivers that can be
bridge ports don't support IFF_UNICAST_FLT, we need a driver that
(a) doesn't support IFF_UNICAST_FLT, *and*
(b) it forwards the IFF_PROMISC flag to another driver, and
(c) *that* driver implements ndo_get_stats64() using a softirq-unsafe
spinlock.
Condition (b) is necessary because the first __dev_set_rx_mode() calls
__dev_set_promiscuity() with "bool notify=false", and thus, the
rtmsg_ifinfo() code path won't be entered.
The same criteria also hold true for DSA switches which don't report
IFF_UNICAST_FLT. When the DSA master uses a spin_lock() in its
ndo_get_stats64() method, the same lockdep splat can be seen.
I think the deadlock possibility is real, even though I didn't reproduce
it, and I'm thinking of the following situation to support that claim:
fdb_add_hw_addr() runs on a CPU A, in a context with softirqs locally
disabled and br->hash_lock held, and may end up attempting to acquire
ocelot->stats_lock.
In parallel, ocelot->stats_lock is currently held by a thread B (say,
ocelot_check_stats_work()), which is interrupted while holding it by a
softirq which attempts to lock br->hash_lock.
Thread B cannot make progress because br->hash_lock is held by A. Whereas
thread A cannot make progress because ocelot->stats_lock is held by B.
When taking the issue at face value, the bridge can avoid that problem
by simply making the ports promiscuous from a code path with a saner
calling context (br->hash_lock not held). A bridge port without
IFF_UNICAST_FLT is going to become promiscuous as soon as we call
dev_uc_add() on it (which we do unconditionally), so why not be
preemptive and make it promiscuous right from the beginning, so as to
not be taken by surprise.
With this, we've broken the links between code that holds br->hash_lock
or br->lock and code that calls into the ndo_change_rx_flags() or
ndo_get_stats64() ops of the bridge port.
Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_if.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 228fd5b20f109..0989074f316ef 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -166,8 +166,9 @@ void br_manage_promisc(struct net_bridge *br)
* This lets us disable promiscuous mode and write
* this config to hw.
*/
- if (br->auto_cnt == 0 ||
- (br->auto_cnt == 1 && br_auto_port(p)))
+ if ((p->dev->priv_flags & IFF_UNICAST_FLT) &&
+ (br->auto_cnt == 0 ||
+ (br->auto_cnt == 1 && br_auto_port(p))))
br_port_clear_promisc(p);
else
br_port_set_promisc(p);
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 500/591] net: dsa: tag_sja1105: fix source port decoding in vlan_filtering=0 bridge mode
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 499/591] net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 501/591] net: fix net_dev_start_xmit trace event vs skb_transport_offset() Greg Kroah-Hartman
` (94 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Simon Horman,
David S. Miller, Sasha Levin
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit a398b9ea0c3b791b7a0f4c6029a62cf628f97f22 ]
There was a regression introduced by the blamed commit, where pinging to
a VLAN-unaware bridge would fail with the repeated message "Couldn't
decode source port" coming from the tagging protocol driver.
When receiving packets with a bridge_vid as determined by
dsa_tag_8021q_bridge_join(), dsa_8021q_rcv() will decode:
- source_port = 0 (which isn't really valid, more like "don't know")
- switch_id = 0 (which isn't really valid, more like "don't know")
- vbid = value in range 1-7
Since the blamed patch has reversed the order of the checks, we are now
going to believe that source_port != -1 and switch_id != -1, so they're
valid, but they aren't.
The minimal solution to the problem is to only populate source_port and
switch_id with what dsa_8021q_rcv() came up with, if the vbid is zero,
i.e. the source port information is trustworthy.
Fixes: c1ae02d87689 ("net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/dsa/tag_sja1105.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
index 731dc3a111ef3..6e3699d859dbd 100644
--- a/net/dsa/tag_sja1105.c
+++ b/net/dsa/tag_sja1105.c
@@ -568,11 +568,14 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
* if available. This allows us to not overwrite a valid source
* port and switch ID with zeroes when receiving link-local
* frames from a VLAN-unaware bridged port (non-zero vbid) or a
- * VLAN-aware bridged port (non-zero vid).
+ * VLAN-aware bridged port (non-zero vid). Furthermore, the
+ * tag_8021q source port information is only of trust when the
+ * vbid is 0 (precise port). Otherwise, tmp_source_port and
+ * tmp_switch_id will be zeroes.
*/
- if (source_port == -1)
+ if (vbid == 0 && source_port == -1)
source_port = tmp_source_port;
- if (switch_id == -1)
+ if (vbid == 0 && switch_id == -1)
switch_id = tmp_switch_id;
} else if (source_port == -1 && switch_id == -1) {
/* Packets with no source information have no chance of
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 501/591] net: fix net_dev_start_xmit trace event vs skb_transport_offset()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 500/591] net: dsa: tag_sja1105: fix source port decoding in vlan_filtering=0 bridge mode Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 502/591] tcp: annotate data races in __tcp_oow_rate_limited() Greg Kroah-Hartman
` (93 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, syzbot,
David S. Miller, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit f88fcb1d7d961b4b402d675109726f94db87571c ]
After blamed commit, we must be more careful about using
skb_transport_offset(), as reminded us by syzbot:
WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 skb_transport_offset include/linux/skbuff.h:2977 [inline]
WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14
Modules linked in:
CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 6.1.30-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
RIP: 0010:skb_transport_header include/linux/skbuff.h:2868 [inline]
RIP: 0010:skb_transport_offset include/linux/skbuff.h:2977 [inline]
RIP: 0010:perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14
Code: 8b 04 25 28 00 00 00 48 3b 84 24 c0 00 00 00 0f 85 4e 04 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc e8 56 22 01 fd <0f> 0b e9 f6 fc ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 86 f9 ff
RSP: 0018:ffffc900002bf700 EFLAGS: 00010293
RAX: ffffffff8485d8ca RBX: 000000000000ffff RCX: ffff888100914280
RDX: 0000000000000000 RSI: 000000000000ffff RDI: 000000000000ffff
RBP: ffffc900002bf818 R08: ffffffff8485d5b6 R09: fffffbfff0f8fb5e
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff110217d8f67
R13: ffff88810bec7b3a R14: dffffc0000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f6a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f96cf6d52f0 CR3: 000000012224c000 CR4: 0000000000350ef0
Call Trace:
<TASK>
[<ffffffff84715e35>] trace_net_dev_start_xmit include/trace/events/net.h:14 [inline]
[<ffffffff84715e35>] xmit_one net/core/dev.c:3643 [inline]
[<ffffffff84715e35>] dev_hard_start_xmit+0x705/0x980 net/core/dev.c:3660
[<ffffffff8471a232>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324
[<ffffffff85416493>] dev_queue_xmit include/linux/netdevice.h:3030 [inline]
[<ffffffff85416493>] batadv_send_skb_packet+0x3f3/0x680 net/batman-adv/send.c:108
[<ffffffff85416744>] batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127
[<ffffffff853bc52a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline]
[<ffffffff853bc52a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:421 [inline]
[<ffffffff853bc52a>] batadv_iv_send_outstanding_bat_ogm_packet+0x69a/0x840 net/batman-adv/bat_iv_ogm.c:1701
[<ffffffff8151023c>] process_one_work+0x8ac/0x1170 kernel/workqueue.c:2289
[<ffffffff81511938>] worker_thread+0xaa8/0x12d0 kernel/workqueue.c:2436
Fixes: 66e4c8d95008 ("net: warn if transport header was not set")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/trace/events/net.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/trace/events/net.h b/include/trace/events/net.h
index da611a7aaf970..f667c76a3b022 100644
--- a/include/trace/events/net.h
+++ b/include/trace/events/net.h
@@ -51,7 +51,8 @@ TRACE_EVENT(net_dev_start_xmit,
__entry->network_offset = skb_network_offset(skb);
__entry->transport_offset_valid =
skb_transport_header_was_set(skb);
- __entry->transport_offset = skb_transport_offset(skb);
+ __entry->transport_offset = skb_transport_header_was_set(skb) ?
+ skb_transport_offset(skb) : 0;
__entry->tx_flags = skb_shinfo(skb)->tx_flags;
__entry->gso_size = skb_shinfo(skb)->gso_size;
__entry->gso_segs = skb_shinfo(skb)->gso_segs;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 502/591] tcp: annotate data races in __tcp_oow_rate_limited()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 501/591] net: fix net_dev_start_xmit trace event vs skb_transport_offset() Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 503/591] bpf, btf: Warn but return no error for NULL btf from __register_btf_kfunc_id_set() Greg Kroah-Hartman
` (92 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, David S. Miller,
Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 998127cdb4699b9d470a9348ffe9f1154346be5f ]
request sockets are lockless, __tcp_oow_rate_limited() could be called
on the same object from different cpus. This is harmless.
Add READ_ONCE()/WRITE_ONCE() annotations to avoid a KCSAN report.
Fixes: 4ce7e93cb3fe ("tcp: rate limit ACK sent by SYN_RECV request sockets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp_input.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 5dabb38b857ff..e2d3ea2e34561 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3590,8 +3590,11 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32
static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
u32 *last_oow_ack_time)
{
- if (*last_oow_ack_time) {
- s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time);
+ /* Paired with the WRITE_ONCE() in this function. */
+ u32 val = READ_ONCE(*last_oow_ack_time);
+
+ if (val) {
+ s32 elapsed = (s32)(tcp_jiffies32 - val);
if (0 <= elapsed &&
elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) {
@@ -3600,7 +3603,10 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
}
}
- *last_oow_ack_time = tcp_jiffies32;
+ /* Paired with the prior READ_ONCE() and with itself,
+ * as we might be lockless.
+ */
+ WRITE_ONCE(*last_oow_ack_time, tcp_jiffies32);
return false; /* not rate-limited: go ahead, send dupack now! */
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 503/591] bpf, btf: Warn but return no error for NULL btf from __register_btf_kfunc_id_set()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 502/591] tcp: annotate data races in __tcp_oow_rate_limited() Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 504/591] xsk: Honor SO_BINDTODEVICE on bind Greg Kroah-Hartman
` (91 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Egorenkov,
Kumar Kartikeya Dwivedi, SeongJae Park, Daniel Borkmann,
Jiri Olsa, Sasha Levin
From: SeongJae Park <sj@kernel.org>
[ Upstream commit 3de4d22cc9ac7c9f38e10edcf54f9a8891a9c2aa ]
__register_btf_kfunc_id_set() assumes .BTF to be part of the module's .ko
file if CONFIG_DEBUG_INFO_BTF is enabled. If that's not the case, the
function prints an error message and return an error. As a result, such
modules cannot be loaded.
However, the section could be stripped out during a build process. It would
be better to let the modules loaded, because their basic functionalities
have no problem [0], though the BTF functionalities will not be supported.
Make the function to lower the level of the message from error to warn, and
return no error.
[0] https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion
Fixes: c446fdacb10d ("bpf: fix register_btf_kfunc_id_set for !CONFIG_DEBUG_INFO_BTF")
Reported-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
Suggested-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/bpf/87y228q66f.fsf@oc8242746057.ibm.com
Link: https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion
Link: https://lore.kernel.org/bpf/20230701171447.56464-1-sj@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/btf.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 8220caa488c54..fb78bb26786fc 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -7469,10 +7469,8 @@ int register_btf_kfunc_id_set(enum bpf_prog_type prog_type,
pr_err("missing vmlinux BTF, cannot register kfuncs\n");
return -ENOENT;
}
- if (kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) {
- pr_err("missing module BTF, cannot register kfuncs\n");
- return -ENOENT;
- }
+ if (kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
+ pr_warn("missing module BTF, cannot register kfuncs\n");
return 0;
}
if (IS_ERR(btf))
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 504/591] xsk: Honor SO_BINDTODEVICE on bind
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 503/591] bpf, btf: Warn but return no error for NULL btf from __register_btf_kfunc_id_set() Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 505/591] net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX Greg Kroah-Hartman
` (90 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilya Maximets, Daniel Borkmann,
Magnus Karlsson, John Fastabend, Jason Wang, Sasha Levin
From: Ilya Maximets <i.maximets@ovn.org>
[ Upstream commit f7306acec9aae9893d15e745c8791124d42ab10a ]
Initial creation of an AF_XDP socket requires CAP_NET_RAW capability. A
privileged process might create the socket and pass it to a non-privileged
process for later use. However, that process will be able to bind the socket
to any network interface. Even though it will not be able to receive any
traffic without modification of the BPF map, the situation is not ideal.
Sockets already have a mechanism that can be used to restrict what interface
they can be attached to. That is SO_BINDTODEVICE.
To change the SO_BINDTODEVICE binding the process will need CAP_NET_RAW.
Make xsk_bind() honor the SO_BINDTODEVICE in order to allow safer workflow
when non-privileged process is using AF_XDP.
The intended workflow is following:
1. First process creates a bare socket with socket(AF_XDP, ...).
2. First process loads the XSK program to the interface.
3. First process adds the socket fd to a BPF map.
4. First process ties socket fd to a particular interface using
SO_BINDTODEVICE.
5. First process sends socket fd to a second process.
6. Second process allocates UMEM.
7. Second process binds socket to the interface with bind(...).
8. Second process sends/receives the traffic.
All the steps above are possible today if the first process is privileged
and the second one has sufficient RLIMIT_MEMLOCK and no capabilities.
However, the second process will be able to bind the socket to any interface
it wants on step 7 and send traffic from it. With the proposed change, the
second process will be able to bind the socket only to a specific interface
chosen by the first process at step 4.
Fixes: 965a99098443 ("xsk: add support for bind for Rx")
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/bpf/20230703175329.3259672-1-i.maximets@ovn.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/networking/af_xdp.rst | 9 +++++++++
net/xdp/xsk.c | 5 +++++
2 files changed, 14 insertions(+)
diff --git a/Documentation/networking/af_xdp.rst b/Documentation/networking/af_xdp.rst
index 60b217b436be6..5b77b9e5ac7e6 100644
--- a/Documentation/networking/af_xdp.rst
+++ b/Documentation/networking/af_xdp.rst
@@ -433,6 +433,15 @@ start N bytes into the buffer leaving the first N bytes for the
application to use. The final option is the flags field, but it will
be dealt with in separate sections for each UMEM flag.
+SO_BINDTODEVICE setsockopt
+--------------------------
+
+This is a generic SOL_SOCKET option that can be used to tie AF_XDP
+socket to a particular network interface. It is useful when a socket
+is created by a privileged process and passed to a non-privileged one.
+Once the option is set, kernel will refuse attempts to bind that socket
+to a different interface. Updating the value requires CAP_NET_RAW.
+
XDP_STATISTICS getsockopt
-------------------------
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 13f62d2402e71..371d269d22fa0 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -886,6 +886,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
struct sock *sk = sock->sk;
struct xdp_sock *xs = xdp_sk(sk);
struct net_device *dev;
+ int bound_dev_if;
u32 flags, qid;
int err = 0;
@@ -899,6 +900,10 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
XDP_USE_NEED_WAKEUP))
return -EINVAL;
+ bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
+ if (bound_dev_if && bound_dev_if != sxdp->sxdp_ifindex)
+ return -EINVAL;
+
rtnl_lock();
mutex_lock(&xs->mutex);
if (xs->state != XSK_READY) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 505/591] net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 504/591] xsk: Honor SO_BINDTODEVICE on bind Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 506/591] fanotify: disallow mount/sb marks on kernel internal pseudo fs Greg Kroah-Hartman
` (89 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin Ma, Pedro Tammela, Paolo Abeni,
Sasha Levin
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit 30c45b5361d39b4b793780ffac5538090b9e2eb1 ]
The attribute TCA_PEDIT_PARMS_EX is not be included in pedit_policy and
one malicious user could fake a TCA_PEDIT_PARMS_EX whose length is
smaller than the intended sizeof(struct tc_pedit). Hence, the
dereference in tcf_pedit_init() could access dirty heap data.
static int tcf_pedit_init(...)
{
// ...
pattr = tb[TCA_PEDIT_PARMS]; // TCA_PEDIT_PARMS is included
if (!pattr)
pattr = tb[TCA_PEDIT_PARMS_EX]; // but this is not
// ...
parm = nla_data(pattr);
index = parm->index; // parm is able to be smaller than 4 bytes
// and this dereference gets dirty skb_buff
// data created in netlink_sendmsg
}
This commit adds TCA_PEDIT_PARMS_EX length in pedit_policy which avoid
the above case, just like the TCA_PEDIT_PARMS.
Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
Link: https://lore.kernel.org/r/20230703110842.590282-1-linma@zju.edu.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/act_pedit.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -28,6 +28,7 @@ static struct tc_action_ops act_pedit_op
static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
[TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) },
+ [TCA_PEDIT_PARMS_EX] = { .len = sizeof(struct tc_pedit) },
[TCA_PEDIT_KEYS_EX] = { .type = NLA_NESTED },
};
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 506/591] fanotify: disallow mount/sb marks on kernel internal pseudo fs
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 505/591] net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 507/591] riscv: move memblock_allow_resize() after linear mapping is ready Greg Kroah-Hartman
` (88 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amir Goldstein, Christian Brauner,
Jan Kara, Sasha Levin
From: Amir Goldstein <amir73il@gmail.com>
[ Upstream commit 69562eb0bd3e6bb8e522a7b254334e0fb30dff0c ]
Hopefully, nobody is trying to abuse mount/sb marks for watching all
anonymous pipes/inodes.
I cannot think of a good reason to allow this - it looks like an
oversight that dated back to the original fanotify API.
Link: https://lore.kernel.org/linux-fsdevel/20230628101132.kvchg544mczxv2pm@quack3/
Fixes: 0ff21db9fcc3 ("fanotify: hooks the fanotify_mark syscall to the vfsmount code")
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20230629042044.25723-1-amir73il@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/notify/fanotify/fanotify_user.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 4546da4a54f95..9df5db0f10ff2 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -1574,6 +1574,20 @@ static int fanotify_events_supported(struct fsnotify_group *group,
path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM)
return -EINVAL;
+ /*
+ * mount and sb marks are not allowed on kernel internal pseudo fs,
+ * like pipe_mnt, because that would subscribe to events on all the
+ * anonynous pipes in the system.
+ *
+ * SB_NOUSER covers all of the internal pseudo fs whose objects are not
+ * exposed to user's mount namespace, but there are other SB_KERNMOUNT
+ * fs, like nsfs, debugfs, for which the value of allowing sb and mount
+ * mark is questionable. For now we leave them alone.
+ */
+ if (mark_type != FAN_MARK_INODE &&
+ path->mnt->mnt_sb->s_flags & SB_NOUSER)
+ return -EINVAL;
+
/*
* We shouldn't have allowed setting dirent events and the directory
* flags FAN_ONDIR and FAN_EVENT_ON_CHILD in mask of non-dir inode,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 507/591] riscv: move memblock_allow_resize() after linear mapping is ready
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 506/591] fanotify: disallow mount/sb marks on kernel internal pseudo fs Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 508/591] pptp: Fix fib lookup calls Greg Kroah-Hartman
` (87 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Woody Zhang, Song Shuai,
Palmer Dabbelt, Sasha Levin
From: Woody Zhang <woodylab@foxmail.com>
[ Upstream commit 85fadc0d04119c2fe4a20287767ab904c6d21ba1 ]
The initial memblock metadata is accessed from kernel image mapping. The
regions arrays need to "reallocated" from memblock and accessed through
linear mapping to cover more memblock regions. So the resizing should
not be allowed until linear mapping is ready. Note that there are
memblock allocations when building linear mapping.
This patch is similar to 24cc61d8cb5a ("arm64: memblock: don't permit
memblock resizing until linear mapping is up").
In following log, many memblock regions are reserved before
create_linear_mapping_page_table(). And then it triggered reallocation
of memblock.reserved.regions and memcpy the old array in kernel image
mapping to the new array in linear mapping which caused a page fault.
[ 0.000000] memblock_reserve: [0x00000000bf01f000-0x00000000bf01ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
[ 0.000000] memblock_reserve: [0x00000000bf021000-0x00000000bf021fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
[ 0.000000] memblock_reserve: [0x00000000bf023000-0x00000000bf023fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
[ 0.000000] memblock_reserve: [0x00000000bf025000-0x00000000bf025fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
[ 0.000000] memblock_reserve: [0x00000000bf027000-0x00000000bf027fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
[ 0.000000] memblock_reserve: [0x00000000bf029000-0x00000000bf029fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
[ 0.000000] memblock_reserve: [0x00000000bf02b000-0x00000000bf02bfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
[ 0.000000] memblock_reserve: [0x00000000bf02d000-0x00000000bf02dfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
[ 0.000000] memblock_reserve: [0x00000000bf02f000-0x00000000bf02ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
[ 0.000000] memblock_reserve: [0x00000000bf030000-0x00000000bf030fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6
[ 0.000000] OF: reserved mem: 0x0000000080000000..0x000000008007ffff (512 KiB) map non-reusable mmode_resv0@80000000
[ 0.000000] memblock_reserve: [0x00000000bf000000-0x00000000bf001fed] paging_init+0x19a/0x5ae
[ 0.000000] memblock_phys_alloc_range: 4096 bytes align=0x1000 from=0x0000000000000000 max_addr=0x0000000000000000 alloc_pmd_fixmap+0x14/0x1c
[ 0.000000] memblock_reserve: [0x000000017ffff000-0x000000017fffffff] memblock_alloc_range_nid+0xb8/0x128
[ 0.000000] memblock: reserved is doubled to 256 at [0x000000017fffd000-0x000000017fffe7ff]
[ 0.000000] Unable to handle kernel paging request at virtual address ff600000ffffd000
[ 0.000000] Oops [#1]
[ 0.000000] Modules linked in:
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.4.0-rc1-00011-g99a670b2069c #66
[ 0.000000] Hardware name: riscv-virtio,qemu (DT)
[ 0.000000] epc : __memcpy+0x60/0xf8
[ 0.000000] ra : memblock_double_array+0x192/0x248
[ 0.000000] epc : ffffffff8081d214 ra : ffffffff80a3dfc0 sp : ffffffff81403bd0
[ 0.000000] gp : ffffffff814fbb38 tp : ffffffff8140dac0 t0 : 0000000001600000
[ 0.000000] t1 : 0000000000000000 t2 : 000000008f001000 s0 : ffffffff81403c60
[ 0.000000] s1 : ffffffff80c0bc98 a0 : ff600000ffffd000 a1 : ffffffff80c0bcd8
[ 0.000000] a2 : 0000000000000c00 a3 : ffffffff80c0c8d8 a4 : 0000000080000000
[ 0.000000] a5 : 0000000000080000 a6 : 0000000000000000 a7 : 0000000080200000
[ 0.000000] s2 : ff600000ffffd000 s3 : 0000000000002000 s4 : 0000000000000c00
[ 0.000000] s5 : ffffffff80c0bc60 s6 : ffffffff80c0bcc8 s7 : 0000000000000000
[ 0.000000] s8 : ffffffff814fd0a8 s9 : 000000017fffe7ff s10: 0000000000000000
[ 0.000000] s11: 0000000000001000 t3 : 0000000000001000 t4 : 0000000000000000
[ 0.000000] t5 : 000000008f003000 t6 : ff600000ffffd000
[ 0.000000] status: 0000000200000100 badaddr: ff600000ffffd000 cause: 000000000000000f
[ 0.000000] [<ffffffff8081d214>] __memcpy+0x60/0xf8
[ 0.000000] [<ffffffff80a3e1a2>] memblock_add_range.isra.14+0x12c/0x162
[ 0.000000] [<ffffffff80a3e36a>] memblock_reserve+0x6e/0x8c
[ 0.000000] [<ffffffff80a123fc>] memblock_alloc_range_nid+0xb8/0x128
[ 0.000000] [<ffffffff80a1256a>] memblock_phys_alloc_range+0x5e/0x6a
[ 0.000000] [<ffffffff80a04732>] alloc_pmd_fixmap+0x14/0x1c
[ 0.000000] [<ffffffff80a0475a>] alloc_p4d_fixmap+0xc/0x14
[ 0.000000] [<ffffffff80a04a36>] create_pgd_mapping+0x98/0x17c
[ 0.000000] [<ffffffff80a04e9e>] create_linear_mapping_range.constprop.10+0xe4/0x112
[ 0.000000] [<ffffffff80a05bb8>] paging_init+0x3ec/0x5ae
[ 0.000000] [<ffffffff80a03354>] setup_arch+0xb2/0x576
[ 0.000000] [<ffffffff80a00726>] start_kernel+0x72/0x57e
[ 0.000000] Code: b303 0285 b383 0305 be03 0385 be83 0405 bf03 0485 (b023) 00ef
[ 0.000000] ---[ end trace 0000000000000000 ]---
[ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
[ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
Fixes: 671f9a3e2e24 ("RISC-V: Setup initial page tables in two stages")
Signed-off-by: Woody Zhang <woodylab@foxmail.com>
Tested-by: Song Shuai <songshuaishuai@tinylab.org>
Link: https://lore.kernel.org/r/tencent_FBB94CE615C5CCE7701CD39C15CCE0EE9706@qq.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/mm/init.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index d8d97df801909..9390cdff39ffc 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -255,7 +255,6 @@ static void __init setup_bootmem(void)
dma_contiguous_reserve(dma32_phys_limit);
if (IS_ENABLED(CONFIG_64BIT))
hugetlb_cma_reserve(PUD_SHIFT - PAGE_SHIFT);
- memblock_allow_resize();
}
#ifdef CONFIG_MMU
@@ -1211,6 +1210,9 @@ void __init paging_init(void)
{
setup_bootmem();
setup_vm_final();
+
+ /* Depend on that Linear Mapping is ready */
+ memblock_allow_resize();
}
void __init misc_mem_init(void)
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 508/591] pptp: Fix fib lookup calls.
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 507/591] riscv: move memblock_allow_resize() after linear mapping is ready Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 509/591] net: dsa: tag_sja1105: fix MAC DA patching from meta frames Greg Kroah-Hartman
` (86 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guillaume Nault, David S. Miller,
Sasha Levin
From: Guillaume Nault <gnault@redhat.com>
[ Upstream commit 84bef5b6037c15180ef88ac4216dc621d16df1a6 ]
PPTP uses pppox sockets (struct pppox_sock). These sockets don't embed
an inet_sock structure, so it's invalid to call inet_sk() on them.
Therefore, the ip_route_output_ports() call in pptp_connect() has two
problems:
* The tos variable is set with RT_CONN_FLAGS(sk), which calls
inet_sk() on the pppox socket.
* ip_route_output_ports() tries to retrieve routing flags using
inet_sk_flowi_flags(), which is also going to call inet_sk() on the
pppox socket.
While PPTP doesn't use inet sockets, it's actually really layered on
top of IP and therefore needs a proper way to do fib lookups. So let's
define pptp_route_output() to get a struct rtable from a pptp socket.
Let's also replace the ip_route_output_ports() call of pptp_xmit() for
consistency.
In practice, this means that:
* pptp_connect() sets ->flowi4_tos and ->flowi4_flags to zero instead
of using bits of unrelated struct pppox_sock fields.
* pptp_xmit() now respects ->sk_mark and ->sk_uid.
* pptp_xmit() now calls the security_sk_classify_flow() security
hook, thus allowing to set ->flowic_secid.
* pptp_xmit() now passes the pppox socket to xfrm_lookup_route().
Found by code inspection.
Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
Signed-off-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ppp/pptp.c | 31 ++++++++++++++++++++-----------
1 file changed, 20 insertions(+), 11 deletions(-)
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 0fe78826c8fa4..32183f24e63ff 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -24,6 +24,7 @@
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/rcupdate.h>
+#include <linux/security.h>
#include <linux/spinlock.h>
#include <net/sock.h>
@@ -128,6 +129,23 @@ static void del_chan(struct pppox_sock *sock)
spin_unlock(&chan_lock);
}
+static struct rtable *pptp_route_output(struct pppox_sock *po,
+ struct flowi4 *fl4)
+{
+ struct sock *sk = &po->sk;
+ struct net *net;
+
+ net = sock_net(sk);
+ flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 0,
+ RT_SCOPE_UNIVERSE, IPPROTO_GRE, 0,
+ po->proto.pptp.dst_addr.sin_addr.s_addr,
+ po->proto.pptp.src_addr.sin_addr.s_addr,
+ 0, 0, sock_net_uid(net, sk));
+ security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4));
+
+ return ip_route_output_flow(net, fl4, sk);
+}
+
static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
{
struct sock *sk = (struct sock *) chan->private;
@@ -151,11 +169,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
if (sk_pppox(po)->sk_state & PPPOX_DEAD)
goto tx_error;
- rt = ip_route_output_ports(net, &fl4, NULL,
- opt->dst_addr.sin_addr.s_addr,
- opt->src_addr.sin_addr.s_addr,
- 0, 0, IPPROTO_GRE,
- RT_TOS(0), sk->sk_bound_dev_if);
+ rt = pptp_route_output(po, &fl4);
if (IS_ERR(rt))
goto tx_error;
@@ -438,12 +452,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
po->chan.private = sk;
po->chan.ops = &pptp_chan_ops;
- rt = ip_route_output_ports(sock_net(sk), &fl4, sk,
- opt->dst_addr.sin_addr.s_addr,
- opt->src_addr.sin_addr.s_addr,
- 0, 0,
- IPPROTO_GRE, RT_CONN_FLAGS(sk),
- sk->sk_bound_dev_if);
+ rt = pptp_route_output(po, &fl4);
if (IS_ERR(rt)) {
error = -EHOSTUNREACH;
goto end;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 509/591] net: dsa: tag_sja1105: fix MAC DA patching from meta frames
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 508/591] pptp: Fix fib lookup calls Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 510/591] net: dsa: sja1105: always enable the send_meta options Greg Kroah-Hartman
` (85 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Simon Horman,
Florian Fainelli, David S. Miller, Sasha Levin
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 1dcf6efd5f0c1f4496b3ef7ec5a7db104a53b38c ]
The SJA1105 manual says that at offset 4 into the meta frame payload we
have "MAC destination byte 2" and at offset 5 we have "MAC destination
byte 1". These are counted from the LSB, so byte 1 is h_dest[ETH_HLEN-2]
aka h_dest[4] and byte 2 is h_dest[ETH_HLEN-3] aka h_dest[3].
The sja1105_meta_unpack() function decodes these the other way around,
so a frame with MAC DA 01:80:c2:11:22:33 is received by the network
stack as having 01:80:c2:22:11:33.
Fixes: e53e18a6fe4d ("net: dsa: sja1105: Receive and decode meta frames")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/dsa/tag_sja1105.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
index 6e3699d859dbd..d3f27cd5fe244 100644
--- a/net/dsa/tag_sja1105.c
+++ b/net/dsa/tag_sja1105.c
@@ -113,8 +113,8 @@ static void sja1105_meta_unpack(const struct sk_buff *skb,
* a unified unpacking command for both device series.
*/
packing(buf, &meta->tstamp, 31, 0, 4, UNPACK, 0);
- packing(buf + 4, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0);
- packing(buf + 5, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0);
+ packing(buf + 4, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0);
+ packing(buf + 5, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0);
packing(buf + 6, &meta->source_port, 7, 0, 1, UNPACK, 0);
packing(buf + 7, &meta->switch_id, 7, 0, 1, UNPACK, 0);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 510/591] net: dsa: sja1105: always enable the send_meta options
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 509/591] net: dsa: tag_sja1105: fix MAC DA patching from meta frames Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 511/591] octeontx-af: fix hardware timestamp configuration Greg Kroah-Hartman
` (84 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Simon Horman,
Florian Fainelli, David S. Miller, Sasha Levin
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit a372d66af48506d9f7aaae2a474cd18f14d98cb8 ]
incl_srcpt has the limitation, mentioned in commit b4638af8885a ("net:
dsa: sja1105: always enable the INCL_SRCPT option"), that frames with a
MAC DA of 01:80:c2:xx:yy:zz will be received as 01:80:c2:00:00:zz unless
PTP RX timestamping is enabled.
The incl_srcpt option was initially unconditionally enabled, then that
changed with commit 42824463d38d ("net: dsa: sja1105: Limit use of
incl_srcpt to bridge+vlan mode"), then again with b4638af8885a ("net:
dsa: sja1105: always enable the INCL_SRCPT option"). Bottom line is that
it now needs to be always enabled, otherwise the driver does not have a
reliable source of information regarding source_port and switch_id for
link-local traffic (tag_8021q VLANs may be imprecise since now they
identify an entire bridging domain when ports are not standalone).
If we accept that PTP RX timestamping (and therefore, meta frame
generation) is always enabled in hardware, then that limitation could be
avoided and packets with any MAC DA can be properly received, because
meta frames do contain the original bytes from the MAC DA of their
associated link-local packet.
This change enables meta frame generation unconditionally, which also
has the nice side effects of simplifying the switch control path
(a switch reset is no longer required on hwtstamping settings change)
and the tagger data path (it no longer needs to be informed whether to
expect meta frames or not - it always does).
Fixes: 227d07a07ef1 ("net: dsa: sja1105: Add support for traffic through standalone ports")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/sja1105/sja1105.h | 2 +-
drivers/net/dsa/sja1105/sja1105_main.c | 5 ++-
drivers/net/dsa/sja1105/sja1105_ptp.c | 48 +++-----------------------
include/linux/dsa/sja1105.h | 4 ---
net/dsa/tag_sja1105.c | 45 ------------------------
5 files changed, 7 insertions(+), 97 deletions(-)
diff --git a/drivers/net/dsa/sja1105/sja1105.h b/drivers/net/dsa/sja1105/sja1105.h
index 9ba2ec2b966d9..fb3cd4c78faa8 100644
--- a/drivers/net/dsa/sja1105/sja1105.h
+++ b/drivers/net/dsa/sja1105/sja1105.h
@@ -250,6 +250,7 @@ struct sja1105_private {
unsigned long ucast_egress_floods;
unsigned long bcast_egress_floods;
unsigned long hwts_tx_en;
+ unsigned long hwts_rx_en;
const struct sja1105_info *info;
size_t max_xfer_len;
struct spi_device *spidev;
@@ -287,7 +288,6 @@ struct sja1105_spi_message {
/* From sja1105_main.c */
enum sja1105_reset_reason {
SJA1105_VLAN_FILTERING = 0,
- SJA1105_RX_HWTSTAMPING,
SJA1105_AGEING_TIME,
SJA1105_SCHEDULING,
SJA1105_BEST_EFFORT_POLICING,
diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
index 8bd61f2ebb2ad..947e8f7c09880 100644
--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -867,11 +867,11 @@ static int sja1105_init_general_params(struct sja1105_private *priv)
.mac_fltres1 = SJA1105_LINKLOCAL_FILTER_A,
.mac_flt1 = SJA1105_LINKLOCAL_FILTER_A_MASK,
.incl_srcpt1 = true,
- .send_meta1 = false,
+ .send_meta1 = true,
.mac_fltres0 = SJA1105_LINKLOCAL_FILTER_B,
.mac_flt0 = SJA1105_LINKLOCAL_FILTER_B_MASK,
.incl_srcpt0 = true,
- .send_meta0 = false,
+ .send_meta0 = true,
/* Default to an invalid value */
.mirr_port = priv->ds->num_ports,
/* No TTEthernet */
@@ -2215,7 +2215,6 @@ static int sja1105_reload_cbs(struct sja1105_private *priv)
static const char * const sja1105_reset_reasons[] = {
[SJA1105_VLAN_FILTERING] = "VLAN filtering",
- [SJA1105_RX_HWTSTAMPING] = "RX timestamping",
[SJA1105_AGEING_TIME] = "Ageing time",
[SJA1105_SCHEDULING] = "Time-aware scheduling",
[SJA1105_BEST_EFFORT_POLICING] = "Best-effort policing",
diff --git a/drivers/net/dsa/sja1105/sja1105_ptp.c b/drivers/net/dsa/sja1105/sja1105_ptp.c
index 30fb2cc40164b..a7d41e7813982 100644
--- a/drivers/net/dsa/sja1105/sja1105_ptp.c
+++ b/drivers/net/dsa/sja1105/sja1105_ptp.c
@@ -58,35 +58,10 @@ enum sja1105_ptp_clk_mode {
#define ptp_data_to_sja1105(d) \
container_of((d), struct sja1105_private, ptp_data)
-/* Must be called only while the RX timestamping state of the tagger
- * is turned off
- */
-static int sja1105_change_rxtstamping(struct sja1105_private *priv,
- bool on)
-{
- struct sja1105_ptp_data *ptp_data = &priv->ptp_data;
- struct sja1105_general_params_entry *general_params;
- struct sja1105_table *table;
-
- table = &priv->static_config.tables[BLK_IDX_GENERAL_PARAMS];
- general_params = table->entries;
- general_params->send_meta1 = on;
- general_params->send_meta0 = on;
-
- ptp_cancel_worker_sync(ptp_data->clock);
- skb_queue_purge(&ptp_data->skb_txtstamp_queue);
- skb_queue_purge(&ptp_data->skb_rxtstamp_queue);
-
- return sja1105_static_config_reload(priv, SJA1105_RX_HWTSTAMPING);
-}
-
int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr)
{
- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds);
struct sja1105_private *priv = ds->priv;
struct hwtstamp_config config;
- bool rx_on;
- int rc;
if (copy_from_user(&config, ifr->ifr_data, sizeof(config)))
return -EFAULT;
@@ -104,26 +79,13 @@ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr)
switch (config.rx_filter) {
case HWTSTAMP_FILTER_NONE:
- rx_on = false;
+ priv->hwts_rx_en &= ~BIT(port);
break;
default:
- rx_on = true;
+ priv->hwts_rx_en |= BIT(port);
break;
}
- if (rx_on != tagger_data->rxtstamp_get_state(ds)) {
- tagger_data->rxtstamp_set_state(ds, false);
-
- rc = sja1105_change_rxtstamping(priv, rx_on);
- if (rc < 0) {
- dev_err(ds->dev,
- "Failed to change RX timestamping: %d\n", rc);
- return rc;
- }
- if (rx_on)
- tagger_data->rxtstamp_set_state(ds, true);
- }
-
if (copy_to_user(ifr->ifr_data, &config, sizeof(config)))
return -EFAULT;
return 0;
@@ -131,7 +93,6 @@ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr)
int sja1105_hwtstamp_get(struct dsa_switch *ds, int port, struct ifreq *ifr)
{
- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds);
struct sja1105_private *priv = ds->priv;
struct hwtstamp_config config;
@@ -140,7 +101,7 @@ int sja1105_hwtstamp_get(struct dsa_switch *ds, int port, struct ifreq *ifr)
config.tx_type = HWTSTAMP_TX_ON;
else
config.tx_type = HWTSTAMP_TX_OFF;
- if (tagger_data->rxtstamp_get_state(ds))
+ if (priv->hwts_rx_en & BIT(port))
config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
else
config.rx_filter = HWTSTAMP_FILTER_NONE;
@@ -413,11 +374,10 @@ static long sja1105_rxtstamp_work(struct ptp_clock_info *ptp)
bool sja1105_rxtstamp(struct dsa_switch *ds, int port, struct sk_buff *skb)
{
- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds);
struct sja1105_private *priv = ds->priv;
struct sja1105_ptp_data *ptp_data = &priv->ptp_data;
- if (!tagger_data->rxtstamp_get_state(ds))
+ if (!(priv->hwts_rx_en & BIT(port)))
return false;
/* We need to read the full PTP clock to reconstruct the Rx
diff --git a/include/linux/dsa/sja1105.h b/include/linux/dsa/sja1105.h
index 159e43171cccf..c177322f793d6 100644
--- a/include/linux/dsa/sja1105.h
+++ b/include/linux/dsa/sja1105.h
@@ -48,13 +48,9 @@ struct sja1105_deferred_xmit_work {
/* Global tagger data */
struct sja1105_tagger_data {
- /* Tagger to switch */
void (*xmit_work_fn)(struct kthread_work *work);
void (*meta_tstamp_handler)(struct dsa_switch *ds, int port, u8 ts_id,
enum sja1110_meta_tstamp dir, u64 tstamp);
- /* Switch to tagger */
- bool (*rxtstamp_get_state)(struct dsa_switch *ds);
- void (*rxtstamp_set_state)(struct dsa_switch *ds, bool on);
};
struct sja1105_skb_cb {
diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
index d3f27cd5fe244..143348962a216 100644
--- a/net/dsa/tag_sja1105.c
+++ b/net/dsa/tag_sja1105.c
@@ -53,11 +53,8 @@
#define SJA1110_TX_TRAILER_LEN 4
#define SJA1110_MAX_PADDING_LEN 15
-#define SJA1105_HWTS_RX_EN 0
-
struct sja1105_tagger_private {
struct sja1105_tagger_data data; /* Must be first */
- unsigned long state;
/* Protects concurrent access to the meta state machine
* from taggers running on multiple ports on SMP systems
*/
@@ -387,10 +384,6 @@ static struct sk_buff
priv = sja1105_tagger_private(ds);
- if (!test_bit(SJA1105_HWTS_RX_EN, &priv->state))
- /* Do normal processing. */
- return skb;
-
spin_lock(&priv->meta_lock);
/* Was this a link-local frame instead of the meta
* that we were expecting?
@@ -426,12 +419,6 @@ static struct sk_buff
priv = sja1105_tagger_private(ds);
- /* Drop the meta frame if we're not in the right state
- * to process it.
- */
- if (!test_bit(SJA1105_HWTS_RX_EN, &priv->state))
- return NULL;
-
spin_lock(&priv->meta_lock);
stampable_skb = priv->stampable_skb;
@@ -467,30 +454,6 @@ static struct sk_buff
return skb;
}
-static bool sja1105_rxtstamp_get_state(struct dsa_switch *ds)
-{
- struct sja1105_tagger_private *priv = sja1105_tagger_private(ds);
-
- return test_bit(SJA1105_HWTS_RX_EN, &priv->state);
-}
-
-static void sja1105_rxtstamp_set_state(struct dsa_switch *ds, bool on)
-{
- struct sja1105_tagger_private *priv = sja1105_tagger_private(ds);
-
- if (on)
- set_bit(SJA1105_HWTS_RX_EN, &priv->state);
- else
- clear_bit(SJA1105_HWTS_RX_EN, &priv->state);
-
- /* Initialize the meta state machine to a known state */
- if (!priv->stampable_skb)
- return;
-
- kfree_skb(priv->stampable_skb);
- priv->stampable_skb = NULL;
-}
-
static bool sja1105_skb_has_tag_8021q(const struct sk_buff *skb)
{
u16 tpid = ntohs(eth_hdr(skb)->h_proto);
@@ -547,9 +510,6 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
*/
source_port = hdr->h_dest[3];
switch_id = hdr->h_dest[4];
- /* Clear the DMAC bytes that were mangled by the switch */
- hdr->h_dest[3] = 0;
- hdr->h_dest[4] = 0;
} else if (is_meta) {
sja1105_meta_unpack(skb, &meta);
source_port = meta.source_port;
@@ -780,7 +740,6 @@ static void sja1105_disconnect(struct dsa_switch *ds)
static int sja1105_connect(struct dsa_switch *ds)
{
- struct sja1105_tagger_data *tagger_data;
struct sja1105_tagger_private *priv;
struct kthread_worker *xmit_worker;
int err;
@@ -800,10 +759,6 @@ static int sja1105_connect(struct dsa_switch *ds)
}
priv->xmit_worker = xmit_worker;
- /* Export functions for switch driver use */
- tagger_data = &priv->data;
- tagger_data->rxtstamp_get_state = sja1105_rxtstamp_get_state;
- tagger_data->rxtstamp_set_state = sja1105_rxtstamp_set_state;
ds->tagger_data = priv;
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 511/591] octeontx-af: fix hardware timestamp configuration
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 510/591] net: dsa: sja1105: always enable the send_meta options Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 512/591] afs: Fix accidental truncation when storing data Greg Kroah-Hartman
` (83 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hariprasad Kelam, Sunil Goutham,
Simon Horman, David S. Miller, Sasha Levin
From: Hariprasad Kelam <hkelam@marvell.com>
[ Upstream commit 14bb236b29922c4f57d8c05bfdbcb82677f917c9 ]
MAC block on CN10K (RPM) supports hardware timestamp configuration. The
previous patch which added timestamp configuration support has a bug.
Though the netdev driver requests to disable timestamp configuration,
the driver is always enabling it.
This patch fixes the same.
Fixes: d1489208681d ("octeontx2-af: cn10k: RPM hardware timestamp configuration")
Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
index e284a14ca1203..c60b9580ca969 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
@@ -751,7 +751,7 @@ static int rvu_cgx_ptp_rx_cfg(struct rvu *rvu, u16 pcifunc, bool enable)
cgxd = rvu_cgx_pdata(cgx_id, rvu);
mac_ops = get_mac_ops(cgxd);
- mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, true);
+ mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, enable);
/* If PTP is enabled then inform NPC that packets to be
* parsed by this PF will have their data shifted by 8 bytes
* and if PTP is disabled then no shift is required
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 512/591] afs: Fix accidental truncation when storing data
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 511/591] octeontx-af: fix hardware timestamp configuration Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 513/591] s390/qeth: Fix vipa deletion Greg Kroah-Hartman
` (82 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Dionne, David Howells,
Jeffrey Altman, linux-afs, linux-fsdevel, Linus Torvalds,
Sasha Levin
From: David Howells <dhowells@redhat.com>
[ Upstream commit 03275585cabd0240944f19f33d7584a1b099a3a8 ]
When an AFS FS.StoreData RPC call is made, amongst other things it is
given the resultant file size to be. On the server, this is processed
by truncating the file to new size and then writing the data.
Now, kafs has a lock (vnode->io_lock) that serves to serialise
operations against a specific vnode (ie. inode), but the parameters for
the op are set before the lock is taken. This allows two writebacks
(say sync and kswapd) to race - and if writes are ongoing the writeback
for a later write could occur before the writeback for an earlier one if
the latter gets interrupted.
Note that afs_writepages() cannot take i_mutex and only takes a shared
lock on vnode->validate_lock.
Also note that the server does the truncation and the write inside a
lock, so there's no problem at that end.
Fix this by moving the calculation for the proposed new i_size inside
the vnode->io_lock. Also reset the iterator (which we might have read
from) and update the mtime setting there.
Fixes: bd80d8a80e12 ("afs: Use ITER_XARRAY for writing")
Reported-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
cc: linux-fsdevel@vger.kernel.org
Link: https://lore.kernel.org/r/3526895.1687960024@warthog.procyon.org.uk/
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/write.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/fs/afs/write.c b/fs/afs/write.c
index 08fd456dde67c..3ecc212b62099 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -381,17 +381,19 @@ static int afs_store_data(struct afs_vnode *vnode, struct iov_iter *iter, loff_t
afs_op_set_vnode(op, 0, vnode);
op->file[0].dv_delta = 1;
op->file[0].modification = true;
- op->store.write_iter = iter;
op->store.pos = pos;
op->store.size = size;
- op->store.i_size = max(pos + size, vnode->netfs.remote_i_size);
op->store.laundering = laundering;
- op->mtime = vnode->netfs.inode.i_mtime;
op->flags |= AFS_OPERATION_UNINTR;
op->ops = &afs_store_data_operation;
try_next_key:
afs_begin_vnode_operation(op);
+
+ op->store.write_iter = iter;
+ op->store.i_size = max(pos + size, vnode->netfs.remote_i_size);
+ op->mtime = vnode->netfs.inode.i_mtime;
+
afs_wait_for_operation(op);
switch (op->error) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 513/591] s390/qeth: Fix vipa deletion
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 512/591] afs: Fix accidental truncation when storing data Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 514/591] sh: dma: Fix DMA channel offset calculation Greg Kroah-Hartman
` (81 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandra Winter, Wenjia Zhang,
Thorsten Winkler, Simon Horman, David S. Miller, Sasha Levin
From: Thorsten Winkler <twinkler@linux.ibm.com>
[ Upstream commit 80de809bd35e2a8999edf9f5aaa2d8de18921f11 ]
Change boolean parameter of function "qeth_l3_vipa_store" inside the
"qeth_l3_dev_vipa_del4_store" function from "true" to "false" because
"true" is used for adding a virtual ip address and "false" for deleting.
Fixes: 2390166a6b45 ("s390/qeth: clean up L3 sysfs code")
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: Thorsten Winkler <twinkler@linux.ibm.com>
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/net/qeth_l3_sys.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index 1082380b21f85..dba9b307020cb 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -652,7 +652,7 @@ static QETH_DEVICE_ATTR(vipa_add4, add4, 0644,
static ssize_t qeth_l3_dev_vipa_del4_store(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
- return qeth_l3_vipa_store(dev, buf, true, count, QETH_PROT_IPV4);
+ return qeth_l3_vipa_store(dev, buf, false, count, QETH_PROT_IPV4);
}
static QETH_DEVICE_ATTR(vipa_del4, del4, 0200, NULL,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 514/591] sh: dma: Fix DMA channel offset calculation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 513/591] s390/qeth: Fix vipa deletion Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 515/591] apparmor: fix missing error check for rhashtable_insert_fast Greg Kroah-Hartman
` (80 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Artur Rojek, Geert Uytterhoeven,
John Paul Adrian Glaubitz, Sasha Levin
From: Artur Rojek <contact@artur-rojek.eu>
[ Upstream commit e82e47584847129a20b8c9f4a1dcde09374fb0e0 ]
Various SoCs of the SH3, SH4 and SH4A family, which use this driver,
feature a differing number of DMA channels, which can be distributed
between up to two DMAC modules. The existing implementation fails to
correctly accommodate for all those variations, resulting in wrong
channel offset calculations and leading to kernel panics.
Rewrite dma_base_addr() in order to properly calculate channel offsets
in a DMAC module. Fix dmaor_read_reg() and dmaor_write_reg(), so that
the correct DMAC module base is selected for the DMAOR register.
Fixes: 7f47c7189b3e8f19 ("sh: dma: More legacy cpu dma chainsawing.")
Signed-off-by: Artur Rojek <contact@artur-rojek.eu>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Link: https://lore.kernel.org/r/20230527164452.64797-2-contact@artur-rojek.eu
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sh/drivers/dma/dma-sh.c | 37 +++++++++++++++++++++++-------------
1 file changed, 24 insertions(+), 13 deletions(-)
diff --git a/arch/sh/drivers/dma/dma-sh.c b/arch/sh/drivers/dma/dma-sh.c
index 96c626c2cd0a4..306fba1564e5e 100644
--- a/arch/sh/drivers/dma/dma-sh.c
+++ b/arch/sh/drivers/dma/dma-sh.c
@@ -18,6 +18,18 @@
#include <cpu/dma-register.h>
#include <cpu/dma.h>
+/*
+ * Some of the SoCs feature two DMAC modules. In such a case, the channels are
+ * distributed equally among them.
+ */
+#ifdef SH_DMAC_BASE1
+#define SH_DMAC_NR_MD_CH (CONFIG_NR_ONCHIP_DMA_CHANNELS / 2)
+#else
+#define SH_DMAC_NR_MD_CH CONFIG_NR_ONCHIP_DMA_CHANNELS
+#endif
+
+#define SH_DMAC_CH_SZ 0x10
+
/*
* Define the default configuration for dual address memory-memory transfer.
* The 0x400 value represents auto-request, external->external.
@@ -29,7 +41,7 @@ static unsigned long dma_find_base(unsigned int chan)
unsigned long base = SH_DMAC_BASE0;
#ifdef SH_DMAC_BASE1
- if (chan >= 6)
+ if (chan >= SH_DMAC_NR_MD_CH)
base = SH_DMAC_BASE1;
#endif
@@ -40,13 +52,13 @@ static unsigned long dma_base_addr(unsigned int chan)
{
unsigned long base = dma_find_base(chan);
- /* Normalize offset calculation */
- if (chan >= 9)
- chan -= 6;
- if (chan >= 4)
- base += 0x10;
+ chan = (chan % SH_DMAC_NR_MD_CH) * SH_DMAC_CH_SZ;
+
+ /* DMAOR is placed inside the channel register space. Step over it. */
+ if (chan >= DMAOR)
+ base += SH_DMAC_CH_SZ;
- return base + (chan * 0x10);
+ return base + chan;
}
#ifdef CONFIG_SH_DMA_IRQ_MULTI
@@ -250,12 +262,11 @@ static int sh_dmac_get_dma_residue(struct dma_channel *chan)
#define NR_DMAOR 1
#endif
-/*
- * DMAOR bases are broken out amongst channel groups. DMAOR0 manages
- * channels 0 - 5, DMAOR1 6 - 11 (optional).
- */
-#define dmaor_read_reg(n) __raw_readw(dma_find_base((n)*6))
-#define dmaor_write_reg(n, data) __raw_writew(data, dma_find_base(n)*6)
+#define dmaor_read_reg(n) __raw_readw(dma_find_base((n) * \
+ SH_DMAC_NR_MD_CH) + DMAOR)
+#define dmaor_write_reg(n, data) __raw_writew(data, \
+ dma_find_base((n) * \
+ SH_DMAC_NR_MD_CH) + DMAOR)
static inline int dmaor_reset(int no)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 515/591] apparmor: fix missing error check for rhashtable_insert_fast
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 514/591] sh: dma: Fix DMA channel offset calculation Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 516/591] i2c: xiic: Dont try to handle more interrupt events after error Greg Kroah-Hartman
` (79 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danila Chernetsov, John Johansen,
Sasha Levin
From: Danila Chernetsov <listdansp@mail.ru>
[ Upstream commit 000518bc5aef25d3f703592a0296d578c98b1517 ]
rhashtable_insert_fast() could return err value when memory allocation is
failed. but unpack_profile() do not check values and this always returns
success value. This patch just adds error check code.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: e025be0f26d5 ("apparmor: support querying extended trusted helper extra data")
Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/policy_unpack.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 9d26bbb901338..9c3fec2c7cf6b 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -917,8 +917,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
goto fail;
}
- rhashtable_insert_fast(profile->data, &data->head,
- profile->data->p);
+ if (rhashtable_insert_fast(profile->data, &data->head,
+ profile->data->p)) {
+ kfree_sensitive(data->key);
+ kfree_sensitive(data);
+ info = "failed to insert data to table";
+ goto fail;
+ }
}
if (!unpack_nameX(e, AA_STRUCTEND, NULL)) {
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 516/591] i2c: xiic: Dont try to handle more interrupt events after error
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 515/591] apparmor: fix missing error check for rhashtable_insert_fast Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 517/591] dm: fix undue/missing spaces Greg Kroah-Hartman
` (78 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Hancock, Andi Shyti,
Wolfram Sang, Sasha Levin
From: Robert Hancock <robert.hancock@calian.com>
[ Upstream commit cb6e45c9a0ad9e0f8664fd06db0227d185dc76ab ]
In xiic_process, it is possible that error events such as arbitration
lost or TX error can be raised in conjunction with other interrupt flags
such as TX FIFO empty or bus not busy. Error events result in the
controller being reset and the error returned to the calling request,
but the function could potentially try to keep handling the other
events, such as by writing more messages into the TX FIFO. Since the
transaction has already failed, this is not helpful and will just cause
issues.
This problem has been present ever since:
commit 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr")
which allowed non-error events to be handled after errors, but became
more obvious after:
commit 743e227a8959 ("i2c: xiic: Defer xiic_wakeup() and
__xiic_start_xfer() in xiic_process()")
which reworked the code to add a WARN_ON which triggers if both the
xfer_more and wakeup_req flags were set, since this combination is
not supposed to happen, but was occurring in this scenario.
Skip further interrupt handling after error flags are detected to avoid
this problem.
Fixes: 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr")
Signed-off-by: Robert Hancock <robert.hancock@calian.com>
Acked-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-xiic.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
index effae4d467291..b41a6709e47f2 100644
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -431,6 +431,8 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
wakeup_req = 1;
wakeup_code = STATE_ERROR;
}
+ /* don't try to handle other events */
+ goto out;
}
if (pend & XIIC_INTR_RX_FULL_MASK) {
/* Receive register/FIFO is full */
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 517/591] dm: fix undue/missing spaces
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 516/591] i2c: xiic: Dont try to handle more interrupt events after error Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 518/591] dm: avoid split of quoted strings where possible Greg Kroah-Hartman
` (77 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heinz Mauelshagen, Mike Snitzer,
Sasha Levin
From: Heinz Mauelshagen <heinzm@redhat.com>
[ Upstream commit 43be9c743c2553519c2093d1798b542f28095a51 ]
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Stable-dep-of: 249bed821b4d ("dm ioctl: Avoid double-fetch of version")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-ioctl.c | 4 ++--
drivers/md/dm-mpath.c | 2 +-
drivers/md/dm-ps-service-time.c | 3 +--
drivers/md/dm-snap.c | 6 +++---
drivers/md/dm-table.c | 2 +-
drivers/md/dm-uevent.h | 2 +-
drivers/md/dm-writecache.c | 4 ++--
drivers/md/dm-zoned-metadata.c | 2 +-
8 files changed, 12 insertions(+), 13 deletions(-)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 6ae1c19b82433..9fc4a5d51b3fc 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1572,7 +1572,7 @@ static void retrieve_deps(struct dm_table *table,
/*
* Count the devices.
*/
- list_for_each (tmp, dm_table_get_devices(table))
+ list_for_each(tmp, dm_table_get_devices(table))
count++;
/*
@@ -1589,7 +1589,7 @@ static void retrieve_deps(struct dm_table *table,
*/
deps->count = count;
count = 0;
- list_for_each_entry (dd, dm_table_get_devices(table), list)
+ list_for_each_entry(dd, dm_table_get_devices(table), list)
deps->dev[count++] = huge_encode_dev(dd->dm_dev->bdev->bd_dev);
param->data_size = param->data_start + needed;
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 91c25ad8eed84..66032ab3c4e92 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1086,7 +1086,7 @@ static int parse_hw_handler(struct dm_arg_set *as, struct multipath *m)
goto fail;
}
j = sprintf(p, "%d", hw_argc - 1);
- for (i = 0, p+=j+1; i <= hw_argc - 2; i++, p+=j+1)
+ for (i = 0, p += j + 1; i <= hw_argc - 2; i++, p += j + 1)
j = sprintf(p, "%s", as->argv[i]);
}
dm_consume_args(as, hw_argc - 1);
diff --git a/drivers/md/dm-ps-service-time.c b/drivers/md/dm-ps-service-time.c
index 84d26234dc053..eba2293be6864 100644
--- a/drivers/md/dm-ps-service-time.c
+++ b/drivers/md/dm-ps-service-time.c
@@ -127,8 +127,7 @@ static int st_add_path(struct path_selector *ps, struct dm_path *path,
* The valid range: 0-<ST_MAX_RELATIVE_THROUGHPUT>
* If not given, minimum value '1' is used.
* If '0' is given, the path isn't selected while
- * other paths having a positive value are
- * available.
+ * other paths having a positive value are available.
*/
if (argc > 2) {
*error = "service-time ps: incorrect number of arguments";
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index c64d987c544d7..cb80d03b37370 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -388,7 +388,7 @@ static struct origin *__lookup_origin(struct block_device *origin)
struct origin *o;
ol = &_origins[origin_hash(origin)];
- list_for_each_entry (o, ol, hash_list)
+ list_for_each_entry(o, ol, hash_list)
if (bdev_equal(o->bdev, origin))
return o;
@@ -407,7 +407,7 @@ static struct dm_origin *__lookup_dm_origin(struct block_device *origin)
struct dm_origin *o;
ol = &_dm_origins[origin_hash(origin)];
- list_for_each_entry (o, ol, hash_list)
+ list_for_each_entry(o, ol, hash_list)
if (bdev_equal(o->dev->bdev, origin))
return o;
@@ -2446,7 +2446,7 @@ static int __origin_write(struct list_head *snapshots, sector_t sector,
chunk_t chunk;
/* Do all the snapshots on this origin */
- list_for_each_entry (snap, snapshots, list) {
+ list_for_each_entry(snap, snapshots, list) {
/*
* Don't make new exceptions in a merging snapshot
* because it has effectively been deleted
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 3acded2f976db..337e667323c4a 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -211,7 +211,7 @@ static struct dm_dev_internal *find_device(struct list_head *l, dev_t dev)
{
struct dm_dev_internal *dd;
- list_for_each_entry (dd, l, list)
+ list_for_each_entry(dd, l, list)
if (dd->dm_dev->bdev->bd_dev == dev)
return dd;
diff --git a/drivers/md/dm-uevent.h b/drivers/md/dm-uevent.h
index 2c9ba561fd8e9..12a5d4fb7d441 100644
--- a/drivers/md/dm-uevent.h
+++ b/drivers/md/dm-uevent.h
@@ -3,7 +3,7 @@
* Device Mapper Uevent Support
*
* Copyright IBM Corporation, 2007
- * Author: Mike Anderson <andmike@linux.vnet.ibm.com>
+ * Author: Mike Anderson <andmike@linux.vnet.ibm.com>
*/
#ifndef DM_UEVENT_H
#define DM_UEVENT_H
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 431c84595ddb7..c6ff43a8f0b25 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -85,12 +85,12 @@ struct wc_entry {
unsigned short wc_list_contiguous;
bool write_in_progress
#if BITS_PER_LONG == 64
- :1
+ : 1
#endif
;
unsigned long index
#if BITS_PER_LONG == 64
- :47
+ : 47
#endif
;
unsigned long age;
diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
index c795ea7da7917..13070c25adc3d 100644
--- a/drivers/md/dm-zoned-metadata.c
+++ b/drivers/md/dm-zoned-metadata.c
@@ -1013,7 +1013,7 @@ static int dmz_check_sb(struct dmz_metadata *zmd, struct dmz_sb *dsb,
}
sb_block = le64_to_cpu(sb->sb_block);
- if (sb_block != (u64)dsb->zone->id << zmd->zone_nr_blocks_shift ) {
+ if (sb_block != (u64)dsb->zone->id << zmd->zone_nr_blocks_shift) {
dmz_dev_err(dev, "Invalid superblock position "
"(is %llu expected %llu)",
sb_block,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 518/591] dm: avoid split of quoted strings where possible
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 517/591] dm: fix undue/missing spaces Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 519/591] dm ioctl: have constant on the right side of the test Greg Kroah-Hartman
` (76 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heinz Mauelshagen, Mike Snitzer,
Sasha Levin
From: Heinz Mauelshagen <heinzm@redhat.com>
[ Upstream commit 2e84fecf19e1694338deec8bf6c90ff84f8f31fb ]
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Stable-dep-of: 249bed821b4d ("dm ioctl: Avoid double-fetch of version")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-crypt.c | 3 +--
drivers/md/dm-ioctl.c | 6 ++----
drivers/md/dm-log-userspace-transfer.c | 5 ++---
drivers/md/dm-log.c | 3 +--
drivers/md/dm-raid1.c | 7 +++----
drivers/md/dm-snap-persistent.c | 6 ++----
drivers/md/dm-snap-transient.c | 3 +--
drivers/md/dm-snap.c | 21 +++++++--------------
drivers/md/dm-stripe.c | 12 ++++--------
drivers/md/dm-table.c | 18 ++++++------------
drivers/md/dm-thin-metadata.c | 8 ++++----
drivers/md/dm-zoned-metadata.c | 12 ++++--------
12 files changed, 37 insertions(+), 67 deletions(-)
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index ee269b1d09fac..ff515437d81e7 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -733,8 +733,7 @@ static int crypt_iv_eboiv_ctr(struct crypt_config *cc, struct dm_target *ti,
}
if (crypto_skcipher_blocksize(any_tfm(cc)) != cc->iv_size) {
- ti->error = "Block size of EBOIV cipher does "
- "not match IV size of block cipher";
+ ti->error = "Block size of EBOIV cipher does not match IV size of block cipher";
return -EINVAL;
}
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 9fc4a5d51b3fc..2ced382cdd70b 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -434,8 +434,7 @@ static struct mapped_device *dm_hash_rename(struct dm_ioctl *param,
hc = __get_name_cell(new);
if (hc) {
- DMERR("Unable to change %s on mapped device %s to one that "
- "already exists: %s",
+ DMERR("Unable to change %s on mapped device %s to one that already exists: %s",
change_uuid ? "uuid" : "name",
param->name, new);
dm_put(hc->md);
@@ -1822,8 +1821,7 @@ static int check_version(unsigned int cmd, struct dm_ioctl __user *user)
if ((DM_VERSION_MAJOR != version[0]) ||
(DM_VERSION_MINOR < version[1])) {
- DMERR("ioctl interface mismatch: "
- "kernel(%u.%u.%u), user(%u.%u.%u), cmd(%d)",
+ DMERR("ioctl interface mismatch: kernel(%u.%u.%u), user(%u.%u.%u), cmd(%d)",
DM_VERSION_MAJOR, DM_VERSION_MINOR,
DM_VERSION_PATCHLEVEL,
version[0], version[1], version[2], cmd);
diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
index 072559b709edd..ee5586e8e1c1e 100644
--- a/drivers/md/dm-log-userspace-transfer.c
+++ b/drivers/md/dm-log-userspace-transfer.c
@@ -108,9 +108,8 @@ static int fill_pkg(struct cn_msg *msg, struct dm_ulog_request *tfr)
if (pkg->error != -EAGAIN)
*(pkg->data_size) = 0;
} else if (tfr->data_size > *(pkg->data_size)) {
- DMERR("Insufficient space to receive package [%u] "
- "(%u vs %zu)", tfr->request_type,
- tfr->data_size, *(pkg->data_size));
+ DMERR("Insufficient space to receive package [%u] (%u vs %zu)",
+ tfr->request_type, tfr->data_size, *(pkg->data_size));
*(pkg->data_size) = 0;
pkg->error = -ENOSPC;
diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
index 159f2c05dfd3c..05141eea18d3c 100644
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -382,8 +382,7 @@ static int create_log_context(struct dm_dirty_log *log, struct dm_target *ti,
else if (!strcmp(argv[1], "nosync"))
sync = NOSYNC;
else {
- DMWARN("unrecognised sync argument to "
- "dirty region log: %s", argv[1]);
+ DMWARN("unrecognised sync argument to dirty region log: %s", argv[1]);
return -EINVAL;
}
}
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 8bd7e87d3538e..c38e63706d911 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -236,8 +236,8 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
* Better to issue requests to same failing device
* than to risk returning corrupt data.
*/
- DMERR("Primary mirror (%s) failed while out-of-sync: "
- "Reads may fail.", m->dev->name);
+ DMERR("Primary mirror (%s) failed while out-of-sync: Reads may fail.",
+ m->dev->name);
goto out;
}
@@ -517,8 +517,7 @@ static void read_callback(unsigned long error, void *context)
fail_mirror(m, DM_RAID1_READ_ERROR);
if (likely(default_ok(m)) || mirror_available(m->ms, bio)) {
- DMWARN_LIMIT("Read failure on mirror device %s. "
- "Trying alternative device.",
+ DMWARN_LIMIT("Read failure on mirror device %s. Trying alternative device.",
m->dev->name);
queue_bio(m->ms, bio, bio_data_dir(bio));
return;
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 5176810f5d243..80b95746a43e0 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -354,8 +354,7 @@ static int read_header(struct pstore *ps, int *new_snapshot)
return 0;
if (chunk_size_supplied)
- DMWARN("chunk size %u in device metadata overrides "
- "table chunk size of %u.",
+ DMWARN("chunk size %u in device metadata overrides table chunk size of %u.",
chunk_size, ps->store->chunk_size);
/* We had a bogus chunk_size. Fix stuff up. */
@@ -958,8 +957,7 @@ int dm_persistent_snapshot_init(void)
r = dm_exception_store_type_register(&_persistent_compat_type);
if (r) {
- DMERR("Unable to register old-style persistent exception "
- "store type");
+ DMERR("Unable to register old-style persistent exception store type");
dm_exception_store_type_unregister(&_persistent_type);
return r;
}
diff --git a/drivers/md/dm-snap-transient.c b/drivers/md/dm-snap-transient.c
index d83a0565bd101..11de107f5f462 100644
--- a/drivers/md/dm-snap-transient.c
+++ b/drivers/md/dm-snap-transient.c
@@ -140,8 +140,7 @@ int dm_transient_snapshot_init(void)
r = dm_exception_store_type_register(&_transient_compat_type);
if (r) {
- DMWARN("Unable to register old-style transient "
- "exception store type");
+ DMWARN("Unable to register old-style transient exception store type");
dm_exception_store_type_unregister(&_transient_type);
return r;
}
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index cb80d03b37370..b748901a4fb55 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -490,8 +490,7 @@ static int __validate_exception_handover(struct dm_snapshot *snap)
if ((__find_snapshots_sharing_cow(snap, &snap_src, &snap_dest,
&snap_merge) == 2) ||
snap_dest) {
- snap->ti->error = "Snapshot cow pairing for exception "
- "table handover failed";
+ snap->ti->error = "Snapshot cow pairing for exception table handover failed";
return -EINVAL;
}
@@ -518,8 +517,7 @@ static int __validate_exception_handover(struct dm_snapshot *snap)
if (!snap_src->store->type->prepare_merge ||
!snap_src->store->type->commit_merge) {
- snap->ti->error = "Snapshot exception store does not "
- "support snapshot-merge.";
+ snap->ti->error = "Snapshot exception store does not support snapshot-merge.";
return -EINVAL;
}
@@ -937,8 +935,7 @@ static int __remove_single_exception_chunk(struct dm_snapshot *s,
e = dm_lookup_exception(&s->complete, old_chunk);
if (!e) {
- DMERR("Corruption detected: exception for block %llu is "
- "on disk but not in memory",
+ DMERR("Corruption detected: exception for block %llu is on disk but not in memory",
(unsigned long long)old_chunk);
return -EINVAL;
}
@@ -965,8 +962,7 @@ static int __remove_single_exception_chunk(struct dm_snapshot *s,
e->new_chunk++;
} else if (old_chunk != e->old_chunk +
dm_consecutive_chunk_count(e)) {
- DMERR("Attempt to merge block %llu from the "
- "middle of a chunk range [%llu - %llu]",
+ DMERR("Attempt to merge block %llu from the middle of a chunk range [%llu - %llu]",
(unsigned long long)old_chunk,
(unsigned long long)e->old_chunk,
(unsigned long long)
@@ -1059,8 +1055,7 @@ static void snapshot_merge_next_chunks(struct dm_snapshot *s)
&new_chunk);
if (linear_chunks <= 0) {
if (linear_chunks < 0) {
- DMERR("Read error in exception store: "
- "shutting down merge");
+ DMERR("Read error in exception store: shutting down merge");
down_write(&s->lock);
s->merge_failed = true;
up_write(&s->lock);
@@ -2208,12 +2203,10 @@ static int snapshot_preresume(struct dm_target *ti)
if (snap_src && snap_dest) {
down_read(&snap_src->lock);
if (s == snap_src) {
- DMERR("Unable to resume snapshot source until "
- "handover completes.");
+ DMERR("Unable to resume snapshot source until handover completes.");
r = -EINVAL;
} else if (!dm_suspended(snap_src->ti)) {
- DMERR("Unable to perform snapshot handover until "
- "source is suspended.");
+ DMERR("Unable to perform snapshot handover until source is suspended.");
r = -EINVAL;
}
up_read(&snap_src->lock);
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index a81ed080730a7..547aefe85c076 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -108,15 +108,13 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
width = ti->len;
if (sector_div(width, stripes)) {
- ti->error = "Target length not divisible by "
- "number of stripes";
+ ti->error = "Target length not divisible by number of stripes";
return -EINVAL;
}
tmp_len = width;
if (sector_div(tmp_len, chunk_size)) {
- ti->error = "Target length not divisible by "
- "chunk size";
+ ti->error = "Target length not divisible by chunk size";
return -EINVAL;
}
@@ -124,15 +122,13 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
* Do we have enough arguments for that many stripes ?
*/
if (argc != (2 + 2 * stripes)) {
- ti->error = "Not enough destinations "
- "specified";
+ ti->error = "Not enough destinations specified";
return -EINVAL;
}
sc = kmalloc(struct_size(sc, stripe, stripes), GFP_KERNEL);
if (!sc) {
- ti->error = "Memory allocation for striped context "
- "failed";
+ ti->error = "Memory allocation for striped context failed";
return -ENOMEM;
}
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 337e667323c4a..288f600ee56dc 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -234,8 +234,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
return 0;
if ((start >= dev_size) || (start + len > dev_size)) {
- DMERR("%s: %pg too small for target: "
- "start=%llu, len=%llu, dev_size=%llu",
+ DMERR("%s: %pg too small for target: start=%llu, len=%llu, dev_size=%llu",
dm_device_name(ti->table->md), bdev,
(unsigned long long)start,
(unsigned long long)len,
@@ -280,8 +279,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
return 0;
if (start & (logical_block_size_sectors - 1)) {
- DMERR("%s: start=%llu not aligned to h/w "
- "logical block size %u of %pg",
+ DMERR("%s: start=%llu not aligned to h/w logical block size %u of %pg",
dm_device_name(ti->table->md),
(unsigned long long)start,
limits->logical_block_size, bdev);
@@ -289,8 +287,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
}
if (len & (logical_block_size_sectors - 1)) {
- DMERR("%s: len=%llu not aligned to h/w "
- "logical block size %u of %pg",
+ DMERR("%s: len=%llu not aligned to h/w logical block size %u of %pg",
dm_device_name(ti->table->md),
(unsigned long long)len,
limits->logical_block_size, bdev);
@@ -880,8 +877,7 @@ static int dm_table_determine_type(struct dm_table *t)
bio_based = 1;
if (bio_based && request_based) {
- DMERR("Inconsistent table: different target types"
- " can't be mixed up");
+ DMERR("Inconsistent table: different target types can't be mixed up");
return -EINVAL;
}
}
@@ -1184,8 +1180,7 @@ static int dm_table_register_integrity(struct dm_table *t)
* profile the new profile should not conflict.
*/
if (blk_integrity_compare(dm_disk(md), template_disk) < 0) {
- DMERR("%s: conflict with existing integrity profile: "
- "%s profile mismatch",
+ DMERR("%s: conflict with existing integrity profile: %s profile mismatch",
dm_device_name(t->md),
template_disk->disk_name);
return 1;
@@ -1698,8 +1693,7 @@ int dm_calculate_queue_limits(struct dm_table *t,
* for the table.
*/
if (blk_stack_limits(limits, &ti_limits, 0) < 0)
- DMWARN("%s: adding target device "
- "(start sect %llu len %llu) "
+ DMWARN("%s: adding target device (start sect %llu len %llu) "
"caused an alignment inconsistency",
dm_device_name(t->md),
(unsigned long long) ti->begin,
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 59eb1cb7037a0..4a0e15109997b 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -265,15 +265,15 @@ static int sb_check(struct dm_block_validator *v,
__le32 csum_le;
if (dm_block_location(b) != le64_to_cpu(disk_super->blocknr)) {
- DMERR("sb_check failed: blocknr %llu: "
- "wanted %llu", le64_to_cpu(disk_super->blocknr),
+ DMERR("sb_check failed: blocknr %llu: wanted %llu",
+ le64_to_cpu(disk_super->blocknr),
(unsigned long long)dm_block_location(b));
return -ENOTBLK;
}
if (le64_to_cpu(disk_super->magic) != THIN_SUPERBLOCK_MAGIC) {
- DMERR("sb_check failed: magic %llu: "
- "wanted %llu", le64_to_cpu(disk_super->magic),
+ DMERR("sb_check failed: magic %llu: wanted %llu",
+ le64_to_cpu(disk_super->magic),
(unsigned long long)THIN_SUPERBLOCK_MAGIC);
return -EILSEQ;
}
diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
index 13070c25adc3d..0548b5d925f74 100644
--- a/drivers/md/dm-zoned-metadata.c
+++ b/drivers/md/dm-zoned-metadata.c
@@ -1014,10 +1014,8 @@ static int dmz_check_sb(struct dmz_metadata *zmd, struct dmz_sb *dsb,
sb_block = le64_to_cpu(sb->sb_block);
if (sb_block != (u64)dsb->zone->id << zmd->zone_nr_blocks_shift) {
- dmz_dev_err(dev, "Invalid superblock position "
- "(is %llu expected %llu)",
- sb_block,
- (u64)dsb->zone->id << zmd->zone_nr_blocks_shift);
+ dmz_dev_err(dev, "Invalid superblock position (is %llu expected %llu)",
+ sb_block, (u64)dsb->zone->id << zmd->zone_nr_blocks_shift);
return -EINVAL;
}
if (zmd->sb_version > 1) {
@@ -1030,16 +1028,14 @@ static int dmz_check_sb(struct dmz_metadata *zmd, struct dmz_sb *dsb,
} else if (uuid_is_null(&zmd->uuid)) {
uuid_copy(&zmd->uuid, &sb_uuid);
} else if (!uuid_equal(&zmd->uuid, &sb_uuid)) {
- dmz_dev_err(dev, "mismatching DM-Zoned uuid, "
- "is %pUl expected %pUl",
+ dmz_dev_err(dev, "mismatching DM-Zoned uuid, is %pUl expected %pUl",
&sb_uuid, &zmd->uuid);
return -ENXIO;
}
if (!strlen(zmd->label))
memcpy(zmd->label, sb->dmz_label, BDEVNAME_SIZE);
else if (memcmp(zmd->label, sb->dmz_label, BDEVNAME_SIZE)) {
- dmz_dev_err(dev, "mismatching DM-Zoned label, "
- "is %s expected %s",
+ dmz_dev_err(dev, "mismatching DM-Zoned label, is %s expected %s",
sb->dmz_label, zmd->label);
return -ENXIO;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 519/591] dm ioctl: have constant on the right side of the test
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 518/591] dm: avoid split of quoted strings where possible Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:50 ` [PATCH 6.1 520/591] dm ioctl: Avoid double-fetch of version Greg Kroah-Hartman
` (75 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heinz Mauelshagen, Mike Snitzer,
Sasha Levin
From: Heinz Mauelshagen <heinzm@redhat.com>
[ Upstream commit 5cae0aa77397015f530aeb34f3ced32db6ac2875 ]
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Stable-dep-of: 249bed821b4d ("dm ioctl: Avoid double-fetch of version")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-ioctl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 2ced382cdd70b..6aeae095086d7 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1819,8 +1819,8 @@ static int check_version(unsigned int cmd, struct dm_ioctl __user *user)
if (copy_from_user(version, user->version, sizeof(version)))
return -EFAULT;
- if ((DM_VERSION_MAJOR != version[0]) ||
- (DM_VERSION_MINOR < version[1])) {
+ if ((version[0] != DM_VERSION_MAJOR) ||
+ (version[1] > DM_VERSION_MINOR)) {
DMERR("ioctl interface mismatch: kernel(%u.%u.%u), user(%u.%u.%u), cmd(%d)",
DM_VERSION_MAJOR, DM_VERSION_MINOR,
DM_VERSION_PATCHLEVEL,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 520/591] dm ioctl: Avoid double-fetch of version
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 519/591] dm ioctl: have constant on the right side of the test Greg Kroah-Hartman
@ 2023-07-16 19:50 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 521/591] extcon: usbc-tusb320: Convert to i2cs .probe_new() Greg Kroah-Hartman
` (74 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Demi Marie Obenour, Mike Snitzer,
Sasha Levin
From: Demi Marie Obenour <demi@invisiblethingslab.com>
[ Upstream commit 249bed821b4db6d95a99160f7d6d236ea5fe6362 ]
The version is fetched once in check_version(), which then does some
validation and then overwrites the version in userspace with the API
version supported by the kernel. copy_params() then fetches the version
from userspace *again*, and this time no validation is done. The result
is that the kernel's version number is completely controllable by
userspace, provided that userspace can win a race condition.
Fix this flaw by not copying the version back to the kernel the second
time. This is not exploitable as the version is not further used in the
kernel. However, it could become a problem if future patches start
relying on the version field.
Cc: stable@vger.kernel.org
Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-ioctl.c | 33 +++++++++++++++++++++------------
1 file changed, 21 insertions(+), 12 deletions(-)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 6aeae095086d7..2afd2d2a0f407 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1811,30 +1811,36 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
* As well as checking the version compatibility this always
* copies the kernel interface version out.
*/
-static int check_version(unsigned int cmd, struct dm_ioctl __user *user)
+static int check_version(unsigned int cmd, struct dm_ioctl __user *user,
+ struct dm_ioctl *kernel_params)
{
- uint32_t version[3];
int r = 0;
- if (copy_from_user(version, user->version, sizeof(version)))
+ /* Make certain version is first member of dm_ioctl struct */
+ BUILD_BUG_ON(offsetof(struct dm_ioctl, version) != 0);
+
+ if (copy_from_user(kernel_params->version, user->version, sizeof(kernel_params->version)))
return -EFAULT;
- if ((version[0] != DM_VERSION_MAJOR) ||
- (version[1] > DM_VERSION_MINOR)) {
+ if ((kernel_params->version[0] != DM_VERSION_MAJOR) ||
+ (kernel_params->version[1] > DM_VERSION_MINOR)) {
DMERR("ioctl interface mismatch: kernel(%u.%u.%u), user(%u.%u.%u), cmd(%d)",
DM_VERSION_MAJOR, DM_VERSION_MINOR,
DM_VERSION_PATCHLEVEL,
- version[0], version[1], version[2], cmd);
+ kernel_params->version[0],
+ kernel_params->version[1],
+ kernel_params->version[2],
+ cmd);
r = -EINVAL;
}
/*
* Fill in the kernel version.
*/
- version[0] = DM_VERSION_MAJOR;
- version[1] = DM_VERSION_MINOR;
- version[2] = DM_VERSION_PATCHLEVEL;
- if (copy_to_user(user->version, version, sizeof(version)))
+ kernel_params->version[0] = DM_VERSION_MAJOR;
+ kernel_params->version[1] = DM_VERSION_MINOR;
+ kernel_params->version[2] = DM_VERSION_PATCHLEVEL;
+ if (copy_to_user(user->version, kernel_params->version, sizeof(kernel_params->version)))
return -EFAULT;
return r;
@@ -1860,7 +1866,10 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
const size_t minimum_data_size = offsetof(struct dm_ioctl, data);
unsigned int noio_flag;
- if (copy_from_user(param_kernel, user, minimum_data_size))
+ /* check_version() already copied version from userspace, avoid TOCTOU */
+ if (copy_from_user((char *)param_kernel + sizeof(param_kernel->version),
+ (char __user *)user + sizeof(param_kernel->version),
+ minimum_data_size - sizeof(param_kernel->version)))
return -EFAULT;
if (param_kernel->data_size < minimum_data_size) {
@@ -1972,7 +1981,7 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us
* Check the interface version passed in. This also
* writes out the kernel's interface version.
*/
- r = check_version(cmd, user);
+ r = check_version(cmd, user, ¶m_kernel);
if (r)
return r;
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 521/591] extcon: usbc-tusb320: Convert to i2cs .probe_new()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2023-07-16 19:50 ` [PATCH 6.1 520/591] dm ioctl: Avoid double-fetch of version Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 522/591] extcon: usbc-tusb320: Unregister typec port on driver removal Greg Kroah-Hartman
` (73 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König, Chanwoo Choi,
Sasha Levin
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 5313121b22fd11db0d14f305c110168b8176efdc ]
The probe function doesn't make use of the i2c_device_id * parameter so it
can be trivially converted.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Stable-dep-of: 3adbaa30d973 ("extcon: usbc-tusb320: Unregister typec port on driver removal")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/extcon/extcon-usbc-tusb320.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/extcon/extcon-usbc-tusb320.c b/drivers/extcon/extcon-usbc-tusb320.c
index 9dfa545427ca1..b408ce989c223 100644
--- a/drivers/extcon/extcon-usbc-tusb320.c
+++ b/drivers/extcon/extcon-usbc-tusb320.c
@@ -428,8 +428,7 @@ static int tusb320_typec_probe(struct i2c_client *client,
return 0;
}
-static int tusb320_probe(struct i2c_client *client,
- const struct i2c_device_id *id)
+static int tusb320_probe(struct i2c_client *client)
{
struct tusb320_priv *priv;
const void *match_data;
@@ -502,7 +501,7 @@ static const struct of_device_id tusb320_extcon_dt_match[] = {
MODULE_DEVICE_TABLE(of, tusb320_extcon_dt_match);
static struct i2c_driver tusb320_extcon_driver = {
- .probe = tusb320_probe,
+ .probe_new = tusb320_probe,
.driver = {
.name = "extcon-tusb320",
.of_match_table = tusb320_extcon_dt_match,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 522/591] extcon: usbc-tusb320: Unregister typec port on driver removal
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 521/591] extcon: usbc-tusb320: Convert to i2cs .probe_new() Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 523/591] btrfs: do not BUG_ON() on tree mod log failure at balance_level() Greg Kroah-Hartman
` (72 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alvin Šipraga, Chanwoo Choi,
Sasha Levin
From: Alvin Šipraga <alsi@bang-olufsen.dk>
[ Upstream commit 3adbaa30d973093a4f37927baf9596cca51b593d ]
The driver can register a typec port if suitable firmware properties are
present. But if the driver is removed through sysfs unbind, rmmod or
similar, then it does not clean up after itself and the typec port
device remains registered. This can be seen in sysfs, where stale typec
ports get left over in /sys/class/typec.
In order to fix this we have to add an i2c_driver remove function and
call typec_unregister_port(), which is a no-op in the case where no
typec port is created and the pointer remains NULL.
In the process we should also put the fwnode_handle when the typec port
isn't registered anymore, including if an error occurs during probe. The
typec subsystem does not increase or decrease the reference counter for
us, so we track it in the driver's private data.
Note that the conditional check on TYPEC_PWR_MODE_PD was removed in the
probe path because a call to tusb320_set_adv_pwr_mode() will perform an
even more robust validation immediately after, hence there is no
functional change here.
Fixes: bf7571c00dca ("extcon: usbc-tusb320: Add USB TYPE-C support")
Cc: stable@vger.kernel.org
Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/extcon/extcon-usbc-tusb320.c | 42 ++++++++++++++++++++++------
1 file changed, 34 insertions(+), 8 deletions(-)
diff --git a/drivers/extcon/extcon-usbc-tusb320.c b/drivers/extcon/extcon-usbc-tusb320.c
index b408ce989c223..10dff1c512c41 100644
--- a/drivers/extcon/extcon-usbc-tusb320.c
+++ b/drivers/extcon/extcon-usbc-tusb320.c
@@ -78,6 +78,7 @@ struct tusb320_priv {
struct typec_capability cap;
enum typec_port_type port_type;
enum typec_pwr_opmode pwr_opmode;
+ struct fwnode_handle *connector_fwnode;
};
static const char * const tusb_attached_states[] = {
@@ -391,27 +392,25 @@ static int tusb320_typec_probe(struct i2c_client *client,
/* Type-C connector found. */
ret = typec_get_fw_cap(&priv->cap, connector);
if (ret)
- return ret;
+ goto err_put;
priv->port_type = priv->cap.type;
/* This goes into register 0x8 field CURRENT_MODE_ADVERTISE */
ret = fwnode_property_read_string(connector, "typec-power-opmode", &cap_str);
if (ret)
- return ret;
+ goto err_put;
ret = typec_find_pwr_opmode(cap_str);
if (ret < 0)
- return ret;
- if (ret == TYPEC_PWR_MODE_PD)
- return -EINVAL;
+ goto err_put;
priv->pwr_opmode = ret;
/* Initialize the hardware with the devicetree settings. */
ret = tusb320_set_adv_pwr_mode(priv);
if (ret)
- return ret;
+ goto err_put;
priv->cap.revision = USB_TYPEC_REV_1_1;
priv->cap.accessory[0] = TYPEC_ACCESSORY_AUDIO;
@@ -422,10 +421,25 @@ static int tusb320_typec_probe(struct i2c_client *client,
priv->cap.fwnode = connector;
priv->port = typec_register_port(&client->dev, &priv->cap);
- if (IS_ERR(priv->port))
- return PTR_ERR(priv->port);
+ if (IS_ERR(priv->port)) {
+ ret = PTR_ERR(priv->port);
+ goto err_put;
+ }
+
+ priv->connector_fwnode = connector;
return 0;
+
+err_put:
+ fwnode_handle_put(connector);
+
+ return ret;
+}
+
+static void tusb320_typec_remove(struct tusb320_priv *priv)
+{
+ typec_unregister_port(priv->port);
+ fwnode_handle_put(priv->connector_fwnode);
}
static int tusb320_probe(struct i2c_client *client)
@@ -438,7 +452,9 @@ static int tusb320_probe(struct i2c_client *client)
priv = devm_kzalloc(&client->dev, sizeof(*priv), GFP_KERNEL);
if (!priv)
return -ENOMEM;
+
priv->dev = &client->dev;
+ i2c_set_clientdata(client, priv);
priv->regmap = devm_regmap_init_i2c(client, &tusb320_regmap_config);
if (IS_ERR(priv->regmap))
@@ -489,10 +505,19 @@ static int tusb320_probe(struct i2c_client *client)
tusb320_irq_handler,
IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
client->name, priv);
+ if (ret)
+ tusb320_typec_remove(priv);
return ret;
}
+static void tusb320_remove(struct i2c_client *client)
+{
+ struct tusb320_priv *priv = i2c_get_clientdata(client);
+
+ tusb320_typec_remove(priv);
+}
+
static const struct of_device_id tusb320_extcon_dt_match[] = {
{ .compatible = "ti,tusb320", .data = &tusb320_ops, },
{ .compatible = "ti,tusb320l", .data = &tusb320l_ops, },
@@ -502,6 +527,7 @@ MODULE_DEVICE_TABLE(of, tusb320_extcon_dt_match);
static struct i2c_driver tusb320_extcon_driver = {
.probe_new = tusb320_probe,
+ .remove = tusb320_remove,
.driver = {
.name = "extcon-tusb320",
.of_match_table = tusb320_extcon_dt_match,
--
2.39.2
^ permalink raw reply related [flat|nested] 604+ messages in thread* [PATCH 6.1 523/591] btrfs: do not BUG_ON() on tree mod log failure at balance_level()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 522/591] extcon: usbc-tusb320: Unregister typec port on driver removal Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 524/591] i2c: qup: Add missing unwind goto in qup_i2c_probe() Greg Kroah-Hartman
` (71 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Filipe Manana,
David Sterba, Sasha Levin
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 39020d8abc7ec62c4de9b260e3d10d4a1c2478ce ]
At balance_level(), instead of doing a BUG_ON() in case we fail to record
tree mod log operations, do a transaction abort and return the error to
the callers. There's really no need for the BUG_ON() as we can release
all resources in this context, and we have to abort because other future
tree searches that use the tree mod log (btrfs_search_old_slot()) may get
inconsistent results if other operations modify the tree after that
failure and before the tree mod log based search.
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/ctree.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -935,7 +935,12 @@ static noinline int balance_level(struct
}
ret = btrfs_tree_mod_log_insert_root(root->node, child, true);
- BUG_ON(ret < 0);
+ if (ret < 0) {
+ btrfs_tree_unlock(child);
+ free_extent_buffer(child);
+ btrfs_abort_transaction(trans, ret);
+ goto enospc;
+ }
rcu_assign_pointer(root->node, child);
add_root_to_dirty_list(root);
@@ -1017,7 +1022,10 @@ static noinline int balance_level(struct
btrfs_node_key(right, &right_key, 0);
ret = btrfs_tree_mod_log_insert_key(parent, pslot + 1,
BTRFS_MOD_LOG_KEY_REPLACE, GFP_NOFS);
- BUG_ON(ret < 0);
+ if (ret < 0) {
+ btrfs_abort_transaction(trans, ret);
+ goto enospc;
+ }
btrfs_set_node_key(parent, &right_key, pslot + 1);
btrfs_mark_buffer_dirty(parent);
}
@@ -1063,7 +1071,10 @@ static noinline int balance_level(struct
btrfs_node_key(mid, &mid_key, 0);
ret = btrfs_tree_mod_log_insert_key(parent, pslot,
BTRFS_MOD_LOG_KEY_REPLACE, GFP_NOFS);
- BUG_ON(ret < 0);
+ if (ret < 0) {
+ btrfs_abort_transaction(trans, ret);
+ goto enospc;
+ }
btrfs_set_node_key(parent, &mid_key, pslot);
btrfs_mark_buffer_dirty(parent);
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 524/591] i2c: qup: Add missing unwind goto in qup_i2c_probe()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 523/591] btrfs: do not BUG_ON() on tree mod log failure at balance_level() Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 525/591] irqchip/loongson-pch-pic: Fix potential incorrect hwirq assignment Greg Kroah-Hartman
` (70 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuai Jiang, Dongliang Mu,
Andi Shyti, Wolfram Sang
From: Shuai Jiang <d202180596@hust.edu.cn>
commit cd9489623c29aa2f8cc07088168afb6e0d5ef06d upstream.
Smatch Warns:
drivers/i2c/busses/i2c-qup.c:1784 qup_i2c_probe()
warn: missing unwind goto?
The goto label "fail_runtime" and "fail" will disable qup->pclk,
but here qup->pclk failed to obtain, in order to be consistent,
change the direct return to goto label "fail_dma".
Fixes: 9cedf3b2f099 ("i2c: qup: Add bam dma capabilities")
Signed-off-by: Shuai Jiang <d202180596@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Cc: <stable@vger.kernel.org> # v4.6+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-qup.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
--- a/drivers/i2c/busses/i2c-qup.c
+++ b/drivers/i2c/busses/i2c-qup.c
@@ -1752,16 +1752,21 @@ nodma:
if (!clk_freq || clk_freq > I2C_MAX_FAST_MODE_PLUS_FREQ) {
dev_err(qup->dev, "clock frequency not supported %d\n",
clk_freq);
- return -EINVAL;
+ ret = -EINVAL;
+ goto fail_dma;
}
qup->base = devm_platform_ioremap_resource(pdev, 0);
- if (IS_ERR(qup->base))
- return PTR_ERR(qup->base);
+ if (IS_ERR(qup->base)) {
+ ret = PTR_ERR(qup->base);
+ goto fail_dma;
+ }
qup->irq = platform_get_irq(pdev, 0);
- if (qup->irq < 0)
- return qup->irq;
+ if (qup->irq < 0) {
+ ret = qup->irq;
+ goto fail_dma;
+ }
if (has_acpi_companion(qup->dev)) {
ret = device_property_read_u32(qup->dev,
@@ -1775,13 +1780,15 @@ nodma:
qup->clk = devm_clk_get(qup->dev, "core");
if (IS_ERR(qup->clk)) {
dev_err(qup->dev, "Could not get core clock\n");
- return PTR_ERR(qup->clk);
+ ret = PTR_ERR(qup->clk);
+ goto fail_dma;
}
qup->pclk = devm_clk_get(qup->dev, "iface");
if (IS_ERR(qup->pclk)) {
dev_err(qup->dev, "Could not get iface clock\n");
- return PTR_ERR(qup->pclk);
+ ret = PTR_ERR(qup->pclk);
+ goto fail_dma;
}
qup_i2c_enable_clocks(qup);
src_clk_freq = clk_get_rate(qup->clk);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 525/591] irqchip/loongson-pch-pic: Fix potential incorrect hwirq assignment
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 524/591] i2c: qup: Add missing unwind goto in qup_i2c_probe() Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 526/591] NFSD: add encoding of op_recall flag for write delegation Greg Kroah-Hartman
` (69 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huacai Chen, Liu Peibao, Jianmin Lv,
Marc Zyngier
From: Liu Peibao <liupeibao@loongson.cn>
commit 783422e704ca0fa41cb2fe9ed79e46b6fe7eae29 upstream.
In DeviceTree path, when ht_vec_base is not zero, the hwirq of PCH PIC
will be assigned incorrectly. Because when pch_pic_domain_translate()
adds the ht_vec_base to hwirq, the hwirq does not have the ht_vec_base
subtracted when calling irq_domain_set_info().
The ht_vec_base is designed for the parent irq chip/domain of the PCH PIC.
It seems not proper to deal this in callbacks of the PCH PIC domain and
let's put this back like the initial commit ef8c01eb64ca ("irqchip: Add
Loongson PCH PIC controller").
Fixes: bcdd75c596c8 ("irqchip/loongson-pch-pic: Add ACPI init support")
Cc: stable@vger.kernel.org
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Liu Peibao <liupeibao@loongson.cn>
Signed-off-by: Jianmin Lv <lvjianmin@loongson.cn>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230614115936.5950-3-lvjianmin@loongson.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-loongson-pch-pic.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/irqchip/irq-loongson-pch-pic.c
+++ b/drivers/irqchip/irq-loongson-pch-pic.c
@@ -162,7 +162,7 @@ static int pch_pic_domain_translate(stru
if (fwspec->param_count < 2)
return -EINVAL;
- *hwirq = fwspec->param[0] + priv->ht_vec_base;
+ *hwirq = fwspec->param[0];
*type = fwspec->param[1] & IRQ_TYPE_SENSE_MASK;
} else {
*hwirq = fwspec->param[0] - priv->gsi_base;
@@ -188,7 +188,7 @@ static int pch_pic_alloc(struct irq_doma
parent_fwspec.fwnode = domain->parent->fwnode;
parent_fwspec.param_count = 1;
- parent_fwspec.param[0] = hwirq;
+ parent_fwspec.param[0] = hwirq + priv->ht_vec_base;
err = irq_domain_alloc_irqs_parent(domain, virq, 1, &parent_fwspec);
if (err)
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 526/591] NFSD: add encoding of op_recall flag for write delegation
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 525/591] irqchip/loongson-pch-pic: Fix potential incorrect hwirq assignment Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 527/591] irqchip/loongson-pch-pic: Fix initialization of HT vector register Greg Kroah-Hartman
` (68 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dai Ngo, Jeff Layton, Chuck Lever
From: Dai Ngo <dai.ngo@oracle.com>
commit 58f5d894006d82ed7335e1c37182fbc5f08c2f51 upstream.
Modified nfsd4_encode_open to encode the op_recall flag properly
for OPEN result with write delegation granted.
Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -3872,7 +3872,7 @@ nfsd4_encode_open(struct nfsd4_compoundr
p = xdr_reserve_space(xdr, 32);
if (!p)
return nfserr_resource;
- *p++ = cpu_to_be32(0);
+ *p++ = cpu_to_be32(open->op_recall);
/*
* TODO: space_limit's in delegations
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 527/591] irqchip/loongson-pch-pic: Fix initialization of HT vector register
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 526/591] NFSD: add encoding of op_recall flag for write delegation Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 528/591] io_uring: wait interruptibly for request completions on exit Greg Kroah-Hartman
` (67 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huacai Chen, liuyun, Jianmin Lv,
Marc Zyngier
From: Jianmin Lv <lvjianmin@loongson.cn>
commit f679616565f1cf1a4acb245dbc0032dafcd40637 upstream.
In an ACPI-based dual-bridge system, IRQ of each bridge's
PCH PIC sent to CPU is always a zero-based number, which
means that the IRQ on PCH PIC of each bridge is mapped into
vector range from 0 to 63 of upstream irqchip(e.g. EIOINTC).
EIOINTC N: [0 ... 63 | 64 ... 255]
-------- ----------
^ ^
| |
PCH PIC N |
PCH MSI N
For example, the IRQ vector number of sata controller on
PCH PIC of each bridge is 16, which is sent to upstream
irqchip of EIOINTC when an interrupt occurs, which will set
bit 16 of EIOINTC. Since hwirq of 16 on EIOINTC has been
mapped to a irq_desc for sata controller during hierarchy
irq allocation, the related mapped IRQ will be found through
irq_resolve_mapping() in the IRQ domain of EIOINTC.
So, the IRQ number set in HT vector register should be fixed
to be a zero-based number.
Cc: stable@vger.kernel.org
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Co-developed-by: liuyun <liuyun@loongson.cn>
Signed-off-by: liuyun <liuyun@loongson.cn>
Signed-off-by: Jianmin Lv <lvjianmin@loongson.cn>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230614115936.5950-2-lvjianmin@loongson.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-loongson-pch-pic.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/irqchip/irq-loongson-pch-pic.c
+++ b/drivers/irqchip/irq-loongson-pch-pic.c
@@ -350,14 +350,12 @@ static int __init acpi_cascade_irqdomain
int __init pch_pic_acpi_init(struct irq_domain *parent,
struct acpi_madt_bio_pic *acpi_pchpic)
{
- int ret, vec_base;
+ int ret;
struct fwnode_handle *domain_handle;
if (find_pch_pic(acpi_pchpic->gsi_base) >= 0)
return 0;
- vec_base = acpi_pchpic->gsi_base - GSI_MIN_PCH_IRQ;
-
domain_handle = irq_domain_alloc_fwnode(&acpi_pchpic->address);
if (!domain_handle) {
pr_err("Unable to allocate domain handle\n");
@@ -365,7 +363,7 @@ int __init pch_pic_acpi_init(struct irq_
}
ret = pch_pic_init(acpi_pchpic->address, acpi_pchpic->size,
- vec_base, parent, domain_handle, acpi_pchpic->gsi_base);
+ 0, parent, domain_handle, acpi_pchpic->gsi_base);
if (ret < 0) {
irq_domain_free_fwnode(domain_handle);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 528/591] io_uring: wait interruptibly for request completions on exit
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 527/591] irqchip/loongson-pch-pic: Fix initialization of HT vector register Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 529/591] mmc: core: disable TRIM on Kingston EMMC04G-M627 Greg Kroah-Hartman
` (66 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe
From: Jens Axboe <axboe@kernel.dk>
commit 4826c59453b3b4677d6bf72814e7ababdea86949 upstream.
WHen the ring exits, cleanup is done and the final cancelation and
waiting on completions is done by io_ring_exit_work. That function is
invoked by kworker, which doesn't take any signals. Because of that, it
doesn't really matter if we wait for completions in TASK_INTERRUPTIBLE
or TASK_UNINTERRUPTIBLE state. However, it does matter to the hung task
detection checker!
Normally we expect cancelations and completions to happen rather
quickly. Some test cases, however, will exit the ring and park the
owning task stopped (eg via SIGSTOP). If the owning task needs to run
task_work to complete requests, then io_ring_exit_work won't make any
progress until the task is runnable again. Hence io_ring_exit_work can
trigger the hung task detection, which is particularly problematic if
panic-on-hung-task is enabled.
As the ring exit doesn't take signals to begin with, have it wait
interruptibly rather than uninterruptibly. io_uring has a separate
stuck-exit warning that triggers independently anyway, so we're not
really missing anything by making this switch.
Cc: stable@vger.kernel.org # 5.10+
Link: https://lore.kernel.org/r/b0e4aaef-7088-56ce-244c-976edeac0e66@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2748,7 +2748,18 @@ static __cold void io_ring_exit_work(str
/* there is little hope left, don't run it too often */
interval = HZ * 60;
}
- } while (!wait_for_completion_timeout(&ctx->ref_comp, interval));
+ /*
+ * This is really an uninterruptible wait, as it has to be
+ * complete. But it's also run from a kworker, which doesn't
+ * take signals, so it's fine to make it interruptible. This
+ * avoids scenarios where we knowingly can wait much longer
+ * on completions, for example if someone does a SIGSTOP on
+ * a task that needs to finish task_work to make this loop
+ * complete. That's a synthetic situation that should not
+ * cause a stuck task backtrace, and hence a potential panic
+ * on stuck tasks if that is enabled.
+ */
+ } while (!wait_for_completion_interruptible_timeout(&ctx->ref_comp, interval));
init_completion(&exit.completion);
init_task_work(&exit.task_work, io_tctx_exit_cb);
@@ -2772,7 +2783,12 @@ static __cold void io_ring_exit_work(str
continue;
mutex_unlock(&ctx->uring_lock);
- wait_for_completion(&exit.completion);
+ /*
+ * See comment above for
+ * wait_for_completion_interruptible_timeout() on why this
+ * wait is marked as interruptible.
+ */
+ wait_for_completion_interruptible(&exit.completion);
mutex_lock(&ctx->uring_lock);
}
mutex_unlock(&ctx->uring_lock);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 529/591] mmc: core: disable TRIM on Kingston EMMC04G-M627
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 528/591] io_uring: wait interruptibly for request completions on exit Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 530/591] mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M Greg Kroah-Hartman
` (65 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Robert Marko, Ulf Hansson
From: Robert Marko <robimarko@gmail.com>
commit f1738a1f816233e6dfc2407f24a31d596643fd90 upstream.
It seems that Kingston EMMC04G-M627 despite advertising TRIM support does
not work when the core is trying to use REQ_OP_WRITE_ZEROES.
We are seeing I/O errors in OpenWrt under 6.1 on Zyxel NBG7815 that we did
not previously have and tracked it down to REQ_OP_WRITE_ZEROES.
Trying to use fstrim seems to also throw errors like:
[93010.835112] I/O error, dev loop0, sector 16902 op 0x3:(DISCARD) flags 0x800 phys_seg 1 prio class 2
Disabling TRIM makes the error go away, so lets add a quirk for this eMMC
to disable TRIM.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230619193621.437358-1-robimarko@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/quirks.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -110,6 +110,13 @@ static const struct mmc_fixup __maybe_un
MMC_QUIRK_TRIM_BROKEN),
/*
+ * Kingston EMMC04G-M627 advertises TRIM but it does not seems to
+ * support being used to offload WRITE_ZEROES.
+ */
+ MMC_FIXUP("M62704", CID_MANFID_KINGSTON, 0x0100, add_quirk_mmc,
+ MMC_QUIRK_TRIM_BROKEN),
+
+ /*
* Some SD cards reports discard support while they don't
*/
MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd,
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 530/591] mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 529/591] mmc: core: disable TRIM on Kingston EMMC04G-M627 Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 531/591] mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS Greg Kroah-Hartman
` (64 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Robert Marko, Ulf Hansson
From: Robert Marko <robimarko@gmail.com>
commit dbfbddcddcebc9ce8a08757708d4e4a99d238e44 upstream.
It seems that Micron MTFC4GACAJCN-1M despite advertising TRIM support does
not work when the core is trying to use REQ_OP_WRITE_ZEROES.
We are seeing the following errors in OpenWrt under 6.1 on Qnap Qhora 301W
that we did not previously have and tracked it down to REQ_OP_WRITE_ZEROES:
[ 18.085950] I/O error, dev loop0, sector 596 op 0x9:(WRITE_ZEROES) flags 0x800 phys_seg 0 prio class 2
Disabling TRIM makes the error go away, so lets add a quirk for this eMMC
to disable TRIM.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230530213259.1776512-1-robimarko@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/quirks.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -117,6 +117,13 @@ static const struct mmc_fixup __maybe_un
MMC_QUIRK_TRIM_BROKEN),
/*
+ * Micron MTFC4GACAJCN-1M advertises TRIM but it does not seems to
+ * support being used to offload WRITE_ZEROES.
+ */
+ MMC_FIXUP("Q2J54A", CID_MANFID_MICRON, 0x014e, add_quirk_mmc,
+ MMC_QUIRK_TRIM_BROKEN),
+
+ /*
* Some SD cards reports discard support while they don't
*/
MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd,
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 531/591] mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 530/591] mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 532/591] mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used Greg Kroah-Hartman
` (63 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ulf Hansson, Linus Walleij,
Yann Gautier
From: Ulf Hansson <ulf.hansson@linaro.org>
commit 3108eb2e8aa7e955a9dd3a4c1bf19a7898961822 upstream.
All mmc host drivers should have the asynchronous probe option enabled, but
it seems like we failed to set it for mmci, so let's do that now.
Fixes: 21b2cec61c04 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Tested-by: Linus Walleij <linus.walleij@linaro.org>
Tested-by: Yann Gautier <yann.gautier@foss.st.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230612143730.210390-1-ulf.hansson@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/mmci.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -2456,6 +2456,7 @@ static struct amba_driver mmci_driver =
.drv = {
.name = DRIVER_NAME,
.pm = &mmci_dev_pm_ops,
+ .probe_type = PROBE_PREFER_ASYNCHRONOUS,
},
.probe = mmci_probe,
.remove = mmci_remove,
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 532/591] mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 531/591] mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 533/591] wifi: cfg80211: fix regulatory disconnect for non-MLO Greg Kroah-Hartman
` (62 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chevron Li, Adrian Hunter,
Ulf Hansson
From: Chevron Li <chevron.li@bayhubtech.com>
commit 20dbd07ef0a8bc29eb03d6a95258ac8934cbe52d upstream.
Bayhub SD host has hardware limitation:
1.The upper 32bit address is inhibited to be written at SD Host Register
[03E][13]=0 (32bits addressing) mode, is admitted to be written only at
SD Host Register [03E][13]=1 (64bits addressing) mode.
2.Because of above item#1, need to configure SD Host Register [03E][13] to
1(64bits addressing mode) before set 64bit ADMA system address's higher
32bits SD Host Register [05F~05C] if 64 bits addressing mode is used.
The hardware limitation is reasonable for below reasons:
1.Normal flow should set DMA working mode first, then do
DMA-transfer-related configuration, such as system address.
2.The hardware limitation may avoid the software to configure wrong higher
32bit address at 32bits addressing mode although it is redundant.
The change that set 32bits/64bits addressing mode before set ADMA address,
has no side-effect to other host IPs for below reason:
The setting order is reasonable and standard: DMA Mode setting first and
then DMA address setting. It meets all DMA setting sequence.
Signed-off-by: Chevron Li <chevron.li@bayhubtech.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230523111114.18124-1-chevron_li@126.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1181,6 +1181,8 @@ static void sdhci_prepare_data(struct sd
}
}
+ sdhci_config_dma(host);
+
if (host->flags & SDHCI_REQ_USE_DMA) {
int sg_cnt = sdhci_pre_dma_transfer(host, data, COOKIE_MAPPED);
@@ -1200,8 +1202,6 @@ static void sdhci_prepare_data(struct sd
}
}
- sdhci_config_dma(host);
-
if (!(host->flags & SDHCI_REQ_USE_DMA)) {
int flags;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 533/591] wifi: cfg80211: fix regulatory disconnect for non-MLO
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 532/591] mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 534/591] wifi: ath10k: Serialize wake_tx_queue ops Greg Kroah-Hartman
` (61 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johannes Berg
From: Johannes Berg <johannes.berg@intel.com>
commit b22552fcaf1970360005c805d7fba4046cf2ab4a upstream.
The multi-link loop here broke disconnect when multi-link
operation (MLO) isn't active for a given interface, since
in that case valid_links is 0 (indicating no links, i.e.
no MLO.)
Fix this by taking that into account properly and skipping
the link only if there are valid_links in the first place.
Cc: stable@vger.kernel.org
Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Link: https://lore.kernel.org/r/20230616222844.eb073d650c75.I72739923ef80919889ea9b50de9e4ba4baa836ae@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/reg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2390,7 +2390,7 @@ static bool reg_wdev_chan_valid(struct w
if (!wdev->valid_links && link > 0)
break;
- if (!(wdev->valid_links & BIT(link)))
+ if (wdev->valid_links && !(wdev->valid_links & BIT(link)))
continue;
switch (iftype) {
case NL80211_IFTYPE_AP:
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 534/591] wifi: ath10k: Serialize wake_tx_queue ops
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 533/591] wifi: cfg80211: fix regulatory disconnect for non-MLO Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 535/591] wifi: mt76: mt7921e: fix init command fail with enabled device Greg Kroah-Hartman
` (60 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Alexander Wetzel,
Kalle Valo
From: Alexander Wetzel <alexander@wetzel-home.de>
commit b719ebc37a1eacd4fd4f1264f731b016e5ec0c6e upstream.
Serialize the ath10k implementation of the wake_tx_queue ops.
ath10k_mac_op_wake_tx_queue() must not run concurrent since it's using
ieee80211_txq_schedule_start().
The intend of this patch is to sort out an issue discovered in the discussion
referred to by the Link tag.
I can't test it with real hardware and thus just implemented the per-ac queue
lock Felix suggested. One obvious alternative to the per-ac lock would be to
bring back the txqs_lock commit bb2edb733586 ("ath10k: migrate to mac80211 txq
scheduling") dropped.
Fixes: bb2edb733586 ("ath10k: migrate to mac80211 txq scheduling")
Reported-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/519b5bb9-8899-ae7c-4eff-f3116cdfdb56@nbd.name
CC: <stable@vger.kernel.org>
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230323165527.156414-1-alexander@wetzel-home.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath10k/core.c | 3 +++
drivers/net/wireless/ath/ath10k/core.h | 3 +++
drivers/net/wireless/ath/ath10k/mac.c | 6 ++++--
3 files changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -3634,6 +3634,9 @@ struct ath10k *ath10k_core_create(size_t
mutex_init(&ar->dump_mutex);
spin_lock_init(&ar->data_lock);
+ for (int ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+ spin_lock_init(&ar->queue_lock[ac]);
+
INIT_LIST_HEAD(&ar->peers);
init_waitqueue_head(&ar->peer_mapping_wq);
init_waitqueue_head(&ar->htt.empty_tx_wq);
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -1170,6 +1170,9 @@ struct ath10k {
/* protects shared structure data */
spinlock_t data_lock;
+ /* serialize wake_tx_queue calls per ac */
+ spinlock_t queue_lock[IEEE80211_NUM_ACS];
+
struct list_head arvifs;
struct list_head peers;
struct ath10k_peer *peer_map[ATH10K_MAX_NUM_PEER_IDS];
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -4732,13 +4732,14 @@ static void ath10k_mac_op_wake_tx_queue(
{
struct ath10k *ar = hw->priv;
int ret;
- u8 ac;
+ u8 ac = txq->ac;
ath10k_htt_tx_txq_update(hw, txq);
if (ar->htt.tx_q_state.mode != HTT_TX_MODE_SWITCH_PUSH)
return;
- ac = txq->ac;
+ spin_lock_bh(&ar->queue_lock[ac]);
+
ieee80211_txq_schedule_start(hw, ac);
txq = ieee80211_next_txq(hw, ac);
if (!txq)
@@ -4753,6 +4754,7 @@ static void ath10k_mac_op_wake_tx_queue(
ath10k_htt_tx_txq_update(hw, txq);
out:
ieee80211_txq_schedule_end(hw, ac);
+ spin_unlock_bh(&ar->queue_lock[ac]);
}
/* Must not be called with conf_mutex held as workers can use that also. */
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 535/591] wifi: mt76: mt7921e: fix init command fail with enabled device
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 534/591] wifi: ath10k: Serialize wake_tx_queue ops Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 536/591] bcache: fixup btree_cache_wait list damage Greg Kroah-Hartman
` (59 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kai-Heng Feng, Juan Martinez,
Leon Yen, Quan Zhou, Deren Wu, Jakub Kicinski
From: Quan Zhou <quan.zhou@mediatek.com>
commit 525c469e5de9bf7e53574396196e80fc716ac9eb upstream.
For some cases as below, we may encounter the unpreditable chip stats
in driver probe()
* The system reboot flow do not work properly, such as kernel oops while
rebooting, and then the driver do not go back to default status at
this moment.
* Similar to the flow above. If the device was enabled in BIOS or UEFI,
the system may switch to Linux without driver fully shutdown.
To avoid the problem, force push the device back to default in probe()
* mt7921e_mcu_fw_pmctrl() : return control privilege to chip side.
* mt7921_wfsys_reset() : cleanup chip config before resource init.
Error log
[59007.600714] mt7921e 0000:02:00.0: ASIC revision: 79220010
[59010.889773] mt7921e 0000:02:00.0: Message 00000010 (seq 1) timeout
[59010.889786] mt7921e 0000:02:00.0: Failed to get patch semaphore
[59014.217839] mt7921e 0000:02:00.0: Message 00000010 (seq 2) timeout
[59014.217852] mt7921e 0000:02:00.0: Failed to get patch semaphore
[59017.545880] mt7921e 0000:02:00.0: Message 00000010 (seq 3) timeout
[59017.545893] mt7921e 0000:02:00.0: Failed to get patch semaphore
[59020.874086] mt7921e 0000:02:00.0: Message 00000010 (seq 4) timeout
[59020.874099] mt7921e 0000:02:00.0: Failed to get patch semaphore
[59024.202019] mt7921e 0000:02:00.0: Message 00000010 (seq 5) timeout
[59024.202033] mt7921e 0000:02:00.0: Failed to get patch semaphore
[59027.530082] mt7921e 0000:02:00.0: Message 00000010 (seq 6) timeout
[59027.530096] mt7921e 0000:02:00.0: Failed to get patch semaphore
[59030.857888] mt7921e 0000:02:00.0: Message 00000010 (seq 7) timeout
[59030.857904] mt7921e 0000:02:00.0: Failed to get patch semaphore
[59034.185946] mt7921e 0000:02:00.0: Message 00000010 (seq 8) timeout
[59034.185961] mt7921e 0000:02:00.0: Failed to get patch semaphore
[59037.514249] mt7921e 0000:02:00.0: Message 00000010 (seq 9) timeout
[59037.514262] mt7921e 0000:02:00.0: Failed to get patch semaphore
[59040.842362] mt7921e 0000:02:00.0: Message 00000010 (seq 10) timeout
[59040.842375] mt7921e 0000:02:00.0: Failed to get patch semaphore
[59040.923845] mt7921e 0000:02:00.0: hardware init failed
Cc: stable@vger.kernel.org
Fixes: 5c14a5f944b9 ("mt76: mt7921: introduce mt7921e support")
Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Tested-by: Juan Martinez <juan.martinez@amd.com>
Co-developed-by: Leon Yen <leon.yen@mediatek.com>
Signed-off-by: Leon Yen <leon.yen@mediatek.com>
Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
Signed-off-by: Deren Wu <deren.wu@mediatek.com>
Message-ID: <39fcb7cee08d4ab940d38d82f21897483212483f.1688569385.git.deren.wu@mediatek.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7921/dma.c | 4 ----
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 8 --------
drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 8 ++++++++
3 files changed, 8 insertions(+), 12 deletions(-)
--- a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
@@ -231,10 +231,6 @@ int mt7921_dma_init(struct mt7921_dev *d
if (ret)
return ret;
- ret = mt7921_wfsys_reset(dev);
- if (ret)
- return ret;
-
/* init tx queue */
ret = mt76_connac_init_tx_queues(dev->phy.mt76, MT7921_TXQ_BAND0,
MT7921_TX_RING_SIZE,
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -449,12 +449,6 @@ static int mt7921_load_firmware(struct m
{
int ret;
- ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
- if (ret && mt76_is_mmio(&dev->mt76)) {
- dev_dbg(dev->mt76.dev, "Firmware is already download\n");
- goto fw_loaded;
- }
-
ret = mt76_connac2_load_patch(&dev->mt76, mt7921_patch_name(dev));
if (ret)
return ret;
@@ -477,8 +471,6 @@ static int mt7921_load_firmware(struct m
return -EIO;
}
-fw_loaded:
-
#ifdef CONFIG_PM
dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
#endif /* CONFIG_PM */
--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
@@ -316,6 +316,10 @@ static int mt7921_pci_probe(struct pci_d
bus_ops->rmw = mt7921_rmw;
dev->mt76.bus = bus_ops;
+ ret = mt7921e_mcu_fw_pmctrl(dev);
+ if (ret)
+ goto err_free_dev;
+
ret = __mt7921e_mcu_drv_pmctrl(dev);
if (ret)
goto err_free_dev;
@@ -324,6 +328,10 @@ static int mt7921_pci_probe(struct pci_d
(mt7921_l1_rr(dev, MT_HW_REV) & 0xff);
dev_info(mdev->dev, "ASIC revision: %04x\n", mdev->rev);
+ ret = mt7921_wfsys_reset(dev);
+ if (ret)
+ goto err_free_dev;
+
mt76_wr(dev, MT_WFDMA0_HOST_INT_ENA, 0);
mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 536/591] bcache: fixup btree_cache_wait list damage
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 535/591] wifi: mt76: mt7921e: fix init command fail with enabled device Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 537/591] bcache: Remove unnecessary NULL point check in node allocations Greg Kroah-Hartman
` (58 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mingzhe Zou, Coly Li, Jens Axboe
From: Mingzhe Zou <mingzhe.zou@easystack.cn>
commit f0854489fc07d2456f7cc71a63f4faf9c716ffbe upstream.
We get a kernel crash about "list_add corruption. next->prev should be
prev (ffff9c801bc01210), but was ffff9c77b688237c.
(next=ffffae586d8afe68)."
crash> struct list_head 0xffff9c801bc01210
struct list_head {
next = 0xffffae586d8afe68,
prev = 0xffffae586d8afe68
}
crash> struct list_head 0xffff9c77b688237c
struct list_head {
next = 0x0,
prev = 0x0
}
crash> struct list_head 0xffffae586d8afe68
struct list_head struct: invalid kernel virtual address: ffffae586d8afe68 type: "gdb_readmem_callback"
Cannot access memory at address 0xffffae586d8afe68
[230469.019492] Call Trace:
[230469.032041] prepare_to_wait+0x8a/0xb0
[230469.044363] ? bch_btree_keys_free+0x6c/0xc0 [escache]
[230469.056533] mca_cannibalize_lock+0x72/0x90 [escache]
[230469.068788] mca_alloc+0x2ae/0x450 [escache]
[230469.080790] bch_btree_node_get+0x136/0x2d0 [escache]
[230469.092681] bch_btree_check_thread+0x1e1/0x260 [escache]
[230469.104382] ? finish_wait+0x80/0x80
[230469.115884] ? bch_btree_check_recurse+0x1a0/0x1a0 [escache]
[230469.127259] kthread+0x112/0x130
[230469.138448] ? kthread_flush_work_fn+0x10/0x10
[230469.149477] ret_from_fork+0x35/0x40
bch_btree_check_thread() and bch_dirty_init_thread() may call
mca_cannibalize() to cannibalize other cached btree nodes. Only one thread
can do it at a time, so the op of other threads will be added to the
btree_cache_wait list.
We must call finish_wait() to remove op from btree_cache_wait before free
it's memory address. Otherwise, the list will be damaged. Also should call
bch_cannibalize_unlock() to release the btree_cache_alloc_lock and wake_up
other waiters.
Fixes: 8e7102273f59 ("bcache: make bch_btree_check() to be multithreaded")
Fixes: b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded")
Cc: stable@vger.kernel.org
Signed-off-by: Mingzhe Zou <mingzhe.zou@easystack.cn>
Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20230615121223.22502-7-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/bcache/btree.c | 11 ++++++++++-
drivers/md/bcache/btree.h | 1 +
drivers/md/bcache/writeback.c | 10 ++++++++++
3 files changed, 21 insertions(+), 1 deletion(-)
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -885,7 +885,7 @@ static struct btree *mca_cannibalize(str
* cannibalize_bucket() will take. This means every time we unlock the root of
* the btree, we need to release this lock if we have it held.
*/
-static void bch_cannibalize_unlock(struct cache_set *c)
+void bch_cannibalize_unlock(struct cache_set *c)
{
spin_lock(&c->btree_cannibalize_lock);
if (c->btree_cache_alloc_lock == current) {
@@ -1968,6 +1968,15 @@ static int bch_btree_check_thread(void *
c->gc_stats.nodes++;
bch_btree_op_init(&op, 0);
ret = bcache_btree(check_recurse, p, c->root, &op);
+ /*
+ * The op may be added to cache_set's btree_cache_wait
+ * in mca_cannibalize(), must ensure it is removed from
+ * the list and release btree_cache_alloc_lock before
+ * free op memory.
+ * Otherwise, the btree_cache_wait will be damaged.
+ */
+ bch_cannibalize_unlock(c);
+ finish_wait(&c->btree_cache_wait, &(&op)->wait);
if (ret)
goto out;
}
--- a/drivers/md/bcache/btree.h
+++ b/drivers/md/bcache/btree.h
@@ -282,6 +282,7 @@ void bch_initial_gc_finish(struct cache_
void bch_moving_gc(struct cache_set *c);
int bch_btree_check(struct cache_set *c);
void bch_initial_mark_key(struct cache_set *c, int level, struct bkey *k);
+void bch_cannibalize_unlock(struct cache_set *c);
static inline void wake_up_gc(struct cache_set *c)
{
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -890,6 +890,16 @@ static int bch_root_node_dirty_init(stru
if (ret < 0)
pr_warn("sectors dirty init failed, ret=%d!\n", ret);
+ /*
+ * The op may be added to cache_set's btree_cache_wait
+ * in mca_cannibalize(), must ensure it is removed from
+ * the list and release btree_cache_alloc_lock before
+ * free op memory.
+ * Otherwise, the btree_cache_wait will be damaged.
+ */
+ bch_cannibalize_unlock(c);
+ finish_wait(&c->btree_cache_wait, &(&op.op)->wait);
+
return ret;
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 537/591] bcache: Remove unnecessary NULL point check in node allocations
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 536/591] bcache: fixup btree_cache_wait list damage Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 538/591] bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent Greg Kroah-Hartman
` (57 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zheng Wang, Coly Li, Jens Axboe
From: Zheng Wang <zyytlz.wz@163.com>
commit 028ddcac477b691dd9205c92f991cc15259d033e upstream.
Due to the previous fix of __bch_btree_node_alloc, the return value will
never be a NULL pointer. So IS_ERR is enough to handle the failure
situation. Fix it by replacing IS_ERR_OR_NULL check by an IS_ERR check.
Fixes: cafe56359144 ("bcache: A block layer cache")
Cc: stable@vger.kernel.org
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20230615121223.22502-5-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/bcache/btree.c | 10 +++++-----
drivers/md/bcache/super.c | 4 ++--
2 files changed, 7 insertions(+), 7 deletions(-)
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1138,7 +1138,7 @@ static struct btree *btree_node_alloc_re
{
struct btree *n = bch_btree_node_alloc(b->c, op, b->level, b->parent);
- if (!IS_ERR_OR_NULL(n)) {
+ if (!IS_ERR(n)) {
mutex_lock(&n->write_lock);
bch_btree_sort_into(&b->keys, &n->keys, &b->c->sort);
bkey_copy_key(&n->key, &b->key);
@@ -1340,7 +1340,7 @@ static int btree_gc_coalesce(struct btre
memset(new_nodes, 0, sizeof(new_nodes));
closure_init_stack(&cl);
- while (nodes < GC_MERGE_NODES && !IS_ERR_OR_NULL(r[nodes].b))
+ while (nodes < GC_MERGE_NODES && !IS_ERR(r[nodes].b))
keys += r[nodes++].keys;
blocks = btree_default_blocks(b->c) * 2 / 3;
@@ -1352,7 +1352,7 @@ static int btree_gc_coalesce(struct btre
for (i = 0; i < nodes; i++) {
new_nodes[i] = btree_node_alloc_replacement(r[i].b, NULL);
- if (IS_ERR_OR_NULL(new_nodes[i]))
+ if (IS_ERR(new_nodes[i]))
goto out_nocoalesce;
}
@@ -1487,7 +1487,7 @@ out_nocoalesce:
bch_keylist_free(&keylist);
for (i = 0; i < nodes; i++)
- if (!IS_ERR_OR_NULL(new_nodes[i])) {
+ if (!IS_ERR(new_nodes[i])) {
btree_node_free(new_nodes[i]);
rw_unlock(true, new_nodes[i]);
}
@@ -1669,7 +1669,7 @@ static int bch_btree_gc_root(struct btre
if (should_rewrite) {
n = btree_node_alloc_replacement(b, NULL);
- if (!IS_ERR_OR_NULL(n)) {
+ if (!IS_ERR(n)) {
bch_btree_node_write_sync(n);
bch_btree_set_root(n);
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1724,7 +1724,7 @@ static void cache_set_flush(struct closu
if (!IS_ERR_OR_NULL(c->gc_thread))
kthread_stop(c->gc_thread);
- if (!IS_ERR_OR_NULL(c->root))
+ if (!IS_ERR(c->root))
list_add(&c->root->list, &c->btree_cache);
/*
@@ -2088,7 +2088,7 @@ static int run_cache_set(struct cache_se
err = "cannot allocate new btree root";
c->root = __bch_btree_node_alloc(c, NULL, 0, true, NULL);
- if (IS_ERR_OR_NULL(c->root))
+ if (IS_ERR(c->root))
goto err;
mutex_lock(&c->root->write_lock);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 538/591] bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 537/591] bcache: Remove unnecessary NULL point check in node allocations Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 539/591] watch_queue: prevent dangling pipe pointer Greg Kroah-Hartman
` (56 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zheng Wang, Coly Li, Jens Axboe
From: Zheng Wang <zyytlz.wz@163.com>
commit 80fca8a10b604afad6c14213fdfd816c4eda3ee4 upstream.
In some specific situations, the return value of __bch_btree_node_alloc
may be NULL. This may lead to a potential NULL pointer dereference in
caller function like a calling chain :
btree_split->bch_btree_node_alloc->__bch_btree_node_alloc.
Fix it by initializing the return value in __bch_btree_node_alloc.
Fixes: cafe56359144 ("bcache: A block layer cache")
Cc: stable@vger.kernel.org
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20230615121223.22502-6-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/bcache/btree.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1090,10 +1090,12 @@ struct btree *__bch_btree_node_alloc(str
struct btree *parent)
{
BKEY_PADDED(key) k;
- struct btree *b = ERR_PTR(-EAGAIN);
+ struct btree *b;
mutex_lock(&c->bucket_lock);
retry:
+ /* return ERR_PTR(-EAGAIN) when it fails */
+ b = ERR_PTR(-EAGAIN);
if (__bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, wait))
goto err;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 539/591] watch_queue: prevent dangling pipe pointer
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 538/591] bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 540/591] um: Use HOST_DIR for mrproper Greg Kroah-Hartman
` (55 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siddh Raman Pant, David Howells,
Christian Brauner
From: Siddh Raman Pant <code@siddh.me>
commit 943211c87427f25bd22e0e63849fb486bb5f87fa upstream.
NULL the dangling pipe reference while clearing watch_queue.
If not done, a reference to a freed pipe remains in the watch_queue,
as this function is called before freeing a pipe in free_pipe_info()
(see line 834 of fs/pipe.c).
The sole use of wqueue->defunct is for checking if the watch queue has
been cleared, but wqueue->pipe is also NULLed while clearing.
Thus, wqueue->defunct is superfluous, as wqueue->pipe can be checked
for NULL. Hence, the former can be removed.
Tested with keyutils testsuite.
Cc: stable@vger.kernel.org # 6.1
Signed-off-by: Siddh Raman Pant <code@siddh.me>
Acked-by: David Howells <dhowells@redhat.com>
Message-Id: <20230605143616.640517-1-code@siddh.me>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/watch_queue.h | 3 +--
kernel/watch_queue.c | 12 ++++++------
2 files changed, 7 insertions(+), 8 deletions(-)
--- a/include/linux/watch_queue.h
+++ b/include/linux/watch_queue.h
@@ -38,7 +38,7 @@ struct watch_filter {
struct watch_queue {
struct rcu_head rcu;
struct watch_filter __rcu *filter;
- struct pipe_inode_info *pipe; /* The pipe we're using as a buffer */
+ struct pipe_inode_info *pipe; /* Pipe we use as a buffer, NULL if queue closed */
struct hlist_head watches; /* Contributory watches */
struct page **notes; /* Preallocated notifications */
unsigned long *notes_bitmap; /* Allocation bitmap for notes */
@@ -46,7 +46,6 @@ struct watch_queue {
spinlock_t lock;
unsigned int nr_notes; /* Number of notes */
unsigned int nr_pages; /* Number of pages in notes[] */
- bool defunct; /* T when queues closed */
};
/*
--- a/kernel/watch_queue.c
+++ b/kernel/watch_queue.c
@@ -43,7 +43,7 @@ MODULE_LICENSE("GPL");
static inline bool lock_wqueue(struct watch_queue *wqueue)
{
spin_lock_bh(&wqueue->lock);
- if (unlikely(wqueue->defunct)) {
+ if (unlikely(!wqueue->pipe)) {
spin_unlock_bh(&wqueue->lock);
return false;
}
@@ -105,9 +105,6 @@ static bool post_one_notification(struct
unsigned int head, tail, mask, note, offset, len;
bool done = false;
- if (!pipe)
- return false;
-
spin_lock_irq(&pipe->rd_wait.lock);
mask = pipe->ring_size - 1;
@@ -604,8 +601,11 @@ void watch_queue_clear(struct watch_queu
rcu_read_lock();
spin_lock_bh(&wqueue->lock);
- /* Prevent new notifications from being stored. */
- wqueue->defunct = true;
+ /*
+ * This pipe can be freed by callers like free_pipe_info().
+ * Removing this reference also prevents new notifications.
+ */
+ wqueue->pipe = NULL;
while (!hlist_empty(&wqueue->watches)) {
watch = hlist_entry(wqueue->watches.first, struct watch, queue_node);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 540/591] um: Use HOST_DIR for mrproper
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 539/591] watch_queue: prevent dangling pipe pointer Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 541/591] integrity: Fix possible multiple allocation in integrity_inode_get() Greg Kroah-Hartman
` (54 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Weinberger, Anton Ivanov,
Johannes Berg, Azeem Shaikh, linux-um, Kees Cook
From: Kees Cook <keescook@chromium.org>
commit a5a319ec2c2236bb96d147c16196d2f1f3799301 upstream.
When HEADER_ARCH was introduced, the MRPROPER_FILES (then MRPROPER_DIRS)
list wasn't adjusted, leaving SUBARCH as part of the path argument.
This resulted in the "mrproper" target not cleaning up arch/x86/... when
SUBARCH was specified. Since HOST_DIR is arch/$(HEADER_ARCH), use it
instead to get the correct path.
Cc: Richard Weinberger <richard@nod.at>
Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Azeem Shaikh <azeemshaikh38@gmail.com>
Cc: linux-um@lists.infradead.org
Fixes: 7bbe7204e937 ("um: merge Makefile-{i386,x86_64}")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230606222442.never.807-kees@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/um/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -148,7 +148,7 @@ export LDFLAGS_vmlinux := $(LDFLAGS_EXEC
# When cleaning we don't include .config, so we don't include
# TT or skas makefiles and don't clean skas_ptregs.h.
CLEAN_FILES += linux x.i gmon.out
-MRPROPER_FILES += arch/$(SUBARCH)/include/generated
+MRPROPER_FILES += $(HOST_DIR)/include/generated
archclean:
@find . \( -name '*.bb' -o -name '*.bbg' -o -name '*.da' \
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 541/591] integrity: Fix possible multiple allocation in integrity_inode_get()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 540/591] um: Use HOST_DIR for mrproper Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 542/591] autofs: use flexible array in ioctl structure Greg Kroah-Hartman
` (53 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tianjia Zhang, Dmitry Kasatkin,
Mimi Zohar
From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
commit 9df6a4870dc371136e90330cfbbc51464ee66993 upstream.
When integrity_inode_get() is querying and inserting the cache, there
is a conditional race in the concurrent environment.
The race condition is the result of not properly implementing
"double-checked locking". In this case, it first checks to see if the
iint cache record exists before taking the lock, but doesn't check
again after taking the integrity_iint_lock.
Fixes: bf2276d10ce5 ("ima: allocating iint improvements")
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: <stable@vger.kernel.org> # v3.10+
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/integrity/iint.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/security/integrity/iint.c
+++ b/security/integrity/iint.c
@@ -43,12 +43,10 @@ static struct integrity_iint_cache *__in
else if (inode > iint->inode)
n = n->rb_right;
else
- break;
+ return iint;
}
- if (!n)
- return NULL;
- return iint;
+ return NULL;
}
/*
@@ -121,10 +119,15 @@ struct integrity_iint_cache *integrity_i
parent = *p;
test_iint = rb_entry(parent, struct integrity_iint_cache,
rb_node);
- if (inode < test_iint->inode)
+ if (inode < test_iint->inode) {
p = &(*p)->rb_left;
- else
+ } else if (inode > test_iint->inode) {
p = &(*p)->rb_right;
+ } else {
+ write_unlock(&integrity_iint_lock);
+ kmem_cache_free(iint_cache, iint);
+ return test_iint;
+ }
}
iint->inode = inode;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 542/591] autofs: use flexible array in ioctl structure
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 541/591] integrity: Fix possible multiple allocation in integrity_inode_get() Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 543/591] mm/damon/ops-common: atomically test and clear young on ptes and pmds Greg Kroah-Hartman
` (52 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kees Cook, Gustavo A. R. Silva,
Arnd Bergmann
From: Arnd Bergmann <arnd@arndb.de>
commit e910c8e3aa02dc456e2f4c32cb479523c326b534 upstream.
Commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") introduced a warning
for the autofs_dev_ioctl structure:
In function 'check_name',
inlined from 'validate_dev_ioctl' at fs/autofs/dev-ioctl.c:131:9,
inlined from '_autofs_dev_ioctl' at fs/autofs/dev-ioctl.c:624:8:
fs/autofs/dev-ioctl.c:33:14: error: 'strchr' reading 1 or more bytes from a region of size 0 [-Werror=stringop-overread]
33 | if (!strchr(name, '/'))
| ^~~~~~~~~~~~~~~~~
In file included from include/linux/auto_dev-ioctl.h:10,
from fs/autofs/autofs_i.h:10,
from fs/autofs/dev-ioctl.c:14:
include/uapi/linux/auto_dev-ioctl.h: In function '_autofs_dev_ioctl':
include/uapi/linux/auto_dev-ioctl.h:112:14: note: source object 'path' of size 0
112 | char path[0];
| ^~~~
This is easily fixed by changing the gnu 0-length array into a c99
flexible array. Since this is a uapi structure, we have to be careful
about possible regressions but this one should be fine as they are
equivalent here. While it would break building with ancient gcc versions
that predate c99, it helps building with --std=c99 and -Wpedantic builds
in user space, as well as non-gnu compilers. This means we probably
also want it fixed in stable kernels.
Cc: stable@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>
Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230523081944.581710-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/filesystems/autofs-mount-control.rst | 2 +-
Documentation/filesystems/autofs.rst | 2 +-
include/uapi/linux/auto_dev-ioctl.h | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
--- a/Documentation/filesystems/autofs-mount-control.rst
+++ b/Documentation/filesystems/autofs-mount-control.rst
@@ -196,7 +196,7 @@ information and return operation results
struct args_ismountpoint ismountpoint;
};
- char path[0];
+ char path[];
};
The ioctlfd field is a mount point file descriptor of an autofs mount
--- a/Documentation/filesystems/autofs.rst
+++ b/Documentation/filesystems/autofs.rst
@@ -467,7 +467,7 @@ Each ioctl is passed a pointer to an `au
struct args_ismountpoint ismountpoint;
};
- char path[0];
+ char path[];
};
For the **OPEN_MOUNT** and **IS_MOUNTPOINT** commands, the target
--- a/include/uapi/linux/auto_dev-ioctl.h
+++ b/include/uapi/linux/auto_dev-ioctl.h
@@ -109,7 +109,7 @@ struct autofs_dev_ioctl {
struct args_ismountpoint ismountpoint;
};
- char path[0];
+ char path[];
};
static inline void init_autofs_dev_ioctl(struct autofs_dev_ioctl *in)
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 543/591] mm/damon/ops-common: atomically test and clear young on ptes and pmds
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 542/591] autofs: use flexible array in ioctl structure Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 544/591] shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs Greg Kroah-Hartman
` (51 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryan Roberts, Zi Yan, SeongJae Park,
Mike Rapoport (IBM), Christoph Hellwig, Kirill A. Shutemov,
Lorenzo Stoakes, Matthew Wilcox (Oracle), Uladzislau Rezki (Sony),
Yu Zhao, Andrew Morton
From: Ryan Roberts <ryan.roberts@arm.com>
commit c11d34fa139e4b0fb4249a30f37b178353533fa1 upstream.
It is racy to non-atomically read a pte, then clear the young bit, then
write it back as this could discard dirty information. Further, it is bad
practice to directly set a pte entry within a table. Instead clearing
young must go through the arch-provided helper,
ptep_test_and_clear_young() to ensure it is modified atomically and to
give the arch code visibility and allow it to check (and potentially
modify) the operation.
Link: https://lkml.kernel.org/r/20230602092949.545577-3-ryan.roberts@arm.com
Fixes: 3f49584b262c ("mm/damon: implement primitives for the virtual memory address spaces").
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
Reviewed-by: Mike Rapoport (IBM) <rppt@kernel.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Uladzislau Rezki (Sony) <urezki@gmail.com>
Cc: Yu Zhao <yuzhao@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/ops-common.c | 16 ++++++----------
mm/damon/ops-common.h | 4 ++--
mm/damon/paddr.c | 4 ++--
mm/damon/vaddr.c | 4 ++--
4 files changed, 12 insertions(+), 16 deletions(-)
--- a/mm/damon/ops-common.c
+++ b/mm/damon/ops-common.c
@@ -33,7 +33,7 @@ struct page *damon_get_page(unsigned lon
return page;
}
-void damon_ptep_mkold(pte_t *pte, struct mm_struct *mm, unsigned long addr)
+void damon_ptep_mkold(pte_t *pte, struct vm_area_struct *vma, unsigned long addr)
{
bool referenced = false;
struct page *page = damon_get_page(pte_pfn(*pte));
@@ -41,13 +41,11 @@ void damon_ptep_mkold(pte_t *pte, struct
if (!page)
return;
- if (pte_young(*pte)) {
+ if (ptep_test_and_clear_young(vma, addr, pte))
referenced = true;
- *pte = pte_mkold(*pte);
- }
#ifdef CONFIG_MMU_NOTIFIER
- if (mmu_notifier_clear_young(mm, addr, addr + PAGE_SIZE))
+ if (mmu_notifier_clear_young(vma->vm_mm, addr, addr + PAGE_SIZE))
referenced = true;
#endif /* CONFIG_MMU_NOTIFIER */
@@ -58,7 +56,7 @@ void damon_ptep_mkold(pte_t *pte, struct
put_page(page);
}
-void damon_pmdp_mkold(pmd_t *pmd, struct mm_struct *mm, unsigned long addr)
+void damon_pmdp_mkold(pmd_t *pmd, struct vm_area_struct *vma, unsigned long addr)
{
#ifdef CONFIG_TRANSPARENT_HUGEPAGE
bool referenced = false;
@@ -67,13 +65,11 @@ void damon_pmdp_mkold(pmd_t *pmd, struct
if (!page)
return;
- if (pmd_young(*pmd)) {
+ if (pmdp_test_and_clear_young(vma, addr, pmd))
referenced = true;
- *pmd = pmd_mkold(*pmd);
- }
#ifdef CONFIG_MMU_NOTIFIER
- if (mmu_notifier_clear_young(mm, addr, addr + HPAGE_PMD_SIZE))
+ if (mmu_notifier_clear_young(vma->vm_mm, addr, addr + HPAGE_PMD_SIZE))
referenced = true;
#endif /* CONFIG_MMU_NOTIFIER */
--- a/mm/damon/ops-common.h
+++ b/mm/damon/ops-common.h
@@ -9,8 +9,8 @@
struct page *damon_get_page(unsigned long pfn);
-void damon_ptep_mkold(pte_t *pte, struct mm_struct *mm, unsigned long addr);
-void damon_pmdp_mkold(pmd_t *pmd, struct mm_struct *mm, unsigned long addr);
+void damon_ptep_mkold(pte_t *pte, struct vm_area_struct *vma, unsigned long addr);
+void damon_pmdp_mkold(pmd_t *pmd, struct vm_area_struct *vma, unsigned long addr);
int damon_cold_score(struct damon_ctx *c, struct damon_region *r,
struct damos *s);
--- a/mm/damon/paddr.c
+++ b/mm/damon/paddr.c
@@ -24,9 +24,9 @@ static bool __damon_pa_mkold(struct foli
while (page_vma_mapped_walk(&pvmw)) {
addr = pvmw.address;
if (pvmw.pte)
- damon_ptep_mkold(pvmw.pte, vma->vm_mm, addr);
+ damon_ptep_mkold(pvmw.pte, vma, addr);
else
- damon_pmdp_mkold(pvmw.pmd, vma->vm_mm, addr);
+ damon_pmdp_mkold(pvmw.pmd, vma, addr);
}
return true;
}
--- a/mm/damon/vaddr.c
+++ b/mm/damon/vaddr.c
@@ -311,7 +311,7 @@ static int damon_mkold_pmd_entry(pmd_t *
}
if (pmd_trans_huge(*pmd)) {
- damon_pmdp_mkold(pmd, walk->mm, addr);
+ damon_pmdp_mkold(pmd, walk->vma, addr);
spin_unlock(ptl);
return 0;
}
@@ -323,7 +323,7 @@ static int damon_mkold_pmd_entry(pmd_t *
pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
if (!pte_present(*pte))
goto out;
- damon_ptep_mkold(pte, walk->mm, addr);
+ damon_ptep_mkold(pte, walk->vma, addr);
out:
pte_unmap_unlock(pte, ptl);
return 0;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 544/591] shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 543/591] mm/damon/ops-common: atomically test and clear young on ptes and pmds Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 545/591] jffs2: reduce stack usage in jffs2_build_xattr_subsystem() Greg Kroah-Hartman
` (50 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roberto Sassu, Hugh Dickins,
David Howells, Al Viro, Andrew Morton
From: Roberto Sassu <roberto.sassu@huawei.com>
commit 36ce9d76b0a93bae799e27e4f5ac35478c676592 upstream.
As the ramfs-based tmpfs uses ramfs_init_fs_context() for the
init_fs_context method, which allocates fc->s_fs_info, use ramfs_kill_sb()
to free it and avoid a memory leak.
Link: https://lkml.kernel.org/r/20230607161523.2876433-1-roberto.sassu@huaweicloud.com
Fixes: c3b1b1cbf002 ("ramfs: add support for "mode=" mount option")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ramfs/inode.c | 2 +-
include/linux/ramfs.h | 1 +
mm/shmem.c | 2 +-
3 files changed, 3 insertions(+), 2 deletions(-)
--- a/fs/ramfs/inode.c
+++ b/fs/ramfs/inode.c
@@ -278,7 +278,7 @@ int ramfs_init_fs_context(struct fs_cont
return 0;
}
-static void ramfs_kill_sb(struct super_block *sb)
+void ramfs_kill_sb(struct super_block *sb)
{
kfree(sb->s_fs_info);
kill_litter_super(sb);
--- a/include/linux/ramfs.h
+++ b/include/linux/ramfs.h
@@ -7,6 +7,7 @@
struct inode *ramfs_get_inode(struct super_block *sb, const struct inode *dir,
umode_t mode, dev_t dev);
extern int ramfs_init_fs_context(struct fs_context *fc);
+extern void ramfs_kill_sb(struct super_block *sb);
#ifdef CONFIG_MMU
static inline int
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -4137,7 +4137,7 @@ static struct file_system_type shmem_fs_
.name = "tmpfs",
.init_fs_context = ramfs_init_fs_context,
.parameters = ramfs_fs_parameters,
- .kill_sb = kill_litter_super,
+ .kill_sb = ramfs_kill_sb,
.fs_flags = FS_USERNS_MOUNT,
};
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 545/591] jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 544/591] shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 546/591] fs: avoid empty option when generating legacy mount string Greg Kroah-Hartman
` (49 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Gardner, kernel test robot,
Ron Economos, Nathan Chancellor, Nick Desaulniers,
Fabian Frederick, Christian Marangi, Christian Brauner
From: Fabian Frederick <fabf@skynet.be>
commit 1168f095417643f663caa341211e117db552989f upstream.
Use kcalloc() for allocation/flush of 128 pointers table to
reduce stack usage.
Function now returns -ENOMEM or 0 on success.
stackusage
Before:
./fs/jffs2/xattr.c:775 jffs2_build_xattr_subsystem 1208
dynamic,bounded
After:
./fs/jffs2/xattr.c:775 jffs2_build_xattr_subsystem 192
dynamic,bounded
Also update definition when CONFIG_JFFS2_FS_XATTR is not enabled
Tested with an MTD mount point and some user set/getfattr.
Many current target on OpenWRT also suffer from a compilation warning
(that become an error with CONFIG_WERROR) with the following output:
fs/jffs2/xattr.c: In function 'jffs2_build_xattr_subsystem':
fs/jffs2/xattr.c:887:1: error: the frame size of 1088 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
887 | }
| ^
Using dynamic allocation fix this compilation warning.
Fixes: c9f700f840bd ("[JFFS2][XATTR] using 'delete marker' for xdatum/xref deletion")
Reported-by: Tim Gardner <tim.gardner@canonical.com>
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Ron Economos <re@w6rz.net>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Cc: stable@vger.kernel.org
Message-Id: <20230506045612.16616-1-ansuelsmth@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jffs2/build.c | 5 ++++-
fs/jffs2/xattr.c | 13 +++++++++----
fs/jffs2/xattr.h | 4 ++--
3 files changed, 15 insertions(+), 7 deletions(-)
--- a/fs/jffs2/build.c
+++ b/fs/jffs2/build.c
@@ -211,7 +211,10 @@ static int jffs2_build_filesystem(struct
ic->scan_dents = NULL;
cond_resched();
}
- jffs2_build_xattr_subsystem(c);
+ ret = jffs2_build_xattr_subsystem(c);
+ if (ret)
+ goto exit;
+
c->flags &= ~JFFS2_SB_FLAG_BUILDING;
dbg_fsbuild("FS build complete\n");
--- a/fs/jffs2/xattr.c
+++ b/fs/jffs2/xattr.c
@@ -772,10 +772,10 @@ void jffs2_clear_xattr_subsystem(struct
}
#define XREF_TMPHASH_SIZE (128)
-void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
+int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
{
struct jffs2_xattr_ref *ref, *_ref;
- struct jffs2_xattr_ref *xref_tmphash[XREF_TMPHASH_SIZE];
+ struct jffs2_xattr_ref **xref_tmphash;
struct jffs2_xattr_datum *xd, *_xd;
struct jffs2_inode_cache *ic;
struct jffs2_raw_node_ref *raw;
@@ -784,9 +784,12 @@ void jffs2_build_xattr_subsystem(struct
BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
+ xref_tmphash = kcalloc(XREF_TMPHASH_SIZE,
+ sizeof(struct jffs2_xattr_ref *), GFP_KERNEL);
+ if (!xref_tmphash)
+ return -ENOMEM;
+
/* Phase.1 : Merge same xref */
- for (i=0; i < XREF_TMPHASH_SIZE; i++)
- xref_tmphash[i] = NULL;
for (ref=c->xref_temp; ref; ref=_ref) {
struct jffs2_xattr_ref *tmp;
@@ -884,6 +887,8 @@ void jffs2_build_xattr_subsystem(struct
"%u of xref (%u dead, %u orphan) found.\n",
xdatum_count, xdatum_unchecked_count, xdatum_orphan_count,
xref_count, xref_dead_count, xref_orphan_count);
+ kfree(xref_tmphash);
+ return 0;
}
struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,
--- a/fs/jffs2/xattr.h
+++ b/fs/jffs2/xattr.h
@@ -71,7 +71,7 @@ static inline int is_xattr_ref_dead(stru
#ifdef CONFIG_JFFS2_FS_XATTR
extern void jffs2_init_xattr_subsystem(struct jffs2_sb_info *c);
-extern void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c);
+extern int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c);
extern void jffs2_clear_xattr_subsystem(struct jffs2_sb_info *c);
extern struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,
@@ -103,7 +103,7 @@ extern ssize_t jffs2_listxattr(struct de
#else
#define jffs2_init_xattr_subsystem(c)
-#define jffs2_build_xattr_subsystem(c)
+#define jffs2_build_xattr_subsystem(c) (0)
#define jffs2_clear_xattr_subsystem(c)
#define jffs2_xattr_do_crccheck_inode(c, ic)
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 546/591] fs: avoid empty option when generating legacy mount string
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 545/591] jffs2: reduce stack usage in jffs2_build_xattr_subsystem() Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 547/591] ext4: Remove ext4 locking of moved directory Greg Kroah-Hartman
` (48 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Christian Brauner
From: Thomas Weißschuh <linux@weissschuh.net>
commit 62176420274db5b5127cd7a0083a9aeb461756ee upstream.
As each option string fragment is always prepended with a comma it would
happen that the whole string always starts with a comma. This could be
interpreted by filesystem drivers as an empty option and may produce
errors.
For example the NTFS driver from ntfs.ko behaves like this and fails
when mounted via the new API.
Link: https://github.com/util-linux/util-linux/issues/2298
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Fixes: 3e1aeb00e6d1 ("vfs: Implement a filesystem superblock creation/configuration context")
Cc: stable@vger.kernel.org
Message-Id: <20230607-fs-empty-option-v1-1-20c8dbf4671b@weissschuh.net>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fs_context.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/fs_context.c
+++ b/fs/fs_context.c
@@ -561,7 +561,8 @@ static int legacy_parse_param(struct fs_
return -ENOMEM;
}
- ctx->legacy_data[size++] = ',';
+ if (size)
+ ctx->legacy_data[size++] = ',';
len = strlen(param->key);
memcpy(ctx->legacy_data + size, param->key, len);
size += len;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 547/591] ext4: Remove ext4 locking of moved directory
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 546/591] fs: avoid empty option when generating legacy mount string Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 548/591] Revert "f2fs: fix potential corruption when moving a directory" Greg Kroah-Hartman
` (47 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ted Tso, Jan Kara, Christian Brauner
From: Jan Kara <jack@suse.cz>
commit 3658840cd363f2be094f5dfd2f0b174a9055dd0f upstream.
Remove locking of moved directory in ext4_rename2(). We will take care
of it in VFS instead. This effectively reverts commit 0813299c586b
("ext4: Fix possible corruption when moving a directory") and followup
fixes.
CC: Ted Tso <tytso@mit.edu>
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20230601105830.13168-1-jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/namei.c | 17 ++---------------
1 file changed, 2 insertions(+), 15 deletions(-)
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3834,19 +3834,10 @@ static int ext4_rename(struct user_names
return retval;
}
- /*
- * We need to protect against old.inode directory getting converted
- * from inline directory format into a normal one.
- */
- if (S_ISDIR(old.inode->i_mode))
- inode_lock_nested(old.inode, I_MUTEX_NONDIR2);
-
old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de,
&old.inlined);
- if (IS_ERR(old.bh)) {
- retval = PTR_ERR(old.bh);
- goto unlock_moved_dir;
- }
+ if (IS_ERR(old.bh))
+ return PTR_ERR(old.bh);
/*
* Check for inode number is _not_ due to possible IO errors.
@@ -4043,10 +4034,6 @@ release_bh:
brelse(old.bh);
brelse(new.bh);
-unlock_moved_dir:
- if (S_ISDIR(old.inode->i_mode))
- inode_unlock(old.inode);
-
return retval;
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 548/591] Revert "f2fs: fix potential corruption when moving a directory"
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 547/591] ext4: Remove ext4 locking of moved directory Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 549/591] fs: Establish locking order for unrelated directories Greg Kroah-Hartman
` (46 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jaegeuk Kim, Jan Kara,
Christian Brauner
From: Jan Kara <jack@suse.cz>
commit cde3c9d7e2a359e337216855dcb333a19daaa436 upstream.
This reverts commit d94772154e524b329a168678836745d2773a6e02. The
locking is going to be provided by VFS.
CC: Jaegeuk Kim <jaegeuk@kernel.org>
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20230601105830.13168-3-jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/namei.c | 16 +---------------
1 file changed, 1 insertion(+), 15 deletions(-)
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -1002,20 +1002,12 @@ static int f2fs_rename(struct user_names
goto out;
}
- /*
- * Copied from ext4_rename: we need to protect against old.inode
- * directory getting converted from inline directory format into
- * a normal one.
- */
- if (S_ISDIR(old_inode->i_mode))
- inode_lock_nested(old_inode, I_MUTEX_NONDIR2);
-
err = -ENOENT;
old_entry = f2fs_find_entry(old_dir, &old_dentry->d_name, &old_page);
if (!old_entry) {
if (IS_ERR(old_page))
err = PTR_ERR(old_page);
- goto out_unlock_old;
+ goto out;
}
if (S_ISDIR(old_inode->i_mode)) {
@@ -1123,9 +1115,6 @@ static int f2fs_rename(struct user_names
f2fs_unlock_op(sbi);
- if (S_ISDIR(old_inode->i_mode))
- inode_unlock(old_inode);
-
if (IS_DIRSYNC(old_dir) || IS_DIRSYNC(new_dir))
f2fs_sync_fs(sbi->sb, 1);
@@ -1140,9 +1129,6 @@ out_dir:
f2fs_put_page(old_dir_page, 0);
out_old:
f2fs_put_page(old_page, 0);
-out_unlock_old:
- if (S_ISDIR(old_inode->i_mode))
- inode_unlock(old_inode);
out:
iput(whiteout);
return err;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 549/591] fs: Establish locking order for unrelated directories
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 548/591] Revert "f2fs: fix potential corruption when moving a directory" Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 550/591] fs: Lock moved directories Greg Kroah-Hartman
` (45 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara, Christian Brauner
From: Jan Kara <jack@suse.cz>
commit f23ce757185319886ca80c4864ce5f81ac6cc9e9 upstream.
Currently the locking order of inode locks for directories that are not
in ancestor relationship is not defined because all operations that
needed to lock two directories like this were serialized by
sb->s_vfs_rename_mutex. However some filesystems need to lock two
subdirectories for RENAME_EXCHANGE operations and for this we need the
locking order established even for two tree-unrelated directories.
Provide a helper function lock_two_inodes() that establishes lock
ordering for any two inodes and use it in lock_two_directories().
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20230601105830.13168-4-jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/inode.c | 42 ++++++++++++++++++++++++++++++++++++++++++
fs/internal.h | 2 ++
fs/namei.c | 4 ++--
3 files changed, 46 insertions(+), 2 deletions(-)
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1104,6 +1104,48 @@ void discard_new_inode(struct inode *ino
EXPORT_SYMBOL(discard_new_inode);
/**
+ * lock_two_inodes - lock two inodes (may be regular files but also dirs)
+ *
+ * Lock any non-NULL argument. The caller must make sure that if he is passing
+ * in two directories, one is not ancestor of the other. Zero, one or two
+ * objects may be locked by this function.
+ *
+ * @inode1: first inode to lock
+ * @inode2: second inode to lock
+ * @subclass1: inode lock subclass for the first lock obtained
+ * @subclass2: inode lock subclass for the second lock obtained
+ */
+void lock_two_inodes(struct inode *inode1, struct inode *inode2,
+ unsigned subclass1, unsigned subclass2)
+{
+ if (!inode1 || !inode2) {
+ /*
+ * Make sure @subclass1 will be used for the acquired lock.
+ * This is not strictly necessary (no current caller cares) but
+ * let's keep things consistent.
+ */
+ if (!inode1)
+ swap(inode1, inode2);
+ goto lock;
+ }
+
+ /*
+ * If one object is directory and the other is not, we must make sure
+ * to lock directory first as the other object may be its child.
+ */
+ if (S_ISDIR(inode2->i_mode) == S_ISDIR(inode1->i_mode)) {
+ if (inode1 > inode2)
+ swap(inode1, inode2);
+ } else if (!S_ISDIR(inode1->i_mode))
+ swap(inode1, inode2);
+lock:
+ if (inode1)
+ inode_lock_nested(inode1, subclass1);
+ if (inode2 && inode2 != inode1)
+ inode_lock_nested(inode2, subclass2);
+}
+
+/**
* lock_two_nondirectories - take two i_mutexes on non-directory objects
*
* Lock any non-NULL argument that is not a directory.
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -153,6 +153,8 @@ extern long prune_icache_sb(struct super
int dentry_needs_remove_privs(struct user_namespace *, struct dentry *dentry);
bool in_group_or_capable(struct user_namespace *mnt_userns,
const struct inode *inode, vfsgid_t vfsgid);
+void lock_two_inodes(struct inode *inode1, struct inode *inode2,
+ unsigned subclass1, unsigned subclass2);
/*
* fs-writeback.c
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3007,8 +3007,8 @@ struct dentry *lock_rename(struct dentry
return p;
}
- inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
- inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
+ lock_two_inodes(p1->d_inode, p2->d_inode,
+ I_MUTEX_PARENT, I_MUTEX_PARENT2);
return NULL;
}
EXPORT_SYMBOL(lock_rename);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 550/591] fs: Lock moved directories
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 549/591] fs: Establish locking order for unrelated directories Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 551/591] i2c: nvidia-gpu: Add ACPI property to align with device-tree Greg Kroah-Hartman
` (44 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara, Christian Brauner
From: Jan Kara <jack@suse.cz>
commit 28eceeda130f5058074dd007d9c59d2e8bc5af2e upstream.
When a directory is moved to a different directory, some filesystems
(udf, ext4, ocfs2, f2fs, and likely gfs2, reiserfs, and others) need to
update their pointer to the parent and this must not race with other
operations on the directory. Lock the directories when they are moved.
Although not all filesystems need this locking, we perform it in
vfs_rename() because getting the lock ordering right is really difficult
and we don't want to expose these locking details to filesystems.
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20230601105830.13168-5-jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/filesystems/directory-locking.rst | 26 ++++++++++++------------
fs/namei.c | 22 ++++++++++++--------
2 files changed, 28 insertions(+), 20 deletions(-)
--- a/Documentation/filesystems/directory-locking.rst
+++ b/Documentation/filesystems/directory-locking.rst
@@ -22,12 +22,11 @@ exclusive.
3) object removal. Locking rules: caller locks parent, finds victim,
locks victim and calls the method. Locks are exclusive.
-4) rename() that is _not_ cross-directory. Locking rules: caller locks
-the parent and finds source and target. In case of exchange (with
-RENAME_EXCHANGE in flags argument) lock both. In any case,
-if the target already exists, lock it. If the source is a non-directory,
-lock it. If we need to lock both, lock them in inode pointer order.
-Then call the method. All locks are exclusive.
+4) rename() that is _not_ cross-directory. Locking rules: caller locks the
+parent and finds source and target. We lock both (provided they exist). If we
+need to lock two inodes of different type (dir vs non-dir), we lock directory
+first. If we need to lock two inodes of the same type, lock them in inode
+pointer order. Then call the method. All locks are exclusive.
NB: we might get away with locking the source (and target in exchange
case) shared.
@@ -44,15 +43,17 @@ All locks are exclusive.
rules:
* lock the filesystem
- * lock parents in "ancestors first" order.
+ * lock parents in "ancestors first" order. If one is not ancestor of
+ the other, lock them in inode pointer order.
* find source and target.
* if old parent is equal to or is a descendent of target
fail with -ENOTEMPTY
* if new parent is equal to or is a descendent of source
fail with -ELOOP
- * If it's an exchange, lock both the source and the target.
- * If the target exists, lock it. If the source is a non-directory,
- lock it. If we need to lock both, do so in inode pointer order.
+ * Lock both the source and the target provided they exist. If we
+ need to lock two inodes of different type (dir vs non-dir), we lock
+ the directory first. If we need to lock two inodes of the same type,
+ lock them in inode pointer order.
* call the method.
All ->i_rwsem are taken exclusive. Again, we might get away with locking
@@ -66,8 +67,9 @@ If no directory is its own ancestor, the
Proof:
- First of all, at any moment we have a partial ordering of the
- objects - A < B iff A is an ancestor of B.
+ First of all, at any moment we have a linear ordering of the
+ objects - A < B iff (A is an ancestor of B) or (B is not an ancestor
+ of A and ptr(A) < ptr(B)).
That ordering can change. However, the following is true:
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -4661,7 +4661,7 @@ SYSCALL_DEFINE2(link, const char __user
* sb->s_vfs_rename_mutex. We might be more accurate, but that's another
* story.
* c) we have to lock _four_ objects - parents and victim (if it exists),
- * and source (if it is not a directory).
+ * and source.
* And that - after we got ->i_mutex on parents (until then we don't know
* whether the target exists). Solution: try to be smart with locking
* order for inodes. We rely on the fact that tree topology may change
@@ -4745,10 +4745,16 @@ int vfs_rename(struct renamedata *rd)
take_dentry_name_snapshot(&old_name, old_dentry);
dget(new_dentry);
- if (!is_dir || (flags & RENAME_EXCHANGE))
- lock_two_nondirectories(source, target);
- else if (target)
- inode_lock(target);
+ /*
+ * Lock all moved children. Moved directories may need to change parent
+ * pointer so they need the lock to prevent against concurrent
+ * directory changes moving parent pointer. For regular files we've
+ * historically always done this. The lockdep locking subclasses are
+ * somewhat arbitrary but RENAME_EXCHANGE in particular can swap
+ * regular files and directories so it's difficult to tell which
+ * subclasses to use.
+ */
+ lock_two_inodes(source, target, I_MUTEX_NORMAL, I_MUTEX_NONDIR2);
error = -EPERM;
if (IS_SWAPFILE(source) || (target && IS_SWAPFILE(target)))
@@ -4796,9 +4802,9 @@ int vfs_rename(struct renamedata *rd)
d_exchange(old_dentry, new_dentry);
}
out:
- if (!is_dir || (flags & RENAME_EXCHANGE))
- unlock_two_nondirectories(source, target);
- else if (target)
+ if (source)
+ inode_unlock(source);
+ if (target)
inode_unlock(target);
dput(new_dentry);
if (!error) {
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 551/591] i2c: nvidia-gpu: Add ACPI property to align with device-tree
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 550/591] fs: Lock moved directories Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 552/591] i2c: nvidia-gpu: Remove ccgx,firmware-build property Greg Kroah-Hartman
` (43 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wayne Chang, Jon Hunter,
Heikki Krogerus, Ajay Gupta, Wolfram Sang
From: Wayne Chang <waynec@nvidia.com>
commit f510b0a3565b9231e828e23a7e0f9790b97edf96 upstream.
Device-tree uses the 'firmware-name' string property to pass a name of
the firmware build to the Cypress CCGx driver. Add a new ACPI string
property to the NVIDIA GPU I2C driver to align with device-tree so that
we can migrate to using a common property name for both ACPI and
device-tree.
Signed-off-by: Wayne Chang <waynec@nvidia.com>
Co-developed-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Acked-by: Ajay Gupta <ajayg@nvidia.com>
Acked-by: Wolfram Sang <wsa@kernel.org>
Link: https://lore.kernel.org/r/20230131175748.256423-3-jonathanh@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-nvidia-gpu.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/i2c/busses/i2c-nvidia-gpu.c
+++ b/drivers/i2c/busses/i2c-nvidia-gpu.c
@@ -261,6 +261,7 @@ MODULE_DEVICE_TABLE(pci, gpu_i2c_ids);
static const struct property_entry ccgx_props[] = {
/* Use FW built for NVIDIA (nv) only */
PROPERTY_ENTRY_U16("ccgx,firmware-build", ('n' << 8) | 'v'),
+ PROPERTY_ENTRY_STRING("firmware-name", "nvidia,gpu"),
{ }
};
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 552/591] i2c: nvidia-gpu: Remove ccgx,firmware-build property
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 551/591] i2c: nvidia-gpu: Add ACPI property to align with device-tree Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 553/591] usb: typec: ucsi: Mark dGPUs as DEVICE scope Greg Kroah-Hartman
` (42 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wayne Chang, Jon Hunter, Ajay Gupta,
Wolfram Sang
From: Wayne Chang <waynec@nvidia.com>
commit 430b38764fbb931c6dbd1af13c8b2e4508994662 upstream.
Now the Cypress CCG driver has been updated to support the
'firmware-name' property to align with device-tree, remove the
'ccgx,firmware-build' property as this is no longer needed.
Signed-off-by: Wayne Chang <waynec@nvidia.com>
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Acked-by: Ajay Gupta <ajayg@nvidia.com>
Acked-by: Wolfram Sang <wsa@kernel.org>
Link: https://lore.kernel.org/r/20230131175748.256423-5-jonathanh@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-nvidia-gpu.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/i2c/busses/i2c-nvidia-gpu.c
+++ b/drivers/i2c/busses/i2c-nvidia-gpu.c
@@ -259,8 +259,7 @@ static const struct pci_device_id gpu_i2
MODULE_DEVICE_TABLE(pci, gpu_i2c_ids);
static const struct property_entry ccgx_props[] = {
- /* Use FW built for NVIDIA (nv) only */
- PROPERTY_ENTRY_U16("ccgx,firmware-build", ('n' << 8) | 'v'),
+ /* Use FW built for NVIDIA GPU only */
PROPERTY_ENTRY_STRING("firmware-name", "nvidia,gpu"),
{ }
};
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 553/591] usb: typec: ucsi: Mark dGPUs as DEVICE scope
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 552/591] i2c: nvidia-gpu: Remove ccgx,firmware-build property Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 554/591] ipvs: increase ip_vs_conn_tab_bits range for 64BIT Greg Kroah-Hartman
` (41 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Evan Quan, Mario Limonciello,
Heikki Krogerus, Sebastian Reichel, Andi Shyti, Wolfram Sang
From: Mario Limonciello <mario.limonciello@amd.com>
commit a7fbfd44c0204f0629288edfd0d77829edb4a2f8 upstream.
power_supply_is_system_supplied() checks whether any power
supplies are present that aren't batteries to decide whether
the system is running on DC or AC. Downstream drivers use
this to make performance decisions.
Navi dGPUs include an UCSI function that has been exported
since commit 17631e8ca2d3 ("i2c: designware: Add driver
support for AMD NAVI GPU").
This UCSI function registers a power supply since commit
992a60ed0d5e ("usb: typec: ucsi: register with power_supply class")
but this is not a system power supply.
As the power supply for a dGPU is only for powering devices connected
to dGPU, create a device property to indicate that the UCSI endpoint
is only for the scope of `POWER_SUPPLY_SCOPE_DEVICE`.
Link: https://lore.kernel.org/lkml/20230516182541.5836-2-mario.limonciello@amd.com/
Reviewed-by: Evan Quan <evan.quan@amd.com>
Tested-by: Evan Quan <evan.quan@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Acked-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-designware-pcidrv.c | 13 ++++++++++++-
drivers/i2c/busses/i2c-nvidia-gpu.c | 3 +++
drivers/usb/typec/ucsi/psy.c | 14 ++++++++++++++
3 files changed, 29 insertions(+), 1 deletion(-)
--- a/drivers/i2c/busses/i2c-designware-pcidrv.c
+++ b/drivers/i2c/busses/i2c-designware-pcidrv.c
@@ -20,6 +20,7 @@
#include <linux/module.h>
#include <linux/pci.h>
#include <linux/pm_runtime.h>
+#include <linux/power_supply.h>
#include <linux/sched.h>
#include <linux/slab.h>
@@ -234,6 +235,16 @@ static const struct dev_pm_ops i2c_dw_pm
SET_RUNTIME_PM_OPS(i2c_dw_pci_runtime_suspend, i2c_dw_pci_runtime_resume, NULL)
};
+static const struct property_entry dgpu_properties[] = {
+ /* USB-C doesn't power the system */
+ PROPERTY_ENTRY_U8("scope", POWER_SUPPLY_SCOPE_DEVICE),
+ {}
+};
+
+static const struct software_node dgpu_node = {
+ .properties = dgpu_properties,
+};
+
static int i2c_dw_pci_probe(struct pci_dev *pdev,
const struct pci_device_id *id)
{
@@ -325,7 +336,7 @@ static int i2c_dw_pci_probe(struct pci_d
}
if ((dev->flags & MODEL_MASK) == MODEL_AMD_NAVI_GPU) {
- dev->slave = i2c_new_ccgx_ucsi(&dev->adapter, dev->irq, NULL);
+ dev->slave = i2c_new_ccgx_ucsi(&dev->adapter, dev->irq, &dgpu_node);
if (IS_ERR(dev->slave))
return dev_err_probe(dev->dev, PTR_ERR(dev->slave),
"register UCSI failed\n");
--- a/drivers/i2c/busses/i2c-nvidia-gpu.c
+++ b/drivers/i2c/busses/i2c-nvidia-gpu.c
@@ -14,6 +14,7 @@
#include <linux/platform_device.h>
#include <linux/pm.h>
#include <linux/pm_runtime.h>
+#include <linux/power_supply.h>
#include <asm/unaligned.h>
@@ -261,6 +262,8 @@ MODULE_DEVICE_TABLE(pci, gpu_i2c_ids);
static const struct property_entry ccgx_props[] = {
/* Use FW built for NVIDIA GPU only */
PROPERTY_ENTRY_STRING("firmware-name", "nvidia,gpu"),
+ /* USB-C doesn't power the system */
+ PROPERTY_ENTRY_U8("scope", POWER_SUPPLY_SCOPE_DEVICE),
{ }
};
--- a/drivers/usb/typec/ucsi/psy.c
+++ b/drivers/usb/typec/ucsi/psy.c
@@ -27,8 +27,20 @@ static enum power_supply_property ucsi_p
POWER_SUPPLY_PROP_VOLTAGE_NOW,
POWER_SUPPLY_PROP_CURRENT_MAX,
POWER_SUPPLY_PROP_CURRENT_NOW,
+ POWER_SUPPLY_PROP_SCOPE,
};
+static int ucsi_psy_get_scope(struct ucsi_connector *con,
+ union power_supply_propval *val)
+{
+ u8 scope = POWER_SUPPLY_SCOPE_UNKNOWN;
+ struct device *dev = con->ucsi->dev;
+
+ device_property_read_u8(dev, "scope", &scope);
+ val->intval = scope;
+ return 0;
+}
+
static int ucsi_psy_get_online(struct ucsi_connector *con,
union power_supply_propval *val)
{
@@ -194,6 +206,8 @@ static int ucsi_psy_get_prop(struct powe
return ucsi_psy_get_current_max(con, val);
case POWER_SUPPLY_PROP_CURRENT_NOW:
return ucsi_psy_get_current_now(con, val);
+ case POWER_SUPPLY_PROP_SCOPE:
+ return ucsi_psy_get_scope(con, val);
default:
return -EINVAL;
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 554/591] ipvs: increase ip_vs_conn_tab_bits range for 64BIT
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 553/591] usb: typec: ucsi: Mark dGPUs as DEVICE scope Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 555/591] btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile Greg Kroah-Hartman
` (40 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abhijeet Rastogi, Julian Anastasov,
Simon Horman, Pablo Neira Ayuso, Allen Pais
From: Abhijeet Rastogi <abhijeet.1989@gmail.com>
commit 04292c695f82b6cf0d25dd5ae494f16ddbb621f6 upstream.
Current range [8, 20] is set purely due to historical reasons
because at the time, ~1M (2^20) was considered sufficient.
With this change, 27 is the upper limit for 64-bit, 20 otherwise.
Previous change regarding this limit is here.
Link: https://lore.kernel.org/all/86eabeb9dd62aebf1e2533926fdd13fed48bab1f.1631289960.git.aclaudi@redhat.com/T/#u
Signed-off-by: Abhijeet Rastogi <abhijeet.1989@gmail.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Allen Pais <apais@linux.microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipvs/Kconfig | 27 ++++++++++++++-------------
net/netfilter/ipvs/ip_vs_conn.c | 4 ++--
2 files changed, 16 insertions(+), 15 deletions(-)
--- a/net/netfilter/ipvs/Kconfig
+++ b/net/netfilter/ipvs/Kconfig
@@ -44,7 +44,8 @@ config IP_VS_DEBUG
config IP_VS_TAB_BITS
int "IPVS connection table size (the Nth power of 2)"
- range 8 20
+ range 8 20 if !64BIT
+ range 8 27 if 64BIT
default 12
help
The IPVS connection hash table uses the chaining scheme to handle
@@ -54,24 +55,24 @@ config IP_VS_TAB_BITS
Note the table size must be power of 2. The table size will be the
value of 2 to the your input number power. The number to choose is
- from 8 to 20, the default number is 12, which means the table size
- is 4096. Don't input the number too small, otherwise you will lose
- performance on it. You can adapt the table size yourself, according
- to your virtual server application. It is good to set the table size
- not far less than the number of connections per second multiplying
- average lasting time of connection in the table. For example, your
- virtual server gets 200 connections per second, the connection lasts
- for 200 seconds in average in the connection table, the table size
- should be not far less than 200x200, it is good to set the table
- size 32768 (2**15).
+ from 8 to 27 for 64BIT(20 otherwise), the default number is 12,
+ which means the table size is 4096. Don't input the number too
+ small, otherwise you will lose performance on it. You can adapt the
+ table size yourself, according to your virtual server application.
+ It is good to set the table size not far less than the number of
+ connections per second multiplying average lasting time of
+ connection in the table. For example, your virtual server gets 200
+ connections per second, the connection lasts for 200 seconds in
+ average in the connection table, the table size should be not far
+ less than 200x200, it is good to set the table size 32768 (2**15).
Another note that each connection occupies 128 bytes effectively and
each hash entry uses 8 bytes, so you can estimate how much memory is
needed for your box.
You can overwrite this number setting conn_tab_bits module parameter
- or by appending ip_vs.conn_tab_bits=? to the kernel command line
- if IP VS was compiled built-in.
+ or by appending ip_vs.conn_tab_bits=? to the kernel command line if
+ IP VS was compiled built-in.
comment "IPVS transport protocol load balancing support"
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -1484,8 +1484,8 @@ int __init ip_vs_conn_init(void)
int idx;
/* Compute size and mask */
- if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 20) {
- pr_info("conn_tab_bits not in [8, 20]. Using default value\n");
+ if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 27) {
+ pr_info("conn_tab_bits not in [8, 27]. Using default value\n");
ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS;
}
ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 555/591] btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 554/591] ipvs: increase ip_vs_conn_tab_bits range for 64BIT Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 556/591] btrfs: delete unused BGs while reclaiming BGs Greg Kroah-Hartman
` (39 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Corallo, David Sterba
From: Matt Corallo <blnxfsl@bluematt.me>
commit 160fe8f6fdb13da6111677be6263e5d65e875987 upstream.
Callers of `btrfs_reduce_alloc_profile` expect it to return exactly
one allocation profile flag, and failing to do so may ultimately
result in a WARN_ON and remount-ro when allocating new blocks, like
the below transaction abort on 6.1.
`btrfs_reduce_alloc_profile` has two ways of determining the profile,
first it checks if a conversion balance is currently running and
uses the profile we're converting to. If no balance is currently
running, it returns the max-redundancy profile which at least one
block in the selected block group has.
This works by simply checking each known allocation profile bit in
redundancy order. However, `btrfs_reduce_alloc_profile` has not been
updated as new flags have been added - first with the `DUP` profile
and later with the RAID1C34 profiles.
Because of the way it checks, if we have blocks with different
profiles and at least one is known, that profile will be selected.
However, if none are known we may return a flag set with multiple
allocation profiles set.
This is currently only possible when a balance from one of the three
unhandled profiles to another of the unhandled profiles is canceled
after allocating at least one block using the new profile.
In that case, a transaction abort like the below will occur and the
filesystem will need to be mounted with -o skip_balance to get it
mounted rw again (but the balance cannot be resumed without a
similar abort).
[770.648] ------------[ cut here ]------------
[770.648] BTRFS: Transaction aborted (error -22)
[770.648] WARNING: CPU: 43 PID: 1159593 at fs/btrfs/extent-tree.c:4122 find_free_extent+0x1d94/0x1e00 [btrfs]
[770.648] CPU: 43 PID: 1159593 Comm: btrfs Tainted: G W 6.1.0-0.deb11.7-powerpc64le #1 Debian 6.1.20-2~bpo11+1a~test
[770.648] Hardware name: T2P9D01 REV 1.00 POWER9 0x4e1202 opal:skiboot-bc106a0 PowerNV
[770.648] NIP: c00800000f6784fc LR: c00800000f6784f8 CTR: c000000000d746c0
[770.648] REGS: c000200089afe9a0 TRAP: 0700 Tainted: G W (6.1.0-0.deb11.7-powerpc64le Debian 6.1.20-2~bpo11+1a~test)
[770.648] MSR: 9000000002029033 <SF,HV,VEC,EE,ME,IR,DR,RI,LE> CR: 28848282 XER: 20040000
[770.648] CFAR: c000000000135110 IRQMASK: 0
GPR00: c00800000f6784f8 c000200089afec40 c00800000f7ea800 0000000000000026
GPR04: 00000001004820c2 c000200089afea00 c000200089afe9f8 0000000000000027
GPR08: c000200ffbfe7f98 c000000002127f90 ffffffffffffffd8 0000000026d6a6e8
GPR12: 0000000028848282 c000200fff7f3800 5deadbeef0000122 c00000002269d000
GPR16: c0002008c7797c40 c000200089afef17 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000001 c000200008bc5a98 0000000000000001
GPR24: 0000000000000000 c0000003c73088d0 c000200089afef17 c000000016d3a800
GPR28: c0000003c7308800 c00000002269d000 ffffffffffffffea 0000000000000001
[770.648] NIP [c00800000f6784fc] find_free_extent+0x1d94/0x1e00 [btrfs]
[770.648] LR [c00800000f6784f8] find_free_extent+0x1d90/0x1e00 [btrfs]
[770.648] Call Trace:
[770.648] [c000200089afec40] [c00800000f6784f8] find_free_extent+0x1d90/0x1e00 [btrfs] (unreliable)
[770.648] [c000200089afed30] [c00800000f681398] btrfs_reserve_extent+0x1a0/0x2f0 [btrfs]
[770.648] [c000200089afeea0] [c00800000f681bf0] btrfs_alloc_tree_block+0x108/0x670 [btrfs]
[770.648] [c000200089afeff0] [c00800000f66bd68] __btrfs_cow_block+0x170/0x850 [btrfs]
[770.648] [c000200089aff100] [c00800000f66c58c] btrfs_cow_block+0x144/0x288 [btrfs]
[770.648] [c000200089aff1b0] [c00800000f67113c] btrfs_search_slot+0x6b4/0xcb0 [btrfs]
[770.648] [c000200089aff2a0] [c00800000f679f60] lookup_inline_extent_backref+0x128/0x7c0 [btrfs]
[770.648] [c000200089aff3b0] [c00800000f67b338] lookup_extent_backref+0x70/0x190 [btrfs]
[770.648] [c000200089aff470] [c00800000f67b54c] __btrfs_free_extent+0xf4/0x1490 [btrfs]
[770.648] [c000200089aff5a0] [c00800000f67d770] __btrfs_run_delayed_refs+0x328/0x1530 [btrfs]
[770.648] [c000200089aff740] [c00800000f67ea2c] btrfs_run_delayed_refs+0xb4/0x3e0 [btrfs]
[770.648] [c000200089aff800] [c00800000f699aa4] btrfs_commit_transaction+0x8c/0x12b0 [btrfs]
[770.648] [c000200089aff8f0] [c00800000f6dc628] reset_balance_state+0x1c0/0x290 [btrfs]
[770.648] [c000200089aff9a0] [c00800000f6e2f7c] btrfs_balance+0x1164/0x1500 [btrfs]
[770.648] [c000200089affb40] [c00800000f6f8e4c] btrfs_ioctl+0x2b54/0x3100 [btrfs]
[770.648] [c000200089affc80] [c00000000053be14] sys_ioctl+0x794/0x1310
[770.648] [c000200089affd70] [c00000000002af98] system_call_exception+0x138/0x250
[770.648] [c000200089affe10] [c00000000000c654] system_call_common+0xf4/0x258
[770.648] --- interrupt: c00 at 0x7fff94126800
[770.648] NIP: 00007fff94126800 LR: 0000000107e0b594 CTR: 0000000000000000
[770.648] REGS: c000200089affe80 TRAP: 0c00 Tainted: G W (6.1.0-0.deb11.7-powerpc64le Debian 6.1.20-2~bpo11+1a~test)
[770.648] MSR: 900000000000d033 <SF,HV,EE,PR,ME,IR,DR,RI,LE> CR: 24002848 XER: 00000000
[770.648] IRQMASK: 0
GPR00: 0000000000000036 00007fffc9439da0 00007fff94217100 0000000000000003
GPR04: 00000000c4009420 00007fffc9439ee8 0000000000000000 0000000000000000
GPR08: 00000000803c7416 0000000000000000 0000000000000000 0000000000000000
GPR12: 0000000000000000 00007fff9467d120 0000000107e64c9c 0000000107e64d0a
GPR16: 0000000107e64d06 0000000107e64cf1 0000000107e64cc4 0000000107e64c73
GPR20: 0000000107e64c31 0000000107e64bf1 0000000107e64be7 0000000000000000
GPR24: 0000000000000000 00007fffc9439ee0 0000000000000003 0000000000000001
GPR28: 00007fffc943f713 0000000000000000 00007fffc9439ee8 0000000000000000
[770.648] NIP [00007fff94126800] 0x7fff94126800
[770.648] LR [0000000107e0b594] 0x107e0b594
[770.648] --- interrupt: c00
[770.648] Instruction dump:
[770.648] 3b00ffe4 e8898828 481175f5 60000000 4bfff4fc 3be00000 4bfff570 3d220000
[770.648] 7fc4f378 e8698830 4811cd95 e8410018 <0fe00000> f9c10060 f9e10068 fa010070
[770.648] ---[ end trace 0000000000000000 ]---
[770.648] BTRFS: error (device dm-2: state A) in find_free_extent_update_loop:4122: errno=-22 unknown
[770.648] BTRFS info (device dm-2: state EA): forced readonly
[770.648] BTRFS: error (device dm-2: state EA) in __btrfs_free_extent:3070: errno=-22 unknown
[770.648] BTRFS error (device dm-2: state EA): failed to run delayed ref for logical 17838685708288 num_bytes 24576 type 184 action 2 ref_mod 1: -22
[770.648] BTRFS: error (device dm-2: state EA) in btrfs_run_delayed_refs:2144: errno=-22 unknown
[770.648] BTRFS: error (device dm-2: state EA) in reset_balance_state:3599: errno=-22 unknown
Fixes: 47e6f7423b91 ("btrfs: add support for 3-copy replication (raid1c3)")
Fixes: 8d6fac0087e5 ("btrfs: add support for 4-copy replication (raid1c4)")
CC: stable@vger.kernel.org # 5.10+
Signed-off-by: Matt Corallo <blnxfsl@bluematt.me>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/block-group.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -79,14 +79,21 @@ static u64 btrfs_reduce_alloc_profile(st
}
allowed &= flags;
- if (allowed & BTRFS_BLOCK_GROUP_RAID6)
+ /* Select the highest-redundancy RAID level. */
+ if (allowed & BTRFS_BLOCK_GROUP_RAID1C4)
+ allowed = BTRFS_BLOCK_GROUP_RAID1C4;
+ else if (allowed & BTRFS_BLOCK_GROUP_RAID6)
allowed = BTRFS_BLOCK_GROUP_RAID6;
+ else if (allowed & BTRFS_BLOCK_GROUP_RAID1C3)
+ allowed = BTRFS_BLOCK_GROUP_RAID1C3;
else if (allowed & BTRFS_BLOCK_GROUP_RAID5)
allowed = BTRFS_BLOCK_GROUP_RAID5;
else if (allowed & BTRFS_BLOCK_GROUP_RAID10)
allowed = BTRFS_BLOCK_GROUP_RAID10;
else if (allowed & BTRFS_BLOCK_GROUP_RAID1)
allowed = BTRFS_BLOCK_GROUP_RAID1;
+ else if (allowed & BTRFS_BLOCK_GROUP_DUP)
+ allowed = BTRFS_BLOCK_GROUP_DUP;
else if (allowed & BTRFS_BLOCK_GROUP_RAID0)
allowed = BTRFS_BLOCK_GROUP_RAID0;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 556/591] btrfs: delete unused BGs while reclaiming BGs
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 555/591] btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 557/591] btrfs: bail out reclaim process if filesystem is read-only Greg Kroah-Hartman
` (38 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, Johannes Thumshirn,
Naohiro Aota, David Sterba
From: Naohiro Aota <naota@elisp.net>
commit 3ed01616bad6c7e3de196676b542ae3df8058592 upstream.
The reclaiming process only starts after the filesystem volumes are
allocated to a certain level (75% by default). Thus, the list of
reclaiming target block groups can build up so huge at the time the
reclaim process kicks in. On a test run, there were over 1000 BGs in the
reclaim list.
As the reclaim involves rewriting the data, it takes really long time to
reclaim the BGs. While the reclaim is running, btrfs_delete_unused_bgs()
won't proceed because the reclaim side is holding
fs_info->reclaim_bgs_lock. As a result, we will have a large number of
unused BGs kept in the unused list. On my test run, I got 1057 unused BGs.
Since deleting a block group is relatively easy and fast work, we can call
btrfs_delete_unused_bgs() while it reclaims BGs, to avoid building up
unused BGs.
Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones")
CC: stable@vger.kernel.org # 5.15+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/block-group.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -1636,10 +1636,24 @@ void btrfs_reclaim_bgs_work(struct work_
next:
btrfs_put_block_group(bg);
+
+ mutex_unlock(&fs_info->reclaim_bgs_lock);
+ /*
+ * Reclaiming all the block groups in the list can take really
+ * long. Prioritize cleaning up unused block groups.
+ */
+ btrfs_delete_unused_bgs(fs_info);
+ /*
+ * If we are interrupted by a balance, we can just bail out. The
+ * cleaner thread restart again if necessary.
+ */
+ if (!mutex_trylock(&fs_info->reclaim_bgs_lock))
+ goto end;
spin_lock(&fs_info->unused_bgs_lock);
}
spin_unlock(&fs_info->unused_bgs_lock);
mutex_unlock(&fs_info->reclaim_bgs_lock);
+end:
btrfs_exclop_finish(fs_info);
sb_end_write(fs_info->sb);
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 557/591] btrfs: bail out reclaim process if filesystem is read-only
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (555 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 556/591] btrfs: delete unused BGs while reclaiming BGs Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 558/591] btrfs: add block-group tree to lockdep classes Greg Kroah-Hartman
` (37 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, Johannes Thumshirn,
Naohiro Aota, David Sterba
From: Naohiro Aota <naota@elisp.net>
commit 93463ff7b54626f8276c0bd3d3f968fbf8d5d380 upstream.
When a filesystem is read-only, we cannot reclaim a block group as it
cannot rewrite the data. Just bail out in that case.
Note that it can drop block groups in this case. As we did
sb_start_write(), read-only filesystem means we got a fatal error and
forced read-only. There is no chance to reclaim them again.
Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones")
CC: stable@vger.kernel.org # 5.15+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/block-group.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -1603,8 +1603,15 @@ void btrfs_reclaim_bgs_work(struct work_
}
spin_unlock(&bg->lock);
- /* Get out fast, in case we're unmounting the filesystem */
- if (btrfs_fs_closing(fs_info)) {
+ /*
+ * Get out fast, in case we're read-only or unmounting the
+ * filesystem. It is OK to drop block groups from the list even
+ * for the read-only case. As we did sb_start_write(),
+ * "mount -o remount,ro" won't happen and read-only filesystem
+ * means it is forced read-only due to a fatal error. So, it
+ * never gets back to read-write to let us reclaim again.
+ */
+ if (btrfs_need_cleaner_sleep(fs_info)) {
up_write(&space_info->groups_sem);
goto next;
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 558/591] btrfs: add block-group tree to lockdep classes
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (556 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 557/591] btrfs: bail out reclaim process if filesystem is read-only Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 559/591] btrfs: reinsert BGs failed to reclaim Greg Kroah-Hartman
` (36 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Sterba
From: David Sterba <dsterba@suse.com>
commit 1a1b0e729d227f9f758f7b5f1c997e874e94156e upstream.
The block group tree was not present among the lockdep classes. We could
get potentially lockdep warnings but so far none has been seen, also
because block-group-tree is a relatively new feature.
CC: stable@vger.kernel.org # 6.1+
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/locking.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/btrfs/locking.c
+++ b/fs/btrfs/locking.c
@@ -56,8 +56,8 @@
static struct btrfs_lockdep_keyset {
u64 id; /* root objectid */
- /* Longest entry: btrfs-free-space-00 */
- char names[BTRFS_MAX_LEVEL][20];
+ /* Longest entry: btrfs-block-group-00 */
+ char names[BTRFS_MAX_LEVEL][24];
struct lock_class_key keys[BTRFS_MAX_LEVEL];
} btrfs_lockdep_keysets[] = {
{ .id = BTRFS_ROOT_TREE_OBJECTID, DEFINE_NAME("root") },
@@ -71,6 +71,7 @@ static struct btrfs_lockdep_keyset {
{ .id = BTRFS_DATA_RELOC_TREE_OBJECTID, DEFINE_NAME("dreloc") },
{ .id = BTRFS_UUID_TREE_OBJECTID, DEFINE_NAME("uuid") },
{ .id = BTRFS_FREE_SPACE_TREE_OBJECTID, DEFINE_NAME("free-space") },
+ { .id = BTRFS_BLOCK_GROUP_TREE_OBJECTID, DEFINE_NAME("block-group") },
{ .id = 0, DEFINE_NAME("tree") },
};
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 559/591] btrfs: reinsert BGs failed to reclaim
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (557 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 558/591] btrfs: add block-group tree to lockdep classes Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 560/591] btrfs: move out now unused BG from the reclaim list Greg Kroah-Hartman
` (35 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Naohiro Aota, David Sterba
From: Naohiro Aota <naota@elisp.net>
commit 7e27180994383b7c741ad87749db01e4989a02ba upstream.
The reclaim process can temporarily fail. For example, if the space is
getting tight, it fails to make the block group read-only. If there are no
further writes on that block group, the block group will never get back to
the reclaim list, and the BG never gets reclaimed. In a certain workload,
we can leave many such block groups never reclaimed.
So, let's get it back to the list and give it a chance to be reclaimed.
Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones")
CC: stable@vger.kernel.org # 5.15+
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/block-group.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -1642,6 +1642,8 @@ void btrfs_reclaim_bgs_work(struct work_
}
next:
+ if (ret)
+ btrfs_mark_bg_to_reclaim(bg);
btrfs_put_block_group(bg);
mutex_unlock(&fs_info->reclaim_bgs_lock);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 560/591] btrfs: move out now unused BG from the reclaim list
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (558 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 559/591] btrfs: reinsert BGs failed to reclaim Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 561/591] btrfs: fix race when deleting quota root from the dirty cow roots list Greg Kroah-Hartman
` (34 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, Johannes Thumshirn,
Naohiro Aota, David Sterba
From: Naohiro Aota <naota@elisp.net>
commit a9f189716cf15913c453299d72f69c51a9b0f86b upstream.
An unused block group is easy to remove to free up space and should be
reclaimed fast. Such block group can often already be a target of the
reclaim process. As we check list_empty(&bg->bg_list), we keep it in the
reclaim list. That block group is never reclaimed until the file system
is filled e.g. up to 75%.
Instead, we can move unused block group to the unused list and delete it
fast.
Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones")
CC: stable@vger.kernel.org # 5.15+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/block-group.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -1503,11 +1503,14 @@ void btrfs_mark_bg_unused(struct btrfs_b
{
struct btrfs_fs_info *fs_info = bg->fs_info;
+ trace_btrfs_add_unused_block_group(bg);
spin_lock(&fs_info->unused_bgs_lock);
if (list_empty(&bg->bg_list)) {
btrfs_get_block_group(bg);
- trace_btrfs_add_unused_block_group(bg);
list_add_tail(&bg->bg_list, &fs_info->unused_bgs);
+ } else {
+ /* Pull out the block group from the reclaim_bgs list. */
+ list_move_tail(&bg->bg_list, &fs_info->unused_bgs);
}
spin_unlock(&fs_info->unused_bgs_lock);
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 561/591] btrfs: fix race when deleting quota root from the dirty cow roots list
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (559 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 560/591] btrfs: move out now unused BG from the reclaim list Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 562/591] btrfs: fix extent buffer leak after tree mod log failure at split_node() Greg Kroah-Hartman
` (33 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Filipe Manana, David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit b31cb5a6eb7a48b0a7bfdf06832b1fd5088d8c79 upstream.
When disabling quotas we are deleting the quota root from the list
fs_info->dirty_cowonly_roots without taking the lock that protects it,
which is struct btrfs_fs_info::trans_lock. This unsynchronized list
manipulation may cause chaos if there's another concurrent manipulation
of this list, such as when adding a root to it with
ctree.c:add_root_to_dirty_list().
This can result in all sorts of weird failures caused by a race, such as
the following crash:
[337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI
[337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1
[337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]
[337571.279928] Code: 85 38 06 00 (...)
[337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206
[337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000
[337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070
[337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b
[337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600
[337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48
[337571.281723] FS: 00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000
[337571.281950] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0
[337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[337571.282874] Call Trace:
[337571.283101] <TASK>
[337571.283327] ? __die_body+0x1b/0x60
[337571.283570] ? die_addr+0x39/0x60
[337571.283796] ? exc_general_protection+0x22e/0x430
[337571.284022] ? asm_exc_general_protection+0x22/0x30
[337571.284251] ? commit_cowonly_roots+0x11f/0x250 [btrfs]
[337571.284531] btrfs_commit_transaction+0x42e/0xf90 [btrfs]
[337571.284803] ? _raw_spin_unlock+0x15/0x30
[337571.285031] ? release_extent_buffer+0x103/0x130 [btrfs]
[337571.285305] reset_balance_state+0x152/0x1b0 [btrfs]
[337571.285578] btrfs_balance+0xa50/0x11e0 [btrfs]
[337571.285864] ? __kmem_cache_alloc_node+0x14a/0x410
[337571.286086] btrfs_ioctl+0x249a/0x3320 [btrfs]
[337571.286358] ? mod_objcg_state+0xd2/0x360
[337571.286577] ? refill_obj_stock+0xb0/0x160
[337571.286798] ? seq_release+0x25/0x30
[337571.287016] ? __rseq_handle_notify_resume+0x3ba/0x4b0
[337571.287235] ? percpu_counter_add_batch+0x2e/0xa0
[337571.287455] ? __x64_sys_ioctl+0x88/0xc0
[337571.287675] __x64_sys_ioctl+0x88/0xc0
[337571.287901] do_syscall_64+0x38/0x90
[337571.288126] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[337571.288352] RIP: 0033:0x7f478aaffe9b
So fix this by locking struct btrfs_fs_info::trans_lock before deleting
the quota root from that list.
Fixes: bed92eae26cc ("Btrfs: qgroup implementation and prototypes")
CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/qgroup.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1296,7 +1296,9 @@ int btrfs_quota_disable(struct btrfs_fs_
goto out;
}
+ spin_lock(&fs_info->trans_lock);
list_del("a_root->dirty_list);
+ spin_unlock(&fs_info->trans_lock);
btrfs_tree_lock(quota_root->node);
btrfs_clean_tree_block(quota_root->node);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 562/591] btrfs: fix extent buffer leak after tree mod log failure at split_node()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (560 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 561/591] btrfs: fix race when deleting quota root from the dirty cow roots list Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 563/591] btrfs: do not BUG_ON() on tree mod log failure at __btrfs_cow_block() Greg Kroah-Hartman
` (32 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Filipe Manana,
David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit ede600e497b1461d06d22a7d17703d9096868bc3 upstream.
At split_node(), if we fail to log the tree mod log copy operation, we
return without unlocking the split extent buffer we just allocated and
without decrementing the reference we own on it. Fix this by unlocking
it and decrementing the ref count before returning.
Fixes: 5de865eebb83 ("Btrfs: fix tree mod logging")
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/ctree.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -2861,6 +2861,8 @@ static noinline int split_node(struct bt
ret = btrfs_tree_mod_log_eb_copy(split, c, 0, mid, c_nritems - mid);
if (ret) {
+ btrfs_tree_unlock(split);
+ free_extent_buffer(split);
btrfs_abort_transaction(trans, ret);
return ret;
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 563/591] btrfs: do not BUG_ON() on tree mod log failure at __btrfs_cow_block()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (561 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 562/591] btrfs: fix extent buffer leak after tree mod log failure at split_node() Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 564/591] ASoC: mediatek: mt8173: Fix irq error path Greg Kroah-Hartman
` (31 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Filipe Manana,
David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit 40b0a749388517de244643c09bdbb98f7dcb6ef1 upstream.
At __btrfs_cow_block(), instead of doing a BUG_ON() in case we fail to
record a tree mod log root insertion operation, do a transaction abort
instead. There's really no need for the BUG_ON(), we can properly
release all resources in this context and turn the filesystem to RO mode
and in an error state instead.
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/ctree.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -475,9 +475,14 @@ static noinline int __btrfs_cow_block(st
btrfs_header_backref_rev(buf) < BTRFS_MIXED_BACKREF_REV)
parent_start = buf->start;
- atomic_inc(&cow->refs);
ret = btrfs_tree_mod_log_insert_root(root->node, cow, true);
- BUG_ON(ret < 0);
+ if (ret < 0) {
+ btrfs_tree_unlock(cow);
+ free_extent_buffer(cow);
+ btrfs_abort_transaction(trans, ret);
+ return ret;
+ }
+ atomic_inc(&cow->refs);
rcu_assign_pointer(root->node, cow);
btrfs_free_tree_block(trans, btrfs_root_id(root), buf,
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 564/591] ASoC: mediatek: mt8173: Fix irq error path
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (562 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 563/591] btrfs: do not BUG_ON() on tree mod log failure at __btrfs_cow_block() Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 565/591] ASoC: mediatek: mt8173: Fix snd_soc_component_initialize " Greg Kroah-Hartman
` (30 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, stable,
Ricardo Ribalda Delgado, AngeloGioacchino Del Regno, Mark Brown
From: Ricardo Ribalda Delgado <ribalda@chromium.org>
commit f9c058d14f4fe23ef523a7ff73734d51c151683c upstream.
After reordering the irq probe, the error path was not properly done.
Lets fix it.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Cc: stable@kernel.org
Fixes: 4cbb264d4e91 ("ASoC: mediatek: mt8173: Enable IRQ when pdata is ready")
Signed-off-by: Ricardo Ribalda Delgado <ribalda@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20230612-mt8173-fixup-v2-2-432aa99ce24d@chromium.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/mediatek/mt8173/mt8173-afe-pcm.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c
+++ b/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c
@@ -1070,6 +1070,10 @@ static int mt8173_afe_pcm_dev_probe(stru
afe->dev = &pdev->dev;
+ irq_id = platform_get_irq(pdev, 0);
+ if (irq_id <= 0)
+ return irq_id < 0 ? irq_id : -ENXIO;
+
afe->base_addr = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(afe->base_addr))
return PTR_ERR(afe->base_addr);
@@ -1175,14 +1179,11 @@ static int mt8173_afe_pcm_dev_probe(stru
if (ret)
goto err_cleanup_components;
- irq_id = platform_get_irq(pdev, 0);
- if (irq_id <= 0)
- return irq_id < 0 ? irq_id : -ENXIO;
ret = devm_request_irq(afe->dev, irq_id, mt8173_afe_irq_handler,
0, "Afe_ISR_Handle", (void *)afe);
if (ret) {
dev_err(afe->dev, "could not request_irq\n");
- goto err_pm_disable;
+ goto err_cleanup_components;
}
dev_info(&pdev->dev, "MT8173 AFE driver initialized.\n");
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 565/591] ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (563 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 564/591] ASoC: mediatek: mt8173: Fix irq error path Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 566/591] regulator: tps65219: Fix matching interrupts for their regulators Greg Kroah-Hartman
` (29 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, stable,
Ricardo Ribalda Delgado, AngeloGioacchino Del Regno, Mark Brown
From: Ricardo Ribalda Delgado <ribalda@chromium.org>
commit a46d37012a5be1737393b8f82fd35665e4556eee upstream.
If the second component fails to initialize, cleanup the first on.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Cc: stable@kernel.org
Fixes: f1b5bf07365d ("ASoC: mt2701/mt8173: replace platform to component")
Signed-off-by: Ricardo Ribalda Delgado <ribalda@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20230612-mt8173-fixup-v2-1-432aa99ce24d@chromium.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/mediatek/mt8173/mt8173-afe-pcm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c
+++ b/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c
@@ -1160,14 +1160,14 @@ static int mt8173_afe_pcm_dev_probe(stru
comp_hdmi = devm_kzalloc(&pdev->dev, sizeof(*comp_hdmi), GFP_KERNEL);
if (!comp_hdmi) {
ret = -ENOMEM;
- goto err_pm_disable;
+ goto err_cleanup_components;
}
ret = snd_soc_component_initialize(comp_hdmi,
&mt8173_afe_hdmi_dai_component,
&pdev->dev);
if (ret)
- goto err_pm_disable;
+ goto err_cleanup_components;
#ifdef CONFIG_DEBUG_FS
comp_hdmi->debugfs_prefix = "hdmi";
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 566/591] regulator: tps65219: Fix matching interrupts for their regulators
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (564 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 565/591] ASoC: mediatek: mt8173: Fix snd_soc_component_initialize " Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 567/591] ARM: dts: qcom: ipq4019: fix broken NAND controller properties override Greg Kroah-Hartman
` (28 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit f050e56de80591fee55bedbdf5b6b998c740cd0c upstream.
The driver's probe() first registers regulators in a loop and then in a
second loop passes them as irq data to the interrupt handlers. However
the function to get the regulator for given name
tps65219_get_rdev_by_name() was a no-op due to argument passed by value,
not pointer, thus the second loop assigned always same value - from
previous loop. The interrupts, when fired, where executed with wrong
data. Compiler also noticed it:
drivers/regulator/tps65219-regulator.c: In function ‘tps65219_get_rdev_by_name’:
drivers/regulator/tps65219-regulator.c:292:60: error: parameter ‘dev’ set but not used [-Werror=unused-but-set-parameter]
Fixes: c12ac5fc3e0a ("regulator: drivers: Add TI TPS65219 PMIC regulators support")
Cc: <stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org
Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com
Link: https://lore.kernel.org/r/20230507144656.192800-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/tps65219-regulator.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/regulator/tps65219-regulator.c
+++ b/drivers/regulator/tps65219-regulator.c
@@ -289,13 +289,13 @@ static irqreturn_t tps65219_regulator_ir
static int tps65219_get_rdev_by_name(const char *regulator_name,
struct regulator_dev *rdevtbl[7],
- struct regulator_dev *dev)
+ struct regulator_dev **dev)
{
int i;
for (i = 0; i < ARRAY_SIZE(regulators); i++) {
if (strcmp(regulator_name, regulators[i].name) == 0) {
- dev = rdevtbl[i];
+ *dev = rdevtbl[i];
return 0;
}
}
@@ -348,7 +348,7 @@ static int tps65219_regulator_probe(stru
irq_data[i].dev = tps->dev;
irq_data[i].type = irq_type;
- tps65219_get_rdev_by_name(irq_type->regulator_name, rdevtbl, rdev);
+ tps65219_get_rdev_by_name(irq_type->regulator_name, rdevtbl, &rdev);
if (IS_ERR(rdev)) {
dev_err(tps->dev, "Failed to get rdev for %s\n",
irq_type->regulator_name);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 567/591] ARM: dts: qcom: ipq4019: fix broken NAND controller properties override
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (565 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 566/591] regulator: tps65219: Fix matching interrupts for their regulators Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 568/591] ARM: orion5x: fix d2net gpio initialization Greg Kroah-Hartman
` (27 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Manivannan Sadhasivam, Bjorn Andersson
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit edcbdd57de499305e2a3737d4a73fe387f71d84c upstream.
After renaming NAND controller node name from "qpic-nand" to
"nand-controller", the board DTS/DTSI also have to be updated:
Warning (unit_address_vs_reg): /soc/qpic-nand@79b0000: node has a unit name, but no reg or ranges property
Cc: <stable@vger.kernel.org>
Fixes: 9e1e00f18afc ("ARM: dts: qcom: Fix node name for NAND controller node")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230420072811.36947-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1-c1.dts | 8 ++++----
arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi | 10 +++++-----
arch/arm/boot/dts/qcom-ipq4019-ap.dk07.1.dtsi | 12 ++++++------
3 files changed, 15 insertions(+), 15 deletions(-)
--- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1-c1.dts
+++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1-c1.dts
@@ -11,9 +11,9 @@
dma-controller@7984000 {
status = "okay";
};
-
- qpic-nand@79b0000 {
- status = "okay";
- };
};
};
+
+&nand {
+ status = "okay";
+};
--- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi
+++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi
@@ -102,10 +102,10 @@
status = "okay";
perst-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>;
};
-
- qpic-nand@79b0000 {
- pinctrl-0 = <&nand_pins>;
- pinctrl-names = "default";
- };
};
};
+
+&nand {
+ pinctrl-0 = <&nand_pins>;
+ pinctrl-names = "default";
+};
--- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk07.1.dtsi
+++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk07.1.dtsi
@@ -65,11 +65,11 @@
dma-controller@7984000 {
status = "okay";
};
-
- qpic-nand@79b0000 {
- pinctrl-0 = <&nand_pins>;
- pinctrl-names = "default";
- status = "okay";
- };
};
};
+
+&nand {
+ pinctrl-0 = <&nand_pins>;
+ pinctrl-names = "default";
+ status = "okay";
+};
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 568/591] ARM: orion5x: fix d2net gpio initialization
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (566 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 567/591] ARM: dts: qcom: ipq4019: fix broken NAND controller properties override Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 569/591] leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename Greg Kroah-Hartman
` (26 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrew Lunn, Arnd Bergmann
From: Arnd Bergmann <arnd@arndb.de>
commit f8ef1233939495c405a9faa4bd1ae7d3f581bae4 upstream.
The DT version of this board has a custom file with the gpio
device. However, it does nothing because the d2net_init()
has no caller or prototype:
arch/arm/mach-orion5x/board-d2net.c:101:13: error: no previous prototype for 'd2net_init'
Call it from the board-dt file as intended.
Fixes: 94b0bd366e36 ("ARM: orion5x: convert d2net to Device Tree")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230516153109.514251-10-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-orion5x/board-dt.c | 3 +++
arch/arm/mach-orion5x/common.h | 6 ++++++
2 files changed, 9 insertions(+)
--- a/arch/arm/mach-orion5x/board-dt.c
+++ b/arch/arm/mach-orion5x/board-dt.c
@@ -60,6 +60,9 @@ static void __init orion5x_dt_init(void)
if (of_machine_is_compatible("maxtor,shared-storage-2"))
mss2_init();
+ if (of_machine_is_compatible("lacie,d2-network"))
+ d2net_init();
+
of_platform_default_populate(NULL, orion5x_auxdata_lookup, NULL);
}
--- a/arch/arm/mach-orion5x/common.h
+++ b/arch/arm/mach-orion5x/common.h
@@ -75,6 +75,12 @@ extern void mss2_init(void);
static inline void mss2_init(void) {}
#endif
+#ifdef CONFIG_MACH_D2NET_DT
+void d2net_init(void);
+#else
+static inline void d2net_init(void) {}
+#endif
+
/*****************************************************************************
* Helpers to access Orion registers
****************************************************************************/
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 569/591] leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (567 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 568/591] ARM: orion5x: fix d2net gpio initialization Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 570/591] blktrace: use inline function for blk_trace_remove() while blktrace is disabled Greg Kroah-Hartman
` (25 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Marangi, Andrew Lunn,
Lee Jones
From: Christian Marangi <ansuelsmth@gmail.com>
commit cee4bd16c3195a701be683f7da9e88c6e11acb73 upstream.
Dev can be renamed also while up for supported device. We currently
wrongly clear the NETDEV_LED_MODE_LINKUP flag on NETDEV_CHANGENAME
event.
Fix this by rechecking if the carrier is ok on NETDEV_CHANGENAME and
correctly set the NETDEV_LED_MODE_LINKUP bit.
Fixes: 5f820ed52371 ("leds: trigger: netdev: fix handling on interface rename")
Cc: stable@vger.kernel.org # v5.5+
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Lee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20230419210743.3594-2-ansuelsmth@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/leds/trigger/ledtrig-netdev.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/leds/trigger/ledtrig-netdev.c
+++ b/drivers/leds/trigger/ledtrig-netdev.c
@@ -318,6 +318,9 @@ static int netdev_trig_notify(struct not
clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
switch (evt) {
case NETDEV_CHANGENAME:
+ if (netif_carrier_ok(dev))
+ set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
+ fallthrough;
case NETDEV_REGISTER:
if (trigger_data->net_dev)
dev_put(trigger_data->net_dev);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 570/591] blktrace: use inline function for blk_trace_remove() while blktrace is disabled
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (568 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 569/591] leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 571/591] fs: no need to check source Greg Kroah-Hartman
` (24 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Christoph Hellwig,
Jens Axboe
From: Yu Kuai <yukuai3@huawei.com>
commit cbe7cff4a76bc749dd70264ca5cf924e2adf9296 upstream.
If config is disabled, call blk_trace_remove() directly will trigger
build warning, hence use inline function instead, prepare to fix
blktrace debugfs entries leakage.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230610022003.2557284-2-yukuai1@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/blktrace_api.h | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -85,10 +85,14 @@ extern int blk_trace_remove(struct reque
# define blk_add_driver_data(rq, data, len) do {} while (0)
# define blk_trace_setup(q, name, dev, bdev, arg) (-ENOTTY)
# define blk_trace_startstop(q, start) (-ENOTTY)
-# define blk_trace_remove(q) (-ENOTTY)
# define blk_add_trace_msg(q, fmt, ...) do { } while (0)
# define blk_add_cgroup_trace_msg(q, cg, fmt, ...) do { } while (0)
# define blk_trace_note_message_enabled(q) (false)
+
+static inline int blk_trace_remove(struct request_queue *q)
+{
+ return -ENOTTY;
+}
#endif /* CONFIG_BLK_DEV_IO_TRACE */
#ifdef CONFIG_COMPAT
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 571/591] fs: no need to check source
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (569 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 570/591] blktrace: use inline function for blk_trace_remove() while blktrace is disabled Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 572/591] xfs: explicitly specify cpu when forcing inodegc delayed work to run immediately Greg Kroah-Hartman
` (23 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Christian Brauner
From: Jan Kara <jack@suse.cz>
commit 66d8fc0539b0d49941f313c9509a8384e4245ac1 upstream.
The @source inode must be valid. It is even checked via IS_SWAPFILE()
above making it pretty clear. So no need to check it when we unlock.
What doesn't need to exist is the @target inode. The lock_two_inodes()
helper currently swaps the @inode1 and @inode2 arguments if @inode1 is
NULL to have consistent lock class usage. However, we know that at least
for vfs_rename() that @inode1 is @source and thus is never NULL as per
above. We also know that @source is a different inode than @target as
that is checked right at the beginning of vfs_rename(). So we know that
@source is valid and locked and that @target is locked. So drop the
check whether @source is non-NULL.
Fixes: 28eceeda130f ("fs: Lock moved directories")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202307030026.9sE2pk2x-lkp@intel.com
Message-Id: <20230703-vfs-rename-source-v1-1-37eebb29b65b@kernel.org>
[brauner: use commit message from patch I sent concurrently]
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namei.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -4802,8 +4802,7 @@ int vfs_rename(struct renamedata *rd)
d_exchange(old_dentry, new_dentry);
}
out:
- if (source)
- inode_unlock(source);
+ inode_unlock(source);
if (target)
inode_unlock(target);
dput(new_dentry);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 572/591] xfs: explicitly specify cpu when forcing inodegc delayed work to run immediately
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (570 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 571/591] fs: no need to check source Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 573/591] xfs: check that per-cpu inodegc workers actually run on that cpu Greg Kroah-Hartman
` (22 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Dave Chinner,
Dave Chinner, Amir Goldstein
From: "Darrick J. Wong" <djwong@kernel.org>
commit 03e0add80f4cf3f7393edb574eeb3a89a1db7758 upstream.
I've been noticing odd racing behavior in the inodegc code that could
only be explained by one cpu adding an inode to its inactivation llist
at the same time that another cpu is processing that cpu's llist.
Preemption is disabled between get/put_cpu_ptr, so the only explanation
is scheduler mayhem. I inserted the following debug code into
xfs_inodegc_worker (see the next patch):
ASSERT(gc->cpu == smp_processor_id());
This assertion tripped during overnight tests on the arm64 machines, but
curiously not on x86_64. I think we haven't observed any resource leaks
here because the lockfree list code can handle simultaneous llist_add
and llist_del_all functions operating on the same list. However, the
whole point of having percpu inodegc lists is to take advantage of warm
memory caches by inactivating inodes on the last processor to touch the
inode.
The incorrect scheduling seems to occur after an inodegc worker is
subjected to mod_delayed_work(). This wraps mod_delayed_work_on with
WORK_CPU_UNBOUND specified as the cpu number. Unbound allows for
scheduling on any cpu, not necessarily the same one that scheduled the
work.
Because preemption is disabled for as long as we have the gc pointer, I
think it's safe to use current_cpu() (aka smp_processor_id) to queue the
delayed work item on the correct cpu.
Fixes: 7cf2b0f9611b ("xfs: bound maximum wait time for inodegc work")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_icache.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -2052,7 +2052,8 @@ xfs_inodegc_queue(
queue_delay = 0;
trace_xfs_inodegc_queue(mp, __return_address);
- mod_delayed_work(mp->m_inodegc_wq, &gc->work, queue_delay);
+ mod_delayed_work_on(current_cpu(), mp->m_inodegc_wq, &gc->work,
+ queue_delay);
put_cpu_ptr(gc);
if (xfs_inodegc_want_flush_work(ip, items, shrinker_hits)) {
@@ -2096,7 +2097,8 @@ xfs_inodegc_cpu_dead(
if (xfs_is_inodegc_enabled(mp)) {
trace_xfs_inodegc_queue(mp, __return_address);
- mod_delayed_work(mp->m_inodegc_wq, &gc->work, 0);
+ mod_delayed_work_on(current_cpu(), mp->m_inodegc_wq, &gc->work,
+ 0);
}
put_cpu_ptr(gc);
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 573/591] xfs: check that per-cpu inodegc workers actually run on that cpu
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (571 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 572/591] xfs: explicitly specify cpu when forcing inodegc delayed work to run immediately Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 574/591] xfs: disable reaping in fscounters scrub Greg Kroah-Hartman
` (21 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Dave Chinner,
Dave Chinner, Amir Goldstein
From: "Darrick J. Wong" <djwong@kernel.org>
commit b37c4c8339cd394ea6b8b415026603320a185651 upstream.
Now that we've allegedly worked out the problem of the per-cpu inodegc
workers being scheduled on the wrong cpu, let's put in a debugging knob
to let us know if a worker ever gets mis-scheduled again.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_icache.c | 2 ++
fs/xfs/xfs_mount.h | 3 +++
fs/xfs/xfs_super.c | 3 +++
3 files changed, 8 insertions(+)
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -1848,6 +1848,8 @@ xfs_inodegc_worker(
struct llist_node *node = llist_del_all(&gc->list);
struct xfs_inode *ip, *n;
+ ASSERT(gc->cpu == smp_processor_id());
+
WRITE_ONCE(gc->items, 0);
if (!node)
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -66,6 +66,9 @@ struct xfs_inodegc {
/* approximate count of inodes in the list */
unsigned int items;
unsigned int shrinker_hits;
+#if defined(DEBUG) || defined(XFS_WARN)
+ unsigned int cpu;
+#endif
};
/*
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1084,6 +1084,9 @@ xfs_inodegc_init_percpu(
for_each_possible_cpu(cpu) {
gc = per_cpu_ptr(mp->m_inodegc, cpu);
+#if defined(DEBUG) || defined(XFS_WARN)
+ gc->cpu = cpu;
+#endif
init_llist_head(&gc->list);
gc->items = 0;
INIT_DELAYED_WORK(&gc->work, xfs_inodegc_worker);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 574/591] xfs: disable reaping in fscounters scrub
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (572 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 573/591] xfs: check that per-cpu inodegc workers actually run on that cpu Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 575/591] xfs: fix xfs_inodegc_stop racing with mod_delayed_work Greg Kroah-Hartman
` (20 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Dave Chinner,
Dave Chinner, Amir Goldstein
From: "Darrick J. Wong" <djwong@kernel.org>
commit 2d5f38a31980d7090f5bf91021488dc61a0ba8ee upstream.
The fscounters scrub code doesn't work properly because it cannot
quiesce updates to the percpu counters in the filesystem, hence it
returns false corruption reports. This has been fixed properly in
one of the online repair patchsets that are under review by replacing
the xchk_disable_reaping calls with an exclusive filesystem freeze.
Disabling background gc isn't sufficient to fix the problem.
In other words, scrub doesn't need to call xfs_inodegc_stop, which is
just as well since it wasn't correct to allow scrub to call
xfs_inodegc_start when something else could be calling xfs_inodegc_stop
(e.g. trying to freeze the filesystem).
Neuter the scrubber for now, and remove the xchk_*_reaping functions.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/scrub/common.c | 26 --------------------------
fs/xfs/scrub/common.h | 2 --
fs/xfs/scrub/fscounters.c | 13 ++++++-------
fs/xfs/scrub/scrub.c | 2 --
fs/xfs/scrub/scrub.h | 1 -
5 files changed, 6 insertions(+), 38 deletions(-)
--- a/fs/xfs/scrub/common.c
+++ b/fs/xfs/scrub/common.c
@@ -865,29 +865,3 @@ xchk_ilock_inverted(
}
return -EDEADLOCK;
}
-
-/* Pause background reaping of resources. */
-void
-xchk_stop_reaping(
- struct xfs_scrub *sc)
-{
- sc->flags |= XCHK_REAPING_DISABLED;
- xfs_blockgc_stop(sc->mp);
- xfs_inodegc_stop(sc->mp);
-}
-
-/* Restart background reaping of resources. */
-void
-xchk_start_reaping(
- struct xfs_scrub *sc)
-{
- /*
- * Readonly filesystems do not perform inactivation or speculative
- * preallocation, so there's no need to restart the workers.
- */
- if (!xfs_is_readonly(sc->mp)) {
- xfs_inodegc_start(sc->mp);
- xfs_blockgc_start(sc->mp);
- }
- sc->flags &= ~XCHK_REAPING_DISABLED;
-}
--- a/fs/xfs/scrub/common.h
+++ b/fs/xfs/scrub/common.h
@@ -148,7 +148,5 @@ static inline bool xchk_skip_xref(struct
int xchk_metadata_inode_forks(struct xfs_scrub *sc);
int xchk_ilock_inverted(struct xfs_inode *ip, uint lock_mode);
-void xchk_stop_reaping(struct xfs_scrub *sc);
-void xchk_start_reaping(struct xfs_scrub *sc);
#endif /* __XFS_SCRUB_COMMON_H__ */
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -128,13 +128,6 @@ xchk_setup_fscounters(
if (error)
return error;
- /*
- * Pause background reclaim while we're scrubbing to reduce the
- * likelihood of background perturbations to the counters throwing off
- * our calculations.
- */
- xchk_stop_reaping(sc);
-
return xchk_trans_alloc(sc, 0);
}
@@ -354,6 +347,12 @@ xchk_fscounters(
xchk_set_corrupt(sc);
/*
+ * XXX: We can't quiesce percpu counter updates, so exit early.
+ * This can be re-enabled when we gain exclusive freeze functionality.
+ */
+ return 0;
+
+ /*
* If ifree exceeds icount by more than the minimum variance then
* something's probably wrong with the counters.
*/
--- a/fs/xfs/scrub/scrub.c
+++ b/fs/xfs/scrub/scrub.c
@@ -171,8 +171,6 @@ xchk_teardown(
}
if (sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR)
mnt_drop_write_file(sc->file);
- if (sc->flags & XCHK_REAPING_DISABLED)
- xchk_start_reaping(sc);
if (sc->buf) {
kmem_free(sc->buf);
sc->buf = NULL;
--- a/fs/xfs/scrub/scrub.h
+++ b/fs/xfs/scrub/scrub.h
@@ -88,7 +88,6 @@ struct xfs_scrub {
/* XCHK state flags grow up from zero, XREP state flags grown down from 2^31 */
#define XCHK_TRY_HARDER (1 << 0) /* can't get resources, try again */
-#define XCHK_REAPING_DISABLED (1 << 2) /* background block reaping paused */
#define XREP_ALREADY_FIXED (1 << 31) /* checking our repair work */
/* Metadata scrubbers */
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 575/591] xfs: fix xfs_inodegc_stop racing with mod_delayed_work
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (573 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 574/591] xfs: disable reaping in fscounters scrub Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 576/591] mm/mmap: Fix extra maple tree write Greg Kroah-Hartman
` (19 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Dave Chinner,
Dave Chinner, Amir Goldstein
From: "Darrick J. Wong" <djwong@kernel.org>
commit 2254a7396a0ca6309854948ee1c0a33fa4268cec upstream.
syzbot reported this warning from the faux inodegc shrinker that tries
to kick off inodegc work:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 102 at kernel/workqueue.c:1445 __queue_work+0xd44/0x1120 kernel/workqueue.c:1444
RIP: 0010:__queue_work+0xd44/0x1120 kernel/workqueue.c:1444
Call Trace:
__queue_delayed_work+0x1c8/0x270 kernel/workqueue.c:1672
mod_delayed_work_on+0xe1/0x220 kernel/workqueue.c:1746
xfs_inodegc_shrinker_scan fs/xfs/xfs_icache.c:2212 [inline]
xfs_inodegc_shrinker_scan+0x250/0x4f0 fs/xfs/xfs_icache.c:2191
do_shrink_slab+0x428/0xaa0 mm/vmscan.c:853
shrink_slab+0x175/0x660 mm/vmscan.c:1013
shrink_one+0x502/0x810 mm/vmscan.c:5343
shrink_many mm/vmscan.c:5394 [inline]
lru_gen_shrink_node mm/vmscan.c:5511 [inline]
shrink_node+0x2064/0x35f0 mm/vmscan.c:6459
kswapd_shrink_node mm/vmscan.c:7262 [inline]
balance_pgdat+0xa02/0x1ac0 mm/vmscan.c:7452
kswapd+0x677/0xd60 mm/vmscan.c:7712
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
This warning corresponds to this code in __queue_work:
/*
* For a draining wq, only works from the same workqueue are
* allowed. The __WQ_DESTROYING helps to spot the issue that
* queues a new work item to a wq after destroy_workqueue(wq).
*/
if (unlikely(wq->flags & (__WQ_DESTROYING | __WQ_DRAINING) &&
WARN_ON_ONCE(!is_chained_work(wq))))
return;
For this to trip, we must have a thread draining the inodedgc workqueue
and a second thread trying to queue inodegc work to that workqueue.
This can happen if freezing or a ro remount race with reclaim poking our
faux inodegc shrinker and another thread dropping an unlinked O_RDONLY
file:
Thread 0 Thread 1 Thread 2
xfs_inodegc_stop
xfs_inodegc_shrinker_scan
xfs_is_inodegc_enabled
<yes, will continue>
xfs_clear_inodegc_enabled
xfs_inodegc_queue_all
<list empty, do not queue inodegc worker>
xfs_inodegc_queue
<add to list>
xfs_is_inodegc_enabled
<no, returns>
drain_workqueue
<set WQ_DRAINING>
llist_empty
<no, will queue list>
mod_delayed_work_on(..., 0)
__queue_work
<sees WQ_DRAINING, kaboom>
In other words, everything between the access to inodegc_enabled state
and the decision to poke the inodegc workqueue requires some kind of
coordination to avoid the WQ_DRAINING state. We could perhaps introduce
a lock here, but we could also try to eliminate WQ_DRAINING from the
picture.
We could replace the drain_workqueue call with a loop that flushes the
workqueue and queues workers as long as there is at least one inode
present in the per-cpu inodegc llists. We've disabled inodegc at this
point, so we know that the number of queued inodes will eventually hit
zero as long as xfs_inodegc_start cannot reactivate the workers.
There are four callers of xfs_inodegc_start. Three of them come from the
VFS with s_umount held: filesystem thawing, failed filesystem freezing,
and the rw remount transition. The fourth caller is mounting rw (no
remount or freezing possible).
There are three callers ofs xfs_inodegc_stop. One is unmounting (no
remount or thaw possible). Two of them come from the VFS with s_umount
held: fs freezing and ro remount transition.
Hence, it is correct to replace the drain_workqueue call with a loop
that drains the inodegc llists.
Fixes: 6191cf3ad59f ("xfs: flush inodegc workqueue tasks before cancel")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_icache.c | 32 +++++++++++++++++++++++++++-----
1 file changed, 27 insertions(+), 5 deletions(-)
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -431,18 +431,23 @@ xfs_iget_check_free_state(
}
/* Make all pending inactivation work start immediately. */
-static void
+static bool
xfs_inodegc_queue_all(
struct xfs_mount *mp)
{
struct xfs_inodegc *gc;
int cpu;
+ bool ret = false;
for_each_online_cpu(cpu) {
gc = per_cpu_ptr(mp->m_inodegc, cpu);
- if (!llist_empty(&gc->list))
+ if (!llist_empty(&gc->list)) {
mod_delayed_work_on(cpu, mp->m_inodegc_wq, &gc->work, 0);
+ ret = true;
+ }
}
+
+ return ret;
}
/*
@@ -1894,24 +1899,41 @@ xfs_inodegc_flush(
/*
* Flush all the pending work and then disable the inode inactivation background
- * workers and wait for them to stop.
+ * workers and wait for them to stop. Caller must hold sb->s_umount to
+ * coordinate changes in the inodegc_enabled state.
*/
void
xfs_inodegc_stop(
struct xfs_mount *mp)
{
+ bool rerun;
+
if (!xfs_clear_inodegc_enabled(mp))
return;
+ /*
+ * Drain all pending inodegc work, including inodes that could be
+ * queued by racing xfs_inodegc_queue or xfs_inodegc_shrinker_scan
+ * threads that sample the inodegc state just prior to us clearing it.
+ * The inodegc flag state prevents new threads from queuing more
+ * inodes, so we queue pending work items and flush the workqueue until
+ * all inodegc lists are empty. IOWs, we cannot use drain_workqueue
+ * here because it does not allow other unserialized mechanisms to
+ * reschedule inodegc work while this draining is in progress.
+ */
xfs_inodegc_queue_all(mp);
- drain_workqueue(mp->m_inodegc_wq);
+ do {
+ flush_workqueue(mp->m_inodegc_wq);
+ rerun = xfs_inodegc_queue_all(mp);
+ } while (rerun);
trace_xfs_inodegc_stop(mp, __return_address);
}
/*
* Enable the inode inactivation background workers and schedule deferred inode
- * inactivation work if there is any.
+ * inactivation work if there is any. Caller must hold sb->s_umount to
+ * coordinate changes in the inodegc_enabled state.
*/
void
xfs_inodegc_start(
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 576/591] mm/mmap: Fix extra maple tree write
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (574 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 575/591] xfs: fix xfs_inodegc_stop racing with mod_delayed_work Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 577/591] drm/i915: Fix TypeC mode initialization during system resume Greg Kroah-Hartman
` (18 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Greg Kroah-Hartman, patches, John Hsu, linux-mm, Liam R. Howlett
From: "Liam R. Howlett" <Liam.Howlett@oracle.com>
based on commit 0503ea8f5ba73eb3ab13a81c1eefbaf51405385a upstream.
This was inadvertently fixed during the removal of __vma_adjust().
When __vma_adjust() is adjusting next with a negative value (pushing
vma->vm_end lower), there would be two writes to the maple tree. The
first write is unnecessary and uses all allocated nodes in the maple
state. The second write is necessary but will need to allocate nodes
since the first write has used the allocated nodes. This may be a
problem as it may not be safe to allocate at this time, such as a low
memory situation. Fix the issue by avoiding the first write and only
write the adjusted "next" VMA.
Reported-by: John Hsu <John.Hsu@mediatek.com>
Link: https://lore.kernel.org/lkml/9cb8c599b1d7f9c1c300d1a334d5eb70ec4d7357.camel@mediatek.com/
Cc: stable@vger.kernel.org
Cc: linux-mm@kvack.org
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mmap.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -767,7 +767,8 @@ int __vma_adjust(struct vm_area_struct *
}
if (end != vma->vm_end) {
if (vma->vm_end > end) {
- if (!insert || (insert->vm_start != end)) {
+ if ((vma->vm_end + adjust_next != end) &&
+ (!insert || (insert->vm_start != end))) {
vma_mas_szero(&mas, end, vma->vm_end);
mas_reset(&mas);
VM_WARN_ON(insert &&
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 577/591] drm/i915: Fix TypeC mode initialization during system resume
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (575 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 576/591] mm/mmap: Fix extra maple tree write Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 578/591] drm/i915/tc: Fix TC port link ref init for DP MST during HW readout Greg Kroah-Hartman
` (17 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Imre Deak, Mika Kahola
From: Imre Deak <imre.deak@intel.com>
commit a82796a2e332d108b2d3aff38509caad370f69b5 upstream.
During system resume DP MST requires AUX to be working already before
the HW state readout of the given encoder. Since AUX requires the
encoder/PHY TypeC mode to be initialized, which atm only happens during
HW state readout, these AUX transfers can change the TypeC mode
incorrectly (disconnecting the PHY for an enabled encoder) and trigger
the state check WARNs in intel_tc_port_sanitize().
Fix this by initializing the TypeC mode earlier both during driver
loading and system resume and making sure that the mode can't change
until the encoder's state is read out. While at it add the missing
DocBook comments and rename
intel_tc_port_sanitize()->intel_tc_port_sanitize_mode() for consistency.
Signed-off-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: Mika Kahola <mika.kahola@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220922172148.2913088-1-imre.deak@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/intel_ddi.c | 8 +++
drivers/gpu/drm/i915/display/intel_tc.c | 66 +++++++++++++++++++++++--------
drivers/gpu/drm/i915/display/intel_tc.h | 3 -
3 files changed, 60 insertions(+), 17 deletions(-)
--- a/drivers/gpu/drm/i915/display/intel_ddi.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi.c
@@ -3579,7 +3579,7 @@ static void intel_ddi_sync_state(struct
enum phy phy = intel_port_to_phy(i915, encoder->port);
if (intel_phy_is_tc(i915, phy))
- intel_tc_port_sanitize(enc_to_dig_port(encoder));
+ intel_tc_port_sanitize_mode(enc_to_dig_port(encoder));
if (crtc_state && intel_crtc_has_dp_encoder(crtc_state))
intel_dp_sync_state(encoder, crtc_state);
@@ -3789,11 +3789,17 @@ static void intel_ddi_encoder_destroy(st
static void intel_ddi_encoder_reset(struct drm_encoder *encoder)
{
+ struct drm_i915_private *i915 = to_i915(encoder->dev);
struct intel_dp *intel_dp = enc_to_intel_dp(to_intel_encoder(encoder));
+ struct intel_digital_port *dig_port = enc_to_dig_port(to_intel_encoder(encoder));
+ enum phy phy = intel_port_to_phy(i915, dig_port->base.port);
intel_dp->reset_link_params = true;
intel_pps_encoder_reset(intel_dp);
+
+ if (intel_phy_is_tc(i915, phy))
+ intel_tc_port_init_mode(dig_port);
}
static const struct drm_encoder_funcs intel_ddi_funcs = {
--- a/drivers/gpu/drm/i915/display/intel_tc.c
+++ b/drivers/gpu/drm/i915/display/intel_tc.c
@@ -687,18 +687,58 @@ static void
intel_tc_port_link_init_refcount(struct intel_digital_port *dig_port,
int refcount)
{
+ dig_port->tc_link_refcount = refcount;
+}
+
+/**
+ * intel_tc_port_init_mode: Read out HW state and init the given port's TypeC mode
+ * @dig_port: digital port
+ *
+ * Read out the HW state and initialize the TypeC mode of @dig_port. The mode
+ * will be locked until intel_tc_port_sanitize_mode() is called.
+ */
+void intel_tc_port_init_mode(struct intel_digital_port *dig_port)
+{
struct drm_i915_private *i915 = to_i915(dig_port->base.base.dev);
+ intel_wakeref_t tc_cold_wref;
+ enum intel_display_power_domain domain;
+ mutex_lock(&dig_port->tc_lock);
+
+ drm_WARN_ON(&i915->drm, dig_port->tc_mode != TC_PORT_DISCONNECTED);
+ drm_WARN_ON(&i915->drm, dig_port->tc_lock_wakeref);
drm_WARN_ON(&i915->drm, dig_port->tc_link_refcount);
- dig_port->tc_link_refcount = refcount;
+
+ tc_cold_wref = tc_cold_block(dig_port, &domain);
+
+ dig_port->tc_mode = intel_tc_port_get_current_mode(dig_port);
+ /* Prevent changing dig_port->tc_mode until intel_tc_port_sanitize_mode() is called. */
+ intel_tc_port_link_init_refcount(dig_port, 1);
+ dig_port->tc_lock_wakeref = tc_cold_block(dig_port, &dig_port->tc_lock_power_domain);
+
+ tc_cold_unblock(dig_port, domain, tc_cold_wref);
+
+ drm_dbg_kms(&i915->drm, "Port %s: init mode (%s)\n",
+ dig_port->tc_port_name,
+ tc_port_mode_name(dig_port->tc_mode));
+
+ mutex_unlock(&dig_port->tc_lock);
}
-void intel_tc_port_sanitize(struct intel_digital_port *dig_port)
+/**
+ * intel_tc_port_sanitize_mode: Sanitize the given port's TypeC mode
+ * @dig_port: digital port
+ *
+ * Sanitize @dig_port's TypeC mode wrt. the encoder's state right after driver
+ * loading and system resume:
+ * If the encoder is enabled keep the TypeC mode/PHY connected state locked until
+ * the encoder is disabled.
+ * If the encoder is disabled make sure the PHY is disconnected.
+ */
+void intel_tc_port_sanitize_mode(struct intel_digital_port *dig_port)
{
struct drm_i915_private *i915 = to_i915(dig_port->base.base.dev);
struct intel_encoder *encoder = &dig_port->base;
- intel_wakeref_t tc_cold_wref;
- enum intel_display_power_domain domain;
int active_links = 0;
mutex_lock(&dig_port->tc_lock);
@@ -708,21 +748,14 @@ void intel_tc_port_sanitize(struct intel
else if (encoder->base.crtc)
active_links = to_intel_crtc(encoder->base.crtc)->active;
- drm_WARN_ON(&i915->drm, dig_port->tc_mode != TC_PORT_DISCONNECTED);
- drm_WARN_ON(&i915->drm, dig_port->tc_lock_wakeref);
+ drm_WARN_ON(&i915->drm, dig_port->tc_link_refcount != 1);
+ intel_tc_port_link_init_refcount(dig_port, active_links);
- tc_cold_wref = tc_cold_block(dig_port, &domain);
-
- dig_port->tc_mode = intel_tc_port_get_current_mode(dig_port);
if (active_links) {
if (!icl_tc_phy_is_connected(dig_port))
drm_dbg_kms(&i915->drm,
"Port %s: PHY disconnected with %d active link(s)\n",
dig_port->tc_port_name, active_links);
- intel_tc_port_link_init_refcount(dig_port, active_links);
-
- dig_port->tc_lock_wakeref = tc_cold_block(dig_port,
- &dig_port->tc_lock_power_domain);
} else {
/*
* TBT-alt is the default mode in any case the PHY ownership is not
@@ -736,9 +769,10 @@ void intel_tc_port_sanitize(struct intel
dig_port->tc_port_name,
tc_port_mode_name(dig_port->tc_mode));
icl_tc_phy_disconnect(dig_port);
- }
- tc_cold_unblock(dig_port, domain, tc_cold_wref);
+ tc_cold_unblock(dig_port, dig_port->tc_lock_power_domain,
+ fetch_and_zero(&dig_port->tc_lock_wakeref));
+ }
drm_dbg_kms(&i915->drm, "Port %s: sanitize mode (%s)\n",
dig_port->tc_port_name,
@@ -923,4 +957,6 @@ void intel_tc_port_init(struct intel_dig
dig_port->tc_mode = TC_PORT_DISCONNECTED;
dig_port->tc_link_refcount = 0;
tc_port_load_fia_params(i915, dig_port);
+
+ intel_tc_port_init_mode(dig_port);
}
--- a/drivers/gpu/drm/i915/display/intel_tc.h
+++ b/drivers/gpu/drm/i915/display/intel_tc.h
@@ -24,7 +24,8 @@ int intel_tc_port_fia_max_lane_count(str
void intel_tc_port_set_fia_lane_count(struct intel_digital_port *dig_port,
int required_lanes);
-void intel_tc_port_sanitize(struct intel_digital_port *dig_port);
+void intel_tc_port_init_mode(struct intel_digital_port *dig_port);
+void intel_tc_port_sanitize_mode(struct intel_digital_port *dig_port);
void intel_tc_port_lock(struct intel_digital_port *dig_port);
void intel_tc_port_unlock(struct intel_digital_port *dig_port);
void intel_tc_port_flush_work(struct intel_digital_port *dig_port);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 578/591] drm/i915/tc: Fix TC port link ref init for DP MST during HW readout
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (576 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 577/591] drm/i915: Fix TypeC mode initialization during system resume Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 579/591] drm/i915/tc: Fix system resume MST mode restore for DP-alt sinks Greg Kroah-Hartman
` (16 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Imre Deak, Ville Syrjälä,
Mika Kahola, Andrzej Hajda
From: Imre Deak <imre.deak@intel.com>
commit 67165722c27cc46de112a4e10b450170c8980a6f upstream.
An enabled TC MST port holds one TC port link reference, regardless of
the number of enabled streams on it, but the TC port HW readout takes
one reference for each active MST stream.
Fix the HW readout, taking only one reference for MST ports.
This didn't cause an actual problem, since the encoder HW readout doesn't
yet support reading out the MST HW state.
Signed-off-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Mika Kahola <mika.kahola@intel.com>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230316131724.359612-3-imre.deak@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/intel_tc.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
--- a/drivers/gpu/drm/i915/display/intel_tc.c
+++ b/drivers/gpu/drm/i915/display/intel_tc.c
@@ -683,11 +683,14 @@ static void intel_tc_port_update_mode(st
tc_cold_unblock(dig_port, domain, wref);
}
-static void
-intel_tc_port_link_init_refcount(struct intel_digital_port *dig_port,
- int refcount)
+static void __intel_tc_port_get_link(struct intel_digital_port *dig_port)
{
- dig_port->tc_link_refcount = refcount;
+ dig_port->tc_link_refcount++;
+}
+
+static void __intel_tc_port_put_link(struct intel_digital_port *dig_port)
+{
+ dig_port->tc_link_refcount--;
}
/**
@@ -713,7 +716,7 @@ void intel_tc_port_init_mode(struct inte
dig_port->tc_mode = intel_tc_port_get_current_mode(dig_port);
/* Prevent changing dig_port->tc_mode until intel_tc_port_sanitize_mode() is called. */
- intel_tc_port_link_init_refcount(dig_port, 1);
+ __intel_tc_port_get_link(dig_port);
dig_port->tc_lock_wakeref = tc_cold_block(dig_port, &dig_port->tc_lock_power_domain);
tc_cold_unblock(dig_port, domain, tc_cold_wref);
@@ -749,8 +752,6 @@ void intel_tc_port_sanitize_mode(struct
active_links = to_intel_crtc(encoder->base.crtc)->active;
drm_WARN_ON(&i915->drm, dig_port->tc_link_refcount != 1);
- intel_tc_port_link_init_refcount(dig_port, active_links);
-
if (active_links) {
if (!icl_tc_phy_is_connected(dig_port))
drm_dbg_kms(&i915->drm,
@@ -769,6 +770,7 @@ void intel_tc_port_sanitize_mode(struct
dig_port->tc_port_name,
tc_port_mode_name(dig_port->tc_mode));
icl_tc_phy_disconnect(dig_port);
+ __intel_tc_port_put_link(dig_port);
tc_cold_unblock(dig_port, dig_port->tc_lock_power_domain,
fetch_and_zero(&dig_port->tc_lock_wakeref));
@@ -880,14 +882,14 @@ void intel_tc_port_get_link(struct intel
int required_lanes)
{
__intel_tc_port_lock(dig_port, required_lanes);
- dig_port->tc_link_refcount++;
+ __intel_tc_port_get_link(dig_port);
intel_tc_port_unlock(dig_port);
}
void intel_tc_port_put_link(struct intel_digital_port *dig_port)
{
intel_tc_port_lock(dig_port);
- --dig_port->tc_link_refcount;
+ __intel_tc_port_put_link(dig_port);
intel_tc_port_unlock(dig_port);
/*
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 579/591] drm/i915/tc: Fix system resume MST mode restore for DP-alt sinks
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (577 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 578/591] drm/i915/tc: Fix TC port link ref init for DP MST during HW readout Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:51 ` [PATCH 6.1 580/591] mtd: parsers: refer to ARCH_BCMBCA instead of ARCH_BCM4908 Greg Kroah-Hartman
` (15 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Imre Deak, Ville Syrjälä
From: Imre Deak <imre.deak@intel.com>
commit 06f66261a1567d66b9d35c87393b6edfbea4c8f8 upstream.
At least restoring the MST topology during system resume needs to use
AUX before the display HW readout->sanitization sequence is complete,
but on TC ports the PHY may be in the wrong mode for this, resulting in
the AUX transfers to fail.
The initial TC port mode is kept fixed as BIOS left it for the above HW
readout sequence (to prevent changing the mode on an enabled port). If
the port is disabled this initial mode is TBT - as in any case the PHY
ownership is not held - even if a DP-alt sink is connected. Thus, the
AUX transfers during this time will use TBT mode instead of the expected
DP-alt mode and so time out.
Fix the above by connecting the PHY during port initialization if the
port is disabled, which will switch to the expected mode (DP-alt in the
above case).
As the encoder/pipe HW state isn't read-out yet at this point, check if
the port is enabled based on the DDI_BUF enabled flag. Save the read-out
initial mode, so intel_tc_port_sanitize_mode() can check this wrt. the
read-out encoder HW state.
Signed-off-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230316131724.359612-5-imre.deak@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/intel_display_types.h | 1
drivers/gpu/drm/i915/display/intel_tc.c | 49 +++++++++++++++++++--
2 files changed, 47 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/i915/display/intel_display_types.h
+++ b/drivers/gpu/drm/i915/display/intel_display_types.h
@@ -1763,6 +1763,7 @@ struct intel_digital_port {
bool tc_legacy_port:1;
char tc_port_name[8];
enum tc_port_mode tc_mode;
+ enum tc_port_mode tc_init_mode;
enum phy_fia tc_phy_fia;
u8 tc_phy_fia_idx;
--- a/drivers/gpu/drm/i915/display/intel_tc.c
+++ b/drivers/gpu/drm/i915/display/intel_tc.c
@@ -5,6 +5,7 @@
#include "i915_drv.h"
#include "i915_reg.h"
+#include "intel_de.h"
#include "intel_display.h"
#include "intel_display_power_map.h"
#include "intel_display_types.h"
@@ -116,6 +117,24 @@ assert_tc_cold_blocked(struct intel_digi
drm_WARN_ON(&i915->drm, !enabled);
}
+static enum intel_display_power_domain
+tc_port_power_domain(struct intel_digital_port *dig_port)
+{
+ struct drm_i915_private *i915 = to_i915(dig_port->base.base.dev);
+ enum tc_port tc_port = intel_port_to_tc(i915, dig_port->base.port);
+
+ return POWER_DOMAIN_PORT_DDI_LANES_TC1 + tc_port - TC_PORT_1;
+}
+
+static void
+assert_tc_port_power_enabled(struct intel_digital_port *dig_port)
+{
+ struct drm_i915_private *i915 = to_i915(dig_port->base.base.dev);
+
+ drm_WARN_ON(&i915->drm,
+ !intel_display_power_is_enabled(i915, tc_port_power_domain(dig_port)));
+}
+
u32 intel_tc_port_get_lane_mask(struct intel_digital_port *dig_port)
{
struct drm_i915_private *i915 = to_i915(dig_port->base.base.dev);
@@ -693,6 +712,16 @@ static void __intel_tc_port_put_link(str
dig_port->tc_link_refcount--;
}
+static bool tc_port_is_enabled(struct intel_digital_port *dig_port)
+{
+ struct drm_i915_private *i915 = to_i915(dig_port->base.base.dev);
+
+ assert_tc_port_power_enabled(dig_port);
+
+ return intel_de_read(i915, DDI_BUF_CTL(dig_port->base.port)) &
+ DDI_BUF_CTL_ENABLE;
+}
+
/**
* intel_tc_port_init_mode: Read out HW state and init the given port's TypeC mode
* @dig_port: digital port
@@ -715,9 +744,23 @@ void intel_tc_port_init_mode(struct inte
tc_cold_wref = tc_cold_block(dig_port, &domain);
dig_port->tc_mode = intel_tc_port_get_current_mode(dig_port);
+ /*
+ * Save the initial mode for the state check in
+ * intel_tc_port_sanitize_mode().
+ */
+ dig_port->tc_init_mode = dig_port->tc_mode;
+ dig_port->tc_lock_wakeref = tc_cold_block(dig_port, &dig_port->tc_lock_power_domain);
+
+ /*
+ * The PHY needs to be connected for AUX to work during HW readout and
+ * MST topology resume, but the PHY mode can only be changed if the
+ * port is disabled.
+ */
+ if (!tc_port_is_enabled(dig_port))
+ intel_tc_port_update_mode(dig_port, 1, false);
+
/* Prevent changing dig_port->tc_mode until intel_tc_port_sanitize_mode() is called. */
__intel_tc_port_get_link(dig_port);
- dig_port->tc_lock_wakeref = tc_cold_block(dig_port, &dig_port->tc_lock_power_domain);
tc_cold_unblock(dig_port, domain, tc_cold_wref);
@@ -764,11 +807,11 @@ void intel_tc_port_sanitize_mode(struct
* we'll just switch to disconnected mode from it here without
* a note.
*/
- if (dig_port->tc_mode != TC_PORT_TBT_ALT)
+ if (dig_port->tc_init_mode != TC_PORT_TBT_ALT)
drm_dbg_kms(&i915->drm,
"Port %s: PHY left in %s mode on disabled port, disconnecting it\n",
dig_port->tc_port_name,
- tc_port_mode_name(dig_port->tc_mode));
+ tc_port_mode_name(dig_port->tc_init_mode));
icl_tc_phy_disconnect(dig_port);
__intel_tc_port_put_link(dig_port);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 580/591] mtd: parsers: refer to ARCH_BCMBCA instead of ARCH_BCM4908
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (578 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 579/591] drm/i915/tc: Fix system resume MST mode restore for DP-alt sinks Greg Kroah-Hartman
@ 2023-07-16 19:51 ` Greg Kroah-Hartman
2023-07-16 19:52 ` [PATCH 6.1 581/591] netfilter: nf_tables: unbind non-anonymous set if rule construction fails Greg Kroah-Hartman
` (14 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lukas Bulwahn, Miquel Raynal
From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
commit 085679b15b5af65f9610f619afde41da0f966194 upstream.
Commit dd5c672d7ca9 ("arm64: bcmbca: Merge ARCH_BCM4908 to ARCH_BCMBCA")
removes config ARCH_BCM4908 as config ARCH_BCMBCA has the same intent.
Probably due to concurrent development, commit 002181f5b150 ("mtd: parsers:
add Broadcom's U-Boot parser") introduces 'Broadcom's U-Boot partition
parser' that depends on ARCH_BCM4908, but this use was not visible during
the config refactoring from the commit above. Hence, these two changes
create a reference to a non-existing config symbol.
Adjust the MTD_BRCM_U_BOOT definition to refer to ARCH_BCMBCA instead of
ARCH_BCM4908 to remove the reference to the non-existing config symbol
ARCH_BCM4908.
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20221116124932.4748-1-lukas.bulwahn@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/parsers/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/parsers/Kconfig
+++ b/drivers/mtd/parsers/Kconfig
@@ -22,7 +22,7 @@ config MTD_BCM63XX_PARTS
config MTD_BRCM_U_BOOT
tristate "Broadcom's U-Boot partition parser"
- depends on ARCH_BCM4908 || COMPILE_TEST
+ depends on ARCH_BCMBCA || COMPILE_TEST
help
Broadcom uses a custom way of storing U-Boot environment variables.
They are placed inside U-Boot partition itself at unspecified offset.
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 581/591] netfilter: nf_tables: unbind non-anonymous set if rule construction fails
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (579 preceding siblings ...)
2023-07-16 19:51 ` [PATCH 6.1 580/591] mtd: parsers: refer to ARCH_BCMBCA instead of ARCH_BCM4908 Greg Kroah-Hartman
@ 2023-07-16 19:52 ` Greg Kroah-Hartman
2023-07-16 19:52 ` [PATCH 6.1 582/591] blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() Greg Kroah-Hartman
` (13 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit 3e70489721b6c870252c9082c496703677240f53 upstream.
Otherwise a dangling reference to a rule object that is gone remains
in the set binding list.
Fixes: 26b5a5712eb8 ("netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_tables_api.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5139,6 +5139,8 @@ void nf_tables_deactivate_set(const stru
nft_set_trans_unbind(ctx, set);
if (nft_set_is_anonymous(set))
nft_deactivate_next(ctx->net, set);
+ else
+ list_del_rcu(&binding->list);
set->use--;
break;
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 582/591] blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (580 preceding siblings ...)
2023-07-16 19:52 ` [PATCH 6.1 581/591] netfilter: nf_tables: unbind non-anonymous set if rule construction fails Greg Kroah-Hartman
@ 2023-07-16 19:52 ` Greg Kroah-Hartman
2023-07-16 19:52 ` [PATCH 6.1 583/591] blk-cgroup: Flush stats before releasing blkcg_gq Greg Kroah-Hartman
` (12 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Waiman Long, Ming Lei, Tejun Heo,
Jens Axboe
From: Waiman Long <longman@redhat.com>
commit 3d2af77e31ade05ff7ccc3658c3635ec1bea0979 upstream.
When blkg_alloc() is called to allocate a blkcg_gq structure
with the associated blkg_iostat_set's, there are 2 fields within
blkg_iostat_set that requires proper initialization - blkg & sync.
The former field was introduced by commit 3b8cc6298724 ("blk-cgroup:
Optimize blkcg_rstat_flush()") while the later one was introduced by
commit f73316482977 ("blk-cgroup: reimplement basic IO stats using
cgroup rstat").
Unfortunately those fields in the blkg_iostat_set's are not properly
re-initialized when they are cleared in v1's blkcg_reset_stats(). This
can lead to a kernel panic due to NULL pointer access of the blkg
pointer. The missing initialization of sync is less problematic and
can be a problem in a debug kernel due to missing lockdep initialization.
Fix these problems by re-initializing them after memory clearing.
Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
Fixes: f73316482977 ("blk-cgroup: reimplement basic IO stats using cgroup rstat")
Signed-off-by: Waiman Long <longman@redhat.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/20230606180724.2455066-1-longman@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-cgroup.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -544,8 +544,13 @@ static int blkcg_reset_stats(struct cgro
struct blkg_iostat_set *bis =
per_cpu_ptr(blkg->iostat_cpu, cpu);
memset(bis, 0, sizeof(*bis));
+
+ /* Re-initialize the cleared blkg_iostat_set */
+ u64_stats_init(&bis->sync);
+ bis->blkg = blkg;
}
memset(&blkg->iostat, 0, sizeof(blkg->iostat));
+ u64_stats_init(&blkg->iostat.sync);
for (i = 0; i < BLKCG_MAX_POLS; i++) {
struct blkcg_policy *pol = blkcg_policy[i];
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 583/591] blk-cgroup: Flush stats before releasing blkcg_gq
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (581 preceding siblings ...)
2023-07-16 19:52 ` [PATCH 6.1 582/591] blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() Greg Kroah-Hartman
@ 2023-07-16 19:52 ` Greg Kroah-Hartman
2023-07-16 19:52 ` [PATCH 6.1 584/591] MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts Greg Kroah-Hartman
` (11 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jay Shin, Tejun Heo, Waiman Long,
mkoutny, Yosry Ahmed, Ming Lei, Jens Axboe
From: Ming Lei <ming.lei@redhat.com>
commit 20cb1c2fb7568a6054c55defe044311397e01ddb upstream.
As noted by Michal, the blkg_iostat_set's in the lockless list hold
reference to blkg's to protect against their removal. Those blkg's
hold reference to blkcg. When a cgroup is being destroyed,
cgroup_rstat_flush() is only called at css_release_work_fn() which
is called when the blkcg reference count reaches 0. This circular
dependency will prevent blkcg and some blkgs from being freed after
they are made offline.
It is less a problem if the cgroup to be destroyed also has other
controllers like memory that will call cgroup_rstat_flush() which will
clean up the reference count. If block is the only controller that uses
rstat, these offline blkcg and blkgs may never be freed leaking more
and more memory over time.
To prevent this potential memory leak:
- flush blkcg per-cpu stats list in __blkg_release(), when no new stat
can be added
- add global blkg_stat_lock for covering concurrent parent blkg stat
update
- don't grab bio->bi_blkg reference when adding the stats into blkcg's
per-cpu stat list since all stats are guaranteed to be consumed before
releasing blkg instance, and grabbing blkg reference for stats was the
most fragile part of original patch
Based on Waiman's patch:
https://lore.kernel.org/linux-block/20221215033132.230023-3-longman@redhat.com/
Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
Cc: stable@vger.kernel.org
Reported-by: Jay Shin <jaeshin@redhat.com>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: Waiman Long <longman@redhat.com>
Cc: mkoutny@suse.com
Cc: Yosry Ahmed <yosryahmed@google.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20230609234249.1412858-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-cgroup.c | 41 ++++++++++++++++++++++++++++++++---------
1 file changed, 32 insertions(+), 9 deletions(-)
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -35,6 +35,8 @@
#include "blk-throttle.h"
#include "blk-rq-qos.h"
+static void __blkcg_rstat_flush(struct blkcg *blkcg, int cpu);
+
/*
* blkcg_pol_mutex protects blkcg_policy[] and policy [de]activation.
* blkcg_pol_register_mutex nests outside of it and synchronizes entire
@@ -58,6 +60,8 @@ static LIST_HEAD(all_blkcgs); /* protec
bool blkcg_debug_stats = false;
static struct workqueue_struct *blkcg_punt_bio_wq;
+static DEFINE_RAW_SPINLOCK(blkg_stat_lock);
+
#define BLKG_DESTROY_BATCH_SIZE 64
/*
@@ -153,9 +157,20 @@ static void blkg_free(struct blkcg_gq *b
static void __blkg_release(struct rcu_head *rcu)
{
struct blkcg_gq *blkg = container_of(rcu, struct blkcg_gq, rcu_head);
+ struct blkcg *blkcg = blkg->blkcg;
+ int cpu;
WARN_ON(!bio_list_empty(&blkg->async_bios));
+ /*
+ * Flush all the non-empty percpu lockless lists before releasing
+ * us, given these stat belongs to us.
+ *
+ * blkg_stat_lock is for serializing blkg stat update
+ */
+ for_each_possible_cpu(cpu)
+ __blkcg_rstat_flush(blkcg, cpu);
+
/* release the blkcg and parent blkg refs this blkg has been holding */
css_put(&blkg->blkcg->css);
if (blkg->parent)
@@ -866,17 +881,12 @@ static void blkcg_iostat_update(struct b
u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags);
}
-static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu)
+static void __blkcg_rstat_flush(struct blkcg *blkcg, int cpu)
{
- struct blkcg *blkcg = css_to_blkcg(css);
struct llist_head *lhead = per_cpu_ptr(blkcg->lhead, cpu);
struct llist_node *lnode;
struct blkg_iostat_set *bisc, *next_bisc;
- /* Root-level stats are sourced from system-wide IO stats */
- if (!cgroup_parent(css->cgroup))
- return;
-
rcu_read_lock();
lnode = llist_del_all(lhead);
@@ -884,6 +894,14 @@ static void blkcg_rstat_flush(struct cgr
goto out;
/*
+ * For covering concurrent parent blkg update from blkg_release().
+ *
+ * When flushing from cgroup, cgroup_rstat_lock is always held, so
+ * this lock won't cause contention most of time.
+ */
+ raw_spin_lock(&blkg_stat_lock);
+
+ /*
* Iterate only the iostat_cpu's queued in the lockless list.
*/
llist_for_each_entry_safe(bisc, next_bisc, lnode, lnode) {
@@ -906,13 +924,19 @@ static void blkcg_rstat_flush(struct cgr
if (parent && parent->parent)
blkcg_iostat_update(parent, &blkg->iostat.cur,
&blkg->iostat.last);
- percpu_ref_put(&blkg->refcnt);
}
-
+ raw_spin_unlock(&blkg_stat_lock);
out:
rcu_read_unlock();
}
+static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu)
+{
+ /* Root-level stats are sourced from system-wide IO stats */
+ if (cgroup_parent(css->cgroup))
+ __blkcg_rstat_flush(css_to_blkcg(css), cpu);
+}
+
/*
* We source root cgroup stats from the system-wide stats to avoid
* tracking the same information twice and incurring overhead when no
@@ -2043,7 +2067,6 @@ void blk_cgroup_bio_start(struct bio *bi
llist_add(&bis->lnode, lhead);
WRITE_ONCE(bis->lqueued, true);
- percpu_ref_get(&bis->blkg->refcnt);
}
u64_stats_update_end_irqrestore(&bis->sync, flags);
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 584/591] MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (582 preceding siblings ...)
2023-07-16 19:52 ` [PATCH 6.1 583/591] blk-cgroup: Flush stats before releasing blkcg_gq Greg Kroah-Hartman
@ 2023-07-16 19:52 ` Greg Kroah-Hartman
2023-07-16 19:52 ` [PATCH 6.1 585/591] block: make sure local irq is disabled when calling __blkcg_rstat_flush Greg Kroah-Hartman
` (10 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Cercueil, Thomas Bogendoerfer
From: Paul Cercueil <paul@crapouillou.net>
commit 944520f85d5b1fb2f9ea243be41f9c9af3d4cef3 upstream.
Commit 08384e80a70f ("MIPS: DTS: CI20: Fix ACT8600 regulator node
names") caused the VDDCORE power supply (regulated by the ACT8600's
DCDC1 output) to drop from a voltage of 1.2V configured by the
bootloader, to the 1.1V set in the Device Tree.
According to the documentation, the VDDCORE supply should be between
0.99V and 1.21V; both values are therefore within the supported range.
However, VDDCORE being 1.1V results in the CI20 being very unstable,
with corrupted memory, failures to boot, or reboots at random. The
reason might be succint drops of the voltage below the minimum required.
Raising the minimum voltage to 1.125 volts seems to be enough to address
this issue, while still keeping a relatively low core voltage which
helps for power consumption and thermals.
Fixes: 08384e80a70f ("MIPS: DTS: CI20: Fix ACT8600 regulator node names")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/boot/dts/ingenic/ci20.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/mips/boot/dts/ingenic/ci20.dts
+++ b/arch/mips/boot/dts/ingenic/ci20.dts
@@ -240,8 +240,8 @@
regulators {
vddcore: DCDC1 {
- regulator-min-microvolt = <1100000>;
- regulator-max-microvolt = <1100000>;
+ regulator-min-microvolt = <1125000>;
+ regulator-max-microvolt = <1125000>;
regulator-always-on;
};
vddmem: DCDC2 {
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 585/591] block: make sure local irq is disabled when calling __blkcg_rstat_flush
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (583 preceding siblings ...)
2023-07-16 19:52 ` [PATCH 6.1 584/591] MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts Greg Kroah-Hartman
@ 2023-07-16 19:52 ` Greg Kroah-Hartman
2023-07-16 19:52 ` [PATCH 6.1 586/591] netfilter: conntrack: Avoid nf_ct_helper_hash uses after free Greg Kroah-Hartman
` (9 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinichiro Kawasaki, Jay Shin,
Tejun Heo, Waiman Long, Ming Lei, Jens Axboe
From: Ming Lei <ming.lei@redhat.com>
commit 9c39b7a905d84b7da5f59d80f2e455853fea7217 upstream.
When __blkcg_rstat_flush() is called from cgroup_rstat_flush*() code
path, interrupt is always disabled.
When we start to flush blkcg per-cpu stats list in __blkg_release()
for avoiding to leak blkcg_gq's reference in commit 20cb1c2fb756
("blk-cgroup: Flush stats before releasing blkcg_gq"), local irq
isn't disabled yet, then lockdep warning may be triggered because
the dependent cgroup locks may be acquired from irq(soft irq) handler.
Fix the issue by disabling local irq always.
Fixes: 20cb1c2fb756 ("blk-cgroup: Flush stats before releasing blkcg_gq")
Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Closes: https://lore.kernel.org/linux-block/pz2wzwnmn5tk3pwpskmjhli6g3qly7eoknilb26of376c7kwxy@qydzpvt6zpis/T/#u
Cc: stable@vger.kernel.org
Cc: Jay Shin <jaeshin@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Waiman Long <longman@redhat.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Waiman Long <longman@redhat.com>
Link: https://lore.kernel.org/r/20230622084249.1208005-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-cgroup.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -886,6 +886,7 @@ static void __blkcg_rstat_flush(struct b
struct llist_head *lhead = per_cpu_ptr(blkcg->lhead, cpu);
struct llist_node *lnode;
struct blkg_iostat_set *bisc, *next_bisc;
+ unsigned long flags;
rcu_read_lock();
@@ -899,7 +900,7 @@ static void __blkcg_rstat_flush(struct b
* When flushing from cgroup, cgroup_rstat_lock is always held, so
* this lock won't cause contention most of time.
*/
- raw_spin_lock(&blkg_stat_lock);
+ raw_spin_lock_irqsave(&blkg_stat_lock, flags);
/*
* Iterate only the iostat_cpu's queued in the lockless list.
@@ -925,7 +926,7 @@ static void __blkcg_rstat_flush(struct b
blkcg_iostat_update(parent, &blkg->iostat.cur,
&blkg->iostat.last);
}
- raw_spin_unlock(&blkg_stat_lock);
+ raw_spin_unlock_irqrestore(&blkg_stat_lock, flags);
out:
rcu_read_unlock();
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 586/591] netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (584 preceding siblings ...)
2023-07-16 19:52 ` [PATCH 6.1 585/591] block: make sure local irq is disabled when calling __blkcg_rstat_flush Greg Kroah-Hartman
@ 2023-07-16 19:52 ` Greg Kroah-Hartman
2023-07-16 19:52 ` [PATCH 6.1 587/591] netfilter: nf_tables: do not ignore genmask when looking up chain by id Greg Kroah-Hartman
` (8 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florent Revest, Florian Westphal,
Pablo Neira Ayuso
From: Florent Revest <revest@chromium.org>
commit 6eef7a2b933885a17679eb8ed0796ddf0ee5309b upstream.
If nf_conntrack_init_start() fails (for example due to a
register_nf_conntrack_bpf() failure), the nf_conntrack_helper_fini()
clean-up path frees the nf_ct_helper_hash map.
When built with NF_CONNTRACK=y, further netfilter modules (e.g:
netfilter_conntrack_ftp) can still be loaded and call
nf_conntrack_helpers_register(), independently of whether nf_conntrack
initialized correctly. This accesses the nf_ct_helper_hash dangling
pointer and causes a uaf, possibly leading to random memory corruption.
This patch guards nf_conntrack_helper_register() from accessing a freed
or uninitialized nf_ct_helper_hash pointer and fixes possible
uses-after-free when loading a conntrack module.
Cc: stable@vger.kernel.org
Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure")
Signed-off-by: Florent Revest <revest@chromium.org>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_helper.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -358,6 +358,9 @@ int nf_conntrack_helper_register(struct
BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES);
BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1);
+ if (!nf_ct_helper_hash)
+ return -ENOENT;
+
if (me->expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
return -EINVAL;
@@ -513,4 +516,5 @@ int nf_conntrack_helper_init(void)
void nf_conntrack_helper_fini(void)
{
kvfree(nf_ct_helper_hash);
+ nf_ct_helper_hash = NULL;
}
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 587/591] netfilter: nf_tables: do not ignore genmask when looking up chain by id
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (585 preceding siblings ...)
2023-07-16 19:52 ` [PATCH 6.1 586/591] netfilter: conntrack: Avoid nf_ct_helper_hash uses after free Greg Kroah-Hartman
@ 2023-07-16 19:52 ` Greg Kroah-Hartman
2023-07-17 10:02 ` Pablo Neira Ayuso
2023-07-16 19:52 ` [PATCH 6.1 588/591] netfilter: nf_tables: prevent OOB access in nft_byteorder_eval Greg Kroah-Hartman
` (7 subsequent siblings)
594 siblings, 1 reply; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thadeu Lima de Souza Cascardo,
Florian Westphal, Pablo Neira Ayuso
From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
commit 515ad530795c118f012539ed76d02bacfd426d89 upstream.
When adding a rule to a chain referring to its ID, if that chain had been
deleted on the same batch, the rule might end up referring to a deleted
chain.
This will lead to a WARNING like following:
[ 33.098431] ------------[ cut here ]------------
[ 33.098678] WARNING: CPU: 5 PID: 69 at net/netfilter/nf_tables_api.c:2037 nf_tables_chain_destroy+0x23d/0x260
[ 33.099217] Modules linked in:
[ 33.099388] CPU: 5 PID: 69 Comm: kworker/5:1 Not tainted 6.4.0+ #409
[ 33.099726] Workqueue: events nf_tables_trans_destroy_work
[ 33.100018] RIP: 0010:nf_tables_chain_destroy+0x23d/0x260
[ 33.100306] Code: 8b 7c 24 68 e8 64 9c ed fe 4c 89 e7 e8 5c 9c ed fe 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 c3 cc cc cc cc <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7
[ 33.101271] RSP: 0018:ffffc900004ffc48 EFLAGS: 00010202
[ 33.101546] RAX: 0000000000000001 RBX: ffff888006fc0a28 RCX: 0000000000000000
[ 33.101920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 33.102649] RBP: ffffc900004ffc78 R08: 0000000000000000 R09: 0000000000000000
[ 33.103018] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880135ef500
[ 33.103385] R13: 0000000000000000 R14: dead000000000122 R15: ffff888006fc0a10
[ 33.103762] FS: 0000000000000000(0000) GS:ffff888024c80000(0000) knlGS:0000000000000000
[ 33.104184] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 33.104493] CR2: 00007fe863b56a50 CR3: 00000000124b0001 CR4: 0000000000770ee0
[ 33.104872] PKRU: 55555554
[ 33.104999] Call Trace:
[ 33.105113] <TASK>
[ 33.105214] ? show_regs+0x72/0x90
[ 33.105371] ? __warn+0xa5/0x210
[ 33.105520] ? nf_tables_chain_destroy+0x23d/0x260
[ 33.105732] ? report_bug+0x1f2/0x200
[ 33.105902] ? handle_bug+0x46/0x90
[ 33.106546] ? exc_invalid_op+0x19/0x50
[ 33.106762] ? asm_exc_invalid_op+0x1b/0x20
[ 33.106995] ? nf_tables_chain_destroy+0x23d/0x260
[ 33.107249] ? nf_tables_chain_destroy+0x30/0x260
[ 33.107506] nf_tables_trans_destroy_work+0x669/0x680
[ 33.107782] ? mark_held_locks+0x28/0xa0
[ 33.107996] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10
[ 33.108294] ? _raw_spin_unlock_irq+0x28/0x70
[ 33.108538] process_one_work+0x68c/0xb70
[ 33.108755] ? lock_acquire+0x17f/0x420
[ 33.108977] ? __pfx_process_one_work+0x10/0x10
[ 33.109218] ? do_raw_spin_lock+0x128/0x1d0
[ 33.109435] ? _raw_spin_lock_irq+0x71/0x80
[ 33.109634] worker_thread+0x2bd/0x700
[ 33.109817] ? __pfx_worker_thread+0x10/0x10
[ 33.110254] kthread+0x18b/0x1d0
[ 33.110410] ? __pfx_kthread+0x10/0x10
[ 33.110581] ret_from_fork+0x29/0x50
[ 33.110757] </TASK>
[ 33.110866] irq event stamp: 1651
[ 33.111017] hardirqs last enabled at (1659): [<ffffffffa206a209>] __up_console_sem+0x79/0xa0
[ 33.111379] hardirqs last disabled at (1666): [<ffffffffa206a1ee>] __up_console_sem+0x5e/0xa0
[ 33.111740] softirqs last enabled at (1616): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0
[ 33.112094] softirqs last disabled at (1367): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0
[ 33.112453] ---[ end trace 0000000000000000 ]---
This is due to the nft_chain_lookup_byid ignoring the genmask. After this
change, adding the new rule will fail as it will not find the chain.
Fixes: 837830a4b439 ("netfilter: nf_tables: add NFTA_RULE_CHAIN_ID attribute")
Cc: stable@vger.kernel.org
Reported-by: Mingi Cho of Theori working with ZDI
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_tables_api.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2628,7 +2628,7 @@ err:
static struct nft_chain *nft_chain_lookup_byid(const struct net *net,
const struct nft_table *table,
- const struct nlattr *nla)
+ const struct nlattr *nla, u8 genmask)
{
struct nftables_pernet *nft_net = nft_pernet(net);
u32 id = ntohl(nla_get_be32(nla));
@@ -2639,7 +2639,8 @@ static struct nft_chain *nft_chain_looku
if (trans->msg_type == NFT_MSG_NEWCHAIN &&
chain->table == table &&
- id == nft_trans_chain_id(trans))
+ id == nft_trans_chain_id(trans) &&
+ nft_active_genmask(chain, genmask))
return chain;
}
return ERR_PTR(-ENOENT);
@@ -3629,7 +3630,8 @@ static int nf_tables_newrule(struct sk_b
return -EOPNOTSUPP;
} else if (nla[NFTA_RULE_CHAIN_ID]) {
- chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID]);
+ chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID],
+ genmask);
if (IS_ERR(chain)) {
NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]);
return PTR_ERR(chain);
@@ -10137,7 +10139,8 @@ static int nft_verdict_init(const struct
genmask);
} else if (tb[NFTA_VERDICT_CHAIN_ID]) {
chain = nft_chain_lookup_byid(ctx->net, ctx->table,
- tb[NFTA_VERDICT_CHAIN_ID]);
+ tb[NFTA_VERDICT_CHAIN_ID],
+ genmask);
if (IS_ERR(chain))
return PTR_ERR(chain);
} else {
^ permalink raw reply [flat|nested] 604+ messages in thread* Re: [PATCH 6.1 587/591] netfilter: nf_tables: do not ignore genmask when looking up chain by id
2023-07-16 19:52 ` [PATCH 6.1 587/591] netfilter: nf_tables: do not ignore genmask when looking up chain by id Greg Kroah-Hartman
@ 2023-07-17 10:02 ` Pablo Neira Ayuso
2023-07-17 18:39 ` Greg Kroah-Hartman
0 siblings, 1 reply; 604+ messages in thread
From: Pablo Neira Ayuso @ 2023-07-17 10:02 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Thadeu Lima de Souza Cascardo, Florian Westphal
Hi Greg,
On Sun, Jul 16, 2023 at 09:52:06PM +0200, Greg Kroah-Hartman wrote:
> From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
>
> commit 515ad530795c118f012539ed76d02bacfd426d89 upstream.
You can cherry-pick this commit to:
- 5.15.y
- 5.10.y
Just tested here and it is good, no hunks are reported.
Thanks.
> When adding a rule to a chain referring to its ID, if that chain had been
> deleted on the same batch, the rule might end up referring to a deleted
> chain.
>
> This will lead to a WARNING like following:
>
> [ 33.098431] ------------[ cut here ]------------
> [ 33.098678] WARNING: CPU: 5 PID: 69 at net/netfilter/nf_tables_api.c:2037 nf_tables_chain_destroy+0x23d/0x260
> [ 33.099217] Modules linked in:
> [ 33.099388] CPU: 5 PID: 69 Comm: kworker/5:1 Not tainted 6.4.0+ #409
> [ 33.099726] Workqueue: events nf_tables_trans_destroy_work
> [ 33.100018] RIP: 0010:nf_tables_chain_destroy+0x23d/0x260
> [ 33.100306] Code: 8b 7c 24 68 e8 64 9c ed fe 4c 89 e7 e8 5c 9c ed fe 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 c3 cc cc cc cc <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7
> [ 33.101271] RSP: 0018:ffffc900004ffc48 EFLAGS: 00010202
> [ 33.101546] RAX: 0000000000000001 RBX: ffff888006fc0a28 RCX: 0000000000000000
> [ 33.101920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 33.102649] RBP: ffffc900004ffc78 R08: 0000000000000000 R09: 0000000000000000
> [ 33.103018] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880135ef500
> [ 33.103385] R13: 0000000000000000 R14: dead000000000122 R15: ffff888006fc0a10
> [ 33.103762] FS: 0000000000000000(0000) GS:ffff888024c80000(0000) knlGS:0000000000000000
> [ 33.104184] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 33.104493] CR2: 00007fe863b56a50 CR3: 00000000124b0001 CR4: 0000000000770ee0
> [ 33.104872] PKRU: 55555554
> [ 33.104999] Call Trace:
> [ 33.105113] <TASK>
> [ 33.105214] ? show_regs+0x72/0x90
> [ 33.105371] ? __warn+0xa5/0x210
> [ 33.105520] ? nf_tables_chain_destroy+0x23d/0x260
> [ 33.105732] ? report_bug+0x1f2/0x200
> [ 33.105902] ? handle_bug+0x46/0x90
> [ 33.106546] ? exc_invalid_op+0x19/0x50
> [ 33.106762] ? asm_exc_invalid_op+0x1b/0x20
> [ 33.106995] ? nf_tables_chain_destroy+0x23d/0x260
> [ 33.107249] ? nf_tables_chain_destroy+0x30/0x260
> [ 33.107506] nf_tables_trans_destroy_work+0x669/0x680
> [ 33.107782] ? mark_held_locks+0x28/0xa0
> [ 33.107996] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10
> [ 33.108294] ? _raw_spin_unlock_irq+0x28/0x70
> [ 33.108538] process_one_work+0x68c/0xb70
> [ 33.108755] ? lock_acquire+0x17f/0x420
> [ 33.108977] ? __pfx_process_one_work+0x10/0x10
> [ 33.109218] ? do_raw_spin_lock+0x128/0x1d0
> [ 33.109435] ? _raw_spin_lock_irq+0x71/0x80
> [ 33.109634] worker_thread+0x2bd/0x700
> [ 33.109817] ? __pfx_worker_thread+0x10/0x10
> [ 33.110254] kthread+0x18b/0x1d0
> [ 33.110410] ? __pfx_kthread+0x10/0x10
> [ 33.110581] ret_from_fork+0x29/0x50
> [ 33.110757] </TASK>
> [ 33.110866] irq event stamp: 1651
> [ 33.111017] hardirqs last enabled at (1659): [<ffffffffa206a209>] __up_console_sem+0x79/0xa0
> [ 33.111379] hardirqs last disabled at (1666): [<ffffffffa206a1ee>] __up_console_sem+0x5e/0xa0
> [ 33.111740] softirqs last enabled at (1616): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0
> [ 33.112094] softirqs last disabled at (1367): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0
> [ 33.112453] ---[ end trace 0000000000000000 ]---
>
> This is due to the nft_chain_lookup_byid ignoring the genmask. After this
> change, adding the new rule will fail as it will not find the chain.
>
> Fixes: 837830a4b439 ("netfilter: nf_tables: add NFTA_RULE_CHAIN_ID attribute")
> Cc: stable@vger.kernel.org
> Reported-by: Mingi Cho of Theori working with ZDI
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> Reviewed-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> net/netfilter/nf_tables_api.c | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
>
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -2628,7 +2628,7 @@ err:
>
> static struct nft_chain *nft_chain_lookup_byid(const struct net *net,
> const struct nft_table *table,
> - const struct nlattr *nla)
> + const struct nlattr *nla, u8 genmask)
> {
> struct nftables_pernet *nft_net = nft_pernet(net);
> u32 id = ntohl(nla_get_be32(nla));
> @@ -2639,7 +2639,8 @@ static struct nft_chain *nft_chain_looku
>
> if (trans->msg_type == NFT_MSG_NEWCHAIN &&
> chain->table == table &&
> - id == nft_trans_chain_id(trans))
> + id == nft_trans_chain_id(trans) &&
> + nft_active_genmask(chain, genmask))
> return chain;
> }
> return ERR_PTR(-ENOENT);
> @@ -3629,7 +3630,8 @@ static int nf_tables_newrule(struct sk_b
> return -EOPNOTSUPP;
>
> } else if (nla[NFTA_RULE_CHAIN_ID]) {
> - chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID]);
> + chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID],
> + genmask);
> if (IS_ERR(chain)) {
> NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]);
> return PTR_ERR(chain);
> @@ -10137,7 +10139,8 @@ static int nft_verdict_init(const struct
> genmask);
> } else if (tb[NFTA_VERDICT_CHAIN_ID]) {
> chain = nft_chain_lookup_byid(ctx->net, ctx->table,
> - tb[NFTA_VERDICT_CHAIN_ID]);
> + tb[NFTA_VERDICT_CHAIN_ID],
> + genmask);
> if (IS_ERR(chain))
> return PTR_ERR(chain);
> } else {
>
>
^ permalink raw reply [flat|nested] 604+ messages in thread* Re: [PATCH 6.1 587/591] netfilter: nf_tables: do not ignore genmask when looking up chain by id
2023-07-17 10:02 ` Pablo Neira Ayuso
@ 2023-07-17 18:39 ` Greg Kroah-Hartman
0 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-17 18:39 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: stable, patches, Thadeu Lima de Souza Cascardo, Florian Westphal
On Mon, Jul 17, 2023 at 12:02:07PM +0200, Pablo Neira Ayuso wrote:
> Hi Greg,
>
> On Sun, Jul 16, 2023 at 09:52:06PM +0200, Greg Kroah-Hartman wrote:
> > From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> >
> > commit 515ad530795c118f012539ed76d02bacfd426d89 upstream.
>
> You can cherry-pick this commit to:
>
> - 5.15.y
> - 5.10.y
>
> Just tested here and it is good, no hunks are reported.
Already queued up there, thanks!
greg k-h
^ permalink raw reply [flat|nested] 604+ messages in thread
* [PATCH 6.1 588/591] netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (586 preceding siblings ...)
2023-07-16 19:52 ` [PATCH 6.1 587/591] netfilter: nf_tables: do not ignore genmask when looking up chain by id Greg Kroah-Hartman
@ 2023-07-16 19:52 ` Greg Kroah-Hartman
2023-07-17 10:08 ` Pablo Neira Ayuso
2023-07-16 19:52 ` [PATCH 6.1 589/591] wireguard: queueing: use saner cpu selection wrapping Greg Kroah-Hartman
` (6 subsequent siblings)
594 siblings, 1 reply; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thadeu Lima de Souza Cascardo,
Florian Westphal, Pablo Neira Ayuso
From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
commit caf3ef7468f7534771b5c44cd8dbd6f7f87c2cbd upstream.
When evaluating byteorder expressions with size 2, a union with 32-bit and
16-bit members is used. Since the 16-bit members are aligned to 32-bit,
the array accesses will be out-of-bounds.
It may lead to a stack-out-of-bounds access like the one below:
[ 23.095215] ==================================================================
[ 23.095625] BUG: KASAN: stack-out-of-bounds in nft_byteorder_eval+0x13c/0x320
[ 23.096020] Read of size 2 at addr ffffc90000007948 by task ping/115
[ 23.096358]
[ 23.096456] CPU: 0 PID: 115 Comm: ping Not tainted 6.4.0+ #413
[ 23.096770] Call Trace:
[ 23.096910] <IRQ>
[ 23.097030] dump_stack_lvl+0x60/0xc0
[ 23.097218] print_report+0xcf/0x630
[ 23.097388] ? nft_byteorder_eval+0x13c/0x320
[ 23.097577] ? kasan_addr_to_slab+0xd/0xc0
[ 23.097760] ? nft_byteorder_eval+0x13c/0x320
[ 23.097949] kasan_report+0xc9/0x110
[ 23.098106] ? nft_byteorder_eval+0x13c/0x320
[ 23.098298] __asan_load2+0x83/0xd0
[ 23.098453] nft_byteorder_eval+0x13c/0x320
[ 23.098659] nft_do_chain+0x1c8/0xc50
[ 23.098852] ? __pfx_nft_do_chain+0x10/0x10
[ 23.099078] ? __kasan_check_read+0x11/0x20
[ 23.099295] ? __pfx___lock_acquire+0x10/0x10
[ 23.099535] ? __pfx___lock_acquire+0x10/0x10
[ 23.099745] ? __kasan_check_read+0x11/0x20
[ 23.099929] nft_do_chain_ipv4+0xfe/0x140
[ 23.100105] ? __pfx_nft_do_chain_ipv4+0x10/0x10
[ 23.100327] ? lock_release+0x204/0x400
[ 23.100515] ? nf_hook.constprop.0+0x340/0x550
[ 23.100779] nf_hook_slow+0x6c/0x100
[ 23.100977] ? __pfx_nft_do_chain_ipv4+0x10/0x10
[ 23.101223] nf_hook.constprop.0+0x334/0x550
[ 23.101443] ? __pfx_ip_local_deliver_finish+0x10/0x10
[ 23.101677] ? __pfx_nf_hook.constprop.0+0x10/0x10
[ 23.101882] ? __pfx_ip_rcv_finish+0x10/0x10
[ 23.102071] ? __pfx_ip_local_deliver_finish+0x10/0x10
[ 23.102291] ? rcu_read_lock_held+0x4b/0x70
[ 23.102481] ip_local_deliver+0xbb/0x110
[ 23.102665] ? __pfx_ip_rcv+0x10/0x10
[ 23.102839] ip_rcv+0x199/0x2a0
[ 23.102980] ? __pfx_ip_rcv+0x10/0x10
[ 23.103140] __netif_receive_skb_one_core+0x13e/0x150
[ 23.103362] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 23.103647] ? mark_held_locks+0x48/0xa0
[ 23.103819] ? process_backlog+0x36c/0x380
[ 23.103999] __netif_receive_skb+0x23/0xc0
[ 23.104179] process_backlog+0x91/0x380
[ 23.104350] __napi_poll.constprop.0+0x66/0x360
[ 23.104589] ? net_rx_action+0x1cb/0x610
[ 23.104811] net_rx_action+0x33e/0x610
[ 23.105024] ? _raw_spin_unlock+0x23/0x50
[ 23.105257] ? __pfx_net_rx_action+0x10/0x10
[ 23.105485] ? mark_held_locks+0x48/0xa0
[ 23.105741] __do_softirq+0xfa/0x5ab
[ 23.105956] ? __dev_queue_xmit+0x765/0x1c00
[ 23.106193] do_softirq.part.0+0x49/0xc0
[ 23.106423] </IRQ>
[ 23.106547] <TASK>
[ 23.106670] __local_bh_enable_ip+0xf5/0x120
[ 23.106903] __dev_queue_xmit+0x789/0x1c00
[ 23.107131] ? __pfx___dev_queue_xmit+0x10/0x10
[ 23.107381] ? find_held_lock+0x8e/0xb0
[ 23.107585] ? lock_release+0x204/0x400
[ 23.107798] ? neigh_resolve_output+0x185/0x350
[ 23.108049] ? mark_held_locks+0x48/0xa0
[ 23.108265] ? neigh_resolve_output+0x185/0x350
[ 23.108514] neigh_resolve_output+0x246/0x350
[ 23.108753] ? neigh_resolve_output+0x246/0x350
[ 23.109003] ip_finish_output2+0x3c3/0x10b0
[ 23.109250] ? __pfx_ip_finish_output2+0x10/0x10
[ 23.109510] ? __pfx_nf_hook+0x10/0x10
[ 23.109732] __ip_finish_output+0x217/0x390
[ 23.109978] ip_finish_output+0x2f/0x130
[ 23.110207] ip_output+0xc9/0x170
[ 23.110404] ip_push_pending_frames+0x1a0/0x240
[ 23.110652] raw_sendmsg+0x102e/0x19e0
[ 23.110871] ? __pfx_raw_sendmsg+0x10/0x10
[ 23.111093] ? lock_release+0x204/0x400
[ 23.111304] ? __mod_lruvec_page_state+0x148/0x330
[ 23.111567] ? find_held_lock+0x8e/0xb0
[ 23.111777] ? find_held_lock+0x8e/0xb0
[ 23.111993] ? __rcu_read_unlock+0x7c/0x2f0
[ 23.112225] ? aa_sk_perm+0x18a/0x550
[ 23.112431] ? filemap_map_pages+0x4f1/0x900
[ 23.112665] ? __pfx_aa_sk_perm+0x10/0x10
[ 23.112880] ? find_held_lock+0x8e/0xb0
[ 23.113098] inet_sendmsg+0xa0/0xb0
[ 23.113297] ? inet_sendmsg+0xa0/0xb0
[ 23.113500] ? __pfx_inet_sendmsg+0x10/0x10
[ 23.113727] sock_sendmsg+0xf4/0x100
[ 23.113924] ? move_addr_to_kernel.part.0+0x4f/0xa0
[ 23.114190] __sys_sendto+0x1d4/0x290
[ 23.114391] ? __pfx___sys_sendto+0x10/0x10
[ 23.114621] ? __pfx_mark_lock.part.0+0x10/0x10
[ 23.114869] ? lock_release+0x204/0x400
[ 23.115076] ? find_held_lock+0x8e/0xb0
[ 23.115287] ? rcu_is_watching+0x23/0x60
[ 23.115503] ? __rseq_handle_notify_resume+0x6e2/0x860
[ 23.115778] ? __kasan_check_write+0x14/0x30
[ 23.116008] ? blkcg_maybe_throttle_current+0x8d/0x770
[ 23.116285] ? mark_held_locks+0x28/0xa0
[ 23.116503] ? do_syscall_64+0x37/0x90
[ 23.116713] __x64_sys_sendto+0x7f/0xb0
[ 23.116924] do_syscall_64+0x59/0x90
[ 23.117123] ? irqentry_exit_to_user_mode+0x25/0x30
[ 23.117387] ? irqentry_exit+0x77/0xb0
[ 23.117593] ? exc_page_fault+0x92/0x140
[ 23.117806] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 23.118081] RIP: 0033:0x7f744aee2bba
[ 23.118282] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
[ 23.119237] RSP: 002b:00007ffd04a7c9f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 23.119644] RAX: ffffffffffffffda RBX: 00007ffd04a7e0a0 RCX: 00007f744aee2bba
[ 23.120023] RDX: 0000000000000040 RSI: 000056488e9e6300 RDI: 0000000000000003
[ 23.120413] RBP: 000056488e9e6300 R08: 00007ffd04a80320 R09: 0000000000000010
[ 23.120809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
[ 23.121219] R13: 00007ffd04a7dc38 R14: 00007ffd04a7ca00 R15: 00007ffd04a7e0a0
[ 23.121617] </TASK>
[ 23.121749]
[ 23.121845] The buggy address belongs to the virtual mapping at
[ 23.121845] [ffffc90000000000, ffffc90000009000) created by:
[ 23.121845] irq_init_percpu_irqstack+0x1cf/0x270
[ 23.122707]
[ 23.122803] The buggy address belongs to the physical page:
[ 23.123104] page:0000000072ac19f0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24a09
[ 23.123609] flags: 0xfffffc0001000(reserved|node=0|zone=1|lastcpupid=0x1fffff)
[ 23.123998] page_type: 0xffffffff()
[ 23.124194] raw: 000fffffc0001000 ffffea0000928248 ffffea0000928248 0000000000000000
[ 23.124610] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 23.125023] page dumped because: kasan: bad access detected
[ 23.125326]
[ 23.125421] Memory state around the buggy address:
[ 23.125682] ffffc90000007800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 23.126072] ffffc90000007880: 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00 f2 f2 00
[ 23.126455] >ffffc90000007900: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00
[ 23.126840] ^
[ 23.127138] ffffc90000007980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3
[ 23.127522] ffffc90000007a00: f3 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
[ 23.127906] ==================================================================
[ 23.128324] Disabling lock debugging due to kernel taint
Using simple s16 pointers for the 16-bit accesses fixes the problem. For
the 32-bit accesses, src and dst can be used directly.
Fixes: 96518518cc41 ("netfilter: add nftables")
Cc: stable@vger.kernel.org
Reported-by: Tanguy DUBROCA (@SidewayRE) from @Synacktiv working with ZDI
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_byteorder.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/net/netfilter/nft_byteorder.c
+++ b/net/netfilter/nft_byteorder.c
@@ -30,11 +30,11 @@ void nft_byteorder_eval(const struct nft
const struct nft_byteorder *priv = nft_expr_priv(expr);
u32 *src = ®s->data[priv->sreg];
u32 *dst = ®s->data[priv->dreg];
- union { u32 u32; u16 u16; } *s, *d;
+ u16 *s16, *d16;
unsigned int i;
- s = (void *)src;
- d = (void *)dst;
+ s16 = (void *)src;
+ d16 = (void *)dst;
switch (priv->size) {
case 8: {
@@ -62,11 +62,11 @@ void nft_byteorder_eval(const struct nft
switch (priv->op) {
case NFT_BYTEORDER_NTOH:
for (i = 0; i < priv->len / 4; i++)
- d[i].u32 = ntohl((__force __be32)s[i].u32);
+ dst[i] = ntohl((__force __be32)src[i]);
break;
case NFT_BYTEORDER_HTON:
for (i = 0; i < priv->len / 4; i++)
- d[i].u32 = (__force __u32)htonl(s[i].u32);
+ dst[i] = (__force __u32)htonl(src[i]);
break;
}
break;
@@ -74,11 +74,11 @@ void nft_byteorder_eval(const struct nft
switch (priv->op) {
case NFT_BYTEORDER_NTOH:
for (i = 0; i < priv->len / 2; i++)
- d[i].u16 = ntohs((__force __be16)s[i].u16);
+ d16[i] = ntohs((__force __be16)s16[i]);
break;
case NFT_BYTEORDER_HTON:
for (i = 0; i < priv->len / 2; i++)
- d[i].u16 = (__force __u16)htons(s[i].u16);
+ d16[i] = (__force __u16)htons(s16[i]);
break;
}
break;
^ permalink raw reply [flat|nested] 604+ messages in thread* Re: [PATCH 6.1 588/591] netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
2023-07-16 19:52 ` [PATCH 6.1 588/591] netfilter: nf_tables: prevent OOB access in nft_byteorder_eval Greg Kroah-Hartman
@ 2023-07-17 10:08 ` Pablo Neira Ayuso
2023-07-17 18:39 ` Greg Kroah-Hartman
0 siblings, 1 reply; 604+ messages in thread
From: Pablo Neira Ayuso @ 2023-07-17 10:08 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Thadeu Lima de Souza Cascardo, Florian Westphal
Hi Greg,
On Sun, Jul 16, 2023 at 09:52:07PM +0200, Greg Kroah-Hartman wrote:
> From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
>
> commit caf3ef7468f7534771b5c44cd8dbd6f7f87c2cbd upstream.
You can also cherry-pick this commit to:
- 5.15.y
- 5.10.y
- 5.4.y
- 4.19.y
- 4.14.y
Just tested here and it is good, no hunks are reported.
Thanks.
> When evaluating byteorder expressions with size 2, a union with 32-bit and
> 16-bit members is used. Since the 16-bit members are aligned to 32-bit,
> the array accesses will be out-of-bounds.
>
> It may lead to a stack-out-of-bounds access like the one below:
>
> [ 23.095215] ==================================================================
> [ 23.095625] BUG: KASAN: stack-out-of-bounds in nft_byteorder_eval+0x13c/0x320
> [ 23.096020] Read of size 2 at addr ffffc90000007948 by task ping/115
> [ 23.096358]
> [ 23.096456] CPU: 0 PID: 115 Comm: ping Not tainted 6.4.0+ #413
> [ 23.096770] Call Trace:
> [ 23.096910] <IRQ>
> [ 23.097030] dump_stack_lvl+0x60/0xc0
> [ 23.097218] print_report+0xcf/0x630
> [ 23.097388] ? nft_byteorder_eval+0x13c/0x320
> [ 23.097577] ? kasan_addr_to_slab+0xd/0xc0
> [ 23.097760] ? nft_byteorder_eval+0x13c/0x320
> [ 23.097949] kasan_report+0xc9/0x110
> [ 23.098106] ? nft_byteorder_eval+0x13c/0x320
> [ 23.098298] __asan_load2+0x83/0xd0
> [ 23.098453] nft_byteorder_eval+0x13c/0x320
> [ 23.098659] nft_do_chain+0x1c8/0xc50
> [ 23.098852] ? __pfx_nft_do_chain+0x10/0x10
> [ 23.099078] ? __kasan_check_read+0x11/0x20
> [ 23.099295] ? __pfx___lock_acquire+0x10/0x10
> [ 23.099535] ? __pfx___lock_acquire+0x10/0x10
> [ 23.099745] ? __kasan_check_read+0x11/0x20
> [ 23.099929] nft_do_chain_ipv4+0xfe/0x140
> [ 23.100105] ? __pfx_nft_do_chain_ipv4+0x10/0x10
> [ 23.100327] ? lock_release+0x204/0x400
> [ 23.100515] ? nf_hook.constprop.0+0x340/0x550
> [ 23.100779] nf_hook_slow+0x6c/0x100
> [ 23.100977] ? __pfx_nft_do_chain_ipv4+0x10/0x10
> [ 23.101223] nf_hook.constprop.0+0x334/0x550
> [ 23.101443] ? __pfx_ip_local_deliver_finish+0x10/0x10
> [ 23.101677] ? __pfx_nf_hook.constprop.0+0x10/0x10
> [ 23.101882] ? __pfx_ip_rcv_finish+0x10/0x10
> [ 23.102071] ? __pfx_ip_local_deliver_finish+0x10/0x10
> [ 23.102291] ? rcu_read_lock_held+0x4b/0x70
> [ 23.102481] ip_local_deliver+0xbb/0x110
> [ 23.102665] ? __pfx_ip_rcv+0x10/0x10
> [ 23.102839] ip_rcv+0x199/0x2a0
> [ 23.102980] ? __pfx_ip_rcv+0x10/0x10
> [ 23.103140] __netif_receive_skb_one_core+0x13e/0x150
> [ 23.103362] ? __pfx___netif_receive_skb_one_core+0x10/0x10
> [ 23.103647] ? mark_held_locks+0x48/0xa0
> [ 23.103819] ? process_backlog+0x36c/0x380
> [ 23.103999] __netif_receive_skb+0x23/0xc0
> [ 23.104179] process_backlog+0x91/0x380
> [ 23.104350] __napi_poll.constprop.0+0x66/0x360
> [ 23.104589] ? net_rx_action+0x1cb/0x610
> [ 23.104811] net_rx_action+0x33e/0x610
> [ 23.105024] ? _raw_spin_unlock+0x23/0x50
> [ 23.105257] ? __pfx_net_rx_action+0x10/0x10
> [ 23.105485] ? mark_held_locks+0x48/0xa0
> [ 23.105741] __do_softirq+0xfa/0x5ab
> [ 23.105956] ? __dev_queue_xmit+0x765/0x1c00
> [ 23.106193] do_softirq.part.0+0x49/0xc0
> [ 23.106423] </IRQ>
> [ 23.106547] <TASK>
> [ 23.106670] __local_bh_enable_ip+0xf5/0x120
> [ 23.106903] __dev_queue_xmit+0x789/0x1c00
> [ 23.107131] ? __pfx___dev_queue_xmit+0x10/0x10
> [ 23.107381] ? find_held_lock+0x8e/0xb0
> [ 23.107585] ? lock_release+0x204/0x400
> [ 23.107798] ? neigh_resolve_output+0x185/0x350
> [ 23.108049] ? mark_held_locks+0x48/0xa0
> [ 23.108265] ? neigh_resolve_output+0x185/0x350
> [ 23.108514] neigh_resolve_output+0x246/0x350
> [ 23.108753] ? neigh_resolve_output+0x246/0x350
> [ 23.109003] ip_finish_output2+0x3c3/0x10b0
> [ 23.109250] ? __pfx_ip_finish_output2+0x10/0x10
> [ 23.109510] ? __pfx_nf_hook+0x10/0x10
> [ 23.109732] __ip_finish_output+0x217/0x390
> [ 23.109978] ip_finish_output+0x2f/0x130
> [ 23.110207] ip_output+0xc9/0x170
> [ 23.110404] ip_push_pending_frames+0x1a0/0x240
> [ 23.110652] raw_sendmsg+0x102e/0x19e0
> [ 23.110871] ? __pfx_raw_sendmsg+0x10/0x10
> [ 23.111093] ? lock_release+0x204/0x400
> [ 23.111304] ? __mod_lruvec_page_state+0x148/0x330
> [ 23.111567] ? find_held_lock+0x8e/0xb0
> [ 23.111777] ? find_held_lock+0x8e/0xb0
> [ 23.111993] ? __rcu_read_unlock+0x7c/0x2f0
> [ 23.112225] ? aa_sk_perm+0x18a/0x550
> [ 23.112431] ? filemap_map_pages+0x4f1/0x900
> [ 23.112665] ? __pfx_aa_sk_perm+0x10/0x10
> [ 23.112880] ? find_held_lock+0x8e/0xb0
> [ 23.113098] inet_sendmsg+0xa0/0xb0
> [ 23.113297] ? inet_sendmsg+0xa0/0xb0
> [ 23.113500] ? __pfx_inet_sendmsg+0x10/0x10
> [ 23.113727] sock_sendmsg+0xf4/0x100
> [ 23.113924] ? move_addr_to_kernel.part.0+0x4f/0xa0
> [ 23.114190] __sys_sendto+0x1d4/0x290
> [ 23.114391] ? __pfx___sys_sendto+0x10/0x10
> [ 23.114621] ? __pfx_mark_lock.part.0+0x10/0x10
> [ 23.114869] ? lock_release+0x204/0x400
> [ 23.115076] ? find_held_lock+0x8e/0xb0
> [ 23.115287] ? rcu_is_watching+0x23/0x60
> [ 23.115503] ? __rseq_handle_notify_resume+0x6e2/0x860
> [ 23.115778] ? __kasan_check_write+0x14/0x30
> [ 23.116008] ? blkcg_maybe_throttle_current+0x8d/0x770
> [ 23.116285] ? mark_held_locks+0x28/0xa0
> [ 23.116503] ? do_syscall_64+0x37/0x90
> [ 23.116713] __x64_sys_sendto+0x7f/0xb0
> [ 23.116924] do_syscall_64+0x59/0x90
> [ 23.117123] ? irqentry_exit_to_user_mode+0x25/0x30
> [ 23.117387] ? irqentry_exit+0x77/0xb0
> [ 23.117593] ? exc_page_fault+0x92/0x140
> [ 23.117806] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
> [ 23.118081] RIP: 0033:0x7f744aee2bba
> [ 23.118282] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
> [ 23.119237] RSP: 002b:00007ffd04a7c9f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
> [ 23.119644] RAX: ffffffffffffffda RBX: 00007ffd04a7e0a0 RCX: 00007f744aee2bba
> [ 23.120023] RDX: 0000000000000040 RSI: 000056488e9e6300 RDI: 0000000000000003
> [ 23.120413] RBP: 000056488e9e6300 R08: 00007ffd04a80320 R09: 0000000000000010
> [ 23.120809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
> [ 23.121219] R13: 00007ffd04a7dc38 R14: 00007ffd04a7ca00 R15: 00007ffd04a7e0a0
> [ 23.121617] </TASK>
> [ 23.121749]
> [ 23.121845] The buggy address belongs to the virtual mapping at
> [ 23.121845] [ffffc90000000000, ffffc90000009000) created by:
> [ 23.121845] irq_init_percpu_irqstack+0x1cf/0x270
> [ 23.122707]
> [ 23.122803] The buggy address belongs to the physical page:
> [ 23.123104] page:0000000072ac19f0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24a09
> [ 23.123609] flags: 0xfffffc0001000(reserved|node=0|zone=1|lastcpupid=0x1fffff)
> [ 23.123998] page_type: 0xffffffff()
> [ 23.124194] raw: 000fffffc0001000 ffffea0000928248 ffffea0000928248 0000000000000000
> [ 23.124610] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
> [ 23.125023] page dumped because: kasan: bad access detected
> [ 23.125326]
> [ 23.125421] Memory state around the buggy address:
> [ 23.125682] ffffc90000007800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 23.126072] ffffc90000007880: 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00 f2 f2 00
> [ 23.126455] >ffffc90000007900: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00
> [ 23.126840] ^
> [ 23.127138] ffffc90000007980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3
> [ 23.127522] ffffc90000007a00: f3 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
> [ 23.127906] ==================================================================
> [ 23.128324] Disabling lock debugging due to kernel taint
>
> Using simple s16 pointers for the 16-bit accesses fixes the problem. For
> the 32-bit accesses, src and dst can be used directly.
>
> Fixes: 96518518cc41 ("netfilter: add nftables")
> Cc: stable@vger.kernel.org
> Reported-by: Tanguy DUBROCA (@SidewayRE) from @Synacktiv working with ZDI
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> Reviewed-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> net/netfilter/nft_byteorder.c | 14 +++++++-------
> 1 file changed, 7 insertions(+), 7 deletions(-)
>
> --- a/net/netfilter/nft_byteorder.c
> +++ b/net/netfilter/nft_byteorder.c
> @@ -30,11 +30,11 @@ void nft_byteorder_eval(const struct nft
> const struct nft_byteorder *priv = nft_expr_priv(expr);
> u32 *src = ®s->data[priv->sreg];
> u32 *dst = ®s->data[priv->dreg];
> - union { u32 u32; u16 u16; } *s, *d;
> + u16 *s16, *d16;
> unsigned int i;
>
> - s = (void *)src;
> - d = (void *)dst;
> + s16 = (void *)src;
> + d16 = (void *)dst;
>
> switch (priv->size) {
> case 8: {
> @@ -62,11 +62,11 @@ void nft_byteorder_eval(const struct nft
> switch (priv->op) {
> case NFT_BYTEORDER_NTOH:
> for (i = 0; i < priv->len / 4; i++)
> - d[i].u32 = ntohl((__force __be32)s[i].u32);
> + dst[i] = ntohl((__force __be32)src[i]);
> break;
> case NFT_BYTEORDER_HTON:
> for (i = 0; i < priv->len / 4; i++)
> - d[i].u32 = (__force __u32)htonl(s[i].u32);
> + dst[i] = (__force __u32)htonl(src[i]);
> break;
> }
> break;
> @@ -74,11 +74,11 @@ void nft_byteorder_eval(const struct nft
> switch (priv->op) {
> case NFT_BYTEORDER_NTOH:
> for (i = 0; i < priv->len / 2; i++)
> - d[i].u16 = ntohs((__force __be16)s[i].u16);
> + d16[i] = ntohs((__force __be16)s16[i]);
> break;
> case NFT_BYTEORDER_HTON:
> for (i = 0; i < priv->len / 2; i++)
> - d[i].u16 = (__force __u16)htons(s[i].u16);
> + d16[i] = (__force __u16)htons(s16[i]);
> break;
> }
> break;
>
>
^ permalink raw reply [flat|nested] 604+ messages in thread* Re: [PATCH 6.1 588/591] netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
2023-07-17 10:08 ` Pablo Neira Ayuso
@ 2023-07-17 18:39 ` Greg Kroah-Hartman
0 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-17 18:39 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: stable, patches, Thadeu Lima de Souza Cascardo, Florian Westphal
On Mon, Jul 17, 2023 at 12:08:54PM +0200, Pablo Neira Ayuso wrote:
> Hi Greg,
>
> On Sun, Jul 16, 2023 at 09:52:07PM +0200, Greg Kroah-Hartman wrote:
> > From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> >
> > commit caf3ef7468f7534771b5c44cd8dbd6f7f87c2cbd upstream.
>
> You can also cherry-pick this commit to:
>
> - 5.15.y
> - 5.10.y
> - 5.4.y
> - 4.19.y
> - 4.14.y
Already queued up there, thanks!
greg k-h
^ permalink raw reply [flat|nested] 604+ messages in thread
* [PATCH 6.1 589/591] wireguard: queueing: use saner cpu selection wrapping
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (587 preceding siblings ...)
2023-07-16 19:52 ` [PATCH 6.1 588/591] netfilter: nf_tables: prevent OOB access in nft_byteorder_eval Greg Kroah-Hartman
@ 2023-07-16 19:52 ` Greg Kroah-Hartman
2023-07-16 19:52 ` [PATCH 6.1 590/591] wireguard: netlink: send staged packets when setting initial private key Greg Kroah-Hartman
` (5 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Torvalds, Manuel Leiner,
Jason A. Donenfeld, David S. Miller
From: Jason A. Donenfeld <Jason@zx2c4.com>
commit 7387943fa35516f6f8017a3b0e9ce48a3bef9faa upstream.
Using `% nr_cpumask_bits` is slow and complicated, and not totally
robust toward dynamic changes to CPU topologies. Rather than storing the
next CPU in the round-robin, just store the last one, and also return
that value. This simplifies the loop drastically into a much more common
pattern.
Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Cc: stable@vger.kernel.org
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: Manuel Leiner <manuel.leiner@gmx.de>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireguard/queueing.c | 1 +
drivers/net/wireguard/queueing.h | 25 +++++++++++--------------
drivers/net/wireguard/receive.c | 2 +-
drivers/net/wireguard/send.c | 2 +-
4 files changed, 14 insertions(+), 16 deletions(-)
--- a/drivers/net/wireguard/queueing.c
+++ b/drivers/net/wireguard/queueing.c
@@ -28,6 +28,7 @@ int wg_packet_queue_init(struct crypt_qu
int ret;
memset(queue, 0, sizeof(*queue));
+ queue->last_cpu = -1;
ret = ptr_ring_init(&queue->ring, len, GFP_KERNEL);
if (ret)
return ret;
--- a/drivers/net/wireguard/queueing.h
+++ b/drivers/net/wireguard/queueing.h
@@ -117,20 +117,17 @@ static inline int wg_cpumask_choose_onli
return cpu;
}
-/* This function is racy, in the sense that next is unlocked, so it could return
- * the same CPU twice. A race-free version of this would be to instead store an
- * atomic sequence number, do an increment-and-return, and then iterate through
- * every possible CPU until we get to that index -- choose_cpu. However that's
- * a bit slower, and it doesn't seem like this potential race actually
- * introduces any performance loss, so we live with it.
+/* This function is racy, in the sense that it's called while last_cpu is
+ * unlocked, so it could return the same CPU twice. Adding locking or using
+ * atomic sequence numbers is slower though, and the consequences of racing are
+ * harmless, so live with it.
*/
-static inline int wg_cpumask_next_online(int *next)
+static inline int wg_cpumask_next_online(int *last_cpu)
{
- int cpu = *next;
-
- while (unlikely(!cpumask_test_cpu(cpu, cpu_online_mask)))
- cpu = cpumask_next(cpu, cpu_online_mask) % nr_cpumask_bits;
- *next = cpumask_next(cpu, cpu_online_mask) % nr_cpumask_bits;
+ int cpu = cpumask_next(*last_cpu, cpu_online_mask);
+ if (cpu >= nr_cpu_ids)
+ cpu = cpumask_first(cpu_online_mask);
+ *last_cpu = cpu;
return cpu;
}
@@ -159,7 +156,7 @@ static inline void wg_prev_queue_drop_pe
static inline int wg_queue_enqueue_per_device_and_peer(
struct crypt_queue *device_queue, struct prev_queue *peer_queue,
- struct sk_buff *skb, struct workqueue_struct *wq, int *next_cpu)
+ struct sk_buff *skb, struct workqueue_struct *wq)
{
int cpu;
@@ -173,7 +170,7 @@ static inline int wg_queue_enqueue_per_d
/* Then we queue it up in the device queue, which consumes the
* packet as soon as it can.
*/
- cpu = wg_cpumask_next_online(next_cpu);
+ cpu = wg_cpumask_next_online(&device_queue->last_cpu);
if (unlikely(ptr_ring_produce_bh(&device_queue->ring, skb)))
return -EPIPE;
queue_work_on(cpu, wq, &per_cpu_ptr(device_queue->worker, cpu)->work);
--- a/drivers/net/wireguard/receive.c
+++ b/drivers/net/wireguard/receive.c
@@ -524,7 +524,7 @@ static void wg_packet_consume_data(struc
goto err;
ret = wg_queue_enqueue_per_device_and_peer(&wg->decrypt_queue, &peer->rx_queue, skb,
- wg->packet_crypt_wq, &wg->decrypt_queue.last_cpu);
+ wg->packet_crypt_wq);
if (unlikely(ret == -EPIPE))
wg_queue_enqueue_per_peer_rx(skb, PACKET_STATE_DEAD);
if (likely(!ret || ret == -EPIPE)) {
--- a/drivers/net/wireguard/send.c
+++ b/drivers/net/wireguard/send.c
@@ -318,7 +318,7 @@ static void wg_packet_create_data(struct
goto err;
ret = wg_queue_enqueue_per_device_and_peer(&wg->encrypt_queue, &peer->tx_queue, first,
- wg->packet_crypt_wq, &wg->encrypt_queue.last_cpu);
+ wg->packet_crypt_wq);
if (unlikely(ret == -EPIPE))
wg_queue_enqueue_per_peer_tx(first, PACKET_STATE_DEAD);
err:
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 590/591] wireguard: netlink: send staged packets when setting initial private key
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (588 preceding siblings ...)
2023-07-16 19:52 ` [PATCH 6.1 589/591] wireguard: queueing: use saner cpu selection wrapping Greg Kroah-Hartman
@ 2023-07-16 19:52 ` Greg Kroah-Hartman
2023-07-16 19:52 ` [PATCH 6.1 591/591] tty: serial: fsl_lpuart: add earlycon for imx8ulp platform Greg Kroah-Hartman
` (4 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxim Cournoyer, Jason A. Donenfeld,
David S. Miller
From: Jason A. Donenfeld <Jason@zx2c4.com>
commit f58d0a9b4c6a7a5199c3af967e43cc8b654604d4 upstream.
Packets bound for peers can queue up prior to the device private key
being set. For example, if persistent keepalive is set, a packet is
queued up to be sent as soon as the device comes up. However, if the
private key hasn't been set yet, the handshake message never sends, and
no timer is armed to retry, since that would be pointless.
But, if a user later sets a private key, the expectation is that those
queued packets, such as a persistent keepalive, are actually sent. So
adjust the configuration logic to account for this edge case, and add a
test case to make sure this works.
Maxim noticed this with a wg-quick(8) config to the tune of:
[Interface]
PostUp = wg set %i private-key somefile
[Peer]
PublicKey = ...
Endpoint = ...
PersistentKeepalive = 25
Here, the private key gets set after the device comes up using a PostUp
script, triggering the bug.
Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Cc: stable@vger.kernel.org
Reported-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Tested-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Link: https://lore.kernel.org/wireguard/87fs7xtqrv.fsf@gmail.com/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireguard/netlink.c | 14 ++++++++-----
tools/testing/selftests/wireguard/netns.sh | 30 +++++++++++++++++++++++++----
2 files changed, 35 insertions(+), 9 deletions(-)
--- a/drivers/net/wireguard/netlink.c
+++ b/drivers/net/wireguard/netlink.c
@@ -546,6 +546,7 @@ static int wg_set_device(struct sk_buff
u8 *private_key = nla_data(info->attrs[WGDEVICE_A_PRIVATE_KEY]);
u8 public_key[NOISE_PUBLIC_KEY_LEN];
struct wg_peer *peer, *temp;
+ bool send_staged_packets;
if (!crypto_memneq(wg->static_identity.static_private,
private_key, NOISE_PUBLIC_KEY_LEN))
@@ -564,14 +565,17 @@ static int wg_set_device(struct sk_buff
}
down_write(&wg->static_identity.lock);
- wg_noise_set_static_identity_private_key(&wg->static_identity,
- private_key);
- list_for_each_entry_safe(peer, temp, &wg->peer_list,
- peer_list) {
+ send_staged_packets = !wg->static_identity.has_identity && netif_running(wg->dev);
+ wg_noise_set_static_identity_private_key(&wg->static_identity, private_key);
+ send_staged_packets = send_staged_packets && wg->static_identity.has_identity;
+
+ wg_cookie_checker_precompute_device_keys(&wg->cookie_checker);
+ list_for_each_entry_safe(peer, temp, &wg->peer_list, peer_list) {
wg_noise_precompute_static_static(peer);
wg_noise_expire_current_peer_keypairs(peer);
+ if (send_staged_packets)
+ wg_packet_send_staged_packets(peer);
}
- wg_cookie_checker_precompute_device_keys(&wg->cookie_checker);
up_write(&wg->static_identity.lock);
}
skip_set_private_key:
--- a/tools/testing/selftests/wireguard/netns.sh
+++ b/tools/testing/selftests/wireguard/netns.sh
@@ -514,10 +514,32 @@ n2 bash -c 'printf 0 > /proc/sys/net/ipv
n1 ping -W 1 -c 1 192.168.241.2
[[ $(n2 wg show wg0 endpoints) == "$pub1 10.0.0.3:1" ]]
-ip1 link del veth1
-ip1 link del veth3
-ip1 link del wg0
-ip2 link del wg0
+ip1 link del dev veth3
+ip1 link del dev wg0
+ip2 link del dev wg0
+
+# Make sure persistent keep alives are sent when an adapter comes up
+ip1 link add dev wg0 type wireguard
+n1 wg set wg0 private-key <(echo "$key1") peer "$pub2" endpoint 10.0.0.1:1 persistent-keepalive 1
+read _ _ tx_bytes < <(n1 wg show wg0 transfer)
+[[ $tx_bytes -eq 0 ]]
+ip1 link set dev wg0 up
+read _ _ tx_bytes < <(n1 wg show wg0 transfer)
+[[ $tx_bytes -gt 0 ]]
+ip1 link del dev wg0
+# This should also happen even if the private key is set later
+ip1 link add dev wg0 type wireguard
+n1 wg set wg0 peer "$pub2" endpoint 10.0.0.1:1 persistent-keepalive 1
+read _ _ tx_bytes < <(n1 wg show wg0 transfer)
+[[ $tx_bytes -eq 0 ]]
+ip1 link set dev wg0 up
+read _ _ tx_bytes < <(n1 wg show wg0 transfer)
+[[ $tx_bytes -eq 0 ]]
+n1 wg set wg0 private-key <(echo "$key1")
+read _ _ tx_bytes < <(n1 wg show wg0 transfer)
+[[ $tx_bytes -gt 0 ]]
+ip1 link del dev veth1
+ip1 link del dev wg0
# We test that Netlink/IPC is working properly by doing things that usually cause split responses
ip0 link add dev wg0 type wireguard
^ permalink raw reply [flat|nested] 604+ messages in thread* [PATCH 6.1 591/591] tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (589 preceding siblings ...)
2023-07-16 19:52 ` [PATCH 6.1 590/591] wireguard: netlink: send staged packets when setting initial private key Greg Kroah-Hartman
@ 2023-07-16 19:52 ` Greg Kroah-Hartman
2023-07-16 23:40 ` [PATCH 6.1 000/591] 6.1.39-rc1 review Daniel Díaz
` (3 subsequent siblings)
594 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-16 19:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sherry Sun, stable
From: Sherry Sun <sherry.sun@nxp.com>
commit e0edfdc15863ec80a1d9ac6e174dbccc00206dd0 upstream.
Add earlycon support for imx8ulp platform.
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20230619080613.16522-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/fsl_lpuart.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -2627,6 +2627,7 @@ OF_EARLYCON_DECLARE(lpuart, "fsl,vf610-l
OF_EARLYCON_DECLARE(lpuart32, "fsl,ls1021a-lpuart", lpuart32_early_console_setup);
OF_EARLYCON_DECLARE(lpuart32, "fsl,ls1028a-lpuart", ls1028a_early_console_setup);
OF_EARLYCON_DECLARE(lpuart32, "fsl,imx7ulp-lpuart", lpuart32_imx_early_console_setup);
+OF_EARLYCON_DECLARE(lpuart32, "fsl,imx8ulp-lpuart", lpuart32_imx_early_console_setup);
OF_EARLYCON_DECLARE(lpuart32, "fsl,imx8qxp-lpuart", lpuart32_imx_early_console_setup);
OF_EARLYCON_DECLARE(lpuart32, "fsl,imxrt1050-lpuart", lpuart32_imx_early_console_setup);
EARLYCON_DECLARE(lpuart, lpuart_early_console_setup);
^ permalink raw reply [flat|nested] 604+ messages in thread* Re: [PATCH 6.1 000/591] 6.1.39-rc1 review
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (590 preceding siblings ...)
2023-07-16 19:52 ` [PATCH 6.1 591/591] tty: serial: fsl_lpuart: add earlycon for imx8ulp platform Greg Kroah-Hartman
@ 2023-07-16 23:40 ` Daniel Díaz
2023-07-17 0:01 ` Guenter Roeck
2023-07-17 0:47 ` ogasawara takeshi
` (2 subsequent siblings)
594 siblings, 1 reply; 604+ messages in thread
From: Daniel Díaz @ 2023-07-16 23:40 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
Hello!
On Sun, 16 Jul 2023 at 14:31, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 6.1.39 release.
> There are 591 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 18 Jul 2023 19:48:07 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.39-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 6.1.39-rc1
>
> Sherry Sun <sherry.sun@nxp.com>
> tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
>
> Jason A. Donenfeld <Jason@zx2c4.com>
> wireguard: netlink: send staged packets when setting initial private key
>
> Jason A. Donenfeld <Jason@zx2c4.com>
> wireguard: queueing: use saner cpu selection wrapping
>
> Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
>
> Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> netfilter: nf_tables: do not ignore genmask when looking up chain by id
>
> Florent Revest <revest@chromium.org>
> netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
>
> Ming Lei <ming.lei@redhat.com>
> block: make sure local irq is disabled when calling __blkcg_rstat_flush
>
> Paul Cercueil <paul@crapouillou.net>
> MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts
>
> Ming Lei <ming.lei@redhat.com>
> blk-cgroup: Flush stats before releasing blkcg_gq
>
> Waiman Long <longman@redhat.com>
> blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
>
> Pablo Neira Ayuso <pablo@netfilter.org>
> netfilter: nf_tables: unbind non-anonymous set if rule construction fails
>
> Lukas Bulwahn <lukas.bulwahn@gmail.com>
> mtd: parsers: refer to ARCH_BCMBCA instead of ARCH_BCM4908
>
> Imre Deak <imre.deak@intel.com>
> drm/i915/tc: Fix system resume MST mode restore for DP-alt sinks
>
> Imre Deak <imre.deak@intel.com>
> drm/i915/tc: Fix TC port link ref init for DP MST during HW readout
>
> Imre Deak <imre.deak@intel.com>
> drm/i915: Fix TypeC mode initialization during system resume
>
> Liam R. Howlett <Liam.Howlett@oracle.com>
> mm/mmap: Fix extra maple tree write
>
> Darrick J. Wong <djwong@kernel.org>
> xfs: fix xfs_inodegc_stop racing with mod_delayed_work
>
> Darrick J. Wong <djwong@kernel.org>
> xfs: disable reaping in fscounters scrub
>
> Darrick J. Wong <djwong@kernel.org>
> xfs: check that per-cpu inodegc workers actually run on that cpu
>
> Darrick J. Wong <djwong@kernel.org>
> xfs: explicitly specify cpu when forcing inodegc delayed work to run immediately
>
> Jan Kara <jack@suse.cz>
> fs: no need to check source
>
> Yu Kuai <yukuai3@huawei.com>
> blktrace: use inline function for blk_trace_remove() while blktrace is disabled
>
> Christian Marangi <ansuelsmth@gmail.com>
> leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename
>
> Arnd Bergmann <arnd@arndb.de>
> ARM: orion5x: fix d2net gpio initialization
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: qcom: ipq4019: fix broken NAND controller properties override
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> regulator: tps65219: Fix matching interrupts for their regulators
>
> Ricardo Ribalda Delgado <ribalda@chromium.org>
> ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path
>
> Ricardo Ribalda Delgado <ribalda@chromium.org>
> ASoC: mediatek: mt8173: Fix irq error path
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: do not BUG_ON() on tree mod log failure at __btrfs_cow_block()
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix extent buffer leak after tree mod log failure at split_node()
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix race when deleting quota root from the dirty cow roots list
>
> Naohiro Aota <naota@elisp.net>
> btrfs: move out now unused BG from the reclaim list
>
> Naohiro Aota <naota@elisp.net>
> btrfs: reinsert BGs failed to reclaim
>
> David Sterba <dsterba@suse.com>
> btrfs: add block-group tree to lockdep classes
>
> Naohiro Aota <naota@elisp.net>
> btrfs: bail out reclaim process if filesystem is read-only
>
> Naohiro Aota <naota@elisp.net>
> btrfs: delete unused BGs while reclaiming BGs
>
> Matt Corallo <blnxfsl@bluematt.me>
> btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile
>
> Abhijeet Rastogi <abhijeet.1989@gmail.com>
> ipvs: increase ip_vs_conn_tab_bits range for 64BIT
>
> Mario Limonciello <mario.limonciello@amd.com>
> usb: typec: ucsi: Mark dGPUs as DEVICE scope
>
> Wayne Chang <waynec@nvidia.com>
> i2c: nvidia-gpu: Remove ccgx,firmware-build property
>
> Wayne Chang <waynec@nvidia.com>
> i2c: nvidia-gpu: Add ACPI property to align with device-tree
>
> Jan Kara <jack@suse.cz>
> fs: Lock moved directories
>
> Jan Kara <jack@suse.cz>
> fs: Establish locking order for unrelated directories
>
> Jan Kara <jack@suse.cz>
> Revert "f2fs: fix potential corruption when moving a directory"
>
> Jan Kara <jack@suse.cz>
> ext4: Remove ext4 locking of moved directory
>
> Thomas Weißschuh <linux@weissschuh.net>
> fs: avoid empty option when generating legacy mount string
>
> Fabian Frederick <fabf@skynet.be>
> jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
>
> Roberto Sassu <roberto.sassu@huawei.com>
> shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs
>
> Ryan Roberts <ryan.roberts@arm.com>
> mm/damon/ops-common: atomically test and clear young on ptes and pmds
>
> Arnd Bergmann <arnd@arndb.de>
> autofs: use flexible array in ioctl structure
>
> Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
> integrity: Fix possible multiple allocation in integrity_inode_get()
>
> Kees Cook <keescook@chromium.org>
> um: Use HOST_DIR for mrproper
>
> Siddh Raman Pant <code@siddh.me>
> watch_queue: prevent dangling pipe pointer
>
> Zheng Wang <zyytlz.wz@163.com>
> bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
>
> Zheng Wang <zyytlz.wz@163.com>
> bcache: Remove unnecessary NULL point check in node allocations
>
> Mingzhe Zou <mingzhe.zou@easystack.cn>
> bcache: fixup btree_cache_wait list damage
>
> Quan Zhou <quan.zhou@mediatek.com>
> wifi: mt76: mt7921e: fix init command fail with enabled device
>
> Alexander Wetzel <alexander@wetzel-home.de>
> wifi: ath10k: Serialize wake_tx_queue ops
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: cfg80211: fix regulatory disconnect for non-MLO
>
> Chevron Li <chevron.li@bayhubtech.com>
> mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.
>
> Ulf Hansson <ulf.hansson@linaro.org>
> mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS
>
> Robert Marko <robimarko@gmail.com>
> mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
>
> Robert Marko <robimarko@gmail.com>
> mmc: core: disable TRIM on Kingston EMMC04G-M627
>
> Jens Axboe <axboe@kernel.dk>
> io_uring: wait interruptibly for request completions on exit
>
> Jianmin Lv <lvjianmin@loongson.cn>
> irqchip/loongson-pch-pic: Fix initialization of HT vector register
>
> Dai Ngo <dai.ngo@oracle.com>
> NFSD: add encoding of op_recall flag for write delegation
>
> Liu Peibao <liupeibao@loongson.cn>
> irqchip/loongson-pch-pic: Fix potential incorrect hwirq assignment
>
> Shuai Jiang <d202180596@hust.edu.cn>
> i2c: qup: Add missing unwind goto in qup_i2c_probe()
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: do not BUG_ON() on tree mod log failure at balance_level()
>
> Alvin Šipraga <alsi@bang-olufsen.dk>
> extcon: usbc-tusb320: Unregister typec port on driver removal
>
> Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> extcon: usbc-tusb320: Convert to i2c's .probe_new()
>
> Demi Marie Obenour <demi@invisiblethingslab.com>
> dm ioctl: Avoid double-fetch of version
>
> Heinz Mauelshagen <heinzm@redhat.com>
> dm ioctl: have constant on the right side of the test
>
> Heinz Mauelshagen <heinzm@redhat.com>
> dm: avoid split of quoted strings where possible
>
> Heinz Mauelshagen <heinzm@redhat.com>
> dm: fix undue/missing spaces
>
> Robert Hancock <robert.hancock@calian.com>
> i2c: xiic: Don't try to handle more interrupt events after error
>
> Danila Chernetsov <listdansp@mail.ru>
> apparmor: fix missing error check for rhashtable_insert_fast
>
> Artur Rojek <contact@artur-rojek.eu>
> sh: dma: Fix DMA channel offset calculation
>
> Thorsten Winkler <twinkler@linux.ibm.com>
> s390/qeth: Fix vipa deletion
>
> David Howells <dhowells@redhat.com>
> afs: Fix accidental truncation when storing data
>
> Hariprasad Kelam <hkelam@marvell.com>
> octeontx-af: fix hardware timestamp configuration
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: dsa: sja1105: always enable the send_meta options
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: dsa: tag_sja1105: fix MAC DA patching from meta frames
>
> Guillaume Nault <gnault@redhat.com>
> pptp: Fix fib lookup calls.
>
> Woody Zhang <woodylab@foxmail.com>
> riscv: move memblock_allow_resize() after linear mapping is ready
>
> Amir Goldstein <amir73il@gmail.com>
> fanotify: disallow mount/sb marks on kernel internal pseudo fs
>
> Lin Ma <linma@zju.edu.cn>
> net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
>
> Ilya Maximets <i.maximets@ovn.org>
> xsk: Honor SO_BINDTODEVICE on bind
>
> SeongJae Park <sj@kernel.org>
> bpf, btf: Warn but return no error for NULL btf from __register_btf_kfunc_id_set()
>
> Eric Dumazet <edumazet@google.com>
> tcp: annotate data races in __tcp_oow_rate_limited()
>
> Eric Dumazet <edumazet@google.com>
> net: fix net_dev_start_xmit trace event vs skb_transport_offset()
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: dsa: tag_sja1105: fix source port decoding in vlan_filtering=0 bridge mode
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
>
> Pali Rohár <pali@kernel.org>
> powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node
>
> Randy Dunlap <rdunlap@infradead.org>
> powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
>
> Zeng Heng <zengheng4@huawei.com>
> ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
>
> Hariprasad Kelam <hkelam@marvell.com>
> octeontx2-af: Add validation before accessing cgx and lmac
>
> Hariprasad Kelam <hkelam@marvell.com>
> octeontx2-af: Fix mapping for NIX block from CGX connection
>
> Chao Yu <chao@kernel.org>
> f2fs: fix error path handling in truncate_dnode()
>
> Nishanth Menon <nm@ti.com>
> mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
>
> Mario Limonciello <mario.limonciello@amd.com>
> drm/amd: Don't try to enable secure display TA multiple times
>
> Christian König <christian.koenig@amd.com>
> drm/amdgpu: fix number of fence calculations
>
> Jonas Gorski <jonas.gorski@gmail.com>
> spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
>
> Zhengchao Shao <shaozhengchao@huawei.com>
> mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init
>
> Pawel Dembicki <paweldembicki@gmail.com>
> net: dsa: vsc73xx: fix MTU configuration
>
> Nick Child <nnac123@linux.ibm.com>
> ibmvnic: Do not reset dql stats on NON_FATAL err
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: MGMT: Use BIT macro when defining bitfields
>
> Pauli Virtanen <pav@iki.fi>
> Bluetooth: MGMT: add CIS feature bits to controller information
>
> Pauli Virtanen <pav@iki.fi>
> Bluetooth: ISO: use hci_sync for setting CIG parameters
>
> Johan Hovold <johan+linaro@kernel.org>
> Bluetooth: fix invalid-bdaddr quirk for non-persistent setup
>
> Tobias Heider <me@tobhe.de>
> Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: dsa: sja1105: always enable the INCL_SRCPT option
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: dsa: felix: don't drop PTP frames with tag_8021q when RX timestamping is disabled
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: mscc: ocelot: don't keep PTP configuration of all ports in single structure
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: mscc: ocelot: don't report that RX timestamping is enabled by default
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode
>
> Florian Westphal <fw@strlen.de>
> net/sched: act_ipt: add sanity checks on skb before calling target
>
> Xin Long <lucien.xin@gmail.com>
> net: add a couple of helpers for iph tot_len
>
> Florian Westphal <fw@strlen.de>
> net/sched: act_ipt: add sanity checks on table name and hook locations
>
> Chengfeng Ye <dg573847474@gmail.com>
> sctp: fix potential deadlock on &net->sctp.addr_wq_lock
>
> Randy Dunlap <rdunlap@infradead.org>
> media: cec: i2c: ch7322: also select REGMAP
>
> Chao Yu <chao@kernel.org>
> f2fs: check return value of freeze_super()
>
> Vinay Belgaumkar <vinay.belgaumkar@intel.com>
> drm/i915/guc/slpc: Apply min softlimit correctly
>
> Jouni Högander <jouni.hogander@intel.com>
> drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake times
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
>
> Jinke Han <hanjinke.666@bytedance.com>
> blk-throttle: Fix io statistics for cgroup v1
>
> Ming Lei <ming.lei@redhat.com>
> blk-cgroup: don't update io stat for root cgroup
>
> Waiman Long <longman@redhat.com>
> blk-cgroup: Optimize blkcg_rstat_flush()
>
> Li Nan <linan122@huawei.com>
> md/raid10: fix the condition to call bio_end_io_acct()
>
> Shuijing Li <shuijing.li@mediatek.com>
> pwm: mtk_disp: Fix the disable flow of disp_pwm
>
> Dan Carpenter <dan.carpenter@linaro.org>
> pwm: ab8500: Fix error code in probe()
>
> Marek Vasut <marex@denx.de>
> pwm: sysfs: Do not apply state to already disabled PWMs
>
> Fancy Fang <chen.fang@nxp.com>
> pwm: imx-tpm: force 'real_period' to be zero in suspend
>
> Yury Norov <yury.norov@gmail.com>
> lib/bitmap: drop optimization of bitmap_{from,to}_arr64
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> phy: tegra: xusb: check return value of devm_kzalloc()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> mfd: stmpe: Only disable the regulators if they are enabled
>
> Yicong Yang <yangyicong@hisilicon.com>
> hwtracing: hisi_ptt: Fix potential sleep in atomic context
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> misc: fastrpc: check return value of devm_kasprintf()
>
> Daniel Golle <daniel@makrotopia.org>
> cpufreq: mediatek: correct voltages for MT7622 and MT7623
>
> Christian Borntraeger <borntraeger@linux.ibm.com>
> KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler
>
> Pierre Morel <pmorel@linux.ibm.com>
> KVM: s390: vsie: fix the length of APCB bitmap
>
> Amelie Delaunay <amelie.delaunay@foss.st.com>
> mfd: stmfx: Nullify stmfx->vdd in case of error
>
> Amelie Delaunay <amelie.delaunay@foss.st.com>
> mfd: stmfx: Fix error path in stmfx_chip_init
>
> Laurentiu Tudor <laurentiu.tudor@nxp.com>
> bus: fsl-mc: don't assume child devices are all fsl-mc devices
>
> Phil Elwell <phil@raspberrypi.com>
> nvmem: rmem: Use NVMEM_DEVID_AUTO
>
> Yi Yingao <m202271736@hust.edu.cn>
> nvmem: sunplus-ocotp: release otp->clk before return
>
> Matti Vaittinen <mazziesaccount@gmail.com>
> drivers: fwnode: fix fwnode_irq_get[_byname]()
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> device property: Clarify description of returned value in some functions
>
> Miaoqian Lin <linmq006@gmail.com>
> device property: Fix documentation for fwnode_get_next_parent()
>
> Tony Lindgren <tony@atomide.com>
> serial: 8250_omap: Use force_suspend and resume for system suspend
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection"
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> mfd: intel-lpss: Add missing check for platform_get_resource
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> mfd: wcd934x: Fix an error handling path in wcd934x_slim_probe()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe()
>
> Prashanth K <quic_prashk@quicinc.com>
> usb: common: usb-conn-gpio: Set last role to unknown before initial detection
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
>
> Nico Boehr <nrb@linux.ibm.com>
> KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
>
> Chao Yu <chao@kernel.org>
> f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
>
> Chao Yu <chao@kernel.org>
> f2fs: fix potential deadlock due to unpaired node_write lock use
>
> Bob Peterson <rpeterso@redhat.com>
> gfs2: Fix duplicate should_fault_in_pages() call
>
> Sergey Shtylyov <s.shtylyov@omp.ru>
> sh: Avoid using IRQ0 on SH3 and SH4
>
> Dan Carpenter <dan.carpenter@linaro.org>
> media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var()
>
> Rikard Falkeborn <rikard.falkeborn@gmail.com>
> media: venus: helpers: Fix ALIGN() of non power of two
>
> Stephan Gerhold <stephan@gerhold.net>
> mfd: rt5033: Drop rt5033-battery sub-device
>
> James Clark <james.clark@arm.com>
> coresight: Fix loss of connection info when a module is unloaded
>
> Clark Wang <xiaoning.wang@nxp.com>
> i3c: master: svc: fix cpu schedule in spin lock
>
> Yue Zhao <findns94@gmail.com>
> lkdtm: replace ll_rw_block with submit_bh
>
> Muchun Song <muchun.song@linux.dev>
> kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR
>
> John Ogness <john.ogness@linutronix.de>
> serial: 8250: lock port for UART_IER access in omap8250_irq()
>
> John Ogness <john.ogness@linutronix.de>
> serial: core: lock port for start_rx() in uart_resume_port()
>
> John Ogness <john.ogness@linutronix.de>
> serial: 8250: lock port for stop_rx() in omap8250_irq()
>
> John Ogness <john.ogness@linutronix.de>
> serial: core: lock port for stop_rx() in uart_suspend_port()
>
> Bhupesh Sharma <bhupesh.sharma@linaro.org>
> usb: misc: eud: Fix eud sysfs path (use 'qcom_eud')
>
> Arnd Bergmann <arnd@arndb.de>
> usb: hide unused usbfs_notify_suspend/resume functions
>
> Li Yang <lidaxian@hust.edu.cn>
> usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> extcon: Fix kernel doc of property capability fields to avoid warnings
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> extcon: Fix kernel doc of property fields to avoid warnings
>
> Prashanth K <quic_prashk@quicinc.com>
> usb: gadget: u_serial: Add null pointer check in gserial_suspend
>
> Vladislav Efanov <VEfanov@ispras.ru>
> usb: dwc3: qcom: Fix potential memory leak
>
> Arnd Bergmann <arnd@arndb.de>
> staging: vchiq_arm: mark vchiq_platform_init() static
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> clk: qcom: mmcc-msm8974: use clk_rcg2_shared_ops for mdp_clk_src clock
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> clk: qcom: dispcc-qcm2290: Fix GPLL0_OUT_DIV handling
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> clk: qcom: dispcc-qcm2290: Fix BI_TCXO_AO handling
>
> Robert Marko <robimarko@gmail.com>
> clk: qcom: ipq6018: fix networking resets
>
> Robert Marko <robimarko@gmail.com>
> clk: qcom: reset: support resetting multiple bits
>
> Yunfei Dong <yunfei.dong@mediatek.com>
> media: mediatek: vcodec: using decoder status instead of core work count
>
> Martin Kepplinger <martink@posteo.de>
> media: hi846: fix usage of pm_runtime_get_if_in_use()
>
> Daniel Scally <dan.scally@ideasonboard.com>
> media: i2c: Correct format propagation for st-mipid02
>
> Duoming Zhou <duoming@zju.edu.cn>
> media: usb: siano: Fix warning due to null work_func_t function pointer
>
> Marek Vasut <marex@denx.de>
> media: videodev2.h: Fix struct v4l2_input tuner index comment
>
> Ming Qian <ming.qian@nxp.com>
> media: amphion: initiate a drain of the capture queue in dynamic resolution change
>
> Ming Qian <ming.qian@nxp.com>
> media: amphion: drop repeated codec data for vc1g format
>
> Ming Qian <ming.qian@nxp.com>
> media: amphion: drop repeated codec data for vc1l format
>
> Daniil Dulov <d.dulov@aladdin.ru>
> media: usb: Check az6007_read() return value
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> clk: qcom: gcc-qcm2290: Mark RCGs shared where applicable
>
> Mantas Pucka <mantas@8devices.com>
> clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks
>
> Taniya Das <quic_tdas@quicinc.com>
> clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk
>
> Tony Lindgren <tony@atomide.com>
> serial: 8250: omap: Fix freeing of resources on failed register
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> usb: dwc2: Fix some error handling paths
>
> Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> usb: dwc2: platform: Improve error reporting for problems during .remove()
>
> John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
> sh: j2: Use ioremap() to translate device tree address into kernel memory
>
> Yangtao Li <frank.li@vivo.com>
> f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> dt-bindings: power: reset: qcom-pon: Only allow reboot-mode pre-pmk8350
>
> Dan Carpenter <error27@gmail.com>
> w1: fix loop in w1_fini()
>
> Stefan Wahren <stefan.wahren@i2se.com>
> w1: w1_therm: fix locking behavior in convert_t
>
> Ding Hui <dinghui@sangfor.com.cn>
> SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix race when deleting free space root from the dirty cow roots list
>
> Demi Marie Obenour <demi@invisiblethingslab.com>
> block: increment diskseq on all media change events
>
> Michael Schmitz <schmitzmic@gmail.com>
> block: change all __u32 annotations to __be32 in affs_hardblocks.h
>
> Michael Schmitz <schmitzmic@gmail.com>
> block: add overflow checks for Amiga partition support
>
> Michael Schmitz <schmitzmic@gmail.com>
> block: fix signed int overflow in Amiga partition support
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: pcm: Fix potential data race at PCM memory allocation helpers
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: jack: Fix mutex call in snd_jack_report()
>
> Werner Sembach <wse@tuxedocomputers.com>
> ALSA: hda/realtek: Add quirk for Clevo NPx0SNx
>
> Andy Chi <andy.chi@canonical.com>
> ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook
>
> Suren Baghdasaryan <surenb@google.com>
> mm/mmap: Fix VM_LOCKED check in do_vmi_align_munmap()
>
> Hersen Wu <hersenxs.wu@amd.com>
> Revert "drm/amd/display: edp do not add non-edid timings"
>
> Sean Nyekjaer <sean@geanix.com>
> iio: accel: fxls8962af: fixup buffer scan element type
>
> Sean Nyekjaer <sean@geanix.com>
> iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF
>
> Fabrizio Lamarque <fl.scratchpad@gmail.com>
> iio: adc: ad7192: Fix internal/external clock selection
>
> Fabrizio Lamarque <fl.scratchpad@gmail.com>
> iio: adc: ad7192: Fix null ad7192_state pointer access
>
> EJ Hsu <ejh@nvidia.com>
> phy: tegra: xusb: Clear the driver reference in usb-phy dev
>
> Krishna Kurapati <quic_kriskura@quicinc.com>
> usb: dwc3: gadget: Propagate core init errors to UDC during pullup
>
> Davide Tronchin <davide.tronchin.94@gmail.com>
> USB: serial: option: add LARA-R6 01B PIDs
>
> Yu Kuai <yukuai3@huawei.com>
> md/raid1-10: fix casting from randomized structure in raid1_submit_write()
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/efi: Make efi_set_virtual_address_map IBT safe
>
> Will Deacon <will@kernel.org>
> arm64: sme: Use STR P to clear FFR context field in streaming SVE mode
>
> Arnd Bergmann <arnd@arndb.de>
> ksmbd: avoid field overflow warning
>
> Paulo Alcantara <pc@manguebit.com>
> smb: client: fix broken file attrs with nodfs mounts
>
> Shyam Prasad N <sprasad@microsoft.com>
> cifs: do all necessary checks for credits within or before locking
>
> Shyam Prasad N <sprasad@microsoft.com>
> cifs: prevent use-after-free by freeing the cfile later
>
> Ard Biesheuvel <ardb@kernel.org>
> efi/libstub: Disable PCI DMA before grabbing the EFI memory map
>
> Sami Tolvanen <samitolvanen@google.com>
> kbuild: Disable GCOV for *.mod.o
>
> Martin Kaiser <martin@kaiser.cx>
> hwrng: st - keep clock enabled while hwrng is registered
>
> Tarun Sahu <tsahu@linux.ibm.com>
> dax/kmem: Pass valid argument to memory_group_register_static
>
> Dan Williams <dan.j.williams@intel.com>
> dax: Introduce alloc_dev_dax_id()
>
> Dan Williams <dan.j.williams@intel.com>
> dax: Fix dax_mapping_release() use after free
>
> Bharath SM <bharathsm@microsoft.com>
> SMB3: Do not send lease break acknowledgment if all file handles have been closed
>
> Olga Kornievskaia <kolga@netapp.com>
> NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
>
> Qi Zheng <zhengqi.arch@bytedance.com>
> NFSv4.2: fix wrong shrinker_id
>
> Hareshx Sankar Raj <hareshx.sankar.raj@intel.com>
> crypto: qat - unmap buffers before free for RSA
>
> Hareshx Sankar Raj <hareshx.sankar.raj@intel.com>
> crypto: qat - unmap buffer before free for DH
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: qat - Use helper to set reqsize
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: kpp - Add helper to set reqsize
>
> Masahiro Yamada <masahiroy@kernel.org>
> ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
>
> Dan Carpenter <dan.carpenter@linaro.org>
> modpost: fix off by one in is_executable_section()
>
> Stephan Müller <smueller@chronox.de>
> crypto: jitter - correct health test during initialization
>
> Arnd Bergmann <arnd@arndb.de>
> crypto: marvell/cesa - Fix type mismatch warning
>
> Masahiro Yamada <masahiroy@kernel.org>
> modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
>
> Masahiro Yamada <masahiroy@kernel.org>
> modpost: fix section mismatch message for R_ARM_ABS32
>
> Randy Dunlap <rdunlap@infradead.org>
> crypto: nx - fix build warnings when DEBUG_FS is not enabled
>
> Masahiro Yamada <masahiroy@kernel.org>
> modpost: remove broken calculation of exception_table_entry size
>
> Herbert Xu <herbert@gondor.apana.org.au>
> hwrng: virtio - Fix race on data_avail and actual data
>
> Eric Farman <farman@linux.ibm.com>
> vfio/mdev: Move the compat_class initialization to module init
>
> Xinghui Li <korantli@tencent.com>
> PCI: vmd: Fix uninitialized variable usage in vmd_enable_domain()
>
> Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
> PCI: endpoint: functions/pci-epf-test: Fix dma_chan direction
>
> Shunsuke Mie <mie@igel.co.jp>
> PCI: endpoint: Fix a Kconfig prompt of vNTB driver
>
> Shunsuke Mie <mie@igel.co.jp>
> PCI: endpoint: Fix Kconfig indent style
>
> Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
> powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary
>
> Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
> powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo
>
> Tiezhu Yang <yangtiezhu@loongson.cn>
> riscv: uprobes: Restore thread.bad_cause
>
> Manivannan Sadhasivam <mani@kernel.org>
> PCI: qcom: Disable write access to read only registers for IP v2.9.0
>
> Manivannan Sadhasivam <mani@kernel.org>
> PCI: qcom: Use DWC helpers for modifying the read-only DBI registers
>
> Manivannan Sadhasivam <mani@kernel.org>
> PCI: qcom: Use lower case for hex
>
> Manivannan Sadhasivam <mani@kernel.org>
> PCI: qcom: Sort and group registers and bitfield definitions
>
> Manivannan Sadhasivam <mani@kernel.org>
> PCI: qcom: Remove PCIE20_ prefix from register definitions
>
> Aditya Gupta <adityag@linux.ibm.com>
> powerpc: update ppc_save_regs to save current r1 in pt_regs
>
> Nicholas Piggin <npiggin@gmail.com>
> powerpc: simplify ppc_save_regs
>
> Colin Ian King <colin.i.king@gmail.com>
> powerpc/powernv/sriov: perform null check on iov before dereferencing iov
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> pinctrl: at91-pio4: check return value of devm_kasprintf()
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> pinctrl: microchip-sgpio: check return value of devm_kasprintf()
>
> Nicholas Piggin <npiggin@gmail.com>
> powerpc/64s: Fix VAS mm use after free
>
> Ian Rogers <irogers@google.com>
> perf tool x86: Fix perf_env memory leak
>
> Ravi Bangoria <ravi.bangoria@amd.com>
> perf tool x86: Consolidate is_amd check into single function
>
> Michal Wilczynski <michal.wilczynski@intel.com>
> platform/x86/dell/dell-rbtn: Fix resources leaking on error path
>
> Namhyung Kim <namhyung@kernel.org>
> perf dwarf-aux: Fix off-by-one in die_get_varname()
>
> Mark Pearson <mpearson-lenovo@squebb.ca>
> platform/x86: thinkpad_acpi: Fix lkp-tests warnings for platform profiles
>
> Arnaldo Carvalho de Melo <acme@redhat.com>
> perf script: Fix allocation of evsel->priv related to per-event dump files
>
> Christophe Leroy <christophe.leroy@csgroup.eu>
> powerpc/signal32: Force inlining of __unsafe_save_user_regs() and save_tm_user_regs_unsafe()
>
> Christophe Leroy <christophe.leroy@csgroup.eu>
> powerpc/interrupt: Don't read MSR from interrupt_exit_kernel_prepare()
>
> Christophe Leroy <christophe.leroy@csgroup.eu>
> kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> pinctrl: npcm7xx: Add missing check for ioremap
>
> Wells Lu <wellslutw@gmail.com>
> pinctrl:sunplus: Add check for kmalloc
>
> Mark Pearson <mpearson-lenovo@squebb.ca>
> platform/x86: think-lmi: Correct NVME password handling
>
> Mark Pearson <mpearson-lenovo@squebb.ca>
> platform/x86: think-lmi: Correct System password interface
>
> Mark Pearson <mpearson-lenovo@squebb.ca>
> platform/x86: think-lmi: mutex protection around multiple WMI calls
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> pinctrl: cherryview: Return correct value if pin in push-pull mode
>
> Arnaldo Carvalho de Melo <acme@redhat.com>
> perf bench: Add missing setlocale() call to allow usage of %'d style formatting
>
> Justin Tee <justin.tee@broadcom.com>
> scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state
>
> Sui Jingfeng <suijingfeng@loongson.cn>
> PCI: Add pci_clear_master() stub for non-CONFIG_PCI
>
> Wells Lu <wellslutw@gmail.com>
> pinctrl: sunplus: Add check for kmalloc
>
> Junyan Ye <yejunyan@hust.edu.cn>
> PCI: ftpci100: Release the clock resources
>
> Rongguang Wei <weirongguang@kylinos.cn>
> PCI: pciehp: Cancel bringup sequence if card is not present
>
> Yuchen Yang <u202114568@hust.edu.cn>
> scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
>
> Ding Hui <dinghui@sangfor.com.cn>
> PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
>
> Hans de Goede <hdegoede@redhat.com>
> platform/x86: lenovo-yogabook: Set default keyboard backligh brightness on probe()
>
> Hans de Goede <hdegoede@redhat.com>
> platform/x86: lenovo-yogabook: Reprobe devices on remove()
>
> Hans de Goede <hdegoede@redhat.com>
> platform/x86: lenovo-yogabook: Fix work race on remove()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors
>
> Jinhong Zhu <jinhongzhu@hust.edu.cn>
> scsi: qedf: Fix NULL dereference in error handling
>
> Nirmal Patel <nirmal.patel@linux.intel.com>
> PCI: vmd: Reset VMD config register between soft reboots
>
> Siddharth Vadapalli <s-vadapalli@ti.com>
> PCI: cadence: Fix Gen2 Link Retraining process
>
> Syed Saba Kareem <Syed.SabaKareem@amd.com>
> ASoC: amd: acp: clear pdm dma interrupt mask
>
> Michael Walle <mwalle@kernel.org>
> ARM: dts: lan966x: kontron-d10: fix SPI CS
>
> Michael Walle <mwalle@kernel.org>
> ARM: dts: lan966x: kontron-d10: fix board reset
>
> Fei Shao <fshao@chromium.org>
> clk: Fix memory leak in devm_clk_notifier_register()
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> ASoC: imx-audmix: check return value of devm_kasprintf()
>
> Amir Goldstein <amir73il@gmail.com>
> ovl: update of dentry revalidate flags after copy up
>
> Alexey Romanov <avromanov@sberdevices.ru>
> drivers: meson: secure-pwrc: always enable DMA domain
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> clk: ti: clkctrl: check return value of kasprintf()
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> clk: keystone: sci-clk: check return value of kasprintf()
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> clk: si5341: free unused memory on probe failure
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> clk: si5341: check return value of {devm_}kasprintf()
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> clk: si5341: return error if one synth clock registration fails
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> clk: cdce925: check return value of kasprintf()
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> clk: vc5: check memory returned by kasprintf()
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/msm/dpu: correct MERGE_3D length
>
> Luben Tuikov <luben.tuikov@amd.com>
> drm/amdgpu: Fix usage of UMC fill record in RAS
>
> Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
> drm/amdgpu: Fix memcpy() in sienna_cichlid_append_powerplay_table function.
>
> Nícolas F. R. A. Prado <nfraprado@collabora.com>
> arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz
>
> Allen-KH Cheng <allen-kh.cheng@mediatek.com>
> arm64: dts: mediatek: Add cpufreq nodes for MT8192
>
> Bjorn Andersson <quic_bjorande@quicinc.com>
> drm/msm/dp: Free resources after unregistering them
>
> Jessica Zhang <quic_jesszhan@quicinc.com>
> drm/msm/dsi: Remove incorrect references to slice_count
>
> Marijn Suijten <marijn.suijten@somainline.org>
> drm/msm/dsi: Flip greater-than check for slice_count and slice_per_intf
>
> Marijn Suijten <marijn.suijten@somainline.org>
> drm/msm/dsi: Use DSC slice(s) packet size to compute word count
>
> Jessica Zhang <quic_jesszhan@quicinc.com>
> drm/msm/dpu: Fix slice_last_group_size calculation
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/msm/dpu: do not enable color-management if DSPPs are not available
>
> Su Hui <suhui@nfschina.com>
> ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
>
> Yuan Can <yuancan@huawei.com>
> clk: tegra: tegra124-emc: Fix potential memory leak
>
> Dan Carpenter <dan.carpenter@linaro.org>
> clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider()
>
> Dan Carpenter <dan.carpenter@linaro.org>
> clk: bcm: rpi: Fix off by one in raspberrypi_discover_clocks()
>
> Marijn Suijten <marijn.suijten@somainline.org>
> arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> arm64: dts: qcom: sdm845: Flush RSC sleep & wake votes
>
> Yuxing Liu <lyx2022@hust.edu.cn>
> clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()
>
> Zhanhao Hu <zero12113@hust.edu.cn>
> clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe
>
> Hao Luo <m202171776@hust.edu.cn>
> clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe
>
> Kai Ma <kaima@hust.edu.cn>
> clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probe
>
> Kashyap Desai <kashyap.desai@broadcom.com>
> RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context
>
> Kashyap Desai <kashyap.desai@broadcom.com>
> RDMA/bnxt_re: wraparound mbox producer index
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/msm/a5xx: really check for A510 in a5xx_gpu_init
>
> Chia-I Wu <olvaffe@gmail.com>
> amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
>
> Bob Pearson <rpearsonhpe@gmail.com>
> RDMA/rxe: Fix access checks in rxe_check_bind_mw
>
> Bob Pearson <rpearsonhpe@gmail.com>
> RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_mw.c
>
> Bob Pearson <rpearsonhpe@gmail.com>
> RDMA/rxe: Add ibdev_dbg macros for rxe
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> HID: uclogic: Modular KUnit tests should not depend on KUNIT=y
>
> Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> drm/radeon: fix possible division-by-zero errors
>
> Aurabindo Pillai <aurabindo.pillai@amd.com>
> drm/amd/display: Fix artifacting on eDP panels when engaging freesync video mode
>
> Chen-Yu Tsai <wenst@chromium.org>
> soc: mediatek: SVS: Fix MT8192 GPU node name
>
> Daniil Dulov <d.dulov@aladdin.ru>
> drm/amdkfd: Fix potential deallocation of previously deallocated memory.
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> drm/amd/display: Fix a test dml32_rq_dlg_get_rq_reg()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> drm/amd/display: Fix a test CalculatePrefetchSchedule()
>
> Paul Cercueil <paul@crapouillou.net>
> MIPS: DTS: CI20: Fix ACT8600 regulator node names
>
> Maxime Ripard <maxime@cerno.tech>
> clk: Export clk_hw_forward_rate_request()
>
> Christian Lamparter <chunkeey@gmail.com>
> ARM: dts: BCM5301X: fix duplex-full => full-duplex
>
> Guenter Roeck <linux@roeck-us.net>
> hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272
>
> Tim Harvey <tharvey@gateworks.com>
> hwmon: (gsc-hwmon) fix fan pwm temperature scaling
>
> Olivier Moysan <olivier.moysan@foss.st.com>
> ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx
>
> Marek Vasut <marex@denx.de>
> ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2
>
> Caleb Connolly <caleb.connolly@linaro.org>
> Input: pm8941-powerkey - fix debounce on gen2+ PMICs
>
> Keerthy <j-keerthy@ti.com>
> arm64: dts: ti: k3-j7200: Fix physical address of pin
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
>
> Kuogee Hsieh <quic_khsieh@quicinc.com>
> drm/msm/dpu: set DSC flush bit correctly at MDP CTL flush register
>
> Wolfram Sang <wsa+renesas@sang-engineering.com>
> arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier
>
> Chengchang Tang <tangchengchang@huawei.com>
> RDMA/hns: Fix hns_roce_table_get return value
>
> Brendan Cunningham <bcunningham@cornelisnetworks.com>
> IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate
>
> Arnd Bergmann <arnd@arndb.de>
> RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes
>
> Randy Dunlap <rdunlap@infradead.org>
> soc/fsl/qe: fix usb.c build errors
>
> Martin Blumenstingl <martin.blumenstingl@googlemail.com>
> ARM: dts: meson8: correct uart_B and uart_C clock references
>
> Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
> ASoC: es8316: Do not set rate constraints for unsupported MCLKs
>
> Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
> ASoC: es8316: Increment max value for ALC Capture Target Volume control
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> ARM: dts: qcom: apq8074-dragonboard: Set DMA as remotely controlled
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> memory: brcmstb_dpfe: fix testing array offset after use
>
> Marek Vasut <marex@denx.de>
> ARM: dts: stm32: Shorten the AV96 HDMI sound card name
>
> Douglas Anderson <dianders@chromium.org>
> arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to kukui
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: apq8096: fix fixed regulator name property
>
> Luca Weiss <luca.weiss@fairphone.com>
> arm64: dts: qcom: pm7250b: add missing spmi-vadc include
>
> Arnd Bergmann <arnd@arndb.de>
> ARM: omap2: fix missing tick_broadcast() prototype
>
> Arnd Bergmann <arnd@arndb.de>
> ARM: ep93xx: fix missing-prototype warnings
>
> Dario Binacchi <dario.binacchi@amarulasolutions.com>
> drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
>
> Frieder Schrempf <frieder.schrempf@kontron.de>
> drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec
>
> Dave Stevenson <dave.stevenson@raspberrypi.com>
> drm/bridge: Introduce pre_enable_prev_first to alter bridge init order
>
> Stephan Gerhold <stephan@gerhold.net>
> arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion
>
> Stephan Gerhold <stephan@gerhold.net>
> arm64: dts: qcom: apq8016-sbc: Fix regulator constraints
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sdm845-polaris: add missing touchscreen child node reg
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8350: correct DMA controller unit address
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8350: Add GPI DMA compatible fallback
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sdm845: correct camss unit address
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sdm630: correct camss unit address
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: msm8996: correct camss unit address
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: msm8994: correct SPMI unit address
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: msm8916: correct MMC unit address
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: msm8916: correct camss unit address
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: qcom: msm8974: do not use underscore in node name (again)
>
> Nícolas F. R. A. Prado <nfraprado@collabora.com>
> drm/bridge: anx7625: Prevent endless probe loop
>
> Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> drm/bridge: anx7625: Convert to i2c's .probe_new()
>
> Tony Lindgren <tony@atomide.com>
> ARM: dts: gta04: Move model property out of pinctrl node
>
> Biju Das <biju.das.jz@bp.renesas.com>
> clk: renesas: rzg2l: Fix CPG_SIPLL5_CLK1 register write
>
> Jean-Philippe Brucker <jean-philippe@linaro.org>
> iommu/virtio: Return size mapped for a detached domain
>
> Jean-Philippe Brucker <jean-philippe@linaro.org>
> iommu/virtio: Detach domain on endpoint release
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK
>
> Vinod Polimera <quic_vpolimer@quicinc.com>
> drm/msm/disp/dpu: get timing engine status from intf status register
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/msm/dsi: don't allow enabling 14nm VCO with unprogrammed rate
>
> Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
> RDMA/bnxt_re: Fix to remove an unnecessary log
>
> Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
> RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid
>
> Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
> RDMA/bnxt_re: Use unique names while registering interrupts
>
> Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
> RDMA/bnxt_re: Fix to remove unnecessary return labels
>
> Selvin Xavier <selvin.xavier@broadcom.com>
> RDMA/bnxt_re: Disable/kill tasklet only if it is enabled
>
> Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> hwmon: (f71882fg) prevent possible division by zero
>
> Dan Carpenter <dan.carpenter@linaro.org>
> clk: imx: scu: use _safe list iterator to avoid a use after free
>
> Alexander Stein <alexander.stein@ew.tq-group.com>
> drm/bridge: tc358767: Switch to devm MIPI-DSI helpers
>
> Robert Marko <robert.marko@sartura.hr>
> arm64: dts: microchip: sparx5: do not use PSCI on reference boards
>
> Tony Lindgren <tony@atomide.com>
> bus: ti-sysc: Fix dispc quirk masking bool variables
>
> Marek Vasut <marex@denx.de>
> ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards
>
> Maíra Canal <mcanal@igalia.com>
> drm/vkms: Fix RGB565 pixel conversion
>
> Maíra Canal <mcanal@igalia.com>
> drm: Add fixed-point helper to get rounded integer values
>
> Maíra Canal <mcanal@igalia.com>
> drm/vkms: isolate pixel conversion functionality
>
> Bard Liao <yung-chuan.liao@linux.intel.com>
> ASoC: Intel: sof_sdw: remove SOF_SDW_TGL_HDMI for MeteorLake devices
>
> Dan Carpenter <dan.carpenter@linaro.org>
> driver: soc: xilinx: use _safe loop iterator to avoid a use after free
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/panel: sharp-ls043t1le01: adjust mode settings
>
> XuDong Liu <m202071377@hust.edu.cn>
> drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
>
> Marek Vasut <marex@denx.de>
> Input: adxl34x - do not hardcode interrupt trigger type
>
> Marek Vasut <marek.vasut+renesas@mailbox.org>
> clk: rs9: Fix .driver_data content in i2c_device_id
>
> Marek Vasut <marek.vasut+renesas@mailbox.org>
> clk: vc7: Fix .driver_data content in i2c_device_id
>
> Marek Vasut <marek.vasut+renesas@mailbox.org>
> clk: vc5: Fix .driver_data content in i2c_device_id
>
> Liu Shixin <liushixin2@huawei.com>
> bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page
>
> Lars-Peter Clausen <lars@metafoo.de>
> clk: vc5: Use `clamp()` to restrict PLL range
>
> Peter Collingbourne <pcc@google.com>
> mm: call arch_swap_restore() from do_swap_page()
>
> hfdevel@gmx.net <hfdevel@gmx.net>
> ARM: dts: meson8b: correct uart_B and uart_C clock references
>
> Rafał Miłecki <rafal@milecki.pl>
> ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
>
> Luc Ma <luc@sietium.com>
> drm/vram-helper: fix function names in vram helper doc
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> drm/bridge: tc358768: fix THS_TRAILCNT computation
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> drm/bridge: tc358768: fix TXTAGOCNT computation
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> drm/bridge: tc358768: fix THS_ZEROCNT computation
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> drm/bridge: tc358768: fix TCLK_TRAILCNT computation
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> drm/bridge: tc358768: fix TCLK_ZEROCNT computation
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> drm/bridge: tc358768: fix PLL target frequency
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> drm/bridge: tc358768: fix PLL parameters computation
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> drm/bridge: tc358768: always enable HS video mode
>
> Alexander Stein <alexander.stein@ew.tq-group.com>
> drm/bridge: ti-sn65dsi83: Fix enable error path
>
> Luca Weiss <luca@z3ntu.xyz>
> Input: drv260x - sleep between polling GO bit
>
> Markus Elfring <elfring@users.sourceforge.net>
> drm/bridge: it6505: Move a variable assignment behind a null pointer check in receive_timing_debugfs_show()
>
> Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
> drm/amd/display: Explicitly specify update type per plane info change
>
> Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> radeon: avoid double free in ci_dpm_init()
>
> Wesley Chalmers <Wesley.Chalmers@amd.com>
> drm/amd/display: Add logging for display MALL refresh setting
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> netlink: Add __sock_i_ino() for __netlink_diag_dump().
>
> Cambda Zhu <cambda@linux.alibaba.com>
> ipvlan: Fix return value of ipvlan_queue_xmit()
>
> Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>
> netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.
>
> Florian Westphal <fw@strlen.de>
> netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
>
> Jeremy Sowden <jeremy@azazel.net>
> lib/ts_bm: reset initial match offset for every block of text
>
> Lin Ma <linma@zju.edu.cn>
> net: nfc: Fix use-after-free caused by nfc_llcp_find_local
>
> Edward Cree <ecree.xilinx@gmail.com>
> sfc: fix crash when reading stats while NIC is resetting
>
> David Howells <dhowells@redhat.com>
> ocfs2: Fix use of slab data with sendpage
>
> Maxim Kochetkov <fido_max@inbox.ru>
> net: axienet: Move reset before 64-bit DMA detection
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> gtp: Fix use-after-free in __gtp_encap_destroy().
>
> Sabrina Dubroca <sd@queasysnail.net>
> selftests: rtnetlink: remove netdevsim device after ipsec offload test
>
> Eric Dumazet <edumazet@google.com>
> bonding: do not assume skb mac_header is set
>
> Eric Dumazet <edumazet@google.com>
> netlink: do not hard code device address lenth in fdb dumps
>
> Eric Dumazet <edumazet@google.com>
> netlink: fix potential deadlock in netlink_set_err()
>
> Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> net: stmmac: fix double serdes powerdown
>
> Jimmy Assarsson <extja@kvaser.com>
> can: kvaser_pciefd: Set hardware timestamp on transmitted packets
>
> Jimmy Assarsson <extja@kvaser.com>
> can: kvaser_pciefd: Add function to set skb hwtstamps
>
> Vincent Mailhol <mailhol.vincent@wanadoo.fr>
> can: length: fix bitstuffing count
>
> Gilad Sever <gilad9366@gmail.com>
> bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings
>
> Gilad Sever <gilad9366@gmail.com>
> bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint
>
> Gilad Sever <gilad9366@gmail.com>
> bpf: Factor out socket lookup functions for the TC hookpoint.
>
> Dmitry Antipov <dmantipov@yandex.ru>
> wifi: ath9k: convert msecs to jiffies where needed
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection
>
> Marek Vasut <marex@denx.de>
> mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019
>
> Ilan Peer <ilan.peer@intel.com>
> wifi: ieee80211: Fix the common size calculation for reconfiguration ML
>
> Ilan Peer <ilan.peer@intel.com>
> wifi: cfg80211/mac80211: Fix ML element common size calculation
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: cfg80211: fix regulatory disconnect with OCB/NAN
>
> Benjamin Berg <benjamin.berg@intel.com>
> wifi: cfg80211: drop incorrect nontransmitted BSS update code
>
> Benjamin Berg <benjamin.berg@intel.com>
> wifi: cfg80211: rewrite merging of inherited elements
>
> Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
> wifi: mac80211: Remove "Missing iftype sband data/EHT cap" spam
>
> Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
> wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler()
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: iwlwifi: pull from TXQs with softirqs disabled
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> wifi: ath11k: Add missing check for ioremap
>
> Edwin Peer <edwin.peer@broadcom.com>
> rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
>
> Ilan Peer <ilan.peer@intel.com>
> wifi: mac80211: Fix permissions for valid_links debugfs entry
>
> Remi Pommarel <repk@triplefau.lt>
> wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
>
> Arnd Bergmann <arnd@arndb.de>
> memstick r592: make memstick_debug_get_tpc_name() static
>
> Douglas Anderson <dianders@chromium.org>
> mmc: mediatek: Avoid ugly error message when SDIO wakeup IRQ isn't used
>
> Zhen Lei <thunder.leizhen@huawei.com>
> kexec: fix a memory leak in crash_shrink_memory()
>
> Douglas Anderson <dianders@chromium.org>
> watchdog/perf: more properly prevent false positives with turbo modes
>
> Douglas Anderson <dianders@chromium.org>
> watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
>
> Haifeng Xu <haifeng.xu@shopee.com>
> selftests: cgroup: fix unexpected failure on test_memcg_low
>
> Karol Kolacinski <karol.kolacinski@intel.com>
> ice: handle extts in the miscellaneous interrupt thread
>
> Marek Vasut <marex@denx.de>
> wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
>
> Marek Vasut <marex@denx.de>
> wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled
>
> Jesper Dangaard Brouer <brouer@redhat.com>
> selftests/bpf: Fix check_mtu using wrong variable type
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: mac80211: recalc min chandef for new STA links
>
> Youghandhar Chintala <quic_youghand@quicinc.com>
> wifi: ath10k: Trigger STA disconnect after reconfig complete on hardware restart
>
> Jesper Dangaard Brouer <brouer@redhat.com>
> samples/bpf: xdp1 and xdp2 reduce XDPBUFSIZE to 60
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> wifi: ray_cs: Fix an error handling path in ray_probe()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> wifi: atmel: Fix an error handling path in atmel_probe()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> regulator: core: Streamline debugfs operations
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> regulator: core: Fix more error checking for debugfs_create_dir()
>
> Alexey Gladkov <legion@kernel.org>
> selftests/bpf: Do not use sign-file as testcase
>
> Yafang Shao <laoar.shao@gmail.com>
> bpf: Fix memleak due to fentry attach failure
>
> Yafang Shao <laoar.shao@gmail.com>
> bpf: Remove bpf trampoline selector
>
> Alan Maguire <alan.maguire@oracle.com>
> bpftool: JIT limited misreported as negative value on aarch64
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect()
>
> Joy Chakraborty <joychakr@google.com>
> spi: dw: Round of n_bytes to power of 2
>
> Stanislav Fomichev <sdf@google.com>
> bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen
>
> Andrii Nakryiko <andrii@kernel.org>
> libbpf: fix offsetof() and container_of() to work with CO-RE
>
> Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
> sctp: add bpf_bypass_getsockopt proto callback
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan()
>
> Amisha Patel <amisha.patel@microchip.com>
> wifi: wilc1000: fix for absent RSN capabilities WFA testcase
>
> Vijaya Krishna Nivarthi <quic_vnivarth@quicinc.com>
> spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
>
> Pengcheng Yang <yangpc@wangsu.com>
> samples/bpf: Fix buffer overflow in tcp_basertt
>
> Martin KaFai Lau <martin.lau@kernel.org>
> libbpf: btf_dump_type_data_check_overflow needs to consider BTF_MEMBER_BITFIELD_SIZE
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
>
> Peter Seiderer <ps.report@gmx.net>
> wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
>
> Jesper Dangaard Brouer <brouer@redhat.com>
> igc: Enable and fix RX hash usage by netstack
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> pstore/ram: Add check for kstrdup
>
> Roberto Sassu <roberto.sassu@huawei.com>
> ima: Fix build warnings
>
> Roberto Sassu <roberto.sassu@huawei.com>
> evm: Fix build warnings
>
> Roberto Sassu <roberto.sassu@huawei.com>
> evm: Complete description of evm_inode_setattr()
>
> Mark Rutland <mark.rutland@arm.com>
> locking/atomic: arm: fix sync ops
>
> Juergen Gross <jgross@suse.com>
> x86/mm: Fix __swp_entry_to_pte() for Xen PV guests
>
> Ravi Bangoria <ravi.bangoria@amd.com>
> perf/ibs: Fix interface via core pmu events
>
> Colin Ian King <colin.i.king@gmail.com>
> kselftest: vDSO: Fix accumulation of uninitialized ret when CLOCK_REALTIME is undefined
>
> Qiuxu Zhuo <qiuxu.zhuo@intel.com>
> rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale
>
> Qiuxu Zhuo <qiuxu.zhuo@intel.com>
> rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup()
>
> Paul E. McKenney <paulmck@kernel.org>
> rcuscale: Move shutdown from wait_event() to wait_event_idle()
>
> Paul E. McKenney <paulmck@kernel.org>
> rcutorture: Correct name of use_softirq module parameter
>
> Paul E. McKenney <paulmck@kernel.org>
> rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs
>
> Paul E. McKenney <paulmck@kernel.org>
> rcu: Make rcu_cpu_starting() rely on interrupts being disabled
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe()
>
> Balsam CHIHI <bchihi@baylibre.com>
> thermal/drivers/mediatek: Relocate driver to mediatek folder
>
> Tero Kristo <tero.kristo@linux.intel.com>
> cpufreq: intel_pstate: Fix energy_performance_preference for passive
>
> Arnd Bergmann <arnd@arndb.de>
> ARM: 9303/1: kprobes: avoid missing-declaration warnings
>
> Ulf Hansson <ulf.hansson@linaro.org>
> PM: domains: Move the verification of in-params from genpd_add_device()
>
> Zhang Rui <rui.zhang@intel.com>
> powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
>
> Junhao He <hejunhao3@huawei.com>
> drivers/perf: hisi: Don't migrate perf to the CPU going to teardown
>
> Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> x86/tdx: Fix race between set_memory_encrypted() and load_unaligned_zeropad()
>
> Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> x86/mm: Allow guest.enc_status_change_prepare() to fail
>
> Robin Murphy <robin.murphy@arm.com>
> perf/arm-cmn: Fix DTC reset
>
> Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> PM: domains: fix integer overflow issues in genpd_parse_state()
>
> Feng Mingxi <m202271825@hust.edu.cn>
> clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
>
> Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
>
> Wen Yang <wenyang.linux@foxmail.com>
> tick/rcu: Fix bogus ratelimit condition
>
> Thomas Gleixner <tglx@linutronix.de>
> posix-timers: Prevent RT livelock in itimer_delete()
>
> Gao Xiang <xiang@kernel.org>
> erofs: fix compact 4B support for 16k block size
>
> Gao Xiang <xiang@kernel.org>
> erofs: simplify iloc()
>
> Chuck Lever <chuck.lever@oracle.com>
> svcrdma: Prevent page release when nothing was received
>
> John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
> irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
>
> Antonio Borneo <antonio.borneo@foss.st.com>
> irqchip/stm32-exti: Fix warning on initialized field overwritten
>
> Yu Kuai <yukuai3@huawei.com>
> block: fix blktrace debugfs entries leakage
>
> Yu Kuai <yukuai3@huawei.com>
> md/raid1-10: submit write io directly if bitmap is not enabled
>
> Yu Kuai <yukuai3@huawei.com>
> md/raid1-10: factor out a helper to submit normal write
>
> Yu Kuai <yukuai3@huawei.com>
> md/raid1-10: factor out a helper to add bio to plug
>
> Li Nan <linan122@huawei.com>
> md/raid10: fix io loss while replacement replace rdev
>
> Li Nan <linan122@huawei.com>
> md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
>
> Li Nan <linan122@huawei.com>
> md/raid10: fix wrong setting of max_corr_read_errors
>
> Li Nan <linan122@huawei.com>
> md/raid10: fix overflow of md/safe_mode_delay
>
> Li Nan <linan122@huawei.com>
> md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
>
> Chaitanya Kulkarni <kch@nvidia.com>
> nvme-core: fix dev_pm_qos memleak
>
> Chaitanya Kulkarni <kch@nvidia.com>
> nvme-core: add missing fault-injection cleanup
>
> Sagi Grimberg <sagi@grimberg.me>
> nvme-auth: don't ignore key generation failures when initializing ctrl keys
>
> Chaitanya Kulkarni <kch@nvidia.com>
> nvme-core: fix memory leak in dhchap_ctrl_secret
>
> Chaitanya Kulkarni <kch@nvidia.com>
> nvme-core: fix memory leak in dhchap_secret_store
>
> Sagi Grimberg <sagi@grimberg.me>
> nvme-auth: no need to reset chap contexts on re-authentication
>
> Sagi Grimberg <sagi@grimberg.me>
> nvme-auth: remove symbol export from nvme_auth_reset
>
> Sagi Grimberg <sagi@grimberg.me>
> nvme-auth: rename authentication work elements
>
> Sagi Grimberg <sagi@grimberg.me>
> nvme-auth: rename __nvme_auth_[reset|free] to nvme_auth[reset|free]_dhchap
>
> NeilBrown <neilb@suse.de>
> lockd: drop inappropriate svc_get() from locked_get()
>
> Yu Kuai <yukuai3@huawei.com>
> blk-mq: fix potential io hang by wrong 'wake_batch'
>
> Arnd Bergmann <arnd@arndb.de>
> virt: sevguest: Add CONFIG_CRYPTO dependency
>
> Tom Lendacky <thomas.lendacky@amd.com>
> x86/sev: Fix calculation of end address based on number of pages
>
> Li Nan <linan122@huawei.com>
> blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
>
> Shawn Wang <shawnwang@linux.alibaba.com>
> x86/resctrl: Only show tasks' pid in current pid namespace
>
> Gao Xiang <xiang@kernel.org>
> erofs: kill hooked chains to avoid loops on deduplicated compressed images
>
> Gao Xiang <xiang@kernel.org>
> erofs: move zdata.h into zdata.c
>
> Gao Xiang <xiang@kernel.org>
> erofs: remove tagged pointer helpers
>
> Gao Xiang <xiang@kernel.org>
> erofs: avoid tagged pointers to mark sync decompression
>
> Gao Xiang <xiang@kernel.org>
> erofs: clean up cached I/O strategies
>
> Bart Van Assche <bvanassche@acm.org>
> block: Fix the type of the second bdev_op_is_zoned_write() argument
>
> Arnd Bergmann <arnd@arndb.de>
> fs: pipe: reveal missing function protoypes
>
> Jeff Layton <jlayton@kernel.org>
> drm: use mgr->dev in drm_dbg_kms in drm_dp_add_payload_part2
We're seeing build failures on i386 and x86 with Clang:
-----8<-----
/builds/linux/block/blk-cgroup.c:1238:6: error: variable 'ret' is used
uninitialized whenever 'if' condition is true
[-Werror,-Wsometimes-uninitialized]
if (init_blkcg_llists(blkcg))
^~~~~~~~~~~~~~~~~~~~~~~~
/builds/linux/block/blk-cgroup.c:1288:9: note: uninitialized use occurs here
return ret;
^~~
/builds/linux/block/blk-cgroup.c:1238:2: note: remove the 'if' if its
condition is always false
if (init_blkcg_llists(blkcg))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/builds/linux/block/blk-cgroup.c:1223:33: note: initialize the
variable 'ret' to silence this warning
struct cgroup_subsys_state *ret;
^
= NULL
1 error generated.
----->8-----
More info to follow soon.
Greetings!
Daniel Díaz
daniel.diaz@linaro.org
^ permalink raw reply [flat|nested] 604+ messages in thread* Re: [PATCH 6.1 000/591] 6.1.39-rc1 review
2023-07-16 23:40 ` [PATCH 6.1 000/591] 6.1.39-rc1 review Daniel Díaz
@ 2023-07-17 0:01 ` Guenter Roeck
2023-07-17 18:47 ` Greg Kroah-Hartman
0 siblings, 1 reply; 604+ messages in thread
From: Guenter Roeck @ 2023-07-17 0:01 UTC (permalink / raw)
To: Daniel Díaz, Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
On 7/16/23 16:40, Daniel Díaz wrote:
> Hello!
>
> On Sun, 16 Jul 2023 at 14:31, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
>> This is the start of the stable review cycle for the 6.1.39 release.
>> There are 591 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>>
>> Responses should be made by Tue, 18 Jul 2023 19:48:07 +0000.
>> Anything received after that time might be too late.
>>
[ ... ]
> We're seeing build failures on i386 and x86 with Clang:
> -----8<-----
> /builds/linux/block/blk-cgroup.c:1238:6: error: variable 'ret' is used
> uninitialized whenever 'if' condition is true
> [-Werror,-Wsometimes-uninitialized]
> if (init_blkcg_llists(blkcg))
> ^~~~~~~~~~~~~~~~~~~~~~~~
> /builds/linux/block/blk-cgroup.c:1288:9: note: uninitialized use occurs here
> return ret;
> ^~~
> /builds/linux/block/blk-cgroup.c:1238:2: note: remove the 'if' if its
> condition is always false
> if (init_blkcg_llists(blkcg))
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> /builds/linux/block/blk-cgroup.c:1223:33: note: initialize the
> variable 'ret' to silence this warning
> struct cgroup_subsys_state *ret;
> ^
> = NULL
> 1 error generated.
> ----->8-----
>
> More info to follow soon.
>
Caused by 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
which is missing its prerequisite b5a9adcbd5dc ("blk-cgroup: Return
-ENOMEM directly in blkcg_css_alloc() error path"). With three Fixup:
patches following, it is one of those patches where I wonder if it
is worth the trouble.
Guenter
^ permalink raw reply [flat|nested] 604+ messages in thread* Re: [PATCH 6.1 000/591] 6.1.39-rc1 review
2023-07-17 0:01 ` Guenter Roeck
@ 2023-07-17 18:47 ` Greg Kroah-Hartman
0 siblings, 0 replies; 604+ messages in thread
From: Greg Kroah-Hartman @ 2023-07-17 18:47 UTC (permalink / raw)
To: Guenter Roeck
Cc: Daniel Díaz, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Sun, Jul 16, 2023 at 05:01:55PM -0700, Guenter Roeck wrote:
> On 7/16/23 16:40, Daniel Díaz wrote:
> > Hello!
> >
> > On Sun, 16 Jul 2023 at 14:31, Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > > This is the start of the stable review cycle for the 6.1.39 release.
> > > There are 591 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Tue, 18 Jul 2023 19:48:07 +0000.
> > > Anything received after that time might be too late.
> > >
> [ ... ]
> > We're seeing build failures on i386 and x86 with Clang:
> > -----8<-----
> > /builds/linux/block/blk-cgroup.c:1238:6: error: variable 'ret' is used
> > uninitialized whenever 'if' condition is true
> > [-Werror,-Wsometimes-uninitialized]
> > if (init_blkcg_llists(blkcg))
> > ^~~~~~~~~~~~~~~~~~~~~~~~
> > /builds/linux/block/blk-cgroup.c:1288:9: note: uninitialized use occurs here
> > return ret;
> > ^~~
> > /builds/linux/block/blk-cgroup.c:1238:2: note: remove the 'if' if its
> > condition is always false
> > if (init_blkcg_llists(blkcg))
> > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > /builds/linux/block/blk-cgroup.c:1223:33: note: initialize the
> > variable 'ret' to silence this warning
> > struct cgroup_subsys_state *ret;
> > ^
> > = NULL
> > 1 error generated.
> > ----->8-----
> >
> > More info to follow soon.
> >
>
> Caused by 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
> which is missing its prerequisite b5a9adcbd5dc ("blk-cgroup: Return
> -ENOMEM directly in blkcg_css_alloc() error path"). With three Fixup:
> patches following, it is one of those patches where I wonder if it
> is worth the trouble.
Yeah, I'm going to just drop this mess for now, thanks. If the block
developers think it is worth adding, let's get them to submit the
working backports :)
greg k-h
^ permalink raw reply [flat|nested] 604+ messages in thread
* Re: [PATCH 6.1 000/591] 6.1.39-rc1 review
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (591 preceding siblings ...)
2023-07-16 23:40 ` [PATCH 6.1 000/591] 6.1.39-rc1 review Daniel Díaz
@ 2023-07-17 0:47 ` ogasawara takeshi
2023-07-17 11:18 ` Conor Dooley
2023-07-17 20:46 ` Shuah Khan
594 siblings, 0 replies; 604+ messages in thread
From: ogasawara takeshi @ 2023-07-17 0:47 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
Hi Greg
On Mon, Jul 17, 2023 at 5:31 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.1.39 release.
> There are 591 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 18 Jul 2023 19:48:07 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.39-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
6.1.39-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64), arch linux)
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 604+ messages in thread* Re: [PATCH 6.1 000/591] 6.1.39-rc1 review
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (592 preceding siblings ...)
2023-07-17 0:47 ` ogasawara takeshi
@ 2023-07-17 11:18 ` Conor Dooley
2023-07-17 20:46 ` Shuah Khan
594 siblings, 0 replies; 604+ messages in thread
From: Conor Dooley @ 2023-07-17 11:18 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
[-- Attachment #1: Type: text/plain, Size: 611 bytes --]
Hey,
On Sun, Jul 16, 2023 at 09:42:19PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.39 release.
> There are 591 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Fails to build w/ clang on RISC-V:
block/blk-cgroup.c:1238:6: error: variable 'ret' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
Guenter already pointed out the culprit.
Other than that,
Tested-by: Conor Dooley <conor.dooley@microchip.com>
Thanks,
Conor.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 604+ messages in thread* Re: [PATCH 6.1 000/591] 6.1.39-rc1 review
2023-07-16 19:42 [PATCH 6.1 000/591] 6.1.39-rc1 review Greg Kroah-Hartman
` (593 preceding siblings ...)
2023-07-17 11:18 ` Conor Dooley
@ 2023-07-17 20:46 ` Shuah Khan
594 siblings, 0 replies; 604+ messages in thread
From: Shuah Khan @ 2023-07-17 20:46 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, Shuah Khan
On 7/16/23 13:42, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.39 release.
> There are 591 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 18 Jul 2023 19:48:07 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.39-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 604+ messages in thread