* [PATCH 6.1 000/194] 6.1.47-rc1 review
@ 2023-08-21 19:39 Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 001/194] mmc: sdhci-f-sdh30: Replace with sdhci_pltfm Greg Kroah-Hartman
` (204 more replies)
0 siblings, 205 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
This is the start of the stable review cycle for the 6.1.47 release.
There are 194 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.1.47-rc1
Yangtao Li <frank.li@vivo.com>
mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
Jason Xing <kernelxing@tencent.com>
net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
Karol Herbst <kherbst@redhat.com>
drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create
Kuniyuki Iwashima <kuniyu@amazon.com>
af_unix: Fix null-ptr-deref in unix_stream_sendpage().
Guchun Chen <guchun.chen@amd.com>
drm/amdgpu: keep irq count in amdgpu_irq_disable_all
Tim Huang <Tim.Huang@amd.com>
drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11
Mark Brown <broonie@kernel.org>
arm64/ptrace: Ensure that SME is set up for target when writing SSVE state
Borislav Petkov (AMD) <bp@alien8.de>
x86/srso: Correct the mitigation status when SMT is disabled
Peter Zijlstra <peterz@infradead.org>
objtool/x86: Fixup frame-pointer vs rethunk
Petr Pavlu <petr.pavlu@suse.com>
x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG
Borislav Petkov (AMD) <bp@alien8.de>
x86/srso: Disable the mitigation on unaffected configurations
Borislav Petkov (AMD) <bp@alien8.de>
x86/CPU/AMD: Fix the DIV(0) initial fix attempt
Sean Christopherson <seanjc@google.com>
x86/retpoline: Don't clobber RFLAGS during srso_safe_ret()
Peter Zijlstra <peterz@infradead.org>
x86/static_call: Fix __static_call_fixup()
Borislav Petkov (AMD) <bp@alien8.de>
x86/srso: Explain the untraining sequences a bit more
Peter Zijlstra <peterz@infradead.org>
x86/cpu: Cleanup the untrain mess
Peter Zijlstra <peterz@infradead.org>
x86/cpu: Rename srso_(.*)_alias to srso_alias_\1
Peter Zijlstra <peterz@infradead.org>
x86/cpu: Rename original retbleed methods
Peter Zijlstra <peterz@infradead.org>
x86/cpu: Clean up SRSO return thunk mess
Peter Zijlstra <peterz@infradead.org>
x86/alternative: Make custom return thunk unconditional
Peter Zijlstra <peterz@infradead.org>
x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
Peter Zijlstra <peterz@infradead.org>
x86/cpu: Fix __x86_return_thunk symbol type
Xin Long <lucien.xin@gmail.com>
netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
Mike Kravetz <mike.kravetz@oracle.com>
hugetlb: do not clear hugetlb dtor until allocating vmemmap
Saaem Rizvi <SyedSaaem.Rizvi@amd.com>
drm/amd/display: Implement workaround for writing to OTG_PIXEL_RATE_DIV register
Vincent Guittot <vincent.guittot@linaro.org>
sched/fair: Remove capacity inversion detection
Vincent Guittot <vincent.guittot@linaro.org>
sched/fair: unlink misfit task from cpu overutilized
Sergey Senozhatsky <senozhatsky@chromium.org>
zsmalloc: allow only one active pool compaction context
Daniel Miess <daniel.miess@amd.com>
drm/amd/display: disable RCO for DCN314
Arnd Bergmann <arnd@arndb.de>
ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG
Umio Yasuno <coelacanth_dream@protonmail.com>
drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7
Tim Huang <Tim.Huang@amd.com>
drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix
Mario Limonciello <mario.limonciello@amd.com>
drm/amd: flush any delayed gfxoff on suspend entry
Jani Nikula <jani.nikula@intel.com>
drm/i915/sdvo: fix panel_type initialization
Wander Lairson Costa <wander@redhat.com>
drm/qxl: fix UAF on handle creation
Yibin Ding <yibin.ding@unisoc.com>
mmc: block: Fix in_flight[issue_type] value error
Yang Yingliang <yangyingliang@huawei.com>
mmc: wbsd: fix double mmc_free_host() in wbsd_init()
Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
blk-crypto: dynamically allocate fallback profile
Yogesh Hegde <yogi.kernel@gmail.com>
arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards
Hawkins Jiawei <yin31149@gmail.com>
virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case
Mingzheng Xing <xingmingzheng@iscas.ac.cn>
riscv: Handle zicsr/zifencei issue between gcc and binutils
Russell Harmon via samba-technical <samba-technical@lists.samba.org>
cifs: Release folio lock on fscache read hit.
dengxiang <dengxiang@nfschina.com>
ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
Tony Lindgren <tony@atomide.com>
serial: 8250: Fix oops for port->pm on uart_change_pm()
Alexandre Ghiti <alexghiti@rivosinc.com>
riscv: uaccess: Return the number of bytes effectively not copied
Kailang Yang <kailang@realtek.com>
ALSA: hda/realtek - Remodified 3k pull low procedure
Jiasheng Jiang <jiasheng@iscas.ac.cn>
soc: aspeed: socinfo: Add kfree for kstrdup
Zev Weiss <zev@bewilderbeest.net>
soc: aspeed: uart-routing: Use __sysfs_match_string
Stefan Binding <sbinding@opensource.cirrus.com>
ALSA: hda/realtek: Add quirks for HP G11 Laptops
Jerome Brunet <jbrunet@baylibre.com>
ASoC: meson: axg-tdm-formatter: fix channel slot allocation
Zhang Shurong <zhang_shurong@foxmail.com>
ASoC: rt5665: add missed regulator_bulk_disable
Alexander Stein <alexander.stein@ew.tq-group.com>
arm64: dts: imx93: Fix anatop node size
Xiaolei Wang <xiaolei.wang@windriver.com>
ARM: dts: imx: Set default tuning step for imx6sx usdhc
Fabio Estevam <festevam@denx.de>
arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration
Andrej Picej <andrej.picej@norik.com>
ARM: dts: imx6: phytec: fix RTC interrupt level
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
ARM: dts: imx: align LED node names with dtschema
Christopher Obbard <chris.obbard@collabora.com>
arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+
Christopher Obbard <chris.obbard@collabora.com>
arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict
Tony Lindgren <tony@atomide.com>
bus: ti-sysc: Flush posted write on enable before reset
Marcin Szycik <marcin.szycik@linux.intel.com>
ice: Block switchdev mode when ADQ is active and vice versa
Manish Chopra <manishc@marvell.com>
qede: fix firmware halt over suspend and resume
Eric Dumazet <edumazet@google.com>
net: do not allow gso_size to be set to GSO_BY_FRAGS
Abel Wu <wuyun.abel@bytedance.com>
sock: Fix misuse of sk_under_memory_pressure()
Edward Cree <ecree.xilinx@gmail.com>
sfc: don't unregister flow_indr if it was never registered
Alfred Lee <l00g33k@gmail.com>
net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
Andrii Staikov <andrii.staikov@intel.com>
i40e: fix misleading debug logs
Piotr Gardocki <piotrx.gardocki@intel.com>
iavf: fix FDIR rule fields masks validation
Jakub Kicinski <kuba@kernel.org>
net: openvswitch: reject negative ifindex
Ziyang Xuan <william.xuanziyang@huawei.com>
team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
Justin Chen <justin.chen@broadcom.com>
net: phy: broadcom: stub c45 read/write for 54810
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_dynset: disallow object maps
Sishuai Gong <sishuai.system@gmail.com>
ipvs: fix racy memcpy in proc_do_sync_threshold
Florian Westphal <fw@strlen.de>
netfilter: nf_tables: deactivate catchall elements in next generation
Florian Westphal <fw@strlen.de>
netfilter: nf_tables: fix false-positive lockdep splat
Michal Schmidt <mschmidt@redhat.com>
octeon_ep: cancel tx_timeout_task later in remove sequence
Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source
Luca Ceresoli <luca.ceresoli@bootlin.com>
drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
Petr Machata <petrm@nvidia.com>
selftests: mirror_gre_changes: Tighten up the TTL test match
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: phy: fix IRQ-based wake-on-lan over hibernate / power off
Xiang Yang <xiangyang3@huawei.com>
net: pcs: Add missing put_device call in miic_create
Jason Wang <jasowang@redhat.com>
virtio-net: set queues after driver_ok
Laurent Vivier <lvivier@redhat.com>
virtio_net: notify MAC address change on device initialization
Lin Ma <linma@zju.edu.cn>
xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
Lin Ma <linma@zju.edu.cn>
xfrm: add NULL check in xfrm_update_ae_params
Zhengchao Shao <shaozhengchao@huawei.com>
ip_vti: fix potential slab-use-after-free in decode_session6
Zhengchao Shao <shaozhengchao@huawei.com>
ip6_vti: fix slab-use-after-free in decode_session6
Zhengchao Shao <shaozhengchao@huawei.com>
xfrm: fix slab-use-after-free in decode_session6
Lin Ma <linma@zju.edu.cn>
net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
Lin Ma <linma@zju.edu.cn>
net: af_key: fix sadb_x_filter validation
Lin Ma <linma@zju.edu.cn>
net: xfrm: Fix xfrm_address_filter OOB read
Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
i2c: designware: Handle invalid SMBus block data response length value
Quan Nguyen <quan@os.amperecomputing.com>
i2c: designware: Correct length byte validation logic
xiaoshoukui <xiaoshoukui@gmail.com>
btrfs: fix BUG_ON condition in btrfs_cancel_balance
Josef Bacik <josef@toxicpanda.com>
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range
Sherry Sun <sherry.sun@nxp.com>
tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms
Yi Yang <yiyang13@huawei.com>
tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
Dragos Tatulea <dtatulea@nvidia.com>
vdpa: Enable strict validation for netlinks ops
Lin Ma <linma@zju.edu.cn>
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
Lin Ma <linma@zju.edu.cn>
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
Lin Ma <linma@zju.edu.cn>
vdpa: Add features attr to vdpa_nl_policy for nlattr length check
Nathan Lynch <nathanl@linux.ibm.com>
powerpc/rtas_flash: allow user copy to flash block cache objects
Yuanjun Gong <ruc_gongyuanjun@163.com>
fbdev: mmp: fix value check in mmphw_probe()
Parker Newman <pnewman@connecttech.com>
i2c: tegra: Fix i2c-tegra DMA config option processing
Yicong Yang <yangyicong@hisilicon.com>
i2c: hisi: Only handle the interrupt of the driver's transfer
Chengfeng Ye <dg573847474@gmail.com>
i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
Steve French <stfrench@microsoft.com>
cifs: fix potential oops in cifs_oplock_break
Eugenio Pérez <eperezma@redhat.com>
vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary
Dragos Tatulea <dtatulea@nvidia.com>
vdpa/mlx5: Fix mr->initialized semantics
Maxime Coquelin <maxime.coquelin@redhat.com>
vduse: Use proper spinlock for IRQ injection
Wolfram Sang <wsa+renesas@sang-engineering.com>
virtio-mmio: don't break lifecycle of vm_dev
Filipe Manana <fdmanana@suse.com>
btrfs: fix use-after-free of new block group that became unused
David Sterba <dsterba@suse.com>
btrfs: convert btrfs_block_group::seq_zone to runtime flag
David Sterba <dsterba@suse.com>
btrfs: convert btrfs_block_group::needs_free_space to runtime flag
Naohiro Aota <naota@elisp.net>
btrfs: move out now unused BG from the reclaim list
Daniel Vetter <daniel.vetter@ffwll.ch>
video/aperture: Only remove sysfb on the default vga pci device
Thomas Zimmermann <tzimmermann@suse.de>
fbdev/hyperv-fb: Do not set struct fb_info.apertures
Xu Yang <xu.yang_2@nxp.com>
ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
Marc Zyngier <maz@kernel.org>
KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption
Hersen Wu <hersenxs.wu@amd.com>
drm/amd/display: fix access hdcp_workqueue assert
hersen wu <hersenxs.wu@amd.com>
drm/amd/display: phase3 mst hdcp for multiple displays
hersen wu <hersenxs.wu@amd.com>
drm/amd/display: save restore hdcp state when display is unplugged from mst hub
Song Yoong Siang <yoong.siang.song@intel.com>
igc: read before write to SRRCTL register
Chen Lin <chen.lin5@zte.com.cn>
ring-buffer: Do not swap cpu_buffer during resize process
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Bluetooth: MGMT: Use correct address for memcpy()
Benjamin Gray <bgray@linux.ibm.com>
powerpc/kasan: Disable KCOV in KASAN code
Luke D. Jones <luke@ljones.dev>
ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V
Luke D. Jones <luke@ljones.dev>
ALSA: hda/realtek: Add quirk for ASUS ROG GA402X
Luke D. Jones <luke@ljones.dev>
ALSA: hda/realtek: Add quirk for ASUS ROG GX650P
Tuo Li <islituo@gmail.com>
ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
dengxiang <dengxiang@nfschina.com>
ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
Jia-Ju Bai <baijiaju@buaa.edu.cn>
fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
Edward Lo <loyuantsung@gmail.com>
fs/ntfs3: Enhance sanity check while generating attr_list
shanzhulig <shanzhulig@gmail.com>
drm/amdgpu: Fix potential fence use-after-free v2
Xiubo Li <xiubli@redhat.com>
ceph: try to dump the msgs when decoding fails
Matthew Anderson <ruinairas1992@gmail.com>
Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
Zhengping Jiang <jiangzp@google.com>
Bluetooth: L2CAP: Fix use-after-free
Yuechao Zhao <yuechao.zhao@advantech.com.cn>
watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
Zhang Shurong <zhang_shurong@foxmail.com>
firewire: net: fix use after free in fwnet_finish_incoming_packet()
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Add Intel Barlow Ridge PCI ID
Armin Wolf <W_Armin@gmx.de>
pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
Tuo Li <islituo@gmail.com>
gfs2: Fix possible data races in gfs2_show_options()
Xu Yang <xu.yang_2@nxp.com>
usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
Xu Yang <xu.yang_2@nxp.com>
usb: chipidea: imx: don't request QoS for imx8ulp
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx()
Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: platform: mediatek: vpu: fix NULL ptr dereference
Avichal Rakesh <arakesh@google.com>
usb: gadget: uvc: queue empty isoc requests if no video buffer is available
Prashanth K <quic_prashk@quicinc.com>
usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
Andrey Konovalov <andrey.konovalov@linaro.org>
media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250
Yunfei Dong <yunfei.dong@mediatek.com>
media: v4l2-mem2mem: add lock to protect parameter num_rdy
Lu Hongfei <luhongfei@vivo.com>
led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
serial: stm32: Ignore return value of uart_remove_one_port() in .remove()
Winston Wen <wentao@uniontech.com>
cifs: fix session state check in reconnect to avoid use-after-free issue
Paulo Alcantara <pc@manguebit.com>
smb: client: fix warning in cifs_smb3_do_mount()
Matthew Anderson <ruinairas1992@gmail.com>
ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio
Even Xu <even.xu@intel.com>
HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown()
Daniel Miess <daniel.miess@amd.com>
drm/amd/display: Enable dcn314 DPP RCO
Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
drm/amd/display: Skip DPP DTO update if root clock is gated
Patrisious Haddad <phaddad@nvidia.com>
RDMA/mlx5: Return the firmware result upon destroying QP/RQ
Alvin Lee <alvin.lee2@amd.com>
drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz
Lang Yu <Lang.Yu@amd.com>
drm/amdgpu: install stub fence into potential unused fence pointers
Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
iommu/amd: Introduce Disable IRTE Caching Support
stuarthayhurst <stuart.a.hayhurst@gmail.com>
HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard
Ofir Bitton <obitton@habana.ai>
accel/habanalabs: add pci health check during heartbeat
gaoxu <gaoxu2@hihonor.com>
dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
Geert Uytterhoeven <geert+renesas@glider.be>
iopoll: Call cpu_relax() in busy loops
Uday M Bhat <uday.m.bhat@intel.com>
ASoC: Intel: sof_sdw: Add support for Rex soundwire
Bard Liao <yung-chuan.liao@linux.intel.com>
ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in _exit
Oleksij Rempel <linux@rempel-privat.de>
ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
ASoC: amd: vangogh: Add check for acp config flags in vangogh platform
Wolfram Sang <wsa+renesas@sang-engineering.com>
drm: rcar-du: remove R-Car H3 ES1.* workarounds
Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
drm/stm: ltdc: fix late dereference check
Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
ASoC: SOF: amd: Add pci revision id check
Sumit Gupta <sumitg@nvidia.com>
PCI: tegra194: Fix possible array out of bounds access
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: Intel: sof_sdw: add quirk for LNL RVP
Bard Liao <yung-chuan.liao@linux.intel.com>
ASoC: Intel: sof_sdw: add quirk for MTL RVP
Jack Xiao <Jack.Xiao@amd.com>
drm/amdgpu: fix memory leak in mes self test
hackyzh002 <hackyzh002@gmail.com>
drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
Longlong Yao <Longlong.Yao@amd.com>
drm/amdgpu: fix calltrace warning in amddrm_buddy_fini
Li Yang <leoyang.li@nxp.com>
net: phy: at803x: fix the wol setting functions
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
net: phy: at803x: Use devm_regulator_get_enable_optional()
Gerd Bayer <gbayer@linux.ibm.com>
net/smc: Fix setsockopt and sysctl to specify same buffer size again
D. Wythe <alibuda@linux.alibaba.com>
net/smc: replace mutex rmbs_lock and sndbufs_lock with rw_semaphore
Ido Schimmel <idosch@nvidia.com>
selftests: forwarding: tc_actions: Use ncat instead of nc
Davide Caratti <dcaratti@redhat.com>
selftests: forwarding: tc_actions: cleanup temporary files when test is aborted
Andrew Yang <andrew.yang@mediatek.com>
zsmalloc: fix races between modifications of fullness and isolated
Nhat Pham <nphamcs@gmail.com>
zsmalloc: consolidate zs_pool's migrate_lock and size_class's locks
Maulik Shah <quic_mkshah@quicinc.com>
cpuidle: psci: Move enabling OSI mode after power domains creation
Ulf Hansson <ulf.hansson@linaro.org>
cpuidle: psci: Extend information in log about OSI/PC mode
Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
-------------
Diffstat:
Documentation/admin-guide/hw-vuln/srso.rst | 4 +-
Documentation/admin-guide/kernel-parameters.txt | 1 +
Makefile | 4 +-
arch/arm/boot/dts/imx50-kobo-aura.dts | 2 +-
arch/arm/boot/dts/imx53-cx9020.dts | 10 +-
arch/arm/boot/dts/imx53-m53evk.dts | 4 +-
arch/arm/boot/dts/imx53-m53menlo.dts | 6 +-
arch/arm/boot/dts/imx53-tx53.dtsi | 2 +-
arch/arm/boot/dts/imx53-usbarmory.dts | 2 +-
arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi | 6 +-
arch/arm/boot/dts/imx6dl-prtrvt.dts | 4 +
arch/arm/boot/dts/imx6dl-riotboard.dts | 4 +-
arch/arm/boot/dts/imx6dl-yapp4-common.dtsi | 6 +-
arch/arm/boot/dts/imx6q-gw5400-a.dts | 6 +-
arch/arm/boot/dts/imx6q-h100.dts | 6 +-
arch/arm/boot/dts/imx6q-kp.dtsi | 4 +-
arch/arm/boot/dts/imx6q-marsboard.dts | 4 +-
arch/arm/boot/dts/imx6q-tbs2910.dts | 2 +-
arch/arm/boot/dts/imx6qdl-emcon.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-gw51xx.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 6 +-
arch/arm/boot/dts/imx6qdl-gw53xx.dtsi | 6 +-
arch/arm/boot/dts/imx6qdl-gw54xx.dtsi | 6 +-
arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-gw552x.dtsi | 6 +-
arch/arm/boot/dts/imx6qdl-gw553x.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-gw560x.dtsi | 6 +-
arch/arm/boot/dts/imx6qdl-gw5903.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-gw5904.dtsi | 6 +-
arch/arm/boot/dts/imx6qdl-gw5907.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-gw5910.dtsi | 6 +-
arch/arm/boot/dts/imx6qdl-gw5912.dtsi | 6 +-
arch/arm/boot/dts/imx6qdl-gw5913.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi | 10 +-
arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi | 8 +-
arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-prti6q.dtsi | 11 +-
arch/arm/boot/dts/imx6qdl-rex.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-sabresd.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-ts7970.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-tx6.dtsi | 2 +-
arch/arm/boot/dts/imx6sl-evk.dts | 2 +-
arch/arm/boot/dts/imx6sll-evk.dts | 2 +-
arch/arm/boot/dts/imx6sll.dtsi | 2 +-
arch/arm/boot/dts/imx6sx-sabreauto.dts | 2 +-
arch/arm/boot/dts/imx6sx-udoo-neo.dtsi | 4 +-
arch/arm/boot/dts/imx6sx.dtsi | 6 +
arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi | 2 +-
arch/arm/boot/dts/imx6ul-tx6ul.dtsi | 2 +-
arch/arm64/boot/dts/freescale/imx8mm.dtsi | 7 +-
arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +-
arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +-
.../boot/dts/rockchip/rk3399-rock-4c-plus.dts | 3 +-
arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 6 +-
arch/arm64/include/asm/fpsimd.h | 4 +-
arch/arm64/include/asm/kvm_host.h | 2 +
arch/arm64/kernel/fpsimd.c | 6 +-
arch/arm64/kernel/ptrace.c | 9 +-
arch/arm64/kernel/signal.c | 2 +-
arch/arm64/kvm/arm.c | 6 +-
arch/arm64/kvm/vgic/vgic-v3.c | 2 +-
arch/arm64/kvm/vgic/vgic-v4.c | 7 +-
arch/powerpc/kernel/rtas_flash.c | 6 +-
arch/powerpc/mm/kasan/Makefile | 1 +
arch/riscv/Kconfig | 28 +--
arch/riscv/kernel/compat_vdso/Makefile | 8 +-
arch/riscv/lib/uaccess.S | 11 +-
arch/x86/include/asm/entry-common.h | 1 +
arch/x86/include/asm/nospec-branch.h | 28 +--
arch/x86/kernel/cpu/amd.c | 1 +
arch/x86/kernel/cpu/bugs.c | 28 ++-
arch/x86/kernel/static_call.c | 13 ++
arch/x86/kernel/traps.c | 2 -
arch/x86/kernel/vmlinux.lds.S | 20 +-
arch/x86/kvm/svm/svm.c | 2 +
arch/x86/lib/retpoline.S | 141 +++++++++-----
block/blk-crypto-fallback.c | 36 ++--
drivers/bluetooth/btusb.c | 3 +
drivers/bus/ti-sysc.c | 2 +
drivers/cpuidle/cpuidle-psci-domain.c | 42 ++--
drivers/firewire/net.c | 6 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 8 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 41 +++-
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 9 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 1 -
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 211 +++++++++++++++++----
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h | 14 ++
.../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 30 +++
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.h | 3 +-
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c | 8 +
.../gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 5 +
.../drm/amd/display/dc/dcn314/dcn314_resource.c | 20 ++
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c | 22 +++
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.h | 3 +-
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 2 +-
.../gpu/drm/amd/display/dc/dcn32/dcn32_resource.h | 3 +-
.../amd/display/dc/dml/dcn32/display_mode_vba_32.c | 4 +-
.../amd/display/dc/dml/dcn32/display_mode_vba_32.h | 2 +-
drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h | 1 +
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 +-
.../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 14 +-
drivers/gpu/drm/i915/display/intel_sdvo.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_connector.c | 8 +-
drivers/gpu/drm/panel/panel-simple.c | 24 +--
drivers/gpu/drm/qxl/qxl_drv.h | 2 +-
drivers/gpu/drm/qxl/qxl_dumb.c | 5 +-
drivers/gpu/drm/qxl/qxl_gem.c | 25 ++-
drivers/gpu/drm/qxl/qxl_ioctl.c | 6 +-
drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 37 +---
drivers/gpu/drm/rcar-du/rcar_du_drv.c | 48 -----
drivers/gpu/drm/rcar-du/rcar_du_drv.h | 2 -
drivers/gpu/drm/rcar-du/rcar_du_regs.h | 3 +-
drivers/gpu/drm/stm/ltdc.c | 4 +-
drivers/hid/hid-logitech-hidpp.c | 4 +
drivers/hid/intel-ish-hid/ipc/hw-ish.h | 1 +
drivers/hid/intel-ish-hid/ipc/pci-ish.c | 1 +
drivers/i2c/busses/i2c-bcm-iproc.c | 11 +-
drivers/i2c/busses/i2c-designware-master.c | 16 +-
drivers/i2c/busses/i2c-hisi.c | 8 +
drivers/i2c/busses/i2c-tegra.c | 2 +-
drivers/infiniband/hw/mlx5/qpc.c | 10 +-
drivers/iommu/amd/amd_iommu_types.h | 4 +
drivers/iommu/amd/init.c | 36 ++++
drivers/leds/rgb/leds-qcom-lpg.c | 8 +-
drivers/media/platform/mediatek/vpu/mtk_vpu.c | 6 +-
drivers/media/platform/qcom/camss/camss-vfe.c | 6 +-
drivers/misc/habanalabs/common/device.c | 15 +-
drivers/misc/habanalabs/common/habanalabs.h | 2 +
drivers/misc/habanalabs/common/habanalabs_drv.c | 2 -
drivers/mmc/core/block.c | 7 +-
drivers/mmc/host/sdhci_f_sdh30.c | 66 +++----
drivers/mmc/host/wbsd.c | 2 -
drivers/net/dsa/mv88e6xxx/chip.c | 8 +
drivers/net/ethernet/cadence/macb_main.c | 9 +-
drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 +-
drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 10 +
drivers/net/ethernet/intel/iavf/iavf_fdir.c | 77 +++++++-
drivers/net/ethernet/intel/iavf/iavf_fdir.h | 2 +
drivers/net/ethernet/intel/ice/ice_eswitch.c | 6 +
drivers/net/ethernet/intel/ice/ice_main.c | 5 +
drivers/net/ethernet/intel/igc/igc_base.h | 11 +-
drivers/net/ethernet/intel/igc/igc_main.c | 7 +-
.../net/ethernet/marvell/octeon_ep/octep_main.c | 2 +-
drivers/net/ethernet/qlogic/qede/qede_main.c | 10 +
drivers/net/ethernet/sfc/tc.c | 2 +-
drivers/net/pcs/pcs-rzn1-miic.c | 10 +-
drivers/net/phy/at803x.c | 89 ++++-----
drivers/net/phy/broadcom.c | 13 ++
drivers/net/phy/phy_device.c | 13 +-
drivers/net/team/team.c | 4 +-
drivers/net/virtio_net.c | 26 ++-
drivers/pci/controller/dwc/pcie-tegra194.c | 13 +-
drivers/pcmcia/rsrc_nonstatic.c | 2 +
drivers/soc/aspeed/aspeed-socinfo.c | 1 +
drivers/soc/aspeed/aspeed-uart-routing.c | 2 +-
drivers/thunderbolt/nhi.c | 2 +
drivers/thunderbolt/nhi.h | 4 +
drivers/thunderbolt/quirks.c | 8 +
drivers/thunderbolt/retimer.c | 29 ++-
drivers/tty/n_gsm.c | 3 +-
drivers/tty/serial/8250/8250_port.c | 1 +
drivers/tty/serial/fsl_lpuart.c | 4 +-
drivers/tty/serial/stm32-usart.c | 5 +-
drivers/usb/chipidea/ci_hdrc_imx.c | 5 +
drivers/usb/chipidea/usbmisc_imx.c | 2 +-
drivers/usb/gadget/function/u_serial.c | 3 +
drivers/usb/gadget/function/uvc_video.c | 32 +++-
drivers/vdpa/mlx5/core/mlx5_vdpa.h | 2 +
drivers/vdpa/mlx5/core/mr.c | 105 +++++++---
drivers/vdpa/mlx5/net/mlx5_vnet.c | 4 +-
drivers/vdpa/vdpa.c | 9 +-
drivers/vdpa/vdpa_user/vduse_dev.c | 8 +-
drivers/video/aperture.c | 7 +-
drivers/video/fbdev/hyperv_fb.c | 17 +-
drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +-
drivers/virtio/virtio_mmio.c | 5 +-
drivers/watchdog/sp5100_tco.c | 4 +-
fs/btrfs/block-group.c | 14 +-
fs/btrfs/block-group.h | 18 +-
fs/btrfs/extent_map.c | 6 +-
fs/btrfs/free-space-tree.c | 10 +-
fs/btrfs/tests/free-space-tree-tests.c | 2 +-
fs/btrfs/volumes.c | 3 +-
fs/btrfs/zoned.c | 7 +-
fs/ceph/mds_client.c | 4 +
fs/gfs2/super.c | 26 +--
fs/ntfs3/frecord.c | 16 +-
fs/ntfs3/fsntfs.c | 2 +-
fs/ntfs3/index.c | 6 +
fs/ntfs3/ntfs_fs.h | 2 +
fs/ntfs3/record.c | 10 +-
fs/smb/client/cifsfs.c | 28 +--
fs/smb/client/file.c | 25 ++-
fs/smb/client/smb2pdu.c | 6 +
include/kvm/arm_vgic.h | 2 +-
include/linux/iopoll.h | 2 +
include/linux/virtio_net.h | 4 +
include/media/v4l2-mem2mem.h | 18 +-
include/net/sock.h | 6 +
kernel/dma/remap.c | 4 +-
kernel/sched/fair.c | 193 +++++++++----------
kernel/sched/sched.h | 19 --
kernel/trace/ring_buffer.c | 14 +-
kernel/trace/trace.c | 3 +-
mm/hugetlb.c | 75 +++++---
mm/zsmalloc.c | 113 +++++------
net/bluetooth/l2cap_core.c | 5 +
net/bluetooth/mgmt.c | 2 +-
net/core/sock.c | 2 +-
net/ipv4/ip_vti.c | 4 +-
net/ipv4/tcp_timer.c | 4 +-
net/ipv6/ip6_vti.c | 4 +-
net/key/af_key.c | 4 +-
net/netfilter/ipvs/ip_vs_ctl.c | 4 +
net/netfilter/nf_conntrack_proto_sctp.c | 6 +-
net/netfilter/nf_tables_api.c | 1 +
net/netfilter/nft_dynset.c | 3 +
net/netfilter/nft_set_pipapo.c | 13 +-
net/openvswitch/datapath.c | 8 +-
net/smc/af_smc.c | 4 +-
net/smc/smc.h | 2 +-
net/smc/smc_clc.c | 4 +-
net/smc/smc_core.c | 80 ++++----
net/smc/smc_core.h | 4 +-
net/smc/smc_llc.c | 16 +-
net/smc/smc_sysctl.c | 10 +-
net/unix/af_unix.c | 9 +-
net/xfrm/xfrm_compat.c | 2 +-
net/xfrm/xfrm_interface_core.c | 4 +-
net/xfrm/xfrm_user.c | 14 +-
sound/hda/hdac_regmap.c | 7 +-
sound/pci/hda/patch_realtek.c | 91 ++++++++-
sound/soc/amd/Kconfig | 1 +
sound/soc/amd/vangogh/acp5x.h | 2 +
sound/soc/amd/vangogh/pci-acp5x.c | 7 +-
sound/soc/codecs/rt5665.c | 2 +
sound/soc/intel/boards/sof_sdw.c | 25 +++
sound/soc/intel/boards/sof_sdw_rt711_sdca.c | 3 +
sound/soc/meson/axg-tdm-formatter.c | 42 ++--
sound/soc/sof/amd/acp.h | 3 +
sound/soc/sof/amd/pci-rmb.c | 3 +
sound/soc/sof/amd/pci-rn.c | 3 +
sound/soc/sof/core.c | 4 +-
sound/soc/sof/intel/hda.c | 12 +-
sound/usb/quirks-table.h | 29 +++
tools/objtool/arch/x86/decode.c | 2 +-
tools/objtool/check.c | 21 +-
.../selftests/net/forwarding/mirror_gre_changes.sh | 3 +-
.../testing/selftests/net/forwarding/tc_actions.sh | 18 +-
255 files changed, 2074 insertions(+), 1100 deletions(-)
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 001/194] mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 002/194] cpuidle: psci: Extend information in log about OSI/PC mode Greg Kroah-Hartman
` (203 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kunihiko Hayashi, Adrian Hunter,
Ulf Hansson, Sasha Levin
From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
[ Upstream commit 5def5c1c15bf22934ee227af85c1716762f3829f ]
Even if sdhci_pltfm_pmops is specified for PM, this driver doesn't apply
sdhci_pltfm, so the structure is not correctly referenced in PM functions.
This applies sdhci_pltfm to this driver to fix this issue.
- Call sdhci_pltfm_init() instead of sdhci_alloc_host() and
other functions that covered by sdhci_pltfm.
- Move ops and quirks to sdhci_pltfm_data
- Replace sdhci_priv() with own private function sdhci_f_sdh30_priv().
Fixes: 87a507459f49 ("mmc: sdhci: host: add new f_sdh30")
Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230630004533.26644-1-hayashi.kunihiko@socionext.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/sdhci_f_sdh30.c | 60 ++++++++++++++------------------
1 file changed, 27 insertions(+), 33 deletions(-)
diff --git a/drivers/mmc/host/sdhci_f_sdh30.c b/drivers/mmc/host/sdhci_f_sdh30.c
index 6c4f43e112826..8876fd1c7eee0 100644
--- a/drivers/mmc/host/sdhci_f_sdh30.c
+++ b/drivers/mmc/host/sdhci_f_sdh30.c
@@ -26,9 +26,16 @@ struct f_sdhost_priv {
bool enable_cmd_dat_delay;
};
+static void *sdhci_f_sdhost_priv(struct sdhci_host *host)
+{
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+
+ return sdhci_pltfm_priv(pltfm_host);
+}
+
static void sdhci_f_sdh30_soft_voltage_switch(struct sdhci_host *host)
{
- struct f_sdhost_priv *priv = sdhci_priv(host);
+ struct f_sdhost_priv *priv = sdhci_f_sdhost_priv(host);
u32 ctrl = 0;
usleep_range(2500, 3000);
@@ -61,7 +68,7 @@ static unsigned int sdhci_f_sdh30_get_min_clock(struct sdhci_host *host)
static void sdhci_f_sdh30_reset(struct sdhci_host *host, u8 mask)
{
- struct f_sdhost_priv *priv = sdhci_priv(host);
+ struct f_sdhost_priv *priv = sdhci_f_sdhost_priv(host);
u32 ctl;
if (sdhci_readw(host, SDHCI_CLOCK_CONTROL) == 0)
@@ -85,30 +92,32 @@ static const struct sdhci_ops sdhci_f_sdh30_ops = {
.set_uhs_signaling = sdhci_set_uhs_signaling,
};
+static const struct sdhci_pltfm_data sdhci_f_sdh30_pltfm_data = {
+ .ops = &sdhci_f_sdh30_ops,
+ .quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC
+ | SDHCI_QUIRK_INVERTED_WRITE_PROTECT,
+ .quirks2 = SDHCI_QUIRK2_SUPPORT_SINGLE
+ | SDHCI_QUIRK2_TUNING_WORK_AROUND,
+};
+
static int sdhci_f_sdh30_probe(struct platform_device *pdev)
{
struct sdhci_host *host;
struct device *dev = &pdev->dev;
- int irq, ctrl = 0, ret = 0;
+ int ctrl = 0, ret = 0;
struct f_sdhost_priv *priv;
+ struct sdhci_pltfm_host *pltfm_host;
u32 reg = 0;
- irq = platform_get_irq(pdev, 0);
- if (irq < 0)
- return irq;
-
- host = sdhci_alloc_host(dev, sizeof(struct f_sdhost_priv));
+ host = sdhci_pltfm_init(pdev, &sdhci_f_sdh30_pltfm_data,
+ sizeof(struct f_sdhost_priv));
if (IS_ERR(host))
return PTR_ERR(host);
- priv = sdhci_priv(host);
+ pltfm_host = sdhci_priv(host);
+ priv = sdhci_pltfm_priv(pltfm_host);
priv->dev = dev;
- host->quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC |
- SDHCI_QUIRK_INVERTED_WRITE_PROTECT;
- host->quirks2 = SDHCI_QUIRK2_SUPPORT_SINGLE |
- SDHCI_QUIRK2_TUNING_WORK_AROUND;
-
priv->enable_cmd_dat_delay = device_property_read_bool(dev,
"fujitsu,cmd-dat-delay-select");
@@ -116,18 +125,6 @@ static int sdhci_f_sdh30_probe(struct platform_device *pdev)
if (ret)
goto err;
- platform_set_drvdata(pdev, host);
-
- host->hw_name = "f_sdh30";
- host->ops = &sdhci_f_sdh30_ops;
- host->irq = irq;
-
- host->ioaddr = devm_platform_ioremap_resource(pdev, 0);
- if (IS_ERR(host->ioaddr)) {
- ret = PTR_ERR(host->ioaddr);
- goto err;
- }
-
if (dev_of_node(dev)) {
sdhci_get_of_property(pdev);
@@ -182,23 +179,20 @@ static int sdhci_f_sdh30_probe(struct platform_device *pdev)
err_clk:
clk_disable_unprepare(priv->clk_iface);
err:
- sdhci_free_host(host);
+ sdhci_pltfm_free(pdev);
+
return ret;
}
static int sdhci_f_sdh30_remove(struct platform_device *pdev)
{
struct sdhci_host *host = platform_get_drvdata(pdev);
- struct f_sdhost_priv *priv = sdhci_priv(host);
-
- sdhci_remove_host(host, readl(host->ioaddr + SDHCI_INT_STATUS) ==
- 0xffffffff);
+ struct f_sdhost_priv *priv = sdhci_f_sdhost_priv(host);
clk_disable_unprepare(priv->clk_iface);
clk_disable_unprepare(priv->clk);
- sdhci_free_host(host);
- platform_set_drvdata(pdev, NULL);
+ sdhci_pltfm_unregister(pdev);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 002/194] cpuidle: psci: Extend information in log about OSI/PC mode
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 001/194] mmc: sdhci-f-sdh30: Replace with sdhci_pltfm Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 003/194] cpuidle: psci: Move enabling OSI mode after power domains creation Greg Kroah-Hartman
` (202 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ulf Hansson, Dmitry Baryshkov,
Rafael J. Wysocki, Sasha Levin
From: Ulf Hansson <ulf.hansson@linaro.org>
[ Upstream commit 668057b07db069daac3ca4e4978f8373db9cb71c ]
It's useful to understand whether we are using OS-initiated (OSI) mode or
Platform Coordinated (PC) mode, when initializing the CPU PM domains.
Therefore, let's extend the print in the log after a successful probe with
this information.
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Sudeep Holla <sudeep.holla@arm.com
Acked-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 12acb348fa45 ("cpuidle: psci: Move enabling OSI mode after power domains creation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpuidle/cpuidle-psci-domain.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/cpuidle/cpuidle-psci-domain.c b/drivers/cpuidle/cpuidle-psci-domain.c
index fe06644725203..1fca250d5dece 100644
--- a/drivers/cpuidle/cpuidle-psci-domain.c
+++ b/drivers/cpuidle/cpuidle-psci-domain.c
@@ -182,7 +182,8 @@ static int psci_cpuidle_domain_probe(struct platform_device *pdev)
if (ret)
goto remove_pd;
- pr_info("Initialized CPU PM domain topology\n");
+ pr_info("Initialized CPU PM domain topology using %s mode\n",
+ use_osi ? "OSI" : "PC");
return 0;
put_node:
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 003/194] cpuidle: psci: Move enabling OSI mode after power domains creation
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 001/194] mmc: sdhci-f-sdh30: Replace with sdhci_pltfm Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 002/194] cpuidle: psci: Extend information in log about OSI/PC mode Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 004/194] zsmalloc: consolidate zs_pools migrate_lock and size_classs locks Greg Kroah-Hartman
` (201 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maulik Shah, Ulf Hansson,
Sasha Levin
From: Maulik Shah <quic_mkshah@quicinc.com>
[ Upstream commit 12acb348fa4528a4203edf1cce7a3be2c9af2279 ]
A switch from OSI to PC mode is only possible if all CPUs other than the
calling one are OFF, either through a call to CPU_OFF or not yet booted.
Currently OSI mode is enabled before power domains are created. In cases
where CPUidle states are not using hierarchical CPU topology the bail out
path tries to switch back to PC mode which gets denied by firmware since
other CPUs are online at this point and creates inconsistent state as
firmware is in OSI mode and Linux in PC mode.
This change moves enabling OSI mode after power domains are created,
this would makes sure that hierarchical CPU topology is used before
switching firmware to OSI mode.
Cc: stable@vger.kernel.org
Fixes: 70c179b49870 ("cpuidle: psci: Allow PM domain to be initialized even if no OSI mode")
Signed-off-by: Maulik Shah <quic_mkshah@quicinc.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpuidle/cpuidle-psci-domain.c | 39 +++++++++------------------
1 file changed, 13 insertions(+), 26 deletions(-)
diff --git a/drivers/cpuidle/cpuidle-psci-domain.c b/drivers/cpuidle/cpuidle-psci-domain.c
index 1fca250d5dece..f5d4359555d77 100644
--- a/drivers/cpuidle/cpuidle-psci-domain.c
+++ b/drivers/cpuidle/cpuidle-psci-domain.c
@@ -117,20 +117,6 @@ static void psci_pd_remove(void)
}
}
-static bool psci_pd_try_set_osi_mode(void)
-{
- int ret;
-
- if (!psci_has_osi_support())
- return false;
-
- ret = psci_set_osi_mode(true);
- if (ret)
- return false;
-
- return true;
-}
-
static void psci_cpuidle_domain_sync_state(struct device *dev)
{
/*
@@ -149,15 +135,12 @@ static int psci_cpuidle_domain_probe(struct platform_device *pdev)
{
struct device_node *np = pdev->dev.of_node;
struct device_node *node;
- bool use_osi;
+ bool use_osi = psci_has_osi_support();
int ret = 0, pd_count = 0;
if (!np)
return -ENODEV;
- /* If OSI mode is supported, let's try to enable it. */
- use_osi = psci_pd_try_set_osi_mode();
-
/*
* Parse child nodes for the "#power-domain-cells" property and
* initialize a genpd/genpd-of-provider pair when it's found.
@@ -167,33 +150,37 @@ static int psci_cpuidle_domain_probe(struct platform_device *pdev)
continue;
ret = psci_pd_init(node, use_osi);
- if (ret)
- goto put_node;
+ if (ret) {
+ of_node_put(node);
+ goto exit;
+ }
pd_count++;
}
/* Bail out if not using the hierarchical CPU topology. */
if (!pd_count)
- goto no_pd;
+ return 0;
/* Link genpd masters/subdomains to model the CPU topology. */
ret = dt_idle_pd_init_topology(np);
if (ret)
goto remove_pd;
+ /* let's try to enable OSI. */
+ ret = psci_set_osi_mode(use_osi);
+ if (ret)
+ goto remove_pd;
+
pr_info("Initialized CPU PM domain topology using %s mode\n",
use_osi ? "OSI" : "PC");
return 0;
-put_node:
- of_node_put(node);
remove_pd:
+ dt_idle_pd_remove_topology(np);
psci_pd_remove();
+exit:
pr_err("failed to create CPU PM domains ret=%d\n", ret);
-no_pd:
- if (use_osi)
- psci_set_osi_mode(false);
return ret;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 004/194] zsmalloc: consolidate zs_pools migrate_lock and size_classs locks
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 003/194] cpuidle: psci: Move enabling OSI mode after power domains creation Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 005/194] zsmalloc: fix races between modifications of fullness and isolated Greg Kroah-Hartman
` (200 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nhat Pham, Johannes Weiner,
Minchan Kim, Sergey Senozhatsky, Dan Streetman, Nitin Gupta,
Seth Jennings, Vitaly Wool, Andrew Morton, Sasha Levin
From: Nhat Pham <nphamcs@gmail.com>
[ Upstream commit c0547d0b6a4b637db05406b90ba82e1b2e71de56 ]
Currently, zsmalloc has a hierarchy of locks, which includes a pool-level
migrate_lock, and a lock for each size class. We have to obtain both
locks in the hotpath in most cases anyway, except for zs_malloc. This
exception will no longer exist when we introduce a LRU into the zs_pool
for the new writeback functionality - we will need to obtain a pool-level
lock to synchronize LRU handling even in zs_malloc.
In preparation for zsmalloc writeback, consolidate these locks into a
single pool-level lock, which drastically reduces the complexity of
synchronization in zsmalloc.
We have also benchmarked the lock consolidation to see the performance
effect of this change on zram.
First, we ran a synthetic FS workload on a server machine with 36 cores
(same machine for all runs), using
fs_mark -d ../zram1mnt -s 100000 -n 2500 -t 32 -k
before and after for btrfs and ext4 on zram (FS usage is 80%).
Here is the result (unit is file/second):
With lock consolidation (btrfs):
Average: 13520.2, Median: 13531.0, Stddev: 137.5961482019028
Without lock consolidation (btrfs):
Average: 13487.2, Median: 13575.0, Stddev: 309.08283679298665
With lock consolidation (ext4):
Average: 16824.4, Median: 16839.0, Stddev: 89.97388510006668
Without lock consolidation (ext4)
Average: 16958.0, Median: 16986.0, Stddev: 194.7370021336469
As you can see, we observe a 0.3% regression for btrfs, and a 0.9%
regression for ext4. This is a small, barely measurable difference in my
opinion.
For a more realistic scenario, we also tries building the kernel on zram.
Here is the time it takes (in seconds):
With lock consolidation (btrfs):
real
Average: 319.6, Median: 320.0, Stddev: 0.8944271909999159
user
Average: 6894.2, Median: 6895.0, Stddev: 25.528415540334656
sys
Average: 521.4, Median: 522.0, Stddev: 1.51657508881031
Without lock consolidation (btrfs):
real
Average: 319.8, Median: 320.0, Stddev: 0.8366600265340756
user
Average: 6896.6, Median: 6899.0, Stddev: 16.04057355583023
sys
Average: 520.6, Median: 521.0, Stddev: 1.140175425099138
With lock consolidation (ext4):
real
Average: 320.0, Median: 319.0, Stddev: 1.4142135623730951
user
Average: 6896.8, Median: 6878.0, Stddev: 28.621670111997307
sys
Average: 521.2, Median: 521.0, Stddev: 1.7888543819998317
Without lock consolidation (ext4)
real
Average: 319.6, Median: 319.0, Stddev: 0.8944271909999159
user
Average: 6886.2, Median: 6887.0, Stddev: 16.93221781102523
sys
Average: 520.4, Median: 520.0, Stddev: 1.140175425099138
The difference is entirely within the noise of a typical run on zram.
This hardly justifies the complexity of maintaining both the pool lock and
the class lock. In fact, for writeback, we would need to introduce yet
another lock to prevent data races on the pool's LRU, further complicating
the lock handling logic. IMHO, it is just better to collapse all of these
into a single pool-level lock.
Link: https://lkml.kernel.org/r/20221128191616.1261026-4-nphamcs@gmail.com
Signed-off-by: Nhat Pham <nphamcs@gmail.com>
Suggested-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Minchan Kim <minchan@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Dan Streetman <ddstreet@ieee.org>
Cc: Nitin Gupta <ngupta@vflare.org>
Cc: Seth Jennings <sjenning@redhat.com>
Cc: Vitaly Wool <vitaly.wool@konsulko.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 4b5d1e47b694 ("zsmalloc: fix races between modifications of fullness and isolated")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/zsmalloc.c | 87 ++++++++++++++++++++++-----------------------------
1 file changed, 37 insertions(+), 50 deletions(-)
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index d03941cace2c4..326faa751f0a4 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -33,8 +33,7 @@
/*
* lock ordering:
* page_lock
- * pool->migrate_lock
- * class->lock
+ * pool->lock
* zspage->lock
*/
@@ -192,7 +191,6 @@ static const int fullness_threshold_frac = 4;
static size_t huge_class_size;
struct size_class {
- spinlock_t lock;
struct list_head fullness_list[NR_ZS_FULLNESS];
/*
* Size of objects stored in this class. Must be multiple
@@ -247,8 +245,7 @@ struct zs_pool {
#ifdef CONFIG_COMPACTION
struct work_struct free_work;
#endif
- /* protect page/zspage migration */
- rwlock_t migrate_lock;
+ spinlock_t lock;
};
struct zspage {
@@ -355,7 +352,7 @@ static void cache_free_zspage(struct zs_pool *pool, struct zspage *zspage)
kmem_cache_free(pool->zspage_cachep, zspage);
}
-/* class->lock(which owns the handle) synchronizes races */
+/* pool->lock(which owns the handle) synchronizes races */
static void record_obj(unsigned long handle, unsigned long obj)
{
*(unsigned long *)handle = obj;
@@ -452,7 +449,7 @@ static __maybe_unused int is_first_page(struct page *page)
return PagePrivate(page);
}
-/* Protected by class->lock */
+/* Protected by pool->lock */
static inline int get_zspage_inuse(struct zspage *zspage)
{
return zspage->inuse;
@@ -597,13 +594,13 @@ static int zs_stats_size_show(struct seq_file *s, void *v)
if (class->index != i)
continue;
- spin_lock(&class->lock);
+ spin_lock(&pool->lock);
class_almost_full = zs_stat_get(class, CLASS_ALMOST_FULL);
class_almost_empty = zs_stat_get(class, CLASS_ALMOST_EMPTY);
obj_allocated = zs_stat_get(class, OBJ_ALLOCATED);
obj_used = zs_stat_get(class, OBJ_USED);
freeable = zs_can_compact(class);
- spin_unlock(&class->lock);
+ spin_unlock(&pool->lock);
objs_per_zspage = class->objs_per_zspage;
pages_used = obj_allocated / objs_per_zspage *
@@ -916,7 +913,7 @@ static void __free_zspage(struct zs_pool *pool, struct size_class *class,
get_zspage_mapping(zspage, &class_idx, &fg);
- assert_spin_locked(&class->lock);
+ assert_spin_locked(&pool->lock);
VM_BUG_ON(get_zspage_inuse(zspage));
VM_BUG_ON(fg != ZS_EMPTY);
@@ -1247,19 +1244,19 @@ void *zs_map_object(struct zs_pool *pool, unsigned long handle,
BUG_ON(in_interrupt());
/* It guarantees it can get zspage from handle safely */
- read_lock(&pool->migrate_lock);
+ spin_lock(&pool->lock);
obj = handle_to_obj(handle);
obj_to_location(obj, &page, &obj_idx);
zspage = get_zspage(page);
/*
- * migration cannot move any zpages in this zspage. Here, class->lock
+ * migration cannot move any zpages in this zspage. Here, pool->lock
* is too heavy since callers would take some time until they calls
* zs_unmap_object API so delegate the locking from class to zspage
* which is smaller granularity.
*/
migrate_read_lock(zspage);
- read_unlock(&pool->migrate_lock);
+ spin_unlock(&pool->lock);
class = zspage_class(pool, zspage);
off = (class->size * obj_idx) & ~PAGE_MASK;
@@ -1412,8 +1409,8 @@ unsigned long zs_malloc(struct zs_pool *pool, size_t size, gfp_t gfp)
size += ZS_HANDLE_SIZE;
class = pool->size_class[get_size_class_index(size)];
- /* class->lock effectively protects the zpage migration */
- spin_lock(&class->lock);
+ /* pool->lock effectively protects the zpage migration */
+ spin_lock(&pool->lock);
zspage = find_get_zspage(class);
if (likely(zspage)) {
obj = obj_malloc(pool, zspage, handle);
@@ -1421,12 +1418,12 @@ unsigned long zs_malloc(struct zs_pool *pool, size_t size, gfp_t gfp)
fix_fullness_group(class, zspage);
record_obj(handle, obj);
class_stat_inc(class, OBJ_USED, 1);
- spin_unlock(&class->lock);
+ spin_unlock(&pool->lock);
return handle;
}
- spin_unlock(&class->lock);
+ spin_unlock(&pool->lock);
zspage = alloc_zspage(pool, class, gfp);
if (!zspage) {
@@ -1434,7 +1431,7 @@ unsigned long zs_malloc(struct zs_pool *pool, size_t size, gfp_t gfp)
return (unsigned long)ERR_PTR(-ENOMEM);
}
- spin_lock(&class->lock);
+ spin_lock(&pool->lock);
obj = obj_malloc(pool, zspage, handle);
newfg = get_fullness_group(class, zspage);
insert_zspage(class, zspage, newfg);
@@ -1447,7 +1444,7 @@ unsigned long zs_malloc(struct zs_pool *pool, size_t size, gfp_t gfp)
/* We completely set up zspage so mark them as movable */
SetZsPageMovable(pool, zspage);
- spin_unlock(&class->lock);
+ spin_unlock(&pool->lock);
return handle;
}
@@ -1491,16 +1488,14 @@ void zs_free(struct zs_pool *pool, unsigned long handle)
return;
/*
- * The pool->migrate_lock protects the race with zpage's migration
+ * The pool->lock protects the race with zpage's migration
* so it's safe to get the page from handle.
*/
- read_lock(&pool->migrate_lock);
+ spin_lock(&pool->lock);
obj = handle_to_obj(handle);
obj_to_page(obj, &f_page);
zspage = get_zspage(f_page);
class = zspage_class(pool, zspage);
- spin_lock(&class->lock);
- read_unlock(&pool->migrate_lock);
obj_free(class->size, obj);
class_stat_dec(class, OBJ_USED, 1);
@@ -1510,7 +1505,7 @@ void zs_free(struct zs_pool *pool, unsigned long handle)
free_zspage(pool, class, zspage);
out:
- spin_unlock(&class->lock);
+ spin_unlock(&pool->lock);
cache_free_handle(pool, handle);
}
EXPORT_SYMBOL_GPL(zs_free);
@@ -1867,16 +1862,12 @@ static int zs_page_migrate(struct page *newpage, struct page *page,
pool = zspage->pool;
/*
- * The pool migrate_lock protects the race between zpage migration
+ * The pool's lock protects the race between zpage migration
* and zs_free.
*/
- write_lock(&pool->migrate_lock);
+ spin_lock(&pool->lock);
class = zspage_class(pool, zspage);
- /*
- * the class lock protects zpage alloc/free in the zspage.
- */
- spin_lock(&class->lock);
/* the migrate_write_lock protects zpage access via zs_map_object */
migrate_write_lock(zspage);
@@ -1906,10 +1897,9 @@ static int zs_page_migrate(struct page *newpage, struct page *page,
replace_sub_page(class, zspage, newpage, page);
/*
* Since we complete the data copy and set up new zspage structure,
- * it's okay to release migration_lock.
+ * it's okay to release the pool's lock.
*/
- write_unlock(&pool->migrate_lock);
- spin_unlock(&class->lock);
+ spin_unlock(&pool->lock);
dec_zspage_isolation(zspage);
migrate_write_unlock(zspage);
@@ -1964,9 +1954,9 @@ static void async_free_zspage(struct work_struct *work)
if (class->index != i)
continue;
- spin_lock(&class->lock);
+ spin_lock(&pool->lock);
list_splice_init(&class->fullness_list[ZS_EMPTY], &free_pages);
- spin_unlock(&class->lock);
+ spin_unlock(&pool->lock);
}
list_for_each_entry_safe(zspage, tmp, &free_pages, list) {
@@ -1976,9 +1966,9 @@ static void async_free_zspage(struct work_struct *work)
get_zspage_mapping(zspage, &class_idx, &fullness);
VM_BUG_ON(fullness != ZS_EMPTY);
class = pool->size_class[class_idx];
- spin_lock(&class->lock);
+ spin_lock(&pool->lock);
__free_zspage(pool, class, zspage);
- spin_unlock(&class->lock);
+ spin_unlock(&pool->lock);
}
};
@@ -2039,10 +2029,11 @@ static unsigned long __zs_compact(struct zs_pool *pool,
struct zspage *dst_zspage = NULL;
unsigned long pages_freed = 0;
- /* protect the race between zpage migration and zs_free */
- write_lock(&pool->migrate_lock);
- /* protect zpage allocation/free */
- spin_lock(&class->lock);
+ /*
+ * protect the race between zpage migration and zs_free
+ * as well as zpage allocation/free
+ */
+ spin_lock(&pool->lock);
while ((src_zspage = isolate_zspage(class, true))) {
/* protect someone accessing the zspage(i.e., zs_map_object) */
migrate_write_lock(src_zspage);
@@ -2067,7 +2058,7 @@ static unsigned long __zs_compact(struct zs_pool *pool,
putback_zspage(class, dst_zspage);
migrate_write_unlock(dst_zspage);
dst_zspage = NULL;
- if (rwlock_is_contended(&pool->migrate_lock))
+ if (spin_is_contended(&pool->lock))
break;
}
@@ -2084,11 +2075,9 @@ static unsigned long __zs_compact(struct zs_pool *pool,
pages_freed += class->pages_per_zspage;
} else
migrate_write_unlock(src_zspage);
- spin_unlock(&class->lock);
- write_unlock(&pool->migrate_lock);
+ spin_unlock(&pool->lock);
cond_resched();
- write_lock(&pool->migrate_lock);
- spin_lock(&class->lock);
+ spin_lock(&pool->lock);
}
if (src_zspage) {
@@ -2096,8 +2085,7 @@ static unsigned long __zs_compact(struct zs_pool *pool,
migrate_write_unlock(src_zspage);
}
- spin_unlock(&class->lock);
- write_unlock(&pool->migrate_lock);
+ spin_unlock(&pool->lock);
return pages_freed;
}
@@ -2200,7 +2188,7 @@ struct zs_pool *zs_create_pool(const char *name)
return NULL;
init_deferred_free(pool);
- rwlock_init(&pool->migrate_lock);
+ spin_lock_init(&pool->lock);
pool->name = kstrdup(name, GFP_KERNEL);
if (!pool->name)
@@ -2271,7 +2259,6 @@ struct zs_pool *zs_create_pool(const char *name)
class->index = i;
class->pages_per_zspage = pages_per_zspage;
class->objs_per_zspage = objs_per_zspage;
- spin_lock_init(&class->lock);
pool->size_class[i] = class;
for (fullness = ZS_EMPTY; fullness < NR_ZS_FULLNESS;
fullness++)
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 005/194] zsmalloc: fix races between modifications of fullness and isolated
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 004/194] zsmalloc: consolidate zs_pools migrate_lock and size_classs locks Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 006/194] selftests: forwarding: tc_actions: cleanup temporary files when test is aborted Greg Kroah-Hartman
` (199 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Yang, Sergey Senozhatsky,
AngeloGioacchino Del Regno, Matthias Brugger, Minchan Kim,
Sebastian Andrzej Siewior, Andrew Morton, Sasha Levin
From: Andrew Yang <andrew.yang@mediatek.com>
[ Upstream commit 4b5d1e47b69426c0f7491d97d73ad0152d02d437 ]
We encountered many kernel exceptions of VM_BUG_ON(zspage->isolated ==
0) in dec_zspage_isolation() and BUG_ON(!pages[1]) in zs_unmap_object()
lately. This issue only occurs when migration and reclamation occur at
the same time.
With our memory stress test, we can reproduce this issue several times
a day. We have no idea why no one else encountered this issue. BTW,
we switched to the new kernel version with this defect a few months
ago.
Since fullness and isolated share the same unsigned int, modifications of
them should be protected by the same lock.
[andrew.yang@mediatek.com: move comment]
Link: https://lkml.kernel.org/r/20230727062910.6337-1-andrew.yang@mediatek.com
Link: https://lkml.kernel.org/r/20230721063705.11455-1-andrew.yang@mediatek.com
Fixes: c4549b871102 ("zsmalloc: remove zspage isolation for migration")
Signed-off-by: Andrew Yang <andrew.yang@mediatek.com>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Cc: Matthias Brugger <matthias.bgg@gmail.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/zsmalloc.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 326faa751f0a4..2f5e6d35b03bd 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -1816,6 +1816,7 @@ static void replace_sub_page(struct size_class *class, struct zspage *zspage,
static bool zs_page_isolate(struct page *page, isolate_mode_t mode)
{
+ struct zs_pool *pool;
struct zspage *zspage;
/*
@@ -1826,9 +1827,10 @@ static bool zs_page_isolate(struct page *page, isolate_mode_t mode)
VM_BUG_ON_PAGE(PageIsolated(page), page);
zspage = get_zspage(page);
- migrate_write_lock(zspage);
+ pool = zspage->pool;
+ spin_lock(&pool->lock);
inc_zspage_isolation(zspage);
- migrate_write_unlock(zspage);
+ spin_unlock(&pool->lock);
return true;
}
@@ -1895,12 +1897,12 @@ static int zs_page_migrate(struct page *newpage, struct page *page,
kunmap_atomic(s_addr);
replace_sub_page(class, zspage, newpage, page);
+ dec_zspage_isolation(zspage);
/*
* Since we complete the data copy and set up new zspage structure,
* it's okay to release the pool's lock.
*/
spin_unlock(&pool->lock);
- dec_zspage_isolation(zspage);
migrate_write_unlock(zspage);
get_page(newpage);
@@ -1917,15 +1919,17 @@ static int zs_page_migrate(struct page *newpage, struct page *page,
static void zs_page_putback(struct page *page)
{
+ struct zs_pool *pool;
struct zspage *zspage;
VM_BUG_ON_PAGE(!PageMovable(page), page);
VM_BUG_ON_PAGE(!PageIsolated(page), page);
zspage = get_zspage(page);
- migrate_write_lock(zspage);
+ pool = zspage->pool;
+ spin_lock(&pool->lock);
dec_zspage_isolation(zspage);
- migrate_write_unlock(zspage);
+ spin_unlock(&pool->lock);
}
static const struct movable_operations zsmalloc_mops = {
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 006/194] selftests: forwarding: tc_actions: cleanup temporary files when test is aborted
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 005/194] zsmalloc: fix races between modifications of fullness and isolated Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 007/194] selftests: forwarding: tc_actions: Use ncat instead of nc Greg Kroah-Hartman
` (198 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Davide Caratti,
Jakub Kicinski, Sasha Levin
From: Davide Caratti <dcaratti@redhat.com>
[ Upstream commit f58531716ced8975a4ade108ef4af35f98722af7 ]
remove temporary files created by 'mirred_egress_to_ingress_tcp' test
in the cleanup() handler. Also, change variable names to avoid clashing
with globals from lib.sh.
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Link: https://lore.kernel.org/r/091649045a017fc00095ecbb75884e5681f7025f.1676368027.git.dcaratti@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 5e8670610b93 ("selftests: forwarding: tc_actions: Use ncat instead of nc")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/net/forwarding/tc_actions.sh | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh
index 919c0dd9fe4bc..a96cff8e72197 100755
--- a/tools/testing/selftests/net/forwarding/tc_actions.sh
+++ b/tools/testing/selftests/net/forwarding/tc_actions.sh
@@ -201,10 +201,10 @@ mirred_egress_to_ingress_test()
mirred_egress_to_ingress_tcp_test()
{
- local tmpfile=$(mktemp) tmpfile1=$(mktemp)
+ mirred_e2i_tf1=$(mktemp) mirred_e2i_tf2=$(mktemp)
RET=0
- dd conv=sparse status=none if=/dev/zero bs=1M count=2 of=$tmpfile
+ dd conv=sparse status=none if=/dev/zero bs=1M count=2 of=$mirred_e2i_tf1
tc filter add dev $h1 protocol ip pref 100 handle 100 egress flower \
$tcflags ip_proto tcp src_ip 192.0.2.1 dst_ip 192.0.2.2 \
action ct commit nat src addr 192.0.2.2 pipe \
@@ -220,11 +220,11 @@ mirred_egress_to_ingress_tcp_test()
ip_proto icmp \
action drop
- ip vrf exec v$h1 nc --recv-only -w10 -l -p 12345 -o $tmpfile1 &
+ ip vrf exec v$h1 nc --recv-only -w10 -l -p 12345 -o $mirred_e2i_tf2 &
local rpid=$!
- ip vrf exec v$h1 nc -w1 --send-only 192.0.2.2 12345 <$tmpfile
+ ip vrf exec v$h1 nc -w1 --send-only 192.0.2.2 12345 <$mirred_e2i_tf1
wait -n $rpid
- cmp -s $tmpfile $tmpfile1
+ cmp -s $mirred_e2i_tf1 $mirred_e2i_tf2
check_err $? "server output check failed"
$MZ $h1 -c 10 -p 64 -a $h1mac -b $h1mac -A 192.0.2.1 -B 192.0.2.1 \
@@ -241,7 +241,7 @@ mirred_egress_to_ingress_tcp_test()
tc filter del dev $h1 egress protocol ip pref 101 handle 101 flower
tc filter del dev $h1 ingress protocol ip pref 102 handle 102 flower
- rm -f $tmpfile $tmpfile1
+ rm -f $mirred_e2i_tf1 $mirred_e2i_tf2
log_test "mirred_egress_to_ingress_tcp ($tcflags)"
}
@@ -270,6 +270,8 @@ setup_prepare()
cleanup()
{
+ local tf
+
pre_cleanup
switch_destroy
@@ -280,6 +282,8 @@ cleanup()
ip link set $swp2 address $swp2origmac
ip link set $swp1 address $swp1origmac
+
+ for tf in $mirred_e2i_tf1 $mirred_e2i_tf2; do rm -f $tf; done
}
mirred_egress_redirect_test()
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 007/194] selftests: forwarding: tc_actions: Use ncat instead of nc
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 006/194] selftests: forwarding: tc_actions: cleanup temporary files when test is aborted Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 008/194] net/smc: replace mutex rmbs_lock and sndbufs_lock with rw_semaphore Greg Kroah-Hartman
` (197 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mirsad Todorovac, Ido Schimmel,
Petr Machata, Hangbin Liu, Nikolay Aleksandrov, Jakub Kicinski,
Sasha Levin
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 5e8670610b93158ffacc3241f835454ff26a3469 ]
The test relies on 'nc' being the netcat version from the nmap project.
While this seems to be the case on Fedora, it is not the case on Ubuntu,
resulting in failures such as [1].
Fix by explicitly using the 'ncat' utility from the nmap project and the
skip the test in case it is not installed.
[1]
# timeout set to 0
# selftests: net/forwarding: tc_actions.sh
# TEST: gact drop and ok (skip_hw) [ OK ]
# TEST: mirred egress flower redirect (skip_hw) [ OK ]
# TEST: mirred egress flower mirror (skip_hw) [ OK ]
# TEST: mirred egress matchall mirror (skip_hw) [ OK ]
# TEST: mirred_egress_to_ingress (skip_hw) [ OK ]
# nc: invalid option -- '-'
# usage: nc [-46CDdFhklNnrStUuvZz] [-I length] [-i interval] [-M ttl]
# [-m minttl] [-O length] [-P proxy_username] [-p source_port]
# [-q seconds] [-s sourceaddr] [-T keyword] [-V rtable] [-W recvlimit]
# [-w timeout] [-X proxy_protocol] [-x proxy_address[:port]]
# [destination] [port]
# nc: invalid option -- '-'
# usage: nc [-46CDdFhklNnrStUuvZz] [-I length] [-i interval] [-M ttl]
# [-m minttl] [-O length] [-P proxy_username] [-p source_port]
# [-q seconds] [-s sourceaddr] [-T keyword] [-V rtable] [-W recvlimit]
# [-w timeout] [-X proxy_protocol] [-x proxy_address[:port]]
# [destination] [port]
# TEST: mirred_egress_to_ingress_tcp (skip_hw) [FAIL]
# server output check failed
# INFO: Could not test offloaded functionality
not ok 80 selftests: net/forwarding: tc_actions.sh # exit=1
Fixes: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress")
Reported-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20230808141503.4060661-12-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/forwarding/tc_actions.sh | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh
index a96cff8e72197..b0f5e55d2d0b2 100755
--- a/tools/testing/selftests/net/forwarding/tc_actions.sh
+++ b/tools/testing/selftests/net/forwarding/tc_actions.sh
@@ -9,6 +9,8 @@ NUM_NETIFS=4
source tc_common.sh
source lib.sh
+require_command ncat
+
tcflags="skip_hw"
h1_create()
@@ -220,9 +222,9 @@ mirred_egress_to_ingress_tcp_test()
ip_proto icmp \
action drop
- ip vrf exec v$h1 nc --recv-only -w10 -l -p 12345 -o $mirred_e2i_tf2 &
+ ip vrf exec v$h1 ncat --recv-only -w10 -l -p 12345 -o $mirred_e2i_tf2 &
local rpid=$!
- ip vrf exec v$h1 nc -w1 --send-only 192.0.2.2 12345 <$mirred_e2i_tf1
+ ip vrf exec v$h1 ncat -w1 --send-only 192.0.2.2 12345 <$mirred_e2i_tf1
wait -n $rpid
cmp -s $mirred_e2i_tf1 $mirred_e2i_tf2
check_err $? "server output check failed"
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 008/194] net/smc: replace mutex rmbs_lock and sndbufs_lock with rw_semaphore
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 007/194] selftests: forwarding: tc_actions: Use ncat instead of nc Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 009/194] net/smc: Fix setsockopt and sysctl to specify same buffer size again Greg Kroah-Hartman
` (196 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, D. Wythe, David S. Miller,
Sasha Levin
From: D. Wythe <alibuda@linux.alibaba.com>
[ Upstream commit aff7bfed9097435ea38de919befbe2d7771a3e87 ]
It's clear that rmbs_lock and sndbufs_lock are aims to protect the
rmbs list or the sndbufs list.
During connection establieshment, smc_buf_get_slot() will always
be invoked, and it only performs read semantics in rmbs list and
sndbufs list.
Based on the above considerations, we replace mutex with rw_semaphore.
Only smc_buf_get_slot() use down_read() to allow smc_buf_get_slot()
run concurrently, other part use down_write() to keep exclusive
semantics.
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 833bac7ec392 ("net/smc: Fix setsockopt and sysctl to specify same buffer size again")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_core.c | 55 +++++++++++++++++++++++-----------------------
net/smc/smc_core.h | 4 ++--
net/smc/smc_llc.c | 16 +++++++-------
3 files changed, 38 insertions(+), 37 deletions(-)
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index f82f43573a159..f793101e0ecc3 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -852,8 +852,8 @@ static int smc_lgr_create(struct smc_sock *smc, struct smc_init_info *ini)
lgr->freeing = 0;
lgr->vlan_id = ini->vlan_id;
refcount_set(&lgr->refcnt, 1); /* set lgr refcnt to 1 */
- mutex_init(&lgr->sndbufs_lock);
- mutex_init(&lgr->rmbs_lock);
+ init_rwsem(&lgr->sndbufs_lock);
+ init_rwsem(&lgr->rmbs_lock);
rwlock_init(&lgr->conns_lock);
for (i = 0; i < SMC_RMBE_SIZES; i++) {
INIT_LIST_HEAD(&lgr->sndbufs[i]);
@@ -1095,7 +1095,7 @@ struct smc_link *smc_switch_conns(struct smc_link_group *lgr,
static void smcr_buf_unuse(struct smc_buf_desc *buf_desc, bool is_rmb,
struct smc_link_group *lgr)
{
- struct mutex *lock; /* lock buffer list */
+ struct rw_semaphore *lock; /* lock buffer list */
int rc;
if (is_rmb && buf_desc->is_conf_rkey && !list_empty(&lgr->list)) {
@@ -1115,9 +1115,9 @@ static void smcr_buf_unuse(struct smc_buf_desc *buf_desc, bool is_rmb,
/* buf registration failed, reuse not possible */
lock = is_rmb ? &lgr->rmbs_lock :
&lgr->sndbufs_lock;
- mutex_lock(lock);
+ down_write(lock);
list_del(&buf_desc->list);
- mutex_unlock(lock);
+ up_write(lock);
smc_buf_free(lgr, is_rmb, buf_desc);
} else {
@@ -1220,15 +1220,16 @@ static void smcr_buf_unmap_lgr(struct smc_link *lnk)
int i;
for (i = 0; i < SMC_RMBE_SIZES; i++) {
- mutex_lock(&lgr->rmbs_lock);
+ down_write(&lgr->rmbs_lock);
list_for_each_entry_safe(buf_desc, bf, &lgr->rmbs[i], list)
smcr_buf_unmap_link(buf_desc, true, lnk);
- mutex_unlock(&lgr->rmbs_lock);
- mutex_lock(&lgr->sndbufs_lock);
+ up_write(&lgr->rmbs_lock);
+
+ down_write(&lgr->sndbufs_lock);
list_for_each_entry_safe(buf_desc, bf, &lgr->sndbufs[i],
list)
smcr_buf_unmap_link(buf_desc, false, lnk);
- mutex_unlock(&lgr->sndbufs_lock);
+ up_write(&lgr->sndbufs_lock);
}
}
@@ -1986,19 +1987,19 @@ int smc_uncompress_bufsize(u8 compressed)
* buffer size; if not available, return NULL
*/
static struct smc_buf_desc *smc_buf_get_slot(int compressed_bufsize,
- struct mutex *lock,
+ struct rw_semaphore *lock,
struct list_head *buf_list)
{
struct smc_buf_desc *buf_slot;
- mutex_lock(lock);
+ down_read(lock);
list_for_each_entry(buf_slot, buf_list, list) {
if (cmpxchg(&buf_slot->used, 0, 1) == 0) {
- mutex_unlock(lock);
+ up_read(lock);
return buf_slot;
}
}
- mutex_unlock(lock);
+ up_read(lock);
return NULL;
}
@@ -2107,13 +2108,13 @@ int smcr_link_reg_buf(struct smc_link *link, struct smc_buf_desc *buf_desc)
return 0;
}
-static int _smcr_buf_map_lgr(struct smc_link *lnk, struct mutex *lock,
+static int _smcr_buf_map_lgr(struct smc_link *lnk, struct rw_semaphore *lock,
struct list_head *lst, bool is_rmb)
{
struct smc_buf_desc *buf_desc, *bf;
int rc = 0;
- mutex_lock(lock);
+ down_write(lock);
list_for_each_entry_safe(buf_desc, bf, lst, list) {
if (!buf_desc->used)
continue;
@@ -2122,7 +2123,7 @@ static int _smcr_buf_map_lgr(struct smc_link *lnk, struct mutex *lock,
goto out;
}
out:
- mutex_unlock(lock);
+ up_write(lock);
return rc;
}
@@ -2155,37 +2156,37 @@ int smcr_buf_reg_lgr(struct smc_link *lnk)
int i, rc = 0;
/* reg all RMBs for a new link */
- mutex_lock(&lgr->rmbs_lock);
+ down_write(&lgr->rmbs_lock);
for (i = 0; i < SMC_RMBE_SIZES; i++) {
list_for_each_entry_safe(buf_desc, bf, &lgr->rmbs[i], list) {
if (!buf_desc->used)
continue;
rc = smcr_link_reg_buf(lnk, buf_desc);
if (rc) {
- mutex_unlock(&lgr->rmbs_lock);
+ up_write(&lgr->rmbs_lock);
return rc;
}
}
}
- mutex_unlock(&lgr->rmbs_lock);
+ up_write(&lgr->rmbs_lock);
if (lgr->buf_type == SMCR_PHYS_CONT_BUFS)
return rc;
/* reg all vzalloced sndbufs for a new link */
- mutex_lock(&lgr->sndbufs_lock);
+ down_write(&lgr->sndbufs_lock);
for (i = 0; i < SMC_RMBE_SIZES; i++) {
list_for_each_entry_safe(buf_desc, bf, &lgr->sndbufs[i], list) {
if (!buf_desc->used || !buf_desc->is_vm)
continue;
rc = smcr_link_reg_buf(lnk, buf_desc);
if (rc) {
- mutex_unlock(&lgr->sndbufs_lock);
+ up_write(&lgr->sndbufs_lock);
return rc;
}
}
}
- mutex_unlock(&lgr->sndbufs_lock);
+ up_write(&lgr->sndbufs_lock);
return rc;
}
@@ -2305,8 +2306,8 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_smcd, bool is_rmb)
struct smc_link_group *lgr = conn->lgr;
struct list_head *buf_list;
int bufsize, bufsize_short;
+ struct rw_semaphore *lock; /* lock buffer list */
bool is_dgraded = false;
- struct mutex *lock; /* lock buffer list */
int sk_buf_size;
if (is_rmb)
@@ -2354,9 +2355,9 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_smcd, bool is_rmb)
SMC_STAT_RMB_ALLOC(smc, is_smcd, is_rmb);
SMC_STAT_RMB_SIZE(smc, is_smcd, is_rmb, bufsize);
buf_desc->used = 1;
- mutex_lock(lock);
+ down_write(lock);
list_add(&buf_desc->list, buf_list);
- mutex_unlock(lock);
+ up_write(lock);
break; /* found */
}
@@ -2430,9 +2431,9 @@ int smc_buf_create(struct smc_sock *smc, bool is_smcd)
/* create rmb */
rc = __smc_buf_create(smc, is_smcd, true);
if (rc) {
- mutex_lock(&smc->conn.lgr->sndbufs_lock);
+ down_write(&smc->conn.lgr->sndbufs_lock);
list_del(&smc->conn.sndbuf_desc->list);
- mutex_unlock(&smc->conn.lgr->sndbufs_lock);
+ up_write(&smc->conn.lgr->sndbufs_lock);
smc_buf_free(smc->conn.lgr, false, smc->conn.sndbuf_desc);
smc->conn.sndbuf_desc = NULL;
}
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index 285f9bd8e232e..6051d92270130 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -252,9 +252,9 @@ struct smc_link_group {
unsigned short vlan_id; /* vlan id of link group */
struct list_head sndbufs[SMC_RMBE_SIZES];/* tx buffers */
- struct mutex sndbufs_lock; /* protects tx buffers */
+ struct rw_semaphore sndbufs_lock; /* protects tx buffers */
struct list_head rmbs[SMC_RMBE_SIZES]; /* rx buffers */
- struct mutex rmbs_lock; /* protects rx buffers */
+ struct rw_semaphore rmbs_lock; /* protects rx buffers */
u8 id[SMC_LGR_ID_SIZE]; /* unique lgr id */
struct delayed_work free_work; /* delayed freeing of an lgr */
diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c
index 760f8bbff822e..fcb24a0ccf761 100644
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -611,7 +611,7 @@ static int smc_llc_fill_ext_v2(struct smc_llc_msg_add_link_v2_ext *ext,
prim_lnk_idx = link->link_idx;
lnk_idx = link_new->link_idx;
- mutex_lock(&lgr->rmbs_lock);
+ down_write(&lgr->rmbs_lock);
ext->num_rkeys = lgr->conns_num;
if (!ext->num_rkeys)
goto out;
@@ -631,7 +631,7 @@ static int smc_llc_fill_ext_v2(struct smc_llc_msg_add_link_v2_ext *ext,
}
len += i * sizeof(ext->rt[0]);
out:
- mutex_unlock(&lgr->rmbs_lock);
+ up_write(&lgr->rmbs_lock);
return len;
}
@@ -892,7 +892,7 @@ static int smc_llc_cli_rkey_exchange(struct smc_link *link,
int rc = 0;
int i;
- mutex_lock(&lgr->rmbs_lock);
+ down_write(&lgr->rmbs_lock);
num_rkeys_send = lgr->conns_num;
buf_pos = smc_llc_get_first_rmb(lgr, &buf_lst);
do {
@@ -919,7 +919,7 @@ static int smc_llc_cli_rkey_exchange(struct smc_link *link,
break;
} while (num_rkeys_send || num_rkeys_recv);
- mutex_unlock(&lgr->rmbs_lock);
+ up_write(&lgr->rmbs_lock);
return rc;
}
@@ -1002,14 +1002,14 @@ static void smc_llc_save_add_link_rkeys(struct smc_link *link,
ext = (struct smc_llc_msg_add_link_v2_ext *)((u8 *)lgr->wr_rx_buf_v2 +
SMC_WR_TX_SIZE);
max = min_t(u8, ext->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2);
- mutex_lock(&lgr->rmbs_lock);
+ down_write(&lgr->rmbs_lock);
for (i = 0; i < max; i++) {
smc_rtoken_set(lgr, link->link_idx, link_new->link_idx,
ext->rt[i].rmb_key,
ext->rt[i].rmb_vaddr_new,
ext->rt[i].rmb_key_new);
}
- mutex_unlock(&lgr->rmbs_lock);
+ up_write(&lgr->rmbs_lock);
}
static void smc_llc_save_add_link_info(struct smc_link *link,
@@ -1316,7 +1316,7 @@ static int smc_llc_srv_rkey_exchange(struct smc_link *link,
int rc = 0;
int i;
- mutex_lock(&lgr->rmbs_lock);
+ down_write(&lgr->rmbs_lock);
num_rkeys_send = lgr->conns_num;
buf_pos = smc_llc_get_first_rmb(lgr, &buf_lst);
do {
@@ -1341,7 +1341,7 @@ static int smc_llc_srv_rkey_exchange(struct smc_link *link,
smc_llc_flow_qentry_del(&lgr->llc_flow_lcl);
} while (num_rkeys_send || num_rkeys_recv);
out:
- mutex_unlock(&lgr->rmbs_lock);
+ up_write(&lgr->rmbs_lock);
return rc;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 009/194] net/smc: Fix setsockopt and sysctl to specify same buffer size again
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 008/194] net/smc: replace mutex rmbs_lock and sndbufs_lock with rw_semaphore Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 010/194] net: phy: at803x: Use devm_regulator_get_enable_optional() Greg Kroah-Hartman
` (195 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Karcher, Wenjia Zhang, Tony Lu,
Gerd Bayer, David S. Miller, Sasha Levin
From: Gerd Bayer <gbayer@linux.ibm.com>
[ Upstream commit 833bac7ec392bf75053c8a4fa4c36d4148dac77d ]
Commit 0227f058aa29 ("net/smc: Unbind r/w buffer size from clcsock
and make them tunable") introduced the net.smc.rmem and net.smc.wmem
sysctls to specify the size of buffers to be used for SMC type
connections. This created a regression for users that specified the
buffer size via setsockopt() as the effective buffer size was now
doubled.
Re-introduce the division by 2 in the SMC buffer create code and level
this out by duplicating the net.smc.[rw]mem values used for initializing
sk_rcvbuf/sk_sndbuf at socket creation time. This gives users of both
methods (setsockopt or sysctl) the effective buffer size that they
expect.
Initialize net.smc.[rw]mem from its own constant of 64kB, respectively.
Internal performance tests show that this value is a good compromise
between throughput/latency and memory consumption. Also, this decouples
it from any tuning that was done to net.ipv4.tcp_[rw]mem[1] before the
module for SMC protocol was loaded. Check that no more than INT_MAX / 2
is assigned to net.smc.[rw]mem, in order to avoid any overflow condition
when that is doubled for use in sk_sndbuf or sk_rcvbuf.
While at it, drop the confusing sk_buf_size variable from
__smc_buf_create and name "compressed" buffer size variables more
consistently.
Background:
Before the commit mentioned above, SMC's buffer allocator in
__smc_buf_create() always used half of the sockets' sk_rcvbuf/sk_sndbuf
value as initial value to search for appropriate buffers. If the search
resorted to using a bigger buffer when all buffers of the specified
size were busy, the duplicate of the used effective buffer size is
stored back to sk_rcvbuf/sk_sndbuf.
When available, buffers of exactly the size that a user had specified as
input to setsockopt() were used, despite setsockopt()'s documentation in
"man 7 socket" talking of a mandatory duplication:
[...]
SO_SNDBUF
Sets or gets the maximum socket send buffer in bytes.
The kernel doubles this value (to allow space for book‐
keeping overhead) when it is set using setsockopt(2),
and this doubled value is returned by getsockopt(2).
The default value is set by the
/proc/sys/net/core/wmem_default file and the maximum
allowed value is set by the /proc/sys/net/core/wmem_max
file. The minimum (doubled) value for this option is
2048.
[...]
Fixes: 0227f058aa29 ("net/smc: Unbind r/w buffer size from clcsock and make them tunable")
Co-developed-by: Jan Karcher <jaka@linux.ibm.com>
Signed-off-by: Jan Karcher <jaka@linux.ibm.com>
Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
Reviewed-by: Tony Lu <tonylu@linux.alibaba.com>
Signed-off-by: Gerd Bayer <gbayer@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/af_smc.c | 4 ++--
net/smc/smc.h | 2 +-
net/smc/smc_clc.c | 4 ++--
net/smc/smc_core.c | 25 ++++++++++++-------------
net/smc/smc_sysctl.c | 10 ++++++++--
5 files changed, 25 insertions(+), 20 deletions(-)
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 5712a5297bd01..84219c5121bc2 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -379,8 +379,8 @@ static struct sock *smc_sock_alloc(struct net *net, struct socket *sock,
sk->sk_state = SMC_INIT;
sk->sk_destruct = smc_destruct;
sk->sk_protocol = protocol;
- WRITE_ONCE(sk->sk_sndbuf, READ_ONCE(net->smc.sysctl_wmem));
- WRITE_ONCE(sk->sk_rcvbuf, READ_ONCE(net->smc.sysctl_rmem));
+ WRITE_ONCE(sk->sk_sndbuf, 2 * READ_ONCE(net->smc.sysctl_wmem));
+ WRITE_ONCE(sk->sk_rcvbuf, 2 * READ_ONCE(net->smc.sysctl_rmem));
smc = smc_sk(sk);
INIT_WORK(&smc->tcp_listen_work, smc_tcp_listen_work);
INIT_WORK(&smc->connect_work, smc_connect_work);
diff --git a/net/smc/smc.h b/net/smc/smc.h
index 5ed765ea0c731..1d36720fc019c 100644
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -161,7 +161,7 @@ struct smc_connection {
struct smc_buf_desc *sndbuf_desc; /* send buffer descriptor */
struct smc_buf_desc *rmb_desc; /* RMBE descriptor */
- int rmbe_size_short;/* compressed notation */
+ int rmbe_size_comp; /* compressed notation */
int rmbe_update_limit;
/* lower limit for consumer
* cursor update
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index dfb9797f7bc63..9b8999e2afca5 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -1002,7 +1002,7 @@ static int smc_clc_send_confirm_accept(struct smc_sock *smc,
clc->hdr.typev1 = SMC_TYPE_D;
clc->d0.gid = conn->lgr->smcd->local_gid;
clc->d0.token = conn->rmb_desc->token;
- clc->d0.dmbe_size = conn->rmbe_size_short;
+ clc->d0.dmbe_size = conn->rmbe_size_comp;
clc->d0.dmbe_idx = 0;
memcpy(&clc->d0.linkid, conn->lgr->id, SMC_LGR_ID_SIZE);
if (version == SMC_V1) {
@@ -1045,7 +1045,7 @@ static int smc_clc_send_confirm_accept(struct smc_sock *smc,
clc->r0.qp_mtu = min(link->path_mtu, link->peer_mtu);
break;
}
- clc->r0.rmbe_size = conn->rmbe_size_short;
+ clc->r0.rmbe_size = conn->rmbe_size_comp;
clc->r0.rmb_dma_addr = conn->rmb_desc->is_vm ?
cpu_to_be64((uintptr_t)conn->rmb_desc->cpu_addr) :
cpu_to_be64((u64)sg_dma_address
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index f793101e0ecc3..c676d92af7b7d 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -2305,31 +2305,30 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_smcd, bool is_rmb)
struct smc_connection *conn = &smc->conn;
struct smc_link_group *lgr = conn->lgr;
struct list_head *buf_list;
- int bufsize, bufsize_short;
+ int bufsize, bufsize_comp;
struct rw_semaphore *lock; /* lock buffer list */
bool is_dgraded = false;
- int sk_buf_size;
if (is_rmb)
/* use socket recv buffer size (w/o overhead) as start value */
- sk_buf_size = smc->sk.sk_rcvbuf;
+ bufsize = smc->sk.sk_rcvbuf / 2;
else
/* use socket send buffer size (w/o overhead) as start value */
- sk_buf_size = smc->sk.sk_sndbuf;
+ bufsize = smc->sk.sk_sndbuf / 2;
- for (bufsize_short = smc_compress_bufsize(sk_buf_size, is_smcd, is_rmb);
- bufsize_short >= 0; bufsize_short--) {
+ for (bufsize_comp = smc_compress_bufsize(bufsize, is_smcd, is_rmb);
+ bufsize_comp >= 0; bufsize_comp--) {
if (is_rmb) {
lock = &lgr->rmbs_lock;
- buf_list = &lgr->rmbs[bufsize_short];
+ buf_list = &lgr->rmbs[bufsize_comp];
} else {
lock = &lgr->sndbufs_lock;
- buf_list = &lgr->sndbufs[bufsize_short];
+ buf_list = &lgr->sndbufs[bufsize_comp];
}
- bufsize = smc_uncompress_bufsize(bufsize_short);
+ bufsize = smc_uncompress_bufsize(bufsize_comp);
/* check for reusable slot in the link group */
- buf_desc = smc_buf_get_slot(bufsize_short, lock, buf_list);
+ buf_desc = smc_buf_get_slot(bufsize_comp, lock, buf_list);
if (buf_desc) {
buf_desc->is_dma_need_sync = 0;
SMC_STAT_RMB_SIZE(smc, is_smcd, is_rmb, bufsize);
@@ -2373,8 +2372,8 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_smcd, bool is_rmb)
if (is_rmb) {
conn->rmb_desc = buf_desc;
- conn->rmbe_size_short = bufsize_short;
- smc->sk.sk_rcvbuf = bufsize;
+ conn->rmbe_size_comp = bufsize_comp;
+ smc->sk.sk_rcvbuf = bufsize * 2;
atomic_set(&conn->bytes_to_rcv, 0);
conn->rmbe_update_limit =
smc_rmb_wnd_update_limit(buf_desc->len);
@@ -2382,7 +2381,7 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_smcd, bool is_rmb)
smc_ism_set_conn(conn); /* map RMB/smcd_dev to conn */
} else {
conn->sndbuf_desc = buf_desc;
- smc->sk.sk_sndbuf = bufsize;
+ smc->sk.sk_sndbuf = bufsize * 2;
atomic_set(&conn->sndbuf_space, bufsize);
}
return 0;
diff --git a/net/smc/smc_sysctl.c b/net/smc/smc_sysctl.c
index b6f79fabb9d3f..0b2a957ca5f5f 100644
--- a/net/smc/smc_sysctl.c
+++ b/net/smc/smc_sysctl.c
@@ -21,6 +21,10 @@
static int min_sndbuf = SMC_BUF_MIN_SIZE;
static int min_rcvbuf = SMC_BUF_MIN_SIZE;
+static int max_sndbuf = INT_MAX / 2;
+static int max_rcvbuf = INT_MAX / 2;
+static const int net_smc_wmem_init = (64 * 1024);
+static const int net_smc_rmem_init = (64 * 1024);
static struct ctl_table smc_table[] = {
{
@@ -53,6 +57,7 @@ static struct ctl_table smc_table[] = {
.mode = 0644,
.proc_handler = proc_dointvec_minmax,
.extra1 = &min_sndbuf,
+ .extra2 = &max_sndbuf,
},
{
.procname = "rmem",
@@ -61,6 +66,7 @@ static struct ctl_table smc_table[] = {
.mode = 0644,
.proc_handler = proc_dointvec_minmax,
.extra1 = &min_rcvbuf,
+ .extra2 = &max_rcvbuf,
},
{ }
};
@@ -88,8 +94,8 @@ int __net_init smc_sysctl_net_init(struct net *net)
net->smc.sysctl_autocorking_size = SMC_AUTOCORKING_DEFAULT_SIZE;
net->smc.sysctl_smcr_buf_type = SMCR_PHYS_CONT_BUFS;
net->smc.sysctl_smcr_testlink_time = SMC_LLC_TESTLINK_DEFAULT_TIME;
- WRITE_ONCE(net->smc.sysctl_wmem, READ_ONCE(net->ipv4.sysctl_tcp_wmem[1]));
- WRITE_ONCE(net->smc.sysctl_rmem, READ_ONCE(net->ipv4.sysctl_tcp_rmem[1]));
+ WRITE_ONCE(net->smc.sysctl_wmem, net_smc_wmem_init);
+ WRITE_ONCE(net->smc.sysctl_rmem, net_smc_rmem_init);
return 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 010/194] net: phy: at803x: Use devm_regulator_get_enable_optional()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 009/194] net/smc: Fix setsockopt and sysctl to specify same buffer size again Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 011/194] net: phy: at803x: fix the wol setting functions Greg Kroah-Hartman
` (194 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Andrew Lunn,
David S. Miller, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 988e8d90b3dc482637532e61bc2d58bfc4af5167 ]
Use devm_regulator_get_enable_optional() instead of hand writing it. It
saves some line of code.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: e58f30246c35 ("net: phy: at803x: fix the wol setting functions")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/at803x.c | 44 +++++++---------------------------------
1 file changed, 7 insertions(+), 37 deletions(-)
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 61824a463df85..e351fa8b84b7d 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -305,7 +305,6 @@ struct at803x_priv {
bool is_1000basex;
struct regulator_dev *vddio_rdev;
struct regulator_dev *vddh_rdev;
- struct regulator *vddio;
u64 stats[ARRAY_SIZE(at803x_hw_stats)];
};
@@ -825,11 +824,11 @@ static int at803x_parse_dt(struct phy_device *phydev)
if (ret < 0)
return ret;
- priv->vddio = devm_regulator_get_optional(&phydev->mdio.dev,
- "vddio");
- if (IS_ERR(priv->vddio)) {
+ ret = devm_regulator_get_enable_optional(&phydev->mdio.dev,
+ "vddio");
+ if (ret) {
phydev_err(phydev, "failed to get VDDIO regulator\n");
- return PTR_ERR(priv->vddio);
+ return ret;
}
/* Only AR8031/8033 support 1000Base-X for SFP modules */
@@ -857,12 +856,6 @@ static int at803x_probe(struct phy_device *phydev)
if (ret)
return ret;
- if (priv->vddio) {
- ret = regulator_enable(priv->vddio);
- if (ret < 0)
- return ret;
- }
-
if (phydev->drv->phy_id == ATH8031_PHY_ID) {
int ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG);
int mode_cfg;
@@ -870,10 +863,8 @@ static int at803x_probe(struct phy_device *phydev)
.wolopts = 0,
};
- if (ccr < 0) {
- ret = ccr;
- goto err;
- }
+ if (ccr < 0)
+ return ccr;
mode_cfg = ccr & AT803X_MODE_CFG_MASK;
switch (mode_cfg) {
@@ -891,25 +882,11 @@ static int at803x_probe(struct phy_device *phydev)
ret = at803x_set_wol(phydev, &wol);
if (ret < 0) {
phydev_err(phydev, "failed to disable WOL on probe: %d\n", ret);
- goto err;
+ return ret;
}
}
return 0;
-
-err:
- if (priv->vddio)
- regulator_disable(priv->vddio);
-
- return ret;
-}
-
-static void at803x_remove(struct phy_device *phydev)
-{
- struct at803x_priv *priv = phydev->priv;
-
- if (priv->vddio)
- regulator_disable(priv->vddio);
}
static int at803x_get_features(struct phy_device *phydev)
@@ -2022,7 +1999,6 @@ static struct phy_driver at803x_driver[] = {
.name = "Qualcomm Atheros AR8035",
.flags = PHY_POLL_CABLE_TEST,
.probe = at803x_probe,
- .remove = at803x_remove,
.config_aneg = at803x_config_aneg,
.config_init = at803x_config_init,
.soft_reset = genphy_soft_reset,
@@ -2044,7 +2020,6 @@ static struct phy_driver at803x_driver[] = {
.name = "Qualcomm Atheros AR8030",
.phy_id_mask = AT8030_PHY_ID_MASK,
.probe = at803x_probe,
- .remove = at803x_remove,
.config_init = at803x_config_init,
.link_change_notify = at803x_link_change_notify,
.set_wol = at803x_set_wol,
@@ -2060,7 +2035,6 @@ static struct phy_driver at803x_driver[] = {
.name = "Qualcomm Atheros AR8031/AR8033",
.flags = PHY_POLL_CABLE_TEST,
.probe = at803x_probe,
- .remove = at803x_remove,
.config_init = at803x_config_init,
.config_aneg = at803x_config_aneg,
.soft_reset = genphy_soft_reset,
@@ -2083,7 +2057,6 @@ static struct phy_driver at803x_driver[] = {
PHY_ID_MATCH_EXACT(ATH8032_PHY_ID),
.name = "Qualcomm Atheros AR8032",
.probe = at803x_probe,
- .remove = at803x_remove,
.flags = PHY_POLL_CABLE_TEST,
.config_init = at803x_config_init,
.link_change_notify = at803x_link_change_notify,
@@ -2099,7 +2072,6 @@ static struct phy_driver at803x_driver[] = {
PHY_ID_MATCH_EXACT(ATH9331_PHY_ID),
.name = "Qualcomm Atheros AR9331 built-in PHY",
.probe = at803x_probe,
- .remove = at803x_remove,
.suspend = at803x_suspend,
.resume = at803x_resume,
.flags = PHY_POLL_CABLE_TEST,
@@ -2116,7 +2088,6 @@ static struct phy_driver at803x_driver[] = {
PHY_ID_MATCH_EXACT(QCA9561_PHY_ID),
.name = "Qualcomm Atheros QCA9561 built-in PHY",
.probe = at803x_probe,
- .remove = at803x_remove,
.suspend = at803x_suspend,
.resume = at803x_resume,
.flags = PHY_POLL_CABLE_TEST,
@@ -2182,7 +2153,6 @@ static struct phy_driver at803x_driver[] = {
.name = "Qualcomm QCA8081",
.flags = PHY_POLL_CABLE_TEST,
.probe = at803x_probe,
- .remove = at803x_remove,
.config_intr = at803x_config_intr,
.handle_interrupt = at803x_handle_interrupt,
.get_tunable = at803x_get_tunable,
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 011/194] net: phy: at803x: fix the wol setting functions
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 010/194] net: phy: at803x: Use devm_regulator_get_enable_optional() Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 012/194] drm/amdgpu: fix calltrace warning in amddrm_buddy_fini Greg Kroah-Hartman
` (193 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Yang, Viorel Suman, Wei Fang,
Russell King (Oracle), David S. Miller, Sasha Levin
From: Li Yang <leoyang.li@nxp.com>
[ Upstream commit e58f30246c35c126c7571065b33bee4b3b1d2ef8 ]
In commit 7beecaf7d507 ("net: phy: at803x: improve the WOL feature"), it
seems not correct to use a wol_en bit in a 1588 Control Register which is
only available on AR8031/AR8033(share the same phy_id) to determine if WoL
is enabled. Change it back to use AT803X_INTR_ENABLE_WOL for determining
the WoL status which is applicable on all chips supporting wol. Also update
the at803x_set_wol() function to only update the 1588 register on chips
having it. After this change, disabling wol at probe from commit
d7cd5e06c9dd ("net: phy: at803x: disable WOL at probe") is no longer
needed. Change it to just disable the WoL bit in 1588 register for
AR8031/AR8033 to be aligned with AT803X_INTR_ENABLE_WOL in probe.
Fixes: 7beecaf7d507 ("net: phy: at803x: improve the WOL feature")
Signed-off-by: Li Yang <leoyang.li@nxp.com>
Reviewed-by: Viorel Suman <viorel.suman@nxp.com>
Reviewed-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/at803x.c | 45 ++++++++++++++++++++++------------------
1 file changed, 25 insertions(+), 20 deletions(-)
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index e351fa8b84b7d..edd4b1e58d965 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -460,21 +460,27 @@ static int at803x_set_wol(struct phy_device *phydev,
phy_write_mmd(phydev, MDIO_MMD_PCS, offsets[i],
mac[(i * 2) + 1] | (mac[(i * 2)] << 8));
- /* Enable WOL function */
- ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, AT803X_PHY_MMD3_WOL_CTRL,
- 0, AT803X_WOL_EN);
- if (ret)
- return ret;
+ /* Enable WOL function for 1588 */
+ if (phydev->drv->phy_id == ATH8031_PHY_ID) {
+ ret = phy_modify_mmd(phydev, MDIO_MMD_PCS,
+ AT803X_PHY_MMD3_WOL_CTRL,
+ 0, AT803X_WOL_EN);
+ if (ret)
+ return ret;
+ }
/* Enable WOL interrupt */
ret = phy_modify(phydev, AT803X_INTR_ENABLE, 0, AT803X_INTR_ENABLE_WOL);
if (ret)
return ret;
} else {
- /* Disable WoL function */
- ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, AT803X_PHY_MMD3_WOL_CTRL,
- AT803X_WOL_EN, 0);
- if (ret)
- return ret;
+ /* Disable WoL function for 1588 */
+ if (phydev->drv->phy_id == ATH8031_PHY_ID) {
+ ret = phy_modify_mmd(phydev, MDIO_MMD_PCS,
+ AT803X_PHY_MMD3_WOL_CTRL,
+ AT803X_WOL_EN, 0);
+ if (ret)
+ return ret;
+ }
/* Disable WOL interrupt */
ret = phy_modify(phydev, AT803X_INTR_ENABLE, AT803X_INTR_ENABLE_WOL, 0);
if (ret)
@@ -509,11 +515,11 @@ static void at803x_get_wol(struct phy_device *phydev,
wol->supported = WAKE_MAGIC;
wol->wolopts = 0;
- value = phy_read_mmd(phydev, MDIO_MMD_PCS, AT803X_PHY_MMD3_WOL_CTRL);
+ value = phy_read(phydev, AT803X_INTR_ENABLE);
if (value < 0)
return;
- if (value & AT803X_WOL_EN)
+ if (value & AT803X_INTR_ENABLE_WOL)
wol->wolopts |= WAKE_MAGIC;
}
@@ -859,9 +865,6 @@ static int at803x_probe(struct phy_device *phydev)
if (phydev->drv->phy_id == ATH8031_PHY_ID) {
int ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG);
int mode_cfg;
- struct ethtool_wolinfo wol = {
- .wolopts = 0,
- };
if (ccr < 0)
return ccr;
@@ -878,12 +881,14 @@ static int at803x_probe(struct phy_device *phydev)
break;
}
- /* Disable WOL by default */
- ret = at803x_set_wol(phydev, &wol);
- if (ret < 0) {
- phydev_err(phydev, "failed to disable WOL on probe: %d\n", ret);
+ /* Disable WoL in 1588 register which is enabled
+ * by default
+ */
+ ret = phy_modify_mmd(phydev, MDIO_MMD_PCS,
+ AT803X_PHY_MMD3_WOL_CTRL,
+ AT803X_WOL_EN, 0);
+ if (ret)
return ret;
- }
}
return 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 012/194] drm/amdgpu: fix calltrace warning in amddrm_buddy_fini
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 011/194] net: phy: at803x: fix the wol setting functions Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 013/194] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 Greg Kroah-Hartman
` (192 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guchun Chen, Feifei Xu, Longlong Yao,
Alex Deucher, Sasha Levin
From: Longlong Yao <Longlong.Yao@amd.com>
[ Upstream commit 01382501509871d0799bab6bd412c228486af5bf ]
The following call trace is observed when removing the amdgpu driver, which
is caused by that BOs allocated for psp are not freed until removing.
[61811.450562] RIP: 0010:amddrm_buddy_fini.cold+0x29/0x47 [amddrm_buddy]
[61811.450577] Call Trace:
[61811.450577] <TASK>
[61811.450579] amdgpu_vram_mgr_fini+0x135/0x1c0 [amdgpu]
[61811.450728] amdgpu_ttm_fini+0x207/0x290 [amdgpu]
[61811.450870] amdgpu_bo_fini+0x27/0xa0 [amdgpu]
[61811.451012] gmc_v9_0_sw_fini+0x4a/0x60 [amdgpu]
[61811.451166] amdgpu_device_fini_sw+0x117/0x520 [amdgpu]
[61811.451306] amdgpu_driver_release_kms+0x16/0x30 [amdgpu]
[61811.451447] devm_drm_dev_init_release+0x4d/0x80 [drm]
[61811.451466] devm_action_release+0x15/0x20
[61811.451469] release_nodes+0x40/0xb0
[61811.451471] devres_release_all+0x9b/0xd0
[61811.451473] __device_release_driver+0x1bb/0x2a0
[61811.451476] driver_detach+0xf3/0x140
[61811.451479] bus_remove_driver+0x6c/0xf0
[61811.451481] driver_unregister+0x31/0x60
[61811.451483] pci_unregister_driver+0x40/0x90
[61811.451486] amdgpu_exit+0x15/0x447 [amdgpu]
For smu v13_0_2, if the GPU supports xgmi, refer to
commit f5c7e7797060 ("drm/amdgpu: Adjust removal control flow for smu v13_0_2"),
it will run gpu recover in AMDGPU_RESET_FOR_DEVICE_REMOVE mode when removing,
which makes all devices in hive list have hw reset but no resume except the
basic ip blocks, then other ip blocks will not call .hw_fini according to
ip_block.status.hw.
Since psp_free_shared_bufs just includes some software operations, so move
it to psp_sw_fini.
Reviewed-by: Guchun Chen <guchun.chen@amd.com>
Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
Signed-off-by: Longlong Yao <Longlong.Yao@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
index eecbd8eeb1f5a..8764ff7ed97e0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -514,6 +514,8 @@ static int psp_sw_fini(void *handle)
kfree(cmd);
cmd = NULL;
+ psp_free_shared_bufs(psp);
+
if (psp->km_ring.ring_mem)
amdgpu_bo_free_kernel(&adev->firmware.rbuf,
&psp->km_ring.ring_mem_mc_addr,
@@ -2673,8 +2675,6 @@ static int psp_hw_fini(void *handle)
psp_ring_destroy(psp, PSP_RING_TYPE__KM);
- psp_free_shared_bufs(psp);
-
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 013/194] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 012/194] drm/amdgpu: fix calltrace warning in amddrm_buddy_fini Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 014/194] drm/amdgpu: fix memory leak in mes self test Greg Kroah-Hartman
` (191 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, hackyzh002,
Alex Deucher, Sasha Levin
From: hackyzh002 <hackyzh002@gmail.com>
[ Upstream commit 87c2213e85bd81e4a9a4d0880c256568794ae388 ]
The type of size is unsigned int, if size is 0x40000000, there will
be an integer overflow, size will be zero after size *= sizeof(uint32_t),
will cause uninitialized memory to be referenced later.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: hackyzh002 <hackyzh002@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index fdb53d4394f30..6d3d01c5f0a28 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -185,7 +185,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
uint64_t *chunk_array_user;
uint64_t *chunk_array;
uint32_t uf_offset = 0;
- unsigned int size;
+ size_t size;
int ret;
int i;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 014/194] drm/amdgpu: fix memory leak in mes self test
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 013/194] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 015/194] ASoC: Intel: sof_sdw: add quirk for MTL RVP Greg Kroah-Hartman
` (190 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jack Xiao, Hawking Zhang,
Alex Deucher, Sasha Levin
From: Jack Xiao <Jack.Xiao@amd.com>
[ Upstream commit 31d7c3a4fc3d312a0646990767647925d5bde540 ]
The fences associated with mes queue have to be freed
up during amdgpu_ring_fini.
Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index d3558c34d406c..296b2d5976af7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -361,6 +361,8 @@ void amdgpu_ring_fini(struct amdgpu_ring *ring)
amdgpu_bo_free_kernel(&ring->ring_obj,
&ring->gpu_addr,
(void **)&ring->ring);
+ } else {
+ kfree(ring->fence_drv.fences);
}
dma_fence_put(ring->vmid_wait);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 015/194] ASoC: Intel: sof_sdw: add quirk for MTL RVP
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 014/194] drm/amdgpu: fix memory leak in mes self test Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 016/194] ASoC: Intel: sof_sdw: add quirk for LNL RVP Greg Kroah-Hartman
` (189 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Bard Liao <yung-chuan.liao@linux.intel.com>
[ Upstream commit 289e1df00e49a229a1c924c059242e759a552f01 ]
We should use RT711_JD2_100K for on board rt711.
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com
Link: https://lore.kernel.org/r/20230512173305.65399-4-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/sof_sdw.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
index a37c85d301471..7f9940c722a3c 100644
--- a/sound/soc/intel/boards/sof_sdw.c
+++ b/sound/soc/intel/boards/sof_sdw.c
@@ -374,6 +374,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
},
.driver_data = (void *)(RT711_JD1),
},
+ {
+ .callback = sof_sdw_quirk_cb,
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Meteor Lake Client Platform"),
+ },
+ .driver_data = (void *)(RT711_JD2_100K),
+ },
{}
};
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 016/194] ASoC: Intel: sof_sdw: add quirk for LNL RVP
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 015/194] ASoC: Intel: sof_sdw: add quirk for MTL RVP Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 017/194] PCI: tegra194: Fix possible array out of bounds access Greg Kroah-Hartman
` (188 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit dfe25fea968dc4884e12d471c8263f0f611b380a ]
We should use RT711_JD2_100K for on board rt711
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com
Link: https://lore.kernel.org/r/20230512173305.65399-9-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/sof_sdw.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
index 7f9940c722a3c..0cf9efec46ce2 100644
--- a/sound/soc/intel/boards/sof_sdw.c
+++ b/sound/soc/intel/boards/sof_sdw.c
@@ -382,6 +382,15 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
},
.driver_data = (void *)(RT711_JD2_100K),
},
+ /* LunarLake devices */
+ {
+ .callback = sof_sdw_quirk_cb,
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Lunar Lake Client Platform"),
+ },
+ .driver_data = (void *)(RT711_JD2_100K),
+ },
{}
};
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 017/194] PCI: tegra194: Fix possible array out of bounds access
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 016/194] ASoC: Intel: sof_sdw: add quirk for LNL RVP Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 018/194] ASoC: SOF: amd: Add pci revision id check Greg Kroah-Hartman
` (187 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Helgaas, Sumit Gupta,
Lorenzo Pieralisi, Thierry Reding, Sasha Levin
From: Sumit Gupta <sumitg@nvidia.com>
[ Upstream commit 205b3d02d57ce6dce96f6d2b9c230f56a9bf9817 ]
Add check to fix the possible array out of bounds violation by
making speed equal to GEN1_CORE_CLK_FREQ when its value is more
than the size of "pcie_gen_freq" array. This array has size of
four but possible speed (CLS) values are from "0 to 0xF". So,
"speed - 1" values are "-1 to 0xE".
Suggested-by: Bjorn Helgaas <helgaas@kernel.org>
Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Link: https://lore.kernel.org/lkml/72b9168b-d4d6-4312-32ea-69358df2f2d0@nvidia.com/
Acked-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-tegra194.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
index 1b6b437823d22..528e73ccfa43e 100644
--- a/drivers/pci/controller/dwc/pcie-tegra194.c
+++ b/drivers/pci/controller/dwc/pcie-tegra194.c
@@ -224,6 +224,7 @@
#define EP_STATE_ENABLED 1
static const unsigned int pcie_gen_freq[] = {
+ GEN1_CORE_CLK_FREQ, /* PCI_EXP_LNKSTA_CLS == 0; undefined */
GEN1_CORE_CLK_FREQ,
GEN2_CORE_CLK_FREQ,
GEN3_CORE_CLK_FREQ,
@@ -455,7 +456,11 @@ static irqreturn_t tegra_pcie_ep_irq_thread(int irq, void *arg)
speed = dw_pcie_readw_dbi(pci, pcie->pcie_cap_base + PCI_EXP_LNKSTA) &
PCI_EXP_LNKSTA_CLS;
- clk_set_rate(pcie->core_clk, pcie_gen_freq[speed - 1]);
+
+ if (speed >= ARRAY_SIZE(pcie_gen_freq))
+ speed = 0;
+
+ clk_set_rate(pcie->core_clk, pcie_gen_freq[speed]);
if (pcie->of_data->has_ltr_req_fix)
return IRQ_HANDLED;
@@ -1016,7 +1021,11 @@ static int tegra_pcie_dw_start_link(struct dw_pcie *pci)
speed = dw_pcie_readw_dbi(pci, pcie->pcie_cap_base + PCI_EXP_LNKSTA) &
PCI_EXP_LNKSTA_CLS;
- clk_set_rate(pcie->core_clk, pcie_gen_freq[speed - 1]);
+
+ if (speed >= ARRAY_SIZE(pcie_gen_freq))
+ speed = 0;
+
+ clk_set_rate(pcie->core_clk, pcie_gen_freq[speed]);
tegra_pcie_enable_interrupts(pp);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 018/194] ASoC: SOF: amd: Add pci revision id check
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 017/194] PCI: tegra194: Fix possible array out of bounds access Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 019/194] drm/stm: ltdc: fix late dereference check Greg Kroah-Hartman
` (186 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Venkata Prasad Potturu, Mark Brown,
Sasha Levin
From: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
[ Upstream commit 1d4a84632b90d88316986b05bcdfe715399a33db ]
Add pci revision id check for renoir and rembrandt platforms.
Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
Link: https://lore.kernel.org/r/20230523072009.2379198-1-venkataprasad.potturu@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/amd/acp.h | 3 +++
sound/soc/sof/amd/pci-rmb.c | 3 +++
sound/soc/sof/amd/pci-rn.c | 3 +++
3 files changed, 9 insertions(+)
diff --git a/sound/soc/sof/amd/acp.h b/sound/soc/sof/amd/acp.h
index dd3c072d01721..14148c311f504 100644
--- a/sound/soc/sof/amd/acp.h
+++ b/sound/soc/sof/amd/acp.h
@@ -54,6 +54,9 @@
#define ACP_DSP_TO_HOST_IRQ 0x04
+#define ACP_RN_PCI_ID 0x01
+#define ACP_RMB_PCI_ID 0x6F
+
#define HOST_BRIDGE_CZN 0x1630
#define HOST_BRIDGE_RMB 0x14B5
#define ACP_SHA_STAT 0x8000
diff --git a/sound/soc/sof/amd/pci-rmb.c b/sound/soc/sof/amd/pci-rmb.c
index 4e1de462b431b..5698d910b26f3 100644
--- a/sound/soc/sof/amd/pci-rmb.c
+++ b/sound/soc/sof/amd/pci-rmb.c
@@ -90,6 +90,9 @@ static int acp_pci_rmb_probe(struct pci_dev *pci, const struct pci_device_id *pc
unsigned int flag, i, addr;
int ret;
+ if (pci->revision != ACP_RMB_PCI_ID)
+ return -ENODEV;
+
flag = snd_amd_acp_find_config(pci);
if (flag != FLAG_AMD_SOF && flag != FLAG_AMD_SOF_ONLY_DMIC)
return -ENODEV;
diff --git a/sound/soc/sof/amd/pci-rn.c b/sound/soc/sof/amd/pci-rn.c
index fca40b261671b..9189f63632789 100644
--- a/sound/soc/sof/amd/pci-rn.c
+++ b/sound/soc/sof/amd/pci-rn.c
@@ -90,6 +90,9 @@ static int acp_pci_rn_probe(struct pci_dev *pci, const struct pci_device_id *pci
unsigned int flag, i, addr;
int ret;
+ if (pci->revision != ACP_RN_PCI_ID)
+ return -ENODEV;
+
flag = snd_amd_acp_find_config(pci);
if (flag != FLAG_AMD_SOF && flag != FLAG_AMD_SOF_ONLY_DMIC)
return -ENODEV;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 019/194] drm/stm: ltdc: fix late dereference check
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 018/194] ASoC: SOF: amd: Add pci revision id check Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 020/194] drm: rcar-du: remove R-Car H3 ES1.* workarounds Greg Kroah-Hartman
` (185 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Raphael Gallais-Pou, Philippe Cornu, Sasha Levin
From: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
[ Upstream commit 898a9e3f56db9860ab091d4bf41b6caa99aafc3d ]
In ltdc_crtc_set_crc_source(), struct drm_crtc was dereferenced in a
container_of() before the pointer check. This could cause a kernel panic.
Fix this smatch warning:
drivers/gpu/drm/stm/ltdc.c:1124 ltdc_crtc_set_crc_source() warn: variable dereferenced before check 'crtc' (see line 1119)
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/lkml/202212241802.zeLFZCXB-lkp@intel.com/
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/lkml/202212241802.zeLFZCXB-lkp@intel.com/
Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
Acked-by: Philippe Cornu <philippe.cornu@foss.st.com>
Signed-off-by: Philippe Cornu <philippe.cornu@foss.st.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230515123818.93971-1-raphael.gallais-pou@foss.st.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/stm/ltdc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c
index 03c6becda795c..b8be4c1db4235 100644
--- a/drivers/gpu/drm/stm/ltdc.c
+++ b/drivers/gpu/drm/stm/ltdc.c
@@ -1145,7 +1145,7 @@ static void ltdc_crtc_disable_vblank(struct drm_crtc *crtc)
static int ltdc_crtc_set_crc_source(struct drm_crtc *crtc, const char *source)
{
- struct ltdc_device *ldev = crtc_to_ltdc(crtc);
+ struct ltdc_device *ldev;
int ret;
DRM_DEBUG_DRIVER("\n");
@@ -1153,6 +1153,8 @@ static int ltdc_crtc_set_crc_source(struct drm_crtc *crtc, const char *source)
if (!crtc)
return -ENODEV;
+ ldev = crtc_to_ltdc(crtc);
+
if (source && strcmp(source, "auto") == 0) {
ldev->crc_active = true;
ret = regmap_set_bits(ldev->regmap, LTDC_GCR, GCR_CRCEN);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 020/194] drm: rcar-du: remove R-Car H3 ES1.* workarounds
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 019/194] drm/stm: ltdc: fix late dereference check Greg Kroah-Hartman
@ 2023-08-21 19:39 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 021/194] ASoC: amd: vangogh: Add check for acp config flags in vangogh platform Greg Kroah-Hartman
` (184 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Kieran Bingham,
Laurent Pinchart, Sasha Levin
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit 2da4b728f994a1f9189a8066b0be90b615768764 ]
R-Car H3 ES1.* was only available to an internal development group and
needed a lot of quirks and workarounds. These become a maintenance
burden now, so our development group decided to remove upstream support
for this SoC and prevent booting it. Public users only have ES2 onwards.
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 37 ++------------------
drivers/gpu/drm/rcar-du/rcar_du_drv.c | 48 --------------------------
drivers/gpu/drm/rcar-du/rcar_du_drv.h | 2 --
drivers/gpu/drm/rcar-du/rcar_du_regs.h | 3 +-
4 files changed, 4 insertions(+), 86 deletions(-)
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
index b7dd59fe119e6..9edb5edb2bad9 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
@@ -223,20 +223,6 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)
* DU channels that have a display PLL can't use the internal
* system clock, and have no internal clock divider.
*/
-
- /*
- * The H3 ES1.x exhibits dot clock duty cycle stability issues.
- * We can work around them by configuring the DPLL to twice the
- * desired frequency, coupled with a /2 post-divider. Restrict
- * the workaround to H3 ES1.x as ES2.0 and all other SoCs have
- * no post-divider when a display PLL is present (as shown by
- * the workaround breaking HDMI output on M3-W during testing).
- */
- if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY) {
- target *= 2;
- div = 1;
- }
-
extclk = clk_get_rate(rcrtc->extclock);
rcar_du_dpll_divider(rcrtc, &dpll, extclk, target);
@@ -245,30 +231,13 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)
| DPLLCR_N(dpll.n) | DPLLCR_M(dpll.m)
| DPLLCR_STBY;
- if (rcrtc->index == 1) {
+ if (rcrtc->index == 1)
dpllcr |= DPLLCR_PLCS1
| DPLLCR_INCS_DOTCLKIN1;
- } else {
- dpllcr |= DPLLCR_PLCS0_PLL
+ else
+ dpllcr |= DPLLCR_PLCS0
| DPLLCR_INCS_DOTCLKIN0;
- /*
- * On ES2.x we have a single mux controlled via bit 21,
- * which selects between DCLKIN source (bit 21 = 0) and
- * a PLL source (bit 21 = 1), where the PLL is always
- * PLL1.
- *
- * On ES1.x we have an additional mux, controlled
- * via bit 20, for choosing between PLL0 (bit 20 = 0)
- * and PLL1 (bit 20 = 1). We always want to use PLL1,
- * so on ES1.x, in addition to setting bit 21, we need
- * to set the bit 20.
- */
-
- if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PLL)
- dpllcr |= DPLLCR_PLCS0_H3ES1X_PLL1;
- }
-
rcar_du_group_write(rcrtc->group, DPLLCR, dpllcr);
escr = ESCR_DCLKSEL_DCLKIN | div;
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
index 6381578c4db58..bd7003d6e0753 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
@@ -16,7 +16,6 @@
#include <linux/platform_device.h>
#include <linux/pm.h>
#include <linux/slab.h>
-#include <linux/sys_soc.h>
#include <linux/wait.h>
#include <drm/drm_atomic_helper.h>
@@ -387,43 +386,6 @@ static const struct rcar_du_device_info rcar_du_r8a7795_info = {
.dpll_mask = BIT(2) | BIT(1),
};
-static const struct rcar_du_device_info rcar_du_r8a7795_es1_info = {
- .gen = 3,
- .features = RCAR_DU_FEATURE_CRTC_IRQ
- | RCAR_DU_FEATURE_CRTC_CLOCK
- | RCAR_DU_FEATURE_VSP1_SOURCE
- | RCAR_DU_FEATURE_INTERLACED
- | RCAR_DU_FEATURE_TVM_SYNC,
- .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY
- | RCAR_DU_QUIRK_H3_ES1_PLL,
- .channels_mask = BIT(3) | BIT(2) | BIT(1) | BIT(0),
- .routes = {
- /*
- * R8A7795 has one RGB output, two HDMI outputs and one
- * LVDS output.
- */
- [RCAR_DU_OUTPUT_DPAD0] = {
- .possible_crtcs = BIT(3),
- .port = 0,
- },
- [RCAR_DU_OUTPUT_HDMI0] = {
- .possible_crtcs = BIT(1),
- .port = 1,
- },
- [RCAR_DU_OUTPUT_HDMI1] = {
- .possible_crtcs = BIT(2),
- .port = 2,
- },
- [RCAR_DU_OUTPUT_LVDS0] = {
- .possible_crtcs = BIT(0),
- .port = 3,
- },
- },
- .num_lvds = 1,
- .num_rpf = 5,
- .dpll_mask = BIT(2) | BIT(1),
-};
-
static const struct rcar_du_device_info rcar_du_r8a7796_info = {
.gen = 3,
.features = RCAR_DU_FEATURE_CRTC_IRQ
@@ -592,11 +554,6 @@ static const struct of_device_id rcar_du_of_table[] = {
MODULE_DEVICE_TABLE(of, rcar_du_of_table);
-static const struct soc_device_attribute rcar_du_soc_table[] = {
- { .soc_id = "r8a7795", .revision = "ES1.*", .data = &rcar_du_r8a7795_es1_info },
- { /* sentinel */ }
-};
-
const char *rcar_du_output_name(enum rcar_du_output output)
{
static const char * const names[] = {
@@ -688,7 +645,6 @@ static void rcar_du_shutdown(struct platform_device *pdev)
static int rcar_du_probe(struct platform_device *pdev)
{
- const struct soc_device_attribute *soc_attr;
struct rcar_du_device *rcdu;
unsigned int mask;
int ret;
@@ -706,10 +662,6 @@ static int rcar_du_probe(struct platform_device *pdev)
rcdu->info = of_device_get_match_data(rcdu->dev);
- soc_attr = soc_device_match(rcar_du_soc_table);
- if (soc_attr)
- rcdu->info = soc_attr->data;
-
platform_set_drvdata(pdev, rcdu);
/* I/O resources */
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.h b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
index acc3673fefe18..5cfa2bb7ad93d 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.h
+++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
@@ -34,8 +34,6 @@ struct rcar_du_device;
#define RCAR_DU_FEATURE_NO_BLENDING BIT(5) /* PnMR.SPIM does not have ALP nor EOR bits */
#define RCAR_DU_QUIRK_ALIGN_128B BIT(0) /* Align pitches to 128 bytes */
-#define RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY BIT(1) /* H3 ES1 has pclk stability issue */
-#define RCAR_DU_QUIRK_H3_ES1_PLL BIT(2) /* H3 ES1 PLL setup differs from non-ES1 */
enum rcar_du_output {
RCAR_DU_OUTPUT_DPAD0,
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_regs.h b/drivers/gpu/drm/rcar-du/rcar_du_regs.h
index 789ae9285108e..288eff12b2b1a 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_regs.h
+++ b/drivers/gpu/drm/rcar-du/rcar_du_regs.h
@@ -283,8 +283,7 @@
#define DPLLCR 0x20044
#define DPLLCR_CODE (0x95 << 24)
#define DPLLCR_PLCS1 (1 << 23)
-#define DPLLCR_PLCS0_PLL (1 << 21)
-#define DPLLCR_PLCS0_H3ES1X_PLL1 (1 << 20)
+#define DPLLCR_PLCS0 (1 << 21)
#define DPLLCR_CLKE (1 << 18)
#define DPLLCR_FDPLL(n) ((n) << 12)
#define DPLLCR_N(n) ((n) << 5)
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 021/194] ASoC: amd: vangogh: Add check for acp config flags in vangogh platform
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2023-08-21 19:39 ` [PATCH 6.1 020/194] drm: rcar-du: remove R-Car H3 ES1.* workarounds Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 022/194] ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings Greg Kroah-Hartman
` (183 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Venkata Prasad Potturu, Mark Brown,
Sasha Levin
From: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
[ Upstream commit e89f45edb747ed88e97a5771dd6d3dd1eb517873 ]
We have SOF and generic ACP support enabled for Vangogh platform
on some machines. Since we have same PCI id used for probing,
add check for machine configuration flag to avoid conflict with
newer pci drivers. Such machine flag has been initialized via
dmi match on few Vangogh based machines. If no flag is
specified probe and register older platform device.
Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
Link: https://lore.kernel.org/r/20230530110802.674939-1-venkataprasad.potturu@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/amd/vangogh/acp5x.h | 2 ++
sound/soc/amd/vangogh/pci-acp5x.c | 7 ++++++-
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/sound/soc/amd/vangogh/acp5x.h b/sound/soc/amd/vangogh/acp5x.h
index bd9f1c5684d17..ac1936a8c43ff 100644
--- a/sound/soc/amd/vangogh/acp5x.h
+++ b/sound/soc/amd/vangogh/acp5x.h
@@ -147,6 +147,8 @@ static inline void acp_writel(u32 val, void __iomem *base_addr)
writel(val, base_addr - ACP5x_PHY_BASE_ADDRESS);
}
+int snd_amd_acp_find_config(struct pci_dev *pci);
+
static inline u64 acp_get_byte_count(struct i2s_stream_instance *rtd,
int direction)
{
diff --git a/sound/soc/amd/vangogh/pci-acp5x.c b/sound/soc/amd/vangogh/pci-acp5x.c
index e0df17c88e8e0..c4634a8a17cdc 100644
--- a/sound/soc/amd/vangogh/pci-acp5x.c
+++ b/sound/soc/amd/vangogh/pci-acp5x.c
@@ -125,10 +125,15 @@ static int snd_acp5x_probe(struct pci_dev *pci,
{
struct acp5x_dev_data *adata;
struct platform_device_info pdevinfo[ACP5x_DEVS];
- unsigned int irqflags;
+ unsigned int irqflags, flag;
int ret, i;
u32 addr, val;
+ /* Return if acp config flag is defined */
+ flag = snd_amd_acp_find_config(pci);
+ if (flag)
+ return -ENODEV;
+
irqflags = IRQF_SHARED;
if (pci->revision != 0x50)
return -ENODEV;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 022/194] ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 021/194] ASoC: amd: vangogh: Add check for acp config flags in vangogh platform Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 023/194] ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in _exit Greg Kroah-Hartman
` (182 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oleksij Rempel, Shawn Guo,
Sasha Levin
From: Oleksij Rempel <o.rempel@pengutronix.de>
[ Upstream commit 1d14bd943fa2bbdfda1efbcc080b298fed5f1803 ]
Fix USB-related warnings in prtrvt, prtvt7, prti6q and prtwd2 device trees
by disabling unused usbphynop1 and usbphynop2 USB PHYs and providing proper
configuration for the over-current detection. This fixes the following
warnings with the current kernel:
usb_phy_generic usbphynop1: dummy supplies not allowed for exclusive requests
usb_phy_generic usbphynop2: dummy supplies not allowed for exclusive requests
imx_usb 2184200.usb: No over current polarity defined
By the way, fix over-current detection on usbotg port for prtvt7, prti6q
and prtwd2 boards. Only prtrvt do not have OC on USB OTG port.
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx6dl-prtrvt.dts | 4 ++++
arch/arm/boot/dts/imx6qdl-prti6q.dtsi | 11 ++++++++++-
2 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/imx6dl-prtrvt.dts b/arch/arm/boot/dts/imx6dl-prtrvt.dts
index 56bb1ca56a2df..36b031236e475 100644
--- a/arch/arm/boot/dts/imx6dl-prtrvt.dts
+++ b/arch/arm/boot/dts/imx6dl-prtrvt.dts
@@ -124,6 +124,10 @@ &usbh1 {
status = "disabled";
};
+&usbotg {
+ disable-over-current;
+};
+
&vpu {
status = "disabled";
};
diff --git a/arch/arm/boot/dts/imx6qdl-prti6q.dtsi b/arch/arm/boot/dts/imx6qdl-prti6q.dtsi
index f0db0d4471f40..36f84f4da6b0d 100644
--- a/arch/arm/boot/dts/imx6qdl-prti6q.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-prti6q.dtsi
@@ -69,6 +69,7 @@ &usbh1 {
vbus-supply = <®_usb_h1_vbus>;
phy_type = "utmi";
dr_mode = "host";
+ disable-over-current;
status = "okay";
};
@@ -78,10 +79,18 @@ &usbotg {
pinctrl-0 = <&pinctrl_usbotg>;
phy_type = "utmi";
dr_mode = "host";
- disable-over-current;
+ over-current-active-low;
status = "okay";
};
+&usbphynop1 {
+ status = "disabled";
+};
+
+&usbphynop2 {
+ status = "disabled";
+};
+
&usdhc1 {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_usdhc1>;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 023/194] ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in _exit
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 022/194] ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 024/194] ASoC: Intel: sof_sdw: Add support for Rex soundwire Greg Kroah-Hartman
` (181 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bard Liao, Pierre-Louis Bossart,
Mark Brown, Sasha Levin
From: Bard Liao <yung-chuan.liao@linux.intel.com>
[ Upstream commit 526a1876fc48e2d0c0ea8ad63b58bdb2cc13047f ]
if (!SOF_RT711_JDSRC(sof_sdw_quirk)) is tested in rt711_sdca_add_codec_
device_props(), and we don't add software node to the device if jack
source is not set. We need to do the same test in
sof_sdw_rt711_sdca_exit(), and avoid removing software node if jack
source is not set.
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20230602202225.249209-8-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/sof_sdw_rt711_sdca.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sound/soc/intel/boards/sof_sdw_rt711_sdca.c b/sound/soc/intel/boards/sof_sdw_rt711_sdca.c
index 7f16304d025be..cf8b9793fe0e5 100644
--- a/sound/soc/intel/boards/sof_sdw_rt711_sdca.c
+++ b/sound/soc/intel/boards/sof_sdw_rt711_sdca.c
@@ -143,6 +143,9 @@ int sof_sdw_rt711_sdca_exit(struct snd_soc_card *card, struct snd_soc_dai_link *
if (!ctx->headset_codec_dev)
return 0;
+ if (!SOF_RT711_JDSRC(sof_sdw_quirk))
+ return 0;
+
device_remove_software_node(ctx->headset_codec_dev);
put_device(ctx->headset_codec_dev);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 024/194] ASoC: Intel: sof_sdw: Add support for Rex soundwire
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 023/194] ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in _exit Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 025/194] iopoll: Call cpu_relax() in busy loops Greg Kroah-Hartman
` (180 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ranjani Sridharan, Bard Liao,
Yong Zhi, Uday M Bhat, Pierre-Louis Bossart, Mark Brown,
Sasha Levin
From: Uday M Bhat <uday.m.bhat@intel.com>
[ Upstream commit 164e5dc17525181c05563f0a06796f1a363801d5 ]
Add rex entry in the soundwire quirk table
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Signed-off-by: Yong Zhi <yong.zhi@intel.com>
Signed-off-by: Uday M Bhat <uday.m.bhat@intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20230602202225.249209-28-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/sof_sdw.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
index 0cf9efec46ce2..064b6feb76167 100644
--- a/sound/soc/intel/boards/sof_sdw.c
+++ b/sound/soc/intel/boards/sof_sdw.c
@@ -382,6 +382,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
},
.driver_data = (void *)(RT711_JD2_100K),
},
+ {
+ .callback = sof_sdw_quirk_cb,
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Google"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Rex"),
+ },
+ .driver_data = (void *)(SOF_SDW_PCH_DMIC),
+ },
/* LunarLake devices */
{
.callback = sof_sdw_quirk_cb,
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 025/194] iopoll: Call cpu_relax() in busy loops
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 024/194] ASoC: Intel: sof_sdw: Add support for Rex soundwire Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 026/194] ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion Greg Kroah-Hartman
` (179 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven,
Peter Zijlstra (Intel), Arnd Bergmann, Tony Lindgren, Ulf Hansson,
Sasha Levin
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit b407460ee99033503993ac7437d593451fcdfe44 ]
It is considered good practice to call cpu_relax() in busy loops, see
Documentation/process/volatile-considered-harmful.rst. This can not
only lower CPU power consumption or yield to a hyperthreaded twin
processor, but also allows an architecture to mitigate hardware issues
(e.g. ARM Erratum 754327 for Cortex-A9 prior to r2p0) in the
architecture-specific cpu_relax() implementation.
In addition, cpu_relax() is also a compiler barrier. It is not
immediately obvious that the @op argument "function" will result in an
actual function call (e.g. in case of inlining).
Where a function call is a C sequence point, this is lost on inlining.
Therefore, with agressive enough optimization it might be possible for
the compiler to hoist the:
(val) = op(args);
"load" out of the loop because it doesn't see the value changing. The
addition of cpu_relax() would inhibit this.
As the iopoll helpers lack calls to cpu_relax(), people are sometimes
reluctant to use them, and may fall back to open-coded polling loops
(including cpu_relax() calls) instead.
Fix this by adding calls to cpu_relax() to the iopoll helpers:
- For the non-atomic case, it is sufficient to call cpu_relax() in
case of a zero sleep-between-reads value, as a call to
usleep_range() is a safe barrier otherwise. However, it doesn't
hurt to add the call regardless, for simplicity, and for similarity
with the atomic case below.
- For the atomic case, cpu_relax() must be called regardless of the
sleep-between-reads value, as there is no guarantee all
architecture-specific implementations of udelay() handle this.
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Tony Lindgren <tony@atomide.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/45c87bec3397fdd704376807f0eec5cc71be440f.1685692810.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/iopoll.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/include/linux/iopoll.h b/include/linux/iopoll.h
index 2c8860e406bd8..0417360a6db9b 100644
--- a/include/linux/iopoll.h
+++ b/include/linux/iopoll.h
@@ -53,6 +53,7 @@
} \
if (__sleep_us) \
usleep_range((__sleep_us >> 2) + 1, __sleep_us); \
+ cpu_relax(); \
} \
(cond) ? 0 : -ETIMEDOUT; \
})
@@ -95,6 +96,7 @@
} \
if (__delay_us) \
udelay(__delay_us); \
+ cpu_relax(); \
} \
(cond) ? 0 : -ETIMEDOUT; \
})
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 026/194] ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 025/194] iopoll: Call cpu_relax() in busy loops Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 027/194] dma-remap: use kvmalloc_array/kvfree for larger dma memory remap Greg Kroah-Hartman
` (178 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre-Louis Bossart, Bard Liao,
Ranjani Sridharan, Mark Brown, Sasha Levin
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
[ Upstream commit f751b99255cacd9ffe8c4bbf99767ad670cee1f7 ]
The functionality described in Commit 61bef9e68dca ("ASoC: SOF: Intel: hda: enforce exclusion between HDaudio and SoundWire")
does not seem to be properly implemented with two issues that need to
be corrected.
a) The test used is incorrect when DisplayAudio codecs are not supported.
b) Conversely when only Display Audio codecs can be found, we do want
to start the SoundWire links, if any. That will help add the relevant
topologies and machine descriptors, and identify cases where the
SoundWire information in ACPI needs to be modified with a quirk.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20230606222529.57156-2-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/intel/hda.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
index 1188ec51816bd..63764afdcf617 100644
--- a/sound/soc/sof/intel/hda.c
+++ b/sound/soc/sof/intel/hda.c
@@ -1309,12 +1309,22 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
hda_mach->mach_params.dmic_num = dmic_num;
pdata->tplg_filename = tplg_filename;
- if (codec_num == 2) {
+ if (codec_num == 2 ||
+ (codec_num == 1 && !HDA_IDISP_CODEC(bus->codec_mask))) {
/*
* Prevent SoundWire links from starting when an external
* HDaudio codec is used
*/
hda_mach->mach_params.link_mask = 0;
+ } else {
+ /*
+ * Allow SoundWire links to start when no external HDaudio codec
+ * was detected. This will not create a SoundWire card but
+ * will help detect if any SoundWire codec reports as ATTACHED.
+ */
+ struct sof_intel_hda_dev *hdev = sdev->pdata->hw_pdata;
+
+ hda_mach->mach_params.link_mask = hdev->info.link_mask;
}
*mach = hda_mach;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 027/194] dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 026/194] ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 028/194] accel/habanalabs: add pci health check during heartbeat Greg Kroah-Hartman
` (177 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gao Xu, Suren Baghdasaryan,
Christoph Hellwig, Sasha Levin
From: gaoxu <gaoxu2@hihonor.com>
[ Upstream commit 51ff97d54f02b4444dfc42e380ac4c058e12d5dd ]
If dma_direct_alloc() alloc memory in size of 64MB, the inner function
dma_common_contiguous_remap() will allocate 128KB memory by invoking
the function kmalloc_array(). and the kmalloc_array seems to fail to try to
allocate 128KB mem.
Call trace:
[14977.928623] qcrosvm: page allocation failure: order:5, mode:0x40cc0
[14977.928638] dump_backtrace.cfi_jt+0x0/0x8
[14977.928647] dump_stack_lvl+0x80/0xb8
[14977.928652] warn_alloc+0x164/0x200
[14977.928657] __alloc_pages_slowpath+0x9f0/0xb4c
[14977.928660] __alloc_pages+0x21c/0x39c
[14977.928662] kmalloc_order+0x48/0x108
[14977.928666] kmalloc_order_trace+0x34/0x154
[14977.928668] __kmalloc+0x548/0x7e4
[14977.928673] dma_direct_alloc+0x11c/0x4f8
[14977.928678] dma_alloc_attrs+0xf4/0x138
[14977.928680] gh_vm_ioctl_set_fw_name+0x3c4/0x610 [gunyah]
[14977.928698] gh_vm_ioctl+0x90/0x14c [gunyah]
[14977.928705] __arm64_sys_ioctl+0x184/0x210
work around by doing kvmalloc_array instead.
Signed-off-by: Gao Xu <gaoxu2@hihonor.com>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/dma/remap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/dma/remap.c b/kernel/dma/remap.c
index b4526668072e7..27596f3b4aef3 100644
--- a/kernel/dma/remap.c
+++ b/kernel/dma/remap.c
@@ -43,13 +43,13 @@ void *dma_common_contiguous_remap(struct page *page, size_t size,
void *vaddr;
int i;
- pages = kmalloc_array(count, sizeof(struct page *), GFP_KERNEL);
+ pages = kvmalloc_array(count, sizeof(struct page *), GFP_KERNEL);
if (!pages)
return NULL;
for (i = 0; i < count; i++)
pages[i] = nth_page(page, i);
vaddr = vmap(pages, count, VM_DMA_COHERENT, prot);
- kfree(pages);
+ kvfree(pages);
return vaddr;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 028/194] accel/habanalabs: add pci health check during heartbeat
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 027/194] dma-remap: use kvmalloc_array/kvfree for larger dma memory remap Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 029/194] HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard Greg Kroah-Hartman
` (176 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ofir Bitton, Oded Gabbay,
Sasha Levin
From: Ofir Bitton <obitton@habana.ai>
[ Upstream commit d8b9cea584661b30305cf341bf9f675dc0a25471 ]
Currently upon a heartbeat failure, we don't know if the failure
is due to firmware hang or due to a bad PCI link. Hence, we
are reading a PCI config space register with a known value (vendor ID)
so we will know which of the two possibilities caused the heartbeat
failure.
Signed-off-by: Ofir Bitton <obitton@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/habanalabs/common/device.c | 15 ++++++++++++++-
drivers/misc/habanalabs/common/habanalabs.h | 2 ++
drivers/misc/habanalabs/common/habanalabs_drv.c | 2 --
3 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/drivers/misc/habanalabs/common/device.c b/drivers/misc/habanalabs/common/device.c
index e0dca445abf14..9ee1b6abd8a05 100644
--- a/drivers/misc/habanalabs/common/device.c
+++ b/drivers/misc/habanalabs/common/device.c
@@ -870,6 +870,18 @@ static void device_early_fini(struct hl_device *hdev)
hdev->asic_funcs->early_fini(hdev);
}
+static bool is_pci_link_healthy(struct hl_device *hdev)
+{
+ u16 vendor_id;
+
+ if (!hdev->pdev)
+ return false;
+
+ pci_read_config_word(hdev->pdev, PCI_VENDOR_ID, &vendor_id);
+
+ return (vendor_id == PCI_VENDOR_ID_HABANALABS);
+}
+
static void hl_device_heartbeat(struct work_struct *work)
{
struct hl_device *hdev = container_of(work, struct hl_device,
@@ -882,7 +894,8 @@ static void hl_device_heartbeat(struct work_struct *work)
goto reschedule;
if (hl_device_operational(hdev, NULL))
- dev_err(hdev->dev, "Device heartbeat failed!\n");
+ dev_err(hdev->dev, "Device heartbeat failed! PCI link is %s\n",
+ is_pci_link_healthy(hdev) ? "healthy" : "broken");
hl_device_reset(hdev, HL_DRV_RESET_HARD | HL_DRV_RESET_HEARTBEAT);
diff --git a/drivers/misc/habanalabs/common/habanalabs.h b/drivers/misc/habanalabs/common/habanalabs.h
index 58c95b13be69a..257b94cec6248 100644
--- a/drivers/misc/habanalabs/common/habanalabs.h
+++ b/drivers/misc/habanalabs/common/habanalabs.h
@@ -34,6 +34,8 @@
struct hl_device;
struct hl_fpriv;
+#define PCI_VENDOR_ID_HABANALABS 0x1da3
+
/* Use upper bits of mmap offset to store habana driver specific information.
* bits[63:59] - Encode mmap type
* bits[45:0] - mmap offset value
diff --git a/drivers/misc/habanalabs/common/habanalabs_drv.c b/drivers/misc/habanalabs/common/habanalabs_drv.c
index 112632afe7d53..ae3cab3f4aa55 100644
--- a/drivers/misc/habanalabs/common/habanalabs_drv.c
+++ b/drivers/misc/habanalabs/common/habanalabs_drv.c
@@ -54,8 +54,6 @@ module_param(boot_error_status_mask, ulong, 0444);
MODULE_PARM_DESC(boot_error_status_mask,
"Mask of the error status during device CPU boot (If bitX is cleared then error X is masked. Default all 1's)");
-#define PCI_VENDOR_ID_HABANALABS 0x1da3
-
#define PCI_IDS_GOYA 0x0001
#define PCI_IDS_GAUDI 0x1000
#define PCI_IDS_GAUDI_SEC 0x1010
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 029/194] HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 028/194] accel/habanalabs: add pci health check during heartbeat Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 030/194] iommu/amd: Introduce Disable IRTE Caching Support Greg Kroah-Hartman
` (175 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bastien Nocera, Stuart Hayhurst,
Jiri Kosina, Sasha Levin
From: stuarthayhurst <stuart.a.hayhurst@gmail.com>
[ Upstream commit 48aea8b445c422a372cf15915101035a47105421 ]
Adds the USB and Bluetooth IDs for the Logitech G915 TKL keyboard, for device detection
For this device, this provides battery reporting on top of hid-generic
Reviewed-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-logitech-hidpp.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 0b4204b9a253c..97eefb77f6014 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4403,6 +4403,8 @@ static const struct hid_device_id hidpp_devices[] = {
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC086) },
{ /* Logitech G903 Hero Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC091) },
+ { /* Logitech G915 TKL Keyboard over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC343) },
{ /* Logitech G920 Wheel over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL),
.driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
@@ -4418,6 +4420,8 @@ static const struct hid_device_id hidpp_devices[] = {
{ /* MX5500 keyboard over Bluetooth */
HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb30b),
.driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS },
+ { /* Logitech G915 TKL keyboard over Bluetooth */
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb35f) },
{ /* M-RCQ142 V470 Cordless Laser Mouse over Bluetooth */
HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb008) },
{ /* MX Master mouse over Bluetooth */
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 030/194] iommu/amd: Introduce Disable IRTE Caching Support
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 029/194] HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 031/194] drm/amdgpu: install stub fence into potential unused fence pointers Greg Kroah-Hartman
` (174 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jerry Snitselaar, Alejandro Jimenez,
Suravee Suthikulpanit, Joerg Roedel, Sasha Levin
From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
[ Upstream commit 66419036f68a838c00cbccacd6cb2e99da6e5710 ]
An Interrupt Remapping Table (IRT) stores interrupt remapping configuration
for each device. In a normal operation, the AMD IOMMU caches the table
to optimize subsequent data accesses. This requires the IOMMU driver to
invalidate IRT whenever it updates the table. The invalidation process
includes issuing an INVALIDATE_INTERRUPT_TABLE command following by
a COMPLETION_WAIT command.
However, there are cases in which the IRT is updated at a high rate.
For example, for IOMMU AVIC, the IRTE[IsRun] bit is updated on every
vcpu scheduling (i.e. amd_iommu_update_ga()). On system with large
amount of vcpus and VFIO PCI pass-through devices, the invalidation
process could potentially become a performance bottleneck.
Introducing a new kernel boot option:
amd_iommu=irtcachedis
which disables IRTE caching by setting the IRTCachedis bit in each IOMMU
Control register, and bypass the IRT invalidation process.
Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
Co-developed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Link: https://lore.kernel.org/r/20230530141137.14376-4-suravee.suthikulpanit@amd.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../admin-guide/kernel-parameters.txt | 1 +
drivers/iommu/amd/amd_iommu_types.h | 4 +++
drivers/iommu/amd/init.c | 36 +++++++++++++++++++
3 files changed, 41 insertions(+)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 286be425f3bfa..882b6198dd0d1 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -323,6 +323,7 @@
option with care.
pgtbl_v1 - Use v1 page table for DMA-API (Default).
pgtbl_v2 - Use v2 page table for DMA-API.
+ irtcachedis - Disable Interrupt Remapping Table (IRT) caching.
amd_iommu_dump= [HW,X86-64]
Enable AMD IOMMU driver option to dump the ACPI table
diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
index 5ecc17240eff5..f5e9377b55212 100644
--- a/drivers/iommu/amd/amd_iommu_types.h
+++ b/drivers/iommu/amd/amd_iommu_types.h
@@ -172,6 +172,7 @@
#define CONTROL_GAINT_EN 29
#define CONTROL_XT_EN 50
#define CONTROL_INTCAPXT_EN 51
+#define CONTROL_IRTCACHEDIS 59
#define CONTROL_SNPAVIC_EN 61
#define CTRL_INV_TO_MASK (7 << CONTROL_INV_TIMEOUT)
@@ -708,6 +709,9 @@ struct amd_iommu {
/* if one, we need to send a completion wait command */
bool need_sync;
+ /* true if disable irte caching */
+ bool irtcachedis_enabled;
+
/* Handle for IOMMU core code */
struct iommu_device iommu;
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index b0af8b5967e0d..f6e64c9858021 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -160,6 +160,7 @@ static int amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE;
static bool amd_iommu_detected;
static bool amd_iommu_disabled __initdata;
static bool amd_iommu_force_enable __initdata;
+static bool amd_iommu_irtcachedis;
static int amd_iommu_target_ivhd_type;
/* Global EFR and EFR2 registers */
@@ -477,6 +478,9 @@ static void iommu_disable(struct amd_iommu *iommu)
/* Disable IOMMU hardware itself */
iommu_feature_disable(iommu, CONTROL_IOMMU_EN);
+
+ /* Clear IRTE cache disabling bit */
+ iommu_feature_disable(iommu, CONTROL_IRTCACHEDIS);
}
/*
@@ -2700,6 +2704,33 @@ static void iommu_enable_ga(struct amd_iommu *iommu)
#endif
}
+static void iommu_disable_irtcachedis(struct amd_iommu *iommu)
+{
+ iommu_feature_disable(iommu, CONTROL_IRTCACHEDIS);
+}
+
+static void iommu_enable_irtcachedis(struct amd_iommu *iommu)
+{
+ u64 ctrl;
+
+ if (!amd_iommu_irtcachedis)
+ return;
+
+ /*
+ * Note:
+ * The support for IRTCacheDis feature is dertermined by
+ * checking if the bit is writable.
+ */
+ iommu_feature_enable(iommu, CONTROL_IRTCACHEDIS);
+ ctrl = readq(iommu->mmio_base + MMIO_CONTROL_OFFSET);
+ ctrl &= (1ULL << CONTROL_IRTCACHEDIS);
+ if (ctrl)
+ iommu->irtcachedis_enabled = true;
+ pr_info("iommu%d (%#06x) : IRT cache is %s\n",
+ iommu->index, iommu->devid,
+ iommu->irtcachedis_enabled ? "disabled" : "enabled");
+}
+
static void early_enable_iommu(struct amd_iommu *iommu)
{
iommu_disable(iommu);
@@ -2710,6 +2741,7 @@ static void early_enable_iommu(struct amd_iommu *iommu)
iommu_set_exclusion_range(iommu);
iommu_enable_ga(iommu);
iommu_enable_xt(iommu);
+ iommu_enable_irtcachedis(iommu);
iommu_enable(iommu);
iommu_flush_all_caches(iommu);
}
@@ -2760,10 +2792,12 @@ static void early_enable_iommus(void)
for_each_iommu(iommu) {
iommu_disable_command_buffer(iommu);
iommu_disable_event_buffer(iommu);
+ iommu_disable_irtcachedis(iommu);
iommu_enable_command_buffer(iommu);
iommu_enable_event_buffer(iommu);
iommu_enable_ga(iommu);
iommu_enable_xt(iommu);
+ iommu_enable_irtcachedis(iommu);
iommu_set_device_table(iommu);
iommu_flush_all_caches(iommu);
}
@@ -3411,6 +3445,8 @@ static int __init parse_amd_iommu_options(char *str)
amd_iommu_pgtable = AMD_IOMMU_V1;
} else if (strncmp(str, "pgtbl_v2", 8) == 0) {
amd_iommu_pgtable = AMD_IOMMU_V2;
+ } else if (strncmp(str, "irtcachedis", 11) == 0) {
+ amd_iommu_irtcachedis = true;
} else {
pr_notice("Unknown option - '%s'\n", str);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 031/194] drm/amdgpu: install stub fence into potential unused fence pointers
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 030/194] iommu/amd: Introduce Disable IRTE Caching Support Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 032/194] drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz Greg Kroah-Hartman
` (173 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Lang Yu,
Alex Deucher, Sasha Levin
From: Lang Yu <Lang.Yu@amd.com>
[ Upstream commit 187916e6ed9d0c3b3abc27429f7a5f8c936bd1f0 ]
When using cpu to update page tables, vm update fences are unused.
Install stub fence into these fence pointers instead of NULL
to avoid NULL dereference when calling dma_fence_wait() on them.
Suggested-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Lang Yu <Lang.Yu@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index ec938a1a50621..4c661e024e13d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1352,6 +1352,7 @@ struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev,
amdgpu_vm_bo_base_init(&bo_va->base, vm, bo);
bo_va->ref_count = 1;
+ bo_va->last_pt_update = dma_fence_get_stub();
INIT_LIST_HEAD(&bo_va->valids);
INIT_LIST_HEAD(&bo_va->invalids);
@@ -2073,7 +2074,8 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
vm->update_funcs = &amdgpu_vm_cpu_funcs;
else
vm->update_funcs = &amdgpu_vm_sdma_funcs;
- vm->last_update = NULL;
+
+ vm->last_update = dma_fence_get_stub();
vm->last_unlocked = dma_fence_get_stub();
vm->last_tlb_flush = dma_fence_get_stub();
@@ -2198,7 +2200,7 @@ int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm)
goto unreserve_bo;
dma_fence_put(vm->last_update);
- vm->last_update = NULL;
+ vm->last_update = dma_fence_get_stub();
vm->is_compute_context = true;
/* Free the shadow bo for compute VM */
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 032/194] drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 031/194] drm/amdgpu: install stub fence into potential unused fence pointers Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 033/194] RDMA/mlx5: Return the firmware result upon destroying QP/RQ Greg Kroah-Hartman
` (172 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nevenko Stupar, Jun Lei, Tom Chung,
Alvin Lee, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Alvin Lee <alvin.lee2@amd.com>
[ Upstream commit 7e60ab4eb3e4ba2adac46d737fdbbc5732bebd58 ]
[Description]
- Previously we wanted to apply extra 60us of prefetch for min DCFCLK
(200Mhz), but DCFCLK can be calculated to be 201Mhz which underflows
also without the extra prefetch
- Instead, apply the the extra 60us prefetch for any DCFCLK freq <=
300Mhz
Reviewed-by: Nevenko Stupar <nevenko.stupar@amd.com>
Reviewed-by: Jun Lei <jun.lei@amd.com>
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Alvin Lee <alvin.lee2@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c | 4 ++--
.../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
index 2bb768413c92a..19f55657272e4 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
@@ -808,7 +808,7 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman
v->SwathHeightC[k],
TWait,
(v->DRAMSpeedPerState[mode_lib->vba.VoltageLevel] <= MEM_STROBE_FREQ_MHZ ||
- v->DCFCLKPerState[mode_lib->vba.VoltageLevel] <= MIN_DCFCLK_FREQ_MHZ) ?
+ v->DCFCLKPerState[mode_lib->vba.VoltageLevel] <= DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ) ?
mode_lib->vba.ip.min_prefetch_in_strobe_us : 0,
/* Output */
&v->DSTXAfterScaler[k],
@@ -3289,7 +3289,7 @@ void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
v->swath_width_chroma_ub_this_state[k],
v->SwathHeightYThisState[k],
v->SwathHeightCThisState[k], v->TWait,
- (v->DRAMSpeedPerState[i] <= MEM_STROBE_FREQ_MHZ || v->DCFCLKState[i][j] <= MIN_DCFCLK_FREQ_MHZ) ?
+ (v->DRAMSpeedPerState[i] <= MEM_STROBE_FREQ_MHZ || v->DCFCLKState[i][j] <= DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ) ?
mode_lib->vba.ip.min_prefetch_in_strobe_us : 0,
/* Output */
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h
index e92eee2c664d0..a475775bc3894 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h
@@ -52,7 +52,7 @@
#define BPP_BLENDED_PIPE 0xffffffff
#define MEM_STROBE_FREQ_MHZ 1600
-#define MIN_DCFCLK_FREQ_MHZ 200
+#define DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ 300
#define MEM_STROBE_MAX_DELIVERY_TIME_US 60.0
struct display_mode_lib;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 033/194] RDMA/mlx5: Return the firmware result upon destroying QP/RQ
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 032/194] drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 034/194] drm/amd/display: Skip DPP DTO update if root clock is gated Greg Kroah-Hartman
` (171 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Patrisious Haddad, Leon Romanovsky,
Sasha Levin
From: Patrisious Haddad <phaddad@nvidia.com>
[ Upstream commit 22664c06e997087fe37f9ba208008c948571214a ]
Previously when destroying a QP/RQ, the result of the firmware
destruction function was ignored and upper layers weren't informed
about the failure.
Which in turn could lead to various problems since when upper layer
isn't aware of the failure it continues its operation thinking that the
related QP/RQ was successfully destroyed while it actually wasn't,
which could lead to the below kernel WARN.
Currently, we return the correct firmware destruction status to upper
layers which in case of the RQ would be mlx5_ib_destroy_wq() which
was already capable of handling RQ destruction failure or in case of
a QP to destroy_qp_common(), which now would actually warn upon qp
destruction failure.
WARNING: CPU: 3 PID: 995 at drivers/infiniband/core/rdma_core.c:940 uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs]
Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core overlay mlx5_core fuse
CPU: 3 PID: 995 Comm: python3 Not tainted 5.16.0-rc5+ #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs]
Code: 41 5c 41 5d 41 5e e9 44 34 f0 e0 48 89 df e8 4c 77 ff ff 49 8b 86 10 01 00 00 48 85 c0 74 a1 4c 89 e7 ff d0 eb 9a 0f 0b eb c1 <0f> 0b be 04 00 00 00 48 89 df e8 b6 f6 ff ff e9 75 ff ff ff 90 0f
RSP: 0018:ffff8881533e3e78 EFLAGS: 00010287
RAX: ffff88811b2cf3e0 RBX: ffff888106209700 RCX: 0000000000000000
RDX: ffff888106209780 RSI: ffff8881533e3d30 RDI: ffff888109b101a0
RBP: 0000000000000001 R08: ffff888127cb381c R09: 0de9890000000009
R10: ffff888127cb3800 R11: 0000000000000000 R12: ffff888106209780
R13: ffff888106209750 R14: ffff888100f20660 R15: 0000000000000000
FS: 00007f8be353b740(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8bd5b117c0 CR3: 000000012cd8a004 CR4: 0000000000370ea0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ib_uverbs_close+0x1a/0x90 [ib_uverbs]
__fput+0x82/0x230
task_work_run+0x59/0x90
exit_to_user_mode_prepare+0x138/0x140
syscall_exit_to_user_mode+0x1d/0x50
? __x64_sys_close+0xe/0x40
do_syscall_64+0x4a/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f8be3ae0abb
Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 83 43 f9 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 c1 43 f9 ff 8b 44
RSP: 002b:00007ffdb51909c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000557bb7f7c020 RCX: 00007f8be3ae0abb
RDX: 0000557bb7c74010 RSI: 0000557bb7f14ca0 RDI: 0000000000000005
RBP: 0000557bb7fbd598 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000557bb7fbd5b8
R13: 0000557bb7fbd5a8 R14: 0000000000001000 R15: 0000557bb7f7c020
</TASK>
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Link: https://lore.kernel.org/r/c6df677f931d18090bafbe7f7dbb9524047b7d9b.1685953497.git.leon@kernel.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/qpc.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/qpc.c b/drivers/infiniband/hw/mlx5/qpc.c
index 542e4c63a8de6..d4e7864c56f18 100644
--- a/drivers/infiniband/hw/mlx5/qpc.c
+++ b/drivers/infiniband/hw/mlx5/qpc.c
@@ -297,8 +297,7 @@ int mlx5_core_destroy_qp(struct mlx5_ib_dev *dev, struct mlx5_core_qp *qp)
MLX5_SET(destroy_qp_in, in, opcode, MLX5_CMD_OP_DESTROY_QP);
MLX5_SET(destroy_qp_in, in, qpn, qp->qpn);
MLX5_SET(destroy_qp_in, in, uid, qp->uid);
- mlx5_cmd_exec_in(dev->mdev, destroy_qp, in);
- return 0;
+ return mlx5_cmd_exec_in(dev->mdev, destroy_qp, in);
}
int mlx5_core_set_delay_drop(struct mlx5_ib_dev *dev,
@@ -548,14 +547,14 @@ int mlx5_core_xrcd_dealloc(struct mlx5_ib_dev *dev, u32 xrcdn)
return mlx5_cmd_exec_in(dev->mdev, dealloc_xrcd, in);
}
-static void destroy_rq_tracked(struct mlx5_ib_dev *dev, u32 rqn, u16 uid)
+static int destroy_rq_tracked(struct mlx5_ib_dev *dev, u32 rqn, u16 uid)
{
u32 in[MLX5_ST_SZ_DW(destroy_rq_in)] = {};
MLX5_SET(destroy_rq_in, in, opcode, MLX5_CMD_OP_DESTROY_RQ);
MLX5_SET(destroy_rq_in, in, rqn, rqn);
MLX5_SET(destroy_rq_in, in, uid, uid);
- mlx5_cmd_exec_in(dev->mdev, destroy_rq, in);
+ return mlx5_cmd_exec_in(dev->mdev, destroy_rq, in);
}
int mlx5_core_create_rq_tracked(struct mlx5_ib_dev *dev, u32 *in, int inlen,
@@ -586,8 +585,7 @@ int mlx5_core_destroy_rq_tracked(struct mlx5_ib_dev *dev,
struct mlx5_core_qp *rq)
{
destroy_resource_common(dev, rq);
- destroy_rq_tracked(dev, rq->qpn, rq->uid);
- return 0;
+ return destroy_rq_tracked(dev, rq->qpn, rq->uid);
}
static void destroy_sq_tracked(struct mlx5_ib_dev *dev, u32 sqn, u16 uid)
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 034/194] drm/amd/display: Skip DPP DTO update if root clock is gated
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 033/194] RDMA/mlx5: Return the firmware result upon destroying QP/RQ Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 035/194] drm/amd/display: Enable dcn314 DPP RCO Greg Kroah-Hartman
` (170 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stylon Wang, Nicholas Kazlauskas,
Jun Lei, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
[ Upstream commit 30f90f3c1c2c63c2fa44f61233737d27b72637c2 ]
[Why]
Hardware implements root clock gating by utilizing the DPP DTO registers
with a special case of DTO enabled, phase = 0, modulo = 1. This
conflicts with our policy to always update the DPPDTO for cases where
it's expected to be disabled.
The pipes unexpectedly enter a higher power state than expected because
of this programming flow.
[How]
Guard the upper layers of HWSS against this hardware quirk with
programming the register with an internal state flag in DCCG.
While technically acting as global state for the DCCG, HWSS shouldn't be
expected to understand the hardware quirk for having DTO disabled
causing more power than DTO enabled with this specific setting.
This also prevents sequencing errors from occuring in the future if
we have to program DPP DTO in multiple locations.
Acked-by: Stylon Wang <stylon.wang@amd.com>
Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Reviewed-by: Jun Lei <jun.lei@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c | 8 ++++++++
drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 5 +++++
drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h | 1 +
3 files changed, 14 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c
index 7d2b982506fd7..cef32a1f91cdc 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c
@@ -47,6 +47,14 @@ void dccg31_update_dpp_dto(struct dccg *dccg, int dpp_inst, int req_dppclk)
{
struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);
+ if (dccg->dpp_clock_gated[dpp_inst]) {
+ /*
+ * Do not update the DPPCLK DTO if the clock is stopped.
+ * It is treated the same as if the pipe itself were in PG.
+ */
+ return;
+ }
+
if (dccg->ref_dppclk && req_dppclk) {
int ref_dppclk = dccg->ref_dppclk;
int modulo, phase;
diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c
index 85ea3334355c2..97c6a79dfba66 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c
@@ -296,6 +296,9 @@ static void dccg314_dpp_root_clock_control(
{
struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);
+ if (dccg->dpp_clock_gated[dpp_inst] == clock_on)
+ return;
+
if (clock_on) {
/* turn off the DTO and leave phase/modulo at max */
REG_UPDATE(DPPCLK_DTO_CTRL, DPPCLK_DTO_ENABLE[dpp_inst], 0);
@@ -309,6 +312,8 @@ static void dccg314_dpp_root_clock_control(
DPPCLK0_DTO_PHASE, 0,
DPPCLK0_DTO_MODULO, 1);
}
+
+ dccg->dpp_clock_gated[dpp_inst] = !clock_on;
}
static const struct dccg_funcs dccg314_funcs = {
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h b/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h
index ad6acd1b34e1d..9651cccb084a3 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h
@@ -68,6 +68,7 @@ struct dccg {
const struct dccg_funcs *funcs;
int pipe_dppclk_khz[MAX_PIPES];
int ref_dppclk;
+ bool dpp_clock_gated[MAX_PIPES];
//int dtbclk_khz[MAX_PIPES];/* TODO needs to be removed */
//int audio_dtbclk_khz;/* TODO needs to be removed */
//int ref_dtbclk_khz;/* TODO needs to be removed */
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 035/194] drm/amd/display: Enable dcn314 DPP RCO
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 034/194] drm/amd/display: Skip DPP DTO update if root clock is gated Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 036/194] ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown() Greg Kroah-Hartman
` (169 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stylon Wang, Daniel Miess, Jun Lei,
Daniel Wheeler, Alex Deucher, Sasha Levin
From: Daniel Miess <daniel.miess@amd.com>
[ Upstream commit 17fbdbda9cc87ff5a013898de506212d25323ed7 ]
[Why and How]
Add back debug bits enabling RCO for dcn314 as underflow
associated with this change has been resolved
Acked-by: Stylon Wang <stylon.wang@amd.com>
Signed-off-by: Daniel Miess <daniel.miess@amd.com>
Reviewed-by: Jun Lei <jun.lei@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/display/dc/dcn314/dcn314_resource.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
index b7782433ce6ba..012f6369dae22 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
@@ -920,6 +920,22 @@ static const struct dc_debug_options debug_defaults_drv = {
.afmt = true,
}
},
+
+ .root_clock_optimization = {
+ .bits = {
+ .dpp = true,
+ .dsc = false,
+ .hdmistream = false,
+ .hdmichar = false,
+ .dpstream = false,
+ .symclk32_se = false,
+ .symclk32_le = false,
+ .symclk_fe = false,
+ .physymclk = false,
+ .dpiasymclk = false,
+ }
+ },
+
.seamless_boot_odm_combine = true
};
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 036/194] ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 035/194] drm/amd/display: Enable dcn314 DPP RCO Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 037/194] HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID Greg Kroah-Hartman
` (168 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kai Vehmanen, Daniel Baluta,
Ranjani Sridharan, Rander Wang, Bard Liao, Peter Ujfalusi,
Pierre-Louis Bossart, Mark Brown, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit d389dcb3a48cec4f03c16434c0bf98a4c635372a ]
The shutdown is called on reboot/shutdown of the machine.
At this point the firmware tracing cannot be used anymore but in case of
IPC3 it is using and keeping a DMA channel active (dtrace).
For Tiger Lake platforms we have a quirk in place to fix rare reboot issues
when a DMA was active before rebooting the system.
If the tracing is enabled this quirk will be always used and a print
appears on the kernel log which might be misleading or not even correct.
Release the fw tracing before executing the shutdown to make sure that this
known DMA user is cleared away.
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20230616100039.378150-4-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/soc/sof/core.c b/sound/soc/sof/core.c
index 625977a29d8a8..75a1e2c6539f2 100644
--- a/sound/soc/sof/core.c
+++ b/sound/soc/sof/core.c
@@ -479,8 +479,10 @@ int snd_sof_device_shutdown(struct device *dev)
if (IS_ENABLED(CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE))
cancel_work_sync(&sdev->probe_work);
- if (sdev->fw_state == SOF_FW_BOOT_COMPLETE)
+ if (sdev->fw_state == SOF_FW_BOOT_COMPLETE) {
+ sof_fw_trace_free(sdev);
return snd_sof_shutdown(sdev);
+ }
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 037/194] HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 036/194] ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown() Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 038/194] ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio Greg Kroah-Hartman
` (167 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Even Xu, Srinivas Pandruvada,
Jiri Kosina, Sasha Levin
From: Even Xu <even.xu@intel.com>
[ Upstream commit 4982126e3029cd59fbd1da0d9cc0365a0585fe64 ]
Add device ID of Arrow Lake-H into ishtp support list.
Signed-off-by: Even Xu <even.xu@intel.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/intel-ish-hid/ipc/hw-ish.h | 1 +
drivers/hid/intel-ish-hid/ipc/pci-ish.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/hid/intel-ish-hid/ipc/hw-ish.h b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
index fc108f19a64c3..e99f3a3c65e15 100644
--- a/drivers/hid/intel-ish-hid/ipc/hw-ish.h
+++ b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
@@ -33,6 +33,7 @@
#define ADL_N_DEVICE_ID 0x54FC
#define RPL_S_DEVICE_ID 0x7A78
#define MTL_P_DEVICE_ID 0x7E45
+#define ARL_H_DEVICE_ID 0x7745
#define REVISION_ID_CHT_A0 0x6
#define REVISION_ID_CHT_Ax_SI 0x0
diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
index 7120b30ac51d0..55cb25038e632 100644
--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
@@ -44,6 +44,7 @@ static const struct pci_device_id ish_pci_tbl[] = {
{PCI_DEVICE(PCI_VENDOR_ID_INTEL, ADL_N_DEVICE_ID)},
{PCI_DEVICE(PCI_VENDOR_ID_INTEL, RPL_S_DEVICE_ID)},
{PCI_DEVICE(PCI_VENDOR_ID_INTEL, MTL_P_DEVICE_ID)},
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, ARL_H_DEVICE_ID)},
{0, }
};
MODULE_DEVICE_TABLE(pci, ish_pci_tbl);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 038/194] ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 037/194] HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 039/194] smb: client: fix warning in cifs_smb3_do_mount() Greg Kroah-Hartman
` (166 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Anderson, Philip Mueller,
Takashi Iwai, Sasha Levin
From: Matthew Anderson <ruinairas1992@gmail.com>
[ Upstream commit 724418b84e6248cd27599607b7e5fac365b8e3f5 ]
This requires a patched ACPI table or a firmware from ASUS to work because
the system does not come with the _DSD field for the CSC3551.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217550
Signed-off-by: Matthew Anderson <ruinairas1992@gmail.com>
Tested-by: Philip Mueller <philm@manjaro.org>
Link: https://lore.kernel.org/r/20230621161714.9442-1-ruinairas1992@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 46 +++++++++++++++++++++++++++++++++++
1 file changed, 46 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f93b68a2a8393..f3c5940b032ff 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7136,6 +7136,10 @@ enum {
ALC294_FIXUP_ASUS_DUAL_SPK,
ALC285_FIXUP_THINKPAD_X1_GEN7,
ALC285_FIXUP_THINKPAD_HEADSET_JACK,
+ ALC294_FIXUP_ASUS_ALLY,
+ ALC294_FIXUP_ASUS_ALLY_PINS,
+ ALC294_FIXUP_ASUS_ALLY_VERBS,
+ ALC294_FIXUP_ASUS_ALLY_SPEAKER,
ALC294_FIXUP_ASUS_HPE,
ALC294_FIXUP_ASUS_COEF_1B,
ALC294_FIXUP_ASUS_GX502_HP,
@@ -8450,6 +8454,47 @@ static const struct hda_fixup alc269_fixups[] = {
.chained = true,
.chain_id = ALC294_FIXUP_SPK2_TO_DAC1
},
+ [ALC294_FIXUP_ASUS_ALLY] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = cs35l41_fixup_i2c_two,
+ .chained = true,
+ .chain_id = ALC294_FIXUP_ASUS_ALLY_PINS
+ },
+ [ALC294_FIXUP_ASUS_ALLY_PINS] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x03a11050 },
+ { 0x1a, 0x03a11c30 },
+ { 0x21, 0x03211420 },
+ { }
+ },
+ .chained = true,
+ .chain_id = ALC294_FIXUP_ASUS_ALLY_VERBS
+ },
+ [ALC294_FIXUP_ASUS_ALLY_VERBS] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x45 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x5089 },
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x46 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x0004 },
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x47 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0xa47a },
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x49 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x0049},
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x4a },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x201b },
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x6b },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x4278},
+ { }
+ },
+ .chained = true,
+ .chain_id = ALC294_FIXUP_ASUS_ALLY_SPEAKER
+ },
+ [ALC294_FIXUP_ASUS_ALLY_SPEAKER] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_speaker2_to_dac1,
+ },
[ALC285_FIXUP_THINKPAD_X1_GEN7] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc285_fixup_thinkpad_x1_gen7,
@@ -9562,6 +9607,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS),
SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK),
+ SND_PCI_QUIRK(0x1043, 0x17f3, "ROG Ally RC71L_RC71L", ALC294_FIXUP_ASUS_ALLY),
SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS),
SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC),
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 039/194] smb: client: fix warning in cifs_smb3_do_mount()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 038/194] ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 040/194] cifs: fix session state check in reconnect to avoid use-after-free issue Greg Kroah-Hartman
` (165 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (SUSE), Steve French,
Sasha Levin
From: Paulo Alcantara <pc@manguebit.com>
[ Upstream commit 12c30f33cc6769bf411088a2872843c4f9ea32f9 ]
This fixes the following warning reported by kernel test robot
fs/smb/client/cifsfs.c:982 cifs_smb3_do_mount() warn: possible
memory leak of 'cifs_sb'
Link: https://lore.kernel.org/all/202306170124.CtQqzf0I-lkp@intel.com/
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/cifsfs.c | 28 ++++++++++------------------
1 file changed, 10 insertions(+), 18 deletions(-)
diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c
index 078df1e2dd18a..18d66497c42d1 100644
--- a/fs/smb/client/cifsfs.c
+++ b/fs/smb/client/cifsfs.c
@@ -883,11 +883,11 @@ struct dentry *
cifs_smb3_do_mount(struct file_system_type *fs_type,
int flags, struct smb3_fs_context *old_ctx)
{
- int rc;
- struct super_block *sb = NULL;
- struct cifs_sb_info *cifs_sb = NULL;
struct cifs_mnt_data mnt_data;
+ struct cifs_sb_info *cifs_sb;
+ struct super_block *sb;
struct dentry *root;
+ int rc;
/*
* Prints in Kernel / CIFS log the attempted mount operation
@@ -898,11 +898,9 @@ cifs_smb3_do_mount(struct file_system_type *fs_type,
else
cifs_info("Attempting to mount %s\n", old_ctx->UNC);
- cifs_sb = kzalloc(sizeof(struct cifs_sb_info), GFP_KERNEL);
- if (cifs_sb == NULL) {
- root = ERR_PTR(-ENOMEM);
- goto out;
- }
+ cifs_sb = kzalloc(sizeof(*cifs_sb), GFP_KERNEL);
+ if (!cifs_sb)
+ return ERR_PTR(-ENOMEM);
cifs_sb->ctx = kzalloc(sizeof(struct smb3_fs_context), GFP_KERNEL);
if (!cifs_sb->ctx) {
@@ -945,10 +943,8 @@ cifs_smb3_do_mount(struct file_system_type *fs_type,
sb = sget(fs_type, cifs_match_super, cifs_set_super, flags, &mnt_data);
if (IS_ERR(sb)) {
- root = ERR_CAST(sb);
cifs_umount(cifs_sb);
- cifs_sb = NULL;
- goto out;
+ return ERR_CAST(sb);
}
if (sb->s_root) {
@@ -979,13 +975,9 @@ cifs_smb3_do_mount(struct file_system_type *fs_type,
deactivate_locked_super(sb);
return root;
out:
- if (cifs_sb) {
- if (!sb || IS_ERR(sb)) { /* otherwise kill_sb will handle */
- kfree(cifs_sb->prepath);
- smb3_cleanup_fs_context(cifs_sb->ctx);
- kfree(cifs_sb);
- }
- }
+ kfree(cifs_sb->prepath);
+ smb3_cleanup_fs_context(cifs_sb->ctx);
+ kfree(cifs_sb);
return root;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 040/194] cifs: fix session state check in reconnect to avoid use-after-free issue
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 039/194] smb: client: fix warning in cifs_smb3_do_mount() Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 041/194] serial: stm32: Ignore return value of uart_remove_one_port() in .remove() Greg Kroah-Hartman
` (164 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Winston Wen, Shyam Prasad N,
Steve French, Sasha Levin
From: Winston Wen <wentao@uniontech.com>
[ Upstream commit 99f280700b4cc02d5f141b8d15f8e9fad0418f65 ]
Don't collect exiting session in smb2_reconnect_server(), because it
will be released soon.
Note that the exiting session will stay in server->smb_ses_list until
it complete the cifs_free_ipc() and logoff() and then delete itself
from the list.
Signed-off-by: Winston Wen <wentao@uniontech.com>
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2pdu.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index 3ca593cdda76e..ba46156e32680 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -3841,6 +3841,12 @@ void smb2_reconnect_server(struct work_struct *work)
spin_lock(&cifs_tcp_ses_lock);
list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
+ spin_lock(&ses->ses_lock);
+ if (ses->ses_status == SES_EXITING) {
+ spin_unlock(&ses->ses_lock);
+ continue;
+ }
+ spin_unlock(&ses->ses_lock);
tcon_selected = false;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 041/194] serial: stm32: Ignore return value of uart_remove_one_port() in .remove()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 040/194] cifs: fix session state check in reconnect to avoid use-after-free issue Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 042/194] led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops Greg Kroah-Hartman
` (163 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König, Sasha Levin
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 6bd6cd29c92401a101993290051fa55078238a52 ]
Returning early from stm32_usart_serial_remove() results in a resource
leak as several cleanup functions are not called. The driver core ignores
the return value and there is no possibility to clean up later.
uart_remove_one_port() only returns non-zero if there is some
inconsistency (i.e. stm32_usart_driver.state[port->line].uart_port == NULL).
This should never happen, and even if it does it's a bad idea to exit
early in the remove callback without cleaning up.
This prepares changing the prototype of struct platform_driver::remove to
return void. See commit 5c5a7680e67b ("platform: Provide a remove callback
that returns no value") for further details about this quest.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20230512173810.131447-2-u.kleine-koenig@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/stm32-usart.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 28edbaf7bb329..2a9c4058824a8 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -1753,13 +1753,10 @@ static int stm32_usart_serial_remove(struct platform_device *pdev)
struct uart_port *port = platform_get_drvdata(pdev);
struct stm32_port *stm32_port = to_stm32_port(port);
const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
- int err;
u32 cr3;
pm_runtime_get_sync(&pdev->dev);
- err = uart_remove_one_port(&stm32_usart_driver, port);
- if (err)
- return(err);
+ uart_remove_one_port(&stm32_usart_driver, port);
pm_runtime_disable(&pdev->dev);
pm_runtime_set_suspended(&pdev->dev);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 042/194] led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 041/194] serial: stm32: Ignore return value of uart_remove_one_port() in .remove() Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 043/194] media: v4l2-mem2mem: add lock to protect parameter num_rdy Greg Kroah-Hartman
` (162 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lu Hongfei, Lee Jones, Sasha Levin
From: Lu Hongfei <luhongfei@vivo.com>
[ Upstream commit 8f38f8fa7261819eb7d4fb369dc3bfab72259033 ]
Ensure child node references are decremented properly in the error path.
Signed-off-by: Lu Hongfei <luhongfei@vivo.com>
Link: https://lore.kernel.org/r/20230525111705.3055-1-luhongfei@vivo.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/rgb/leds-qcom-lpg.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/leds/rgb/leds-qcom-lpg.c b/drivers/leds/rgb/leds-qcom-lpg.c
index f1c2419334e6f..f85a5d65d1314 100644
--- a/drivers/leds/rgb/leds-qcom-lpg.c
+++ b/drivers/leds/rgb/leds-qcom-lpg.c
@@ -1112,8 +1112,10 @@ static int lpg_add_led(struct lpg *lpg, struct device_node *np)
i = 0;
for_each_available_child_of_node(np, child) {
ret = lpg_parse_channel(lpg, child, &led->channels[i]);
- if (ret < 0)
+ if (ret < 0) {
+ of_node_put(child);
return ret;
+ }
info[i].color_index = led->channels[i]->color;
info[i].intensity = 0;
@@ -1291,8 +1293,10 @@ static int lpg_probe(struct platform_device *pdev)
for_each_available_child_of_node(pdev->dev.of_node, np) {
ret = lpg_add_led(lpg, np);
- if (ret)
+ if (ret) {
+ of_node_put(np);
return ret;
+ }
}
for (i = 0; i < lpg->num_channels; i++)
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 043/194] media: v4l2-mem2mem: add lock to protect parameter num_rdy
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 042/194] led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 044/194] media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250 Greg Kroah-Hartman
` (161 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pina Chen, Yunfei Dong, Hans Verkuil,
Sasha Levin
From: Yunfei Dong <yunfei.dong@mediatek.com>
[ Upstream commit 56b5c3e67b0f9af3f45cf393be048ee8d8a92694 ]
Getting below error when using KCSAN to check the driver. Adding lock to
protect parameter num_rdy when getting the value with function:
v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready.
kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue
kworker/u16:3: [name:report&]
kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7:
kworker/u16:3: v4l2_m2m_buf_queue+0xd8/0x10c
Signed-off-by: Pina Chen <pina.chen@mediatek.com>
Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/media/v4l2-mem2mem.h | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h
index bb9de6a899e07..d6c8eb2b52019 100644
--- a/include/media/v4l2-mem2mem.h
+++ b/include/media/v4l2-mem2mem.h
@@ -593,7 +593,14 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx,
static inline
unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)
{
- return m2m_ctx->out_q_ctx.num_rdy;
+ unsigned int num_buf_rdy;
+ unsigned long flags;
+
+ spin_lock_irqsave(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
+ num_buf_rdy = m2m_ctx->out_q_ctx.num_rdy;
+ spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
+
+ return num_buf_rdy;
}
/**
@@ -605,7 +612,14 @@ unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)
static inline
unsigned int v4l2_m2m_num_dst_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)
{
- return m2m_ctx->cap_q_ctx.num_rdy;
+ unsigned int num_buf_rdy;
+ unsigned long flags;
+
+ spin_lock_irqsave(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
+ num_buf_rdy = m2m_ctx->cap_q_ctx.num_rdy;
+ spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
+
+ return num_buf_rdy;
}
/**
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 044/194] media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 043/194] media: v4l2-mem2mem: add lock to protect parameter num_rdy Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 045/194] usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push Greg Kroah-Hartman
` (160 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrey Konovalov, Bryan ODonoghue,
Hans Verkuil, Sasha Levin
From: Andrey Konovalov <andrey.konovalov@linaro.org>
[ Upstream commit d5b7eb477c286f6ceccbb38704136eea0e6b09ca ]
>From the experiments with camera sensors using SGRBG10_1X10/3280x2464 and
SRGGB10_1X10/3280x2464 formats, it becomes clear that on sdm845 and sm8250
VFE outputs the lines padded to a length multiple of 16 bytes. As in the
current driver the value of the bpl_alignment is set to 8 bytes, the frames
captured in formats with the bytes-per-line value being not a multiple of
16 get corrupted.
Set the bpl_alignment of the camss video output device to 16 for sdm845 and
sm8250 to fix that.
Signed-off-by: Andrey Konovalov <andrey.konovalov@linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/camss/camss-vfe.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
index a26e4a5d87b6b..d8cd9b09c20de 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe.c
@@ -1540,7 +1540,11 @@ int msm_vfe_register_entities(struct vfe_device *vfe,
}
video_out->ops = &vfe->video_ops;
- video_out->bpl_alignment = 8;
+ if (vfe->camss->version == CAMSS_845 ||
+ vfe->camss->version == CAMSS_8250)
+ video_out->bpl_alignment = 16;
+ else
+ video_out->bpl_alignment = 8;
video_out->line_based = 0;
if (i == VFE_LINE_PIX) {
video_out->bpl_alignment = 16;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 045/194] usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 044/194] media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250 Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 046/194] usb: gadget: uvc: queue empty isoc requests if no video buffer is available Greg Kroah-Hartman
` (159 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Prashanth K, Sasha Levin
From: Prashanth K <quic_prashk@quicinc.com>
[ Upstream commit e5990469943c711cb00bfde6338d2add6c6d0bfe ]
When serial console over USB is enabled, gs_console_connect
queues gs_console_work, where it acquires the spinlock and
queues the usb request, and this request goes to gadget layer.
Now consider a situation where gadget layer prints something
to dmesg, this will eventually call gs_console_write() which
requires cons->lock. And this causes spinlock recursion. Avoid
this by excluding usb_ep_queue from the spinlock.
spin_lock_irqsave //needs cons->lock
gs_console_write
.
.
_printk
__warn_printk
dev_warn/pr_err
.
.
[USB Gadget Layer]
.
.
usb_ep_queue
gs_console_work
__gs_console_push // acquires cons->lock
process_one_work
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Link: https://lore.kernel.org/r/1683638872-6885-1-git-send-email-quic_prashk@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/u_serial.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index ea2c5b6cde8cd..3c51355ccc94d 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -915,8 +915,11 @@ static void __gs_console_push(struct gs_console *cons)
}
req->length = size;
+
+ spin_unlock_irq(&cons->lock);
if (usb_ep_queue(ep, req, GFP_ATOMIC))
req->length = 0;
+ spin_lock_irq(&cons->lock);
}
static void gs_console_work(struct work_struct *work)
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 046/194] usb: gadget: uvc: queue empty isoc requests if no video buffer is available
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 045/194] usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 047/194] media: platform: mediatek: vpu: fix NULL ptr dereference Greg Kroah-Hartman
` (158 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Avichal Rakesh, Sasha Levin
From: Avichal Rakesh <arakesh@google.com>
[ Upstream commit c3ff12a92bd7072170978b8b41c2fa41b038139a ]
ISOC transfers expect a certain cadence of requests being queued. Not
keeping up with the expected rate of requests results in missed ISOC
transfers (EXDEV). The application layer may or may not produce video
frames to match this expectation, so uvc gadget driver must handle cases
where the application is not queuing up buffers fast enough to fulfill
ISOC requirements.
Currently, uvc gadget driver waits for new video buffer to become available
before queuing up usb requests. With this patch the gadget driver queues up
0 length usb requests whenever there are no video buffers available. The
USB controller's complete callback is used as the limiter for how quickly
the 0 length packets will be queued. Video buffers are still queued as
soon as they become available.
Link: https://lore.kernel.org/CAMHf4WKbi6KBPQztj9FA4kPvESc1fVKrC8G73-cs6tTeQby9=w@mail.gmail.com/
Signed-off-by: Avichal Rakesh <arakesh@google.com>
Link: https://lore.kernel.org/r/20230508231103.1621375-1-arakesh@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/uvc_video.c | 32 ++++++++++++++++++-------
1 file changed, 24 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index dd1c6b2ca7c6f..e81865978299c 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -386,6 +386,9 @@ static void uvcg_video_pump(struct work_struct *work)
struct uvc_buffer *buf;
unsigned long flags;
int ret;
+ bool buf_int;
+ /* video->max_payload_size is only set when using bulk transfer */
+ bool is_bulk = video->max_payload_size;
while (video->ep->enabled) {
/*
@@ -408,20 +411,35 @@ static void uvcg_video_pump(struct work_struct *work)
*/
spin_lock_irqsave(&queue->irqlock, flags);
buf = uvcg_queue_head(queue);
- if (buf == NULL) {
+
+ if (buf != NULL) {
+ video->encode(req, video, buf);
+ /* Always interrupt for the last request of a video buffer */
+ buf_int = buf->state == UVC_BUF_STATE_DONE;
+ } else if (!(queue->flags & UVC_QUEUE_DISCONNECTED) && !is_bulk) {
+ /*
+ * No video buffer available; the queue is still connected and
+ * we're traferring over ISOC. Queue a 0 length request to
+ * prevent missed ISOC transfers.
+ */
+ req->length = 0;
+ buf_int = false;
+ } else {
+ /*
+ * Either queue has been disconnected or no video buffer
+ * available to bulk transfer. Either way, stop processing
+ * further.
+ */
spin_unlock_irqrestore(&queue->irqlock, flags);
break;
}
- video->encode(req, video, buf);
-
/*
* With usb3 we have more requests. This will decrease the
* interrupt load to a quarter but also catches the corner
* cases, which needs to be handled.
*/
- if (list_empty(&video->req_free) ||
- buf->state == UVC_BUF_STATE_DONE ||
+ if (list_empty(&video->req_free) || buf_int ||
!(video->req_int_count %
DIV_ROUND_UP(video->uvc_num_requests, 4))) {
video->req_int_count = 0;
@@ -441,8 +459,7 @@ static void uvcg_video_pump(struct work_struct *work)
/* Endpoint now owns the request */
req = NULL;
- if (buf->state != UVC_BUF_STATE_DONE)
- video->req_int_count++;
+ video->req_int_count++;
}
if (!req)
@@ -527,4 +544,3 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)
V4L2_BUF_TYPE_VIDEO_OUTPUT, &video->mutex);
return 0;
}
-
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 047/194] media: platform: mediatek: vpu: fix NULL ptr dereference
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 046/194] usb: gadget: uvc: queue empty isoc requests if no video buffer is available Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 048/194] thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx() Greg Kroah-Hartman
` (157 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Yunfei Dong,
Mauro Carvalho Chehab, Sasha Levin
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit 3df55cd773e8603b623425cc97b05e542854ad27 ]
If pdev is NULL, then it is still dereferenced.
This fixes this smatch warning:
drivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_load_firmware() warn: address of NULL pointer 'pdev'
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: Yunfei Dong <yunfei.dong@mediatek.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/vpu/mtk_vpu.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
index 47b684b92f817..6beab9e86a22a 100644
--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
@@ -562,15 +562,17 @@ static int load_requested_vpu(struct mtk_vpu *vpu,
int vpu_load_firmware(struct platform_device *pdev)
{
struct mtk_vpu *vpu;
- struct device *dev = &pdev->dev;
+ struct device *dev;
struct vpu_run *run;
int ret;
if (!pdev) {
- dev_err(dev, "VPU platform device is invalid\n");
+ pr_err("VPU platform device is invalid\n");
return -EINVAL;
}
+ dev = &pdev->dev;
+
vpu = platform_get_drvdata(pdev);
run = &vpu->run;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 048/194] thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 047/194] media: platform: mediatek: vpu: fix NULL ptr dereference Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 049/194] usb: chipidea: imx: dont request QoS for imx8ulp Greg Kroah-Hartman
` (156 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mika Westerberg, Sasha Levin
From: Mika Westerberg <mika.westerberg@linux.intel.com>
[ Upstream commit 1402ba08abae5cfa583ff1a40b99c098a0532d41 ]
According to the USB4 retimer guide the correct order is immediately
after sending ENUMERATE_RETIMERS so update the code to follow this.
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thunderbolt/retimer.c | 29 +++++++++++++++++++++--------
1 file changed, 21 insertions(+), 8 deletions(-)
diff --git a/drivers/thunderbolt/retimer.c b/drivers/thunderbolt/retimer.c
index 9cc28197dbc45..edbd92435b41a 100644
--- a/drivers/thunderbolt/retimer.c
+++ b/drivers/thunderbolt/retimer.c
@@ -187,6 +187,21 @@ static ssize_t nvm_authenticate_show(struct device *dev,
return ret;
}
+static void tb_retimer_nvm_authenticate_status(struct tb_port *port, u32 *status)
+{
+ int i;
+
+ tb_port_dbg(port, "reading NVM authentication status of retimers\n");
+
+ /*
+ * Before doing anything else, read the authentication status.
+ * If the retimer has it set, store it for the new retimer
+ * device instance.
+ */
+ for (i = 1; i <= TB_MAX_RETIMER_INDEX; i++)
+ usb4_port_retimer_nvm_authenticate_status(port, i, &status[i]);
+}
+
static void tb_retimer_set_inbound_sbtx(struct tb_port *port)
{
int i;
@@ -455,18 +470,16 @@ int tb_retimer_scan(struct tb_port *port, bool add)
return ret;
/*
- * Enable sideband channel for each retimer. We can do this
- * regardless whether there is device connected or not.
+ * Immediately after sending enumerate retimers read the
+ * authentication status of each retimer.
*/
- tb_retimer_set_inbound_sbtx(port);
+ tb_retimer_nvm_authenticate_status(port, status);
/*
- * Before doing anything else, read the authentication status.
- * If the retimer has it set, store it for the new retimer
- * device instance.
+ * Enable sideband channel for each retimer. We can do this
+ * regardless whether there is device connected or not.
*/
- for (i = 1; i <= TB_MAX_RETIMER_INDEX; i++)
- usb4_port_retimer_nvm_authenticate_status(port, i, &status[i]);
+ tb_retimer_set_inbound_sbtx(port);
for (i = 1; i <= TB_MAX_RETIMER_INDEX; i++) {
/*
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 049/194] usb: chipidea: imx: dont request QoS for imx8ulp
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 048/194] thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx() Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 050/194] usb: chipidea: imx: add missing USB PHY DPDM wakeup setting Greg Kroah-Hartman
` (155 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xu Yang, Li Jun, Peter Chen,
Sasha Levin
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit 9a070e8e208995a9d638b538ed7abf28bd6ea6f0 ]
Use dedicated imx8ulp usb compatible to remove QoS request
since imx8ulp has no such limitation of imx7ulp: DMA will
not work if system enters idle.
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Message-ID: <20230530104007.1294702-2-xu.yang_2@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/chipidea/ci_hdrc_imx.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index 9ffcecd3058c1..60b4de0a4f76d 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -70,6 +70,10 @@ static const struct ci_hdrc_imx_platform_flag imx7ulp_usb_data = {
CI_HDRC_PMQOS,
};
+static const struct ci_hdrc_imx_platform_flag imx8ulp_usb_data = {
+ .flags = CI_HDRC_SUPPORTS_RUNTIME_PM,
+};
+
static const struct of_device_id ci_hdrc_imx_dt_ids[] = {
{ .compatible = "fsl,imx23-usb", .data = &imx23_usb_data},
{ .compatible = "fsl,imx28-usb", .data = &imx28_usb_data},
@@ -80,6 +84,7 @@ static const struct of_device_id ci_hdrc_imx_dt_ids[] = {
{ .compatible = "fsl,imx6ul-usb", .data = &imx6ul_usb_data},
{ .compatible = "fsl,imx7d-usb", .data = &imx7d_usb_data},
{ .compatible = "fsl,imx7ulp-usb", .data = &imx7ulp_usb_data},
+ { .compatible = "fsl,imx8ulp-usb", .data = &imx8ulp_usb_data},
{ /* sentinel */ }
};
MODULE_DEVICE_TABLE(of, ci_hdrc_imx_dt_ids);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 050/194] usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 049/194] usb: chipidea: imx: dont request QoS for imx8ulp Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 051/194] gfs2: Fix possible data races in gfs2_show_options() Greg Kroah-Hartman
` (154 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Jun, Xu Yang, Peter Chen,
Sasha Levin
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit 53d061c19dc4cb68409df6dc11c40389c8c42a75 ]
USB PHY DPDM wakeup bit is enabled by default, when USB wakeup
is not required(/sys/.../wakeup is disabled), this bit should be
disabled, otherwise we will have unexpected wakeup if do USB device
connect/disconnect while system sleep.
This bit can be enabled for both host and device mode.
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Message-ID: <20230517081907.3410465-3-xu.yang_2@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/chipidea/usbmisc_imx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
index bac0f5458cab9..2318c7906acdb 100644
--- a/drivers/usb/chipidea/usbmisc_imx.c
+++ b/drivers/usb/chipidea/usbmisc_imx.c
@@ -135,7 +135,7 @@
#define TXVREFTUNE0_MASK (0xf << 20)
#define MX6_USB_OTG_WAKEUP_BITS (MX6_BM_WAKEUP_ENABLE | MX6_BM_VBUS_WAKEUP | \
- MX6_BM_ID_WAKEUP)
+ MX6_BM_ID_WAKEUP | MX6SX_BM_DPDM_WAKEUP_EN)
struct usbmisc_ops {
/* It's called once when probe a usb device */
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 051/194] gfs2: Fix possible data races in gfs2_show_options()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 050/194] usb: chipidea: imx: add missing USB PHY DPDM wakeup setting Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 052/194] pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() Greg Kroah-Hartman
` (153 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, BassCheck, Tuo Li,
Andreas Gruenbacher, Sasha Levin
From: Tuo Li <islituo@gmail.com>
[ Upstream commit 6fa0a72cbbe45db4ed967a51f9e6f4e3afe61d20 ]
Some fields such as gt_logd_secs of the struct gfs2_tune are accessed
without holding the lock gt_spin in gfs2_show_options():
val = sdp->sd_tune.gt_logd_secs;
if (val != 30)
seq_printf(s, ",commit=%d", val);
And thus can cause data races when gfs2_show_options() and other functions
such as gfs2_reconfigure() are concurrently executed:
spin_lock(>->gt_spin);
gt->gt_logd_secs = newargs->ar_commit;
To fix these possible data races, the lock sdp->sd_tune.gt_spin is
acquired before accessing the fields of gfs2_tune and released after these
accesses.
Further changes by Andreas:
- Don't hold the spin lock over the seq_printf operations.
Reported-by: BassCheck <bass@buaa.edu.cn>
Signed-off-by: Tuo Li <islituo@gmail.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/super.c | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 9d27aa8bd2bc6..44c564f0bc622 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -981,7 +981,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root)
{
struct gfs2_sbd *sdp = root->d_sb->s_fs_info;
struct gfs2_args *args = &sdp->sd_args;
- int val;
+ unsigned int logd_secs, statfs_slow, statfs_quantum, quota_quantum;
+
+ spin_lock(&sdp->sd_tune.gt_spin);
+ logd_secs = sdp->sd_tune.gt_logd_secs;
+ quota_quantum = sdp->sd_tune.gt_quota_quantum;
+ statfs_quantum = sdp->sd_tune.gt_statfs_quantum;
+ statfs_slow = sdp->sd_tune.gt_statfs_slow;
+ spin_unlock(&sdp->sd_tune.gt_spin);
if (is_ancestor(root, sdp->sd_master_dir))
seq_puts(s, ",meta");
@@ -1036,17 +1043,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root)
}
if (args->ar_discard)
seq_puts(s, ",discard");
- val = sdp->sd_tune.gt_logd_secs;
- if (val != 30)
- seq_printf(s, ",commit=%d", val);
- val = sdp->sd_tune.gt_statfs_quantum;
- if (val != 30)
- seq_printf(s, ",statfs_quantum=%d", val);
- else if (sdp->sd_tune.gt_statfs_slow)
+ if (logd_secs != 30)
+ seq_printf(s, ",commit=%d", logd_secs);
+ if (statfs_quantum != 30)
+ seq_printf(s, ",statfs_quantum=%d", statfs_quantum);
+ else if (statfs_slow)
seq_puts(s, ",statfs_quantum=0");
- val = sdp->sd_tune.gt_quota_quantum;
- if (val != 60)
- seq_printf(s, ",quota_quantum=%d", val);
+ if (quota_quantum != 60)
+ seq_printf(s, ",quota_quantum=%d", quota_quantum);
if (args->ar_statfs_percent)
seq_printf(s, ",statfs_percent=%d", args->ar_statfs_percent);
if (args->ar_errors != GFS2_ERRORS_DEFAULT) {
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 052/194] pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 051/194] gfs2: Fix possible data races in gfs2_show_options() Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 053/194] thunderbolt: Add Intel Barlow Ridge PCI ID Greg Kroah-Hartman
` (152 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Armin Wolf, Sasha Levin
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit c85fd9422fe0f5d667305efb27f56d09eab120b0 ]
When nonstatic_release_resource_db() frees all resources associated
with an PCMCIA socket, it forgets to free socket_data too, causing
a memory leak observable with kmemleak:
unreferenced object 0xc28d1000 (size 64):
comm "systemd-udevd", pid 297, jiffies 4294898478 (age 194.484s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 f0 85 0e c3 00 00 00 00 ................
00 00 00 00 0c 10 8d c2 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffda4245>] __kmem_cache_alloc_node+0x2d7/0x4a0
[<7e51f0c8>] kmalloc_trace+0x31/0xa4
[<d52b4ca0>] nonstatic_init+0x24/0x1a4 [pcmcia_rsrc]
[<a2f13e08>] pcmcia_register_socket+0x200/0x35c [pcmcia_core]
[<a728be1b>] yenta_probe+0x4d8/0xa70 [yenta_socket]
[<c48fac39>] pci_device_probe+0x99/0x194
[<84b7c690>] really_probe+0x181/0x45c
[<8060fe6e>] __driver_probe_device+0x75/0x1f4
[<b9b76f43>] driver_probe_device+0x28/0xac
[<648b766f>] __driver_attach+0xeb/0x1e4
[<6e9659eb>] bus_for_each_dev+0x61/0xb4
[<25a669f3>] driver_attach+0x1e/0x28
[<d8671d6b>] bus_add_driver+0x102/0x20c
[<df0d323c>] driver_register+0x5b/0x120
[<942cd8a4>] __pci_register_driver+0x44/0x4c
[<e536027e>] __UNIQUE_ID___addressable_cleanup_module188+0x1c/0xfffff000 [iTCO_vendor_support]
Fix this by freeing socket_data too.
Tested on a Acer Travelmate 4002WLMi by manually binding/unbinding
the yenta_cardbus driver (yenta_socket).
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Message-ID: <20230512184529.5094-1-W_Armin@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pcmcia/rsrc_nonstatic.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index ad1141fddb4cc..8bda75990bce5 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -1053,6 +1053,8 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s)
q = p->next;
kfree(p);
}
+
+ kfree(data);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 053/194] thunderbolt: Add Intel Barlow Ridge PCI ID
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 052/194] pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 054/194] thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth Greg Kroah-Hartman
` (151 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengfei Xu, Mika Westerberg,
Sasha Levin
From: Mika Westerberg <mika.westerberg@linux.intel.com>
[ Upstream commit 6f14a210661ce03988ef4ed3c8402037c8e06539 ]
Intel Barlow Ridge is the first USB4 v2 controller from Intel. The
controller exposes standard USB4 PCI class ID in typical configurations,
however there is a way to configure it so that it uses a special class
ID to allow using s different driver than the Windows inbox one. For
this reason add the Barlow Ridge PCI ID to the Linux driver too so that
the driver can attach regardless of the class ID.
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thunderbolt/nhi.c | 2 ++
drivers/thunderbolt/nhi.h | 2 ++
2 files changed, 4 insertions(+)
diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
index 4a6a3802d7e51..288aaa05d0071 100644
--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -1479,6 +1479,8 @@ static struct pci_device_id nhi_ids[] = {
.driver_data = (kernel_ulong_t)&icl_nhi_ops },
{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTL_P_NHI1),
.driver_data = (kernel_ulong_t)&icl_nhi_ops },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) },
/* Any USB4 compliant host */
{ PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_USB4, ~0) },
diff --git a/drivers/thunderbolt/nhi.h b/drivers/thunderbolt/nhi.h
index b0718020c6f59..c15a0c46c9cff 100644
--- a/drivers/thunderbolt/nhi.h
+++ b/drivers/thunderbolt/nhi.h
@@ -75,6 +75,8 @@ extern const struct tb_nhi_ops icl_nhi_ops;
#define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_BRIDGE 0x15ef
#define PCI_DEVICE_ID_INTEL_ADL_NHI0 0x463e
#define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d
+#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781
+#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784
#define PCI_DEVICE_ID_INTEL_MTL_M_NHI0 0x7eb2
#define PCI_DEVICE_ID_INTEL_MTL_P_NHI0 0x7ec2
#define PCI_DEVICE_ID_INTEL_MTL_P_NHI1 0x7ec3
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 054/194] thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 053/194] thunderbolt: Add Intel Barlow Ridge PCI ID Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 055/194] firewire: net: fix use after free in fwnet_finish_incoming_packet() Greg Kroah-Hartman
` (150 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gil Fine, Mika Westerberg,
Sasha Levin
From: Mika Westerberg <mika.westerberg@linux.intel.com>
[ Upstream commit f2bfa944080dcbb8eb56259dfd2c07204cbee17e ]
Intel Barlow Ridge discrete USB4 host router has the same limitation as
the previous generations so make sure the USB3 bandwidth limitation
quirk is applied to Barlow Ridge too.
Signed-off-by: Gil Fine <gil.fine@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thunderbolt/nhi.h | 2 ++
drivers/thunderbolt/quirks.c | 8 ++++++++
2 files changed, 10 insertions(+)
diff --git a/drivers/thunderbolt/nhi.h b/drivers/thunderbolt/nhi.h
index c15a0c46c9cff..0f029ce758825 100644
--- a/drivers/thunderbolt/nhi.h
+++ b/drivers/thunderbolt/nhi.h
@@ -77,6 +77,8 @@ extern const struct tb_nhi_ops icl_nhi_ops;
#define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d
#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781
#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784
+#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE 0x5786
+#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_40G_BRIDGE 0x57a4
#define PCI_DEVICE_ID_INTEL_MTL_M_NHI0 0x7eb2
#define PCI_DEVICE_ID_INTEL_MTL_P_NHI0 0x7ec2
#define PCI_DEVICE_ID_INTEL_MTL_P_NHI1 0x7ec3
diff --git a/drivers/thunderbolt/quirks.c b/drivers/thunderbolt/quirks.c
index 1157b8869bcca..8c2ee431fcde8 100644
--- a/drivers/thunderbolt/quirks.c
+++ b/drivers/thunderbolt/quirks.c
@@ -74,6 +74,14 @@ static const struct tb_quirk tb_quirks[] = {
quirk_usb3_maximum_bandwidth },
{ 0x8087, PCI_DEVICE_ID_INTEL_MTL_P_NHI1, 0x0000, 0x0000,
quirk_usb3_maximum_bandwidth },
+ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI, 0x0000, 0x0000,
+ quirk_usb3_maximum_bandwidth },
+ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI, 0x0000, 0x0000,
+ quirk_usb3_maximum_bandwidth },
+ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE, 0x0000, 0x0000,
+ quirk_usb3_maximum_bandwidth },
+ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_40G_BRIDGE, 0x0000, 0x0000,
+ quirk_usb3_maximum_bandwidth },
/*
* CLx is not supported on AMD USB4 Yellow Carp and Pink Sardine platforms.
*/
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 055/194] firewire: net: fix use after free in fwnet_finish_incoming_packet()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 054/194] thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 056/194] watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub) Greg Kroah-Hartman
` (149 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Shurong, Takashi Sakamoto,
Sasha Levin
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit 3ff256751a2853e1ffaa36958ff933ccc98c6cb5 ]
The netif_rx() function frees the skb so we can't dereference it to
save the skb->len.
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Link: https://lore.kernel.org/r/tencent_3B3D24B66ED66A6BB73CC0E63C6A14E45109@qq.com
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firewire/net.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index af22be84034bb..a53eacebca339 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -479,7 +479,7 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
struct sk_buff *skb, u16 source_node_id,
bool is_broadcast, u16 ether_type)
{
- int status;
+ int status, len;
switch (ether_type) {
case ETH_P_ARP:
@@ -533,13 +533,15 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
}
skb->protocol = protocol;
}
+
+ len = skb->len;
status = netif_rx(skb);
if (status == NET_RX_DROP) {
net->stats.rx_errors++;
net->stats.rx_dropped++;
} else {
net->stats.rx_packets++;
- net->stats.rx_bytes += skb->len;
+ net->stats.rx_bytes += len;
}
return 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 056/194] watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 055/194] firewire: net: fix use after free in fwnet_finish_incoming_packet() Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 057/194] Bluetooth: L2CAP: Fix use-after-free Greg Kroah-Hartman
` (148 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuechao Zhao, Guenter Roeck,
Wim Van Sebroeck, Sasha Levin
From: Yuechao Zhao <yuechao.zhao@advantech.com.cn>
[ Upstream commit 009637de1f65cff452ad49554d1e8ef9fda99e43 ]
Add PCI_VENDOR_ID_HYGON(Hygon vendor id [0x1d94]) in this driver
Signed-off-by: Yuechao Zhao <yuechao.zhao@advantech.com.cn>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lkml.kernel.org/r/20230612031907.796461-1-a345351830@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/sp5100_tco.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c
index 14f8d8d90920f..2bd3dc25cb030 100644
--- a/drivers/watchdog/sp5100_tco.c
+++ b/drivers/watchdog/sp5100_tco.c
@@ -96,7 +96,7 @@ static enum tco_reg_layout tco_reg_layout(struct pci_dev *dev)
sp5100_tco_pci->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS &&
sp5100_tco_pci->revision >= AMD_ZEN_SMBUS_PCI_REV) {
return efch_mmio;
- } else if (dev->vendor == PCI_VENDOR_ID_AMD &&
+ } else if ((dev->vendor == PCI_VENDOR_ID_AMD || dev->vendor == PCI_VENDOR_ID_HYGON) &&
((dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
dev->revision >= 0x41) ||
(dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS &&
@@ -579,6 +579,8 @@ static const struct pci_device_id sp5100_tco_pci_tbl[] = {
PCI_ANY_ID, },
{ PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_KERNCZ_SMBUS, PCI_ANY_ID,
PCI_ANY_ID, },
+ { PCI_VENDOR_ID_HYGON, PCI_DEVICE_ID_AMD_KERNCZ_SMBUS, PCI_ANY_ID,
+ PCI_ANY_ID, },
{ 0, }, /* End of list */
};
MODULE_DEVICE_TABLE(pci, sp5100_tco_pci_tbl);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 057/194] Bluetooth: L2CAP: Fix use-after-free
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 056/194] watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub) Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 058/194] Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally Greg Kroah-Hartman
` (147 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhengping Jiang,
Luiz Augusto von Dentz, Jakub Kicinski, Sasha Levin
From: Zhengping Jiang <jiangzp@google.com>
[ Upstream commit f752a0b334bb95fe9b42ecb511e0864e2768046f ]
Fix potential use-after-free in l2cap_le_command_rej.
Signed-off-by: Zhengping Jiang <jiangzp@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 02fc9961464cf..a7899857aee5d 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6375,9 +6375,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
if (!chan)
goto done;
+ chan = l2cap_chan_hold_unless_zero(chan);
+ if (!chan)
+ goto done;
+
l2cap_chan_lock(chan);
l2cap_chan_del(chan, ECONNREFUSED);
l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
done:
mutex_unlock(&conn->chan_lock);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 058/194] Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 057/194] Bluetooth: L2CAP: Fix use-after-free Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 059/194] ceph: try to dump the msgs when decoding fails Greg Kroah-Hartman
` (146 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Anderson,
Luiz Augusto von Dentz, Jakub Kicinski, Sasha Levin
From: Matthew Anderson <ruinairas1992@gmail.com>
[ Upstream commit fa01eba11f0e57c767a5eab5291c7a01407a00be ]
Adding the device ID from the Asus Ally gets the bluetooth working
on the device.
Signed-off-by: Matthew Anderson <ruinairas1992@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index faad19b396d50..d6f405763c56f 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -600,6 +600,9 @@ static const struct usb_device_id blacklist_table[] = {
{ USB_DEVICE(0x0489, 0xe0d9), .driver_info = BTUSB_MEDIATEK |
BTUSB_WIDEBAND_SPEECH |
BTUSB_VALID_LE_STATES },
+ { USB_DEVICE(0x0489, 0xe0f5), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH |
+ BTUSB_VALID_LE_STATES },
{ USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK |
BTUSB_WIDEBAND_SPEECH |
BTUSB_VALID_LE_STATES },
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 059/194] ceph: try to dump the msgs when decoding fails
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 058/194] Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 060/194] drm/amdgpu: Fix potential fence use-after-free v2 Greg Kroah-Hartman
` (145 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiubo Li, Milind Changire,
Ilya Dryomov, Sasha Levin
From: Xiubo Li <xiubli@redhat.com>
[ Upstream commit 8b0da5c549ae63ba1debd92a350f90773cb4bfe7 ]
When the msgs are corrupted we need to dump them and then it will
be easier to dig what has happened and where the issue is.
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Milind Changire <mchangir@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mds_client.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index dcabe2783edfe..5399a9ea5b4f1 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -645,6 +645,7 @@ static int parse_reply_info(struct ceph_mds_session *s, struct ceph_msg *msg,
err = -EIO;
out_bad:
pr_err("mds parse_reply err %d\n", err);
+ ceph_msg_dump(msg);
return err;
}
@@ -3534,6 +3535,7 @@ static void handle_forward(struct ceph_mds_client *mdsc,
bad:
pr_err("mdsc_handle_forward decode error err=%d\n", err);
+ ceph_msg_dump(msg);
}
static int __decode_session_metadata(void **p, void *end,
@@ -5254,6 +5256,7 @@ void ceph_mdsc_handle_fsmap(struct ceph_mds_client *mdsc, struct ceph_msg *msg)
bad:
pr_err("error decoding fsmap %d. Shutting down mount.\n", err);
ceph_umount_begin(mdsc->fsc->sb);
+ ceph_msg_dump(msg);
err_out:
mutex_lock(&mdsc->mutex);
mdsc->mdsmap_err = err;
@@ -5322,6 +5325,7 @@ void ceph_mdsc_handle_mdsmap(struct ceph_mds_client *mdsc, struct ceph_msg *msg)
bad:
pr_err("error decoding mdsmap %d. Shutting down mount.\n", err);
ceph_umount_begin(mdsc->fsc->sb);
+ ceph_msg_dump(msg);
return;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 060/194] drm/amdgpu: Fix potential fence use-after-free v2
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 059/194] ceph: try to dump the msgs when decoding fails Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 061/194] fs/ntfs3: Enhance sanity check while generating attr_list Greg Kroah-Hartman
` (144 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, shanzhulig, Christian König,
Alex Deucher, Sasha Levin
From: shanzhulig <shanzhulig@gmail.com>
[ Upstream commit 2e54154b9f27262efd0cb4f903cc7d5ad1fe9628 ]
fence Decrements the reference count before exiting.
Avoid Race Vulnerabilities for fence use-after-free.
v2 (chk): actually fix the use after free and not just move it.
Signed-off-by: shanzhulig <shanzhulig@gmail.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 6d3d01c5f0a28..02a112d00d413 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -1607,15 +1607,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev,
continue;
r = dma_fence_wait_timeout(fence, true, timeout);
+ if (r > 0 && fence->error)
+ r = fence->error;
+
dma_fence_put(fence);
if (r < 0)
return r;
if (r == 0)
break;
-
- if (fence->error)
- return fence->error;
}
memset(wait, 0, sizeof(*wait));
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 061/194] fs/ntfs3: Enhance sanity check while generating attr_list
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 060/194] drm/amdgpu: Fix potential fence use-after-free v2 Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 062/194] fs: ntfs3: Fix possible null-pointer dereferences in mi_read() Greg Kroah-Hartman
` (143 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Edward Lo, Konstantin Komarov,
Sasha Levin
From: Edward Lo <loyuantsung@gmail.com>
[ Upstream commit fdec309c7672cbee4dc0229ee4cbb33c948a1bdd ]
ni_create_attr_list uses WARN_ON to catch error cases while generating
attribute list, which only prints out stack trace and may not be enough.
This repalces them with more proper error handling flow.
[ 59.666332] BUG: kernel NULL pointer dereference, address: 000000000000000e
[ 59.673268] #PF: supervisor read access in kernel mode
[ 59.678354] #PF: error_code(0x0000) - not-present page
[ 59.682831] PGD 8000000005ff1067 P4D 8000000005ff1067 PUD 7dee067 PMD 0
[ 59.688556] Oops: 0000 [#1] PREEMPT SMP KASAN PTI
[ 59.692642] CPU: 0 PID: 198 Comm: poc Tainted: G B W 6.2.0-rc1+ #4
[ 59.698868] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
[ 59.708795] RIP: 0010:ni_create_attr_list+0x505/0x860
[ 59.713657] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8
[ 59.731559] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282
[ 59.735691] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe
[ 59.741792] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0
[ 59.748423] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9
[ 59.754654] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180
[ 59.761552] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050
[ 59.768323] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000
[ 59.776027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 59.781395] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0
[ 59.787607] Call Trace:
[ 59.790271] <TASK>
[ 59.792488] ? __pfx_ni_create_attr_list+0x10/0x10
[ 59.797235] ? kernel_text_address+0xd3/0xe0
[ 59.800856] ? unwind_get_return_address+0x3e/0x60
[ 59.805101] ? __kasan_check_write+0x18/0x20
[ 59.809296] ? preempt_count_sub+0x1c/0xd0
[ 59.813421] ni_ins_attr_ext+0x52c/0x5c0
[ 59.817034] ? __pfx_ni_ins_attr_ext+0x10/0x10
[ 59.821926] ? __vfs_setxattr+0x121/0x170
[ 59.825718] ? __vfs_setxattr_noperm+0x97/0x300
[ 59.829562] ? __vfs_setxattr_locked+0x145/0x170
[ 59.833987] ? vfs_setxattr+0x137/0x2a0
[ 59.836732] ? do_setxattr+0xce/0x150
[ 59.839807] ? setxattr+0x126/0x140
[ 59.842353] ? path_setxattr+0x164/0x180
[ 59.845275] ? __x64_sys_setxattr+0x71/0x90
[ 59.848838] ? do_syscall_64+0x3f/0x90
[ 59.851898] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 59.857046] ? stack_depot_save+0x17/0x20
[ 59.860299] ni_insert_attr+0x1ba/0x420
[ 59.863104] ? __pfx_ni_insert_attr+0x10/0x10
[ 59.867069] ? preempt_count_sub+0x1c/0xd0
[ 59.869897] ? _raw_spin_unlock_irqrestore+0x2b/0x50
[ 59.874088] ? __create_object+0x3ae/0x5d0
[ 59.877865] ni_insert_resident+0xc4/0x1c0
[ 59.881430] ? __pfx_ni_insert_resident+0x10/0x10
[ 59.886355] ? kasan_save_alloc_info+0x1f/0x30
[ 59.891117] ? __kasan_kmalloc+0x8b/0xa0
[ 59.894383] ntfs_set_ea+0x90d/0xbf0
[ 59.897703] ? __pfx_ntfs_set_ea+0x10/0x10
[ 59.901011] ? kernel_text_address+0xd3/0xe0
[ 59.905308] ? __kernel_text_address+0x16/0x50
[ 59.909811] ? unwind_get_return_address+0x3e/0x60
[ 59.914898] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 59.920250] ? arch_stack_walk+0xa2/0x100
[ 59.924560] ? filter_irq_stacks+0x27/0x80
[ 59.928722] ntfs_setxattr+0x405/0x440
[ 59.932512] ? __pfx_ntfs_setxattr+0x10/0x10
[ 59.936634] ? kvmalloc_node+0x2d/0x120
[ 59.940378] ? kasan_save_stack+0x41/0x60
[ 59.943870] ? kasan_save_stack+0x2a/0x60
[ 59.947719] ? kasan_set_track+0x29/0x40
[ 59.951417] ? kasan_save_alloc_info+0x1f/0x30
[ 59.955733] ? __kasan_kmalloc+0x8b/0xa0
[ 59.959598] ? __kmalloc_node+0x68/0x150
[ 59.963163] ? kvmalloc_node+0x2d/0x120
[ 59.966490] ? vmemdup_user+0x2b/0xa0
[ 59.969060] __vfs_setxattr+0x121/0x170
[ 59.972456] ? __pfx___vfs_setxattr+0x10/0x10
[ 59.976008] __vfs_setxattr_noperm+0x97/0x300
[ 59.981562] __vfs_setxattr_locked+0x145/0x170
[ 59.986100] vfs_setxattr+0x137/0x2a0
[ 59.989964] ? __pfx_vfs_setxattr+0x10/0x10
[ 59.993616] ? __kasan_check_write+0x18/0x20
[ 59.997425] do_setxattr+0xce/0x150
[ 60.000304] setxattr+0x126/0x140
[ 60.002967] ? __pfx_setxattr+0x10/0x10
[ 60.006471] ? __virt_addr_valid+0xcb/0x140
[ 60.010461] ? __call_rcu_common.constprop.0+0x1c7/0x330
[ 60.016037] ? debug_smp_processor_id+0x1b/0x30
[ 60.021008] ? kasan_quarantine_put+0x5b/0x190
[ 60.025545] ? putname+0x84/0xa0
[ 60.027910] ? __kasan_slab_free+0x11e/0x1b0
[ 60.031483] ? putname+0x84/0xa0
[ 60.033986] ? preempt_count_sub+0x1c/0xd0
[ 60.036876] ? __mnt_want_write+0xae/0x100
[ 60.040738] ? mnt_want_write+0x8f/0x150
[ 60.044317] path_setxattr+0x164/0x180
[ 60.048096] ? __pfx_path_setxattr+0x10/0x10
[ 60.052096] ? strncpy_from_user+0x175/0x1c0
[ 60.056482] ? debug_smp_processor_id+0x1b/0x30
[ 60.059848] ? fpregs_assert_state_consistent+0x6b/0x80
[ 60.064557] __x64_sys_setxattr+0x71/0x90
[ 60.068892] do_syscall_64+0x3f/0x90
[ 60.072868] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 60.077523] RIP: 0033:0x7feaa86e4469
[ 60.080915] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088
[ 60.097353] RSP: 002b:00007ffdbd8311e8 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc
[ 60.103386] RAX: ffffffffffffffda RBX: 9461c5e290baac00 RCX: 00007feaa86e4469
[ 60.110322] RDX: 00007ffdbd831fe0 RSI: 00007ffdbd831305 RDI: 00007ffdbd831263
[ 60.116808] RBP: 00007ffdbd836180 R08: 0000000000000001 R09: 00007ffdbd836268
[ 60.123879] R10: 000000000000007d R11: 0000000000000286 R12: 0000000000400500
[ 60.130540] R13: 00007ffdbd836260 R14: 0000000000000000 R15: 0000000000000000
[ 60.136553] </TASK>
[ 60.138818] Modules linked in:
[ 60.141839] CR2: 000000000000000e
[ 60.144831] ---[ end trace 0000000000000000 ]---
[ 60.149058] RIP: 0010:ni_create_attr_list+0x505/0x860
[ 60.153975] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8
[ 60.172443] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282
[ 60.176246] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe
[ 60.182752] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0
[ 60.189949] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9
[ 60.196950] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180
[ 60.203671] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050
[ 60.209595] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000
[ 60.216299] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 60.222276] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0
Signed-off-by: Edward Lo <loyuantsung@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/frecord.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index b1b476fb7229b..dda13e1f1b330 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -874,6 +874,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
if (err)
goto out1;
+ err = -EINVAL;
/* Call mi_remove_attr() in reverse order to keep pointers 'arr_move' valid. */
while (to_free > 0) {
struct ATTRIB *b = arr_move[--nb];
@@ -882,7 +883,8 @@ int ni_create_attr_list(struct ntfs_inode *ni)
attr = mi_insert_attr(mi, b->type, Add2Ptr(b, name_off),
b->name_len, asize, name_off);
- WARN_ON(!attr);
+ if (!attr)
+ goto out1;
mi_get_ref(mi, &le_b[nb]->ref);
le_b[nb]->id = attr->id;
@@ -892,17 +894,20 @@ int ni_create_attr_list(struct ntfs_inode *ni)
attr->id = le_b[nb]->id;
/* Remove from primary record. */
- WARN_ON(!mi_remove_attr(NULL, &ni->mi, b));
+ if (!mi_remove_attr(NULL, &ni->mi, b))
+ goto out1;
if (to_free <= asize)
break;
to_free -= asize;
- WARN_ON(!nb);
+ if (!nb)
+ goto out1;
}
attr = mi_insert_attr(&ni->mi, ATTR_LIST, NULL, 0,
lsize + SIZEOF_RESIDENT, SIZEOF_RESIDENT);
- WARN_ON(!attr);
+ if (!attr)
+ goto out1;
attr->non_res = 0;
attr->flags = 0;
@@ -922,9 +927,10 @@ int ni_create_attr_list(struct ntfs_inode *ni)
kfree(ni->attr_list.le);
ni->attr_list.le = NULL;
ni->attr_list.size = 0;
+ return err;
out:
- return err;
+ return 0;
}
/*
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 062/194] fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 061/194] fs/ntfs3: Enhance sanity check while generating attr_list Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 063/194] fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted Greg Kroah-Hartman
` (142 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jia-Ju Bai, Konstantin Komarov,
Sasha Levin
From: Jia-Ju Bai <baijiaju@buaa.edu.cn>
[ Upstream commit 97498cd610c0d030a7bd49a7efad974790661162 ]
In a previous commit 2681631c2973 ("fs/ntfs3: Add null pointer check to
attr_load_runs_vcn"), ni can be NULL in attr_load_runs_vcn(), and thus it
should be checked before being used.
However, in the call stack of this commit, mft_ni in mi_read() is
aliased with ni in attr_load_runs_vcn(), and it is also used in
mi_read() at two places:
mi_read()
rw_lock = &mft_ni->file.run_lock -> No check
attr_load_runs_vcn(mft_ni, ...)
ni (namely mft_ni) is checked in the previous commit
attr_load_runs_vcn(..., &mft_ni->file.run) -> No check
Thus, to avoid possible null-pointer dereferences, the related checks
should be added.
These bugs are reported by a static analysis tool implemented by myself,
and they are found by extending a known bug fixed in the previous commit.
Thus, they could be theoretical bugs.
Signed-off-by: Jia-Ju Bai <baijiaju@buaa.edu.cn>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/record.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index af1e4b364ea8e..07037ec773ac8 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -124,7 +124,7 @@ int mi_read(struct mft_inode *mi, bool is_mft)
struct rw_semaphore *rw_lock = NULL;
if (is_mounted(sbi)) {
- if (!is_mft) {
+ if (!is_mft && mft_ni) {
rw_lock = &mft_ni->file.run_lock;
down_read(rw_lock);
}
@@ -148,7 +148,7 @@ int mi_read(struct mft_inode *mi, bool is_mft)
ni_lock(mft_ni);
down_write(rw_lock);
}
- err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, &mft_ni->file.run,
+ err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, run,
vbo >> sbi->cluster_bits);
if (rw_lock) {
up_write(rw_lock);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 063/194] fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 062/194] fs: ntfs3: Fix possible null-pointer dereferences in mi_read() Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 064/194] ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 Greg Kroah-Hartman
` (141 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konstantin Komarov, Sasha Levin
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit e0f363a98830e8d7d70fbaf91c07ae0b7c57aafe ]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fsntfs.c | 2 +-
fs/ntfs3/index.c | 6 ++++++
fs/ntfs3/ntfs_fs.h | 2 ++
fs/ntfs3/record.c | 6 ++++++
4 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
index b6e22bcb929ba..829b62d3bb889 100644
--- a/fs/ntfs3/fsntfs.c
+++ b/fs/ntfs3/fsntfs.c
@@ -154,7 +154,7 @@ int ntfs_fix_post_read(struct NTFS_RECORD_HEADER *rhdr, size_t bytes,
/* Check errors. */
if ((fo & 1) || fo + fn * sizeof(short) > SECTOR_SIZE || !fn-- ||
fn * SECTOR_SIZE > bytes) {
- return -EINVAL; /* Native chkntfs returns ok! */
+ return -E_NTFS_CORRUPT;
}
/* Get fixup pointer. */
diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 9e9a9ffd92958..495cfb37962fa 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1103,6 +1103,12 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn,
*node = in;
out:
+ if (err == -E_NTFS_CORRUPT) {
+ ntfs_inode_err(&ni->vfs_inode, "directory corrupted");
+ ntfs_set_state(ni->mi.sbi, NTFS_DIRTY_ERROR);
+ err = -EINVAL;
+ }
+
if (ib != in->index)
kfree(ib);
diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
index 24227b2e1b2b0..8c9abaf139e67 100644
--- a/fs/ntfs3/ntfs_fs.h
+++ b/fs/ntfs3/ntfs_fs.h
@@ -53,6 +53,8 @@ enum utf16_endian;
#define E_NTFS_NONRESIDENT 556
/* NTFS specific error code about punch hole. */
#define E_NTFS_NOTALIGNED 557
+/* NTFS specific error code when on-disk struct is corrupted. */
+#define E_NTFS_CORRUPT 558
/* sbi->flags */
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 07037ec773ac8..ba336c7280b85 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -180,6 +180,12 @@ int mi_read(struct mft_inode *mi, bool is_mft)
return 0;
out:
+ if (err == -E_NTFS_CORRUPT) {
+ ntfs_err(sbi->sb, "mft corrupted");
+ ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
+ err = -EINVAL;
+ }
+
return err;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 064/194] ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 063/194] fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 065/194] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() Greg Kroah-Hartman
` (140 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, dengxiang, Takashi Iwai, Sasha Levin
From: dengxiang <dengxiang@nfschina.com>
[ Upstream commit 73f1c75d5e6bd8ce2a887ef493a66ad1b16ed704 ]
These models use NSIWAY amplifiers for internal speaker, but cannot put
sound outside from these amplifiers. So eapd verbs are needed to initialize
the amplifiers. They can be added during boot to get working sound out
of internal speaker.
Signed-off-by: dengxiang <dengxiang@nfschina.com>
Link: https://lore.kernel.org/r/20230703021751.2945750-1-dengxiang@nfschina.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f3c5940b032ff..923b8e0c9efe3 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -11314,6 +11314,7 @@ enum {
ALC897_FIXUP_HP_HSMIC_VERB,
ALC897_FIXUP_LENOVO_HEADSET_MODE,
ALC897_FIXUP_HEADSET_MIC_PIN2,
+ ALC897_FIXUP_UNIS_H3C_X500S,
};
static const struct hda_fixup alc662_fixups[] = {
@@ -11753,6 +11754,13 @@ static const struct hda_fixup alc662_fixups[] = {
.chained = true,
.chain_id = ALC897_FIXUP_LENOVO_HEADSET_MODE
},
+ [ALC897_FIXUP_UNIS_H3C_X500S] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+ { 0x14, AC_VERB_SET_EAPD_BTLENABLE, 0 },
+ {}
+ },
+ },
};
static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -11914,6 +11922,7 @@ static const struct hda_model_fixup alc662_fixup_models[] = {
{.id = ALC662_FIXUP_USI_HEADSET_MODE, .name = "usi-headset"},
{.id = ALC662_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"},
{.id = ALC669_FIXUP_ACER_ASPIRE_ETHOS, .name = "aspire-ethos"},
+ {.id = ALC897_FIXUP_UNIS_H3C_X500S, .name = "unis-h3c-x500s"},
{}
};
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 065/194] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 064/194] ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 066/194] ALSA: hda/realtek: Add quirk for ASUS ROG GX650P Greg Kroah-Hartman
` (139 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, BassCheck, Tuo Li, Takashi Iwai,
Sasha Levin
From: Tuo Li <islituo@gmail.com>
[ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ]
The variable codec->regmap is often protected by the lock
codec->regmap_lock when is accessed. However, it is accessed without
holding the lock when is accessed in snd_hdac_regmap_sync():
if (codec->regmap)
In my opinion, this may be a harmful race, because if codec->regmap is
set to NULL right after the condition is checked, a null-pointer
dereference can occur in the called function regcache_sync():
map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c
To fix this possible null-pointer dereference caused by data race, the
mutex_lock coverage is extended to protect the if statement as well as the
function call to regcache_sync().
[ Note: the lack of the regmap_lock itself is harmless for the current
codec driver implementations, as snd_hdac_regmap_sync() is only for
PM runtime resume that is prohibited during the codec probe.
But the change makes the whole code more consistent, so it's merged
as is -- tiwai ]
Reported-by: BassCheck <bass@buaa.edu.cn>
Signed-off-by: Tuo Li <islituo@gmail.com>
Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/hdac_regmap.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c
index fe3587547cfec..39610a15bcc98 100644
--- a/sound/hda/hdac_regmap.c
+++ b/sound/hda/hdac_regmap.c
@@ -597,10 +597,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once);
*/
void snd_hdac_regmap_sync(struct hdac_device *codec)
{
- if (codec->regmap) {
- mutex_lock(&codec->regmap_lock);
+ mutex_lock(&codec->regmap_lock);
+ if (codec->regmap)
regcache_sync(codec->regmap);
- mutex_unlock(&codec->regmap_lock);
- }
+ mutex_unlock(&codec->regmap_lock);
}
EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 066/194] ALSA: hda/realtek: Add quirk for ASUS ROG GX650P
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 065/194] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 067/194] ALSA: hda/realtek: Add quirk for ASUS ROG GA402X Greg Kroah-Hartman
` (138 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luke D. Jones, Takashi Iwai,
Sasha Levin
From: Luke D. Jones <luke@ljones.dev>
[ Upstream commit 8cc87c055d28320e5fa5457922f43bc07dec58bd ]
Adds the required quirk to enable the Cirrus amp and correct pins
on the ASUS ROG GV601V series which uses an I2C connected Cirrus amp.
While this works if the related _DSD properties are made available, these
aren't included in the ACPI of these laptops (yet).
Signed-off-by: Luke D. Jones <luke@ljones.dev>
Link: https://lore.kernel.org/r/20230704044619.19343-2-luke@ljones.dev
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 923b8e0c9efe3..b290391314873 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7081,6 +7081,8 @@ enum {
ALC285_FIXUP_SPEAKER2_TO_DAC1,
ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1,
ALC285_FIXUP_ASUS_HEADSET_MIC,
+ ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1,
+ ALC285_FIXUP_ASUS_I2C_HEADSET_MIC,
ALC280_FIXUP_HP_HEADSET_MIC,
ALC221_FIXUP_HP_FRONT_MIC,
ALC292_FIXUP_TPT460,
@@ -8073,6 +8075,22 @@ static const struct hda_fixup alc269_fixups[] = {
.chained = true,
.chain_id = ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1
},
+ [ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_speaker2_to_dac1,
+ .chained = true,
+ .chain_id = ALC287_FIXUP_CS35L41_I2C_2
+ },
+ [ALC285_FIXUP_ASUS_I2C_HEADSET_MIC] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x03a11050 },
+ { 0x1b, 0x03a11c30 },
+ { }
+ },
+ .chained = true,
+ .chain_id = ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1
+ },
[ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
.type = HDA_FIXUP_PINS,
.v.pins = (const struct hda_pintbl[]) {
@@ -9598,6 +9616,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1043, 0x1313, "Asus K42JZ", ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+ SND_PCI_QUIRK(0x1043, 0x1433, "ASUS GX650P", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1473, "ASUS GU604V", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 067/194] ALSA: hda/realtek: Add quirk for ASUS ROG GA402X
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 066/194] ALSA: hda/realtek: Add quirk for ASUS ROG GX650P Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 068/194] ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V Greg Kroah-Hartman
` (137 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luke D. Jones, Takashi Iwai,
Sasha Levin
From: Luke D. Jones <luke@ljones.dev>
[ Upstream commit 9abc77fb144fe916fd2f592dc4b8c7bade02e58a ]
Adds the required quirk to enable the Cirrus amp and correct pins
on the ASUS ROG GA402X series which uses an I2C connected Cirrus amp.
While this works if the related _DSD properties are made available, these
aren't included in the ACPI of these laptops (yet).
Signed-off-by: Luke D. Jones <luke@ljones.dev>
Link: https://lore.kernel.org/r/20230704044619.19343-3-luke@ljones.dev
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b290391314873..b0cee0a361bfb 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9617,6 +9617,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
SND_PCI_QUIRK(0x1043, 0x1433, "ASUS GX650P", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1463, "Asus GA402X", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1473, "ASUS GU604V", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 068/194] ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 067/194] ALSA: hda/realtek: Add quirk for ASUS ROG GA402X Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 069/194] powerpc/kasan: Disable KCOV in KASAN code Greg Kroah-Hartman
` (136 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luke D. Jones, Takashi Iwai,
Sasha Levin
From: Luke D. Jones <luke@ljones.dev>
[ Upstream commit 5251605f4d297a0eb5d3b7f39f9dcee9e4d0115a ]
Adds the required quirk to enable the Cirrus amp and correct pins
on the ASUS ROG GZ301V series which uses an SPI connected Cirrus amp.
While this works if the related _DSD properties are made available, these
aren't included in the ACPI of these laptops (yet).
Signed-off-by: Luke D. Jones <luke@ljones.dev>
Link: https://lore.kernel.org/r/20230706223323.30871-2-luke@ljones.dev
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b0cee0a361bfb..526ec8cae9437 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9621,6 +9621,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1043, 0x1473, "ASUS GU604V", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301V", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK),
SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 069/194] powerpc/kasan: Disable KCOV in KASAN code
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 068/194] ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 070/194] Bluetooth: MGMT: Use correct address for memcpy() Greg Kroah-Hartman
` (135 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe Leroy, Benjamin Gray,
Michael Ellerman, Sasha Levin
From: Benjamin Gray <bgray@linux.ibm.com>
[ Upstream commit ccb381e1af1ace292153c88eb1fffa5683d16a20 ]
As per the generic KASAN code in mm/kasan, disable KCOV with
KCOV_INSTRUMENT := n in the makefile.
This fixes a ppc64 boot hang when KCOV and KASAN are enabled.
kasan_early_init() gets called before a PACA is initialised, but the
KCOV hook expects a valid PACA.
Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230710044143.146840-1-bgray@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/mm/kasan/Makefile | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/mm/kasan/Makefile b/arch/powerpc/mm/kasan/Makefile
index 699eeffd9f551..f9522fd70b2f3 100644
--- a/arch/powerpc/mm/kasan/Makefile
+++ b/arch/powerpc/mm/kasan/Makefile
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
KASAN_SANITIZE := n
+KCOV_INSTRUMENT := n
obj-$(CONFIG_PPC32) += init_32.o
obj-$(CONFIG_PPC_8xx) += 8xx.o
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 070/194] Bluetooth: MGMT: Use correct address for memcpy()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 069/194] powerpc/kasan: Disable KCOV in KASAN code Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 071/194] ring-buffer: Do not swap cpu_buffer during resize process Greg Kroah-Hartman
` (134 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko,
Luiz Augusto von Dentz, Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit d1f0a9816f5fbc1316355ec1aa4ddfb9b624cca5 ]
In function ‘fortify_memcpy_chk’,
inlined from ‘get_conn_info_complete’ at net/bluetooth/mgmt.c:7281:2:
include/linux/fortify-string.h:592:25: error: call to
‘__read_overflow2_field’ declared with attribute warning: detected read
beyond size of field (2nd parameter); maybe use struct_group()?
[-Werror=attribute-warning]
592 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
This is due to the wrong member is used for memcpy(). Use correct one.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/mgmt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 89c94f3e96bc3..d2e8565d0b33f 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -7277,7 +7277,7 @@ static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
bt_dev_dbg(hdev, "err %d", err);
- memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
+ memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
status = mgmt_status(err);
if (status == MGMT_STATUS_SUCCESS) {
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 071/194] ring-buffer: Do not swap cpu_buffer during resize process
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 070/194] Bluetooth: MGMT: Use correct address for memcpy() Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 072/194] igc: read before write to SRRCTL register Greg Kroah-Hartman
` (133 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Lin, Steven Rostedt (Google),
Sasha Levin
From: Chen Lin <chen.lin5@zte.com.cn>
[ Upstream commit 8a96c0288d0737ad77882024974c075345c72011 ]
When ring_buffer_swap_cpu was called during resize process,
the cpu buffer was swapped in the middle, resulting in incorrect state.
Continuing to run in the wrong state will result in oops.
This issue can be easily reproduced using the following two scripts:
/tmp # cat test1.sh
//#! /bin/sh
for i in `seq 0 100000`
do
echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb
sleep 0.5
echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb
sleep 0.5
done
/tmp # cat test2.sh
//#! /bin/sh
for i in `seq 0 100000`
do
echo irqsoff > /sys/kernel/debug/tracing/current_tracer
sleep 1
echo nop > /sys/kernel/debug/tracing/current_tracer
sleep 1
done
/tmp # ./test1.sh &
/tmp # ./test2.sh &
A typical oops log is as follows, sometimes with other different oops logs.
[ 231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8
[ 231.713375] Modules linked in:
[ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15
[ 231.716750] Hardware name: linux,dummy-virt (DT)
[ 231.718152] Workqueue: events update_pages_handler
[ 231.719714] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 231.721171] pc : rb_update_pages+0x378/0x3f8
[ 231.722212] lr : rb_update_pages+0x25c/0x3f8
[ 231.723248] sp : ffff800082b9bd50
[ 231.724169] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000
[ 231.726102] x26: 0000000000000001 x25: fffffffffffff010 x24: 0000000000000ff0
[ 231.728122] x23: ffff0000c3a0b600 x22: ffff0000c3a0b5c0 x21: fffffffffffffe0a
[ 231.730203] x20: ffff0000c3a0b600 x19: ffff0000c0102400 x18: 0000000000000000
[ 231.732329] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffe7aa8510
[ 231.734212] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000002
[ 231.736291] x11: ffff8000826998a8 x10: ffff800082b9baf0 x9 : ffff800081137558
[ 231.738195] x8 : fffffc00030e82c8 x7 : 0000000000000000 x6 : 0000000000000001
[ 231.740192] x5 : ffff0000ffbafe00 x4 : 0000000000000000 x3 : 0000000000000000
[ 231.742118] x2 : 00000000000006aa x1 : 0000000000000001 x0 : ffff0000c0007208
[ 231.744196] Call trace:
[ 231.744892] rb_update_pages+0x378/0x3f8
[ 231.745893] update_pages_handler+0x1c/0x38
[ 231.746893] process_one_work+0x1f0/0x468
[ 231.747852] worker_thread+0x54/0x410
[ 231.748737] kthread+0x124/0x138
[ 231.749549] ret_from_fork+0x10/0x20
[ 231.750434] ---[ end trace 0000000000000000 ]---
[ 233.720486] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 233.721696] Mem abort info:
[ 233.721935] ESR = 0x0000000096000004
[ 233.722283] EC = 0x25: DABT (current EL), IL = 32 bits
[ 233.722596] SET = 0, FnV = 0
[ 233.722805] EA = 0, S1PTW = 0
[ 233.723026] FSC = 0x04: level 0 translation fault
[ 233.723458] Data abort info:
[ 233.723734] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[ 233.724176] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 233.724589] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 233.725075] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000104943000
[ 233.725592] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
[ 233.726231] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[ 233.726720] Modules linked in:
[ 233.727007] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15
[ 233.727777] Hardware name: linux,dummy-virt (DT)
[ 233.728225] Workqueue: events update_pages_handler
[ 233.728655] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 233.729054] pc : rb_update_pages+0x1a8/0x3f8
[ 233.729334] lr : rb_update_pages+0x154/0x3f8
[ 233.729592] sp : ffff800082b9bd50
[ 233.729792] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000
[ 233.730220] x26: 0000000000000000 x25: ffff800082a8b840 x24: ffff0000c0102418
[ 233.730653] x23: 0000000000000000 x22: fffffc000304c880 x21: 0000000000000003
[ 233.731105] x20: 00000000000001f4 x19: ffff0000c0102400 x18: ffff800082fcbc58
[ 233.731727] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000001
[ 233.732282] x14: ffff8000825fe0c8 x13: 0000000000000001 x12: 0000000000000000
[ 233.732709] x11: ffff8000826998a8 x10: 0000000000000ae0 x9 : ffff8000801b760c
[ 233.733148] x8 : fefefefefefefeff x7 : 0000000000000018 x6 : ffff0000c03298c0
[ 233.733553] x5 : 0000000000000002 x4 : 0000000000000000 x3 : 0000000000000000
[ 233.733972] x2 : ffff0000c3a0b600 x1 : 0000000000000000 x0 : 0000000000000000
[ 233.734418] Call trace:
[ 233.734593] rb_update_pages+0x1a8/0x3f8
[ 233.734853] update_pages_handler+0x1c/0x38
[ 233.735148] process_one_work+0x1f0/0x468
[ 233.735525] worker_thread+0x54/0x410
[ 233.735852] kthread+0x124/0x138
[ 233.736064] ret_from_fork+0x10/0x20
[ 233.736387] Code: 92400000 910006b5 aa000021 aa0303f7 (f9400060)
[ 233.736959] ---[ end trace 0000000000000000 ]---
After analysis, the seq of the error is as follows [1-5]:
int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
int cpu_id)
{
for_each_buffer_cpu(buffer, cpu) {
cpu_buffer = buffer->buffers[cpu];
//1. get cpu_buffer, aka cpu_buffer(A)
...
...
schedule_work_on(cpu,
&cpu_buffer->update_pages_work);
//2. 'update_pages_work' is queue on 'cpu', cpu_buffer(A) is passed to
// update_pages_handler, do the update process, set 'update_done' in
// complete(&cpu_buffer->update_done) and to wakeup resize process.
//---->
//3. Just at this moment, ring_buffer_swap_cpu is triggered,
//cpu_buffer(A) be swaped to cpu_buffer(B), the max_buffer.
//ring_buffer_swap_cpu is called as the 'Call trace' below.
Call trace:
dump_backtrace+0x0/0x2f8
show_stack+0x18/0x28
dump_stack+0x12c/0x188
ring_buffer_swap_cpu+0x2f8/0x328
update_max_tr_single+0x180/0x210
check_critical_timing+0x2b4/0x2c8
tracer_hardirqs_on+0x1c0/0x200
trace_hardirqs_on+0xec/0x378
el0_svc_common+0x64/0x260
do_el0_svc+0x90/0xf8
el0_svc+0x20/0x30
el0_sync_handler+0xb0/0xb8
el0_sync+0x180/0x1c0
//<----
/* wait for all the updates to complete */
for_each_buffer_cpu(buffer, cpu) {
cpu_buffer = buffer->buffers[cpu];
//4. get cpu_buffer, cpu_buffer(B) is used in the following process,
//the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong.
//for example, cpu_buffer(A)->update_done will leave be set 1, and will
//not 'wait_for_completion' at the next resize round.
if (!cpu_buffer->nr_pages_to_update)
continue;
if (cpu_online(cpu))
wait_for_completion(&cpu_buffer->update_done);
cpu_buffer->nr_pages_to_update = 0;
}
...
}
//5. the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong,
//Continuing to run in the wrong state, then oops occurs.
Link: https://lore.kernel.org/linux-trace-kernel/202307191558478409990@zte.com.cn
Signed-off-by: Chen Lin <chen.lin5@zte.com.cn>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 14 +++++++++++++-
kernel/trace/trace.c | 3 ++-
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index c49ed619a64dd..de55107aef5d5 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -544,6 +544,7 @@ struct trace_buffer {
unsigned flags;
int cpus;
atomic_t record_disabled;
+ atomic_t resizing;
cpumask_var_t cpumask;
struct lock_class_key *reader_lock_key;
@@ -2173,7 +2174,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
/* prevent another thread from changing buffer sizes */
mutex_lock(&buffer->mutex);
-
+ atomic_inc(&buffer->resizing);
if (cpu_id == RING_BUFFER_ALL_CPUS) {
/*
@@ -2312,6 +2313,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
atomic_dec(&buffer->record_disabled);
}
+ atomic_dec(&buffer->resizing);
mutex_unlock(&buffer->mutex);
return 0;
@@ -2332,6 +2334,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
}
}
out_err_unlock:
+ atomic_dec(&buffer->resizing);
mutex_unlock(&buffer->mutex);
return err;
}
@@ -5539,6 +5542,15 @@ int ring_buffer_swap_cpu(struct trace_buffer *buffer_a,
if (local_read(&cpu_buffer_b->committing))
goto out_dec;
+ /*
+ * When resize is in progress, we cannot swap it because
+ * it will mess the state of the cpu buffer.
+ */
+ if (atomic_read(&buffer_a->resizing))
+ goto out_dec;
+ if (atomic_read(&buffer_b->resizing))
+ goto out_dec;
+
buffer_a->buffers[cpu] = cpu_buffer_b;
buffer_b->buffers[cpu] = cpu_buffer_a;
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 709af9631be45..af33c5a4166d4 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1885,9 +1885,10 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu)
* place on this CPU. We fail to record, but we reset
* the max trace buffer (no one writes directly to it)
* and flag that it failed.
+ * Another reason is resize is in progress.
*/
trace_array_printk_buf(tr->max_buffer.buffer, _THIS_IP_,
- "Failed to swap buffers due to commit in progress\n");
+ "Failed to swap buffers due to commit or resize in progress\n");
}
WARN_ON_ONCE(ret && ret != -EAGAIN && ret != -EBUSY);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 072/194] igc: read before write to SRRCTL register
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 071/194] ring-buffer: Do not swap cpu_buffer during resize process Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 073/194] drm/amd/display: save restore hdcp state when display is unplugged from mst hub Greg Kroah-Hartman
` (132 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Yoong Siang, Jacob Keller,
Jesper Dangaard Brouer, Naama Meir, Tony Nguyen, Leon Romanovsky,
David S. Miller, Sasha Levin
From: Song Yoong Siang <yoong.siang.song@intel.com>
[ Upstream commit 3ce29c17dc847bf4245e16aad78a7617afa96297 ]
igc_configure_rx_ring() function will be called as part of XDP program
setup. If Rx hardware timestamp is enabled prio to XDP program setup,
this timestamp enablement will be overwritten when buffer size is
written into SRRCTL register.
Thus, this commit read the register value before write to SRRCTL
register. This commit is tested by using xdp_hw_metadata bpf selftest
tool. The tool enables Rx hardware timestamp and then attach XDP program
to igc driver. It will display hardware timestamp of UDP packet with
port number 9092. Below are detail of test steps and results.
Command on DUT:
sudo ./xdp_hw_metadata <interface name>
Command on Link Partner:
echo -n skb | nc -u -q1 <destination IPv4 addr> 9092
Result before this patch:
skb hwtstamp is not found!
Result after this patch:
found skb hwtstamp = 1677800973.642836757
Optionally, read PHC to confirm the values obtained are almost the same:
Command:
sudo ./testptp -d /dev/ptp0 -g
Result:
clock time: 1677800973.913598978 or Fri Mar 3 07:49:33 2023
Fixes: fc9df2a0b520 ("igc: Enable RX via AF_XDP zero-copy")
Cc: <stable@vger.kernel.org> # 5.14+
Signed-off-by: Song Yoong Siang <yoong.siang.song@intel.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Jesper Dangaard Brouer <brouer@redhat.com>
Tested-by: Jesper Dangaard Brouer <brouer@redhat.com>
Tested-by: Naama Meir <naamax.meir@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igc/igc_base.h | 11 ++++++++---
drivers/net/ethernet/intel/igc/igc_main.c | 7 +++++--
2 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/intel/igc/igc_base.h b/drivers/net/ethernet/intel/igc/igc_base.h
index ce530f5fd7bda..52849f5e8048d 100644
--- a/drivers/net/ethernet/intel/igc/igc_base.h
+++ b/drivers/net/ethernet/intel/igc/igc_base.h
@@ -85,8 +85,13 @@ union igc_adv_rx_desc {
#define IGC_RXDCTL_SWFLUSH 0x04000000 /* Receive Software Flush */
/* SRRCTL bit definitions */
-#define IGC_SRRCTL_BSIZEPKT_SHIFT 10 /* Shift _right_ */
-#define IGC_SRRCTL_BSIZEHDRSIZE_SHIFT 2 /* Shift _left_ */
-#define IGC_SRRCTL_DESCTYPE_ADV_ONEBUF 0x02000000
+#define IGC_SRRCTL_BSIZEPKT_MASK GENMASK(6, 0)
+#define IGC_SRRCTL_BSIZEPKT(x) FIELD_PREP(IGC_SRRCTL_BSIZEPKT_MASK, \
+ (x) / 1024) /* in 1 KB resolution */
+#define IGC_SRRCTL_BSIZEHDR_MASK GENMASK(13, 8)
+#define IGC_SRRCTL_BSIZEHDR(x) FIELD_PREP(IGC_SRRCTL_BSIZEHDR_MASK, \
+ (x) / 64) /* in 64 bytes resolution */
+#define IGC_SRRCTL_DESCTYPE_MASK GENMASK(27, 25)
+#define IGC_SRRCTL_DESCTYPE_ADV_ONEBUF FIELD_PREP(IGC_SRRCTL_DESCTYPE_MASK, 1)
#endif /* _IGC_BASE_H */
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index d877dc0f87f71..2f3947cf513bd 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -675,8 +675,11 @@ static void igc_configure_rx_ring(struct igc_adapter *adapter,
else
buf_size = IGC_RXBUFFER_2048;
- srrctl = IGC_RX_HDR_LEN << IGC_SRRCTL_BSIZEHDRSIZE_SHIFT;
- srrctl |= buf_size >> IGC_SRRCTL_BSIZEPKT_SHIFT;
+ srrctl = rd32(IGC_SRRCTL(reg_idx));
+ srrctl &= ~(IGC_SRRCTL_BSIZEPKT_MASK | IGC_SRRCTL_BSIZEHDR_MASK |
+ IGC_SRRCTL_DESCTYPE_MASK);
+ srrctl |= IGC_SRRCTL_BSIZEHDR(IGC_RX_HDR_LEN);
+ srrctl |= IGC_SRRCTL_BSIZEPKT(buf_size);
srrctl |= IGC_SRRCTL_DESCTYPE_ADV_ONEBUF;
wr32(IGC_SRRCTL(reg_idx), srrctl);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 073/194] drm/amd/display: save restore hdcp state when display is unplugged from mst hub
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 072/194] igc: read before write to SRRCTL register Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 074/194] drm/amd/display: phase3 mst hdcp for multiple displays Greg Kroah-Hartman
` (131 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aurabindo Pillai, hersen wu,
Bhawanpreet Lakha, Daniel Wheeler, Alex Deucher, Sasha Levin
From: hersen wu <hersenxs.wu@amd.com>
[ Upstream commit 82986fd631fa04bcedaefe11a6b3767601cbe84f ]
[Why]
connector hdcp properties are lost after display is
unplgged from mst hub. connector is destroyed with
dm_dp_mst_connector_destroy. when display is plugged
back, hdcp is not desired and it wouldnt be enabled.
[How]
save hdcp properties into hdcp_work within
amdgpu_dm_atomic_commit_tail. If the same display is
plugged back with same display index, its hdcp
properties will be retrieved from hdcp_work within
dm_dp_mst_get_modes.
Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: hersen wu <hersenxs.wu@amd.com>
Reviewed-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: cdff36a0217a ("drm/amd/display: fix access hdcp_workqueue assert")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 24 ++++++++++++++++-
.../amd/display/amdgpu_dm/amdgpu_dm_hdcp.h | 14 ++++++++++
.../display/amdgpu_dm/amdgpu_dm_mst_types.c | 26 +++++++++++++++++++
3 files changed, 63 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 9f718b98da1f7..bdc6f90b3adb5 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -8350,11 +8350,33 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
continue;
}
- if (is_content_protection_different(new_con_state, old_con_state, connector, adev->dm.hdcp_workqueue))
+ if (is_content_protection_different(new_con_state, old_con_state, connector, adev->dm.hdcp_workqueue)) {
+ /* when display is unplugged from mst hub, connctor will
+ * be destroyed within dm_dp_mst_connector_destroy. connector
+ * hdcp perperties, like type, undesired, desired, enabled,
+ * will be lost. So, save hdcp properties into hdcp_work within
+ * amdgpu_dm_atomic_commit_tail. if the same display is
+ * plugged back with same display index, its hdcp properties
+ * will be retrieved from hdcp_work within dm_dp_mst_get_modes
+ */
+
+ if (aconnector->dc_link && aconnector->dc_sink &&
+ aconnector->dc_link->type == dc_connection_mst_branch) {
+ struct hdcp_workqueue *hdcp_work = adev->dm.hdcp_workqueue;
+ struct hdcp_workqueue *hdcp_w =
+ &hdcp_work[aconnector->dc_link->link_index];
+
+ hdcp_w->hdcp_content_type[connector->index] =
+ new_con_state->hdcp_content_type;
+ hdcp_w->content_protection[connector->index] =
+ new_con_state->content_protection;
+ }
+
hdcp_update_display(
adev->dm.hdcp_workqueue, aconnector->dc_link->link_index, aconnector,
new_con_state->hdcp_content_type,
new_con_state->content_protection == DRM_MODE_CONTENT_PROTECTION_DESIRED);
+ }
}
#endif
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h
index 09294ff122fea..bbbf7d0eff82f 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h
@@ -52,6 +52,20 @@ struct hdcp_workqueue {
struct mod_hdcp_link link;
enum mod_hdcp_encryption_status encryption_status;
+
+ /* when display is unplugged from mst hub, connctor will be
+ * destroyed within dm_dp_mst_connector_destroy. connector
+ * hdcp perperties, like type, undesired, desired, enabled,
+ * will be lost. So, save hdcp properties into hdcp_work within
+ * amdgpu_dm_atomic_commit_tail. if the same display is
+ * plugged back with same display index, its hdcp properties
+ * will be retrieved from hdcp_work within dm_dp_mst_get_modes
+ */
+ /* un-desired, desired, enabled */
+ unsigned int content_protection[AMDGPU_DM_MAX_DISPLAY_INDEX];
+ /* hdcp1.x, hdcp2.x */
+ unsigned int hdcp_content_type[AMDGPU_DM_MAX_DISPLAY_INDEX];
+
uint8_t max_link;
uint8_t *srm;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index d07e1053b36b3..9884dd78c652c 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -32,6 +32,10 @@
#include "amdgpu_dm.h"
#include "amdgpu_dm_mst_types.h"
+#ifdef CONFIG_DRM_AMD_DC_HDCP
+#include "amdgpu_dm_hdcp.h"
+#endif
+
#include "dc.h"
#include "dm_helpers.h"
@@ -363,6 +367,28 @@ static int dm_dp_mst_get_modes(struct drm_connector *connector)
/* dc_link_add_remote_sink returns a new reference */
aconnector->dc_sink = dc_sink;
+ /* when display is unplugged from mst hub, connctor will be
+ * destroyed within dm_dp_mst_connector_destroy. connector
+ * hdcp perperties, like type, undesired, desired, enabled,
+ * will be lost. So, save hdcp properties into hdcp_work within
+ * amdgpu_dm_atomic_commit_tail. if the same display is
+ * plugged back with same display index, its hdcp properties
+ * will be retrieved from hdcp_work within dm_dp_mst_get_modes
+ */
+#ifdef CONFIG_DRM_AMD_DC_HDCP
+ if (aconnector->dc_sink && connector->state) {
+ struct drm_device *dev = connector->dev;
+ struct amdgpu_device *adev = drm_to_adev(dev);
+ struct hdcp_workqueue *hdcp_work = adev->dm.hdcp_workqueue;
+ struct hdcp_workqueue *hdcp_w = &hdcp_work[aconnector->dc_link->link_index];
+
+ connector->state->hdcp_content_type =
+ hdcp_w->hdcp_content_type[connector->index];
+ connector->state->content_protection =
+ hdcp_w->content_protection[connector->index];
+ }
+#endif
+
if (aconnector->dc_sink) {
amdgpu_dm_update_freesync_caps(
connector, aconnector->edid);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 074/194] drm/amd/display: phase3 mst hdcp for multiple displays
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 073/194] drm/amd/display: save restore hdcp state when display is unplugged from mst hub Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 075/194] drm/amd/display: fix access hdcp_workqueue assert Greg Kroah-Hartman
` (130 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aurabindo Pillai, hersen wu,
Bhawanpreet Lakha, Daniel Wheeler, Alex Deucher, Sasha Levin
From: hersen wu <hersenxs.wu@amd.com>
[ Upstream commit e8fd3eeb5e8711af39b00642da06474e52f4780c ]
[Why]
multiple display hdcp are enabled within event_property_validate,
event_property_update by looping all displays on mst hub. when
one of display on mst hub in unplugged or disabled, hdcp are
disabled for all displays on mst hub within hdcp_reset_display
by looping all displays of mst link. for displays still active,
their encryption status are off. kernel driver will not run hdcp
authentication again. therefore, hdcp are not enabled automatically.
[How]
within is_content_protection_different, check drm_crtc_state changes
of all displays on mst hub, if need, triger hdcp_update_display to
re-run hdcp authentication.
Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: hersen wu <hersenxs.wu@amd.com>
Reviewed-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: cdff36a0217a ("drm/amd/display: fix access hdcp_workqueue assert")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 183 ++++++++++++++----
1 file changed, 141 insertions(+), 42 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index bdc6f90b3adb5..aa0ea28a86f02 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -7397,27 +7397,55 @@ is_scaling_state_different(const struct dm_connector_state *dm_state,
}
#ifdef CONFIG_DRM_AMD_DC_HDCP
-static bool is_content_protection_different(struct drm_connector_state *state,
- const struct drm_connector_state *old_state,
- const struct drm_connector *connector, struct hdcp_workqueue *hdcp_w)
+static bool is_content_protection_different(struct drm_crtc_state *new_crtc_state,
+ struct drm_crtc_state *old_crtc_state,
+ struct drm_connector_state *new_conn_state,
+ struct drm_connector_state *old_conn_state,
+ const struct drm_connector *connector,
+ struct hdcp_workqueue *hdcp_w)
{
struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
struct dm_connector_state *dm_con_state = to_dm_connector_state(connector->state);
- /* Handle: Type0/1 change */
- if (old_state->hdcp_content_type != state->hdcp_content_type &&
- state->content_protection != DRM_MODE_CONTENT_PROTECTION_UNDESIRED) {
- state->content_protection = DRM_MODE_CONTENT_PROTECTION_DESIRED;
+ pr_debug("[HDCP_DM] connector->index: %x connect_status: %x dpms: %x\n",
+ connector->index, connector->status, connector->dpms);
+ pr_debug("[HDCP_DM] state protection old: %x new: %x\n",
+ old_conn_state->content_protection, new_conn_state->content_protection);
+
+ if (old_crtc_state)
+ pr_debug("[HDCP_DM] old crtc en: %x a: %x m: %x a-chg: %x c-chg: %x\n",
+ old_crtc_state->enable,
+ old_crtc_state->active,
+ old_crtc_state->mode_changed,
+ old_crtc_state->active_changed,
+ old_crtc_state->connectors_changed);
+
+ if (new_crtc_state)
+ pr_debug("[HDCP_DM] NEW crtc en: %x a: %x m: %x a-chg: %x c-chg: %x\n",
+ new_crtc_state->enable,
+ new_crtc_state->active,
+ new_crtc_state->mode_changed,
+ new_crtc_state->active_changed,
+ new_crtc_state->connectors_changed);
+
+ /* hdcp content type change */
+ if (old_conn_state->hdcp_content_type != new_conn_state->hdcp_content_type &&
+ new_conn_state->content_protection != DRM_MODE_CONTENT_PROTECTION_UNDESIRED) {
+ new_conn_state->content_protection = DRM_MODE_CONTENT_PROTECTION_DESIRED;
+ pr_debug("[HDCP_DM] Type0/1 change %s :true\n", __func__);
return true;
}
- /* CP is being re enabled, ignore this
- *
- * Handles: ENABLED -> DESIRED
- */
- if (old_state->content_protection == DRM_MODE_CONTENT_PROTECTION_ENABLED &&
- state->content_protection == DRM_MODE_CONTENT_PROTECTION_DESIRED) {
- state->content_protection = DRM_MODE_CONTENT_PROTECTION_ENABLED;
+ /* CP is being re enabled, ignore this */
+ if (old_conn_state->content_protection == DRM_MODE_CONTENT_PROTECTION_ENABLED &&
+ new_conn_state->content_protection == DRM_MODE_CONTENT_PROTECTION_DESIRED) {
+ if (new_crtc_state && new_crtc_state->mode_changed) {
+ new_conn_state->content_protection = DRM_MODE_CONTENT_PROTECTION_DESIRED;
+ pr_debug("[HDCP_DM] ENABLED->DESIRED & mode_changed %s :true\n", __func__);
+ return true;
+ };
+ new_conn_state->content_protection = DRM_MODE_CONTENT_PROTECTION_ENABLED;
+ pr_debug("[HDCP_DM] ENABLED -> DESIRED %s :false\n", __func__);
return false;
}
@@ -7425,9 +7453,9 @@ static bool is_content_protection_different(struct drm_connector_state *state,
*
* Handles: UNDESIRED -> ENABLED
*/
- if (old_state->content_protection == DRM_MODE_CONTENT_PROTECTION_UNDESIRED &&
- state->content_protection == DRM_MODE_CONTENT_PROTECTION_ENABLED)
- state->content_protection = DRM_MODE_CONTENT_PROTECTION_DESIRED;
+ if (old_conn_state->content_protection == DRM_MODE_CONTENT_PROTECTION_UNDESIRED &&
+ new_conn_state->content_protection == DRM_MODE_CONTENT_PROTECTION_ENABLED)
+ new_conn_state->content_protection = DRM_MODE_CONTENT_PROTECTION_DESIRED;
/* Stream removed and re-enabled
*
@@ -7437,10 +7465,12 @@ static bool is_content_protection_different(struct drm_connector_state *state,
*
* Handles: DESIRED -> DESIRED (Special case)
*/
- if (!(old_state->crtc && old_state->crtc->enabled) &&
- state->crtc && state->crtc->enabled &&
+ if (!(old_conn_state->crtc && old_conn_state->crtc->enabled) &&
+ new_conn_state->crtc && new_conn_state->crtc->enabled &&
connector->state->content_protection == DRM_MODE_CONTENT_PROTECTION_DESIRED) {
dm_con_state->update_hdcp = false;
+ pr_debug("[HDCP_DM] DESIRED->DESIRED (Stream removed and re-enabled) %s :true\n",
+ __func__);
return true;
}
@@ -7452,35 +7482,42 @@ static bool is_content_protection_different(struct drm_connector_state *state,
*
* Handles: DESIRED -> DESIRED (Special case)
*/
- if (dm_con_state->update_hdcp && state->content_protection == DRM_MODE_CONTENT_PROTECTION_DESIRED &&
- connector->dpms == DRM_MODE_DPMS_ON && aconnector->dc_sink != NULL) {
+ if (dm_con_state->update_hdcp &&
+ new_conn_state->content_protection == DRM_MODE_CONTENT_PROTECTION_DESIRED &&
+ connector->dpms == DRM_MODE_DPMS_ON && aconnector->dc_sink != NULL) {
dm_con_state->update_hdcp = false;
+ pr_debug("[HDCP_DM] DESIRED->DESIRED (Hot-plug, headless s3, dpms) %s :true\n",
+ __func__);
return true;
}
- /*
- * Handles: UNDESIRED -> UNDESIRED
- * DESIRED -> DESIRED
- * ENABLED -> ENABLED
- */
- if (old_state->content_protection == state->content_protection)
+ if (old_conn_state->content_protection == new_conn_state->content_protection) {
+ if (new_conn_state->content_protection >= DRM_MODE_CONTENT_PROTECTION_DESIRED) {
+ if (new_crtc_state && new_crtc_state->mode_changed) {
+ pr_debug("[HDCP_DM] DESIRED->DESIRED or ENABLE->ENABLE mode_change %s :true\n",
+ __func__);
+ return true;
+ };
+ pr_debug("[HDCP_DM] DESIRED->DESIRED & ENABLE->ENABLE %s :false\n",
+ __func__);
+ return false;
+ };
+
+ pr_debug("[HDCP_DM] UNDESIRED->UNDESIRED %s :false\n", __func__);
return false;
+ }
- /*
- * Handles: UNDESIRED -> DESIRED
- * DESIRED -> UNDESIRED
- * ENABLED -> UNDESIRED
- */
- if (state->content_protection != DRM_MODE_CONTENT_PROTECTION_ENABLED)
+ if (new_conn_state->content_protection != DRM_MODE_CONTENT_PROTECTION_ENABLED) {
+ pr_debug("[HDCP_DM] UNDESIRED->DESIRED or DESIRED->UNDESIRED or ENABLED->UNDESIRED %s :true\n",
+ __func__);
return true;
+ }
- /*
- * Handles: DESIRED -> ENABLED
- */
+ pr_debug("[HDCP_DM] DESIRED->ENABLED %s :false\n", __func__);
return false;
}
-
#endif
+
static void remove_stream(struct amdgpu_device *adev,
struct amdgpu_crtc *acrtc,
struct dc_stream_state *stream)
@@ -8330,15 +8367,66 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
}
}
#ifdef CONFIG_DRM_AMD_DC_HDCP
+ for_each_oldnew_connector_in_state(state, connector, old_con_state, new_con_state, i) {
+ struct dm_connector_state *dm_new_con_state = to_dm_connector_state(new_con_state);
+ struct amdgpu_crtc *acrtc = to_amdgpu_crtc(dm_new_con_state->base.crtc);
+ struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+
+ pr_debug("[HDCP_DM] -------------- i : %x ----------\n", i);
+
+ if (!connector)
+ continue;
+
+ pr_debug("[HDCP_DM] connector->index: %x connect_status: %x dpms: %x\n",
+ connector->index, connector->status, connector->dpms);
+ pr_debug("[HDCP_DM] state protection old: %x new: %x\n",
+ old_con_state->content_protection, new_con_state->content_protection);
+
+ if (aconnector->dc_sink) {
+ if (aconnector->dc_sink->sink_signal != SIGNAL_TYPE_VIRTUAL &&
+ aconnector->dc_sink->sink_signal != SIGNAL_TYPE_NONE) {
+ pr_debug("[HDCP_DM] pipe_ctx dispname=%s\n",
+ aconnector->dc_sink->edid_caps.display_name);
+ }
+ }
+
+ new_crtc_state = NULL;
+ old_crtc_state = NULL;
+
+ if (acrtc) {
+ new_crtc_state = drm_atomic_get_new_crtc_state(state, &acrtc->base);
+ old_crtc_state = drm_atomic_get_old_crtc_state(state, &acrtc->base);
+ }
+
+ if (old_crtc_state)
+ pr_debug("old crtc en: %x a: %x m: %x a-chg: %x c-chg: %x\n",
+ old_crtc_state->enable,
+ old_crtc_state->active,
+ old_crtc_state->mode_changed,
+ old_crtc_state->active_changed,
+ old_crtc_state->connectors_changed);
+
+ if (new_crtc_state)
+ pr_debug("NEW crtc en: %x a: %x m: %x a-chg: %x c-chg: %x\n",
+ new_crtc_state->enable,
+ new_crtc_state->active,
+ new_crtc_state->mode_changed,
+ new_crtc_state->active_changed,
+ new_crtc_state->connectors_changed);
+ }
+
for_each_oldnew_connector_in_state(state, connector, old_con_state, new_con_state, i) {
struct dm_connector_state *dm_new_con_state = to_dm_connector_state(new_con_state);
struct amdgpu_crtc *acrtc = to_amdgpu_crtc(dm_new_con_state->base.crtc);
struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
new_crtc_state = NULL;
+ old_crtc_state = NULL;
- if (acrtc)
+ if (acrtc) {
new_crtc_state = drm_atomic_get_new_crtc_state(state, &acrtc->base);
+ old_crtc_state = drm_atomic_get_old_crtc_state(state, &acrtc->base);
+ }
dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
@@ -8350,7 +8438,8 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
continue;
}
- if (is_content_protection_different(new_con_state, old_con_state, connector, adev->dm.hdcp_workqueue)) {
+ if (is_content_protection_different(new_crtc_state, old_crtc_state, new_con_state,
+ old_con_state, connector, adev->dm.hdcp_workqueue)) {
/* when display is unplugged from mst hub, connctor will
* be destroyed within dm_dp_mst_connector_destroy. connector
* hdcp perperties, like type, undesired, desired, enabled,
@@ -8360,6 +8449,11 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
* will be retrieved from hdcp_work within dm_dp_mst_get_modes
*/
+ bool enable_encryption = false;
+
+ if (new_con_state->content_protection == DRM_MODE_CONTENT_PROTECTION_DESIRED)
+ enable_encryption = true;
+
if (aconnector->dc_link && aconnector->dc_sink &&
aconnector->dc_link->type == dc_connection_mst_branch) {
struct hdcp_workqueue *hdcp_work = adev->dm.hdcp_workqueue;
@@ -8372,11 +8466,16 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
new_con_state->content_protection;
}
+ if (new_crtc_state && new_crtc_state->mode_changed &&
+ new_con_state->content_protection >= DRM_MODE_CONTENT_PROTECTION_DESIRED)
+ enable_encryption = true;
+
+ DRM_INFO("[HDCP_DM] hdcp_update_display enable_encryption = %x\n", enable_encryption);
+
hdcp_update_display(
adev->dm.hdcp_workqueue, aconnector->dc_link->link_index, aconnector,
- new_con_state->hdcp_content_type,
- new_con_state->content_protection == DRM_MODE_CONTENT_PROTECTION_DESIRED);
- }
+ new_con_state->hdcp_content_type, enable_encryption);
+ }
}
#endif
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 075/194] drm/amd/display: fix access hdcp_workqueue assert
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 074/194] drm/amd/display: phase3 mst hdcp for multiple displays Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 076/194] KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption Greg Kroah-Hartman
` (129 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bhawanpreet Lakha, Qingqing Zhuo,
Hersen Wu, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Hersen Wu <hersenxs.wu@amd.com>
[ Upstream commit cdff36a0217aadf5cbc167893ad1c0da869619cb ]
[Why] hdcp are enabled for asics from raven. for old asics
which hdcp are not enabled, hdcp_workqueue are null. some
access to hdcp work queue are not guarded with pointer check.
[How] add hdcp_workqueue pointer check before access workqueue.
Reviewed-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++++
.../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 16 ++++++++++------
2 files changed, 16 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index aa0ea28a86f02..249b269e2cc53 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -8372,6 +8372,9 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
struct amdgpu_crtc *acrtc = to_amdgpu_crtc(dm_new_con_state->base.crtc);
struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+ if (!adev->dm.hdcp_workqueue)
+ continue;
+
pr_debug("[HDCP_DM] -------------- i : %x ----------\n", i);
if (!connector)
@@ -8420,6 +8423,9 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
struct amdgpu_crtc *acrtc = to_amdgpu_crtc(dm_new_con_state->base.crtc);
struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+ if (!adev->dm.hdcp_workqueue)
+ continue;
+
new_crtc_state = NULL;
old_crtc_state = NULL;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index 9884dd78c652c..a9ddff774a978 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -379,13 +379,17 @@ static int dm_dp_mst_get_modes(struct drm_connector *connector)
if (aconnector->dc_sink && connector->state) {
struct drm_device *dev = connector->dev;
struct amdgpu_device *adev = drm_to_adev(dev);
- struct hdcp_workqueue *hdcp_work = adev->dm.hdcp_workqueue;
- struct hdcp_workqueue *hdcp_w = &hdcp_work[aconnector->dc_link->link_index];
- connector->state->hdcp_content_type =
- hdcp_w->hdcp_content_type[connector->index];
- connector->state->content_protection =
- hdcp_w->content_protection[connector->index];
+ if (adev->dm.hdcp_workqueue) {
+ struct hdcp_workqueue *hdcp_work = adev->dm.hdcp_workqueue;
+ struct hdcp_workqueue *hdcp_w =
+ &hdcp_work[aconnector->dc_link->link_index];
+
+ connector->state->hdcp_content_type =
+ hdcp_w->hdcp_content_type[connector->index];
+ connector->state->content_protection =
+ hdcp_w->content_protection[connector->index];
+ }
}
#endif
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 076/194] KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 075/194] drm/amd/display: fix access hdcp_workqueue assert Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 077/194] ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node Greg Kroah-Hartman
` (128 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Chen, Zenghui Yu, Marc Zyngier,
Oliver Upton, Sasha Levin
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit b321c31c9b7b309dcde5e8854b741c8e6a9a05f0 ]
Xiang reports that VMs occasionally fail to boot on GICv4.1 systems when
running a preemptible kernel, as it is possible that a vCPU is blocked
without requesting a doorbell interrupt.
The issue is that any preemption that occurs between vgic_v4_put() and
schedule() on the block path will mark the vPE as nonresident and *not*
request a doorbell irq. This occurs because when the vcpu thread is
resumed on its way to block, vcpu_load() will make the vPE resident
again. Once the vcpu actually blocks, we don't request a doorbell
anymore, and the vcpu won't be woken up on interrupt delivery.
Fix it by tracking that we're entering WFI, and key the doorbell
request on that flag. This allows us not to make the vPE resident
when going through a preempt/schedule cycle, meaning we don't lose
any state.
Cc: stable@vger.kernel.org
Fixes: 8e01d9a396e6 ("KVM: arm64: vgic-v4: Move the GICv4 residency flow to be driven by vcpu_load/put")
Reported-by: Xiang Chen <chenxiang66@hisilicon.com>
Suggested-by: Zenghui Yu <yuzenghui@huawei.com>
Tested-by: Xiang Chen <chenxiang66@hisilicon.com>
Co-developed-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Acked-by: Zenghui Yu <yuzenghui@huawei.com>
Link: https://lore.kernel.org/r/20230713070657.3873244-1-maz@kernel.org
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/kvm_host.h | 2 ++
arch/arm64/kvm/arm.c | 6 ++++--
arch/arm64/kvm/vgic/vgic-v3.c | 2 +-
arch/arm64/kvm/vgic/vgic-v4.c | 7 +++++--
include/kvm/arm_vgic.h | 2 +-
5 files changed, 13 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index b5a8e8b3c691c..577cf444c1135 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -559,6 +559,8 @@ struct kvm_vcpu_arch {
#define SYSREGS_ON_CPU __vcpu_single_flag(sflags, BIT(4))
/* Software step state is Active-pending */
#define DBG_SS_ACTIVE_PENDING __vcpu_single_flag(sflags, BIT(5))
+/* WFI instruction trapped */
+#define IN_WFI __vcpu_single_flag(sflags, BIT(7))
/* Pointer to the vcpu's SVE FFR for sve_{save,load}_state() */
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 35481d51aada8..6cc380a15eb76 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -692,13 +692,15 @@ void kvm_vcpu_wfi(struct kvm_vcpu *vcpu)
*/
preempt_disable();
kvm_vgic_vmcr_sync(vcpu);
- vgic_v4_put(vcpu, true);
+ vcpu_set_flag(vcpu, IN_WFI);
+ vgic_v4_put(vcpu);
preempt_enable();
kvm_vcpu_halt(vcpu);
vcpu_clear_flag(vcpu, IN_WFIT);
preempt_disable();
+ vcpu_clear_flag(vcpu, IN_WFI);
vgic_v4_load(vcpu);
preempt_enable();
}
@@ -766,7 +768,7 @@ static int check_vcpu_requests(struct kvm_vcpu *vcpu)
if (kvm_check_request(KVM_REQ_RELOAD_GICv4, vcpu)) {
/* The distributor enable bits were changed */
preempt_disable();
- vgic_v4_put(vcpu, false);
+ vgic_v4_put(vcpu);
vgic_v4_load(vcpu);
preempt_enable();
}
diff --git a/arch/arm64/kvm/vgic/vgic-v3.c b/arch/arm64/kvm/vgic/vgic-v3.c
index f86c3007a319c..1f8eea53e982f 100644
--- a/arch/arm64/kvm/vgic/vgic-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-v3.c
@@ -742,7 +742,7 @@ void vgic_v3_put(struct kvm_vcpu *vcpu)
{
struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
- WARN_ON(vgic_v4_put(vcpu, false));
+ WARN_ON(vgic_v4_put(vcpu));
vgic_v3_vmcr_sync(vcpu);
diff --git a/arch/arm64/kvm/vgic/vgic-v4.c b/arch/arm64/kvm/vgic/vgic-v4.c
index c1c28fe680ba3..339a55194b2c6 100644
--- a/arch/arm64/kvm/vgic/vgic-v4.c
+++ b/arch/arm64/kvm/vgic/vgic-v4.c
@@ -336,14 +336,14 @@ void vgic_v4_teardown(struct kvm *kvm)
its_vm->vpes = NULL;
}
-int vgic_v4_put(struct kvm_vcpu *vcpu, bool need_db)
+int vgic_v4_put(struct kvm_vcpu *vcpu)
{
struct its_vpe *vpe = &vcpu->arch.vgic_cpu.vgic_v3.its_vpe;
if (!vgic_supports_direct_msis(vcpu->kvm) || !vpe->resident)
return 0;
- return its_make_vpe_non_resident(vpe, need_db);
+ return its_make_vpe_non_resident(vpe, !!vcpu_get_flag(vcpu, IN_WFI));
}
int vgic_v4_load(struct kvm_vcpu *vcpu)
@@ -354,6 +354,9 @@ int vgic_v4_load(struct kvm_vcpu *vcpu)
if (!vgic_supports_direct_msis(vcpu->kvm) || vpe->resident)
return 0;
+ if (vcpu_get_flag(vcpu, IN_WFI))
+ return 0;
+
/*
* Before making the VPE resident, make sure the redistributor
* corresponding to our current CPU expects us here. See the
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 4df9e73a8bb5f..1d7d4cffaefc6 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -429,6 +429,6 @@ int kvm_vgic_v4_unset_forwarding(struct kvm *kvm, int irq,
int vgic_v4_load(struct kvm_vcpu *vcpu);
void vgic_v4_commit(struct kvm_vcpu *vcpu);
-int vgic_v4_put(struct kvm_vcpu *vcpu, bool need_db);
+int vgic_v4_put(struct kvm_vcpu *vcpu);
#endif /* __KVM_ARM_VGIC_H */
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 077/194] ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 076/194] KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 078/194] fbdev/hyperv-fb: Do not set struct fb_info.apertures Greg Kroah-Hartman
` (127 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Yang, Shawn Guo, Sasha Levin
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit ee70b908f77a9d8f689dea986f09e6d7dc481934 ]
Property name "phy-3p0-supply" is used instead of "phy-reg_3p0-supply".
Fixes: 9f30b6b1a957 ("ARM: dts: imx: Add basic dtsi file for imx6sll")
cc: <stable@vger.kernel.org>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx6sll.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi
index 2873369a57c02..3659fd5ecfa62 100644
--- a/arch/arm/boot/dts/imx6sll.dtsi
+++ b/arch/arm/boot/dts/imx6sll.dtsi
@@ -552,7 +552,7 @@ usbphy2: usb-phy@20ca000 {
reg = <0x020ca000 0x1000>;
interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&clks IMX6SLL_CLK_USBPHY2>;
- phy-reg_3p0-supply = <®_3p0>;
+ phy-3p0-supply = <®_3p0>;
fsl,anatop = <&anatop>;
};
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 078/194] fbdev/hyperv-fb: Do not set struct fb_info.apertures
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 077/194] ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 079/194] video/aperture: Only remove sysfb on the default vga pci device Greg Kroah-Hartman
` (126 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann,
Javier Martinez Canillas, Michael Kelley, Sasha Levin
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 81d2393485f0990cf6566b0c9e0697c199f68ae5 ]
Generic fbdev drivers use the apertures field in struct fb_info to
control ownership of the framebuffer memory and graphics device. Do
not set the values in hyperv-fb.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221219160516.23436-9-tzimmermann@suse.de
Stable-dep-of: 5ae3716cfdcd ("video/aperture: Only remove sysfb on the default vga pci device")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/hyperv_fb.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
index 4ff25dfc865d9..d3d643cf7506c 100644
--- a/drivers/video/fbdev/hyperv_fb.c
+++ b/drivers/video/fbdev/hyperv_fb.c
@@ -995,13 +995,10 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
struct pci_dev *pdev = NULL;
void __iomem *fb_virt;
int gen2vm = efi_enabled(EFI_BOOT);
+ resource_size_t base, size;
phys_addr_t paddr;
int ret;
- info->apertures = alloc_apertures(1);
- if (!info->apertures)
- return -ENOMEM;
-
if (!gen2vm) {
pdev = pci_get_device(PCI_VENDOR_ID_MICROSOFT,
PCI_DEVICE_ID_HYPERV_VIDEO, NULL);
@@ -1010,8 +1007,8 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
return -ENODEV;
}
- info->apertures->ranges[0].base = pci_resource_start(pdev, 0);
- info->apertures->ranges[0].size = pci_resource_len(pdev, 0);
+ base = pci_resource_start(pdev, 0);
+ size = pci_resource_len(pdev, 0);
/*
* For Gen 1 VM, we can directly use the contiguous memory
@@ -1034,8 +1031,8 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
}
pr_info("Unable to allocate enough contiguous physical memory on Gen 1 VM. Using MMIO instead.\n");
} else {
- info->apertures->ranges[0].base = screen_info.lfb_base;
- info->apertures->ranges[0].size = screen_info.lfb_size;
+ base = screen_info.lfb_base;
+ size = screen_info.lfb_size;
}
/*
@@ -1077,9 +1074,7 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
info->screen_size = dio_fb_size;
getmem_done:
- aperture_remove_conflicting_devices(info->apertures->ranges[0].base,
- info->apertures->ranges[0].size,
- false, KBUILD_MODNAME);
+ aperture_remove_conflicting_devices(base, size, false, KBUILD_MODNAME);
if (gen2vm) {
/* framebuffer is reallocated, clear screen_info to avoid misuse from kexec */
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 079/194] video/aperture: Only remove sysfb on the default vga pci device
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 078/194] fbdev/hyperv-fb: Do not set struct fb_info.apertures Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 080/194] btrfs: move out now unused BG from the reclaim list Greg Kroah-Hartman
` (125 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaron Plattner,
Javier Martinez Canillas, Daniel Vetter, Daniel Vetter,
Thomas Zimmermann, Helge Deller, Sam Ravnborg, Alex Deucher,
Sasha Levin
From: Daniel Vetter <daniel.vetter@ffwll.ch>
[ Upstream commit 5ae3716cfdcd286268133867f67d0803847acefc ]
Instead of calling aperture_remove_conflicting_devices() to remove the
conflicting devices, just call to aperture_detach_devices() to detach
the device that matches the same PCI BAR / aperture range. Since the
former is just a wrapper of the latter plus a sysfb_disable() call,
and now that's done in this function but only for the primary devices.
This fixes a regression introduced by commit ee7a69aa38d8 ("fbdev:
Disable sysfb device registration when removing conflicting FBs"),
where we remove the sysfb when loading a driver for an unrelated pci
device, resulting in the user losing their efifb console or similar.
Note that in practice this only is a problem with the nvidia blob,
because that's the only gpu driver people might install which does not
come with an fbdev driver of it's own. For everyone else the real gpu
driver will restore a working console.
Also note that in the referenced bug there's confusion that this same
bug also happens on amdgpu. But that was just another amdgpu specific
regression, which just happened to happen at roughly the same time and
with the same user-observable symptoms. That bug is fixed now, see
https://bugzilla.kernel.org/show_bug.cgi?id=216331#c15
Note that we should not have any such issues on non-pci multi-gpu
issues, because I could only find two such cases:
- SoC with some external panel over spi or similar. These panel
drivers do not use drm_aperture_remove_conflicting_framebuffers(),
so no problem.
- vga+mga, which is a direct console driver and entirely bypasses all
this.
For the above reasons the cc: stable is just notionally, this patch
will need a backport and that's up to nvidia if they care enough.
v2:
- Explain a bit better why other multi-gpu that aren't pci shouldn't
have any issues with making all this fully pci specific.
v3
- polish commit message (Javier)
v4:
- Fix commit message style (i.e., commit 1234 ("..."))
- fix Daniel's S-o-b address
v5:
- add back an S-o-b tag with Daniel's Intel address
Fixes: ee7a69aa38d8 ("fbdev: Disable sysfb device registration when removing conflicting FBs")
Tested-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216303#c28
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Aaron Plattner <aplattner@nvidia.com>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Helge Deller <deller@gmx.de>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: <stable@vger.kernel.org> # v5.19+ (if someone else does the backport)
Link: https://patchwork.freedesktop.org/patch/msgid/20230406132109.32050-8-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/aperture.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/video/aperture.c b/drivers/video/aperture.c
index 41e77de1ea82c..5c94abdb1ad6d 100644
--- a/drivers/video/aperture.c
+++ b/drivers/video/aperture.c
@@ -332,15 +332,16 @@ int aperture_remove_conflicting_pci_devices(struct pci_dev *pdev, const char *na
primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
#endif
+ if (primary)
+ sysfb_disable();
+
for (bar = 0; bar < PCI_STD_NUM_BARS; ++bar) {
if (!(pci_resource_flags(pdev, bar) & IORESOURCE_MEM))
continue;
base = pci_resource_start(pdev, bar);
size = pci_resource_len(pdev, bar);
- ret = aperture_remove_conflicting_devices(base, size, primary, name);
- if (ret)
- return ret;
+ aperture_detach_devices(base, size);
}
/*
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 080/194] btrfs: move out now unused BG from the reclaim list
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 079/194] video/aperture: Only remove sysfb on the default vga pci device Greg Kroah-Hartman
@ 2023-08-21 19:40 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 081/194] btrfs: convert btrfs_block_group::needs_free_space to runtime flag Greg Kroah-Hartman
` (124 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, Johannes Thumshirn,
Naohiro Aota, David Sterba, Sasha Levin
From: Naohiro Aota <naota@elisp.net>
[ Upstream commit a9f189716cf15913c453299d72f69c51a9b0f86b ]
An unused block group is easy to remove to free up space and should be
reclaimed fast. Such block group can often already be a target of the
reclaim process. As we check list_empty(&bg->bg_list), we keep it in the
reclaim list. That block group is never reclaimed until the file system
is filled e.g. up to 75%.
Instead, we can move unused block group to the unused list and delete it
fast.
Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones")
CC: stable@vger.kernel.org # 5.15+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/block-group.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
index 3495bc775afa3..9f5a971bfed42 100644
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -1528,11 +1528,14 @@ void btrfs_mark_bg_unused(struct btrfs_block_group *bg)
{
struct btrfs_fs_info *fs_info = bg->fs_info;
+ trace_btrfs_add_unused_block_group(bg);
spin_lock(&fs_info->unused_bgs_lock);
if (list_empty(&bg->bg_list)) {
btrfs_get_block_group(bg);
- trace_btrfs_add_unused_block_group(bg);
list_add_tail(&bg->bg_list, &fs_info->unused_bgs);
+ } else {
+ /* Pull out the block group from the reclaim_bgs list. */
+ list_move_tail(&bg->bg_list, &fs_info->unused_bgs);
}
spin_unlock(&fs_info->unused_bgs_lock);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 081/194] btrfs: convert btrfs_block_group::needs_free_space to runtime flag
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2023-08-21 19:40 ` [PATCH 6.1 080/194] btrfs: move out now unused BG from the reclaim list Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 082/194] btrfs: convert btrfs_block_group::seq_zone " Greg Kroah-Hartman
` (123 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Anand Jain, David Sterba,
Sasha Levin
From: David Sterba <dsterba@suse.com>
[ Upstream commit 0d7764ff58b4b45c39eb03f2c74a819c1a88fa7b ]
We already have flags in block group to track various status bits,
convert needs_free_space as well and reduce size of btrfs_block_group.
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: 0657b20c5a76 ("btrfs: fix use-after-free of new block group that became unused")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/block-group.c | 2 +-
fs/btrfs/block-group.h | 8 ++------
fs/btrfs/free-space-tree.c | 10 +++++-----
fs/btrfs/tests/free-space-tree-tests.c | 2 +-
4 files changed, 9 insertions(+), 13 deletions(-)
diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
index 9f5a971bfed42..a726b532b5277 100644
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -2543,7 +2543,7 @@ struct btrfs_block_group *btrfs_make_block_group(struct btrfs_trans_handle *tran
cache->global_root_id = calculate_global_root_id(fs_info, cache->start);
if (btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE))
- cache->needs_free_space = 1;
+ set_bit(BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE, &cache->runtime_flags);
ret = btrfs_load_block_group_zone_info(cache, true);
if (ret) {
diff --git a/fs/btrfs/block-group.h b/fs/btrfs/block-group.h
index debd42aeae0f1..dcad5e959b920 100644
--- a/fs/btrfs/block-group.h
+++ b/fs/btrfs/block-group.h
@@ -55,6 +55,8 @@ enum btrfs_block_group_flags {
BLOCK_GROUP_FLAG_CHUNK_ITEM_INSERTED,
BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE,
BLOCK_GROUP_FLAG_ZONED_DATA_RELOC,
+ /* Does the block group need to be added to the free space tree? */
+ BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE,
};
enum btrfs_caching_type {
@@ -204,12 +206,6 @@ struct btrfs_block_group {
/* Lock for free space tree operations. */
struct mutex free_space_lock;
- /*
- * Does the block group need to be added to the free space tree?
- * Protected by free_space_lock.
- */
- int needs_free_space;
-
/* Flag indicating this block group is placed on a sequential zone */
bool seq_zone;
diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c
index a207db9322264..6a44733a95e1c 100644
--- a/fs/btrfs/free-space-tree.c
+++ b/fs/btrfs/free-space-tree.c
@@ -803,7 +803,7 @@ int __remove_from_free_space_tree(struct btrfs_trans_handle *trans,
u32 flags;
int ret;
- if (block_group->needs_free_space) {
+ if (test_bit(BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE, &block_group->runtime_flags)) {
ret = __add_block_group_free_space(trans, block_group, path);
if (ret)
return ret;
@@ -996,7 +996,7 @@ int __add_to_free_space_tree(struct btrfs_trans_handle *trans,
u32 flags;
int ret;
- if (block_group->needs_free_space) {
+ if (test_bit(BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE, &block_group->runtime_flags)) {
ret = __add_block_group_free_space(trans, block_group, path);
if (ret)
return ret;
@@ -1350,7 +1350,7 @@ static int __add_block_group_free_space(struct btrfs_trans_handle *trans,
{
int ret;
- block_group->needs_free_space = 0;
+ clear_bit(BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE, &block_group->runtime_flags);
ret = add_new_free_space_info(trans, block_group, path);
if (ret)
@@ -1372,7 +1372,7 @@ int add_block_group_free_space(struct btrfs_trans_handle *trans,
return 0;
mutex_lock(&block_group->free_space_lock);
- if (!block_group->needs_free_space)
+ if (!test_bit(BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE, &block_group->runtime_flags))
goto out;
path = btrfs_alloc_path();
@@ -1405,7 +1405,7 @@ int remove_block_group_free_space(struct btrfs_trans_handle *trans,
if (!btrfs_fs_compat_ro(trans->fs_info, FREE_SPACE_TREE))
return 0;
- if (block_group->needs_free_space) {
+ if (test_bit(BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE, &block_group->runtime_flags)) {
/* We never added this block group to the free space tree. */
return 0;
}
diff --git a/fs/btrfs/tests/free-space-tree-tests.c b/fs/btrfs/tests/free-space-tree-tests.c
index 13734ed43bfcb..766117a76d742 100644
--- a/fs/btrfs/tests/free-space-tree-tests.c
+++ b/fs/btrfs/tests/free-space-tree-tests.c
@@ -470,7 +470,7 @@ static int run_test(test_func_t test_func, int bitmaps, u32 sectorsize,
}
cache->bitmap_low_thresh = 0;
cache->bitmap_high_thresh = (u32)-1;
- cache->needs_free_space = 1;
+ set_bit(BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE, &cache->runtime_flags);
cache->fs_info = root->fs_info;
btrfs_init_dummy_trans(&trans, root->fs_info);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 082/194] btrfs: convert btrfs_block_group::seq_zone to runtime flag
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 081/194] btrfs: convert btrfs_block_group::needs_free_space to runtime flag Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 083/194] btrfs: fix use-after-free of new block group that became unused Greg Kroah-Hartman
` (122 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Anand Jain, David Sterba,
Sasha Levin
From: David Sterba <dsterba@suse.com>
[ Upstream commit 961f5b8bf48a463ac5fe5b13143426d79eb41817 ]
In zoned mode the sequential status of zone can be also tracked in the
runtime flags of block group.
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: 0657b20c5a76 ("btrfs: fix use-after-free of new block group that became unused")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/block-group.h | 5 ++---
fs/btrfs/zoned.c | 7 ++++---
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/fs/btrfs/block-group.h b/fs/btrfs/block-group.h
index dcad5e959b920..fb4f4901350bd 100644
--- a/fs/btrfs/block-group.h
+++ b/fs/btrfs/block-group.h
@@ -57,6 +57,8 @@ enum btrfs_block_group_flags {
BLOCK_GROUP_FLAG_ZONED_DATA_RELOC,
/* Does the block group need to be added to the free space tree? */
BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE,
+ /* Indicate that the block group is placed on a sequential zone */
+ BLOCK_GROUP_FLAG_SEQUENTIAL_ZONE,
};
enum btrfs_caching_type {
@@ -206,9 +208,6 @@ struct btrfs_block_group {
/* Lock for free space tree operations. */
struct mutex free_space_lock;
- /* Flag indicating this block group is placed on a sequential zone */
- bool seq_zone;
-
/*
* Number of extents in this block group used for swap files.
* All accesses protected by the spinlock 'lock'.
diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c
index 836babd23db52..9bc7ac06c5177 100644
--- a/fs/btrfs/zoned.c
+++ b/fs/btrfs/zoned.c
@@ -1436,7 +1436,7 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new)
}
if (num_sequential > 0)
- cache->seq_zone = true;
+ set_bit(BLOCK_GROUP_FLAG_SEQUENTIAL_ZONE, &cache->runtime_flags);
if (num_conventional > 0) {
/* Zone capacity is always zone size in emulation */
@@ -1658,7 +1658,7 @@ bool btrfs_use_zone_append(struct btrfs_inode *inode, u64 start)
if (!cache)
return false;
- ret = cache->seq_zone;
+ ret = !!test_bit(BLOCK_GROUP_FLAG_SEQUENTIAL_ZONE, &cache->runtime_flags);
btrfs_put_block_group(cache);
return ret;
@@ -2177,7 +2177,8 @@ static void btrfs_zone_finish_endio_workfn(struct work_struct *work)
void btrfs_schedule_zone_finish_bg(struct btrfs_block_group *bg,
struct extent_buffer *eb)
{
- if (!bg->seq_zone || eb->start + eb->len * 2 <= bg->start + bg->zone_capacity)
+ if (!test_bit(BLOCK_GROUP_FLAG_SEQUENTIAL_ZONE, &bg->runtime_flags) ||
+ eb->start + eb->len * 2 <= bg->start + bg->zone_capacity)
return;
if (WARN_ON(bg->zone_finish_work.func == btrfs_zone_finish_endio_workfn)) {
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 083/194] btrfs: fix use-after-free of new block group that became unused
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 082/194] btrfs: convert btrfs_block_group::seq_zone " Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 084/194] virtio-mmio: dont break lifecycle of vm_dev Greg Kroah-Hartman
` (121 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, David Sterba,
Sasha Levin
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 0657b20c5a76c938612f8409735a8830d257866e ]
If a task creates a new block group and that block group becomes unused
before we finish its creation, at btrfs_create_pending_block_groups(),
then when btrfs_mark_bg_unused() is called against the block group, we
assume that the block group is currently in the list of block groups to
reclaim, and we move it out of the list of new block groups and into the
list of unused block groups. This has two consequences:
1) We move it out of the list of new block groups associated to the
current transaction. So the block group creation is not finished and
if we attempt to delete the bg because it's unused, we will not find
the block group item in the extent tree (or the new block group tree),
its device extent items in the device tree etc, resulting in the
deletion to fail due to the missing items;
2) We don't increment the reference count on the block group when we
move it to the list of unused block groups, because we assumed the
block group was on the list of block groups to reclaim, and in that
case it already has the correct reference count. However the block
group was on the list of new block groups, in which case no extra
reference was taken because it's local to the current task. This
later results in doing an extra reference count decrement when
removing the block group from the unused list, eventually leading the
reference count to 0.
This second case was caught when running generic/297 from fstests, which
produced the following assertion failure and stack trace:
[589.559] assertion failed: refcount_read(&block_group->refs) == 1, in fs/btrfs/block-group.c:4299
[589.559] ------------[ cut here ]------------
[589.559] kernel BUG at fs/btrfs/block-group.c:4299!
[589.560] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[589.560] CPU: 8 PID: 2819134 Comm: umount Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1
[589.560] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
[589.560] RIP: 0010:btrfs_free_block_groups+0x449/0x4a0 [btrfs]
[589.561] Code: 68 62 da c0 (...)
[589.561] RSP: 0018:ffffa55a8c3b3d98 EFLAGS: 00010246
[589.561] RAX: 0000000000000058 RBX: ffff8f030d7f2000 RCX: 0000000000000000
[589.562] RDX: 0000000000000000 RSI: ffffffff953f0878 RDI: 00000000ffffffff
[589.562] RBP: ffff8f030d7f2088 R08: 0000000000000000 R09: ffffa55a8c3b3c50
[589.562] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8f05850b4c00
[589.562] R13: ffff8f030d7f2090 R14: ffff8f05850b4cd8 R15: dead000000000100
[589.563] FS: 00007f497fd2e840(0000) GS:ffff8f09dfc00000(0000) knlGS:0000000000000000
[589.563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[589.563] CR2: 00007f497ff8ec10 CR3: 0000000271472006 CR4: 0000000000370ee0
[589.563] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[589.564] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[589.564] Call Trace:
[589.564] <TASK>
[589.565] ? __die_body+0x1b/0x60
[589.565] ? die+0x39/0x60
[589.565] ? do_trap+0xeb/0x110
[589.565] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs]
[589.566] ? do_error_trap+0x6a/0x90
[589.566] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs]
[589.566] ? exc_invalid_op+0x4e/0x70
[589.566] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs]
[589.567] ? asm_exc_invalid_op+0x16/0x20
[589.567] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs]
[589.567] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs]
[589.567] close_ctree+0x35d/0x560 [btrfs]
[589.568] ? fsnotify_sb_delete+0x13e/0x1d0
[589.568] ? dispose_list+0x3a/0x50
[589.568] ? evict_inodes+0x151/0x1a0
[589.568] generic_shutdown_super+0x73/0x1a0
[589.569] kill_anon_super+0x14/0x30
[589.569] btrfs_kill_super+0x12/0x20 [btrfs]
[589.569] deactivate_locked_super+0x2e/0x70
[589.569] cleanup_mnt+0x104/0x160
[589.570] task_work_run+0x56/0x90
[589.570] exit_to_user_mode_prepare+0x160/0x170
[589.570] syscall_exit_to_user_mode+0x22/0x50
[589.570] ? __x64_sys_umount+0x12/0x20
[589.571] do_syscall_64+0x48/0x90
[589.571] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[589.571] RIP: 0033:0x7f497ff0a567
[589.571] Code: af 98 0e (...)
[589.572] RSP: 002b:00007ffc98347358 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[589.572] RAX: 0000000000000000 RBX: 00007f49800b8264 RCX: 00007f497ff0a567
[589.572] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000557f558abfa0
[589.573] RBP: 0000557f558a6ba0 R08: 0000000000000000 R09: 00007ffc98346100
[589.573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[589.573] R13: 0000557f558abfa0 R14: 0000557f558a6cb0 R15: 0000557f558a6dd0
[589.573] </TASK>
[589.574] Modules linked in: dm_snapshot dm_thin_pool (...)
[589.576] ---[ end trace 0000000000000000 ]---
Fix this by adding a runtime flag to the block group to tell that the
block group is still in the list of new block groups, and therefore it
should not be moved to the list of unused block groups, at
btrfs_mark_bg_unused(), until the flag is cleared, when we finish the
creation of the block group at btrfs_create_pending_block_groups().
Fixes: a9f189716cf1 ("btrfs: move out now unused BG from the reclaim list")
CC: stable@vger.kernel.org # 5.15+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/block-group.c | 13 +++++++++++--
fs/btrfs/block-group.h | 5 +++++
2 files changed, 16 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
index a726b532b5277..08017b180a10d 100644
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -1528,13 +1528,14 @@ void btrfs_mark_bg_unused(struct btrfs_block_group *bg)
{
struct btrfs_fs_info *fs_info = bg->fs_info;
- trace_btrfs_add_unused_block_group(bg);
spin_lock(&fs_info->unused_bgs_lock);
if (list_empty(&bg->bg_list)) {
btrfs_get_block_group(bg);
+ trace_btrfs_add_unused_block_group(bg);
list_add_tail(&bg->bg_list, &fs_info->unused_bgs);
- } else {
+ } else if (!test_bit(BLOCK_GROUP_FLAG_NEW, &bg->runtime_flags)) {
/* Pull out the block group from the reclaim_bgs list. */
+ trace_btrfs_add_unused_block_group(bg);
list_move_tail(&bg->bg_list, &fs_info->unused_bgs);
}
spin_unlock(&fs_info->unused_bgs_lock);
@@ -2496,6 +2497,7 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans)
next:
btrfs_delayed_refs_rsv_release(fs_info, 1);
list_del_init(&block_group->bg_list);
+ clear_bit(BLOCK_GROUP_FLAG_NEW, &block_group->runtime_flags);
}
btrfs_trans_release_chunk_metadata(trans);
}
@@ -2535,6 +2537,13 @@ struct btrfs_block_group *btrfs_make_block_group(struct btrfs_trans_handle *tran
if (!cache)
return ERR_PTR(-ENOMEM);
+ /*
+ * Mark it as new before adding it to the rbtree of block groups or any
+ * list, so that no other task finds it and calls btrfs_mark_bg_unused()
+ * before the new flag is set.
+ */
+ set_bit(BLOCK_GROUP_FLAG_NEW, &cache->runtime_flags);
+
cache->length = size;
set_free_space_tree_thresholds(cache);
cache->used = bytes_used;
diff --git a/fs/btrfs/block-group.h b/fs/btrfs/block-group.h
index fb4f4901350bd..47a2dcbfee255 100644
--- a/fs/btrfs/block-group.h
+++ b/fs/btrfs/block-group.h
@@ -59,6 +59,11 @@ enum btrfs_block_group_flags {
BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE,
/* Indicate that the block group is placed on a sequential zone */
BLOCK_GROUP_FLAG_SEQUENTIAL_ZONE,
+ /*
+ * Indicate that block group is in the list of new block groups of a
+ * transaction.
+ */
+ BLOCK_GROUP_FLAG_NEW,
};
enum btrfs_caching_type {
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 084/194] virtio-mmio: dont break lifecycle of vm_dev
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 083/194] btrfs: fix use-after-free of new block group that became unused Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 085/194] vduse: Use proper spinlock for IRQ injection Greg Kroah-Hartman
` (120 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Michael S. Tsirkin,
Sasha Levin
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit 55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a ]
vm_dev has a separate lifecycle because it has a 'struct device'
embedded. Thus, having a release callback for it is correct.
Allocating the vm_dev struct with devres totally breaks this protection,
though. Instead of waiting for the vm_dev release callback, the memory
is freed when the platform_device is removed. Resulting in a
use-after-free when finally the callback is to be called.
To easily see the problem, compile the kernel with
CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs.
The fix is easy, don't use devres in this case.
Found during my research about object lifetime problems.
Fixes: 7eb781b1bbb7 ("virtio_mmio: add cleanup for virtio_mmio_probe")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Message-Id: <20230629120526.7184-1-wsa+renesas@sang-engineering.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/virtio/virtio_mmio.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index 3ff746e3f24aa..dec3cba884586 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -590,9 +590,8 @@ static void virtio_mmio_release_dev(struct device *_d)
struct virtio_device *vdev =
container_of(_d, struct virtio_device, dev);
struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
- struct platform_device *pdev = vm_dev->pdev;
- devm_kfree(&pdev->dev, vm_dev);
+ kfree(vm_dev);
}
/* Platform device */
@@ -603,7 +602,7 @@ static int virtio_mmio_probe(struct platform_device *pdev)
unsigned long magic;
int rc;
- vm_dev = devm_kzalloc(&pdev->dev, sizeof(*vm_dev), GFP_KERNEL);
+ vm_dev = kzalloc(sizeof(*vm_dev), GFP_KERNEL);
if (!vm_dev)
return -ENOMEM;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 085/194] vduse: Use proper spinlock for IRQ injection
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 084/194] virtio-mmio: dont break lifecycle of vm_dev Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 086/194] vdpa/mlx5: Fix mr->initialized semantics Greg Kroah-Hartman
` (119 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, xieyongji, Jason Wang,
Maxime Coquelin, Michael S. Tsirkin, Sasha Levin
From: Maxime Coquelin <maxime.coquelin@redhat.com>
[ Upstream commit 7ca26efb09a1543fddb29308ea3b63b66cb5d3ee ]
The IRQ injection work used spin_lock_irq() to protect the
scheduling of the softirq, but spin_lock_bh() should be
used.
With spin_lock_irq(), we noticed delay of more than 6
seconds between the time a NAPI polling work is scheduled
and the time it is executed.
Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Cc: xieyongji@bytedance.com
Suggested-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Message-Id: <20230705114505.63274-1-maxime.coquelin@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Xie Yongji <xieyongji@bytedance.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/vdpa_user/vduse_dev.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c
index 72f924ec4658d..edcd74cc4c0f7 100644
--- a/drivers/vdpa/vdpa_user/vduse_dev.c
+++ b/drivers/vdpa/vdpa_user/vduse_dev.c
@@ -899,10 +899,10 @@ static void vduse_dev_irq_inject(struct work_struct *work)
{
struct vduse_dev *dev = container_of(work, struct vduse_dev, inject);
- spin_lock_irq(&dev->irq_lock);
+ spin_lock_bh(&dev->irq_lock);
if (dev->config_cb.callback)
dev->config_cb.callback(dev->config_cb.private);
- spin_unlock_irq(&dev->irq_lock);
+ spin_unlock_bh(&dev->irq_lock);
}
static void vduse_vq_irq_inject(struct work_struct *work)
@@ -910,10 +910,10 @@ static void vduse_vq_irq_inject(struct work_struct *work)
struct vduse_virtqueue *vq = container_of(work,
struct vduse_virtqueue, inject);
- spin_lock_irq(&vq->irq_lock);
+ spin_lock_bh(&vq->irq_lock);
if (vq->ready && vq->cb.callback)
vq->cb.callback(vq->cb.private);
- spin_unlock_irq(&vq->irq_lock);
+ spin_unlock_bh(&vq->irq_lock);
}
static int vduse_dev_queue_irq_work(struct vduse_dev *dev,
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 086/194] vdpa/mlx5: Fix mr->initialized semantics
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 085/194] vduse: Use proper spinlock for IRQ injection Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 087/194] vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary Greg Kroah-Hartman
` (118 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragos Tatulea, Eugenio Pérez,
Gal Pressman, Michael S. Tsirkin, Jason Wang, Sasha Levin
From: Dragos Tatulea <dtatulea@nvidia.com>
[ Upstream commit 9ee811009ad8f87982b69e61d07447d12233ad01 ]
The mr->initialized flag is shared between the control vq and data vq
part of the mr init/uninit. But if the control vq and data vq get placed
in different ASIDs, it can happen that initializing the control vq will
prevent the data vq mr from being initialized.
This patch consolidates the control and data vq init parts into their
own init functions. The mr->initialized will now be used for the data vq
only. The control vq currently doesn't need a flag.
The uninitializing part is also taken care of: mlx5_vdpa_destroy_mr got
split into data and control vq functions which are now also ASID aware.
Fixes: 8fcd20c30704 ("vdpa/mlx5: Support different address spaces for control and data")
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Gal Pressman <gal@nvidia.com>
Message-Id: <20230802171231.11001-3-dtatulea@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/mlx5/core/mlx5_vdpa.h | 1 +
drivers/vdpa/mlx5/core/mr.c | 97 +++++++++++++++++++++---------
2 files changed, 71 insertions(+), 27 deletions(-)
diff --git a/drivers/vdpa/mlx5/core/mlx5_vdpa.h b/drivers/vdpa/mlx5/core/mlx5_vdpa.h
index 25fc4120b618d..a0420be5059f4 100644
--- a/drivers/vdpa/mlx5/core/mlx5_vdpa.h
+++ b/drivers/vdpa/mlx5/core/mlx5_vdpa.h
@@ -31,6 +31,7 @@ struct mlx5_vdpa_mr {
struct list_head head;
unsigned long num_directs;
unsigned long num_klms;
+ /* state of dvq mr */
bool initialized;
/* serialize mkey creation and destruction */
diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c
index a4d7ee2339fa5..b3609867d5676 100644
--- a/drivers/vdpa/mlx5/core/mr.c
+++ b/drivers/vdpa/mlx5/core/mr.c
@@ -491,15 +491,24 @@ static void destroy_user_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *mr
}
}
-void mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev)
+static void _mlx5_vdpa_destroy_cvq_mr(struct mlx5_vdpa_dev *mvdev, unsigned int asid)
+{
+ if (mvdev->group2asid[MLX5_VDPA_CVQ_GROUP] != asid)
+ return;
+
+ prune_iotlb(mvdev);
+}
+
+static void _mlx5_vdpa_destroy_dvq_mr(struct mlx5_vdpa_dev *mvdev, unsigned int asid)
{
struct mlx5_vdpa_mr *mr = &mvdev->mr;
- mutex_lock(&mr->mkey_mtx);
+ if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] != asid)
+ return;
+
if (!mr->initialized)
- goto out;
+ return;
- prune_iotlb(mvdev);
if (mr->user_mr)
destroy_user_mr(mvdev, mr);
else
@@ -507,45 +516,79 @@ void mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev)
memset(mr, 0, sizeof(*mr));
mr->initialized = false;
-out:
+}
+
+static void mlx5_vdpa_destroy_mr_asid(struct mlx5_vdpa_dev *mvdev, unsigned int asid)
+{
+ struct mlx5_vdpa_mr *mr = &mvdev->mr;
+
+ mutex_lock(&mr->mkey_mtx);
+
+ _mlx5_vdpa_destroy_dvq_mr(mvdev, asid);
+ _mlx5_vdpa_destroy_cvq_mr(mvdev, asid);
+
mutex_unlock(&mr->mkey_mtx);
}
-static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev,
- struct vhost_iotlb *iotlb, unsigned int asid)
+void mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev)
+{
+ mlx5_vdpa_destroy_mr_asid(mvdev, mvdev->group2asid[MLX5_VDPA_CVQ_GROUP]);
+ mlx5_vdpa_destroy_mr_asid(mvdev, mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP]);
+}
+
+static int _mlx5_vdpa_create_cvq_mr(struct mlx5_vdpa_dev *mvdev,
+ struct vhost_iotlb *iotlb,
+ unsigned int asid)
+{
+ if (mvdev->group2asid[MLX5_VDPA_CVQ_GROUP] != asid)
+ return 0;
+
+ return dup_iotlb(mvdev, iotlb);
+}
+
+static int _mlx5_vdpa_create_dvq_mr(struct mlx5_vdpa_dev *mvdev,
+ struct vhost_iotlb *iotlb,
+ unsigned int asid)
{
struct mlx5_vdpa_mr *mr = &mvdev->mr;
int err;
- if (mr->initialized)
+ if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] != asid)
return 0;
- if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] == asid) {
- if (iotlb)
- err = create_user_mr(mvdev, iotlb);
- else
- err = create_dma_mr(mvdev, mr);
+ if (mr->initialized)
+ return 0;
- if (err)
- return err;
- }
+ if (iotlb)
+ err = create_user_mr(mvdev, iotlb);
+ else
+ err = create_dma_mr(mvdev, mr);
- if (mvdev->group2asid[MLX5_VDPA_CVQ_GROUP] == asid) {
- err = dup_iotlb(mvdev, iotlb);
- if (err)
- goto out_err;
- }
+ if (err)
+ return err;
mr->initialized = true;
+
+ return 0;
+}
+
+static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev,
+ struct vhost_iotlb *iotlb, unsigned int asid)
+{
+ int err;
+
+ err = _mlx5_vdpa_create_dvq_mr(mvdev, iotlb, asid);
+ if (err)
+ return err;
+
+ err = _mlx5_vdpa_create_cvq_mr(mvdev, iotlb, asid);
+ if (err)
+ goto out_err;
+
return 0;
out_err:
- if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] == asid) {
- if (iotlb)
- destroy_user_mr(mvdev, mr);
- else
- destroy_dma_mr(mvdev, mr);
- }
+ _mlx5_vdpa_destroy_dvq_mr(mvdev, asid);
return err;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 087/194] vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 086/194] vdpa/mlx5: Fix mr->initialized semantics Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 088/194] cifs: fix potential oops in cifs_oplock_break Greg Kroah-Hartman
` (117 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eugenio Pérez, Gal Pressman,
Michael S. Tsirkin, Jason Wang, Sasha Levin
From: Eugenio Pérez <eperezma@redhat.com>
[ Upstream commit ad03a0f44cdb97b46e5c84ed353dac9b8ae2c276 ]
mlx5_vdpa_destroy_mr can be called from .set_map with data ASID after
the control virtqueue ASID iotlb has been populated. The control vq
iotlb must not be cleared, since it will not be populated again.
So call the ASID aware destroy function which makes sure that the
right vq resource is destroyed.
Fixes: 8fcd20c30704 ("vdpa/mlx5: Support different address spaces for control and data")
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Gal Pressman <gal@nvidia.com>
Message-Id: <20230802171231.11001-5-dtatulea@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/mlx5/core/mlx5_vdpa.h | 1 +
drivers/vdpa/mlx5/core/mr.c | 2 +-
drivers/vdpa/mlx5/net/mlx5_vnet.c | 4 ++--
3 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/vdpa/mlx5/core/mlx5_vdpa.h b/drivers/vdpa/mlx5/core/mlx5_vdpa.h
index a0420be5059f4..b53420e874acb 100644
--- a/drivers/vdpa/mlx5/core/mlx5_vdpa.h
+++ b/drivers/vdpa/mlx5/core/mlx5_vdpa.h
@@ -122,6 +122,7 @@ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *io
int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
unsigned int asid);
void mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev);
+void mlx5_vdpa_destroy_mr_asid(struct mlx5_vdpa_dev *mvdev, unsigned int asid);
#define mlx5_vdpa_warn(__dev, format, ...) \
dev_warn((__dev)->mdev->device, "%s:%d:(pid %d) warning: " format, __func__, __LINE__, \
diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c
index b3609867d5676..113aac0446de5 100644
--- a/drivers/vdpa/mlx5/core/mr.c
+++ b/drivers/vdpa/mlx5/core/mr.c
@@ -518,7 +518,7 @@ static void _mlx5_vdpa_destroy_dvq_mr(struct mlx5_vdpa_dev *mvdev, unsigned int
mr->initialized = false;
}
-static void mlx5_vdpa_destroy_mr_asid(struct mlx5_vdpa_dev *mvdev, unsigned int asid)
+void mlx5_vdpa_destroy_mr_asid(struct mlx5_vdpa_dev *mvdev, unsigned int asid)
{
struct mlx5_vdpa_mr *mr = &mvdev->mr;
diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
index daac3ab314785..bf99654371b35 100644
--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -2406,7 +2406,7 @@ static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev,
goto err_mr;
teardown_driver(ndev);
- mlx5_vdpa_destroy_mr(mvdev);
+ mlx5_vdpa_destroy_mr_asid(mvdev, asid);
err = mlx5_vdpa_create_mr(mvdev, iotlb, asid);
if (err)
goto err_mr;
@@ -2422,7 +2422,7 @@ static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev,
return 0;
err_setup:
- mlx5_vdpa_destroy_mr(mvdev);
+ mlx5_vdpa_destroy_mr_asid(mvdev, asid);
err_mr:
return err;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 088/194] cifs: fix potential oops in cifs_oplock_break
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 087/194] vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 089/194] i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue Greg Kroah-Hartman
` (116 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bharath SM, Shyam Prasad N,
Paulo Alcantara (SUSE), Steve French, Sasha Levin
From: Steve French <stfrench@microsoft.com>
[ Upstream commit e8f5f849ffce24490eb9449e98312b66c0dba76f ]
With deferred close we can have closes that race with lease breaks,
and so with the current checks for whether to send the lease response,
oplock_response(), this can mean that an unmount (kill_sb) can occur
just before we were checking if the tcon->ses is valid. See below:
[Fri Aug 4 04:12:50 2023] RIP: 0010:cifs_oplock_break+0x1f7/0x5b0 [cifs]
[Fri Aug 4 04:12:50 2023] Code: 7d a8 48 8b 7d c0 c0 e9 02 48 89 45 b8 41 89 cf e8 3e f5 ff ff 4c 89 f7 41 83 e7 01 e8 82 b3 03 f2 49 8b 45 50 48 85 c0 74 5e <48> 83 78 60 00 74 57 45 84 ff 75 52 48 8b 43 98 48 83 eb 68 48 39
[Fri Aug 4 04:12:50 2023] RSP: 0018:ffffb30607ddbdf8 EFLAGS: 00010206
[Fri Aug 4 04:12:50 2023] RAX: 632d223d32612022 RBX: ffff97136944b1e0 RCX: 0000000080100009
[Fri Aug 4 04:12:50 2023] RDX: 0000000000000001 RSI: 0000000080100009 RDI: ffff97136944b188
[Fri Aug 4 04:12:50 2023] RBP: ffffb30607ddbe58 R08: 0000000000000001 R09: ffffffffc08e0900
[Fri Aug 4 04:12:50 2023] R10: 0000000000000001 R11: 000000000000000f R12: ffff97136944b138
[Fri Aug 4 04:12:50 2023] R13: ffff97149147c000 R14: ffff97136944b188 R15: 0000000000000000
[Fri Aug 4 04:12:50 2023] FS: 0000000000000000(0000) GS:ffff9714f7c00000(0000) knlGS:0000000000000000
[Fri Aug 4 04:12:50 2023] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[Fri Aug 4 04:12:50 2023] CR2: 00007fd8de9c7590 CR3: 000000011228e000 CR4: 0000000000350ef0
[Fri Aug 4 04:12:50 2023] Call Trace:
[Fri Aug 4 04:12:50 2023] <TASK>
[Fri Aug 4 04:12:50 2023] process_one_work+0x225/0x3d0
[Fri Aug 4 04:12:50 2023] worker_thread+0x4d/0x3e0
[Fri Aug 4 04:12:50 2023] ? process_one_work+0x3d0/0x3d0
[Fri Aug 4 04:12:50 2023] kthread+0x12a/0x150
[Fri Aug 4 04:12:50 2023] ? set_kthread_struct+0x50/0x50
[Fri Aug 4 04:12:50 2023] ret_from_fork+0x22/0x30
[Fri Aug 4 04:12:50 2023] </TASK>
To fix this change the ordering of the checks before sending the oplock_response
to first check if the openFileList is empty.
Fixes: da787d5b7498 ("SMB3: Do not send lease break acknowledgment if all file handles have been closed")
Suggested-by: Bharath SM <bharathsm@microsoft.com>
Reviewed-by: Bharath SM <bharathsm@microsoft.com>
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/file.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c
index 27c6d14e369f1..0a8adec515aed 100644
--- a/fs/smb/client/file.c
+++ b/fs/smb/client/file.c
@@ -5082,9 +5082,11 @@ void cifs_oplock_break(struct work_struct *work)
struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo,
oplock_break);
struct inode *inode = d_inode(cfile->dentry);
+ struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
struct cifsInodeInfo *cinode = CIFS_I(inode);
- struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
- struct TCP_Server_Info *server = tcon->ses->server;
+ struct cifs_tcon *tcon;
+ struct TCP_Server_Info *server;
+ struct tcon_link *tlink;
int rc = 0;
bool purge_cache = false, oplock_break_cancelled;
__u64 persistent_fid, volatile_fid;
@@ -5093,6 +5095,12 @@ void cifs_oplock_break(struct work_struct *work)
wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS,
TASK_UNINTERRUPTIBLE);
+ tlink = cifs_sb_tlink(cifs_sb);
+ if (IS_ERR(tlink))
+ goto out;
+ tcon = tlink_tcon(tlink);
+ server = tcon->ses->server;
+
server->ops->downgrade_oplock(server, cinode, cfile->oplock_level,
cfile->oplock_epoch, &purge_cache);
@@ -5142,18 +5150,19 @@ void cifs_oplock_break(struct work_struct *work)
/*
* MS-SMB2 3.2.5.19.1 and 3.2.5.19.2 (and MS-CIFS 3.2.5.42) do not require
* an acknowledgment to be sent when the file has already been closed.
- * check for server null, since can race with kill_sb calling tree disconnect.
*/
spin_lock(&cinode->open_file_lock);
- if (tcon->ses && tcon->ses->server && !oplock_break_cancelled &&
- !list_empty(&cinode->openFileList)) {
+ /* check list empty since can race with kill_sb calling tree disconnect */
+ if (!oplock_break_cancelled && !list_empty(&cinode->openFileList)) {
spin_unlock(&cinode->open_file_lock);
- rc = tcon->ses->server->ops->oplock_response(tcon, persistent_fid,
- volatile_fid, net_fid, cinode);
+ rc = server->ops->oplock_response(tcon, persistent_fid,
+ volatile_fid, net_fid, cinode);
cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
} else
spin_unlock(&cinode->open_file_lock);
+ cifs_put_tlink(tlink);
+out:
cifs_done_oplock_break(cinode);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 089/194] i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 088/194] cifs: fix potential oops in cifs_oplock_break Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 090/194] i2c: hisi: Only handle the interrupt of the drivers transfer Greg Kroah-Hartman
` (115 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Ray Jui, Andi Shyti,
Wolfram Sang
From: Chengfeng Ye <dg573847474@gmail.com>
commit 4caf4cb1eaed469742ef719f2cc024b1ec3fa9e6 upstream.
iproc_i2c_rd_reg() and iproc_i2c_wr_reg() are called from both
interrupt context (e.g. bcm_iproc_i2c_isr) and process context
(e.g. bcm_iproc_i2c_suspend). Therefore, interrupts should be
disabled to avoid potential deadlock. To prevent this scenario,
use spin_lock_irqsave().
Fixes: 9a1038728037 ("i2c: iproc: add NIC I2C support")
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Acked-by: Ray Jui <ray.jui@broadcom.com>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-bcm-iproc.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/i2c/busses/i2c-bcm-iproc.c
+++ b/drivers/i2c/busses/i2c-bcm-iproc.c
@@ -233,13 +233,14 @@ static inline u32 iproc_i2c_rd_reg(struc
u32 offset)
{
u32 val;
+ unsigned long flags;
if (iproc_i2c->idm_base) {
- spin_lock(&iproc_i2c->idm_lock);
+ spin_lock_irqsave(&iproc_i2c->idm_lock, flags);
writel(iproc_i2c->ape_addr_mask,
iproc_i2c->idm_base + IDM_CTRL_DIRECT_OFFSET);
val = readl(iproc_i2c->base + offset);
- spin_unlock(&iproc_i2c->idm_lock);
+ spin_unlock_irqrestore(&iproc_i2c->idm_lock, flags);
} else {
val = readl(iproc_i2c->base + offset);
}
@@ -250,12 +251,14 @@ static inline u32 iproc_i2c_rd_reg(struc
static inline void iproc_i2c_wr_reg(struct bcm_iproc_i2c_dev *iproc_i2c,
u32 offset, u32 val)
{
+ unsigned long flags;
+
if (iproc_i2c->idm_base) {
- spin_lock(&iproc_i2c->idm_lock);
+ spin_lock_irqsave(&iproc_i2c->idm_lock, flags);
writel(iproc_i2c->ape_addr_mask,
iproc_i2c->idm_base + IDM_CTRL_DIRECT_OFFSET);
writel(val, iproc_i2c->base + offset);
- spin_unlock(&iproc_i2c->idm_lock);
+ spin_unlock_irqrestore(&iproc_i2c->idm_lock, flags);
} else {
writel(val, iproc_i2c->base + offset);
}
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 090/194] i2c: hisi: Only handle the interrupt of the drivers transfer
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 089/194] i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 091/194] i2c: tegra: Fix i2c-tegra DMA config option processing Greg Kroah-Hartman
` (114 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yicong Yang, Andi Shyti,
Wolfram Sang
From: Yicong Yang <yangyicong@hisilicon.com>
commit fff67c1b17ee093947bdcbac6f64d072e644159a upstream.
The controller may be shared with other port, for example the firmware.
Handle the interrupt from other sources will cause crash since some
data are not initialized. So only handle the interrupt of the driver's
transfer and discard others.
Fixes: d62fbdb99a85 ("i2c: add support for HiSilicon I2C controller")
Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20230801124625.63587-1-yangyicong@huawei.com
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-hisi.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/i2c/busses/i2c-hisi.c
+++ b/drivers/i2c/busses/i2c-hisi.c
@@ -328,6 +328,14 @@ static irqreturn_t hisi_i2c_irq(int irq,
struct hisi_i2c_controller *ctlr = context;
u32 int_stat;
+ /*
+ * Don't handle the interrupt if cltr->completion is NULL. We may
+ * reach here because the interrupt is spurious or the transfer is
+ * started by another port (e.g. firmware) rather than us.
+ */
+ if (!ctlr->completion)
+ return IRQ_NONE;
+
int_stat = readl(ctlr->iobase + HISI_I2C_INT_MSTAT);
hisi_i2c_clear_int(ctlr, int_stat);
if (!(int_stat & HISI_I2C_INT_ALL))
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 091/194] i2c: tegra: Fix i2c-tegra DMA config option processing
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 090/194] i2c: hisi: Only handle the interrupt of the drivers transfer Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 092/194] fbdev: mmp: fix value check in mmphw_probe() Greg Kroah-Hartman
` (113 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Parker Newman, Andi Shyti, Akhil R,
Wolfram Sang
From: Parker Newman <pnewman@connecttech.com>
commit 27ec43c77b5db780a56fc3a6d6de6bf2f74614f7 upstream.
Tegra processors prior to Tegra186 used APB DMA for I2C requiring
CONFIG_TEGRA20_APB_DMA=y while Tegra186 and later use GPC DMA requiring
CONFIG_TEGRA186_GPC_DMA=y.
The check for if the processor uses APB DMA is inverted and so the wrong
DMA config options are checked.
This means if CONFIG_TEGRA20_APB_DMA=y but CONFIG_TEGRA186_GPC_DMA=n
with a Tegra186 or later processor the driver will incorrectly think DMA is
enabled and attempt to request DMA channels that will never be availible,
leaving the driver in a perpetual EPROBE_DEFER state.
Fixes: 48cb6356fae1 ("i2c: tegra: Add GPCDMA support")
Signed-off-by: Parker Newman <pnewman@connecttech.com>
Acked-by: Andi Shyti <andi.shyti@kernel.org>
Acked-by: Akhil R <akhilrajeev@nvidia.com>
Link: https://lore.kernel.org/r/fcfcf9b3-c8c4-9b34-2ff8-cd60a3d490bd@connecttech.com
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-tegra.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -449,7 +449,7 @@ static int tegra_i2c_init_dma(struct teg
if (i2c_dev->is_vi)
return 0;
- if (!i2c_dev->hw->has_apb_dma) {
+ if (i2c_dev->hw->has_apb_dma) {
if (!IS_ENABLED(CONFIG_TEGRA20_APB_DMA)) {
dev_dbg(i2c_dev->dev, "APB DMA support not enabled\n");
return 0;
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 092/194] fbdev: mmp: fix value check in mmphw_probe()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 091/194] i2c: tegra: Fix i2c-tegra DMA config option processing Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 093/194] powerpc/rtas_flash: allow user copy to flash block cache objects Greg Kroah-Hartman
` (112 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuanjun Gong, Helge Deller
From: Yuanjun Gong <ruc_gongyuanjun@163.com>
commit 0872b2c0abc0e84ac82472959c8e14e35277549c upstream.
in mmphw_probe(), check the return value of clk_prepare_enable()
and return the error code if clk_prepare_enable() returns an
unexpected value.
Fixes: d63028c38905 ("video: mmp display controller support")
Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
+++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
@@ -519,7 +519,9 @@ static int mmphw_probe(struct platform_d
"unable to get clk %s\n", mi->clk_name);
goto failed;
}
- clk_prepare_enable(ctrl->clk);
+ ret = clk_prepare_enable(ctrl->clk);
+ if (ret)
+ goto failed;
/* init global regs */
ctrl_set_default(ctrl);
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 093/194] powerpc/rtas_flash: allow user copy to flash block cache objects
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 092/194] fbdev: mmp: fix value check in mmphw_probe() Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 094/194] vdpa: Add features attr to vdpa_nl_policy for nlattr length check Greg Kroah-Hartman
` (111 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Lynch, Kees Cook,
Michael Ellerman
From: Nathan Lynch <nathanl@linux.ibm.com>
commit 4f3175979e62de3b929bfa54a0db4b87d36257a7 upstream.
With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the
/proc/powerpc/rtas/firmware_update interface to prepare a system
firmware update yields a BUG():
kernel BUG at mm/usercopy.c:102!
Oops: Exception in kernel mode, sig: 5 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2
Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860_146) hv:phyp pSeries
NIP: c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000
REGS: c0000000148c76a0 TRAP: 0700 Not tainted (6.5.0-rc3+)
MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 24002242 XER: 0000000c
CFAR: c0000000001fbd34 IRQMASK: 0
[ ... GPRs omitted ... ]
NIP usercopy_abort+0xa0/0xb0
LR usercopy_abort+0x9c/0xb0
Call Trace:
usercopy_abort+0x9c/0xb0 (unreliable)
__check_heap_object+0x1b4/0x1d0
__check_object_size+0x2d0/0x380
rtas_flash_write+0xe4/0x250
proc_reg_write+0xfc/0x160
vfs_write+0xfc/0x4e0
ksys_write+0x90/0x160
system_call_exception+0x178/0x320
system_call_common+0x160/0x2c4
The blocks of the firmware image are copied directly from user memory
to objects allocated from flash_block_cache, so flash_block_cache must
be created using kmem_cache_create_usercopy() to mark it safe for user
access.
Fixes: 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[mpe: Trim and indent oops]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230810-rtas-flash-vs-hardened-usercopy-v2-1-dcf63793a938@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/rtas_flash.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -710,9 +710,9 @@ static int __init rtas_flash_init(void)
if (!rtas_validate_flash_data.buf)
return -ENOMEM;
- flash_block_cache = kmem_cache_create("rtas_flash_cache",
- RTAS_BLK_SIZE, RTAS_BLK_SIZE, 0,
- NULL);
+ flash_block_cache = kmem_cache_create_usercopy("rtas_flash_cache",
+ RTAS_BLK_SIZE, RTAS_BLK_SIZE,
+ 0, 0, RTAS_BLK_SIZE, NULL);
if (!flash_block_cache) {
printk(KERN_ERR "%s: failed to create block cache\n",
__func__);
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 094/194] vdpa: Add features attr to vdpa_nl_policy for nlattr length check
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 093/194] powerpc/rtas_flash: allow user copy to flash block cache objects Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 095/194] vdpa: Add queue index " Greg Kroah-Hartman
` (110 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lin Ma, Michael S. Tsirkin
From: Lin Ma <linma@zju.edu.cn>
commit 79c8651587504ba263d2fd67fd4406240fb21f69 upstream.
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa features attr to avoid
such bugs.
Fixes: 90fea5a800c3 ("vdpa: device feature provisioning")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Cc: stable@vger.kernel.org
Message-Id: <20230727175757.73988-3-dtatulea@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vdpa/vdpa.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/vdpa/vdpa.c
+++ b/drivers/vdpa/vdpa.c
@@ -1174,6 +1174,7 @@ static const struct nla_policy vdpa_nl_p
[VDPA_ATTR_DEV_NET_CFG_MACADDR] = NLA_POLICY_ETH_ADDR,
/* virtio spec 1.1 section 5.1.4.1 for valid MTU range */
[VDPA_ATTR_DEV_NET_CFG_MTU] = NLA_POLICY_MIN(NLA_U16, 68),
+ [VDPA_ATTR_DEV_FEATURES] = { .type = NLA_U64 },
};
static const struct genl_ops vdpa_nl_ops[] = {
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 095/194] vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 094/194] vdpa: Add features attr to vdpa_nl_policy for nlattr length check Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 096/194] vdpa: Add max vqp " Greg Kroah-Hartman
` (109 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lin Ma, stable, Michael S. Tsirkin
From: Lin Ma <linma@zju.edu.cn>
commit b3003e1b54e057f5f3124e437b80c3bef26ed3fe upstream.
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa queue index attr to avoid
such bugs.
Fixes: 13b00b135665 ("vdpa: Add support for querying vendor statistics")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Cc: stable@vger.kernelorg
Message-Id: <20230727175757.73988-5-dtatulea@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vdpa/vdpa.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/vdpa/vdpa.c
+++ b/drivers/vdpa/vdpa.c
@@ -1174,6 +1174,7 @@ static const struct nla_policy vdpa_nl_p
[VDPA_ATTR_DEV_NET_CFG_MACADDR] = NLA_POLICY_ETH_ADDR,
/* virtio spec 1.1 section 5.1.4.1 for valid MTU range */
[VDPA_ATTR_DEV_NET_CFG_MTU] = NLA_POLICY_MIN(NLA_U16, 68),
+ [VDPA_ATTR_DEV_QUEUE_INDEX] = { .type = NLA_U32 },
[VDPA_ATTR_DEV_FEATURES] = { .type = NLA_U64 },
};
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 096/194] vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 095/194] vdpa: Add queue index " Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 097/194] vdpa: Enable strict validation for netlinks ops Greg Kroah-Hartman
` (108 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lin Ma, Michael S. Tsirkin
From: Lin Ma <linma@zju.edu.cn>
commit 5d6ba607d6cb5c58a4ddf33381e18c83dbb4098f upstream.
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa max vqp attr to avoid
such bugs.
Fixes: ad69dd0bf26b ("vdpa: Introduce query of device config layout")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Cc: stable@vger.kernel.org
Message-Id: <20230727175757.73988-7-dtatulea@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vdpa/vdpa.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/vdpa/vdpa.c
+++ b/drivers/vdpa/vdpa.c
@@ -1172,6 +1172,7 @@ static const struct nla_policy vdpa_nl_p
[VDPA_ATTR_MGMTDEV_DEV_NAME] = { .type = NLA_STRING },
[VDPA_ATTR_DEV_NAME] = { .type = NLA_STRING },
[VDPA_ATTR_DEV_NET_CFG_MACADDR] = NLA_POLICY_ETH_ADDR,
+ [VDPA_ATTR_DEV_NET_CFG_MAX_VQP] = { .type = NLA_U16 },
/* virtio spec 1.1 section 5.1.4.1 for valid MTU range */
[VDPA_ATTR_DEV_NET_CFG_MTU] = NLA_POLICY_MIN(NLA_U16, 68),
[VDPA_ATTR_DEV_QUEUE_INDEX] = { .type = NLA_U32 },
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 097/194] vdpa: Enable strict validation for netlinks ops
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 096/194] vdpa: Add max vqp " Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 098/194] tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux Greg Kroah-Hartman
` (107 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dragos Tatulea, Michael S. Tsirkin
From: Dragos Tatulea <dtatulea@nvidia.com>
commit f46c1e1620c6bbc9aad5693082efd1b80822e97c upstream.
The previous patches added the missing nla policies that were required for
validation to work.
Now strict validation on netlink ops can be enabled. This patch does it.
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Cc: stable@vger.kernel.org
Message-Id: <20230727175757.73988-9-dtatulea@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vdpa/vdpa.c | 6 ------
1 file changed, 6 deletions(-)
--- a/drivers/vdpa/vdpa.c
+++ b/drivers/vdpa/vdpa.c
@@ -1182,37 +1182,31 @@ static const struct nla_policy vdpa_nl_p
static const struct genl_ops vdpa_nl_ops[] = {
{
.cmd = VDPA_CMD_MGMTDEV_GET,
- .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = vdpa_nl_cmd_mgmtdev_get_doit,
.dumpit = vdpa_nl_cmd_mgmtdev_get_dumpit,
},
{
.cmd = VDPA_CMD_DEV_NEW,
- .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = vdpa_nl_cmd_dev_add_set_doit,
.flags = GENL_ADMIN_PERM,
},
{
.cmd = VDPA_CMD_DEV_DEL,
- .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = vdpa_nl_cmd_dev_del_set_doit,
.flags = GENL_ADMIN_PERM,
},
{
.cmd = VDPA_CMD_DEV_GET,
- .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = vdpa_nl_cmd_dev_get_doit,
.dumpit = vdpa_nl_cmd_dev_get_dumpit,
},
{
.cmd = VDPA_CMD_DEV_CONFIG_GET,
- .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = vdpa_nl_cmd_dev_config_get_doit,
.dumpit = vdpa_nl_cmd_dev_config_get_dumpit,
},
{
.cmd = VDPA_CMD_DEV_VSTATS_GET,
- .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = vdpa_nl_cmd_dev_stats_get_doit,
.flags = GENL_ADMIN_PERM,
},
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 098/194] tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 097/194] vdpa: Enable strict validation for netlinks ops Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 099/194] tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms Greg Kroah-Hartman
` (106 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Yi Yang, Qiumiao Zhang
From: Yi Yang <yiyang13@huawei.com>
commit 3c4f8333b582487a2d1e02171f1465531cde53e3 upstream.
In commit 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux"), the UAF
problem is not completely fixed. There is a race condition in
gsm_cleanup_mux(), which caused this UAF.
The UAF problem is triggered by the following race:
task[5046] task[5054]
----------------------- -----------------------
gsm_cleanup_mux();
dlci = gsm->dlci[0];
mutex_lock(&gsm->mutex);
gsm_cleanup_mux();
dlci = gsm->dlci[0]; //Didn't take the lock
gsm_dlci_release(gsm->dlci[i]);
gsm->dlci[i] = NULL;
mutex_unlock(&gsm->mutex);
mutex_lock(&gsm->mutex);
dlci->dead = true; //UAF
Fix it by assigning values after mutex_lock().
Link: https://syzkaller.appspot.com/text?tag=CrashReport&x=176188b5a80000
Cc: stable <stable@kernel.org>
Fixes: 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux")
Fixes: aa371e96f05d ("tty: n_gsm: fix restart handling via CLD command")
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Co-developed-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
Link: https://lore.kernel.org/r/20230811031121.153237-1-yiyang13@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/n_gsm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2481,12 +2481,13 @@ static void gsm_error(struct gsm_mux *gs
static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
{
int i;
- struct gsm_dlci *dlci = gsm->dlci[0];
+ struct gsm_dlci *dlci;
struct gsm_msg *txq, *ntxq;
gsm->dead = true;
mutex_lock(&gsm->mutex);
+ dlci = gsm->dlci[0];
if (dlci) {
if (disc && dlci->state != DLCI_CLOSED) {
gsm_dlci_begin_close(dlci);
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 099/194] tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 098/194] tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 100/194] btrfs: fix incorrect splitting in btrfs_drop_extent_map_range Greg Kroah-Hartman
` (105 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Sherry Sun
From: Sherry Sun <sherry.sun@nxp.com>
commit 282069845af388b08d622ad192b831dcd0549c62 upstream.
Do not read the data register to clear the error flags for lpuart32
platforms, the additional read may cause the receive FIFO underflow
since the DMA has already read the data register.
Actually all lpuart32 platforms support write 1 to clear those error
bits, let's use this method to better clear the error flags.
Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant")
Cc: stable <stable@kernel.org>
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Link: https://lore.kernel.org/r/20230801022304.24251-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/fsl_lpuart.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1125,8 +1125,8 @@ static void lpuart_copy_rx_to_tty(struct
unsigned long sr = lpuart32_read(&sport->port, UARTSTAT);
if (sr & (UARTSTAT_PE | UARTSTAT_FE)) {
- /* Read DR to clear the error flags */
- lpuart32_read(&sport->port, UARTDATA);
+ /* Clear the error flags */
+ lpuart32_write(&sport->port, sr, UARTSTAT);
if (sr & UARTSTAT_PE)
sport->port.icount.parity++;
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 100/194] btrfs: fix incorrect splitting in btrfs_drop_extent_map_range
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 099/194] tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 101/194] btrfs: fix BUG_ON condition in btrfs_cancel_balance Greg Kroah-Hartman
` (104 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, Josef Bacik,
David Sterba
From: Josef Bacik <josef@toxicpanda.com>
commit c962098ca4af146f2625ed64399926a098752c9c upstream.
In production we were seeing a variety of WARN_ON()'s in the extent_map
code, specifically in btrfs_drop_extent_map_range() when we have to call
add_extent_mapping() for our second split.
Consider the following extent map layout
PINNED
[0 16K) [32K, 48K)
and then we call btrfs_drop_extent_map_range for [0, 36K), with
skip_pinned == true. The initial loop will have
start = 0
end = 36K
len = 36K
we will find the [0, 16k) extent, but since we are pinned we will skip
it, which has this code
start = em_end;
if (end != (u64)-1)
len = start + len - em_end;
em_end here is 16K, so now the values are
start = 16K
len = 16K + 36K - 16K = 36K
len should instead be 20K. This is a problem when we find the next
extent at [32K, 48K), we need to split this extent to leave [36K, 48k),
however the code for the split looks like this
split->start = start + len;
split->len = em_end - (start + len);
In this case we have
em_end = 48K
split->start = 16K + 36K // this should be 16K + 20K
split->len = 48K - (16K + 36K) // this overflows as 16K + 36K is 52K
and now we have an invalid extent_map in the tree that potentially
overlaps other entries in the extent map. Even in the non-overlapping
case we will have split->start set improperly, which will cause problems
with any block related calculations.
We don't actually need len in this loop, we can simply use end as our
end point, and only adjust start up when we find a pinned extent we need
to skip.
Adjust the logic to do this, which keeps us from inserting an invalid
extent map.
We only skip_pinned in the relocation case, so this is relatively rare,
except in the case where you are running relocation a lot, which can
happen with auto relocation on.
Fixes: 55ef68990029 ("Btrfs: Fix btrfs_drop_extent_cache for skip pinned case")
CC: stable@vger.kernel.org # 4.14+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/extent_map.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -784,8 +784,6 @@ void btrfs_drop_extent_map_range(struct
if (skip_pinned && test_bit(EXTENT_FLAG_PINNED, &em->flags)) {
start = em_end;
- if (end != (u64)-1)
- len = start + len - em_end;
goto next;
}
@@ -853,8 +851,8 @@ void btrfs_drop_extent_map_range(struct
if (!split)
goto remove_em;
}
- split->start = start + len;
- split->len = em_end - (start + len);
+ split->start = end;
+ split->len = em_end - end;
split->block_start = em->block_start;
split->flags = flags;
split->compress_type = em->compress_type;
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 101/194] btrfs: fix BUG_ON condition in btrfs_cancel_balance
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 100/194] btrfs: fix incorrect splitting in btrfs_drop_extent_map_range Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 102/194] i2c: designware: Correct length byte validation logic Greg Kroah-Hartman
` (103 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, xiaoshoukui, David Sterba
From: xiaoshoukui <xiaoshoukui@gmail.com>
commit 29eefa6d0d07e185f7bfe9576f91e6dba98189c2 upstream.
Pausing and canceling balance can race to interrupt balance lead to BUG_ON
panic in btrfs_cancel_balance. The BUG_ON condition in btrfs_cancel_balance
does not take this race scenario into account.
However, the race condition has no other side effects. We can fix that.
Reproducing it with panic trace like this:
kernel BUG at fs/btrfs/volumes.c:4618!
RIP: 0010:btrfs_cancel_balance+0x5cf/0x6a0
Call Trace:
<TASK>
? do_nanosleep+0x60/0x120
? hrtimer_nanosleep+0xb7/0x1a0
? sched_core_clone_cookie+0x70/0x70
btrfs_ioctl_balance_ctl+0x55/0x70
btrfs_ioctl+0xa46/0xd20
__x64_sys_ioctl+0x7d/0xa0
do_syscall_64+0x38/0x80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Race scenario as follows:
> mutex_unlock(&fs_info->balance_mutex);
> --------------------
> .......issue pause and cancel req in another thread
> --------------------
> ret = __btrfs_balance(fs_info);
>
> mutex_lock(&fs_info->balance_mutex);
> if (ret == -ECANCELED && atomic_read(&fs_info->balance_pause_req)) {
> btrfs_info(fs_info, "balance: paused");
> btrfs_exclop_balance(fs_info, BTRFS_EXCLOP_BALANCE_PAUSED);
> }
CC: stable@vger.kernel.org # 4.19+
Signed-off-by: xiaoshoukui <xiaoshoukui@ruijie.com.cn>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/volumes.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4652,8 +4652,7 @@ int btrfs_cancel_balance(struct btrfs_fs
}
}
- BUG_ON(fs_info->balance_ctl ||
- test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags));
+ ASSERT(!test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags));
atomic_dec(&fs_info->balance_cancel_req);
mutex_unlock(&fs_info->balance_mutex);
return 0;
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 102/194] i2c: designware: Correct length byte validation logic
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 101/194] btrfs: fix BUG_ON condition in btrfs_cancel_balance Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 103/194] i2c: designware: Handle invalid SMBus block data response length value Greg Kroah-Hartman
` (102 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tam Nguyen, Quan Nguyen,
Jarkko Nikula, Andi Shyti, Wolfram Sang
From: Quan Nguyen <quan@os.amperecomputing.com>
commit 49d4db3953cb9004ff94efc0c176e026c820af5a upstream.
Commit 0daede80f870 ("i2c: designware: Convert driver to using regmap API")
changes the logic to validate the whole 32-bit return value of
DW_IC_DATA_CMD register instead of 8-bit LSB without reason.
Later, commit f53f15ba5a85 ("i2c: designware: Get right data length"),
introduced partial fix but not enough because the "tmp > 0" still test
tmp as 32-bit value and is wrong in case the IC_DATA_CMD[11] is set.
Revert the logic to just before commit 0daede80f870
("i2c: designware: Convert driver to using regmap API").
Fixes: f53f15ba5a85 ("i2c: designware: Get right data length")
Fixes: 0daede80f870 ("i2c: designware: Convert driver to using regmap API")
Cc: stable@vger.kernel.org
Signed-off-by: Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
Signed-off-by: Quan Nguyen <quan@os.amperecomputing.com>
Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Link: https://lore.kernel.org/r/20230726080001.337353-2-tamnguyenchi@os.amperecomputing.com
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-designware-master.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -525,9 +525,10 @@ i2c_dw_read(struct dw_i2c_dev *dev)
u32 flags = msgs[dev->msg_read_idx].flags;
regmap_read(dev->map, DW_IC_DATA_CMD, &tmp);
+ tmp &= DW_IC_DATA_CMD_DAT;
/* Ensure length byte is a valid value */
if (flags & I2C_M_RECV_LEN &&
- (tmp & DW_IC_DATA_CMD_DAT) <= I2C_SMBUS_BLOCK_MAX && tmp > 0) {
+ tmp <= I2C_SMBUS_BLOCK_MAX && tmp > 0) {
len = i2c_dw_recv_len(dev, tmp);
}
*buf++ = tmp;
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 103/194] i2c: designware: Handle invalid SMBus block data response length value
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 102/194] i2c: designware: Correct length byte validation logic Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 104/194] net: xfrm: Fix xfrm_address_filter OOB read Greg Kroah-Hartman
` (101 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tam Nguyen, Jarkko Nikula,
Andi Shyti, Wolfram Sang
From: Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
commit 69f035c480d76f12bf061148ccfd578e1099e5fc upstream.
In the I2C_FUNC_SMBUS_BLOCK_DATA case, the invalid length byte value
(outside of 1-32) of the SMBus block data response from the Slave device
is not correctly handled by the I2C Designware driver.
In case IC_EMPTYFIFO_HOLD_MASTER_EN==1, which cannot be detected
from the registers, the Master can be disabled only if the STOP bit
is set. Without STOP bit set, the Master remains active, holding the bus
until receiving a block data response length. This hangs the bus and
is unrecoverable.
Avoid this by issuing another dump read to reach the stop condition when
an invalid length byte is received.
Cc: stable@vger.kernel.org
Signed-off-by: Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Link: https://lore.kernel.org/r/20230726080001.337353-3-tamnguyenchi@os.amperecomputing.com
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-designware-master.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -527,8 +527,19 @@ i2c_dw_read(struct dw_i2c_dev *dev)
regmap_read(dev->map, DW_IC_DATA_CMD, &tmp);
tmp &= DW_IC_DATA_CMD_DAT;
/* Ensure length byte is a valid value */
- if (flags & I2C_M_RECV_LEN &&
- tmp <= I2C_SMBUS_BLOCK_MAX && tmp > 0) {
+ if (flags & I2C_M_RECV_LEN) {
+ /*
+ * if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which cannot be
+ * detected from the registers, the controller can be
+ * disabled if the STOP bit is set. But it is only set
+ * after receiving block data response length in
+ * I2C_FUNC_SMBUS_BLOCK_DATA case. That needs to read
+ * another byte with STOP bit set when the block data
+ * response length is invalid to complete the transaction.
+ */
+ if (!tmp || tmp > I2C_SMBUS_BLOCK_MAX)
+ tmp = 1;
+
len = i2c_dw_recv_len(dev, tmp);
}
*buf++ = tmp;
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 104/194] net: xfrm: Fix xfrm_address_filter OOB read
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 103/194] i2c: designware: Handle invalid SMBus block data response length value Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 105/194] net: af_key: fix sadb_x_filter validation Greg Kroah-Hartman
` (100 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lin Ma, Steffen Klassert,
Sasha Levin
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit dfa73c17d55b921e1d4e154976de35317e43a93a ]
We found below OOB crash:
[ 44.211730] ==================================================================
[ 44.212045] BUG: KASAN: slab-out-of-bounds in memcmp+0x8b/0xb0
[ 44.212045] Read of size 8 at addr ffff88800870f320 by task poc.xfrm/97
[ 44.212045]
[ 44.212045] CPU: 0 PID: 97 Comm: poc.xfrm Not tainted 6.4.0-rc7-00072-gdad9774deaf1-dirty #4
[ 44.212045] Call Trace:
[ 44.212045] <TASK>
[ 44.212045] dump_stack_lvl+0x37/0x50
[ 44.212045] print_report+0xcc/0x620
[ 44.212045] ? __virt_addr_valid+0xf3/0x170
[ 44.212045] ? memcmp+0x8b/0xb0
[ 44.212045] kasan_report+0xb2/0xe0
[ 44.212045] ? memcmp+0x8b/0xb0
[ 44.212045] kasan_check_range+0x39/0x1c0
[ 44.212045] memcmp+0x8b/0xb0
[ 44.212045] xfrm_state_walk+0x21c/0x420
[ 44.212045] ? __pfx_dump_one_state+0x10/0x10
[ 44.212045] xfrm_dump_sa+0x1e2/0x290
[ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10
[ 44.212045] ? __kernel_text_address+0xd/0x40
[ 44.212045] ? kasan_unpoison+0x27/0x60
[ 44.212045] ? mutex_lock+0x60/0xe0
[ 44.212045] ? __pfx_mutex_lock+0x10/0x10
[ 44.212045] ? kasan_save_stack+0x22/0x50
[ 44.212045] netlink_dump+0x322/0x6c0
[ 44.212045] ? __pfx_netlink_dump+0x10/0x10
[ 44.212045] ? mutex_unlock+0x7f/0xd0
[ 44.212045] ? __pfx_mutex_unlock+0x10/0x10
[ 44.212045] __netlink_dump_start+0x353/0x430
[ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410
[ 44.212045] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10
[ 44.212045] ? __pfx_xfrm_dump_sa_done+0x10/0x10
[ 44.212045] ? __stack_depot_save+0x382/0x4e0
[ 44.212045] ? filter_irq_stacks+0x1c/0x70
[ 44.212045] ? kasan_save_stack+0x32/0x50
[ 44.212045] ? kasan_save_stack+0x22/0x50
[ 44.212045] ? kasan_set_track+0x25/0x30
[ 44.212045] ? __kasan_slab_alloc+0x59/0x70
[ 44.212045] ? kmem_cache_alloc_node+0xf7/0x260
[ 44.212045] ? kmalloc_reserve+0xab/0x120
[ 44.212045] ? __alloc_skb+0xcf/0x210
[ 44.212045] ? netlink_sendmsg+0x509/0x700
[ 44.212045] ? sock_sendmsg+0xde/0xe0
[ 44.212045] ? __sys_sendto+0x18d/0x230
[ 44.212045] ? __x64_sys_sendto+0x71/0x90
[ 44.212045] ? do_syscall_64+0x3f/0x90
[ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 44.212045] ? netlink_sendmsg+0x509/0x700
[ 44.212045] ? sock_sendmsg+0xde/0xe0
[ 44.212045] ? __sys_sendto+0x18d/0x230
[ 44.212045] ? __x64_sys_sendto+0x71/0x90
[ 44.212045] ? do_syscall_64+0x3f/0x90
[ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 44.212045] ? kasan_save_stack+0x22/0x50
[ 44.212045] ? kasan_set_track+0x25/0x30
[ 44.212045] ? kasan_save_free_info+0x2e/0x50
[ 44.212045] ? __kasan_slab_free+0x10a/0x190
[ 44.212045] ? kmem_cache_free+0x9c/0x340
[ 44.212045] ? netlink_recvmsg+0x23c/0x660
[ 44.212045] ? sock_recvmsg+0xeb/0xf0
[ 44.212045] ? __sys_recvfrom+0x13c/0x1f0
[ 44.212045] ? __x64_sys_recvfrom+0x71/0x90
[ 44.212045] ? do_syscall_64+0x3f/0x90
[ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 44.212045] ? copyout+0x3e/0x50
[ 44.212045] netlink_rcv_skb+0xd6/0x210
[ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[ 44.212045] ? __pfx_netlink_rcv_skb+0x10/0x10
[ 44.212045] ? __pfx_sock_has_perm+0x10/0x10
[ 44.212045] ? mutex_lock+0x8d/0xe0
[ 44.212045] ? __pfx_mutex_lock+0x10/0x10
[ 44.212045] xfrm_netlink_rcv+0x44/0x50
[ 44.212045] netlink_unicast+0x36f/0x4c0
[ 44.212045] ? __pfx_netlink_unicast+0x10/0x10
[ 44.212045] ? netlink_recvmsg+0x500/0x660
[ 44.212045] netlink_sendmsg+0x3b7/0x700
[ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10
[ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10
[ 44.212045] sock_sendmsg+0xde/0xe0
[ 44.212045] __sys_sendto+0x18d/0x230
[ 44.212045] ? __pfx___sys_sendto+0x10/0x10
[ 44.212045] ? rcu_core+0x44a/0xe10
[ 44.212045] ? __rseq_handle_notify_resume+0x45b/0x740
[ 44.212045] ? _raw_spin_lock_irq+0x81/0xe0
[ 44.212045] ? __pfx___rseq_handle_notify_resume+0x10/0x10
[ 44.212045] ? __pfx_restore_fpregs_from_fpstate+0x10/0x10
[ 44.212045] ? __pfx_blkcg_maybe_throttle_current+0x10/0x10
[ 44.212045] ? __pfx_task_work_run+0x10/0x10
[ 44.212045] __x64_sys_sendto+0x71/0x90
[ 44.212045] do_syscall_64+0x3f/0x90
[ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 44.212045] RIP: 0033:0x44b7da
[ 44.212045] RSP: 002b:00007ffdc8838548 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 44.212045] RAX: ffffffffffffffda RBX: 00007ffdc8839978 RCX: 000000000044b7da
[ 44.212045] RDX: 0000000000000038 RSI: 00007ffdc8838770 RDI: 0000000000000003
[ 44.212045] RBP: 00007ffdc88385b0 R08: 00007ffdc883858c R09: 000000000000000c
[ 44.212045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 44.212045] R13: 00007ffdc8839968 R14: 00000000004c37d0 R15: 0000000000000001
[ 44.212045] </TASK>
[ 44.212045]
[ 44.212045] Allocated by task 97:
[ 44.212045] kasan_save_stack+0x22/0x50
[ 44.212045] kasan_set_track+0x25/0x30
[ 44.212045] __kasan_kmalloc+0x7f/0x90
[ 44.212045] __kmalloc_node_track_caller+0x5b/0x140
[ 44.212045] kmemdup+0x21/0x50
[ 44.212045] xfrm_dump_sa+0x17d/0x290
[ 44.212045] netlink_dump+0x322/0x6c0
[ 44.212045] __netlink_dump_start+0x353/0x430
[ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410
[ 44.212045] netlink_rcv_skb+0xd6/0x210
[ 44.212045] xfrm_netlink_rcv+0x44/0x50
[ 44.212045] netlink_unicast+0x36f/0x4c0
[ 44.212045] netlink_sendmsg+0x3b7/0x700
[ 44.212045] sock_sendmsg+0xde/0xe0
[ 44.212045] __sys_sendto+0x18d/0x230
[ 44.212045] __x64_sys_sendto+0x71/0x90
[ 44.212045] do_syscall_64+0x3f/0x90
[ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 44.212045]
[ 44.212045] The buggy address belongs to the object at ffff88800870f300
[ 44.212045] which belongs to the cache kmalloc-64 of size 64
[ 44.212045] The buggy address is located 32 bytes inside of
[ 44.212045] allocated 36-byte region [ffff88800870f300, ffff88800870f324)
[ 44.212045]
[ 44.212045] The buggy address belongs to the physical page:
[ 44.212045] page:00000000e4de16ee refcount:1 mapcount:0 mapping:000000000 ...
[ 44.212045] flags: 0x100000000000200(slab|node=0|zone=1)
[ 44.212045] page_type: 0xffffffff()
[ 44.212045] raw: 0100000000000200 ffff888004c41640 dead000000000122 0000000000000000
[ 44.212045] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
[ 44.212045] page dumped because: kasan: bad access detected
[ 44.212045]
[ 44.212045] Memory state around the buggy address:
[ 44.212045] ffff88800870f200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 44.212045] ffff88800870f280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 44.212045] >ffff88800870f300: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc
[ 44.212045] ^
[ 44.212045] ffff88800870f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 44.212045] ffff88800870f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 44.212045] ==================================================================
By investigating the code, we find the root cause of this OOB is the lack
of checks in xfrm_dump_sa(). The buggy code allows a malicious user to pass
arbitrary value of filter->splen/dplen. Hence, with crafted xfrm states,
the attacker can achieve 8 bytes heap OOB read, which causes info leak.
if (attrs[XFRMA_ADDRESS_FILTER]) {
filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]),
sizeof(*filter), GFP_KERNEL);
if (filter == NULL)
return -ENOMEM;
// NO MORE CHECKS HERE !!!
}
This patch fixes the OOB by adding necessary boundary checks, just like
the code in pfkey_dump() function.
Fixes: d3623099d350 ("ipsec: add support of limited SA dump")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_user.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 2d68a173b2273..3e32fe99a6818 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1250,6 +1250,15 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
sizeof(*filter), GFP_KERNEL);
if (filter == NULL)
return -ENOMEM;
+
+ /* see addr_match(), (prefix length >> 5) << 2
+ * will be used to compare xfrm_address_t
+ */
+ if (filter->splen > (sizeof(xfrm_address_t) << 3) ||
+ filter->dplen > (sizeof(xfrm_address_t) << 3)) {
+ kfree(filter);
+ return -EINVAL;
+ }
}
if (attrs[XFRMA_PROTO])
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 105/194] net: af_key: fix sadb_x_filter validation
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 104/194] net: xfrm: Fix xfrm_address_filter OOB read Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 106/194] net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure Greg Kroah-Hartman
` (99 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lin Ma, Steffen Klassert,
Sasha Levin
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit 75065a8929069bc93181848818e23f147a73f83a ]
When running xfrm_state_walk_init(), the xfrm_address_filter being used
is okay to have a splen/dplen that equals to sizeof(xfrm_address_t)<<3.
This commit replaces >= to > to make sure the boundary checking is
correct.
Fixes: 37bd22420f85 ("af_key: pfkey_dump needs parameter validation")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/key/af_key.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 8c21de50eadf8..8a8f2429d5d99 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1848,9 +1848,9 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
- if ((xfilter->sadb_x_filter_splen >=
+ if ((xfilter->sadb_x_filter_splen >
(sizeof(xfrm_address_t) << 3)) ||
- (xfilter->sadb_x_filter_dplen >=
+ (xfilter->sadb_x_filter_dplen >
(sizeof(xfrm_address_t) << 3))) {
mutex_unlock(&pfk->dump_lock);
return -EINVAL;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 106/194] net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 105/194] net: af_key: fix sadb_x_filter validation Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 107/194] xfrm: fix slab-use-after-free in decode_session6 Greg Kroah-Hartman
` (98 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lin Ma, Steffen Klassert,
Sasha Levin
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit d1e0e61d617ba17aa516db707aa871387566bbf7 ]
According to all consumers code of attrs[XFRMA_SEC_CTX], like
* verify_sec_ctx_len(), convert to xfrm_user_sec_ctx*
* xfrm_state_construct(), call security_xfrm_state_alloc whose prototype
is int security_xfrm_state_alloc(.., struct xfrm_user_sec_ctx *sec_ctx);
* copy_from_user_sec_ctx(), convert to xfrm_user_sec_ctx *
...
It seems that the expected parsing result for XFRMA_SEC_CTX should be
structure xfrm_user_sec_ctx, and the current xfrm_sec_ctx is confusing
and misleading (Luckily, they happen to have same size 8 bytes).
This commit amend the policy structure to xfrm_user_sec_ctx to avoid
ambiguity.
Fixes: cf5cb79f6946 ("[XFRM] netlink: Establish an attribute policy")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_compat.c | 2 +-
net/xfrm/xfrm_user.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c
index 8cbf45a8bcdc2..655fe4ff86212 100644
--- a/net/xfrm/xfrm_compat.c
+++ b/net/xfrm/xfrm_compat.c
@@ -108,7 +108,7 @@ static const struct nla_policy compat_policy[XFRMA_MAX+1] = {
[XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
[XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
[XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
- [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
+ [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) },
[XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
[XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
[XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 3e32fe99a6818..c6803318ac63e 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2969,7 +2969,7 @@ const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
[XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
[XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
[XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
- [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
+ [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) },
[XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
[XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
[XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 107/194] xfrm: fix slab-use-after-free in decode_session6
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 106/194] net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 108/194] ip6_vti: " Greg Kroah-Hartman
` (97 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhengchao Shao, Steffen Klassert,
Sasha Levin
From: Zhengchao Shao <shaozhengchao@huawei.com>
[ Upstream commit 53223f2ed1ef5c90dad814daaaefea4e68a933c8 ]
When the xfrm device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when the xfrm device sends IPv6 packets.
The stack information is as follows:
BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890
Read of size 1 at addr ffff8881111458ef by task swapper/3/0
CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.4.0-next-20230707 #409
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl+0xd9/0x150
print_address_description.constprop.0+0x2c/0x3c0
kasan_report+0x11d/0x130
decode_session6+0x103f/0x1890
__xfrm_decode_session+0x54/0xb0
xfrmi_xmit+0x173/0x1ca0
dev_hard_start_xmit+0x187/0x700
sch_direct_xmit+0x1a3/0xc30
__qdisc_run+0x510/0x17a0
__dev_queue_xmit+0x2215/0x3b10
neigh_connected_output+0x3c2/0x550
ip6_finish_output2+0x55a/0x1550
ip6_finish_output+0x6b9/0x1270
ip6_output+0x1f1/0x540
ndisc_send_skb+0xa63/0x1890
ndisc_send_rs+0x132/0x6f0
addrconf_rs_timer+0x3f1/0x870
call_timer_fn+0x1a0/0x580
expire_timers+0x29b/0x4b0
run_timer_softirq+0x326/0x910
__do_softirq+0x1d4/0x905
irq_exit_rcu+0xb7/0x120
sysvec_apic_timer_interrupt+0x97/0xc0
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:intel_idle_hlt+0x23/0x30
Code: 1f 84 00 00 00 00 00 f3 0f 1e fa 41 54 41 89 d4 0f 1f 44 00 00 66 90 0f 1f 44 00 00 0f 00 2d c4 9f ab 00 0f 1f 44 00 00 fb f4 <fa> 44 89 e0 41 5c c3 66 0f 1f 44 00 00 f3 0f 1e fa 41 54 41 89 d4
RSP: 0018:ffffc90000197d78 EFLAGS: 00000246
RAX: 00000000000a83c3 RBX: ffffe8ffffd09c50 RCX: ffffffff8a22d8e5
RDX: 0000000000000001 RSI: ffffffff8d3f8080 RDI: ffffe8ffffd09c50
RBP: ffffffff8d3f8080 R08: 0000000000000001 R09: ffffed1026ba6d9d
R10: ffff888135d36ceb R11: 0000000000000001 R12: 0000000000000001
R13: ffffffff8d3f8100 R14: 0000000000000001 R15: 0000000000000000
cpuidle_enter_state+0xd3/0x6f0
cpuidle_enter+0x4e/0xa0
do_idle+0x2fe/0x3c0
cpu_startup_entry+0x18/0x20
start_secondary+0x200/0x290
secondary_startup_64_no_verify+0x167/0x16b
</TASK>
Allocated by task 939:
kasan_save_stack+0x22/0x40
kasan_set_track+0x25/0x30
__kasan_slab_alloc+0x7f/0x90
kmem_cache_alloc_node+0x1cd/0x410
kmalloc_reserve+0x165/0x270
__alloc_skb+0x129/0x330
inet6_ifa_notify+0x118/0x230
__ipv6_ifa_notify+0x177/0xbe0
addrconf_dad_completed+0x133/0xe00
addrconf_dad_work+0x764/0x1390
process_one_work+0xa32/0x16f0
worker_thread+0x67d/0x10c0
kthread+0x344/0x440
ret_from_fork+0x1f/0x30
The buggy address belongs to the object at ffff888111145800
which belongs to the cache skbuff_small_head of size 640
The buggy address is located 239 bytes inside of
freed 640-byte region [ffff888111145800, ffff888111145a80)
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.
Fixes: f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_interface_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c
index 94a3609548b11..d71dbe822096a 100644
--- a/net/xfrm/xfrm_interface_core.c
+++ b/net/xfrm/xfrm_interface_core.c
@@ -528,8 +528,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
switch (skb->protocol) {
case htons(ETH_P_IPV6):
- xfrm_decode_session(skb, &fl, AF_INET6);
memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ xfrm_decode_session(skb, &fl, AF_INET6);
if (!dst) {
fl.u.ip6.flowi6_oif = dev->ifindex;
fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
@@ -543,8 +543,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
}
break;
case htons(ETH_P_IP):
- xfrm_decode_session(skb, &fl, AF_INET);
memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ xfrm_decode_session(skb, &fl, AF_INET);
if (!dst) {
struct rtable *rt;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 108/194] ip6_vti: fix slab-use-after-free in decode_session6
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 107/194] xfrm: fix slab-use-after-free in decode_session6 Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 109/194] ip_vti: fix potential " Greg Kroah-Hartman
` (96 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhengchao Shao, Steffen Klassert,
Sasha Levin
From: Zhengchao Shao <shaozhengchao@huawei.com>
[ Upstream commit 9fd41f1ba638938c9a1195d09bc6fa3be2712f25 ]
When ipv6_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ipv6_vti device sends IPv6 packets.
The stack information is as follows:
BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890
Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl+0xd9/0x150
print_address_description.constprop.0+0x2c/0x3c0
kasan_report+0x11d/0x130
decode_session6+0x103f/0x1890
__xfrm_decode_session+0x54/0xb0
vti6_tnl_xmit+0x3e6/0x1ee0
dev_hard_start_xmit+0x187/0x700
sch_direct_xmit+0x1a3/0xc30
__qdisc_run+0x510/0x17a0
__dev_queue_xmit+0x2215/0x3b10
neigh_connected_output+0x3c2/0x550
ip6_finish_output2+0x55a/0x1550
ip6_finish_output+0x6b9/0x1270
ip6_output+0x1f1/0x540
ndisc_send_skb+0xa63/0x1890
ndisc_send_rs+0x132/0x6f0
addrconf_rs_timer+0x3f1/0x870
call_timer_fn+0x1a0/0x580
expire_timers+0x29b/0x4b0
run_timer_softirq+0x326/0x910
__do_softirq+0x1d4/0x905
irq_exit_rcu+0xb7/0x120
sysvec_apic_timer_interrupt+0x97/0xc0
</IRQ>
Allocated by task 9176:
kasan_save_stack+0x22/0x40
kasan_set_track+0x25/0x30
__kasan_slab_alloc+0x7f/0x90
kmem_cache_alloc_node+0x1cd/0x410
kmalloc_reserve+0x165/0x270
__alloc_skb+0x129/0x330
netlink_sendmsg+0x9b1/0xe30
sock_sendmsg+0xde/0x190
____sys_sendmsg+0x739/0x920
___sys_sendmsg+0x110/0x1b0
__sys_sendmsg+0xf7/0x1c0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 9176:
kasan_save_stack+0x22/0x40
kasan_set_track+0x25/0x30
kasan_save_free_info+0x2b/0x40
____kasan_slab_free+0x160/0x1c0
slab_free_freelist_hook+0x11b/0x220
kmem_cache_free+0xf0/0x490
skb_free_head+0x17f/0x1b0
skb_release_data+0x59c/0x850
consume_skb+0xd2/0x170
netlink_unicast+0x54f/0x7f0
netlink_sendmsg+0x926/0xe30
sock_sendmsg+0xde/0x190
____sys_sendmsg+0x739/0x920
___sys_sendmsg+0x110/0x1b0
__sys_sendmsg+0xf7/0x1c0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff88802e08ed00
which belongs to the cache skbuff_small_head of size 640
The buggy address is located 194 bytes inside of
freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.
Fixes: f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ip6_vti.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 151337d7f67b4..cb71463bbbabd 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -570,12 +570,12 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
vti6_addr_conflict(t, ipv6_hdr(skb)))
goto tx_err;
- xfrm_decode_session(skb, &fl, AF_INET6);
memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ xfrm_decode_session(skb, &fl, AF_INET6);
break;
case htons(ETH_P_IP):
- xfrm_decode_session(skb, &fl, AF_INET);
memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ xfrm_decode_session(skb, &fl, AF_INET);
break;
default:
goto tx_err;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 109/194] ip_vti: fix potential slab-use-after-free in decode_session6
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 108/194] ip6_vti: " Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 110/194] xfrm: add NULL check in xfrm_update_ae_params Greg Kroah-Hartman
` (95 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhengchao Shao, Steffen Klassert,
Sasha Levin
From: Zhengchao Shao <shaozhengchao@huawei.com>
[ Upstream commit 6018a266279b1a75143c7c0804dd08a5fc4c3e0b ]
When ip_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ip_vti device sends IPv6 packets.
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.
Fixes: f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/ip_vti.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 8c2bd1d9ddce3..615c1dcf3a28e 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -287,12 +287,12 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
switch (skb->protocol) {
case htons(ETH_P_IP):
- xfrm_decode_session(skb, &fl, AF_INET);
memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ xfrm_decode_session(skb, &fl, AF_INET);
break;
case htons(ETH_P_IPV6):
- xfrm_decode_session(skb, &fl, AF_INET6);
memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ xfrm_decode_session(skb, &fl, AF_INET6);
break;
default:
goto tx_err;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 110/194] xfrm: add NULL check in xfrm_update_ae_params
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 109/194] ip_vti: fix potential " Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 111/194] xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH Greg Kroah-Hartman
` (94 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin Ma, Leon Romanovsky,
Steffen Klassert, Sasha Levin
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit 00374d9b6d9f932802b55181be9831aa948e5b7c ]
Normally, x->replay_esn and x->preplay_esn should be allocated at
xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the
xfrm_update_ae_params(...) is okay to update them. However, the current
implementation of xfrm_new_ae(...) allows a malicious user to directly
dereference a NULL pointer and crash the kernel like below.
BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4
RIP: 0010:memcpy_orig+0xad/0x140
Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c
RSP: 0018:ffff888008f57658 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571
RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818
R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000
FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0
Call Trace:
<TASK>
? __die+0x1f/0x70
? page_fault_oops+0x1e8/0x500
? __pfx_is_prefetch.constprop.0+0x10/0x10
? __pfx_page_fault_oops+0x10/0x10
? _raw_spin_unlock_irqrestore+0x11/0x40
? fixup_exception+0x36/0x460
? _raw_spin_unlock_irqrestore+0x11/0x40
? exc_page_fault+0x5e/0xc0
? asm_exc_page_fault+0x26/0x30
? xfrm_update_ae_params+0xd1/0x260
? memcpy_orig+0xad/0x140
? __pfx__raw_spin_lock_bh+0x10/0x10
xfrm_update_ae_params+0xe7/0x260
xfrm_new_ae+0x298/0x4e0
? __pfx_xfrm_new_ae+0x10/0x10
? __pfx_xfrm_new_ae+0x10/0x10
xfrm_user_rcv_msg+0x25a/0x410
? __pfx_xfrm_user_rcv_msg+0x10/0x10
? __alloc_skb+0xcf/0x210
? stack_trace_save+0x90/0xd0
? filter_irq_stacks+0x1c/0x70
? __stack_depot_save+0x39/0x4e0
? __kasan_slab_free+0x10a/0x190
? kmem_cache_free+0x9c/0x340
? netlink_recvmsg+0x23c/0x660
? sock_recvmsg+0xeb/0xf0
? __sys_recvfrom+0x13c/0x1f0
? __x64_sys_recvfrom+0x71/0x90
? do_syscall_64+0x3f/0x90
? entry_SYSCALL_64_after_hwframe+0x72/0xdc
? copyout+0x3e/0x50
netlink_rcv_skb+0xd6/0x210
? __pfx_xfrm_user_rcv_msg+0x10/0x10
? __pfx_netlink_rcv_skb+0x10/0x10
? __pfx_sock_has_perm+0x10/0x10
? mutex_lock+0x8d/0xe0
? __pfx_mutex_lock+0x10/0x10
xfrm_netlink_rcv+0x44/0x50
netlink_unicast+0x36f/0x4c0
? __pfx_netlink_unicast+0x10/0x10
? netlink_recvmsg+0x500/0x660
netlink_sendmsg+0x3b7/0x700
This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit
adds additional NULL check in xfrm_update_ae_params to fix the NPD.
Fixes: d8647b79c3b7 ("xfrm: Add user interface for esn and big anti-replay windows")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index c6803318ac63e..9fc1da47d02e0 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -615,7 +615,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH];
- if (re) {
+ if (re && x->replay_esn && x->preplay_esn) {
struct xfrm_replay_state_esn *replay_esn;
replay_esn = nla_data(re);
memcpy(x->replay_esn, replay_esn,
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 111/194] xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 110/194] xfrm: add NULL check in xfrm_update_ae_params Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 112/194] virtio_net: notify MAC address change on device initialization Greg Kroah-Hartman
` (93 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin Ma, Simon Horman,
Leon Romanovsky, Steffen Klassert, Sasha Levin
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit 5e2424708da7207087934c5c75211e8584d553a0 ]
The previous commit 4e484b3e969b ("xfrm: rate limit SA mapping change
message to user space") added one additional attribute named
XFRMA_MTIMER_THRESH and described its type at compat_policy
(net/xfrm/xfrm_compat.c).
However, the author forgot to also describe the nla_policy at
xfrma_policy (net/xfrm/xfrm_user.c). Hence, this suppose NLA_U32 (4
bytes) value can be faked as empty (0 bytes) by a malicious user, which
leads to 4 bytes overflow read and heap information leak when parsing
nlattrs.
To exploit this, one malicious user can spray the SLUB objects and then
leverage this 4 bytes OOB read to leak the heap data into
x->mapping_maxage (see xfrm_update_ae_params(...)), and leak it to
userspace via copy_to_user_state_extra(...).
The above bug is assigned CVE-2023-3773. To fix it, this commit just
completes the nla_policy description for XFRMA_MTIMER_THRESH, which
enforces the length check and avoids such OOB read.
Fixes: 4e484b3e969b ("xfrm: rate limit SA mapping change message to user space")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_user.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 9fc1da47d02e0..d042ca01211fa 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2989,6 +2989,7 @@ const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
[XFRMA_SET_MARK] = { .type = NLA_U32 },
[XFRMA_SET_MARK_MASK] = { .type = NLA_U32 },
[XFRMA_IF_ID] = { .type = NLA_U32 },
+ [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 },
};
EXPORT_SYMBOL_GPL(xfrma_policy);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 112/194] virtio_net: notify MAC address change on device initialization
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 111/194] xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 113/194] virtio-net: set queues after driver_ok Greg Kroah-Hartman
` (92 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurent Vivier, Michael S. Tsirkin,
Jakub Kicinski, Sasha Levin
From: Laurent Vivier <lvivier@redhat.com>
[ Upstream commit 9f62d221a4b0aa6a8d2a18053a0ca349c025297c ]
In virtnet_probe(), if the device doesn't provide a MAC address the
driver assigns a random one.
As we modify the MAC address we need to notify the device to allow it
to update all the related information.
The problem can be seen with vDPA and mlx5_vdpa driver as it doesn't
assign a MAC address by default. The virtio_net device uses a random
MAC address (we can see it with "ip link"), but we can't ping a net
namespace from another one using the virtio-vdpa device because the
new MAC address has not been provided to the hardware:
RX packets are dropped since they don't go through the receive filters,
TX packets go through unaffected.
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 51b813176f09 ("virtio-net: set queues after driver_ok")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/virtio_net.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 075d5d42f5eb6..b7a4df4bab817 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3825,6 +3825,8 @@ static int virtnet_probe(struct virtio_device *vdev)
eth_hw_addr_set(dev, addr);
} else {
eth_hw_addr_random(dev);
+ dev_info(&vdev->dev, "Assigned random MAC address %pM\n",
+ dev->dev_addr);
}
/* Set up our device-specific information */
@@ -3954,6 +3956,24 @@ static int virtnet_probe(struct virtio_device *vdev)
virtio_device_ready(vdev);
+ /* a random MAC address has been assigned, notify the device.
+ * We don't fail probe if VIRTIO_NET_F_CTRL_MAC_ADDR is not there
+ * because many devices work fine without getting MAC explicitly
+ */
+ if (!virtio_has_feature(vdev, VIRTIO_NET_F_MAC) &&
+ virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
+ struct scatterlist sg;
+
+ sg_init_one(&sg, dev->dev_addr, dev->addr_len);
+ if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MAC,
+ VIRTIO_NET_CTRL_MAC_ADDR_SET, &sg)) {
+ pr_debug("virtio_net: setting MAC address failed\n");
+ rtnl_unlock();
+ err = -EINVAL;
+ goto free_unregister_netdev;
+ }
+ }
+
rtnl_unlock();
err = virtnet_cpu_notif_add(vi);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 113/194] virtio-net: set queues after driver_ok
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 112/194] virtio_net: notify MAC address change on device initialization Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 114/194] net: pcs: Add missing put_device call in miic_create Greg Kroah-Hartman
` (91 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragos Tatulea, Michael S. Tsirkin,
Jason Wang, David S. Miller, Sasha Levin
From: Jason Wang <jasowang@redhat.com>
[ Upstream commit 51b813176f098ff61bd2833f627f5319ead098a5 ]
Commit 25266128fe16 ("virtio-net: fix race between set queues and
probe") tries to fix the race between set queues and probe by calling
_virtnet_set_queues() before DRIVER_OK is set. This violates virtio
spec. Fixing this by setting queues after virtio_device_ready().
Note that rtnl needs to be held for userspace requests to change the
number of queues. So we are serialized in this way.
Fixes: 25266128fe16 ("virtio-net: fix race between set queues and probe")
Reported-by: Dragos Tatulea <dtatulea@nvidia.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/virtio_net.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index b7a4df4bab817..55c20ccb791ea 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3942,8 +3942,6 @@ static int virtnet_probe(struct virtio_device *vdev)
if (vi->has_rss || vi->has_rss_hash_report)
virtnet_init_default_rss(vi);
- _virtnet_set_queues(vi, vi->curr_queue_pairs);
-
/* serialize netdev register + virtio_device_ready() with ndo_open() */
rtnl_lock();
@@ -3956,6 +3954,8 @@ static int virtnet_probe(struct virtio_device *vdev)
virtio_device_ready(vdev);
+ _virtnet_set_queues(vi, vi->curr_queue_pairs);
+
/* a random MAC address has been assigned, notify the device.
* We don't fail probe if VIRTIO_NET_F_CTRL_MAC_ADDR is not there
* because many devices work fine without getting MAC explicitly
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 114/194] net: pcs: Add missing put_device call in miic_create
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 113/194] virtio-net: set queues after driver_ok Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 115/194] net: phy: fix IRQ-based wake-on-lan over hibernate / power off Greg Kroah-Hartman
` (90 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Yang, Vladimir Oltean,
David S. Miller, Sasha Levin
From: Xiang Yang <xiangyang3@huawei.com>
[ Upstream commit 829c6524d6729d05a82575dbcc16f99be5ee843d ]
The reference of pdev->dev is taken by of_find_device_by_node, so
it should be released when not need anymore.
Fixes: 7dc54d3b8d91 ("net: pcs: add Renesas MII converter driver")
Signed-off-by: Xiang Yang <xiangyang3@huawei.com>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/pcs/pcs-rzn1-miic.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/net/pcs/pcs-rzn1-miic.c b/drivers/net/pcs/pcs-rzn1-miic.c
index c1424119e8212..847ab37f13671 100644
--- a/drivers/net/pcs/pcs-rzn1-miic.c
+++ b/drivers/net/pcs/pcs-rzn1-miic.c
@@ -317,15 +317,21 @@ struct phylink_pcs *miic_create(struct device *dev, struct device_node *np)
pdev = of_find_device_by_node(pcs_np);
of_node_put(pcs_np);
- if (!pdev || !platform_get_drvdata(pdev))
+ if (!pdev || !platform_get_drvdata(pdev)) {
+ if (pdev)
+ put_device(&pdev->dev);
return ERR_PTR(-EPROBE_DEFER);
+ }
miic_port = kzalloc(sizeof(*miic_port), GFP_KERNEL);
- if (!miic_port)
+ if (!miic_port) {
+ put_device(&pdev->dev);
return ERR_PTR(-ENOMEM);
+ }
miic = platform_get_drvdata(pdev);
device_link_add(dev, miic->dev, DL_FLAG_AUTOREMOVE_CONSUMER);
+ put_device(&pdev->dev);
miic_port->miic = miic;
miic_port->port = port - 1;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 115/194] net: phy: fix IRQ-based wake-on-lan over hibernate / power off
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 114/194] net: pcs: Add missing put_device call in miic_create Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 116/194] selftests: mirror_gre_changes: Tighten up the TTL test match Greg Kroah-Hartman
` (89 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Russell King (Oracle), Andrew Lunn, Florian Fainelli,
David S. Miller, Sasha Levin
From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
[ Upstream commit cc941e548bffc01b5816b4edc5cb432a137a58b3 ]
Uwe reports:
"Most PHYs signal WoL using an interrupt. So disabling interrupts [at
shutdown] breaks WoL at least on PHYs covered by the marvell driver."
Discussing with Ioana, the problem which was trying to be solved was:
"The board in question is a LS1021ATSN which has two AR8031 PHYs that
share an interrupt line. In case only one of the PHYs is probed and
there are pending interrupts on the PHY#2 an IRQ storm will happen
since there is no entity to clear the interrupt from PHY#2's registers.
PHY#1's driver will get stuck in .handle_interrupt() indefinitely."
Further confirmation that "the two AR8031 PHYs are on the same MDIO
bus."
With WoL using interrupts to wake the system, in such a case, the
system will begin booting with an asserted interrupt. Thus, we need to
cope with an interrupt asserted during boot.
Solve this instead by disabling interrupts during PHY probe. This will
ensure in Ioana's situation that both PHYs of the same type sharing an
interrupt line on a common MDIO bus will have their interrupt outputs
disabled when the driver probes the device, but before we hook in any
interrupt handlers - thus avoiding the interrupt storm.
A better fix would be for platform firmware to disable the interrupting
devices at source during boot, before control is handed to the kernel.
Fixes: e2f016cf7751 ("net: phy: add a shutdown procedure")
Link: 20230804071757.383971-1-u.kleine-koenig@pengutronix.de
Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/phy_device.c | 13 ++-----------
1 file changed, 2 insertions(+), 11 deletions(-)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 82f74f96eba29..944f76e6fc8eb 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -3050,6 +3050,8 @@ static int phy_probe(struct device *dev)
goto out;
}
+ phy_disable_interrupts(phydev);
+
/* Start out supporting everything. Eventually,
* a controller will attach, and may modify one
* or both of these values
@@ -3137,16 +3139,6 @@ static int phy_remove(struct device *dev)
return 0;
}
-static void phy_shutdown(struct device *dev)
-{
- struct phy_device *phydev = to_phy_device(dev);
-
- if (phydev->state == PHY_READY || !phydev->attached_dev)
- return;
-
- phy_disable_interrupts(phydev);
-}
-
/**
* phy_driver_register - register a phy_driver with the PHY layer
* @new_driver: new phy_driver to register
@@ -3180,7 +3172,6 @@ int phy_driver_register(struct phy_driver *new_driver, struct module *owner)
new_driver->mdiodrv.driver.bus = &mdio_bus_type;
new_driver->mdiodrv.driver.probe = phy_probe;
new_driver->mdiodrv.driver.remove = phy_remove;
- new_driver->mdiodrv.driver.shutdown = phy_shutdown;
new_driver->mdiodrv.driver.owner = owner;
new_driver->mdiodrv.driver.probe_type = PROBE_FORCE_SYNCHRONOUS;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 116/194] selftests: mirror_gre_changes: Tighten up the TTL test match
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 115/194] net: phy: fix IRQ-based wake-on-lan over hibernate / power off Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 117/194] drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs Greg Kroah-Hartman
` (88 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Machata, Mirsad Todorovac,
Ido Schimmel, Simon Horman, David S. Miller, Sasha Levin
From: Petr Machata <petrm@nvidia.com>
[ Upstream commit 855067defa36b1f9effad8c219d9a85b655cf500 ]
This test verifies whether the encapsulated packets have the correct
configured TTL. It does so by sending ICMP packets through the test
topology and mirroring them to a gretap netdevice. On a busy host
however, more than just the test ICMP packets may end up flowing
through the topology, get mirrored, and counted. This leads to
potential spurious failures as the test observes much more mirrored
packets than the sent test packets, and assumes a bug.
Fix this by tightening up the mirror action match. Change it from
matchall to a flower classifier matching on ICMP packets specifically.
Fixes: 45315673e0c5 ("selftests: forwarding: Test changes in mirror-to-gretap")
Signed-off-by: Petr Machata <petrm@nvidia.com>
Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/forwarding/mirror_gre_changes.sh | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh b/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh
index aff88f78e3391..5ea9d63915f77 100755
--- a/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh
+++ b/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh
@@ -72,7 +72,8 @@ test_span_gre_ttl()
RET=0
- mirror_install $swp1 ingress $tundev "matchall $tcflags"
+ mirror_install $swp1 ingress $tundev \
+ "prot ip flower $tcflags ip_prot icmp"
tc filter add dev $h3 ingress pref 77 prot $prot \
flower skip_hw ip_ttl 50 action pass
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 117/194] drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 116/194] selftests: mirror_gre_changes: Tighten up the TTL test match Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 118/194] net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source Greg Kroah-Hartman
` (87 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Ceresoli, Neil Armstrong,
Sasha Levin
From: Luca Ceresoli <luca.ceresoli@bootlin.com>
[ Upstream commit e8470c0a7bcaa82f78ad34282d662dd7bd9630c2 ]
Commit 03e909acd95a ("drm/panel: simple: Add support for AUO G121EAN01.4
panel") added support for this panel model, but the timings it implements
are very different from what the datasheet describes. I checked both the
G121EAN01.0 datasheet from [0] and the G121EAN01.4 one from [1] and they
all have the same timings: for example the LVDS clock typical value is 74.4
MHz, not 66.7 MHz as implemented.
Replace the timings with the ones from the documentation. These timings
have been tested and the clock frequencies verified with an oscilloscope to
ensure they are correct.
Also use struct display_timing instead of struct drm_display_mode in order
to also specify the minimum and maximum values.
[0] https://embedded.avnet.com/product/g121ean01-0/
[1] https://embedded.avnet.com/product/g121ean01-4/
Fixes: 03e909acd95a ("drm/panel: simple: Add support for AUO G121EAN01.4 panel")
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230804151239.835216-1-luca.ceresoli@bootlin.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-simple.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index f851aaf2c5917..5e067ba7e5fba 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -969,21 +969,21 @@ static const struct panel_desc auo_g104sn02 = {
.connector_type = DRM_MODE_CONNECTOR_LVDS,
};
-static const struct drm_display_mode auo_g121ean01_mode = {
- .clock = 66700,
- .hdisplay = 1280,
- .hsync_start = 1280 + 58,
- .hsync_end = 1280 + 58 + 8,
- .htotal = 1280 + 58 + 8 + 70,
- .vdisplay = 800,
- .vsync_start = 800 + 6,
- .vsync_end = 800 + 6 + 4,
- .vtotal = 800 + 6 + 4 + 10,
+static const struct display_timing auo_g121ean01_timing = {
+ .pixelclock = { 60000000, 74400000, 90000000 },
+ .hactive = { 1280, 1280, 1280 },
+ .hfront_porch = { 20, 50, 100 },
+ .hback_porch = { 20, 50, 100 },
+ .hsync_len = { 30, 100, 200 },
+ .vactive = { 800, 800, 800 },
+ .vfront_porch = { 2, 10, 25 },
+ .vback_porch = { 2, 10, 25 },
+ .vsync_len = { 4, 18, 50 },
};
static const struct panel_desc auo_g121ean01 = {
- .modes = &auo_g121ean01_mode,
- .num_modes = 1,
+ .timings = &auo_g121ean01_timing,
+ .num_timings = 1,
.bpc = 8,
.size = {
.width = 261,
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 118/194] net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 117/194] drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 119/194] octeon_ep: cancel tx_timeout_task later in remove sequence Greg Kroah-Hartman
` (86 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Radhey Shyam Pandey, Jakub Kicinski,
Sasha Levin
From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
[ Upstream commit 6c461e394d11a981c662cc16cebfb05b602e23ba ]
On Zynq UltraScale+ MPSoC ubuntu platform when systemctl issues suspend,
network manager bring down the interface and goes into suspend. When it
wakes up it again enables the interface.
This leads to xilinx-psgtr "PLL lock timeout" on interface bringup, as
the power management controller power down the entire FPD (including
SERDES) if none of the FPD devices are in use and serdes is not
initialized on resume.
$ sudo rtcwake -m no -s 120 -v
$ sudo systemctl suspend <this does ifconfig eth1 down>
$ ifconfig eth1 up
xilinx-psgtr fd400000.phy: lane 0 (type 10, protocol 5): PLL lock timeout
phy phy-fd400000.phy.0: phy poweron failed --> -110
macb driver is called in this way:
1. macb_close: Stop network interface. In this function, it
reset MACB IP and disables PHY and network interface.
2. macb_suspend: It is called in kernel suspend flow. But because
network interface has been disabled(netif_running(ndev) is
false), it does nothing and returns directly;
3. System goes into suspend state. Some time later, system is
waken up by RTC wakeup device;
4. macb_resume: It does nothing because network interface has
been disabled;
5. macb_open: It is called to enable network interface again. ethernet
interface is initialized in this API but serdes which is power-off
by PMUFW during FPD-off suspend is not initialized again and so
we hit GT PLL lock issue on open.
To resolve this PLL timeout issue always do PS GTR initialization
when ethernet device is configured as non-wakeup source.
Fixes: f22bd29ba19a ("net: macb: Fix ZynqMP SGMII non-wakeup source resume failure")
Fixes: 8b73fa3ae02b ("net: macb: Added ZynqMP-specific initialization")
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://lore.kernel.org/r/1691414091-2260697-1-git-send-email-radhey.shyam.pandey@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb_main.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index abd6cc0cd641f..5fb991835078a 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -5070,6 +5070,9 @@ static int __maybe_unused macb_suspend(struct device *dev)
unsigned int q;
int err;
+ if (!device_may_wakeup(&bp->dev->dev))
+ phy_exit(bp->sgmii_phy);
+
if (!netif_running(netdev))
return 0;
@@ -5130,7 +5133,6 @@ static int __maybe_unused macb_suspend(struct device *dev)
if (!(bp->wol & MACB_WOL_ENABLED)) {
rtnl_lock();
phylink_stop(bp->phylink);
- phy_exit(bp->sgmii_phy);
rtnl_unlock();
spin_lock_irqsave(&bp->lock, flags);
macb_reset_hw(bp);
@@ -5160,6 +5162,9 @@ static int __maybe_unused macb_resume(struct device *dev)
unsigned int q;
int err;
+ if (!device_may_wakeup(&bp->dev->dev))
+ phy_init(bp->sgmii_phy);
+
if (!netif_running(netdev))
return 0;
@@ -5220,8 +5225,6 @@ static int __maybe_unused macb_resume(struct device *dev)
macb_set_rx_mode(netdev);
macb_restore_features(bp);
rtnl_lock();
- if (!device_may_wakeup(&bp->dev->dev))
- phy_init(bp->sgmii_phy);
phylink_start(bp->phylink);
rtnl_unlock();
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 119/194] octeon_ep: cancel tx_timeout_task later in remove sequence
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 118/194] net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 120/194] netfilter: nf_tables: fix false-positive lockdep splat Greg Kroah-Hartman
` (85 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Schmidt, Jakub Kicinski,
Sasha Levin
From: Michal Schmidt <mschmidt@redhat.com>
[ Upstream commit 28458c80006bb4e993a09fc094094a8578cad292 ]
tx_timeout_task is canceled too early when removing the driver. Nothing
prevents .ndo_tx_timeout from triggering and queuing the work again.
Better cancel it after the netdev is unregistered.
It's harmless for octep_tx_timeout_task to run in the window between the
unregistration and cancelation, because it checks netif_running.
Fixes: 862cd659a6fb ("octeon_ep: Add driver framework and device initialization")
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Link: https://lore.kernel.org/r/20230810150114.107765-3-mschmidt@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
index 8979dd05e873f..d4ec46d1c8cfb 100644
--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
@@ -1121,12 +1121,12 @@ static void octep_remove(struct pci_dev *pdev)
if (!oct)
return;
- cancel_work_sync(&oct->tx_timeout_task);
cancel_work_sync(&oct->ctrl_mbox_task);
netdev = oct->netdev;
if (netdev->reg_state == NETREG_REGISTERED)
unregister_netdev(netdev);
+ cancel_work_sync(&oct->tx_timeout_task);
octep_device_cleanup(oct);
pci_release_mem_regions(pdev);
free_netdev(netdev);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 120/194] netfilter: nf_tables: fix false-positive lockdep splat
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 119/194] octeon_ep: cancel tx_timeout_task later in remove sequence Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 121/194] netfilter: nf_tables: deactivate catchall elements in next generation Greg Kroah-Hartman
` (84 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal, Sasha Levin
From: Florian Westphal <fw@strlen.de>
[ Upstream commit b9f052dc68f69dac89fe1e24693354c033daa091 ]
->abort invocation may cause splat on debug kernels:
WARNING: suspicious RCU usage
net/netfilter/nft_set_pipapo.c:1697 suspicious rcu_dereference_check() usage!
[..]
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by nft/133554: [..] (nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid
[..]
lockdep_rcu_suspicious+0x1ad/0x260
nft_pipapo_abort+0x145/0x180
__nf_tables_abort+0x5359/0x63d0
nf_tables_abort+0x24/0x40
nfnetlink_rcv+0x1a0a/0x22c0
netlink_unicast+0x73c/0x900
netlink_sendmsg+0x7f0/0xc20
____sys_sendmsg+0x48d/0x760
Transaction mutex is held, so parallel updates are not possible.
Switch to _protected and check mutex is held for lockdep enabled builds.
Fixes: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_set_pipapo.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index a81829c10feab..32cfd0a84b0e2 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1665,6 +1665,17 @@ static void nft_pipapo_commit(const struct nft_set *set)
priv->clone = new_clone;
}
+static bool nft_pipapo_transaction_mutex_held(const struct nft_set *set)
+{
+#ifdef CONFIG_PROVE_LOCKING
+ const struct net *net = read_pnet(&set->net);
+
+ return lockdep_is_held(&nft_pernet(net)->commit_mutex);
+#else
+ return true;
+#endif
+}
+
static void nft_pipapo_abort(const struct nft_set *set)
{
struct nft_pipapo *priv = nft_set_priv(set);
@@ -1673,7 +1684,7 @@ static void nft_pipapo_abort(const struct nft_set *set)
if (!priv->dirty)
return;
- m = rcu_dereference(priv->match);
+ m = rcu_dereference_protected(priv->match, nft_pipapo_transaction_mutex_held(set));
new_clone = pipapo_clone(m);
if (IS_ERR(new_clone))
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 121/194] netfilter: nf_tables: deactivate catchall elements in next generation
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 120/194] netfilter: nf_tables: fix false-positive lockdep splat Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 122/194] ipvs: fix racy memcpy in proc_do_sync_threshold Greg Kroah-Hartman
` (83 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, lonial con, Florian Westphal,
Sasha Levin
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 90e5b3462efa37b8bba82d7c4e63683856e188af ]
When flushing, individual set elements are disabled in the next
generation via the ->flush callback.
Catchall elements are not disabled. This is incorrect and may lead to
double-deactivations of catchall elements which then results in memory
leaks:
WARNING: CPU: 1 PID: 3300 at include/net/netfilter/nf_tables.h:1172 nft_map_deactivate+0x549/0x730
CPU: 1 PID: 3300 Comm: nft Not tainted 6.5.0-rc5+ #60
RIP: 0010:nft_map_deactivate+0x549/0x730
[..]
? nft_map_deactivate+0x549/0x730
nf_tables_delset+0xb66/0xeb0
(the warn is due to nft_use_dec() detecting underflow).
Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index f6e6273838859..4c2df7af73f76 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6874,6 +6874,7 @@ static int nft_set_catchall_flush(const struct nft_ctx *ctx,
ret = __nft_set_catchall_flush(ctx, set, &elem);
if (ret < 0)
break;
+ nft_set_elem_change_active(ctx->net, set, ext);
}
return ret;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 122/194] ipvs: fix racy memcpy in proc_do_sync_threshold
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 121/194] netfilter: nf_tables: deactivate catchall elements in next generation Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 123/194] netfilter: nft_dynset: disallow object maps Greg Kroah-Hartman
` (82 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sishuai Gong, Simon Horman,
Julian Anastasov, Florian Westphal, Sasha Levin
From: Sishuai Gong <sishuai.system@gmail.com>
[ Upstream commit 5310760af1d4fbea1452bfc77db5f9a680f7ae47 ]
When two threads run proc_do_sync_threshold() in parallel,
data races could happen between the two memcpy():
Thread-1 Thread-2
memcpy(val, valp, sizeof(val));
memcpy(valp, val, sizeof(val));
This race might mess up the (struct ctl_table *) table->data,
so we add a mutex lock to serialize them.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Link: https://lore.kernel.org/netdev/B6988E90-0A1E-4B85-BF26-2DAF6D482433@gmail.com/
Signed-off-by: Sishuai Gong <sishuai.system@gmail.com>
Acked-by: Simon Horman <horms@kernel.org>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 03af6a2ffd567..17a1b731a76b1 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1798,6 +1798,7 @@ static int
proc_do_sync_threshold(struct ctl_table *table, int write,
void *buffer, size_t *lenp, loff_t *ppos)
{
+ struct netns_ipvs *ipvs = table->extra2;
int *valp = table->data;
int val[2];
int rc;
@@ -1807,6 +1808,7 @@ proc_do_sync_threshold(struct ctl_table *table, int write,
.mode = table->mode,
};
+ mutex_lock(&ipvs->sync_mutex);
memcpy(val, valp, sizeof(val));
rc = proc_dointvec(&tmp, write, buffer, lenp, ppos);
if (write) {
@@ -1816,6 +1818,7 @@ proc_do_sync_threshold(struct ctl_table *table, int write,
else
memcpy(valp, val, sizeof(val));
}
+ mutex_unlock(&ipvs->sync_mutex);
return rc;
}
@@ -4080,6 +4083,7 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
tbl[idx].data = &ipvs->sysctl_sync_threshold;
+ tbl[idx].extra2 = ipvs;
tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 123/194] netfilter: nft_dynset: disallow object maps
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 122/194] ipvs: fix racy memcpy in proc_do_sync_threshold Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 124/194] net: phy: broadcom: stub c45 read/write for 54810 Greg Kroah-Hartman
` (81 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Florian Westphal,
Sasha Levin
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 23185c6aed1ffb8fc44087880ba2767aba493779 ]
Do not allow to insert elements from datapath to objects maps.
Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_dynset.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index e65a83328b554..cf9a1ae87d9b1 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -191,6 +191,9 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
if (IS_ERR(set))
return PTR_ERR(set);
+ if (set->flags & NFT_SET_OBJECT)
+ return -EOPNOTSUPP;
+
if (set->ops->update == NULL)
return -EOPNOTSUPP;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 124/194] net: phy: broadcom: stub c45 read/write for 54810
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 123/194] netfilter: nft_dynset: disallow object maps Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 125/194] team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves Greg Kroah-Hartman
` (80 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Chen, Florian Fainelli,
Jakub Kicinski, Sasha Levin
From: Justin Chen <justin.chen@broadcom.com>
[ Upstream commit 096516d092d54604d590827d05b1022c8f326639 ]
The 54810 does not support c45. The mmd_phy_indirect accesses return
arbirtary values leading to odd behavior like saying it supports EEE
when it doesn't. We also see that reading/writing these non-existent
MMD registers leads to phy instability in some cases.
Fixes: b14995ac2527 ("net: phy: broadcom: Add BCM54810 PHY entry")
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://lore.kernel.org/r/1691901708-28650-1-git-send-email-justin.chen@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/broadcom.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index ad71c88c87e78..f9ad8902100f3 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -486,6 +486,17 @@ static int bcm54xx_resume(struct phy_device *phydev)
return bcm54xx_config_init(phydev);
}
+static int bcm54810_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
+{
+ return -EOPNOTSUPP;
+}
+
+static int bcm54810_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,
+ u16 val)
+{
+ return -EOPNOTSUPP;
+}
+
static int bcm54811_config_init(struct phy_device *phydev)
{
int err, reg;
@@ -981,6 +992,8 @@ static struct phy_driver broadcom_drivers[] = {
.get_strings = bcm_phy_get_strings,
.get_stats = bcm54xx_get_stats,
.probe = bcm54xx_phy_probe,
+ .read_mmd = bcm54810_read_mmd,
+ .write_mmd = bcm54810_write_mmd,
.config_init = bcm54xx_config_init,
.config_aneg = bcm5481_config_aneg,
.config_intr = bcm_phy_config_intr,
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 125/194] team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 124/194] net: phy: broadcom: stub c45 read/write for 54810 Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 126/194] net: openvswitch: reject negative ifindex Greg Kroah-Hartman
` (79 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Ziyang Xuan,
Simon Horman, Jakub Kicinski, Sasha Levin
From: Ziyang Xuan <william.xuanziyang@huawei.com>
[ Upstream commit dafcbce07136d799edc4c67f04f9fd69ff1eac1f ]
Similar to commit 01f4fd270870 ("bonding: Fix incorrect deletion of
ETH_P_8021AD protocol vid from slaves"), we can trigger BUG_ON(!vlan_info)
in unregister_vlan_dev() with the following testcase:
# ip netns add ns1
# ip netns exec ns1 ip link add team1 type team
# ip netns exec ns1 ip link add team_slave type veth peer veth2
# ip netns exec ns1 ip link set team_slave master team1
# ip netns exec ns1 ip link add link team_slave name team_slave.10 type vlan id 10 protocol 802.1ad
# ip netns exec ns1 ip link add link team1 name team1.10 type vlan id 10 protocol 802.1ad
# ip netns exec ns1 ip link set team_slave nomaster
# ip netns del ns1
Add S-VLAN tag related features support to team driver. So the team driver
will always propagate the VLAN info to its slaves.
Fixes: 8ad227ff89a7 ("net: vlan: add 802.1ad support")
Suggested-by: Ido Schimmel <idosch@idosch.org>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20230814032301.2804971-1-william.xuanziyang@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/team/team.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 509ba706781ed..921ca59822b0f 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2200,7 +2200,9 @@ static void team_setup(struct net_device *dev)
dev->hw_features = TEAM_VLAN_FEATURES |
NETIF_F_HW_VLAN_CTAG_RX |
- NETIF_F_HW_VLAN_CTAG_FILTER;
+ NETIF_F_HW_VLAN_CTAG_FILTER |
+ NETIF_F_HW_VLAN_STAG_RX |
+ NETIF_F_HW_VLAN_STAG_FILTER;
dev->hw_features |= NETIF_F_GSO_ENCAP_ALL;
dev->features |= dev->hw_features;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 126/194] net: openvswitch: reject negative ifindex
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 125/194] team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 127/194] iavf: fix FDIR rule fields masks validation Greg Kroah-Hartman
` (78 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7456b5dcf65111553320,
Leon Romanovsky, Aaron Conole, Jakub Kicinski, Sasha Levin
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit a552bfa16bab4ce901ee721346a28c4e483f4066 ]
Recent changes in net-next (commit 759ab1edb56c ("net: store netdevs
in an xarray")) refactored the handling of pre-assigned ifindexes
and let syzbot surface a latent problem in ovs. ovs does not validate
ifindex, making it possible to create netdev ports with negative
ifindex values. It's easy to repro with YNL:
$ ./cli.py --spec netlink/specs/ovs_datapath.yaml \
--do new \
--json '{"upcall-pid": 1, "name":"my-dp"}'
$ ./cli.py --spec netlink/specs/ovs_vport.yaml \
--do new \
--json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}'
$ ip link show
-65536: some-port0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 7a:48:21:ad:0b:fb brd ff:ff:ff:ff:ff:ff
...
Validate the inputs. Now the second command correctly returns:
$ ./cli.py --spec netlink/specs/ovs_vport.yaml \
--do new \
--json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}'
lib.ynl.NlError: Netlink error: Numerical result out of range
nl_len = 108 (92) nl_flags = 0x300 nl_type = 2
error: -34 extack: {'msg': 'integer out of range', 'unknown': [[type:4 len:36] b'\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\xff\xff\xff\x7f\x00\x00\x00\x00\x08\x00\x01\x00\x08\x00\x00\x00'], 'bad-attr': '.ifindex'}
Accept 0 since it used to be silently ignored.
Fixes: 54c4ef34c4b6 ("openvswitch: allow specifying ifindex of new interfaces")
Reported-by: syzbot+7456b5dcf65111553320@syzkaller.appspotmail.com
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Aaron Conole <aconole@redhat.com>
Link: https://lore.kernel.org/r/20230814203840.2908710-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/openvswitch/datapath.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 5920fdca12875..3c7b245354096 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1806,7 +1806,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
parms.port_no = OVSP_LOCAL;
parms.upcall_portids = a[OVS_DP_ATTR_UPCALL_PID];
parms.desired_ifindex = a[OVS_DP_ATTR_IFINDEX]
- ? nla_get_u32(a[OVS_DP_ATTR_IFINDEX]) : 0;
+ ? nla_get_s32(a[OVS_DP_ATTR_IFINDEX]) : 0;
/* So far only local changes have been made, now need the lock. */
ovs_lock();
@@ -2026,7 +2026,7 @@ static const struct nla_policy datapath_policy[OVS_DP_ATTR_MAX + 1] = {
[OVS_DP_ATTR_USER_FEATURES] = { .type = NLA_U32 },
[OVS_DP_ATTR_MASKS_CACHE_SIZE] = NLA_POLICY_RANGE(NLA_U32, 0,
PCPU_MIN_UNIT_SIZE / sizeof(struct mask_cache_entry)),
- [OVS_DP_ATTR_IFINDEX] = {.type = NLA_U32 },
+ [OVS_DP_ATTR_IFINDEX] = NLA_POLICY_MIN(NLA_S32, 0),
};
static const struct genl_small_ops dp_datapath_genl_ops[] = {
@@ -2276,7 +2276,7 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info)
parms.port_no = port_no;
parms.upcall_portids = a[OVS_VPORT_ATTR_UPCALL_PID];
parms.desired_ifindex = a[OVS_VPORT_ATTR_IFINDEX]
- ? nla_get_u32(a[OVS_VPORT_ATTR_IFINDEX]) : 0;
+ ? nla_get_s32(a[OVS_VPORT_ATTR_IFINDEX]) : 0;
vport = new_vport(&parms);
err = PTR_ERR(vport);
@@ -2513,7 +2513,7 @@ static const struct nla_policy vport_policy[OVS_VPORT_ATTR_MAX + 1] = {
[OVS_VPORT_ATTR_TYPE] = { .type = NLA_U32 },
[OVS_VPORT_ATTR_UPCALL_PID] = { .type = NLA_UNSPEC },
[OVS_VPORT_ATTR_OPTIONS] = { .type = NLA_NESTED },
- [OVS_VPORT_ATTR_IFINDEX] = { .type = NLA_U32 },
+ [OVS_VPORT_ATTR_IFINDEX] = NLA_POLICY_MIN(NLA_S32, 0),
[OVS_VPORT_ATTR_NETNSID] = { .type = NLA_S32 },
};
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 127/194] iavf: fix FDIR rule fields masks validation
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 126/194] net: openvswitch: reject negative ifindex Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 128/194] i40e: fix misleading debug logs Greg Kroah-Hartman
` (77 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Piotr Gardocki, Rafal Romanowski,
Tony Nguyen, Sasha Levin
From: Piotr Gardocki <piotrx.gardocki@intel.com>
[ Upstream commit 751969e5b1196821ef78f0aa664a8a97c92c9057 ]
Return an error if a field's mask is neither full nor empty. When a mask
is only partial the field is not being used for rule programming but it
gives a wrong impression it is used. Fix by returning an error on any
partial mask to make it clear they are not supported.
The ip_ver assignment is moved earlier in code to allow using it in
iavf_validate_fdir_fltr_masks.
Fixes: 527691bf0682 ("iavf: Support IPv4 Flow Director filters")
Fixes: e90cbc257a6f ("iavf: Support IPv6 Flow Director filters")
Signed-off-by: Piotr Gardocki <piotrx.gardocki@intel.com>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/intel/iavf/iavf_ethtool.c | 10 +++
drivers/net/ethernet/intel/iavf/iavf_fdir.c | 77 ++++++++++++++++++-
drivers/net/ethernet/intel/iavf/iavf_fdir.h | 2 +
3 files changed, 85 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
index f544d2b0abdbd..fe912b1c468ef 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
@@ -1289,6 +1289,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
fltr->ip_mask.src_port = fsp->m_u.tcp_ip4_spec.psrc;
fltr->ip_mask.dst_port = fsp->m_u.tcp_ip4_spec.pdst;
fltr->ip_mask.tos = fsp->m_u.tcp_ip4_spec.tos;
+ fltr->ip_ver = 4;
break;
case AH_V4_FLOW:
case ESP_V4_FLOW:
@@ -1300,6 +1301,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
fltr->ip_mask.v4_addrs.dst_ip = fsp->m_u.ah_ip4_spec.ip4dst;
fltr->ip_mask.spi = fsp->m_u.ah_ip4_spec.spi;
fltr->ip_mask.tos = fsp->m_u.ah_ip4_spec.tos;
+ fltr->ip_ver = 4;
break;
case IPV4_USER_FLOW:
fltr->ip_data.v4_addrs.src_ip = fsp->h_u.usr_ip4_spec.ip4src;
@@ -1312,6 +1314,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
fltr->ip_mask.l4_header = fsp->m_u.usr_ip4_spec.l4_4_bytes;
fltr->ip_mask.tos = fsp->m_u.usr_ip4_spec.tos;
fltr->ip_mask.proto = fsp->m_u.usr_ip4_spec.proto;
+ fltr->ip_ver = 4;
break;
case TCP_V6_FLOW:
case UDP_V6_FLOW:
@@ -1330,6 +1333,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
fltr->ip_mask.src_port = fsp->m_u.tcp_ip6_spec.psrc;
fltr->ip_mask.dst_port = fsp->m_u.tcp_ip6_spec.pdst;
fltr->ip_mask.tclass = fsp->m_u.tcp_ip6_spec.tclass;
+ fltr->ip_ver = 6;
break;
case AH_V6_FLOW:
case ESP_V6_FLOW:
@@ -1345,6 +1349,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
sizeof(struct in6_addr));
fltr->ip_mask.spi = fsp->m_u.ah_ip6_spec.spi;
fltr->ip_mask.tclass = fsp->m_u.ah_ip6_spec.tclass;
+ fltr->ip_ver = 6;
break;
case IPV6_USER_FLOW:
memcpy(&fltr->ip_data.v6_addrs.src_ip, fsp->h_u.usr_ip6_spec.ip6src,
@@ -1361,6 +1366,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
fltr->ip_mask.l4_header = fsp->m_u.usr_ip6_spec.l4_4_bytes;
fltr->ip_mask.tclass = fsp->m_u.usr_ip6_spec.tclass;
fltr->ip_mask.proto = fsp->m_u.usr_ip6_spec.l4_proto;
+ fltr->ip_ver = 6;
break;
case ETHER_FLOW:
fltr->eth_data.etype = fsp->h_u.ether_spec.h_proto;
@@ -1371,6 +1377,10 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
return -EINVAL;
}
+ err = iavf_validate_fdir_fltr_masks(adapter, fltr);
+ if (err)
+ return err;
+
if (iavf_fdir_is_dup_fltr(adapter, fltr))
return -EEXIST;
diff --git a/drivers/net/ethernet/intel/iavf/iavf_fdir.c b/drivers/net/ethernet/intel/iavf/iavf_fdir.c
index 505e82ebafe47..03e774bd2a5b4 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_fdir.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_fdir.c
@@ -18,6 +18,79 @@ static const struct in6_addr ipv6_addr_full_mask = {
}
};
+static const struct in6_addr ipv6_addr_zero_mask = {
+ .in6_u = {
+ .u6_addr8 = {
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ }
+ }
+};
+
+/**
+ * iavf_validate_fdir_fltr_masks - validate Flow Director filter fields masks
+ * @adapter: pointer to the VF adapter structure
+ * @fltr: Flow Director filter data structure
+ *
+ * Returns 0 if all masks of packet fields are either full or empty. Returns
+ * error on at least one partial mask.
+ */
+int iavf_validate_fdir_fltr_masks(struct iavf_adapter *adapter,
+ struct iavf_fdir_fltr *fltr)
+{
+ if (fltr->eth_mask.etype && fltr->eth_mask.etype != htons(U16_MAX))
+ goto partial_mask;
+
+ if (fltr->ip_ver == 4) {
+ if (fltr->ip_mask.v4_addrs.src_ip &&
+ fltr->ip_mask.v4_addrs.src_ip != htonl(U32_MAX))
+ goto partial_mask;
+
+ if (fltr->ip_mask.v4_addrs.dst_ip &&
+ fltr->ip_mask.v4_addrs.dst_ip != htonl(U32_MAX))
+ goto partial_mask;
+
+ if (fltr->ip_mask.tos && fltr->ip_mask.tos != U8_MAX)
+ goto partial_mask;
+ } else if (fltr->ip_ver == 6) {
+ if (memcmp(&fltr->ip_mask.v6_addrs.src_ip, &ipv6_addr_zero_mask,
+ sizeof(struct in6_addr)) &&
+ memcmp(&fltr->ip_mask.v6_addrs.src_ip, &ipv6_addr_full_mask,
+ sizeof(struct in6_addr)))
+ goto partial_mask;
+
+ if (memcmp(&fltr->ip_mask.v6_addrs.dst_ip, &ipv6_addr_zero_mask,
+ sizeof(struct in6_addr)) &&
+ memcmp(&fltr->ip_mask.v6_addrs.dst_ip, &ipv6_addr_full_mask,
+ sizeof(struct in6_addr)))
+ goto partial_mask;
+
+ if (fltr->ip_mask.tclass && fltr->ip_mask.tclass != U8_MAX)
+ goto partial_mask;
+ }
+
+ if (fltr->ip_mask.proto && fltr->ip_mask.proto != U8_MAX)
+ goto partial_mask;
+
+ if (fltr->ip_mask.src_port && fltr->ip_mask.src_port != htons(U16_MAX))
+ goto partial_mask;
+
+ if (fltr->ip_mask.dst_port && fltr->ip_mask.dst_port != htons(U16_MAX))
+ goto partial_mask;
+
+ if (fltr->ip_mask.spi && fltr->ip_mask.spi != htonl(U32_MAX))
+ goto partial_mask;
+
+ if (fltr->ip_mask.l4_header &&
+ fltr->ip_mask.l4_header != htonl(U32_MAX))
+ goto partial_mask;
+
+ return 0;
+
+partial_mask:
+ dev_err(&adapter->pdev->dev, "Failed to add Flow Director filter, partial masks are not supported\n");
+ return -EOPNOTSUPP;
+}
+
/**
* iavf_pkt_udp_no_pay_len - the length of UDP packet without payload
* @fltr: Flow Director filter data structure
@@ -263,8 +336,6 @@ iavf_fill_fdir_ip4_hdr(struct iavf_fdir_fltr *fltr,
VIRTCHNL_ADD_PROTO_HDR_FIELD_BIT(hdr, IPV4, DST);
}
- fltr->ip_ver = 4;
-
return 0;
}
@@ -309,8 +380,6 @@ iavf_fill_fdir_ip6_hdr(struct iavf_fdir_fltr *fltr,
VIRTCHNL_ADD_PROTO_HDR_FIELD_BIT(hdr, IPV6, DST);
}
- fltr->ip_ver = 6;
-
return 0;
}
diff --git a/drivers/net/ethernet/intel/iavf/iavf_fdir.h b/drivers/net/ethernet/intel/iavf/iavf_fdir.h
index 33c55c366315b..9eb9f73f6adf3 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_fdir.h
+++ b/drivers/net/ethernet/intel/iavf/iavf_fdir.h
@@ -110,6 +110,8 @@ struct iavf_fdir_fltr {
struct virtchnl_fdir_add vc_add_msg;
};
+int iavf_validate_fdir_fltr_masks(struct iavf_adapter *adapter,
+ struct iavf_fdir_fltr *fltr);
int iavf_fill_fdir_add_msg(struct iavf_adapter *adapter, struct iavf_fdir_fltr *fltr);
void iavf_print_fdir_fltr(struct iavf_adapter *adapter, struct iavf_fdir_fltr *fltr);
bool iavf_fdir_is_dup_fltr(struct iavf_adapter *adapter, struct iavf_fdir_fltr *fltr);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 128/194] i40e: fix misleading debug logs
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 127/194] iavf: fix FDIR rule fields masks validation Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 129/194] net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset Greg Kroah-Hartman
` (76 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksandr Loktionov, Andrii Staikov,
Tony Nguyen, Sasha Levin
From: Andrii Staikov <andrii.staikov@intel.com>
[ Upstream commit 2f2beb8874cb0844e84ad26e990f05f4f13ff63f ]
Change "write" into the actual "read" word.
Change parameters description.
Fixes: 7073f46e443e ("i40e: Add AQ commands for NVM Update for X722")
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Andrii Staikov <andrii.staikov@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
index 17e3f26eee4a4..779ba907009a5 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
@@ -210,11 +210,11 @@ static int i40e_read_nvm_word_srctl(struct i40e_hw *hw, u16 offset,
* @hw: pointer to the HW structure.
* @module_pointer: module pointer location in words from the NVM beginning
* @offset: offset in words from module start
- * @words: number of words to write
- * @data: buffer with words to write to the Shadow RAM
+ * @words: number of words to read
+ * @data: buffer with words to read to the Shadow RAM
* @last_command: tells the AdminQ that this is the last command
*
- * Writes a 16 bit words buffer to the Shadow RAM using the admin command.
+ * Reads a 16 bit words buffer to the Shadow RAM using the admin command.
**/
static int i40e_read_nvm_aq(struct i40e_hw *hw,
u8 module_pointer, u32 offset,
@@ -234,18 +234,18 @@ static int i40e_read_nvm_aq(struct i40e_hw *hw,
*/
if ((offset + words) > hw->nvm.sr_size)
i40e_debug(hw, I40E_DEBUG_NVM,
- "NVM write error: offset %d beyond Shadow RAM limit %d\n",
+ "NVM read error: offset %d beyond Shadow RAM limit %d\n",
(offset + words), hw->nvm.sr_size);
else if (words > I40E_SR_SECTOR_SIZE_IN_WORDS)
- /* We can write only up to 4KB (one sector), in one AQ write */
+ /* We can read only up to 4KB (one sector), in one AQ write */
i40e_debug(hw, I40E_DEBUG_NVM,
- "NVM write fail error: tried to write %d words, limit is %d.\n",
+ "NVM read fail error: tried to read %d words, limit is %d.\n",
words, I40E_SR_SECTOR_SIZE_IN_WORDS);
else if (((offset + (words - 1)) / I40E_SR_SECTOR_SIZE_IN_WORDS)
!= (offset / I40E_SR_SECTOR_SIZE_IN_WORDS))
- /* A single write cannot spread over two sectors */
+ /* A single read cannot spread over two sectors */
i40e_debug(hw, I40E_DEBUG_NVM,
- "NVM write error: cannot spread over two sectors in a single write offset=%d words=%d\n",
+ "NVM read error: cannot spread over two sectors in a single read offset=%d words=%d\n",
offset, words);
else
ret_code = i40e_aq_read_nvm(hw, module_pointer,
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 129/194] net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 128/194] i40e: fix misleading debug logs Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 130/194] sfc: dont unregister flow_indr if it was never registered Greg Kroah-Hartman
` (75 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alfred Lee, Andrew Lunn,
Jakub Kicinski, Sasha Levin
From: Alfred Lee <l00g33k@gmail.com>
[ Upstream commit 23d775f12dcd23d052a4927195f15e970e27ab26 ]
If the switch is reset during active EEPROM transactions, as in
just after an SoC reset after power up, the I2C bus transaction
may be cut short leaving the EEPROM internal I2C state machine
in the wrong state. When the switch is reset again, the bad
state machine state may result in data being read from the wrong
memory location causing the switch to enter unexpected mode
rendering it inoperational.
Fixes: a3dcb3e7e70c ("net: dsa: mv88e6xxx: Wait for EEPROM done after HW reset")
Signed-off-by: Alfred Lee <l00g33k@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20230815001323.24739-1-l00g33k@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/mv88e6xxx/chip.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index b69bd44ada1f2..a73008b9e0b3c 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -3006,6 +3006,14 @@ static void mv88e6xxx_hardware_reset(struct mv88e6xxx_chip *chip)
/* If there is a GPIO connected to the reset pin, toggle it */
if (gpiod) {
+ /* If the switch has just been reset and not yet completed
+ * loading EEPROM, the reset may interrupt the I2C transaction
+ * mid-byte, causing the first EEPROM read after the reset
+ * from the wrong location resulting in the switch booting
+ * to wrong mode and inoperable.
+ */
+ mv88e6xxx_g1_wait_eeprom_done(chip);
+
gpiod_set_value_cansleep(gpiod, 1);
usleep_range(10000, 20000);
gpiod_set_value_cansleep(gpiod, 0);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 130/194] sfc: dont unregister flow_indr if it was never registered
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 129/194] net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 131/194] sock: Fix misuse of sk_under_memory_pressure() Greg Kroah-Hartman
` (74 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pieter Jansen van Vuuren,
Martin Habets, Edward Cree, Jakub Kicinski, Sasha Levin
From: Edward Cree <ecree.xilinx@gmail.com>
[ Upstream commit fa165e1949976704500a442faeef8d9596faee76 ]
In efx_init_tc(), move the setting of efx->tc->up after the
flow_indr_dev_register() call, so that if it fails, efx_fini_tc()
won't call flow_indr_dev_unregister().
Fixes: 5b2e12d51bd8 ("sfc: bind indirect blocks for TC offload on EF100")
Suggested-by: Pieter Jansen van Vuuren <pieter.jansen-van-vuuren@amd.com>
Reviewed-by: Martin Habets <habetsm.xilinx@gmail.com>
Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
Link: https://lore.kernel.org/r/a81284d7013aba74005277bd81104e4cfbea3f6f.1692114888.git.ecree.xilinx@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sfc/tc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/sfc/tc.c b/drivers/net/ethernet/sfc/tc.c
index 3478860d40232..d312147cd2dd7 100644
--- a/drivers/net/ethernet/sfc/tc.c
+++ b/drivers/net/ethernet/sfc/tc.c
@@ -603,10 +603,10 @@ int efx_init_tc(struct efx_nic *efx)
rc = efx_tc_configure_rep_mport(efx);
if (rc)
return rc;
- efx->tc->up = true;
rc = flow_indr_dev_register(efx_tc_indr_setup_cb, efx);
if (rc)
return rc;
+ efx->tc->up = true;
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 131/194] sock: Fix misuse of sk_under_memory_pressure()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 130/194] sfc: dont unregister flow_indr if it was never registered Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 132/194] net: do not allow gso_size to be set to GSO_BY_FRAGS Greg Kroah-Hartman
` (73 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abel Wu, Shakeel Butt,
Jakub Kicinski, Sasha Levin
From: Abel Wu <wuyun.abel@bytedance.com>
[ Upstream commit 2d0c88e84e483982067a82073f6125490ddf3614 ]
The status of global socket memory pressure is updated when:
a) __sk_mem_raise_allocated():
enter: sk_memory_allocated(sk) > sysctl_mem[1]
leave: sk_memory_allocated(sk) <= sysctl_mem[0]
b) __sk_mem_reduce_allocated():
leave: sk_under_memory_pressure(sk) &&
sk_memory_allocated(sk) < sysctl_mem[0]
So the conditions of leaving global pressure are inconstant, which
may lead to the situation that one pressured net-memcg prevents the
global pressure from being cleared when there is indeed no global
pressure, thus the global constrains are still in effect unexpectedly
on the other sockets.
This patch fixes this by ignoring the net-memcg's pressure when
deciding whether should leave global memory pressure.
Fixes: e1aab161e013 ("socket: initial cgroup code.")
Signed-off-by: Abel Wu <wuyun.abel@bytedance.com>
Acked-by: Shakeel Butt <shakeelb@google.com>
Link: https://lore.kernel.org/r/20230816091226.1542-1-wuyun.abel@bytedance.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sock.h | 6 ++++++
net/core/sock.c | 2 +-
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index 1bbdddcf61542..699408944952c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1445,6 +1445,12 @@ static inline bool sk_has_memory_pressure(const struct sock *sk)
return sk->sk_prot->memory_pressure != NULL;
}
+static inline bool sk_under_global_memory_pressure(const struct sock *sk)
+{
+ return sk->sk_prot->memory_pressure &&
+ !!*sk->sk_prot->memory_pressure;
+}
+
static inline bool sk_under_memory_pressure(const struct sock *sk)
{
if (!sk->sk_prot->memory_pressure)
diff --git a/net/core/sock.c b/net/core/sock.c
index 3b5304f084ef3..509773919d302 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3099,7 +3099,7 @@ void __sk_mem_reduce_allocated(struct sock *sk, int amount)
if (mem_cgroup_sockets_enabled && sk->sk_memcg)
mem_cgroup_uncharge_skmem(sk->sk_memcg, amount);
- if (sk_under_memory_pressure(sk) &&
+ if (sk_under_global_memory_pressure(sk) &&
(sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)))
sk_leave_memory_pressure(sk);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 132/194] net: do not allow gso_size to be set to GSO_BY_FRAGS
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 131/194] sock: Fix misuse of sk_under_memory_pressure() Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 133/194] qede: fix firmware halt over suspend and resume Greg Kroah-Hartman
` (72 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet, Xin Long,
Michael S. Tsirkin, Jason Wang, Willem de Bruijn,
Marcelo Ricardo Leitner, Xuan Zhuo, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit b616be6b97688f2f2bd7c4a47ab32f27f94fb2a9 ]
One missing check in virtio_net_hdr_to_skb() allowed
syzbot to crash kernels again [1]
Do not allow gso_size to be set to GSO_BY_FRAGS (0xffff),
because this magic value is used by the kernel.
[1]
general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
CPU: 0 PID: 5039 Comm: syz-executor401 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:skb_segment+0x1a52/0x3ef0 net/core/skbuff.c:4500
Code: 00 00 00 e9 ab eb ff ff e8 6b 96 5d f9 48 8b 84 24 00 01 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e ea 21 00 00 48 8b 84 24 00 01
RSP: 0018:ffffc90003d3f1c8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 000000000001fffe RCX: 0000000000000000
RDX: 000000000000000e RSI: ffffffff882a3115 RDI: 0000000000000070
RBP: ffffc90003d3f378 R08: 0000000000000005 R09: 000000000000ffff
R10: 000000000000ffff R11: 5ee4a93e456187d6 R12: 000000000001ffc6
R13: dffffc0000000000 R14: 0000000000000008 R15: 000000000000ffff
FS: 00005555563f2380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020020000 CR3: 000000001626d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
udp6_ufo_fragment+0x9d2/0xd50 net/ipv6/udp_offload.c:109
ipv6_gso_segment+0x5c4/0x17b0 net/ipv6/ip6_offload.c:120
skb_mac_gso_segment+0x292/0x610 net/core/gso.c:53
__skb_gso_segment+0x339/0x710 net/core/gso.c:124
skb_gso_segment include/net/gso.h:83 [inline]
validate_xmit_skb+0x3a5/0xf10 net/core/dev.c:3625
__dev_queue_xmit+0x8f0/0x3d60 net/core/dev.c:4329
dev_queue_xmit include/linux/netdevice.h:3082 [inline]
packet_xmit+0x257/0x380 net/packet/af_packet.c:276
packet_snd net/packet/af_packet.c:3087 [inline]
packet_sendmsg+0x24c7/0x5570 net/packet/af_packet.c:3119
sock_sendmsg_nosec net/socket.c:727 [inline]
sock_sendmsg+0xd9/0x180 net/socket.c:750
____sys_sendmsg+0x6ac/0x940 net/socket.c:2496
___sys_sendmsg+0x135/0x1d0 net/socket.c:2550
__sys_sendmsg+0x117/0x1e0 net/socket.c:2579
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7ff27cdb34d9
Fixes: 3953c46c3ac7 ("sk_buff: allow segmenting based on frag sizes")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Xin Long <lucien.xin@gmail.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Link: https://lore.kernel.org/r/20230816142158.1779798-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/virtio_net.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index a960de68ac69e..6047058d67037 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -148,6 +148,10 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
if (gso_type & SKB_GSO_UDP)
nh_off -= thlen;
+ /* Kernel has a special handling for GSO_BY_FRAGS. */
+ if (gso_size == GSO_BY_FRAGS)
+ return -EINVAL;
+
/* Too small packets are not really GSO ones. */
if (skb->len - nh_off > gso_size) {
shinfo->gso_size = gso_size;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 133/194] qede: fix firmware halt over suspend and resume
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 132/194] net: do not allow gso_size to be set to GSO_BY_FRAGS Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 134/194] ice: Block switchdev mode when ADQ is active and vice versa Greg Kroah-Hartman
` (71 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manish Chopra, Alok Prasad,
John Meneghini, Simon Horman, Jakub Kicinski, Sasha Levin
From: Manish Chopra <manishc@marvell.com>
[ Upstream commit 2eb9625a3a32251ecea470cd576659a3a03b4e59 ]
While performing certain power-off sequences, PCI drivers are
called to suspend and resume their underlying devices through
PCI PM (power management) interface. However this NIC hardware
does not support PCI PM suspend/resume operations so system wide
suspend/resume leads to bad MFW (management firmware) state which
causes various follow-up errors in driver when communicating with
the device/firmware afterwards.
To fix this driver implements PCI PM suspend handler to indicate
unsupported operation to the PCI subsystem explicitly, thus avoiding
system to go into suspended/standby mode.
Without this fix device/firmware does not recover unless system
is power cycled.
Fixes: 2950219d87b0 ("qede: Add basic network device support")
Signed-off-by: Manish Chopra <manishc@marvell.com>
Signed-off-by: Alok Prasad <palok@marvell.com>
Reviewed-by: John Meneghini <jmeneghi@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20230816150711.59035-1-manishc@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/qlogic/qede/qede_main.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index e8d427c7d1cff..dc43e74147fbf 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -177,6 +177,15 @@ static int qede_sriov_configure(struct pci_dev *pdev, int num_vfs_param)
}
#endif
+static int __maybe_unused qede_suspend(struct device *dev)
+{
+ dev_info(dev, "Device does not support suspend operation\n");
+
+ return -EOPNOTSUPP;
+}
+
+static DEFINE_SIMPLE_DEV_PM_OPS(qede_pm_ops, qede_suspend, NULL);
+
static const struct pci_error_handlers qede_err_handler = {
.error_detected = qede_io_error_detected,
};
@@ -191,6 +200,7 @@ static struct pci_driver qede_pci_driver = {
.sriov_configure = qede_sriov_configure,
#endif
.err_handler = &qede_err_handler,
+ .driver.pm = &qede_pm_ops,
};
static struct qed_eth_cb_ops qede_ll_ops = {
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 134/194] ice: Block switchdev mode when ADQ is active and vice versa
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 133/194] qede: fix firmware halt over suspend and resume Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 135/194] bus: ti-sysc: Flush posted write on enable before reset Greg Kroah-Hartman
` (70 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marcin Szycik, Przemek Kitszel,
Sujai Buvaneswaran, Tony Nguyen, Simon Horman, Jakub Kicinski,
Sasha Levin
From: Marcin Szycik <marcin.szycik@linux.intel.com>
[ Upstream commit 43d00e102d9ecbe2635d7e3f2e14d2e90183d6af ]
ADQ and switchdev are not supported simultaneously. Enabling both at the
same time can result in nullptr dereference.
To prevent this, check if ADQ is active when changing devlink mode to
switchdev mode, and check if switchdev is active when enabling ADQ.
Fixes: fbc7b27af0f9 ("ice: enable ndo_setup_tc support for mqprio_qdisc")
Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Tested-by: Sujai Buvaneswaran <sujai.buvaneswaran@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20230816193405.1307580-1-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_eswitch.c | 6 ++++++
drivers/net/ethernet/intel/ice/ice_main.c | 5 +++++
2 files changed, 11 insertions(+)
diff --git a/drivers/net/ethernet/intel/ice/ice_eswitch.c b/drivers/net/ethernet/intel/ice/ice_eswitch.c
index f9f15acae90a0..2ffe5708a045b 100644
--- a/drivers/net/ethernet/intel/ice/ice_eswitch.c
+++ b/drivers/net/ethernet/intel/ice/ice_eswitch.c
@@ -562,6 +562,12 @@ ice_eswitch_mode_set(struct devlink *devlink, u16 mode,
break;
case DEVLINK_ESWITCH_MODE_SWITCHDEV:
{
+ if (ice_is_adq_active(pf)) {
+ dev_err(ice_pf_to_dev(pf), "Couldn't change eswitch mode to switchdev - ADQ is active. Delete ADQ configs and try again, e.g. tc qdisc del dev $PF root");
+ NL_SET_ERR_MSG_MOD(extack, "Couldn't change eswitch mode to switchdev - ADQ is active. Delete ADQ configs and try again, e.g. tc qdisc del dev $PF root");
+ return -EOPNOTSUPP;
+ }
+
dev_info(ice_pf_to_dev(pf), "PF %d changed eswitch mode to switchdev",
pf->hw.pf_id);
NL_SET_ERR_MSG_MOD(extack, "Changed eswitch mode to switchdev");
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index a771e597795d3..7a00d297be3a9 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -8787,6 +8787,11 @@ ice_setup_tc(struct net_device *netdev, enum tc_setup_type type,
ice_setup_tc_block_cb,
np, np, true);
case TC_SETUP_QDISC_MQPRIO:
+ if (ice_is_eswitch_mode_switchdev(pf)) {
+ netdev_err(netdev, "TC MQPRIO offload not supported, switchdev is enabled\n");
+ return -EOPNOTSUPP;
+ }
+
if (pf->adev) {
mutex_lock(&pf->adev_mutex);
device_lock(&pf->adev->dev);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 135/194] bus: ti-sysc: Flush posted write on enable before reset
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 134/194] ice: Block switchdev mode when ADQ is active and vice versa Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 136/194] arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict Greg Kroah-Hartman
` (69 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernelci.org bot, Tony Lindgren,
Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 34539b442b3bc7d5bf10164750302b60b91f18a7 ]
The am335x devices started producing boot errors for resetting musb module
in because of subtle timing changes:
Unhandled fault: external abort on non-linefetch (0x1008)
...
sysc_poll_reset_sysconfig from sysc_reset+0x109/0x12
sysc_reset from sysc_probe+0xa99/0xeb0
...
The fix is to flush posted write after enable before reset during
probe. Note that some devices also need to specify the delay after enable
with ti,sysc-delay-us, but this is not needed for musb on am335x based on
my tests.
Reported-by: kernelci.org bot <bot@kernelci.org>
Closes: https://storage.kernelci.org/next/master/next-20230614/arm/multi_v7_defconfig+CONFIG_THUMB2_KERNEL=y/gcc-10/lab-cip/baseline-beaglebone-black.html
Fixes: 596e7955692b ("bus: ti-sysc: Add support for software reset")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/ti-sysc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index cae078bffc715..9b7268bae66ab 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -2159,6 +2159,8 @@ static int sysc_reset(struct sysc *ddata)
sysc_val = sysc_read_sysconfig(ddata);
sysc_val |= sysc_mask;
sysc_write(ddata, sysc_offset, sysc_val);
+ /* Flush posted write */
+ sysc_val = sysc_read_sysconfig(ddata);
}
if (ddata->cfg.srst_udelay)
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 136/194] arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 135/194] bus: ti-sysc: Flush posted write on enable before reset Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 137/194] arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4 Greg Kroah-Hartman
` (68 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 798f1df86e5709b7b6aedf493cc04c7fedbf544a ]
The commit 3a786086c6f8 ("arm64: dts: qcom: Add missing "-thermal"
suffix for thermal zones") renamed the thermal zone in the pm8150l.dtsi
file to comply with the schema. However this resulted in a clash with
the RB5 board file, which already contained the pm8150l-thermal zone for
the on-board sensor. This resulted in the board file definition
overriding the thermal zone defined in the PMIC include file (and thus
the on-die PMIC temp alarm was not probing at all).
Rename the thermal zone in qcom/qrb5165-rb5.dts to remove this override.
Fixes: 3a786086c6f8 ("arm64: dts: qcom: Add missing "-thermal" suffix for thermal zones")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230613131224.666668-1-dmitry.baryshkov@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
index bf8077a1cf9a7..9731a7c63d53b 100644
--- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
@@ -121,7 +121,7 @@
};
};
- pm8150l-thermal {
+ pm8150l-pcb-thermal {
polling-delay-passive = <0>;
polling-delay = <0>;
thermal-sensors = <&pm8150l_adc_tm 1>;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 137/194] arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 136/194] arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 138/194] arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+ Greg Kroah-Hartman
` (67 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christopher Obbard,
Folker Schwesinger, Heiko Stuebner, Sasha Levin
From: Christopher Obbard <chris.obbard@collabora.com>
[ Upstream commit cee572756aa2cb46e959e9797ad4b730b78a050b ]
There is some instablity with some eMMC modules on ROCK Pi 4 SBCs running
in HS400 mode. This ends up resulting in some block errors after a while
or after a "heavy" operation utilising the eMMC (e.g. resizing a
filesystem). An example of these errors is as follows:
[ 289.171014] mmc1: running CQE recovery
[ 290.048972] mmc1: running CQE recovery
[ 290.054834] mmc1: running CQE recovery
[ 290.060817] mmc1: running CQE recovery
[ 290.061337] blk_update_request: I/O error, dev mmcblk1, sector 1411072 op 0x1:(WRITE) flags 0x800 phys_seg 36 prio class 0
[ 290.061370] EXT4-fs warning (device mmcblk1p1): ext4_end_bio:348: I/O error 10 writing to inode 29547 starting block 176466)
[ 290.061484] Buffer I/O error on device mmcblk1p1, logical block 172288
[ 290.061531] Buffer I/O error on device mmcblk1p1, logical block 172289
[ 290.061551] Buffer I/O error on device mmcblk1p1, logical block 172290
[ 290.061574] Buffer I/O error on device mmcblk1p1, logical block 172291
[ 290.061592] Buffer I/O error on device mmcblk1p1, logical block 172292
[ 290.061615] Buffer I/O error on device mmcblk1p1, logical block 172293
[ 290.061632] Buffer I/O error on device mmcblk1p1, logical block 172294
[ 290.061654] Buffer I/O error on device mmcblk1p1, logical block 172295
[ 290.061673] Buffer I/O error on device mmcblk1p1, logical block 172296
[ 290.061695] Buffer I/O error on device mmcblk1p1, logical block 172297
Disabling the Command Queue seems to stop the CQE recovery from running,
but doesn't seem to improve the I/O errors. Until this can be investigated
further, disable HS400 mode on the ROCK Pi 4 SBCs to at least stop I/O
errors from occurring.
While we are here, set the eMMC maximum clock frequency to 1.5MHz to
follow the ROCK 4C+.
Fixes: 1b5715c602fd ("arm64: dts: rockchip: add ROCK Pi 4 DTS support")
Signed-off-by: Christopher Obbard <chris.obbard@collabora.com>
Tested-By: Folker Schwesinger <dev@folker-schwesinger.de>
Link: https://lore.kernel.org/r/20230705144255.115299-2-chris.obbard@collabora.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
index 1f76d3501bda3..24fbb06007f94 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
@@ -645,9 +645,9 @@
};
&sdhci {
+ max-frequency = <150000000>;
bus-width = <8>;
- mmc-hs400-1_8v;
- mmc-hs400-enhanced-strobe;
+ mmc-hs200-1_8v;
non-removable;
status = "okay";
};
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 138/194] arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 137/194] arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4 Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 139/194] ARM: dts: imx: align LED node names with dtschema Greg Kroah-Hartman
` (66 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christopher Obbard, Heiko Stuebner,
Sasha Levin
From: Christopher Obbard <chris.obbard@collabora.com>
[ Upstream commit 2bd1d2dd808c60532283e9cf05110bf1bf2f9079 ]
There is some instablity with some eMMC modules on ROCK Pi 4 SBCs running
in HS400 mode. This ends up resulting in some block errors after a while
or after a "heavy" operation utilising the eMMC (e.g. resizing a
filesystem). An example of these errors is as follows:
[ 289.171014] mmc1: running CQE recovery
[ 290.048972] mmc1: running CQE recovery
[ 290.054834] mmc1: running CQE recovery
[ 290.060817] mmc1: running CQE recovery
[ 290.061337] blk_update_request: I/O error, dev mmcblk1, sector 1411072 op 0x1:(WRITE) flags 0x800 phys_seg 36 prio class 0
[ 290.061370] EXT4-fs warning (device mmcblk1p1): ext4_end_bio:348: I/O error 10 writing to inode 29547 starting block 176466)
[ 290.061484] Buffer I/O error on device mmcblk1p1, logical block 172288
[ 290.061531] Buffer I/O error on device mmcblk1p1, logical block 172289
[ 290.061551] Buffer I/O error on device mmcblk1p1, logical block 172290
[ 290.061574] Buffer I/O error on device mmcblk1p1, logical block 172291
[ 290.061592] Buffer I/O error on device mmcblk1p1, logical block 172292
[ 290.061615] Buffer I/O error on device mmcblk1p1, logical block 172293
[ 290.061632] Buffer I/O error on device mmcblk1p1, logical block 172294
[ 290.061654] Buffer I/O error on device mmcblk1p1, logical block 172295
[ 290.061673] Buffer I/O error on device mmcblk1p1, logical block 172296
[ 290.061695] Buffer I/O error on device mmcblk1p1, logical block 172297
Disabling the Command Queue seems to stop the CQE recovery from running,
but doesn't seem to improve the I/O errors. Until this can be investigated
further, disable HS400 mode on the ROCK Pi 4 SBCs to at least stop I/O
errors from occurring.
Fixes: 246450344dad ("arm64: dts: rockchip: rk3399: Radxa ROCK 4C+")
Signed-off-by: Christopher Obbard <chris.obbard@collabora.com>
Link: https://lore.kernel.org/r/20230705144255.115299-3-chris.obbard@collabora.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts b/arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts
index f9884902f8745..c3f53aa1ea4ac 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts
@@ -548,9 +548,8 @@
&sdhci {
max-frequency = <150000000>;
bus-width = <8>;
- mmc-hs400-1_8v;
+ mmc-hs200-1_8v;
non-removable;
- mmc-hs400-enhanced-strobe;
status = "okay";
};
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 139/194] ARM: dts: imx: align LED node names with dtschema
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 138/194] arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+ Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 140/194] ARM: dts: imx6: phytec: fix RTC interrupt level Greg Kroah-Hartman
` (65 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Shawn Guo,
Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 4b0d1f2738899dbcc7a026d826373530019aa31b ]
The node names should be generic and DT schema expects certain pattern:
imx50-kobo-aura.dtb: gpio-leds: 'on' does not match any of the regexes: '(^led-[0-9a-f]$|led)', 'pinctrl-[0-9]+'
imx6dl-yapp4-draco.dtb: led-controller@30: 'chan@0', 'chan@1', 'chan@2' do not match any of the regexes: '^led@[0-8]$', '^multi-led@[0-8]$', 'pinctrl-[0-9]+'
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Stable-dep-of: 762b700982a1 ("ARM: dts: imx6: phytec: fix RTC interrupt level")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx50-kobo-aura.dts | 2 +-
arch/arm/boot/dts/imx53-cx9020.dts | 10 +++++-----
arch/arm/boot/dts/imx53-m53evk.dts | 4 ++--
arch/arm/boot/dts/imx53-m53menlo.dts | 6 +++---
arch/arm/boot/dts/imx53-tx53.dtsi | 2 +-
arch/arm/boot/dts/imx53-usbarmory.dts | 2 +-
arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi | 6 +++---
arch/arm/boot/dts/imx6dl-riotboard.dts | 4 ++--
arch/arm/boot/dts/imx6dl-yapp4-common.dtsi | 6 +++---
arch/arm/boot/dts/imx6q-gw5400-a.dts | 6 +++---
arch/arm/boot/dts/imx6q-h100.dts | 6 +++---
arch/arm/boot/dts/imx6q-kp.dtsi | 4 ++--
arch/arm/boot/dts/imx6q-marsboard.dts | 4 ++--
arch/arm/boot/dts/imx6q-tbs2910.dts | 2 +-
arch/arm/boot/dts/imx6qdl-emcon.dtsi | 4 ++--
arch/arm/boot/dts/imx6qdl-gw51xx.dtsi | 4 ++--
arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 6 +++---
arch/arm/boot/dts/imx6qdl-gw53xx.dtsi | 6 +++---
arch/arm/boot/dts/imx6qdl-gw54xx.dtsi | 6 +++---
arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-gw552x.dtsi | 6 +++---
arch/arm/boot/dts/imx6qdl-gw553x.dtsi | 4 ++--
arch/arm/boot/dts/imx6qdl-gw560x.dtsi | 6 +++---
arch/arm/boot/dts/imx6qdl-gw5903.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-gw5904.dtsi | 6 +++---
arch/arm/boot/dts/imx6qdl-gw5907.dtsi | 4 ++--
arch/arm/boot/dts/imx6qdl-gw5910.dtsi | 6 +++---
arch/arm/boot/dts/imx6qdl-gw5912.dtsi | 6 +++---
arch/arm/boot/dts/imx6qdl-gw5913.dtsi | 4 ++--
arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi | 10 +++++-----
arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi | 4 ++--
arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi | 6 +++---
arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 4 ++--
arch/arm/boot/dts/imx6qdl-rex.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-sabresd.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-ts7970.dtsi | 4 ++--
arch/arm/boot/dts/imx6qdl-tx6.dtsi | 2 +-
arch/arm/boot/dts/imx6sl-evk.dts | 2 +-
arch/arm/boot/dts/imx6sll-evk.dts | 2 +-
arch/arm/boot/dts/imx6sx-sabreauto.dts | 2 +-
arch/arm/boot/dts/imx6sx-udoo-neo.dtsi | 4 ++--
arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi | 2 +-
arch/arm/boot/dts/imx6ul-tx6ul.dtsi | 2 +-
44 files changed, 93 insertions(+), 93 deletions(-)
diff --git a/arch/arm/boot/dts/imx50-kobo-aura.dts b/arch/arm/boot/dts/imx50-kobo-aura.dts
index 51bf6117fb124..467db6b4ed7f8 100644
--- a/arch/arm/boot/dts/imx50-kobo-aura.dts
+++ b/arch/arm/boot/dts/imx50-kobo-aura.dts
@@ -26,7 +26,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_leds>;
- on {
+ led-on {
label = "kobo_aura:orange:on";
gpios = <&gpio6 24 GPIO_ACTIVE_LOW>;
panic-indicator;
diff --git a/arch/arm/boot/dts/imx53-cx9020.dts b/arch/arm/boot/dts/imx53-cx9020.dts
index cfb18849a92b4..055d23a9aee7c 100644
--- a/arch/arm/boot/dts/imx53-cx9020.dts
+++ b/arch/arm/boot/dts/imx53-cx9020.dts
@@ -86,27 +86,27 @@
leds {
compatible = "gpio-leds";
- pwr-r {
+ led-pwr-r {
gpios = <&gpio3 22 GPIO_ACTIVE_HIGH>;
default-state = "off";
};
- pwr-g {
+ led-pwr-g {
gpios = <&gpio3 24 GPIO_ACTIVE_HIGH>;
default-state = "on";
};
- pwr-b {
+ led-pwr-b {
gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
default-state = "off";
};
- sd1-b {
+ led-sd1-b {
linux,default-trigger = "mmc0";
gpios = <&gpio3 20 GPIO_ACTIVE_HIGH>;
};
- sd2-b {
+ led-sd2-b {
linux,default-trigger = "mmc1";
gpios = <&gpio3 17 GPIO_ACTIVE_HIGH>;
};
diff --git a/arch/arm/boot/dts/imx53-m53evk.dts b/arch/arm/boot/dts/imx53-m53evk.dts
index a1a6228d1aa66..2bd2432d317ff 100644
--- a/arch/arm/boot/dts/imx53-m53evk.dts
+++ b/arch/arm/boot/dts/imx53-m53evk.dts
@@ -52,13 +52,13 @@
pinctrl-names = "default";
pinctrl-0 = <&led_pin_gpio>;
- user1 {
+ led-user1 {
label = "user1";
gpios = <&gpio2 8 0>;
linux,default-trigger = "heartbeat";
};
- user2 {
+ led-user2 {
label = "user2";
gpios = <&gpio2 9 0>;
linux,default-trigger = "heartbeat";
diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts
index d5c68d1ea707c..4d77b6077fc1b 100644
--- a/arch/arm/boot/dts/imx53-m53menlo.dts
+++ b/arch/arm/boot/dts/imx53-m53menlo.dts
@@ -34,19 +34,19 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_led>;
- user1 {
+ led-user1 {
label = "TestLed601";
gpios = <&gpio6 1 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "mmc0";
};
- user2 {
+ led-user2 {
label = "TestLed602";
gpios = <&gpio6 2 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "heartbeat";
};
- eth {
+ led-eth {
label = "EthLedYe";
gpios = <&gpio2 11 GPIO_ACTIVE_LOW>;
linux,default-trigger = "netdev";
diff --git a/arch/arm/boot/dts/imx53-tx53.dtsi b/arch/arm/boot/dts/imx53-tx53.dtsi
index 892dd1a4bac35..a439a47fb65ac 100644
--- a/arch/arm/boot/dts/imx53-tx53.dtsi
+++ b/arch/arm/boot/dts/imx53-tx53.dtsi
@@ -94,7 +94,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_stk5led>;
- user {
+ led-user {
label = "Heartbeat";
gpios = <&gpio2 20 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "heartbeat";
diff --git a/arch/arm/boot/dts/imx53-usbarmory.dts b/arch/arm/boot/dts/imx53-usbarmory.dts
index f34993a490ee8..acc44010d5106 100644
--- a/arch/arm/boot/dts/imx53-usbarmory.dts
+++ b/arch/arm/boot/dts/imx53-usbarmory.dts
@@ -67,7 +67,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_led>;
- user {
+ led-user {
label = "LED";
gpios = <&gpio4 27 GPIO_ACTIVE_LOW>;
linux,default-trigger = "heartbeat";
diff --git a/arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi b/arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi
index 337db29b0010a..37697fac9dea9 100644
--- a/arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi
+++ b/arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi
@@ -211,17 +211,17 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_q7_gpio1 &pinctrl_q7_gpio3 &pinctrl_q7_gpio5>;
- alarm1 {
+ led-alarm1 {
label = "alarm:red";
gpios = <&gpio1 8 GPIO_ACTIVE_HIGH>;
};
- alarm2 {
+ led-alarm2 {
label = "alarm:yellow";
gpios = <&gpio4 27 GPIO_ACTIVE_HIGH>;
};
- alarm3 {
+ led-alarm3 {
label = "alarm:blue";
gpios = <&gpio4 15 GPIO_ACTIVE_HIGH>;
};
diff --git a/arch/arm/boot/dts/imx6dl-riotboard.dts b/arch/arm/boot/dts/imx6dl-riotboard.dts
index e7be05f205d32..24c7f535f63bd 100644
--- a/arch/arm/boot/dts/imx6dl-riotboard.dts
+++ b/arch/arm/boot/dts/imx6dl-riotboard.dts
@@ -25,14 +25,14 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_led>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio5 2 GPIO_ACTIVE_LOW>;
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio3 28 GPIO_ACTIVE_LOW>;
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
index 52162e8c7274b..aacbf317feea6 100644
--- a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
+++ b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
@@ -274,7 +274,7 @@
#address-cells = <1>;
#size-cells = <0>;
- chan@0 {
+ led@0 {
chan-name = "R";
led-cur = /bits/ 8 <0x20>;
max-cur = /bits/ 8 <0x60>;
@@ -282,7 +282,7 @@
color = <LED_COLOR_ID_RED>;
};
- chan@1 {
+ led@1 {
chan-name = "G";
led-cur = /bits/ 8 <0x20>;
max-cur = /bits/ 8 <0x60>;
@@ -290,7 +290,7 @@
color = <LED_COLOR_ID_GREEN>;
};
- chan@2 {
+ led@2 {
chan-name = "B";
led-cur = /bits/ 8 <0x20>;
max-cur = /bits/ 8 <0x60>;
diff --git a/arch/arm/boot/dts/imx6q-gw5400-a.dts b/arch/arm/boot/dts/imx6q-gw5400-a.dts
index e894faba571f9..522a51042965a 100644
--- a/arch/arm/boot/dts/imx6q-gw5400-a.dts
+++ b/arch/arm/boot/dts/imx6q-gw5400-a.dts
@@ -34,20 +34,20 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* 102 -> MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 10 GPIO_ACTIVE_HIGH>; /* 106 -> MX6_PANLEDR */
default-state = "off";
};
- led2: user3 {
+ led2: led-user3 {
label = "user3";
gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* 111 -> MX6_LOCLED# */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6q-h100.dts b/arch/arm/boot/dts/imx6q-h100.dts
index b8feadbff967d..6406ade14f57b 100644
--- a/arch/arm/boot/dts/imx6q-h100.dts
+++ b/arch/arm/boot/dts/imx6q-h100.dts
@@ -76,19 +76,19 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_h100_leds>;
- led0: power {
+ led0: led-power {
label = "power";
gpios = <&gpio3 0 GPIO_ACTIVE_LOW>;
default-state = "on";
};
- led1: stream {
+ led1: led-stream {
label = "stream";
gpios = <&gpio2 29 GPIO_ACTIVE_LOW>;
default-state = "off";
};
- led2: rec {
+ led2: led-rec {
label = "rec";
gpios = <&gpio2 28 GPIO_ACTIVE_LOW>;
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6q-kp.dtsi b/arch/arm/boot/dts/imx6q-kp.dtsi
index 1ade0bff681d6..5e0ed55600405 100644
--- a/arch/arm/boot/dts/imx6q-kp.dtsi
+++ b/arch/arm/boot/dts/imx6q-kp.dtsi
@@ -66,14 +66,14 @@
leds {
compatible = "gpio-leds";
- green {
+ led-green {
label = "led1";
gpios = <&gpio3 16 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "gpio";
default-state = "off";
};
- red {
+ led-red {
label = "led0";
gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "gpio";
diff --git a/arch/arm/boot/dts/imx6q-marsboard.dts b/arch/arm/boot/dts/imx6q-marsboard.dts
index cc18010023942..2c9961333b0a8 100644
--- a/arch/arm/boot/dts/imx6q-marsboard.dts
+++ b/arch/arm/boot/dts/imx6q-marsboard.dts
@@ -73,14 +73,14 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_led>;
- user1 {
+ led-user1 {
label = "imx6:green:user1";
gpios = <&gpio5 2 GPIO_ACTIVE_LOW>;
default-state = "off";
linux,default-trigger = "heartbeat";
};
- user2 {
+ led-user2 {
label = "imx6:green:user2";
gpios = <&gpio3 28 GPIO_ACTIVE_LOW>;
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6q-tbs2910.dts b/arch/arm/boot/dts/imx6q-tbs2910.dts
index 8daef65d5bb35..2f576e2ce73f2 100644
--- a/arch/arm/boot/dts/imx6q-tbs2910.dts
+++ b/arch/arm/boot/dts/imx6q-tbs2910.dts
@@ -49,7 +49,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- blue {
+ led-blue {
label = "blue_status_led";
gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
default-state = "keep";
diff --git a/arch/arm/boot/dts/imx6qdl-emcon.dtsi b/arch/arm/boot/dts/imx6qdl-emcon.dtsi
index 7228b894a763f..ee2dd75cead6d 100644
--- a/arch/arm/boot/dts/imx6qdl-emcon.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-emcon.dtsi
@@ -46,14 +46,14 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_som_leds>;
- green {
+ led-green {
label = "som:green";
gpios = <&gpio3 0 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "heartbeat";
default-state = "on";
};
- red {
+ led-red {
label = "som:red";
gpios = <&gpio3 1 GPIO_ACTIVE_LOW>;
default-state = "keep";
diff --git a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
index 069c27fab432c..e75e1a5364b85 100644
--- a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
@@ -71,14 +71,14 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
index 728810b9d677d..47d9a8d08197d 100644
--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
@@ -80,20 +80,20 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
};
- led2: user3 {
+ led2: led-user3 {
label = "user3";
gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
index 6c0c109046d80..fb1d29abe0991 100644
--- a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
@@ -80,20 +80,20 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
};
- led2: user3 {
+ led2: led-user3 {
label = "user3";
gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
index a9b04f9f1c2bc..4e20cb97058eb 100644
--- a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
@@ -81,20 +81,20 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
};
- led2: user3 {
+ led2: led-user3 {
label = "user3";
gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
index 435dec6338fe6..0fa4b8eeddee7 100644
--- a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
@@ -115,7 +115,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 7 GPIO_ACTIVE_LOW>;
default-state = "on";
diff --git a/arch/arm/boot/dts/imx6qdl-gw552x.dtsi b/arch/arm/boot/dts/imx6qdl-gw552x.dtsi
index 2e61102ae6946..77ae611b817a4 100644
--- a/arch/arm/boot/dts/imx6qdl-gw552x.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw552x.dtsi
@@ -72,20 +72,20 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
};
- led2: user3 {
+ led2: led-user3 {
label = "user3";
gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw553x.dtsi b/arch/arm/boot/dts/imx6qdl-gw553x.dtsi
index 4662408b225a5..7f16c602cc075 100644
--- a/arch/arm/boot/dts/imx6qdl-gw553x.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw553x.dtsi
@@ -113,14 +113,14 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 10 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 11 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw560x.dtsi b/arch/arm/boot/dts/imx6qdl-gw560x.dtsi
index 4b81a975c979d..46cf4080fec38 100644
--- a/arch/arm/boot/dts/imx6qdl-gw560x.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw560x.dtsi
@@ -139,20 +139,20 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
};
- led2: user3 {
+ led2: led-user3 {
label = "user3";
gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw5903.dtsi b/arch/arm/boot/dts/imx6qdl-gw5903.dtsi
index 1fdb7ba630f1b..a74cde0501589 100644
--- a/arch/arm/boot/dts/imx6qdl-gw5903.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw5903.dtsi
@@ -123,7 +123,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio6 14 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw5904.dtsi b/arch/arm/boot/dts/imx6qdl-gw5904.dtsi
index 612b6e068e282..9fc79af2bc9aa 100644
--- a/arch/arm/boot/dts/imx6qdl-gw5904.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw5904.dtsi
@@ -120,20 +120,20 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
};
- led2: user3 {
+ led2: led-user3 {
label = "user3";
gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw5907.dtsi b/arch/arm/boot/dts/imx6qdl-gw5907.dtsi
index fcd3bdfd61827..955a51226eda7 100644
--- a/arch/arm/boot/dts/imx6qdl-gw5907.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw5907.dtsi
@@ -71,14 +71,14 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw5910.dtsi b/arch/arm/boot/dts/imx6qdl-gw5910.dtsi
index 6bb4855d13ce5..218d6e667ed24 100644
--- a/arch/arm/boot/dts/imx6qdl-gw5910.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw5910.dtsi
@@ -74,20 +74,20 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
};
- led2: user3 {
+ led2: led-user3 {
label = "user3";
gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw5912.dtsi b/arch/arm/boot/dts/imx6qdl-gw5912.dtsi
index 0415bcb416400..40e235e315cc4 100644
--- a/arch/arm/boot/dts/imx6qdl-gw5912.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw5912.dtsi
@@ -72,20 +72,20 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
};
- led2: user3 {
+ led2: led-user3 {
label = "user3";
gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-gw5913.dtsi b/arch/arm/boot/dts/imx6qdl-gw5913.dtsi
index 696427b487f01..82f47c295b085 100644
--- a/arch/arm/boot/dts/imx6qdl-gw5913.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw5913.dtsi
@@ -71,14 +71,14 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- led0: user1 {
+ led0: led-user1 {
label = "user1";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
default-state = "on";
linux,default-trigger = "heartbeat";
};
- led1: user2 {
+ led1: led-user2 {
label = "user2";
gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi b/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi
index a53a5d0766a51..6d4eab1942b94 100644
--- a/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi
@@ -85,31 +85,31 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_leds>;
- j14-pin1 {
+ led-j14-pin1 {
gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
retain-state-suspended;
default-state = "off";
};
- j14-pin3 {
+ led-j14-pin3 {
gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
retain-state-suspended;
default-state = "off";
};
- j14-pins8-9 {
+ led-j14-pins8-9 {
gpios = <&gpio3 29 GPIO_ACTIVE_LOW>;
retain-state-suspended;
default-state = "off";
};
- j46-pin2 {
+ led-j46-pin2 {
gpios = <&gpio1 7 GPIO_ACTIVE_LOW>;
retain-state-suspended;
default-state = "off";
};
- j46-pin3 {
+ led-j46-pin3 {
gpios = <&gpio1 8 GPIO_ACTIVE_LOW>;
retain-state-suspended;
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
index 57c21a01f126d..81a9a302aec1b 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
@@ -181,13 +181,13 @@
leds {
compatible = "gpio-leds";
- speaker-enable {
+ led-speaker-enable {
gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>;
retain-state-suspended;
default-state = "off";
};
- ttymxc4-rs232 {
+ led-ttymxc4-rs232 {
gpios = <&gpio6 10 GPIO_ACTIVE_HIGH>;
retain-state-suspended;
default-state = "on";
diff --git a/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
index 120d6e997a4c5..1a599c294ab86 100644
--- a/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
@@ -25,17 +25,17 @@
pinctrl-0 = <&pinctrl_gpioleds>;
status = "disabled";
- red {
+ led-red {
label = "phyboard-mira:red";
gpios = <&gpio5 22 GPIO_ACTIVE_HIGH>;
};
- green {
+ led-green {
label = "phyboard-mira:green";
gpios = <&gpio5 23 GPIO_ACTIVE_HIGH>;
};
- blue {
+ led-blue {
label = "phyboard-mira:blue";
gpios = <&gpio5 24 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "mmc0";
diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
index 768bc0e3a2b38..80adb2a02cc94 100644
--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
@@ -47,12 +47,12 @@
pinctrl-0 = <&pinctrl_leds>;
compatible = "gpio-leds";
- led_green: green {
+ led_green: led-green {
label = "phyflex:green";
gpios = <&gpio1 30 0>;
};
- led_red: red {
+ led_red: led-red {
label = "phyflex:red";
gpios = <&gpio2 31 0>;
};
diff --git a/arch/arm/boot/dts/imx6qdl-rex.dtsi b/arch/arm/boot/dts/imx6qdl-rex.dtsi
index de514eb5aa99d..f804ff95a6ad6 100644
--- a/arch/arm/boot/dts/imx6qdl-rex.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-rex.dtsi
@@ -55,7 +55,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_led>;
- led0: usr {
+ led0: led-usr {
label = "usr";
gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
index 3dbb460ef102e..10886a1461bfb 100644
--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
@@ -21,7 +21,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- user {
+ led-user {
label = "debug";
gpios = <&gpio5 15 GPIO_ACTIVE_HIGH>;
};
diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
index 37482a9023fce..bcb83d52e26ed 100644
--- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
@@ -130,7 +130,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_gpio_leds>;
- red {
+ led-red {
gpios = <&gpio1 2 0>;
default-state = "on";
};
diff --git a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi
index c096d25a6f5b5..1e0a041e9f60a 100644
--- a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi
@@ -73,13 +73,13 @@
default-state = "off";
};
- en-usb-5v {
+ en-usb-5v-led {
label = "en-usb-5v";
gpios = <&gpio2 22 GPIO_ACTIVE_HIGH>;
default-state = "on";
};
- sel_dc_usb {
+ sel-dc-usb-led {
label = "sel_dc_usb";
gpios = <&gpio5 17 GPIO_ACTIVE_HIGH>;
default-state = "off";
diff --git a/arch/arm/boot/dts/imx6qdl-tx6.dtsi b/arch/arm/boot/dts/imx6qdl-tx6.dtsi
index f41f86a76ea95..a197bac95cbac 100644
--- a/arch/arm/boot/dts/imx6qdl-tx6.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-tx6.dtsi
@@ -92,7 +92,7 @@
leds {
compatible = "gpio-leds";
- user_led: user {
+ user_led: led-user {
label = "Heartbeat";
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_user_led>;
diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
index f16c830f1e918..dc5d596c18db4 100644
--- a/arch/arm/boot/dts/imx6sl-evk.dts
+++ b/arch/arm/boot/dts/imx6sl-evk.dts
@@ -33,7 +33,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_led>;
- user {
+ led-user {
label = "debug";
gpios = <&gpio3 20 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "heartbeat";
diff --git a/arch/arm/boot/dts/imx6sll-evk.dts b/arch/arm/boot/dts/imx6sll-evk.dts
index 32b3d82fec53c..269092ac881c5 100644
--- a/arch/arm/boot/dts/imx6sll-evk.dts
+++ b/arch/arm/boot/dts/imx6sll-evk.dts
@@ -37,7 +37,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_led>;
- user {
+ led-user {
label = "debug";
gpios = <&gpio2 4 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "heartbeat";
diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
index 83ee97252ff11..b0c27b9b02446 100644
--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
+++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
@@ -20,7 +20,7 @@
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_led>;
- user {
+ led-user {
label = "debug";
gpios = <&gpio1 24 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "heartbeat";
diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
index c84ea1fac5e98..725d0b5cb55f6 100644
--- a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
+++ b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
@@ -15,14 +15,14 @@
leds {
compatible = "gpio-leds";
- red {
+ led-red {
label = "udoo-neo:red:mmc";
gpios = <&gpio6 0 GPIO_ACTIVE_HIGH>;
default-state = "off";
linux,default-trigger = "mmc0";
};
- orange {
+ led-orange {
label = "udoo-neo:orange:user";
gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>;
default-state = "keep";
diff --git a/arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi b/arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi
index 3cddc68917a08..e4d2652a75c0b 100644
--- a/arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi
+++ b/arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi
@@ -30,7 +30,7 @@
pinctrl-0 = <&pinctrl_gpioleds_som>;
compatible = "gpio-leds";
- phycore-green {
+ led-phycore-green {
gpios = <&gpio5 4 GPIO_ACTIVE_HIGH>;
linux,default-trigger = "heartbeat";
};
diff --git a/arch/arm/boot/dts/imx6ul-tx6ul.dtsi b/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
index 15ee0275feaff..70cef5e817bd1 100644
--- a/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
+++ b/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
@@ -131,7 +131,7 @@
leds {
compatible = "gpio-leds";
- user_led: user {
+ user_led: led-user {
label = "Heartbeat";
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_led>;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 140/194] ARM: dts: imx6: phytec: fix RTC interrupt level
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 139/194] ARM: dts: imx: align LED node names with dtschema Greg Kroah-Hartman
@ 2023-08-21 19:41 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 141/194] arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration Greg Kroah-Hartman
` (64 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrej Picej, Stefan Riedmüller,
Shawn Guo, Sasha Levin
From: Andrej Picej <andrej.picej@norik.com>
[ Upstream commit 762b700982a1e0f562184363f19860c3b9bdd0bf ]
RTC interrupt level should be set to "LOW". This was revealed by the
introduction of commit:
f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode")
which changed the way IRQ type is obtained.
Signed-off-by: Andrej Picej <andrej.picej@norik.com>
Reviewed-by: Stefan Riedmüller <s.riedmueller@phytec.de>
Fixes: 800d595151bb ("ARM: dts: imx6: Add initial support for phyBOARD-Mira")
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
index 1a599c294ab86..1ca4d219609f6 100644
--- a/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
@@ -182,7 +182,7 @@
pinctrl-0 = <&pinctrl_rtc_int>;
reg = <0x68>;
interrupt-parent = <&gpio7>;
- interrupts = <8 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <8 IRQ_TYPE_LEVEL_LOW>;
status = "disabled";
};
};
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 141/194] arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2023-08-21 19:41 ` [PATCH 6.1 140/194] ARM: dts: imx6: phytec: fix RTC interrupt level Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 142/194] ARM: dts: imx: Set default tuning step for imx6sx usdhc Greg Kroah-Hartman
` (63 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabio Estevam, Marek Vasut,
Marco Felsch, Adam Ford, Shawn Guo, Sasha Levin
From: Fabio Estevam <festevam@denx.de>
[ Upstream commit f02b53375e8f14b4c27a14f6e4fb6e89914fdc29 ]
The CSI1 PHY reference clock is limited to 125 MHz according to:
i.MX 8M Mini Applications Processor Reference Manual, Rev. 3, 11/2020
Table 5-1. Clock Root Table (continued) / page 307
Slice Index n = 123 .
Currently the IMX8MM_CLK_CSI1_PHY_REF clock is configured to be
fed directly from 1 GHz PLL2 , which overclocks them. Instead, drop
the configuration altogether, which defaults the clock to 24 MHz REF
clock input, which for the PHY reference clock is just fine.
Based on a patch from Marek Vasut for the imx8mn.
Fixes: e523b7c54c05 ("arm64: dts: imx8mm: Add CSI nodes")
Signed-off-by: Fabio Estevam <festevam@denx.de>
Reviewed-by: Marek Vasut <marex@denx.de>
Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
Reviewed-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mm.dtsi | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
index 420ba0d6f1343..12c82bb1bb7aa 100644
--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
@@ -1145,10 +1145,9 @@
compatible = "fsl,imx8mm-mipi-csi2";
reg = <0x32e30000 0x1000>;
interrupts = <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>;
- assigned-clocks = <&clk IMX8MM_CLK_CSI1_CORE>,
- <&clk IMX8MM_CLK_CSI1_PHY_REF>;
- assigned-clock-parents = <&clk IMX8MM_SYS_PLL2_1000M>,
- <&clk IMX8MM_SYS_PLL2_1000M>;
+ assigned-clocks = <&clk IMX8MM_CLK_CSI1_CORE>;
+ assigned-clock-parents = <&clk IMX8MM_SYS_PLL2_1000M>;
+
clock-frequency = <333000000>;
clocks = <&clk IMX8MM_CLK_DISP_APB_ROOT>,
<&clk IMX8MM_CLK_CSI1_ROOT>,
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 142/194] ARM: dts: imx: Set default tuning step for imx6sx usdhc
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 141/194] arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 143/194] arm64: dts: imx93: Fix anatop node size Greg Kroah-Hartman
` (62 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaolei Wang, Fabio Estevam,
Shawn Guo, Sasha Levin
From: Xiaolei Wang <xiaolei.wang@windriver.com>
[ Upstream commit 0a2b96e42a0284c4fc03022236f656a085ca714a ]
If the tuning step is not set, the tuning step is set to 1.
For some sd cards, the following Tuning timeout will occur.
Tuning failed, falling back to fixed sampling clock
So set the default tuning step. This refers to the NXP vendor's
commit below:
https://github.com/nxp-imx/linux-imx/blob/lf-6.1.y/
arch/arm/boot/dts/imx6sx.dtsi#L1108-L1109
Fixes: 1e336aa0c025 ("mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting")
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx6sx.dtsi | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
index abc3572d699e6..1f1053a898fbf 100644
--- a/arch/arm/boot/dts/imx6sx.dtsi
+++ b/arch/arm/boot/dts/imx6sx.dtsi
@@ -981,6 +981,8 @@
<&clks IMX6SX_CLK_USDHC1>;
clock-names = "ipg", "ahb", "per";
bus-width = <4>;
+ fsl,tuning-start-tap = <20>;
+ fsl,tuning-step= <2>;
status = "disabled";
};
@@ -993,6 +995,8 @@
<&clks IMX6SX_CLK_USDHC2>;
clock-names = "ipg", "ahb", "per";
bus-width = <4>;
+ fsl,tuning-start-tap = <20>;
+ fsl,tuning-step= <2>;
status = "disabled";
};
@@ -1005,6 +1009,8 @@
<&clks IMX6SX_CLK_USDHC3>;
clock-names = "ipg", "ahb", "per";
bus-width = <4>;
+ fsl,tuning-start-tap = <20>;
+ fsl,tuning-step= <2>;
status = "disabled";
};
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 143/194] arm64: dts: imx93: Fix anatop node size
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 142/194] ARM: dts: imx: Set default tuning step for imx6sx usdhc Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 144/194] ASoC: rt5665: add missed regulator_bulk_disable Greg Kroah-Hartman
` (61 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Stein, Peng Fan, Jacky Bai,
Shawn Guo, Sasha Levin
From: Alexander Stein <alexander.stein@ew.tq-group.com>
[ Upstream commit 78e869dd8b2ba19765ac9b05cdea3e432d1dc188 ]
Although the memory map of i.MX93 reference manual rev. 2 claims that
analog top has start address of 0x44480000 and end address of 0x4448ffff,
this overlaps with TMU memory area starting at 0x44482000, as stated in
section 73.6.1.
As PLL configuration registers start at addresses up to 0x44481400, as used
by clk-imx93, reduce the anatop size to 0x2000, so exclude the TMU area
but keep all PLL registers inside.
Fixes: ec8b5b5058ea ("arm64: dts: freescale: Add i.MX93 dtsi support")
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Jacky Bai <ping.bai@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi
index 8ab9f8194702e..c2f60d41d6fd1 100644
--- a/arch/arm64/boot/dts/freescale/imx93.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx93.dtsi
@@ -254,7 +254,7 @@
anatop: anatop@44480000 {
compatible = "fsl,imx93-anatop", "syscon";
- reg = <0x44480000 0x10000>;
+ reg = <0x44480000 0x2000>;
};
};
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 144/194] ASoC: rt5665: add missed regulator_bulk_disable
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 143/194] arm64: dts: imx93: Fix anatop node size Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 145/194] ASoC: meson: axg-tdm-formatter: fix channel slot allocation Greg Kroah-Hartman
` (60 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhang Shurong, Mark Brown,
Sasha Levin
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit c163108e706909570f8aa9aa5bcf6806e2b4c98c ]
The driver forgets to call regulator_bulk_disable()
Add the missed call to fix it.
Fixes: 33ada14a26c8 ("ASoC: add rt5665 codec driver")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Link: https://lore.kernel.org/r/tencent_A560D01E3E0A00A85A12F137E4B5205B3508@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/rt5665.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/soc/codecs/rt5665.c b/sound/soc/codecs/rt5665.c
index 6e66cc218fa8d..76ff097518c88 100644
--- a/sound/soc/codecs/rt5665.c
+++ b/sound/soc/codecs/rt5665.c
@@ -4472,6 +4472,8 @@ static void rt5665_remove(struct snd_soc_component *component)
struct rt5665_priv *rt5665 = snd_soc_component_get_drvdata(component);
regmap_write(rt5665->regmap, RT5665_RESET, 0);
+
+ regulator_bulk_disable(ARRAY_SIZE(rt5665->supplies), rt5665->supplies);
}
#ifdef CONFIG_PM
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 145/194] ASoC: meson: axg-tdm-formatter: fix channel slot allocation
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 144/194] ASoC: rt5665: add missed regulator_bulk_disable Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 146/194] ALSA: hda/realtek: Add quirks for HP G11 Laptops Greg Kroah-Hartman
` (59 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jerome Brunet, Mark Brown,
Sasha Levin
From: Jerome Brunet <jbrunet@baylibre.com>
[ Upstream commit c1f848f12103920ca165758aedb1c10904e193e1 ]
When the tdm lane mask is computed, the driver currently fills the 1st lane
before moving on to the next. If the stream has less channels than the
lanes can accommodate, slots will be disabled on the last lanes.
Unfortunately, the HW distribute channels in a different way. It distribute
channels in pair on each lanes before moving on the next slots.
This difference leads to problems if a device has an interface with more
than 1 lane and with more than 2 slots per lane.
For example: a playback interface with 2 lanes and 4 slots each (total 8
slots - zero based numbering)
- Playing a 8ch stream:
- All slots activated by the driver
- channel #2 will be played on lane #1 - slot #0 following HW placement
- Playing a 4ch stream:
- Lane #1 disabled by the driver
- channel #2 will be played on lane #0 - slot #2
This behaviour is obviously not desirable.
Change the way slots are activated on the TDM lanes to follow what the HW
does and make sure each channel always get mapped to the same slot/lane.
Fixes: 1a11d88f499c ("ASoC: meson: add tdm formatter base driver")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20230809171931.1244502-1-jbrunet@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/meson/axg-tdm-formatter.c | 42 ++++++++++++++++++-----------
1 file changed, 26 insertions(+), 16 deletions(-)
diff --git a/sound/soc/meson/axg-tdm-formatter.c b/sound/soc/meson/axg-tdm-formatter.c
index 9883dc777f630..63333a2b0a9c3 100644
--- a/sound/soc/meson/axg-tdm-formatter.c
+++ b/sound/soc/meson/axg-tdm-formatter.c
@@ -30,27 +30,32 @@ int axg_tdm_formatter_set_channel_masks(struct regmap *map,
struct axg_tdm_stream *ts,
unsigned int offset)
{
- unsigned int val, ch = ts->channels;
- unsigned long mask;
- int i, j;
+ unsigned int ch = ts->channels;
+ u32 val[AXG_TDM_NUM_LANES];
+ int i, j, k;
+
+ /*
+ * We need to mimick the slot distribution used by the HW to keep the
+ * channel placement consistent regardless of the number of channel
+ * in the stream. This is why the odd algorithm below is used.
+ */
+ memset(val, 0, sizeof(*val) * AXG_TDM_NUM_LANES);
/*
* Distribute the channels of the stream over the available slots
- * of each TDM lane
+ * of each TDM lane. We need to go over the 32 slots ...
*/
- for (i = 0; i < AXG_TDM_NUM_LANES; i++) {
- val = 0;
- mask = ts->mask[i];
-
- for (j = find_first_bit(&mask, 32);
- (j < 32) && ch;
- j = find_next_bit(&mask, 32, j + 1)) {
- val |= 1 << j;
- ch -= 1;
+ for (i = 0; (i < 32) && ch; i += 2) {
+ /* ... of all the lanes ... */
+ for (j = 0; j < AXG_TDM_NUM_LANES; j++) {
+ /* ... then distribute the channels in pairs */
+ for (k = 0; k < 2; k++) {
+ if ((BIT(i + k) & ts->mask[j]) && ch) {
+ val[j] |= BIT(i + k);
+ ch -= 1;
+ }
+ }
}
-
- regmap_write(map, offset, val);
- offset += regmap_get_reg_stride(map);
}
/*
@@ -63,6 +68,11 @@ int axg_tdm_formatter_set_channel_masks(struct regmap *map,
return -EINVAL;
}
+ for (i = 0; i < AXG_TDM_NUM_LANES; i++) {
+ regmap_write(map, offset, val[i]);
+ offset += regmap_get_reg_stride(map);
+ }
+
return 0;
}
EXPORT_SYMBOL_GPL(axg_tdm_formatter_set_channel_masks);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 146/194] ALSA: hda/realtek: Add quirks for HP G11 Laptops
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 145/194] ASoC: meson: axg-tdm-formatter: fix channel slot allocation Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 147/194] soc: aspeed: uart-routing: Use __sysfs_match_string Greg Kroah-Hartman
` (58 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Binding, Takashi Iwai,
Sasha Levin
From: Stefan Binding <sbinding@opensource.cirrus.com>
[ Upstream commit fb8cce69e5e56eedb35fc4d77b2f099860965859 ]
These HP G11 laptops use Realtek HDA codec combined with
2xCS35L41 Amplifiers using SPI or I2C with External Boost.
Laptop 103c8c26 has been removed as this has been replaced
by this new series of laptops.
Fixes: 3e10f6ca76c4 ("ALSA: hda/realtek: Add quirk for HP EliteBook G10 laptops")
Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20230809142957.675933-2-sbinding@opensource.cirrus.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 526ec8cae9437..de6bd8a9871cf 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9596,7 +9596,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x103c, 0x8b96, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
SND_PCI_QUIRK(0x103c, 0x8b97, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
SND_PCI_QUIRK(0x103c, 0x8bf0, "HP", ALC236_FIXUP_HP_GPIO_LED),
- SND_PCI_QUIRK(0x103c, 0x8c26, "HP HP EliteBook 800G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8c46, "HP EliteBook 830 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8c47, "HP EliteBook 840 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8c48, "HP EliteBook 860 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8c49, "HP Elite x360 830 2-in-1 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8c70, "HP EliteBook 835 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8c71, "HP EliteBook 845 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8c72, "HP EliteBook 865 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 147/194] soc: aspeed: uart-routing: Use __sysfs_match_string
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 146/194] ALSA: hda/realtek: Add quirks for HP G11 Laptops Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 148/194] soc: aspeed: socinfo: Add kfree for kstrdup Greg Kroah-Hartman
` (57 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zev Weiss, Joel Stanley,
Arnd Bergmann, Sasha Levin
From: Zev Weiss <zev@bewilderbeest.net>
[ Upstream commit e4ad279ae345413d900d791f2f618d0a1cd0d791 ]
The existing use of match_string() caused it to reject 'echo foo' due
to the implicitly appended newline, which was somewhat ergonomically
awkward and inconsistent with typical sysfs behavior. Using the
__sysfs_* variant instead provides more convenient and consistent
linefeed-agnostic behavior.
Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
Fixes: c6807970c3bc ("soc: aspeed: Add UART routing support")
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20230628083735.19946-2-zev@bewilderbeest.net
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20230810122941.231085-1-joel@jms.id.au
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/aspeed/aspeed-uart-routing.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/aspeed/aspeed-uart-routing.c b/drivers/soc/aspeed/aspeed-uart-routing.c
index ef8b24fd18518..59123e1f27acb 100644
--- a/drivers/soc/aspeed/aspeed-uart-routing.c
+++ b/drivers/soc/aspeed/aspeed-uart-routing.c
@@ -524,7 +524,7 @@ static ssize_t aspeed_uart_routing_store(struct device *dev,
struct aspeed_uart_routing_selector *sel = to_routing_selector(attr);
int val;
- val = match_string(sel->options, -1, buf);
+ val = __sysfs_match_string(sel->options, -1, buf);
if (val < 0) {
dev_err(dev, "invalid value \"%s\"\n", buf);
return -EINVAL;
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 148/194] soc: aspeed: socinfo: Add kfree for kstrdup
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 147/194] soc: aspeed: uart-routing: Use __sysfs_match_string Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 149/194] ALSA: hda/realtek - Remodified 3k pull low procedure Greg Kroah-Hartman
` (56 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Joel Stanley,
Arnd Bergmann, Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit 6e6d847a8ce18ab2fbec4f579f682486a82d2c6b ]
Add kfree() in the later error handling in order to avoid memory leak.
Fixes: e0218dca5787 ("soc: aspeed: Add soc info driver")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20230707021625.7727-1-jiasheng@iscas.ac.cn
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20230810123104.231167-1-joel@jms.id.au
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/aspeed/aspeed-socinfo.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
index 1ca140356a084..3f759121dc00a 100644
--- a/drivers/soc/aspeed/aspeed-socinfo.c
+++ b/drivers/soc/aspeed/aspeed-socinfo.c
@@ -137,6 +137,7 @@ static int __init aspeed_socinfo_init(void)
soc_dev = soc_device_register(attrs);
if (IS_ERR(soc_dev)) {
+ kfree(attrs->machine);
kfree(attrs->soc_id);
kfree(attrs->serial_number);
kfree(attrs);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 149/194] ALSA: hda/realtek - Remodified 3k pull low procedure
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 148/194] soc: aspeed: socinfo: Add kfree for kstrdup Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 150/194] riscv: uaccess: Return the number of bytes effectively not copied Greg Kroah-Hartman
` (55 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kailang Yang, Takashi Iwai,
Sasha Levin
From: Kailang Yang <kailang@realtek.com>
[ Upstream commit 46cdff2369cbdf8d78081a22526e77bd1323f563 ]
Set spec->en_3kpull_low default to true.
Then fillback ALC236 and ALC257 to false.
Additional note: this addresses a regression caused by the previous
fix 69ea4c9d02b7 ("ALSA: hda/realtek - remove 3k pull low procedure").
The previous workaround was applied too widely without necessity,
which resulted in the pop noise at PM again. This patch corrects the
condition and restores the old behavior for the devices that don't
suffer from the original problem.
Fixes: 69ea4c9d02b7 ("ALSA: hda/realtek - remove 3k pull low procedure")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217732
Link: https://lore.kernel.org/r/01e212a538fc407ca6edd10b81ff7b05@realtek.com
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index de6bd8a9871cf..aa475154c582f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10620,6 +10620,7 @@ static int patch_alc269(struct hda_codec *codec)
spec = codec->spec;
spec->gen.shared_mic_vref_pin = 0x18;
codec->power_save_node = 0;
+ spec->en_3kpull_low = true;
#ifdef CONFIG_PM
codec->patch_ops.suspend = alc269_suspend;
@@ -10702,14 +10703,16 @@ static int patch_alc269(struct hda_codec *codec)
spec->shutup = alc256_shutup;
spec->init_hook = alc256_init;
spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */
- if (codec->bus->pci->vendor == PCI_VENDOR_ID_AMD)
- spec->en_3kpull_low = true;
+ if (codec->core.vendor_id == 0x10ec0236 &&
+ codec->bus->pci->vendor != PCI_VENDOR_ID_AMD)
+ spec->en_3kpull_low = false;
break;
case 0x10ec0257:
spec->codec_variant = ALC269_TYPE_ALC257;
spec->shutup = alc256_shutup;
spec->init_hook = alc256_init;
spec->gen.mixer_nid = 0;
+ spec->en_3kpull_low = false;
break;
case 0x10ec0215:
case 0x10ec0245:
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 150/194] riscv: uaccess: Return the number of bytes effectively not copied
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 149/194] ALSA: hda/realtek - Remodified 3k pull low procedure Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 151/194] serial: 8250: Fix oops for port->pm on uart_change_pm() Greg Kroah-Hartman
` (54 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bo YU, Aurelien Jarno,
Alexandre Ghiti, Björn Töpel, Palmer Dabbelt,
Sasha Levin
From: Alexandre Ghiti <alexghiti@rivosinc.com>
[ Upstream commit 4b05b993900dd3eba0fc83ef5c5ddc7d65d786c6 ]
It was reported that the riscv kernel hangs while executing the test
in [1].
Indeed, the test hangs when trying to write a buffer to a file. The
problem is that the riscv implementation of raw_copy_from_user() does not
return the correct number of bytes not written when an exception happens
and is fixed up, instead it always returns the initial size to copy,
even if some bytes were actually copied.
generic_perform_write() pre-faults the user pages and bails out if nothing
can be written, otherwise it will access the userspace buffer: here the
riscv implementation keeps returning it was not able to copy any byte
though the pre-faulting indicates otherwise. So generic_perform_write()
keeps retrying to access the user memory and ends up in an infinite
loop.
Note that before the commit mentioned in [1] that introduced this
regression, it worked because generic_perform_write() would bail out if
only one byte could not be written.
So fix this by returning the number of bytes effectively not written in
__asm_copy_[to|from]_user() and __clear_user(), as it is expected.
Link: https://lore.kernel.org/linux-riscv/20230309151841.bomov6hq3ybyp42a@debian/ [1]
Fixes: ebcbd75e3962 ("riscv: Fix the bug in memory access fixup code")
Reported-by: Bo YU <tsu.yubo@gmail.com>
Closes: https://lore.kernel.org/linux-riscv/20230309151841.bomov6hq3ybyp42a@debian/#t
Reported-by: Aurelien Jarno <aurelien@aurel32.net>
Closes: https://lore.kernel.org/linux-riscv/ZNOnCakhwIeue3yr@aurel32.net/
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Reviewed-by: Björn Töpel <bjorn@rivosinc.com>
Tested-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Link: https://lore.kernel.org/r/20230811150604.1621784-1-alexghiti@rivosinc.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/lib/uaccess.S | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/arch/riscv/lib/uaccess.S b/arch/riscv/lib/uaccess.S
index ec486e5369d9b..09b47ebacf2e8 100644
--- a/arch/riscv/lib/uaccess.S
+++ b/arch/riscv/lib/uaccess.S
@@ -17,8 +17,11 @@ ENTRY(__asm_copy_from_user)
li t6, SR_SUM
csrs CSR_STATUS, t6
- /* Save for return value */
- mv t5, a2
+ /*
+ * Save the terminal address which will be used to compute the number
+ * of bytes copied in case of a fixup exception.
+ */
+ add t5, a0, a2
/*
* Register allocation for code below:
@@ -176,7 +179,7 @@ ENTRY(__asm_copy_from_user)
10:
/* Disable access to user memory */
csrc CSR_STATUS, t6
- mv a0, t5
+ sub a0, t5, a0
ret
ENDPROC(__asm_copy_to_user)
ENDPROC(__asm_copy_from_user)
@@ -228,7 +231,7 @@ ENTRY(__clear_user)
11:
/* Disable access to user memory */
csrc CSR_STATUS, t6
- mv a0, a1
+ sub a0, a3, a0
ret
ENDPROC(__clear_user)
EXPORT_SYMBOL(__clear_user)
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 151/194] serial: 8250: Fix oops for port->pm on uart_change_pm()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 150/194] riscv: uaccess: Return the number of bytes effectively not copied Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 152/194] ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces Greg Kroah-Hartman
` (53 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tony Lindgren, Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit dfe2aeb226fd5e19b0ee795f4f6ed8bc494c1534 ]
Unloading a hardware specific 8250 driver can produce error "Unable to
handle kernel paging request at virtual address" about ten seconds after
unloading the driver. This happens on uart_hangup() calling
uart_change_pm().
Turns out commit 04e82793f068 ("serial: 8250: Reinit port->pm on port
specific driver unbind") was only a partial fix. If the hardware specific
driver has initialized port->pm function, we need to clear port->pm too.
Just reinitializing port->ops does not do this. Otherwise serial8250_pm()
will call port->pm() instead of serial8250_do_pm().
Fixes: 04e82793f068 ("serial: 8250: Reinit port->pm on port specific driver unbind")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20230804131553.52927-1-tony@atomide.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_port.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index acf578aa9930b..38760bd6e0c29 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -3281,6 +3281,7 @@ void serial8250_init_port(struct uart_8250_port *up)
struct uart_port *port = &up->port;
spin_lock_init(&port->lock);
+ port->pm = NULL;
port->ops = &serial8250_pops;
port->has_sysrq = IS_ENABLED(CONFIG_SERIAL_8250_CONSOLE);
--
2.40.1
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 152/194] ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 151/194] serial: 8250: Fix oops for port->pm on uart_change_pm() Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 153/194] cifs: Release folio lock on fscache read hit Greg Kroah-Hartman
` (52 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, dengxiang, Takashi Iwai
From: dengxiang <dengxiang@nfschina.com>
commit 788449ae57f4273111b779bbcaad552b67f517d5 upstream.
This patch adds a USB quirk for Mythware XA001AU USB interface.
Signed-off-by: dengxiang <dengxiang@nfschina.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230803024437.370069-1-dengxiang@nfschina.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/quirks-table.h | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -4507,6 +4507,35 @@ YAMAHA_DEVICE(0x7010, "UB99"),
}
}
},
+{
+ /* Advanced modes of the Mythware XA001AU.
+ * For the standard mode, Mythware XA001AU has ID ffad:a001
+ */
+ USB_DEVICE_VENDOR_SPEC(0xffad, 0xa001),
+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+ .vendor_name = "Mythware",
+ .product_name = "XA001AU",
+ .ifnum = QUIRK_ANY_INTERFACE,
+ .type = QUIRK_COMPOSITE,
+ .data = (const struct snd_usb_audio_quirk[]) {
+ {
+ .ifnum = 0,
+ .type = QUIRK_IGNORE_INTERFACE,
+ },
+ {
+ .ifnum = 1,
+ .type = QUIRK_AUDIO_STANDARD_INTERFACE,
+ },
+ {
+ .ifnum = 2,
+ .type = QUIRK_AUDIO_STANDARD_INTERFACE,
+ },
+ {
+ .ifnum = -1
+ }
+ }
+ }
+},
#undef USB_DEVICE_VENDOR_SPEC
#undef USB_AUDIO_DEVICE
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 153/194] cifs: Release folio lock on fscache read hit.
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 152/194] ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 154/194] riscv: Handle zicsr/zifencei issue between gcc and binutils Greg Kroah-Hartman
` (51 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Russell Harmon,
Paulo Alcantara (SUSE), David Howells, Steve French
From: Russell Harmon via samba-technical <samba-technical@lists.samba.org>
commit 69513dd669e243928f7450893190915a88f84a2b upstream.
Under the current code, when cifs_readpage_worker is called, the call
contract is that the callee should unlock the page. This is documented
in the read_folio section of Documentation/filesystems/vfs.rst as:
> The filesystem should unlock the folio once the read has completed,
> whether it was successful or not.
Without this change, when fscache is in use and cache hit occurs during
a read, the page lock is leaked, producing the following stack on
subsequent reads (via mmap) to the page:
$ cat /proc/3890/task/12864/stack
[<0>] folio_wait_bit_common+0x124/0x350
[<0>] filemap_read_folio+0xad/0xf0
[<0>] filemap_fault+0x8b1/0xab0
[<0>] __do_fault+0x39/0x150
[<0>] do_fault+0x25c/0x3e0
[<0>] __handle_mm_fault+0x6ca/0xc70
[<0>] handle_mm_fault+0xe9/0x350
[<0>] do_user_addr_fault+0x225/0x6c0
[<0>] exc_page_fault+0x84/0x1b0
[<0>] asm_exc_page_fault+0x27/0x30
This requires a reboot to resolve; it is a deadlock.
Note however that the call to cifs_readpage_from_fscache does mark the
page clean, but does not free the folio lock. This happens in
__cifs_readpage_from_fscache on success. Releasing the lock at that
point however is not appropriate as cifs_readahead also calls
cifs_readpage_from_fscache and *does* unconditionally release the lock
after its return. This change therefore effectively makes
cifs_readpage_worker work like cifs_readahead.
Signed-off-by: Russell Harmon <russ@har.mn>
Acked-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Reviewed-by: David Howells <dhowells@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/smb/client/file.c
+++ b/fs/smb/client/file.c
@@ -4885,9 +4885,9 @@ static int cifs_readpage_worker(struct f
io_error:
kunmap(page);
- unlock_page(page);
read_complete:
+ unlock_page(page);
return rc;
}
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 154/194] riscv: Handle zicsr/zifencei issue between gcc and binutils
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 153/194] cifs: Release folio lock on fscache read hit Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 155/194] virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case Greg Kroah-Hartman
` (50 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Conor Dooley, Guo Ren,
Mingzheng Xing, Palmer Dabbelt
From: Mingzheng Xing <xingmingzheng@iscas.ac.cn>
commit ca09f772cccaeec4cd05a21528c37a260aa2dd2c upstream.
Binutils-2.38 and GCC-12.1.0 bumped[0][1] the default ISA spec to the newer
20191213 version which moves some instructions from the I extension to the
Zicsr and Zifencei extensions. So if one of the binutils and GCC exceeds
that version, we should explicitly specifying Zicsr and Zifencei via -march
to cope with the new changes. but this only occurs when binutils >= 2.36
and GCC >= 11.1.0. It's a different story when binutils < 2.36.
binutils-2.36 supports the Zifencei extension[2] and splits Zifencei and
Zicsr from I[3]. GCC-11.1.0 is particular[4] because it add support Zicsr
and Zifencei extension for -march. binutils-2.35 does not support the
Zifencei extension, and does not need to specify Zicsr and Zifencei when
working with GCC >= 12.1.0.
To make our lives easier, let's relax the check to binutils >= 2.36 in
CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI. For the other two cases,
where clang < 17 or GCC < 11.1.0, we will deal with them in
CONFIG_TOOLCHAIN_NEEDS_OLD_ISA_SPEC.
For more information, please refer to:
commit 6df2a016c0c8 ("riscv: fix build with binutils 2.38")
commit e89c2e815e76 ("riscv: Handle zicsr/zifencei issues between clang and binutils")
Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=aed44286efa8ae8717a77d94b51ac3614e2ca6dc [0]
Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=98416dbb0a62579d4a7a4a76bab51b5b52fec2cd [1]
Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=5a1b31e1e1cee6e9f1c92abff59cdcfff0dddf30 [2]
Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=729a53530e86972d1143553a415db34e6e01d5d2 [3]
Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=b03be74bad08c382da47e048007a78fa3fb4ef49 [4]
Link: https://lore.kernel.org/all/20230308220842.1231003-1-conor@kernel.org
Link: https://lore.kernel.org/all/20230223220546.52879-1-conor@kernel.org
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Guo Ren <guoren@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Mingzheng Xing <xingmingzheng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20230809165648.21071-1-xingmingzheng@iscas.ac.cn
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/Kconfig | 28 +++++++++++++++++-----------
arch/riscv/kernel/compat_vdso/Makefile | 8 +++++++-
2 files changed, 24 insertions(+), 12 deletions(-)
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -447,24 +447,30 @@ config TOOLCHAIN_HAS_ZIHINTPAUSE
config TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI
def_bool y
# https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=aed44286efa8ae8717a77d94b51ac3614e2ca6dc
- depends on AS_IS_GNU && AS_VERSION >= 23800
+ # https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=98416dbb0a62579d4a7a4a76bab51b5b52fec2cd
+ depends on AS_IS_GNU && AS_VERSION >= 23600
help
- Newer binutils versions default to ISA spec version 20191213 which
- moves some instructions from the I extension to the Zicsr and Zifencei
- extensions.
+ Binutils-2.38 and GCC-12.1.0 bumped the default ISA spec to the newer
+ 20191213 version, which moves some instructions from the I extension to
+ the Zicsr and Zifencei extensions. This requires explicitly specifying
+ Zicsr and Zifencei when binutils >= 2.38 or GCC >= 12.1.0. Zicsr
+ and Zifencei are supported in binutils from version 2.36 onwards.
+ To make life easier, and avoid forcing toolchains that default to a
+ newer ISA spec to version 2.2, relax the check to binutils >= 2.36.
+ For clang < 17 or GCC < 11.1.0, for which this is not possible, this is
+ dealt with in CONFIG_TOOLCHAIN_NEEDS_OLD_ISA_SPEC.
config TOOLCHAIN_NEEDS_OLD_ISA_SPEC
def_bool y
depends on TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI
# https://github.com/llvm/llvm-project/commit/22e199e6afb1263c943c0c0d4498694e15bf8a16
- depends on CC_IS_CLANG && CLANG_VERSION < 170000
+ # https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=b03be74bad08c382da47e048007a78fa3fb4ef49
+ depends on (CC_IS_CLANG && CLANG_VERSION < 170000) || (CC_IS_GCC && GCC_VERSION < 110100)
help
- Certain versions of clang do not support zicsr and zifencei via -march
- but newer versions of binutils require it for the reasons noted in the
- help text of CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI. This
- option causes an older ISA spec compatible with these older versions
- of clang to be passed to GAS, which has the same result as passing zicsr
- and zifencei to -march.
+ Certain versions of clang and GCC do not support zicsr and zifencei via
+ -march. This option causes an older ISA spec compatible with these older
+ versions of clang and GCC to be passed to GAS, which has the same result
+ as passing zicsr and zifencei to -march.
config FPU
bool "FPU support"
--- a/arch/riscv/kernel/compat_vdso/Makefile
+++ b/arch/riscv/kernel/compat_vdso/Makefile
@@ -11,7 +11,13 @@ compat_vdso-syms += flush_icache
COMPAT_CC := $(CC)
COMPAT_LD := $(LD)
-COMPAT_CC_FLAGS := -march=rv32g -mabi=ilp32
+# binutils 2.35 does not support the zifencei extension, but in the ISA
+# spec 20191213, G stands for IMAFD_ZICSR_ZIFENCEI.
+ifdef CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI
+ COMPAT_CC_FLAGS := -march=rv32g -mabi=ilp32
+else
+ COMPAT_CC_FLAGS := -march=rv32imafd -mabi=ilp32
+endif
COMPAT_LD_FLAGS := -melf32lriscv
# Disable attributes, as they're useless and break the build.
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 155/194] virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 154/194] riscv: Handle zicsr/zifencei issue between gcc and binutils Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 156/194] arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards Greg Kroah-Hartman
` (49 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Melnychenko, Hawkins Jiawei,
Jason Wang, Eugenio Pérez, Michael S. Tsirkin, Xuan Zhuo
From: Hawkins Jiawei <yin31149@gmail.com>
commit 2c507ce90e02cd78d00fd4b0fe26c8641873c13f upstream.
Kernel uses `struct virtio_net_ctrl_rss` to save command-specific-data
for both the VIRTIO_NET_CTRL_MQ_HASH_CONFIG and
VIRTIO_NET_CTRL_MQ_RSS_CONFIG commands.
According to the VirtIO standard, "Field reserved MUST contain zeroes.
It is defined to make the structure to match the layout of
virtio_net_rss_config structure, defined in 5.1.6.5.7.".
Yet for the VIRTIO_NET_CTRL_MQ_HASH_CONFIG command case, the `max_tx_vq`
field in struct virtio_net_ctrl_rss, which corresponds to the
`reserved` field in struct virtio_net_hash_config, is not zeroed,
thereby violating the VirtIO standard.
This patch solves this problem by zeroing this field in
virtnet_init_default_rss().
Cc: Andrew Melnychenko <andrew@daynix.com>
Cc: stable@vger.kernel.org
Fixes: c7114b1249fa ("drivers/net/virtio_net: Added basic RSS support.")
Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20230810110405.25558-1-yin31149@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/virtio_net.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2504,7 +2504,7 @@ static void virtnet_init_default_rss(str
vi->ctrl->rss.indirection_table[i] = indir_val;
}
- vi->ctrl->rss.max_tx_vq = vi->curr_queue_pairs;
+ vi->ctrl->rss.max_tx_vq = vi->has_rss ? vi->curr_queue_pairs : 0;
vi->ctrl->rss.hash_key_length = vi->rss_key_size;
netdev_rss_key_fill(vi->ctrl->rss.key, vi->rss_key_size);
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 156/194] arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 155/194] virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 157/194] blk-crypto: dynamically allocate fallback profile Greg Kroah-Hartman
` (48 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yogesh Hegde, Heiko Stuebner
From: Yogesh Hegde <yogi.kernel@gmail.com>
commit ebceec271e552a2b05e47d8ef0597052b1a39449 upstream.
This patch fixes an issue affecting the Wifi/Bluetooth connectivity on
ROCK Pi 4 boards. Commit f471b1b2db08 ("arm64: dts: rockchip: Fix Bluetooth
on ROCK Pi 4 boards") introduced a problem with the clock configuration.
Specifically, the clock-names property of the sdio-pwrseq node was not
updated to 'lpo', causing the driver to wait indefinitely for the wrong clock
signal 'ext_clock' instead of the expected one 'lpo'. This prevented the proper
initialization of Wifi/Bluetooth chip on ROCK Pi 4 boards.
To address this, this patch updates the clock-names property of the
sdio-pwrseq node to "lpo" to align with the changes made to the bluetooth node.
This patch has been tested on ROCK Pi 4B.
Fixes: f471b1b2db08 ("arm64: dts: rockchip: Fix Bluetooth on ROCK Pi 4 boards")
Cc: stable@vger.kernel.org
Signed-off-by: Yogesh Hegde <yogi.kernel@gmail.com>
Link: https://lore.kernel.org/r/ZLbATQRjOl09aLAp@zephyrusG14
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
@@ -45,7 +45,7 @@
sdio_pwrseq: sdio-pwrseq {
compatible = "mmc-pwrseq-simple";
clocks = <&rk808 1>;
- clock-names = "ext_clock";
+ clock-names = "lpo";
pinctrl-names = "default";
pinctrl-0 = <&wifi_enable_h>;
reset-gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_LOW>;
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 157/194] blk-crypto: dynamically allocate fallback profile
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 156/194] arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 158/194] mmc: wbsd: fix double mmc_free_host() in wbsd_init() Greg Kroah-Hartman
` (47 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sweet Tea Dorminy, Eric Biggers,
Jens Axboe
From: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
commit c984ff1423ae9f70b1f28ce811856db0d9c99021 upstream.
blk_crypto_profile_init() calls lockdep_register_key(), which warns and
does not register if the provided memory is a static object.
blk-crypto-fallback currently has a static blk_crypto_profile and calls
blk_crypto_profile_init() thereupon, resulting in the warning and
failure to register.
Fortunately it is simple enough to use a dynamically allocated profile
and make lockdep function correctly.
Fixes: 2fb48d88e77f ("blk-crypto: use dynamic lock class for blk_crypto_profile::lock")
Cc: stable@vger.kernel.org
Signed-off-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20230817141615.15387-1-sweettea-kernel@dorminy.me
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-crypto-fallback.c | 36 +++++++++++++++++++++++-------------
1 file changed, 23 insertions(+), 13 deletions(-)
diff --git a/block/blk-crypto-fallback.c b/block/blk-crypto-fallback.c
index ad9844c5b40c..e6468eab2681 100644
--- a/block/blk-crypto-fallback.c
+++ b/block/blk-crypto-fallback.c
@@ -78,7 +78,7 @@ static struct blk_crypto_fallback_keyslot {
struct crypto_skcipher *tfms[BLK_ENCRYPTION_MODE_MAX];
} *blk_crypto_keyslots;
-static struct blk_crypto_profile blk_crypto_fallback_profile;
+static struct blk_crypto_profile *blk_crypto_fallback_profile;
static struct workqueue_struct *blk_crypto_wq;
static mempool_t *blk_crypto_bounce_page_pool;
static struct bio_set crypto_bio_split;
@@ -292,7 +292,7 @@ static bool blk_crypto_fallback_encrypt_bio(struct bio **bio_ptr)
* Get a blk-crypto-fallback keyslot that contains a crypto_skcipher for
* this bio's algorithm and key.
*/
- blk_st = blk_crypto_get_keyslot(&blk_crypto_fallback_profile,
+ blk_st = blk_crypto_get_keyslot(blk_crypto_fallback_profile,
bc->bc_key, &slot);
if (blk_st != BLK_STS_OK) {
src_bio->bi_status = blk_st;
@@ -395,7 +395,7 @@ static void blk_crypto_fallback_decrypt_bio(struct work_struct *work)
* Get a blk-crypto-fallback keyslot that contains a crypto_skcipher for
* this bio's algorithm and key.
*/
- blk_st = blk_crypto_get_keyslot(&blk_crypto_fallback_profile,
+ blk_st = blk_crypto_get_keyslot(blk_crypto_fallback_profile,
bc->bc_key, &slot);
if (blk_st != BLK_STS_OK) {
bio->bi_status = blk_st;
@@ -499,7 +499,7 @@ bool blk_crypto_fallback_bio_prep(struct bio **bio_ptr)
return false;
}
- if (!__blk_crypto_cfg_supported(&blk_crypto_fallback_profile,
+ if (!__blk_crypto_cfg_supported(blk_crypto_fallback_profile,
&bc->bc_key->crypto_cfg)) {
bio->bi_status = BLK_STS_NOTSUPP;
return false;
@@ -526,7 +526,7 @@ bool blk_crypto_fallback_bio_prep(struct bio **bio_ptr)
int blk_crypto_fallback_evict_key(const struct blk_crypto_key *key)
{
- return __blk_crypto_evict_key(&blk_crypto_fallback_profile, key);
+ return __blk_crypto_evict_key(blk_crypto_fallback_profile, key);
}
static bool blk_crypto_fallback_inited;
@@ -534,7 +534,6 @@ static int blk_crypto_fallback_init(void)
{
int i;
int err;
- struct blk_crypto_profile *profile = &blk_crypto_fallback_profile;
if (blk_crypto_fallback_inited)
return 0;
@@ -545,18 +544,27 @@ static int blk_crypto_fallback_init(void)
if (err)
goto out;
- err = blk_crypto_profile_init(profile, blk_crypto_num_keyslots);
- if (err)
+ /* Dynamic allocation is needed because of lockdep_register_key(). */
+ blk_crypto_fallback_profile =
+ kzalloc(sizeof(*blk_crypto_fallback_profile), GFP_KERNEL);
+ if (!blk_crypto_fallback_profile) {
+ err = -ENOMEM;
goto fail_free_bioset;
+ }
+
+ err = blk_crypto_profile_init(blk_crypto_fallback_profile,
+ blk_crypto_num_keyslots);
+ if (err)
+ goto fail_free_profile;
err = -ENOMEM;
- profile->ll_ops = blk_crypto_fallback_ll_ops;
- profile->max_dun_bytes_supported = BLK_CRYPTO_MAX_IV_SIZE;
+ blk_crypto_fallback_profile->ll_ops = blk_crypto_fallback_ll_ops;
+ blk_crypto_fallback_profile->max_dun_bytes_supported = BLK_CRYPTO_MAX_IV_SIZE;
/* All blk-crypto modes have a crypto API fallback. */
for (i = 0; i < BLK_ENCRYPTION_MODE_MAX; i++)
- profile->modes_supported[i] = 0xFFFFFFFF;
- profile->modes_supported[BLK_ENCRYPTION_MODE_INVALID] = 0;
+ blk_crypto_fallback_profile->modes_supported[i] = 0xFFFFFFFF;
+ blk_crypto_fallback_profile->modes_supported[BLK_ENCRYPTION_MODE_INVALID] = 0;
blk_crypto_wq = alloc_workqueue("blk_crypto_wq",
WQ_UNBOUND | WQ_HIGHPRI |
@@ -597,7 +605,9 @@ static int blk_crypto_fallback_init(void)
fail_free_wq:
destroy_workqueue(blk_crypto_wq);
fail_destroy_profile:
- blk_crypto_profile_destroy(profile);
+ blk_crypto_profile_destroy(blk_crypto_fallback_profile);
+fail_free_profile:
+ kfree(blk_crypto_fallback_profile);
fail_free_bioset:
bioset_exit(&crypto_bio_split);
out:
--
2.41.0
^ permalink raw reply related [flat|nested] 227+ messages in thread
* [PATCH 6.1 158/194] mmc: wbsd: fix double mmc_free_host() in wbsd_init()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 157/194] blk-crypto: dynamically allocate fallback profile Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 159/194] mmc: block: Fix in_flight[issue_type] value error Greg Kroah-Hartman
` (46 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Ulf Hansson
From: Yang Yingliang <yangyingliang@huawei.com>
commit d83035433701919ac6db15f7737cbf554c36c1a6 upstream.
mmc_free_host() has already be called in wbsd_free_mmc(),
remove the mmc_free_host() in error path in wbsd_init().
Fixes: dc5b9b50fc9d ("mmc: wbsd: fix return value check of mmc_add_host()")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230807124443.3431366-1-yangyingliang@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/wbsd.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/mmc/host/wbsd.c
+++ b/drivers/mmc/host/wbsd.c
@@ -1705,8 +1705,6 @@ static int wbsd_init(struct device *dev,
wbsd_release_resources(host);
wbsd_free_mmc(dev);
-
- mmc_free_host(mmc);
return ret;
}
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 159/194] mmc: block: Fix in_flight[issue_type] value error
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 158/194] mmc: wbsd: fix double mmc_free_host() in wbsd_init() Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 160/194] drm/qxl: fix UAF on handle creation Greg Kroah-Hartman
` (45 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yibin Ding, Adrian Hunter,
Ulf Hansson
From: Yibin Ding <yibin.ding@unisoc.com>
commit 4b430d4ac99750ee2ae2f893f1055c7af1ec3dc5 upstream.
For a completed request, after the mmc_blk_mq_complete_rq(mq, req)
function is executed, the bitmap_tags corresponding to the
request will be cleared, that is, the request will be regarded as
idle. If the request is acquired by a different type of process at
this time, the issue_type of the request may change. It further
caused the value of mq->in_flight[issue_type] to be abnormal,
and a large number of requests could not be sent.
p1: p2:
mmc_blk_mq_complete_rq
blk_mq_free_request
blk_mq_get_request
blk_mq_rq_ctx_init
mmc_blk_mq_dec_in_flight
mmc_issue_type(mq, req)
This strategy can ensure the consistency of issue_type
before and after executing mmc_blk_mq_complete_rq.
Fixes: 81196976ed94 ("mmc: block: Add blk-mq support")
Cc: stable@vger.kernel.org
Signed-off-by: Yibin Ding <yibin.ding@unisoc.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/20230802023023.1318134-1-yunlong.xing@unisoc.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/block.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2097,14 +2097,14 @@ static void mmc_blk_mq_poll_completion(s
mmc_blk_urgent_bkops(mq, mqrq);
}
-static void mmc_blk_mq_dec_in_flight(struct mmc_queue *mq, struct request *req)
+static void mmc_blk_mq_dec_in_flight(struct mmc_queue *mq, enum mmc_issue_type issue_type)
{
unsigned long flags;
bool put_card;
spin_lock_irqsave(&mq->lock, flags);
- mq->in_flight[mmc_issue_type(mq, req)] -= 1;
+ mq->in_flight[issue_type] -= 1;
put_card = (mmc_tot_in_flight(mq) == 0);
@@ -2117,6 +2117,7 @@ static void mmc_blk_mq_dec_in_flight(str
static void mmc_blk_mq_post_req(struct mmc_queue *mq, struct request *req,
bool can_sleep)
{
+ enum mmc_issue_type issue_type = mmc_issue_type(mq, req);
struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
struct mmc_request *mrq = &mqrq->brq.mrq;
struct mmc_host *host = mq->card->host;
@@ -2136,7 +2137,7 @@ static void mmc_blk_mq_post_req(struct m
blk_mq_complete_request(req);
}
- mmc_blk_mq_dec_in_flight(mq, req);
+ mmc_blk_mq_dec_in_flight(mq, issue_type);
}
void mmc_blk_mq_recovery(struct mmc_queue *mq)
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 160/194] drm/qxl: fix UAF on handle creation
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 159/194] mmc: block: Fix in_flight[issue_type] value error Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 161/194] drm/i915/sdvo: fix panel_type initialization Greg Kroah-Hartman
` (44 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wander Lairson Costa, Dave Airlie
From: Wander Lairson Costa <wander@redhat.com>
commit c611589b4259ed63b9b77be6872b1ce07ec0ac16 upstream.
qxl_mode_dumb_create() dereferences the qobj returned by
qxl_gem_object_create_with_handle(), but the handle is the only one
holding a reference to it.
A potential attacker could guess the returned handle value and closes it
between the return of qxl_gem_object_create_with_handle() and the qobj
usage, triggering a use-after-free scenario.
Reproducer:
int dri_fd =-1;
struct drm_mode_create_dumb arg = {0};
void gem_close(int handle);
void* trigger(void* ptr)
{
int ret;
arg.width = arg.height = 0x20;
arg.bpp = 32;
ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &arg);
if(ret)
{
perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
exit(-1);
}
gem_close(arg.handle);
while(1) {
struct drm_mode_create_dumb args = {0};
args.width = args.height = 0x20;
args.bpp = 32;
ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &args);
if (ret) {
perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
exit(-1);
}
printf("[*] DRM_IOCTL_MODE_CREATE_DUMB created, %d\n", args.handle);
gem_close(args.handle);
}
return NULL;
}
void gem_close(int handle)
{
struct drm_gem_close args;
args.handle = handle;
int ret = ioctl(dri_fd, DRM_IOCTL_GEM_CLOSE, &args); // gem close handle
if (!ret)
printf("gem close handle %d\n", args.handle);
}
int main(void)
{
dri_fd= open("/dev/dri/card0", O_RDWR);
printf("fd:%d\n", dri_fd);
if(dri_fd == -1)
return -1;
pthread_t tid1;
if(pthread_create(&tid1,NULL,trigger,NULL)){
perror("[*] thread_create tid1\n");
return -1;
}
while (1)
{
gem_close(arg.handle);
}
return 0;
}
This is a KASAN report:
==================================================================
BUG: KASAN: slab-use-after-free in qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69
Write of size 1 at addr ffff88801136c240 by task poc/515
CPU: 1 PID: 515 Comm: poc Not tainted 6.3.0 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
Call Trace:
<TASK>
__dump_stack linux/lib/dump_stack.c:88
dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106
print_address_description linux/mm/kasan/report.c:319
print_report+0xd2/0x660 linux/mm/kasan/report.c:430
kasan_report+0xd2/0x110 linux/mm/kasan/report.c:536
__asan_report_store1_noabort+0x17/0x30 linux/mm/kasan/report_generic.c:383
qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120
RIP: 0033:0x7ff5004ff5f7
Code: 00 00 00 48 8b 05 99 c8 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 69 c8 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ff500408ea8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5004ff5f7
RDX: 00007ff500408ec0 RSI: 00000000c02064b2 RDI: 0000000000000003
RBP: 00007ff500408ef0 R08: 0000000000000000 R09: 000000000000002a
R10: 0000000000000000 R11: 0000000000000286 R12: 00007fff1c6cdafe
R13: 00007fff1c6cdaff R14: 00007ff500408fc0 R15: 0000000000802000
</TASK>
Allocated by task 515:
kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45
kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52
kasan_save_alloc_info+0x1e/0x40 linux/mm/kasan/generic.c:510
____kasan_kmalloc linux/mm/kasan/common.c:374
__kasan_kmalloc+0xc3/0xd0 linux/mm/kasan/common.c:383
kasan_kmalloc linux/./include/linux/kasan.h:196
kmalloc_trace+0x48/0xc0 linux/mm/slab_common.c:1066
kmalloc linux/./include/linux/slab.h:580
kzalloc linux/./include/linux/slab.h:720
qxl_bo_create+0x11a/0x610 linux/drivers/gpu/drm/qxl/qxl_object.c:124
qxl_gem_object_create+0xd9/0x360 linux/drivers/gpu/drm/qxl/qxl_gem.c:58
qxl_gem_object_create_with_handle+0xa1/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:89
qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120
Freed by task 515:
kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45
kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x60 linux/mm/kasan/generic.c:521
____kasan_slab_free linux/mm/kasan/common.c:236
____kasan_slab_free+0x180/0x1f0 linux/mm/kasan/common.c:200
__kasan_slab_free+0x12/0x30 linux/mm/kasan/common.c:244
kasan_slab_free linux/./include/linux/kasan.h:162
slab_free_hook linux/mm/slub.c:1781
slab_free_freelist_hook+0xd2/0x1a0 linux/mm/slub.c:1807
slab_free linux/mm/slub.c:3787
__kmem_cache_free+0x196/0x2d0 linux/mm/slub.c:3800
kfree+0x78/0x120 linux/mm/slab_common.c:1019
qxl_ttm_bo_destroy+0x140/0x1a0 linux/drivers/gpu/drm/qxl/qxl_object.c:49
ttm_bo_release+0x678/0xa30 linux/drivers/gpu/drm/ttm/ttm_bo.c:381
kref_put linux/./include/linux/kref.h:65
ttm_bo_put+0x50/0x80 linux/drivers/gpu/drm/ttm/ttm_bo.c:393
qxl_gem_object_free+0x3e/0x60 linux/drivers/gpu/drm/qxl/qxl_gem.c:42
drm_gem_object_free+0x5c/0x90 linux/drivers/gpu/drm/drm_gem.c:974
kref_put linux/./include/linux/kref.h:65
__drm_gem_object_put linux/./include/drm/drm_gem.h:431
drm_gem_object_put linux/./include/drm/drm_gem.h:444
qxl_gem_object_create_with_handle+0x151/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:100
qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120
The buggy address belongs to the object at ffff88801136c000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 576 bytes inside of
freed 1024-byte region [ffff88801136c000, ffff88801136c400)
The buggy address belongs to the physical page:
page:0000000089fc329b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11368
head:0000000089fc329b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0010200 ffff888007841dc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88801136c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801136c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801136c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801136c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801136c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Disabling lock debugging due to kernel taint
Instead of returning a weak reference to the qxl_bo object, return the
created drm_gem_object and let the caller decrement the reference count
when it no longer needs it. As a convenience, if the caller is not
interested in the gobj object, it can pass NULL to the parameter and the
reference counting is descremented internally.
The bug and the reproducer were originally found by the Zero Day Initiative project (ZDI-CAN-20940).
Link: https://www.zerodayinitiative.com/
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230814165119.90847-1-wander@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/qxl/qxl_drv.h | 2 +-
drivers/gpu/drm/qxl/qxl_dumb.c | 5 ++++-
drivers/gpu/drm/qxl/qxl_gem.c | 25 +++++++++++++++++--------
drivers/gpu/drm/qxl/qxl_ioctl.c | 6 ++----
4 files changed, 24 insertions(+), 14 deletions(-)
--- a/drivers/gpu/drm/qxl/qxl_drv.h
+++ b/drivers/gpu/drm/qxl/qxl_drv.h
@@ -312,7 +312,7 @@ int qxl_gem_object_create_with_handle(st
u32 domain,
size_t size,
struct qxl_surface *surf,
- struct qxl_bo **qobj,
+ struct drm_gem_object **gobj,
uint32_t *handle);
void qxl_gem_object_free(struct drm_gem_object *gobj);
int qxl_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_priv);
--- a/drivers/gpu/drm/qxl/qxl_dumb.c
+++ b/drivers/gpu/drm/qxl/qxl_dumb.c
@@ -34,6 +34,7 @@ int qxl_mode_dumb_create(struct drm_file
{
struct qxl_device *qdev = to_qxl(dev);
struct qxl_bo *qobj;
+ struct drm_gem_object *gobj;
uint32_t handle;
int r;
struct qxl_surface surf;
@@ -62,11 +63,13 @@ int qxl_mode_dumb_create(struct drm_file
r = qxl_gem_object_create_with_handle(qdev, file_priv,
QXL_GEM_DOMAIN_CPU,
- args->size, &surf, &qobj,
+ args->size, &surf, &gobj,
&handle);
if (r)
return r;
+ qobj = gem_to_qxl_bo(gobj);
qobj->is_dumb = true;
+ drm_gem_object_put(gobj);
args->pitch = pitch;
args->handle = handle;
return 0;
--- a/drivers/gpu/drm/qxl/qxl_gem.c
+++ b/drivers/gpu/drm/qxl/qxl_gem.c
@@ -72,32 +72,41 @@ int qxl_gem_object_create(struct qxl_dev
return 0;
}
+/*
+ * If the caller passed a valid gobj pointer, it is responsible to call
+ * drm_gem_object_put() when it no longer needs to acess the object.
+ *
+ * If gobj is NULL, it is handled internally.
+ */
int qxl_gem_object_create_with_handle(struct qxl_device *qdev,
struct drm_file *file_priv,
u32 domain,
size_t size,
struct qxl_surface *surf,
- struct qxl_bo **qobj,
+ struct drm_gem_object **gobj,
uint32_t *handle)
{
- struct drm_gem_object *gobj;
int r;
+ struct drm_gem_object *local_gobj;
- BUG_ON(!qobj);
BUG_ON(!handle);
r = qxl_gem_object_create(qdev, size, 0,
domain,
false, false, surf,
- &gobj);
+ &local_gobj);
if (r)
return -ENOMEM;
- r = drm_gem_handle_create(file_priv, gobj, handle);
+ r = drm_gem_handle_create(file_priv, local_gobj, handle);
if (r)
return r;
- /* drop reference from allocate - handle holds it now */
- *qobj = gem_to_qxl_bo(gobj);
- drm_gem_object_put(gobj);
+
+ if (gobj)
+ *gobj = local_gobj;
+ else
+ /* drop reference from allocate - handle holds it now */
+ drm_gem_object_put(local_gobj);
+
return 0;
}
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -38,7 +38,6 @@ int qxl_alloc_ioctl(struct drm_device *d
struct qxl_device *qdev = to_qxl(dev);
struct drm_qxl_alloc *qxl_alloc = data;
int ret;
- struct qxl_bo *qobj;
uint32_t handle;
u32 domain = QXL_GEM_DOMAIN_VRAM;
@@ -50,7 +49,7 @@ int qxl_alloc_ioctl(struct drm_device *d
domain,
qxl_alloc->size,
NULL,
- &qobj, &handle);
+ NULL, &handle);
if (ret) {
DRM_ERROR("%s: failed to create gem ret=%d\n",
__func__, ret);
@@ -386,7 +385,6 @@ int qxl_alloc_surf_ioctl(struct drm_devi
{
struct qxl_device *qdev = to_qxl(dev);
struct drm_qxl_alloc_surf *param = data;
- struct qxl_bo *qobj;
int handle;
int ret;
int size, actual_stride;
@@ -406,7 +404,7 @@ int qxl_alloc_surf_ioctl(struct drm_devi
QXL_GEM_DOMAIN_SURFACE,
size,
&surf,
- &qobj, &handle);
+ NULL, &handle);
if (ret) {
DRM_ERROR("%s: failed to create gem ret=%d\n",
__func__, ret);
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 161/194] drm/i915/sdvo: fix panel_type initialization
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 160/194] drm/qxl: fix UAF on handle creation Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 162/194] drm/amd: flush any delayed gfxoff on suspend entry Greg Kroah-Hartman
` (43 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tomi Leppänen,
Ville Syrjälä, Uma Shankar, Jani Nikula, Rodrigo Vivi
From: Jani Nikula <jani.nikula@intel.com>
commit 2002eb6d3ea954dde9f8a223018d5335779937d0 upstream.
Commit 3f9ffce5765d ("drm/i915: Do panel VBT init early if the VBT
declares an explicit panel type") started using -1 as the value for
unset panel_type. It gets initialized in intel_panel_init_alloc(), but
the SDVO code never calls it.
Call intel_panel_init_alloc() to initialize the panel, including the
panel_type.
Reported-by: Tomi Leppänen <tomi@tomin.site>
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8896
Fixes: 3f9ffce5765d ("drm/i915: Do panel VBT init early if the VBT declares an explicit panel type")
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: <stable@vger.kernel.org> # v6.1+
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Tested-by: Tomi Leppänen <tomi@tomin.site>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230803122706.838721-1-jani.nikula@intel.com
(cherry picked from commit 26e60294e8eacedc8ebb33405b2c375fd80e0900)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/intel_sdvo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/display/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/display/intel_sdvo.c
@@ -2727,7 +2727,7 @@ static struct intel_sdvo_connector *inte
__drm_atomic_helper_connector_reset(&sdvo_connector->base.base,
&conn_state->base.base);
- INIT_LIST_HEAD(&sdvo_connector->base.panel.fixed_modes);
+ intel_panel_init_alloc(&sdvo_connector->base);
return sdvo_connector;
}
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 162/194] drm/amd: flush any delayed gfxoff on suspend entry
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 161/194] drm/i915/sdvo: fix panel_type initialization Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 163/194] drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix Greg Kroah-Hartman
` (42 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Tim Huang,
Lijo Lazar, Alex Deucher
From: Mario Limonciello <mario.limonciello@amd.com>
commit a7b7d9e8aee4f71b4c7151702fd74237b8cef989 upstream.
DCN 3.1.4 is reported to hang on s2idle entry if graphics activity
is happening during entry. This is because GFXOFF was scheduled as
delayed but RLC gets disabled in s2idle entry sequence which will
hang GFX IP if not already in GFXOFF.
To help this problem, flush any delayed work for GFXOFF early in
s2idle entry sequence to ensure that it's off when RLC is changed.
commit 4b31b92b143f ("drm/amdgpu: complete gfxoff allow signal during
suspend without delay") modified power gating flow so that if called
in s0ix that it ensured that GFXOFF wasn't put in work queue but
instead processed immediately.
This is dead code due to commit 10cb67eb8a1b ("drm/amdgpu: skip
CG/PG for gfx during S0ix") because GFXOFF will now not be explicitly
called as part of the suspend entry code. Remove that dead code.
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Tim Huang <tim.huang@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 9 +--------
2 files changed, 2 insertions(+), 8 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4232,6 +4232,7 @@ int amdgpu_device_suspend(struct drm_dev
drm_fb_helper_set_suspend_unlocked(adev_to_drm(adev)->fb_helper, true);
cancel_delayed_work_sync(&adev->delayed_init_work);
+ flush_delayed_work(&adev->gfx.gfx_off_delay_work);
amdgpu_ras_suspend(adev);
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -585,15 +585,8 @@ void amdgpu_gfx_off_ctrl(struct amdgpu_d
if (adev->gfx.gfx_off_req_count == 0 &&
!adev->gfx.gfx_off_state) {
- /* If going to s2idle, no need to wait */
- if (adev->in_s0ix) {
- if (!amdgpu_dpm_set_powergating_by_smu(adev,
- AMD_IP_BLOCK_TYPE_GFX, true))
- adev->gfx.gfx_off_state = true;
- } else {
- schedule_delayed_work(&adev->gfx.gfx_off_delay_work,
+ schedule_delayed_work(&adev->gfx.gfx_off_delay_work,
delay);
- }
}
} else {
if (adev->gfx.gfx_off_req_count == 0) {
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 163/194] drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 162/194] drm/amd: flush any delayed gfxoff on suspend entry Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 164/194] drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7 Greg Kroah-Hartman
` (41 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Huang, Mario Limonciello,
Alex Deucher
From: Tim Huang <Tim.Huang@amd.com>
commit f1740b1ab2703b2a057da7cf33b03297e0381aa0 upstream.
GFX v11.0.1 reported fence fallback timer expired issue on
SDMA and GFX rings after S0ix resume. This is generated by
EOP interrupts are disabled when S0ix suspend but fails to
re-enable when resume because of the GFX is in GFXOFF.
[ 203.349571] [drm] Fence fallback timer expired on ring sdma0
[ 203.349572] [drm] Fence fallback timer expired on ring gfx_0.0.0
[ 203.861635] [drm] Fence fallback timer expired on ring gfx_0.0.0
For S0ix, GFX is in GFXOFF state, avoid to touch the GFX registers
to configure the fence driver interrupts for rings that belong to GFX.
The interrupts configuration will be restored by GFXOFF exit.
Signed-off-by: Tim Huang <Tim.Huang@amd.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 41 ++++++++++++++++++++++++++++--
1 file changed, 39 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
@@ -502,6 +502,41 @@ int amdgpu_fence_driver_sw_init(struct a
}
/**
+ * amdgpu_fence_need_ring_interrupt_restore - helper function to check whether
+ * fence driver interrupts need to be restored.
+ *
+ * @ring: ring that to be checked
+ *
+ * Interrupts for rings that belong to GFX IP don't need to be restored
+ * when the target power state is s0ix.
+ *
+ * Return true if need to restore interrupts, false otherwise.
+ */
+static bool amdgpu_fence_need_ring_interrupt_restore(struct amdgpu_ring *ring)
+{
+ struct amdgpu_device *adev = ring->adev;
+ bool is_gfx_power_domain = false;
+
+ switch (ring->funcs->type) {
+ case AMDGPU_RING_TYPE_SDMA:
+ /* SDMA 5.x+ is part of GFX power domain so it's covered by GFXOFF */
+ if (adev->ip_versions[SDMA0_HWIP][0] >= IP_VERSION(5, 0, 0))
+ is_gfx_power_domain = true;
+ break;
+ case AMDGPU_RING_TYPE_GFX:
+ case AMDGPU_RING_TYPE_COMPUTE:
+ case AMDGPU_RING_TYPE_KIQ:
+ case AMDGPU_RING_TYPE_MES:
+ is_gfx_power_domain = true;
+ break;
+ default:
+ break;
+ }
+
+ return !(adev->in_s0ix && is_gfx_power_domain);
+}
+
+/**
* amdgpu_fence_driver_hw_fini - tear down the fence driver
* for all possible rings.
*
@@ -529,7 +564,8 @@ void amdgpu_fence_driver_hw_fini(struct
amdgpu_fence_driver_force_completion(ring);
if (!drm_dev_is_unplugged(adev_to_drm(adev)) &&
- ring->fence_drv.irq_src)
+ ring->fence_drv.irq_src &&
+ amdgpu_fence_need_ring_interrupt_restore(ring))
amdgpu_irq_put(adev, ring->fence_drv.irq_src,
ring->fence_drv.irq_type);
@@ -604,7 +640,8 @@ void amdgpu_fence_driver_hw_init(struct
continue;
/* enable the interrupt */
- if (ring->fence_drv.irq_src)
+ if (ring->fence_drv.irq_src &&
+ amdgpu_fence_need_ring_interrupt_restore(ring))
amdgpu_irq_get(adev, ring->fence_drv.irq_src,
ring->fence_drv.irq_type);
}
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 164/194] drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 163/194] drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 165/194] ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG Greg Kroah-Hartman
` (40 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Evan Quan, Umio Yasuno, Alex Deucher
From: Umio Yasuno <coelacanth_dream@protonmail.com>
commit 6a92761a86817ad15c9a562e2a809386237fae3e upstream.
Use the right metrics table version based on the firmware.
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2720
Reviewed-by: Evan Quan <evan.quan@amd.com>
Signed-off-by: Umio Yasuno <coelacanth_dream@protonmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -588,7 +588,9 @@ err0_out:
return -ENOMEM;
}
-static uint32_t sienna_cichlid_get_throttler_status_locked(struct smu_context *smu)
+static uint32_t sienna_cichlid_get_throttler_status_locked(struct smu_context *smu,
+ bool use_metrics_v3,
+ bool use_metrics_v2)
{
struct smu_table_context *smu_table= &smu->smu_table;
SmuMetricsExternal_t *metrics_ext =
@@ -596,13 +598,11 @@ static uint32_t sienna_cichlid_get_throt
uint32_t throttler_status = 0;
int i;
- if ((smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 7)) &&
- (smu->smc_fw_version >= 0x3A4900)) {
+ if (use_metrics_v3) {
for (i = 0; i < THROTTLER_COUNT; i++)
throttler_status |=
(metrics_ext->SmuMetrics_V3.ThrottlingPercentage[i] ? 1U << i : 0);
- } else if ((smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 7)) &&
- (smu->smc_fw_version >= 0x3A4300)) {
+ } else if (use_metrics_v2) {
for (i = 0; i < THROTTLER_COUNT; i++)
throttler_status |=
(metrics_ext->SmuMetrics_V2.ThrottlingPercentage[i] ? 1U << i : 0);
@@ -864,7 +864,7 @@ static int sienna_cichlid_get_smu_metric
metrics->TemperatureVrSoc) * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
break;
case METRICS_THROTTLER_STATUS:
- *value = sienna_cichlid_get_throttler_status_locked(smu);
+ *value = sienna_cichlid_get_throttler_status_locked(smu, use_metrics_v3, use_metrics_v2);
break;
case METRICS_CURR_FANSPEED:
*value = use_metrics_v3 ? metrics_v3->CurrFanSpeed :
@@ -4017,7 +4017,7 @@ static ssize_t sienna_cichlid_get_gpu_me
gpu_metrics->current_dclk1 = use_metrics_v3 ? metrics_v3->CurrClock[PPCLK_DCLK_1] :
use_metrics_v2 ? metrics_v2->CurrClock[PPCLK_DCLK_1] : metrics->CurrClock[PPCLK_DCLK_1];
- gpu_metrics->throttle_status = sienna_cichlid_get_throttler_status_locked(smu);
+ gpu_metrics->throttle_status = sienna_cichlid_get_throttler_status_locked(smu, use_metrics_v3, use_metrics_v2);
gpu_metrics->indep_throttle_status =
smu_cmn_get_indep_throttler_status(gpu_metrics->throttle_status,
sienna_cichlid_throttler_map);
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 165/194] ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 164/194] drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7 Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 166/194] drm/amd/display: disable RCO for DCN314 Greg Kroah-Hartman
` (39 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Mark Brown
From: Arnd Bergmann <arnd@arndb.de>
commit 812a05256d673b2b9c5db906775d1e6625ba4787 upstream.
The vangogh driver just gained a link time dependency that now causes
randconfig builds to fail:
x86_64-linux-ld: sound/soc/amd/vangogh/pci-acp5x.o: in function `snd_acp5x_probe':
pci-acp5x.c:(.text+0xbb): undefined reference to `snd_amd_acp_find_config'
Fixes: e89f45edb747e ("ASoC: amd: vangogh: Add check for acp config flags in vangogh platform")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20230602124447.863476-1-arnd@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/amd/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/sound/soc/amd/Kconfig
+++ b/sound/soc/amd/Kconfig
@@ -81,6 +81,7 @@ config SND_SOC_AMD_VANGOGH_MACH
tristate "AMD Vangogh support for NAU8821 CS35L41"
select SND_SOC_NAU8821
select SND_SOC_CS35L41_SPI
+ select SND_AMD_ACP_CONFIG
depends on SND_SOC_AMD_ACP5x && I2C && SPI_MASTER
help
This option enables machine driver for Vangogh platform
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 166/194] drm/amd/display: disable RCO for DCN314
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 165/194] ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 167/194] zsmalloc: allow only one active pool compaction context Greg Kroah-Hartman
` (38 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicholas Kazlauskas, Hamza Mahfooz,
Daniel Miess, Alex Deucher
From: Daniel Miess <daniel.miess@amd.com>
commit 85e41f1ed5d94a26fe4e57003c399936d291ed70 upstream.
[Why]
RCO is causing error messages on some DCN314 systems
[How]
Force disable RCO for DCN314
Fixes: 17fbdbda9cc8 ("drm/amd/display: Enable dcn314 DPP RCO")
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Daniel Miess <daniel.miess@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 2 +-
drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 4 ++++
2 files changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c
@@ -296,7 +296,7 @@ static void dccg314_dpp_root_clock_contr
{
struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);
- if (dccg->dpp_clock_gated[dpp_inst] == clock_on)
+ if (dccg->dpp_clock_gated[dpp_inst] != clock_on)
return;
if (clock_on) {
--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
@@ -1933,6 +1933,10 @@ static bool dcn314_resource_construct(
dc->debug = debug_defaults_drv;
else
dc->debug = debug_defaults_diags;
+
+ /* Disable root clock optimization */
+ dc->debug.root_clock_optimization.u32All = 0;
+
// Init the vm_helper
if (dc->vm_helper)
vm_helper_init(dc->vm_helper, 16);
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 167/194] zsmalloc: allow only one active pool compaction context
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 166/194] drm/amd/display: disable RCO for DCN314 Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 168/194] sched/fair: unlink misfit task from cpu overutilized Greg Kroah-Hartman
` (37 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Senozhatsky, Yosry Ahmed,
Minchan Kim, Andrew Morton
From: Sergey Senozhatsky <senozhatsky@chromium.org>
commit d2658f2052c7db6ec0a79977205f8cf1cb9effc2 upstream.
zsmalloc pool can be compacted concurrently by many contexts,
e.g.
cc1 handle_mm_fault()
do_anonymous_page()
__alloc_pages_slowpath()
try_to_free_pages()
do_try_to_free_pages(
lru_gen_shrink_node()
shrink_slab()
do_shrink_slab()
zs_shrinker_scan()
zs_compact()
Pool compaction is currently (basically) single-threaded as
it is performed under pool->lock. Having multiple compaction
threads results in unnecessary contention, as each thread
competes for pool->lock. This, in turn, affects all zsmalloc
operations such as zs_malloc(), zs_map_object(), zs_free(), etc.
Introduce the pool->compaction_in_progress atomic variable,
which ensures that only one compaction context can run at a
time. This reduces overall pool->lock contention in (corner)
cases when many contexts attempt to shrink zspool simultaneously.
Link: https://lkml.kernel.org/r/20230418074639.1903197-1-senozhatsky@chromium.org
Fixes: c0547d0b6a4b ("zsmalloc: consolidate zs_pool's migrate_lock and size_class's locks")
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Yosry Ahmed <yosryahmed@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/zsmalloc.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -246,6 +246,7 @@ struct zs_pool {
struct work_struct free_work;
#endif
spinlock_t lock;
+ atomic_t compaction_in_progress;
};
struct zspage {
@@ -2100,6 +2101,15 @@ unsigned long zs_compact(struct zs_pool
struct size_class *class;
unsigned long pages_freed = 0;
+ /*
+ * Pool compaction is performed under pool->lock so it is basically
+ * single-threaded. Having more than one thread in __zs_compact()
+ * will increase pool->lock contention, which will impact other
+ * zsmalloc operations that need pool->lock.
+ */
+ if (atomic_xchg(&pool->compaction_in_progress, 1))
+ return 0;
+
for (i = ZS_SIZE_CLASSES - 1; i >= 0; i--) {
class = pool->size_class[i];
if (class->index != i)
@@ -2107,6 +2117,7 @@ unsigned long zs_compact(struct zs_pool
pages_freed += __zs_compact(pool, class);
}
atomic_long_add(pages_freed, &pool->stats.pages_compacted);
+ atomic_set(&pool->compaction_in_progress, 0);
return pages_freed;
}
@@ -2193,6 +2204,7 @@ struct zs_pool *zs_create_pool(const cha
init_deferred_free(pool);
spin_lock_init(&pool->lock);
+ atomic_set(&pool->compaction_in_progress, 0);
pool->name = kstrdup(name, GFP_KERNEL);
if (!pool->name)
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 168/194] sched/fair: unlink misfit task from cpu overutilized
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 167/194] zsmalloc: allow only one active pool compaction context Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 169/194] sched/fair: Remove capacity inversion detection Greg Kroah-Hartman
` (36 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Guittot,
Peter Zijlstra (Intel), Dietmar Eggemann, Kajetan Puchalski,
Qais Yousef (Google)
From: Vincent Guittot <vincent.guittot@linaro.org>
commit e5ed0550c04c5469ecdc1634d8aa18c8609590f0 upstream.
By taking into account uclamp_min, the 1:1 relation between task misfit
and cpu overutilized is no more true as a task with a small util_avg may
not fit a high capacity cpu because of uclamp_min constraint.
Add a new state in util_fits_cpu() to reflect the case that task would fit
a CPU except for the uclamp_min hint which is a performance requirement.
Use -1 to reflect that a CPU doesn't fit only because of uclamp_min so we
can use this new value to take additional action to select the best CPU
that doesn't match uclamp_min hint.
When util_fits_cpu() returns -1, we will continue to look for a possible
CPU with better performance, which replaces Capacity Inversion detection
with capacity_orig_of() - thermal_load_avg to detect a capacity inversion.
Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
Reviewed-and-tested-by: Qais Yousef <qyousef@layalina.io>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Tested-by: Kajetan Puchalski <kajetan.puchalski@arm.com>
Link: https://lore.kernel.org/r/20230201143628.270912-2-vincent.guittot@linaro.org
Signed-off-by: Qais Yousef (Google) <qyousef@layalina.io>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/fair.c | 105 ++++++++++++++++++++++++++++++++++++++++------------
1 file changed, 82 insertions(+), 23 deletions(-)
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4549,8 +4549,8 @@ static inline int util_fits_cpu(unsigned
* handle the case uclamp_min > uclamp_max.
*/
uclamp_min = min(uclamp_min, uclamp_max);
- if (util < uclamp_min && capacity_orig != SCHED_CAPACITY_SCALE)
- fits = fits && (uclamp_min <= capacity_orig_thermal);
+ if (fits && (util < uclamp_min) && (uclamp_min > capacity_orig_thermal))
+ return -1;
return fits;
}
@@ -4560,7 +4560,11 @@ static inline int task_fits_cpu(struct t
unsigned long uclamp_min = uclamp_eff_value(p, UCLAMP_MIN);
unsigned long uclamp_max = uclamp_eff_value(p, UCLAMP_MAX);
unsigned long util = task_util_est(p);
- return util_fits_cpu(util, uclamp_min, uclamp_max, cpu);
+ /*
+ * Return true only if the cpu fully fits the task requirements, which
+ * include the utilization but also the performance hints.
+ */
+ return (util_fits_cpu(util, uclamp_min, uclamp_max, cpu) > 0);
}
static inline void update_misfit_status(struct task_struct *p, struct rq *rq)
@@ -6043,6 +6047,7 @@ static inline bool cpu_overutilized(int
unsigned long rq_util_min = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MIN);
unsigned long rq_util_max = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MAX);
+ /* Return true only if the utilization doesn't fit CPU's capacity */
return !util_fits_cpu(cpu_util_cfs(cpu), rq_util_min, rq_util_max, cpu);
}
@@ -6836,6 +6841,7 @@ static int
select_idle_capacity(struct task_struct *p, struct sched_domain *sd, int target)
{
unsigned long task_util, util_min, util_max, best_cap = 0;
+ int fits, best_fits = 0;
int cpu, best_cpu = -1;
struct cpumask *cpus;
@@ -6851,12 +6857,28 @@ select_idle_capacity(struct task_struct
if (!available_idle_cpu(cpu) && !sched_idle_cpu(cpu))
continue;
- if (util_fits_cpu(task_util, util_min, util_max, cpu))
+
+ fits = util_fits_cpu(task_util, util_min, util_max, cpu);
+
+ /* This CPU fits with all requirements */
+ if (fits > 0)
return cpu;
+ /*
+ * Only the min performance hint (i.e. uclamp_min) doesn't fit.
+ * Look for the CPU with best capacity.
+ */
+ else if (fits < 0)
+ cpu_cap = capacity_orig_of(cpu) - thermal_load_avg(cpu_rq(cpu));
- if (cpu_cap > best_cap) {
+ /*
+ * First, select CPU which fits better (-1 being better than 0).
+ * Then, select the one with best capacity at same level.
+ */
+ if ((fits < best_fits) ||
+ ((fits == best_fits) && (cpu_cap > best_cap))) {
best_cap = cpu_cap;
best_cpu = cpu;
+ best_fits = fits;
}
}
@@ -6869,7 +6891,11 @@ static inline bool asym_fits_cpu(unsigne
int cpu)
{
if (sched_asym_cpucap_active())
- return util_fits_cpu(util, util_min, util_max, cpu);
+ /*
+ * Return true only if the cpu fully fits the task requirements
+ * which include the utilization and the performance hints.
+ */
+ return (util_fits_cpu(util, util_min, util_max, cpu) > 0);
return true;
}
@@ -7236,6 +7262,9 @@ static int find_energy_efficient_cpu(str
unsigned long p_util_max = uclamp_is_used() ? uclamp_eff_value(p, UCLAMP_MAX) : 1024;
struct root_domain *rd = this_rq()->rd;
int cpu, best_energy_cpu, target = -1;
+ int prev_fits = -1, best_fits = -1;
+ unsigned long best_thermal_cap = 0;
+ unsigned long prev_thermal_cap = 0;
struct sched_domain *sd;
struct perf_domain *pd;
struct energy_env eenv;
@@ -7271,6 +7300,7 @@ static int find_energy_efficient_cpu(str
unsigned long prev_spare_cap = 0;
int max_spare_cap_cpu = -1;
unsigned long base_energy;
+ int fits, max_fits = -1;
cpumask_and(cpus, perf_domain_span(pd), cpu_online_mask);
@@ -7320,7 +7350,9 @@ static int find_energy_efficient_cpu(str
util_min = max(rq_util_min, p_util_min);
util_max = max(rq_util_max, p_util_max);
}
- if (!util_fits_cpu(util, util_min, util_max, cpu))
+
+ fits = util_fits_cpu(util, util_min, util_max, cpu);
+ if (!fits)
continue;
lsub_positive(&cpu_cap, util);
@@ -7328,7 +7360,9 @@ static int find_energy_efficient_cpu(str
if (cpu == prev_cpu) {
/* Always use prev_cpu as a candidate. */
prev_spare_cap = cpu_cap;
- } else if (cpu_cap > max_spare_cap) {
+ prev_fits = fits;
+ } else if ((fits > max_fits) ||
+ ((fits == max_fits) && (cpu_cap > max_spare_cap))) {
/*
* Find the CPU with the maximum spare capacity
* among the remaining CPUs in the performance
@@ -7336,6 +7370,7 @@ static int find_energy_efficient_cpu(str
*/
max_spare_cap = cpu_cap;
max_spare_cap_cpu = cpu;
+ max_fits = fits;
}
}
@@ -7354,26 +7389,50 @@ static int find_energy_efficient_cpu(str
if (prev_delta < base_energy)
goto unlock;
prev_delta -= base_energy;
+ prev_thermal_cap = cpu_thermal_cap;
best_delta = min(best_delta, prev_delta);
}
/* Evaluate the energy impact of using max_spare_cap_cpu. */
if (max_spare_cap_cpu >= 0 && max_spare_cap > prev_spare_cap) {
+ /* Current best energy cpu fits better */
+ if (max_fits < best_fits)
+ continue;
+
+ /*
+ * Both don't fit performance hint (i.e. uclamp_min)
+ * but best energy cpu has better capacity.
+ */
+ if ((max_fits < 0) &&
+ (cpu_thermal_cap <= best_thermal_cap))
+ continue;
+
cur_delta = compute_energy(&eenv, pd, cpus, p,
max_spare_cap_cpu);
/* CPU utilization has changed */
if (cur_delta < base_energy)
goto unlock;
cur_delta -= base_energy;
- if (cur_delta < best_delta) {
- best_delta = cur_delta;
- best_energy_cpu = max_spare_cap_cpu;
- }
+
+ /*
+ * Both fit for the task but best energy cpu has lower
+ * energy impact.
+ */
+ if ((max_fits > 0) && (best_fits > 0) &&
+ (cur_delta >= best_delta))
+ continue;
+
+ best_delta = cur_delta;
+ best_energy_cpu = max_spare_cap_cpu;
+ best_fits = max_fits;
+ best_thermal_cap = cpu_thermal_cap;
}
}
rcu_read_unlock();
- if (best_delta < prev_delta)
+ if ((best_fits > prev_fits) ||
+ ((best_fits > 0) && (best_delta < prev_delta)) ||
+ ((best_fits < 0) && (best_thermal_cap > prev_thermal_cap)))
target = best_energy_cpu;
return target;
@@ -10183,24 +10242,23 @@ static struct sched_group *find_busiest_
*/
update_sd_lb_stats(env, &sds);
- if (sched_energy_enabled()) {
- struct root_domain *rd = env->dst_rq->rd;
-
- if (rcu_dereference(rd->pd) && !READ_ONCE(rd->overutilized))
- goto out_balanced;
- }
-
- local = &sds.local_stat;
- busiest = &sds.busiest_stat;
-
/* There is no busy sibling group to pull tasks from */
if (!sds.busiest)
goto out_balanced;
+ busiest = &sds.busiest_stat;
+
/* Misfit tasks should be dealt with regardless of the avg load */
if (busiest->group_type == group_misfit_task)
goto force_balance;
+ if (sched_energy_enabled()) {
+ struct root_domain *rd = env->dst_rq->rd;
+
+ if (rcu_dereference(rd->pd) && !READ_ONCE(rd->overutilized))
+ goto out_balanced;
+ }
+
/* ASYM feature bypasses nice load balance check */
if (busiest->group_type == group_asym_packing)
goto force_balance;
@@ -10213,6 +10271,7 @@ static struct sched_group *find_busiest_
if (busiest->group_type == group_imbalanced)
goto force_balance;
+ local = &sds.local_stat;
/*
* If the local group is busier than the selected busiest group
* don't try and pull any tasks.
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 169/194] sched/fair: Remove capacity inversion detection
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 168/194] sched/fair: unlink misfit task from cpu overutilized Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 170/194] drm/amd/display: Implement workaround for writing to OTG_PIXEL_RATE_DIV register Greg Kroah-Hartman
` (35 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Guittot,
Peter Zijlstra (Intel), Qais Yousef (Google)
From: Vincent Guittot <vincent.guittot@linaro.org>
commit a2e90611b9f425adbbfcdaa5b5e49958ddf6f61b upstream.
Remove the capacity inversion detection which is now handled by
util_fits_cpu() returning -1 when we need to continue to look for a
potential CPU with better performance.
This ends up almost reverting patches below except for some comments:
commit da07d2f9c153 ("sched/fair: Fixes for capacity inversion detection")
commit aa69c36f31aa ("sched/fair: Consider capacity inversion in util_fits_cpu()")
commit 44c7b80bffc3 ("sched/fair: Detect capacity inversion")
Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20230201143628.270912-3-vincent.guittot@linaro.org
Signed-off-by: Qais Yousef (Google) <qyousef@layalina.io>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/fair.c | 84 +++------------------------------------------------
kernel/sched/sched.h | 19 -----------
2 files changed, 5 insertions(+), 98 deletions(-)
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4464,17 +4464,9 @@ static inline int util_fits_cpu(unsigned
*
* For uclamp_max, we can tolerate a drop in performance level as the
* goal is to cap the task. So it's okay if it's getting less.
- *
- * In case of capacity inversion we should honour the inverted capacity
- * for both uclamp_min and uclamp_max all the time.
*/
- capacity_orig = cpu_in_capacity_inversion(cpu);
- if (capacity_orig) {
- capacity_orig_thermal = capacity_orig;
- } else {
- capacity_orig = capacity_orig_of(cpu);
- capacity_orig_thermal = capacity_orig - arch_scale_thermal_pressure(cpu);
- }
+ capacity_orig = capacity_orig_of(cpu);
+ capacity_orig_thermal = capacity_orig - arch_scale_thermal_pressure(cpu);
/*
* We want to force a task to fit a cpu as implied by uclamp_max.
@@ -8929,82 +8921,16 @@ static unsigned long scale_rt_capacity(i
static void update_cpu_capacity(struct sched_domain *sd, int cpu)
{
- unsigned long capacity_orig = arch_scale_cpu_capacity(cpu);
unsigned long capacity = scale_rt_capacity(cpu);
struct sched_group *sdg = sd->groups;
- struct rq *rq = cpu_rq(cpu);
- rq->cpu_capacity_orig = capacity_orig;
+ cpu_rq(cpu)->cpu_capacity_orig = arch_scale_cpu_capacity(cpu);
if (!capacity)
capacity = 1;
- rq->cpu_capacity = capacity;
-
- /*
- * Detect if the performance domain is in capacity inversion state.
- *
- * Capacity inversion happens when another perf domain with equal or
- * lower capacity_orig_of() ends up having higher capacity than this
- * domain after subtracting thermal pressure.
- *
- * We only take into account thermal pressure in this detection as it's
- * the only metric that actually results in *real* reduction of
- * capacity due to performance points (OPPs) being dropped/become
- * unreachable due to thermal throttling.
- *
- * We assume:
- * * That all cpus in a perf domain have the same capacity_orig
- * (same uArch).
- * * Thermal pressure will impact all cpus in this perf domain
- * equally.
- */
- if (sched_energy_enabled()) {
- unsigned long inv_cap = capacity_orig - thermal_load_avg(rq);
- struct perf_domain *pd;
-
- rcu_read_lock();
-
- pd = rcu_dereference(rq->rd->pd);
- rq->cpu_capacity_inverted = 0;
-
- for (; pd; pd = pd->next) {
- struct cpumask *pd_span = perf_domain_span(pd);
- unsigned long pd_cap_orig, pd_cap;
-
- /* We can't be inverted against our own pd */
- if (cpumask_test_cpu(cpu_of(rq), pd_span))
- continue;
-
- cpu = cpumask_any(pd_span);
- pd_cap_orig = arch_scale_cpu_capacity(cpu);
-
- if (capacity_orig < pd_cap_orig)
- continue;
-
- /*
- * handle the case of multiple perf domains have the
- * same capacity_orig but one of them is under higher
- * thermal pressure. We record it as capacity
- * inversion.
- */
- if (capacity_orig == pd_cap_orig) {
- pd_cap = pd_cap_orig - thermal_load_avg(cpu_rq(cpu));
-
- if (pd_cap > inv_cap) {
- rq->cpu_capacity_inverted = inv_cap;
- break;
- }
- } else if (pd_cap_orig > inv_cap) {
- rq->cpu_capacity_inverted = inv_cap;
- break;
- }
- }
-
- rcu_read_unlock();
- }
-
- trace_sched_cpu_capacity_tp(rq);
+ cpu_rq(cpu)->cpu_capacity = capacity;
+ trace_sched_cpu_capacity_tp(cpu_rq(cpu));
sdg->sgc->capacity = capacity;
sdg->sgc->min_capacity = capacity;
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1041,7 +1041,6 @@ struct rq {
unsigned long cpu_capacity;
unsigned long cpu_capacity_orig;
- unsigned long cpu_capacity_inverted;
struct balance_callback *balance_callback;
@@ -2879,24 +2878,6 @@ static inline unsigned long capacity_ori
return cpu_rq(cpu)->cpu_capacity_orig;
}
-/*
- * Returns inverted capacity if the CPU is in capacity inversion state.
- * 0 otherwise.
- *
- * Capacity inversion detection only considers thermal impact where actual
- * performance points (OPPs) gets dropped.
- *
- * Capacity inversion state happens when another performance domain that has
- * equal or lower capacity_orig_of() becomes effectively larger than the perf
- * domain this CPU belongs to due to thermal pressure throttling it hard.
- *
- * See comment in update_cpu_capacity().
- */
-static inline unsigned long cpu_in_capacity_inversion(int cpu)
-{
- return cpu_rq(cpu)->cpu_capacity_inverted;
-}
-
/**
* enum cpu_util_type - CPU utilization type
* @FREQUENCY_UTIL: Utilization used to select frequency
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 170/194] drm/amd/display: Implement workaround for writing to OTG_PIXEL_RATE_DIV register
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 169/194] sched/fair: Remove capacity inversion detection Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 171/194] hugetlb: do not clear hugetlb dtor until allocating vmemmap Greg Kroah-Hartman
` (34 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alvin Lee, Qingqing Zhuo,
Saaem Rizvi, Daniel Wheeler, Alex Deucher, Limonciello, Mario
From: Saaem Rizvi <SyedSaaem.Rizvi@amd.com>
commit 74fa4c81aadf418341f0d073c864ea7dca730a2e upstream.
[Why and How]
Current implementation requires FPGA builds to take a different
code path from DCN32 to write to OTG_PIXEL_RATE_DIV. Now that
we have a workaround to write to OTG_PIXEL_RATE_DIV register without
blanking display on hotplug on DCN32, we can allow the code paths for
FPGA to be exactly the same allowing for more consistent
testing.
Reviewed-by: Alvin Lee <Alvin.Lee2@amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
Signed-off-by: Saaem Rizvi <SyedSaaem.Rizvi@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <mario.limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.h | 3 +-
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c | 22 ++++++++++++++++++
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.h | 3 +-
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 2 -
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.h | 3 +-
5 files changed, 29 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.h
@@ -230,7 +230,8 @@
type DTBCLK_P2_SRC_SEL;\
type DTBCLK_P2_EN;\
type DTBCLK_P3_SRC_SEL;\
- type DTBCLK_P3_EN;
+ type DTBCLK_P3_EN;\
+ type DENTIST_DISPCLK_CHG_DONE;
struct dccg_shift {
DCCG_REG_FIELD_LIST(uint8_t)
--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c
@@ -42,6 +42,20 @@
#define DC_LOGGER \
dccg->ctx->logger
+/* This function is a workaround for writing to OTG_PIXEL_RATE_DIV
+ * without the probability of causing a DIG FIFO error.
+ */
+static void dccg32_wait_for_dentist_change_done(
+ struct dccg *dccg)
+{
+ struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);
+
+ uint32_t dentist_dispclk_value = REG_READ(DENTIST_DISPCLK_CNTL);
+
+ REG_WRITE(DENTIST_DISPCLK_CNTL, dentist_dispclk_value);
+ REG_WAIT(DENTIST_DISPCLK_CNTL, DENTIST_DISPCLK_CHG_DONE, 1, 50, 2000);
+}
+
static void dccg32_get_pixel_rate_div(
struct dccg *dccg,
uint32_t otg_inst,
@@ -110,21 +124,29 @@ static void dccg32_set_pixel_rate_div(
REG_UPDATE_2(OTG_PIXEL_RATE_DIV,
OTG0_PIXEL_RATE_DIVK1, k1,
OTG0_PIXEL_RATE_DIVK2, k2);
+
+ dccg32_wait_for_dentist_change_done(dccg);
break;
case 1:
REG_UPDATE_2(OTG_PIXEL_RATE_DIV,
OTG1_PIXEL_RATE_DIVK1, k1,
OTG1_PIXEL_RATE_DIVK2, k2);
+
+ dccg32_wait_for_dentist_change_done(dccg);
break;
case 2:
REG_UPDATE_2(OTG_PIXEL_RATE_DIV,
OTG2_PIXEL_RATE_DIVK1, k1,
OTG2_PIXEL_RATE_DIVK2, k2);
+
+ dccg32_wait_for_dentist_change_done(dccg);
break;
case 3:
REG_UPDATE_2(OTG_PIXEL_RATE_DIV,
OTG3_PIXEL_RATE_DIVK1, k1,
OTG3_PIXEL_RATE_DIVK2, k2);
+
+ dccg32_wait_for_dentist_change_done(dccg);
break;
default:
BREAK_TO_DEBUGGER();
--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.h
@@ -147,7 +147,8 @@
DCCG_SF(DTBCLK_P_CNTL, DTBCLK_P3_SRC_SEL, mask_sh),\
DCCG_SF(DTBCLK_P_CNTL, DTBCLK_P3_EN, mask_sh),\
DCCG_SF(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO_SEL, mask_sh),\
- DCCG_SF(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL, mask_sh)
+ DCCG_SF(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL, mask_sh),\
+ DCCG_SF(DENTIST_DISPCLK_CNTL, DENTIST_DISPCLK_CHG_DONE, mask_sh)
struct dccg *dccg32_create(
--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
@@ -1177,7 +1177,7 @@ unsigned int dcn32_calculate_dccg_k1_k2_
*k2_div = PIXEL_RATE_DIV_BY_2;
else
*k2_div = PIXEL_RATE_DIV_BY_4;
- } else if (dc_is_dp_signal(stream->signal)) {
+ } else if (dc_is_dp_signal(stream->signal) || dc_is_virtual_signal(stream->signal)) {
if (two_pix_per_container) {
*k1_div = PIXEL_RATE_DIV_BY_1;
*k2_div = PIXEL_RATE_DIV_BY_2;
--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.h
@@ -1272,7 +1272,8 @@ unsigned int dcn32_calc_num_avail_chans_
DCCG_SRII(PHASE, DTBCLK_DTO, 0), DCCG_SRII(PHASE, DTBCLK_DTO, 1), \
DCCG_SRII(PHASE, DTBCLK_DTO, 2), DCCG_SRII(PHASE, DTBCLK_DTO, 3), \
SR(DCCG_AUDIO_DTBCLK_DTO_MODULO), SR(DCCG_AUDIO_DTBCLK_DTO_PHASE), \
- SR(OTG_PIXEL_RATE_DIV), SR(DTBCLK_P_CNTL), SR(DCCG_AUDIO_DTO_SOURCE) \
+ SR(OTG_PIXEL_RATE_DIV), SR(DTBCLK_P_CNTL), \
+ SR(DCCG_AUDIO_DTO_SOURCE), SR(DENTIST_DISPCLK_CNTL) \
)
/* VMID */
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 171/194] hugetlb: do not clear hugetlb dtor until allocating vmemmap
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 170/194] drm/amd/display: Implement workaround for writing to OTG_PIXEL_RATE_DIV register Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 172/194] netfilter: set default timeout to 3 secs for sctp shutdown send and recv state Greg Kroah-Hartman
` (33 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Kravetz, Muchun Song,
Naoya Horiguchi, Axel Rasmussen, James Houghton, Jiaqi Yan,
Miaohe Lin, Michal Hocko, Andrew Morton
From: Mike Kravetz <mike.kravetz@oracle.com>
commit 32c877191e022b55fe3a374f3d7e9fb5741c514d upstream.
Patch series "Fix hugetlb free path race with memory errors".
In the discussion of Jiaqi Yan's series "Improve hugetlbfs read on
HWPOISON hugepages" the race window was discovered.
https://lore.kernel.org/linux-mm/20230616233447.GB7371@monkey/
Freeing a hugetlb page back to low level memory allocators is performed
in two steps.
1) Under hugetlb lock, remove page from hugetlb lists and clear destructor
2) Outside lock, allocate vmemmap if necessary and call low level free
Between these two steps, the hugetlb page will appear as a normal
compound page. However, vmemmap for tail pages could be missing.
If a memory error occurs at this time, we could try to update page
flags non-existant page structs.
A much more detailed description is in the first patch.
The first patch addresses the race window. However, it adds a
hugetlb_lock lock/unlock cycle to every vmemmap optimized hugetlb page
free operation. This could lead to slowdowns if one is freeing a large
number of hugetlb pages.
The second path optimizes the update_and_free_pages_bulk routine to only
take the lock once in bulk operations.
The second patch is technically not a bug fix, but includes a Fixes tag
and Cc stable to avoid a performance regression. It can be combined with
the first, but was done separately make reviewing easier.
This patch (of 2):
Freeing a hugetlb page and releasing base pages back to the underlying
allocator such as buddy or cma is performed in two steps:
- remove_hugetlb_folio() is called to remove the folio from hugetlb
lists, get a ref on the page and remove hugetlb destructor. This
all must be done under the hugetlb lock. After this call, the page
can be treated as a normal compound page or a collection of base
size pages.
- update_and_free_hugetlb_folio() is called to allocate vmemmap if
needed and the free routine of the underlying allocator is called
on the resulting page. We can not hold the hugetlb lock here.
One issue with this scheme is that a memory error could occur between
these two steps. In this case, the memory error handling code treats
the old hugetlb page as a normal compound page or collection of base
pages. It will then try to SetPageHWPoison(page) on the page with an
error. If the page with error is a tail page without vmemmap, a write
error will occur when trying to set the flag.
Address this issue by modifying remove_hugetlb_folio() and
update_and_free_hugetlb_folio() such that the hugetlb destructor is not
cleared until after allocating vmemmap. Since clearing the destructor
requires holding the hugetlb lock, the clearing is done in
remove_hugetlb_folio() if the vmemmap is present. This saves a
lock/unlock cycle. Otherwise, destructor is cleared in
update_and_free_hugetlb_folio() after allocating vmemmap.
Note that this will leave hugetlb pages in a state where they are marked
free (by hugetlb specific page flag) and have a ref count. This is not
a normal state. The only code that would notice is the memory error
code, and it is set up to retry in such a case.
A subsequent patch will create a routine to do bulk processing of
vmemmap allocation. This will eliminate a lock/unlock cycle for each
hugetlb page in the case where we are freeing a large number of pages.
Link: https://lkml.kernel.org/r/20230711220942.43706-1-mike.kravetz@oracle.com
Link: https://lkml.kernel.org/r/20230711220942.43706-2-mike.kravetz@oracle.com
Fixes: ad2fa3717b74 ("mm: hugetlb: alloc the vmemmap pages associated with each HugeTLB page")
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Muchun Song <songmuchun@bytedance.com>
Tested-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: James Houghton <jthoughton@google.com>
Cc: Jiaqi Yan <jiaqiyan@google.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 75 ++++++++++++++++++++++++++++++++++++++++-------------------
1 file changed, 51 insertions(+), 24 deletions(-)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1581,9 +1581,37 @@ static inline void destroy_compound_giga
unsigned int order) { }
#endif
+static inline void __clear_hugetlb_destructor(struct hstate *h,
+ struct page *page)
+{
+ lockdep_assert_held(&hugetlb_lock);
+
+ /*
+ * Very subtle
+ *
+ * For non-gigantic pages set the destructor to the normal compound
+ * page dtor. This is needed in case someone takes an additional
+ * temporary ref to the page, and freeing is delayed until they drop
+ * their reference.
+ *
+ * For gigantic pages set the destructor to the null dtor. This
+ * destructor will never be called. Before freeing the gigantic
+ * page destroy_compound_gigantic_folio will turn the folio into a
+ * simple group of pages. After this the destructor does not
+ * apply.
+ *
+ */
+ if (hstate_is_gigantic(h))
+ set_compound_page_dtor(page, NULL_COMPOUND_DTOR);
+ else
+ set_compound_page_dtor(page, COMPOUND_PAGE_DTOR);
+}
+
/*
- * Remove hugetlb page from lists, and update dtor so that page appears
- * as just a compound page.
+ * Remove hugetlb page from lists.
+ * If vmemmap exists for the page, update dtor so that the page appears
+ * as just a compound page. Otherwise, wait until after allocating vmemmap
+ * to update dtor.
*
* A reference is held on the page, except in the case of demote.
*
@@ -1614,31 +1642,19 @@ static void __remove_hugetlb_page(struct
}
/*
- * Very subtle
- *
- * For non-gigantic pages set the destructor to the normal compound
- * page dtor. This is needed in case someone takes an additional
- * temporary ref to the page, and freeing is delayed until they drop
- * their reference.
- *
- * For gigantic pages set the destructor to the null dtor. This
- * destructor will never be called. Before freeing the gigantic
- * page destroy_compound_gigantic_page will turn the compound page
- * into a simple group of pages. After this the destructor does not
- * apply.
- *
- * This handles the case where more than one ref is held when and
- * after update_and_free_page is called.
- *
- * In the case of demote we do not ref count the page as it will soon
- * be turned into a page of smaller size.
+ * We can only clear the hugetlb destructor after allocating vmemmap
+ * pages. Otherwise, someone (memory error handling) may try to write
+ * to tail struct pages.
+ */
+ if (!HPageVmemmapOptimized(page))
+ __clear_hugetlb_destructor(h, page);
+
+ /*
+ * In the case of demote we do not ref count the page as it will soon
+ * be turned into a page of smaller size.
*/
if (!demote)
set_page_refcounted(page);
- if (hstate_is_gigantic(h))
- set_compound_page_dtor(page, NULL_COMPOUND_DTOR);
- else
- set_compound_page_dtor(page, COMPOUND_PAGE_DTOR);
h->nr_huge_pages--;
h->nr_huge_pages_node[nid]--;
@@ -1706,6 +1722,7 @@ static void __update_and_free_page(struc
{
int i;
struct page *subpage;
+ bool clear_dtor = HPageVmemmapOptimized(page);
if (hstate_is_gigantic(h) && !gigantic_page_runtime_supported())
return;
@@ -1736,6 +1753,16 @@ static void __update_and_free_page(struc
if (unlikely(PageHWPoison(page)))
hugetlb_clear_page_hwpoison(page);
+ /*
+ * If vmemmap pages were allocated above, then we need to clear the
+ * hugetlb destructor under the hugetlb lock.
+ */
+ if (clear_dtor) {
+ spin_lock_irq(&hugetlb_lock);
+ __clear_hugetlb_destructor(h, page);
+ spin_unlock_irq(&hugetlb_lock);
+ }
+
for (i = 0; i < pages_per_huge_page(h); i++) {
subpage = nth_page(page, i);
subpage->flags &= ~(1 << PG_locked | 1 << PG_error |
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 172/194] netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 171/194] hugetlb: do not clear hugetlb dtor until allocating vmemmap Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 173/194] x86/cpu: Fix __x86_return_thunk symbol type Greg Kroah-Hartman
` (32 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Valerio, Xin Long,
Simon Horman, Florian Westphal
From: Xin Long <lucien.xin@gmail.com>
commit 9bfab6d23a2865966a4f89a96536fbf23f83bc8c upstream.
In SCTP protocol, it is using the same timer (T2 timer) for SHUTDOWN and
SHUTDOWN_ACK retransmission. However in sctp conntrack the default timeout
value for SCTP_CONNTRACK_SHUTDOWN_ACK_SENT state is 3 secs while it's 300
msecs for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV state.
As Paolo Valerio noticed, this might cause unwanted expiration of the ct
entry. In my test, with 1s tc netem delay set on the NAT path, after the
SHUTDOWN is sent, the sctp ct entry enters SCTP_CONNTRACK_SHUTDOWN_SEND
state. However, due to 300ms (too short) delay, when the SHUTDOWN_ACK is
sent back from the peer, the sctp ct entry has expired and been deleted,
and then the SHUTDOWN_ACK has to be dropped.
Also, it is confusing these two sysctl options always show 0 due to all
timeout values using sec as unit:
net.netfilter.nf_conntrack_sctp_timeout_shutdown_recd = 0
net.netfilter.nf_conntrack_sctp_timeout_shutdown_sent = 0
This patch fixes it by also using 3 secs for sctp shutdown send and recv
state in sctp conntrack, which is also RTO.initial value in SCTP protocol.
Note that the very short time value for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV
was probably used for a rare scenario where SHUTDOWN is sent on 1st path
but SHUTDOWN_ACK is replied on 2nd path, then a new connection started
immediately on 1st path. So this patch also moves from SHUTDOWN_SEND/RECV
to CLOSE when receiving INIT in the ORIGINAL direction.
Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
Reported-by: Paolo Valerio <pvalerio@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_proto_sctp.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -49,8 +49,8 @@ static const unsigned int sctp_timeouts[
[SCTP_CONNTRACK_COOKIE_WAIT] = 3 SECS,
[SCTP_CONNTRACK_COOKIE_ECHOED] = 3 SECS,
[SCTP_CONNTRACK_ESTABLISHED] = 210 SECS,
- [SCTP_CONNTRACK_SHUTDOWN_SENT] = 300 SECS / 1000,
- [SCTP_CONNTRACK_SHUTDOWN_RECD] = 300 SECS / 1000,
+ [SCTP_CONNTRACK_SHUTDOWN_SENT] = 3 SECS,
+ [SCTP_CONNTRACK_SHUTDOWN_RECD] = 3 SECS,
[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = 3 SECS,
[SCTP_CONNTRACK_HEARTBEAT_SENT] = 30 SECS,
};
@@ -105,7 +105,7 @@ static const u8 sctp_conntracks[2][11][S
{
/* ORIGINAL */
/* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS */
-/* init */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCW},
+/* init */ {sCL, sCL, sCW, sCE, sES, sCL, sCL, sSA, sCW},
/* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL},
/* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
/* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL},
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 173/194] x86/cpu: Fix __x86_return_thunk symbol type
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 172/194] netfilter: set default timeout to 3 secs for sctp shutdown send and recv state Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 174/194] x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() Greg Kroah-Hartman
` (31 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Borislav Petkov (AMD)
From: Peter Zijlstra <peterz@infradead.org>
commit 77f67119004296a9b2503b377d610e08b08afc2a upstream.
Commit
fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
reimplemented __x86_return_thunk with a mix of SYM_FUNC_START and
SYM_CODE_END, this is not a sane combination.
Since nothing should ever actually 'CALL' this, make it consistently
CODE.
Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230814121148.571027074@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/lib/retpoline.S | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -207,7 +207,9 @@ SYM_CODE_END(srso_safe_ret)
SYM_FUNC_END(srso_untrain_ret)
__EXPORT_THUNK(srso_untrain_ret)
-SYM_FUNC_START(__x86_return_thunk)
+SYM_CODE_START(__x86_return_thunk)
+ UNWIND_HINT_FUNC
+ ANNOTATE_NOENDBR
ALTERNATIVE_2 "jmp __ret", "call srso_safe_ret", X86_FEATURE_SRSO, \
"call srso_safe_ret_alias", X86_FEATURE_SRSO_ALIAS
int3
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 174/194] x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 173/194] x86/cpu: Fix __x86_return_thunk symbol type Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 175/194] x86/alternative: Make custom return thunk unconditional Greg Kroah-Hartman
` (30 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Borislav Petkov (AMD)
From: Peter Zijlstra <peterz@infradead.org>
commit af023ef335f13c8b579298fc432daeef609a9e60 upstream.
vmlinux.o: warning: objtool: srso_untrain_ret() falls through to next function __x86_return_skl()
vmlinux.o: warning: objtool: __x86_return_thunk() falls through to next function __x86_return_skl()
This is because these functions (can) end with CALL, which objtool
does not consider a terminating instruction. Therefore, replace the
INT3 instruction (which is a non-fatal trap) with UD2 (which is a
fatal-trap).
This indicates execution will not continue past this point.
Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230814121148.637802730@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/lib/retpoline.S | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -202,7 +202,7 @@ SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLO
int3
lfence
call srso_safe_ret
- int3
+ ud2
SYM_CODE_END(srso_safe_ret)
SYM_FUNC_END(srso_untrain_ret)
__EXPORT_THUNK(srso_untrain_ret)
@@ -212,7 +212,7 @@ SYM_CODE_START(__x86_return_thunk)
ANNOTATE_NOENDBR
ALTERNATIVE_2 "jmp __ret", "call srso_safe_ret", X86_FEATURE_SRSO, \
"call srso_safe_ret_alias", X86_FEATURE_SRSO_ALIAS
- int3
+ ud2
SYM_CODE_END(__x86_return_thunk)
EXPORT_SYMBOL(__x86_return_thunk)
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 175/194] x86/alternative: Make custom return thunk unconditional
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 174/194] x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 176/194] x86/cpu: Clean up SRSO return thunk mess Greg Kroah-Hartman
` (29 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Borislav Petkov (AMD)
From: Peter Zijlstra <peterz@infradead.org>
commit 095b8303f3835c68ac4a8b6d754ca1c3b6230711 upstream.
There is infrastructure to rewrite return thunks to point to any
random thunk one desires, unwrap that from CALL_THUNKS, which up to
now was the sole user of that.
[ bp: Make the thunks visible on 32-bit and add ifdeffery for the
32-bit builds. ]
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230814121148.775293785@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/nospec-branch.h | 5 +++++
arch/x86/kernel/cpu/bugs.c | 2 ++
2 files changed, 7 insertions(+)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -210,7 +210,12 @@
typedef u8 retpoline_thunk_t[RETPOLINE_THUNK_SIZE];
extern retpoline_thunk_t __x86_indirect_thunk_array[];
+#ifdef CONFIG_RETHUNK
extern void __x86_return_thunk(void);
+#else
+static inline void __x86_return_thunk(void) {}
+#endif
+
extern void zen_untrain_ret(void);
extern void srso_untrain_ret(void);
extern void srso_untrain_ret_alias(void);
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -62,6 +62,8 @@ EXPORT_SYMBOL_GPL(x86_pred_cmd);
static DEFINE_MUTEX(spec_ctrl_mutex);
+void (*x86_return_thunk)(void) __ro_after_init = &__x86_return_thunk;
+
/* Update SPEC_CTRL MSR and its cached copy unconditionally */
static void update_spec_ctrl(u64 val)
{
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 176/194] x86/cpu: Clean up SRSO return thunk mess
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 175/194] x86/alternative: Make custom return thunk unconditional Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 177/194] x86/cpu: Rename original retbleed methods Greg Kroah-Hartman
` (28 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Borislav Petkov (AMD)
From: Peter Zijlstra <peterz@infradead.org>
commit d43490d0ab824023e11d0b57d0aeec17a6e0ca13 upstream.
Use the existing configurable return thunk. There is absolute no
justification for having created this __x86_return_thunk alternative.
To clarify, the whole thing looks like:
Zen3/4 does:
srso_alias_untrain_ret:
nop2
lfence
jmp srso_alias_return_thunk
int3
srso_alias_safe_ret: // aliasses srso_alias_untrain_ret just so
add $8, %rsp
ret
int3
srso_alias_return_thunk:
call srso_alias_safe_ret
ud2
While Zen1/2 does:
srso_untrain_ret:
movabs $foo, %rax
lfence
call srso_safe_ret (jmp srso_return_thunk ?)
int3
srso_safe_ret: // embedded in movabs instruction
add $8,%rsp
ret
int3
srso_return_thunk:
call srso_safe_ret
ud2
While retbleed does:
zen_untrain_ret:
test $0xcc, %bl
lfence
jmp zen_return_thunk
int3
zen_return_thunk: // embedded in the test instruction
ret
int3
Where Zen1/2 flush the BTB entry using the instruction decoder trick
(test,movabs) Zen3/4 use BTB aliasing. SRSO adds a return sequence
(srso_safe_ret()) which forces the function return instruction to
speculate into a trap (UD2). This RET will then mispredict and
execution will continue at the return site read from the top of the
stack.
Pick one of three options at boot (evey function can only ever return
once).
[ bp: Fixup commit message uarch details and add them in a comment in
the code too. Add a comment about the srso_select_mitigation()
dependency on retbleed_select_mitigation(). Add moar ifdeffery for
32-bit builds. Add a dummy srso_untrain_ret_alias() definition for
32-bit alternatives needing the symbol. ]
Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230814121148.842775684@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/nospec-branch.h | 5 +++
arch/x86/kernel/cpu/bugs.c | 17 ++++++++--
arch/x86/kernel/vmlinux.lds.S | 4 +-
arch/x86/lib/retpoline.S | 58 +++++++++++++++++++++++++----------
tools/objtool/arch/x86/decode.c | 2 -
5 files changed, 64 insertions(+), 22 deletions(-)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -216,9 +216,14 @@ extern void __x86_return_thunk(void);
static inline void __x86_return_thunk(void) {}
#endif
+extern void zen_return_thunk(void);
+extern void srso_return_thunk(void);
+extern void srso_alias_return_thunk(void);
+
extern void zen_untrain_ret(void);
extern void srso_untrain_ret(void);
extern void srso_untrain_ret_alias(void);
+
extern void entry_ibpb(void);
#ifdef CONFIG_RETPOLINE
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -166,8 +166,13 @@ void __init cpu_select_mitigations(void)
md_clear_select_mitigation();
srbds_select_mitigation();
l1d_flush_select_mitigation();
- gds_select_mitigation();
+
+ /*
+ * srso_select_mitigation() depends and must run after
+ * retbleed_select_mitigation().
+ */
srso_select_mitigation();
+ gds_select_mitigation();
}
/*
@@ -1015,6 +1020,9 @@ do_cmd_auto:
setup_force_cpu_cap(X86_FEATURE_RETHUNK);
setup_force_cpu_cap(X86_FEATURE_UNRET);
+ if (IS_ENABLED(CONFIG_RETHUNK))
+ x86_return_thunk = zen_return_thunk;
+
if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD &&
boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)
pr_err(RETBLEED_UNTRAIN_MSG);
@@ -2422,10 +2430,13 @@ static void __init srso_select_mitigatio
*/
setup_force_cpu_cap(X86_FEATURE_RETHUNK);
- if (boot_cpu_data.x86 == 0x19)
+ if (boot_cpu_data.x86 == 0x19) {
setup_force_cpu_cap(X86_FEATURE_SRSO_ALIAS);
- else
+ x86_return_thunk = srso_alias_return_thunk;
+ } else {
setup_force_cpu_cap(X86_FEATURE_SRSO);
+ x86_return_thunk = srso_return_thunk;
+ }
srso_mitigation = SRSO_MITIGATION_SAFE_RET;
} else {
pr_err("WARNING: kernel not compiled with CPU_SRSO.\n");
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -507,8 +507,8 @@ INIT_PER_CPU(irq_stack_backing_store);
"fixed_percpu_data is not at start of per-cpu area");
#endif
- #ifdef CONFIG_RETHUNK
-. = ASSERT((__ret & 0x3f) == 0, "__ret not cacheline-aligned");
+#ifdef CONFIG_RETHUNK
+. = ASSERT((zen_return_thunk & 0x3f) == 0, "zen_return_thunk not cacheline-aligned");
. = ASSERT((srso_safe_ret & 0x3f) == 0, "srso_safe_ret not cacheline-aligned");
#endif
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -94,22 +94,27 @@ SYM_CODE_END(__x86_indirect_thunk_array)
.section .text.__x86.rethunk_untrain
SYM_START(srso_untrain_ret_alias, SYM_L_GLOBAL, SYM_A_NONE)
+ UNWIND_HINT_FUNC
ANNOTATE_NOENDBR
ASM_NOP2
lfence
- jmp __x86_return_thunk
+ jmp srso_alias_return_thunk
SYM_FUNC_END(srso_untrain_ret_alias)
__EXPORT_THUNK(srso_untrain_ret_alias)
.section .text.__x86.rethunk_safe
+#else
+/* dummy definition for alternatives */
+SYM_START(srso_untrain_ret_alias, SYM_L_GLOBAL, SYM_A_NONE)
+ ANNOTATE_UNRET_SAFE
+ ret
+ int3
+SYM_FUNC_END(srso_untrain_ret_alias)
#endif
-/* Needs a definition for the __x86_return_thunk alternative below. */
SYM_START(srso_safe_ret_alias, SYM_L_GLOBAL, SYM_A_NONE)
-#ifdef CONFIG_CPU_SRSO
add $8, %_ASM_SP
UNWIND_HINT_FUNC
-#endif
ANNOTATE_UNRET_SAFE
ret
int3
@@ -117,9 +122,16 @@ SYM_FUNC_END(srso_safe_ret_alias)
.section .text.__x86.return_thunk
+SYM_CODE_START(srso_alias_return_thunk)
+ UNWIND_HINT_FUNC
+ ANNOTATE_NOENDBR
+ call srso_safe_ret_alias
+ ud2
+SYM_CODE_END(srso_alias_return_thunk)
+
/*
* Safety details here pertain to the AMD Zen{1,2} microarchitecture:
- * 1) The RET at __x86_return_thunk must be on a 64 byte boundary, for
+ * 1) The RET at zen_return_thunk must be on a 64 byte boundary, for
* alignment within the BTB.
* 2) The instruction at zen_untrain_ret must contain, and not
* end with, the 0xc3 byte of the RET.
@@ -127,7 +139,7 @@ SYM_FUNC_END(srso_safe_ret_alias)
* from re-poisioning the BTB prediction.
*/
.align 64
- .skip 64 - (__ret - zen_untrain_ret), 0xcc
+ .skip 64 - (zen_return_thunk - zen_untrain_ret), 0xcc
SYM_START(zen_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
ANNOTATE_NOENDBR
/*
@@ -135,16 +147,16 @@ SYM_START(zen_untrain_ret, SYM_L_GLOBAL,
*
* TEST $0xcc, %bl
* LFENCE
- * JMP __x86_return_thunk
+ * JMP zen_return_thunk
*
* Executing the TEST instruction has a side effect of evicting any BTB
* prediction (potentially attacker controlled) attached to the RET, as
- * __x86_return_thunk + 1 isn't an instruction boundary at the moment.
+ * zen_return_thunk + 1 isn't an instruction boundary at the moment.
*/
.byte 0xf6
/*
- * As executed from __x86_return_thunk, this is a plain RET.
+ * As executed from zen_return_thunk, this is a plain RET.
*
* As part of the TEST above, RET is the ModRM byte, and INT3 the imm8.
*
@@ -156,13 +168,13 @@ SYM_START(zen_untrain_ret, SYM_L_GLOBAL,
* With SMT enabled and STIBP active, a sibling thread cannot poison
* RET's prediction to a type of its choice, but can evict the
* prediction due to competitive sharing. If the prediction is
- * evicted, __x86_return_thunk will suffer Straight Line Speculation
+ * evicted, zen_return_thunk will suffer Straight Line Speculation
* which will be contained safely by the INT3.
*/
-SYM_INNER_LABEL(__ret, SYM_L_GLOBAL)
+SYM_INNER_LABEL(zen_return_thunk, SYM_L_GLOBAL)
ret
int3
-SYM_CODE_END(__ret)
+SYM_CODE_END(zen_return_thunk)
/*
* Ensure the TEST decoding / BTB invalidation is complete.
@@ -173,7 +185,7 @@ SYM_CODE_END(__ret)
* Jump back and execute the RET in the middle of the TEST instruction.
* INT3 is for SLS protection.
*/
- jmp __ret
+ jmp zen_return_thunk
int3
SYM_FUNC_END(zen_untrain_ret)
__EXPORT_THUNK(zen_untrain_ret)
@@ -194,12 +206,19 @@ SYM_START(srso_untrain_ret, SYM_L_GLOBAL
ANNOTATE_NOENDBR
.byte 0x48, 0xb8
+/*
+ * This forces the function return instruction to speculate into a trap
+ * (UD2 in srso_return_thunk() below). This RET will then mispredict
+ * and execution will continue at the return site read from the top of
+ * the stack.
+ */
SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLOBAL)
add $8, %_ASM_SP
ret
int3
int3
int3
+ /* end of movabs */
lfence
call srso_safe_ret
ud2
@@ -207,12 +226,19 @@ SYM_CODE_END(srso_safe_ret)
SYM_FUNC_END(srso_untrain_ret)
__EXPORT_THUNK(srso_untrain_ret)
-SYM_CODE_START(__x86_return_thunk)
+SYM_CODE_START(srso_return_thunk)
UNWIND_HINT_FUNC
ANNOTATE_NOENDBR
- ALTERNATIVE_2 "jmp __ret", "call srso_safe_ret", X86_FEATURE_SRSO, \
- "call srso_safe_ret_alias", X86_FEATURE_SRSO_ALIAS
+ call srso_safe_ret
ud2
+SYM_CODE_END(srso_return_thunk)
+
+SYM_CODE_START(__x86_return_thunk)
+ UNWIND_HINT_FUNC
+ ANNOTATE_NOENDBR
+ ANNOTATE_UNRET_SAFE
+ ret
+ int3
SYM_CODE_END(__x86_return_thunk)
EXPORT_SYMBOL(__x86_return_thunk)
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -799,5 +799,5 @@ bool arch_is_rethunk(struct symbol *sym)
return !strcmp(sym->name, "__x86_return_thunk") ||
!strcmp(sym->name, "srso_untrain_ret") ||
!strcmp(sym->name, "srso_safe_ret") ||
- !strcmp(sym->name, "__ret");
+ !strcmp(sym->name, "zen_return_thunk");
}
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 177/194] x86/cpu: Rename original retbleed methods
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 176/194] x86/cpu: Clean up SRSO return thunk mess Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 178/194] x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 Greg Kroah-Hartman
` (27 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josh Poimboeuf,
Peter Zijlstra (Intel), Borislav Petkov (AMD)
From: Peter Zijlstra <peterz@infradead.org>
commit d025b7bac07a6e90b6b98b487f88854ad9247c39 upstream.
Rename the original retbleed return thunk and untrain_ret to
retbleed_return_thunk() and retbleed_untrain_ret().
No functional changes.
Suggested-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230814121148.909378169@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/nospec-branch.h | 8 ++++----
arch/x86/kernel/cpu/bugs.c | 2 +-
arch/x86/kernel/vmlinux.lds.S | 2 +-
arch/x86/lib/retpoline.S | 30 +++++++++++++++---------------
tools/objtool/arch/x86/decode.c | 2 +-
tools/objtool/check.c | 2 +-
6 files changed, 23 insertions(+), 23 deletions(-)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -168,7 +168,7 @@
.endm
#ifdef CONFIG_CPU_UNRET_ENTRY
-#define CALL_ZEN_UNTRAIN_RET "call zen_untrain_ret"
+#define CALL_ZEN_UNTRAIN_RET "call retbleed_untrain_ret"
#else
#define CALL_ZEN_UNTRAIN_RET ""
#endif
@@ -178,7 +178,7 @@
* return thunk isn't mapped into the userspace tables (then again, AMD
* typically has NO_MELTDOWN).
*
- * While zen_untrain_ret() doesn't clobber anything but requires stack,
+ * While retbleed_untrain_ret() doesn't clobber anything but requires stack,
* entry_ibpb() will clobber AX, CX, DX.
*
* As such, this must be placed after every *SWITCH_TO_KERNEL_CR3 at a point
@@ -216,11 +216,11 @@ extern void __x86_return_thunk(void);
static inline void __x86_return_thunk(void) {}
#endif
-extern void zen_return_thunk(void);
+extern void retbleed_return_thunk(void);
extern void srso_return_thunk(void);
extern void srso_alias_return_thunk(void);
-extern void zen_untrain_ret(void);
+extern void retbleed_untrain_ret(void);
extern void srso_untrain_ret(void);
extern void srso_untrain_ret_alias(void);
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1021,7 +1021,7 @@ do_cmd_auto:
setup_force_cpu_cap(X86_FEATURE_UNRET);
if (IS_ENABLED(CONFIG_RETHUNK))
- x86_return_thunk = zen_return_thunk;
+ x86_return_thunk = retbleed_return_thunk;
if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD &&
boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -508,7 +508,7 @@ INIT_PER_CPU(irq_stack_backing_store);
#endif
#ifdef CONFIG_RETHUNK
-. = ASSERT((zen_return_thunk & 0x3f) == 0, "zen_return_thunk not cacheline-aligned");
+. = ASSERT((retbleed_return_thunk & 0x3f) == 0, "retbleed_return_thunk not cacheline-aligned");
. = ASSERT((srso_safe_ret & 0x3f) == 0, "srso_safe_ret not cacheline-aligned");
#endif
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -131,32 +131,32 @@ SYM_CODE_END(srso_alias_return_thunk)
/*
* Safety details here pertain to the AMD Zen{1,2} microarchitecture:
- * 1) The RET at zen_return_thunk must be on a 64 byte boundary, for
+ * 1) The RET at retbleed_return_thunk must be on a 64 byte boundary, for
* alignment within the BTB.
- * 2) The instruction at zen_untrain_ret must contain, and not
+ * 2) The instruction at retbleed_untrain_ret must contain, and not
* end with, the 0xc3 byte of the RET.
* 3) STIBP must be enabled, or SMT disabled, to prevent the sibling thread
* from re-poisioning the BTB prediction.
*/
.align 64
- .skip 64 - (zen_return_thunk - zen_untrain_ret), 0xcc
-SYM_START(zen_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
+ .skip 64 - (retbleed_return_thunk - retbleed_untrain_ret), 0xcc
+SYM_START(retbleed_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
ANNOTATE_NOENDBR
/*
- * As executed from zen_untrain_ret, this is:
+ * As executed from retbleed_untrain_ret, this is:
*
* TEST $0xcc, %bl
* LFENCE
- * JMP zen_return_thunk
+ * JMP retbleed_return_thunk
*
* Executing the TEST instruction has a side effect of evicting any BTB
* prediction (potentially attacker controlled) attached to the RET, as
- * zen_return_thunk + 1 isn't an instruction boundary at the moment.
+ * retbleed_return_thunk + 1 isn't an instruction boundary at the moment.
*/
.byte 0xf6
/*
- * As executed from zen_return_thunk, this is a plain RET.
+ * As executed from retbleed_return_thunk, this is a plain RET.
*
* As part of the TEST above, RET is the ModRM byte, and INT3 the imm8.
*
@@ -168,13 +168,13 @@ SYM_START(zen_untrain_ret, SYM_L_GLOBAL,
* With SMT enabled and STIBP active, a sibling thread cannot poison
* RET's prediction to a type of its choice, but can evict the
* prediction due to competitive sharing. If the prediction is
- * evicted, zen_return_thunk will suffer Straight Line Speculation
+ * evicted, retbleed_return_thunk will suffer Straight Line Speculation
* which will be contained safely by the INT3.
*/
-SYM_INNER_LABEL(zen_return_thunk, SYM_L_GLOBAL)
+SYM_INNER_LABEL(retbleed_return_thunk, SYM_L_GLOBAL)
ret
int3
-SYM_CODE_END(zen_return_thunk)
+SYM_CODE_END(retbleed_return_thunk)
/*
* Ensure the TEST decoding / BTB invalidation is complete.
@@ -185,13 +185,13 @@ SYM_CODE_END(zen_return_thunk)
* Jump back and execute the RET in the middle of the TEST instruction.
* INT3 is for SLS protection.
*/
- jmp zen_return_thunk
+ jmp retbleed_return_thunk
int3
-SYM_FUNC_END(zen_untrain_ret)
-__EXPORT_THUNK(zen_untrain_ret)
+SYM_FUNC_END(retbleed_untrain_ret)
+__EXPORT_THUNK(retbleed_untrain_ret)
/*
- * SRSO untraining sequence for Zen1/2, similar to zen_untrain_ret()
+ * SRSO untraining sequence for Zen1/2, similar to retbleed_untrain_ret()
* above. On kernel entry, srso_untrain_ret() is executed which is a
*
* movabs $0xccccccc308c48348,%rax
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -799,5 +799,5 @@ bool arch_is_rethunk(struct symbol *sym)
return !strcmp(sym->name, "__x86_return_thunk") ||
!strcmp(sym->name, "srso_untrain_ret") ||
!strcmp(sym->name, "srso_safe_ret") ||
- !strcmp(sym->name, "zen_return_thunk");
+ !strcmp(sym->name, "retbleed_return_thunk");
}
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -1430,7 +1430,7 @@ static int add_jump_destinations(struct
struct symbol *sym = find_symbol_by_offset(dest_sec, dest_off);
/*
- * This is a special case for zen_untrain_ret().
+ * This is a special case for retbleed_untrain_ret().
* It jumps to __x86_return_thunk(), but objtool
* can't find the thunk's starting RET
* instruction, because the RET is also in the
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 178/194] x86/cpu: Rename srso_(.*)_alias to srso_alias_\1
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 177/194] x86/cpu: Rename original retbleed methods Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 179/194] x86/cpu: Cleanup the untrain mess Greg Kroah-Hartman
` (26 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Borislav Petkov (AMD)
From: Peter Zijlstra <peterz@infradead.org>
commit 42be649dd1f2eee6b1fb185f1a231b9494cf095f upstream.
For a more consistent namespace.
[ bp: Fixup names in the doc too. ]
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230814121148.976236447@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/hw-vuln/srso.rst | 4 ++--
arch/x86/include/asm/nospec-branch.h | 4 ++--
arch/x86/kernel/vmlinux.lds.S | 8 ++++----
arch/x86/lib/retpoline.S | 26 +++++++++++++-------------
4 files changed, 21 insertions(+), 21 deletions(-)
--- a/Documentation/admin-guide/hw-vuln/srso.rst
+++ b/Documentation/admin-guide/hw-vuln/srso.rst
@@ -124,8 +124,8 @@ sequence.
To ensure the safety of this mitigation, the kernel must ensure that the
safe return sequence is itself free from attacker interference. In Zen3
and Zen4, this is accomplished by creating a BTB alias between the
-untraining function srso_untrain_ret_alias() and the safe return
-function srso_safe_ret_alias() which results in evicting a potentially
+untraining function srso_alias_untrain_ret() and the safe return
+function srso_alias_safe_ret() which results in evicting a potentially
poisoned BTB entry and using that safe one for all function returns.
In older Zen1 and Zen2, this is accomplished using a reinterpretation
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -195,7 +195,7 @@
#ifdef CONFIG_CPU_SRSO
ALTERNATIVE_2 "", "call srso_untrain_ret", X86_FEATURE_SRSO, \
- "call srso_untrain_ret_alias", X86_FEATURE_SRSO_ALIAS
+ "call srso_alias_untrain_ret", X86_FEATURE_SRSO_ALIAS
#endif
.endm
@@ -222,7 +222,7 @@ extern void srso_alias_return_thunk(void
extern void retbleed_untrain_ret(void);
extern void srso_untrain_ret(void);
-extern void srso_untrain_ret_alias(void);
+extern void srso_alias_untrain_ret(void);
extern void entry_ibpb(void);
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -141,10 +141,10 @@ SECTIONS
#ifdef CONFIG_CPU_SRSO
/*
- * See the comment above srso_untrain_ret_alias()'s
+ * See the comment above srso_alias_untrain_ret()'s
* definition.
*/
- . = srso_untrain_ret_alias | (1 << 2) | (1 << 8) | (1 << 14) | (1 << 20);
+ . = srso_alias_untrain_ret | (1 << 2) | (1 << 8) | (1 << 14) | (1 << 20);
*(.text.__x86.rethunk_safe)
#endif
ALIGN_ENTRY_TEXT_END
@@ -523,8 +523,8 @@ INIT_PER_CPU(irq_stack_backing_store);
* Instead do: (A | B) - (A & B) in order to compute the XOR
* of the two function addresses:
*/
-. = ASSERT(((ABSOLUTE(srso_untrain_ret_alias) | srso_safe_ret_alias) -
- (ABSOLUTE(srso_untrain_ret_alias) & srso_safe_ret_alias)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)),
+. = ASSERT(((ABSOLUTE(srso_alias_untrain_ret) | srso_alias_safe_ret) -
+ (ABSOLUTE(srso_alias_untrain_ret) & srso_alias_safe_ret)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)),
"SRSO function pair won't alias");
#endif
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -76,56 +76,56 @@ SYM_CODE_END(__x86_indirect_thunk_array)
#ifdef CONFIG_RETHUNK
/*
- * srso_untrain_ret_alias() and srso_safe_ret_alias() are placed at
+ * srso_alias_untrain_ret() and srso_alias_safe_ret() are placed at
* special addresses:
*
- * - srso_untrain_ret_alias() is 2M aligned
- * - srso_safe_ret_alias() is also in the same 2M page but bits 2, 8, 14
+ * - srso_alias_untrain_ret() is 2M aligned
+ * - srso_alias_safe_ret() is also in the same 2M page but bits 2, 8, 14
* and 20 in its virtual address are set (while those bits in the
- * srso_untrain_ret_alias() function are cleared).
+ * srso_alias_untrain_ret() function are cleared).
*
* This guarantees that those two addresses will alias in the branch
* target buffer of Zen3/4 generations, leading to any potential
* poisoned entries at that BTB slot to get evicted.
*
- * As a result, srso_safe_ret_alias() becomes a safe return.
+ * As a result, srso_alias_safe_ret() becomes a safe return.
*/
#ifdef CONFIG_CPU_SRSO
.section .text.__x86.rethunk_untrain
-SYM_START(srso_untrain_ret_alias, SYM_L_GLOBAL, SYM_A_NONE)
+SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
UNWIND_HINT_FUNC
ANNOTATE_NOENDBR
ASM_NOP2
lfence
jmp srso_alias_return_thunk
-SYM_FUNC_END(srso_untrain_ret_alias)
-__EXPORT_THUNK(srso_untrain_ret_alias)
+SYM_FUNC_END(srso_alias_untrain_ret)
+__EXPORT_THUNK(srso_alias_untrain_ret)
.section .text.__x86.rethunk_safe
#else
/* dummy definition for alternatives */
-SYM_START(srso_untrain_ret_alias, SYM_L_GLOBAL, SYM_A_NONE)
+SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
ANNOTATE_UNRET_SAFE
ret
int3
-SYM_FUNC_END(srso_untrain_ret_alias)
+SYM_FUNC_END(srso_alias_untrain_ret)
#endif
-SYM_START(srso_safe_ret_alias, SYM_L_GLOBAL, SYM_A_NONE)
+SYM_START(srso_alias_safe_ret, SYM_L_GLOBAL, SYM_A_NONE)
add $8, %_ASM_SP
UNWIND_HINT_FUNC
ANNOTATE_UNRET_SAFE
ret
int3
-SYM_FUNC_END(srso_safe_ret_alias)
+SYM_FUNC_END(srso_alias_safe_ret)
.section .text.__x86.return_thunk
SYM_CODE_START(srso_alias_return_thunk)
UNWIND_HINT_FUNC
ANNOTATE_NOENDBR
- call srso_safe_ret_alias
+ call srso_alias_safe_ret
ud2
SYM_CODE_END(srso_alias_return_thunk)
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 179/194] x86/cpu: Cleanup the untrain mess
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 178/194] x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 180/194] x86/srso: Explain the untraining sequences a bit more Greg Kroah-Hartman
` (25 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Borislav Petkov (AMD)
From: Peter Zijlstra <peterz@infradead.org>
commit e7c25c441e9e0fa75b4c83e0b26306b702cfe90d upstream.
Since there can only be one active return_thunk, there only needs be
one (matching) untrain_ret. It fundamentally doesn't make sense to
allow multiple untrain_ret at the same time.
Fold all the 3 different untrain methods into a single (temporary)
helper stub.
Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230814121149.042774962@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/nospec-branch.h | 12 ++++--------
arch/x86/kernel/cpu/bugs.c | 1 +
arch/x86/lib/retpoline.S | 7 +++++++
3 files changed, 12 insertions(+), 8 deletions(-)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -168,9 +168,9 @@
.endm
#ifdef CONFIG_CPU_UNRET_ENTRY
-#define CALL_ZEN_UNTRAIN_RET "call retbleed_untrain_ret"
+#define CALL_UNTRAIN_RET "call entry_untrain_ret"
#else
-#define CALL_ZEN_UNTRAIN_RET ""
+#define CALL_UNTRAIN_RET ""
#endif
/*
@@ -189,14 +189,9 @@
defined(CONFIG_CPU_SRSO)
ANNOTATE_UNRET_END
ALTERNATIVE_2 "", \
- CALL_ZEN_UNTRAIN_RET, X86_FEATURE_UNRET, \
+ CALL_UNTRAIN_RET, X86_FEATURE_UNRET, \
"call entry_ibpb", X86_FEATURE_ENTRY_IBPB
#endif
-
-#ifdef CONFIG_CPU_SRSO
- ALTERNATIVE_2 "", "call srso_untrain_ret", X86_FEATURE_SRSO, \
- "call srso_alias_untrain_ret", X86_FEATURE_SRSO_ALIAS
-#endif
.endm
#else /* __ASSEMBLY__ */
@@ -224,6 +219,7 @@ extern void retbleed_untrain_ret(void);
extern void srso_untrain_ret(void);
extern void srso_alias_untrain_ret(void);
+extern void entry_untrain_ret(void);
extern void entry_ibpb(void);
#ifdef CONFIG_RETPOLINE
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -2429,6 +2429,7 @@ static void __init srso_select_mitigatio
* like ftrace, static_call, etc.
*/
setup_force_cpu_cap(X86_FEATURE_RETHUNK);
+ setup_force_cpu_cap(X86_FEATURE_UNRET);
if (boot_cpu_data.x86 == 0x19) {
setup_force_cpu_cap(X86_FEATURE_SRSO_ALIAS);
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -233,6 +233,13 @@ SYM_CODE_START(srso_return_thunk)
ud2
SYM_CODE_END(srso_return_thunk)
+SYM_FUNC_START(entry_untrain_ret)
+ ALTERNATIVE_2 "jmp retbleed_untrain_ret", \
+ "jmp srso_untrain_ret", X86_FEATURE_SRSO, \
+ "jmp srso_alias_untrain_ret", X86_FEATURE_SRSO_ALIAS
+SYM_FUNC_END(entry_untrain_ret)
+__EXPORT_THUNK(entry_untrain_ret)
+
SYM_CODE_START(__x86_return_thunk)
UNWIND_HINT_FUNC
ANNOTATE_NOENDBR
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 180/194] x86/srso: Explain the untraining sequences a bit more
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 179/194] x86/cpu: Cleanup the untrain mess Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 181/194] x86/static_call: Fix __static_call_fixup() Greg Kroah-Hartman
` (24 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Borislav Petkov (AMD)
From: Borislav Petkov (AMD) <bp@alien8.de>
commit 9dbd23e42ff0b10c9b02c9e649c76e5228241a8e upstream.
The goal is to eventually have a proper documentation about all this.
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230814164447.GFZNpZ/64H4lENIe94@fat_crate.local
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/lib/retpoline.S | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -130,6 +130,25 @@ SYM_CODE_START(srso_alias_return_thunk)
SYM_CODE_END(srso_alias_return_thunk)
/*
+ * Some generic notes on the untraining sequences:
+ *
+ * They are interchangeable when it comes to flushing potentially wrong
+ * RET predictions from the BTB.
+ *
+ * The SRSO Zen1/2 (MOVABS) untraining sequence is longer than the
+ * Retbleed sequence because the return sequence done there
+ * (srso_safe_ret()) is longer and the return sequence must fully nest
+ * (end before) the untraining sequence. Therefore, the untraining
+ * sequence must fully overlap the return sequence.
+ *
+ * Regarding alignment - the instructions which need to be untrained,
+ * must all start at a cacheline boundary for Zen1/2 generations. That
+ * is, instruction sequences starting at srso_safe_ret() and
+ * the respective instruction sequences at retbleed_return_thunk()
+ * must start at a cacheline boundary.
+ */
+
+/*
* Safety details here pertain to the AMD Zen{1,2} microarchitecture:
* 1) The RET at retbleed_return_thunk must be on a 64 byte boundary, for
* alignment within the BTB.
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 181/194] x86/static_call: Fix __static_call_fixup()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 180/194] x86/srso: Explain the untraining sequences a bit more Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 182/194] x86/retpoline: Dont clobber RFLAGS during srso_safe_ret() Greg Kroah-Hartman
` (23 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Bricart,
Peter Zijlstra (Intel), Josh Poimboeuf
From: Peter Zijlstra <peterz@infradead.org>
commit 54097309620ef0dc2d7083783dc521c6a5fef957 upstream.
Christian reported spurious module load crashes after some of Song's
module memory layout patches.
Turns out that if the very last instruction on the very last page of the
module is a 'JMP __x86_return_thunk' then __static_call_fixup() will
trip a fault and die.
And while the module rework made this slightly more likely to happen,
it's always been possible.
Fixes: ee88d363d156 ("x86,static_call: Use alternative RET encoding")
Reported-by: Christian Bricart <christian@bricart.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
Link: https://lkml.kernel.org/r/20230816104419.GA982867@hirez.programming.kicks-ass.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/static_call.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/arch/x86/kernel/static_call.c
+++ b/arch/x86/kernel/static_call.c
@@ -184,6 +184,19 @@ EXPORT_SYMBOL_GPL(arch_static_call_trans
*/
bool __static_call_fixup(void *tramp, u8 op, void *dest)
{
+ unsigned long addr = (unsigned long)tramp;
+ /*
+ * Not all .return_sites are a static_call trampoline (most are not).
+ * Check if the 3 bytes after the return are still kernel text, if not,
+ * then this definitely is not a trampoline and we need not worry
+ * further.
+ *
+ * This avoids the memcmp() below tripping over pagefaults etc..
+ */
+ if (((addr >> PAGE_SHIFT) != ((addr + 7) >> PAGE_SHIFT)) &&
+ !kernel_text_address(addr + 7))
+ return false;
+
if (memcmp(tramp+5, tramp_ud, 3)) {
/* Not a trampoline site, not our problem. */
return false;
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 182/194] x86/retpoline: Dont clobber RFLAGS during srso_safe_ret()
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 181/194] x86/static_call: Fix __static_call_fixup() Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 183/194] x86/CPU/AMD: Fix the DIV(0) initial fix attempt Greg Kroah-Hartman
` (22 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srikanth Aithal, Nathan Chancellor,
Sean Christopherson, Borislav Petkov (AMD)
From: Sean Christopherson <seanjc@google.com>
commit ba5ca5e5e6a1d55923e88b4a83da452166f5560e upstream.
Use LEA instead of ADD when adjusting %rsp in srso_safe_ret{,_alias}()
so as to avoid clobbering flags. Drop one of the INT3 instructions to
account for the LEA consuming one more byte than the ADD.
KVM's emulator makes indirect calls into a jump table of sorts, where
the destination of each call is a small blob of code that performs fast
emulation by executing the target instruction with fixed operands.
E.g. to emulate ADC, fastop() invokes adcb_al_dl():
adcb_al_dl:
<+0>: adc %dl,%al
<+2>: jmp <__x86_return_thunk>
A major motivation for doing fast emulation is to leverage the CPU to
handle consumption and manipulation of arithmetic flags, i.e. RFLAGS is
both an input and output to the target of the call. fastop() collects
the RFLAGS result by pushing RFLAGS onto the stack and popping them back
into a variable (held in %rdi in this case):
asm("push %[flags]; popf; " CALL_NOSPEC " ; pushf; pop %[flags]\n"
<+71>: mov 0xc0(%r8),%rdx
<+78>: mov 0x100(%r8),%rcx
<+85>: push %rdi
<+86>: popf
<+87>: call *%rsi
<+89>: nop
<+90>: nop
<+91>: nop
<+92>: pushf
<+93>: pop %rdi
and then propagating the arithmetic flags into the vCPU's emulator state:
ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK);
<+64>: and $0xfffffffffffff72a,%r9
<+94>: and $0x8d5,%edi
<+109>: or %rdi,%r9
<+122>: mov %r9,0x10(%r8)
The failures can be most easily reproduced by running the "emulator"
test in KVM-Unit-Tests.
If you're feeling a bit of deja vu, see commit b63f20a778c8
("x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386").
In addition, this breaks booting of clang-compiled guest on
a gcc-compiled host where the host contains the %rsp-modifying SRSO
mitigations.
[ bp: Massage commit message, extend, remove addresses. ]
Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
Closes: https://lore.kernel.org/all/de474347-122d-54cd-eabf-9dcc95ab9eae@amd.com
Reported-by: Srikanth Aithal <sraithal@amd.com>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/20230810013334.GA5354@dev-arch.thelio-3990X/
Link: https://lore.kernel.org/r/20230811155255.250835-1-seanjc@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/lib/retpoline.S | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -113,7 +113,7 @@ SYM_FUNC_END(srso_alias_untrain_ret)
#endif
SYM_START(srso_alias_safe_ret, SYM_L_GLOBAL, SYM_A_NONE)
- add $8, %_ASM_SP
+ lea 8(%_ASM_SP), %_ASM_SP
UNWIND_HINT_FUNC
ANNOTATE_UNRET_SAFE
ret
@@ -213,7 +213,7 @@ __EXPORT_THUNK(retbleed_untrain_ret)
* SRSO untraining sequence for Zen1/2, similar to retbleed_untrain_ret()
* above. On kernel entry, srso_untrain_ret() is executed which is a
*
- * movabs $0xccccccc308c48348,%rax
+ * movabs $0xccccc30824648d48,%rax
*
* and when the return thunk executes the inner label srso_safe_ret()
* later, it is a stack manipulation and a RET which is mispredicted and
@@ -232,11 +232,10 @@ SYM_START(srso_untrain_ret, SYM_L_GLOBAL
* the stack.
*/
SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLOBAL)
- add $8, %_ASM_SP
+ lea 8(%_ASM_SP), %_ASM_SP
ret
int3
int3
- int3
/* end of movabs */
lfence
call srso_safe_ret
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 183/194] x86/CPU/AMD: Fix the DIV(0) initial fix attempt
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 182/194] x86/retpoline: Dont clobber RFLAGS during srso_safe_ret() Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 184/194] x86/srso: Disable the mitigation on unaffected configurations Greg Kroah-Hartman
` (21 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Borislav Petkov (AMD), stable
From: Borislav Petkov (AMD) <bp@alien8.de>
commit f58d6fbcb7c848b7f2469be339bc571f2e9d245b upstream.
Initially, it was thought that doing an innocuous division in the #DE
handler would take care to prevent any leaking of old data from the
divider but by the time the fault is raised, the speculation has already
advanced too far and such data could already have been used by younger
operations.
Therefore, do the innocuous division on every exit to userspace so that
userspace doesn't see any potentially old data from integer divisions in
kernel space.
Do the same before VMRUN too, to protect host data from leaking into the
guest too.
Fixes: 77245f1c3c64 ("x86/CPU/AMD: Do not leak quotient data after a division by 0")
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org>
Link: https://lore.kernel.org/r/20230811213824.10025-1-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/entry-common.h | 1 +
arch/x86/kernel/cpu/amd.c | 1 +
arch/x86/kernel/traps.c | 2 --
arch/x86/kvm/svm/svm.c | 2 ++
4 files changed, 4 insertions(+), 2 deletions(-)
--- a/arch/x86/include/asm/entry-common.h
+++ b/arch/x86/include/asm/entry-common.h
@@ -92,6 +92,7 @@ static inline void arch_exit_to_user_mod
static __always_inline void arch_exit_to_user_mode(void)
{
mds_user_clear_cpu_buffers();
+ amd_clear_divider();
}
#define arch_exit_to_user_mode arch_exit_to_user_mode
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -1295,3 +1295,4 @@ void noinstr amd_clear_divider(void)
asm volatile(ALTERNATIVE("", "div %2\n\t", X86_BUG_DIV0)
:: "a" (0), "d" (0), "r" (1));
}
+EXPORT_SYMBOL_GPL(amd_clear_divider);
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -206,8 +206,6 @@ DEFINE_IDTENTRY(exc_divide_error)
{
do_error_trap(regs, 0, "divide error", X86_TRAP_DE, SIGFPE,
FPE_INTDIV, error_get_trap_addr(regs));
-
- amd_clear_divider();
}
DEFINE_IDTENTRY(exc_overflow)
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -3947,6 +3947,8 @@ static noinstr void svm_vcpu_enter_exit(
guest_state_enter_irqoff();
+ amd_clear_divider();
+
if (sev_es_guest(vcpu->kvm))
__svm_sev_es_vcpu_run(svm, spec_ctrl_intercepted);
else
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 184/194] x86/srso: Disable the mitigation on unaffected configurations
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 183/194] x86/CPU/AMD: Fix the DIV(0) initial fix attempt Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 185/194] x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG Greg Kroah-Hartman
` (20 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Borislav Petkov (AMD)
From: Borislav Petkov (AMD) <bp@alien8.de>
commit e9fbc47b818b964ddff5df5b2d5c0f5f32f4a147 upstream.
Skip the srso cmd line parsing which is not needed on Zen1/2 with SMT
disabled and with the proper microcode applied (latter should be the
case anyway) as those are not affected.
Fixes: 5a15d8348881 ("x86/srso: Tie SBPB bit setting to microcode patch detection")
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230813104517.3346-1-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/bugs.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -2399,8 +2399,10 @@ static void __init srso_select_mitigatio
* IBPB microcode has been applied.
*/
if ((boot_cpu_data.x86 < 0x19) &&
- (!cpu_smt_possible() || (cpu_smt_control == CPU_SMT_DISABLED)))
+ (!cpu_smt_possible() || (cpu_smt_control == CPU_SMT_DISABLED))) {
setup_force_cpu_cap(X86_FEATURE_SRSO_NO);
+ return;
+ }
}
if (retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {
@@ -2686,6 +2688,9 @@ static ssize_t gds_show_state(char *buf)
static ssize_t srso_show_state(char *buf)
{
+ if (boot_cpu_has(X86_FEATURE_SRSO_NO))
+ return sysfs_emit(buf, "Not affected\n");
+
return sysfs_emit(buf, "%s%s\n",
srso_strings[srso_mitigation],
(cpu_has_ibpb_brtype_microcode() ? "" : ", no microcode"));
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 185/194] x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 184/194] x86/srso: Disable the mitigation on unaffected configurations Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 186/194] objtool/x86: Fixup frame-pointer vs rethunk Greg Kroah-Hartman
` (19 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Pavlu, Peter Zijlstra (Intel),
Nathan Chancellor, Borislav Petkov (AMD)
From: Petr Pavlu <petr.pavlu@suse.com>
commit 79cd2a11224eab86d6673fe8a11d2046ae9d2757 upstream.
The linker script arch/x86/kernel/vmlinux.lds.S matches the thunk
sections ".text.__x86.*" from arch/x86/lib/retpoline.S as follows:
.text {
[...]
TEXT_TEXT
[...]
__indirect_thunk_start = .;
*(.text.__x86.*)
__indirect_thunk_end = .;
[...]
}
Macro TEXT_TEXT references TEXT_MAIN which normally expands to only
".text". However, with CONFIG_LTO_CLANG, TEXT_MAIN becomes
".text .text.[0-9a-zA-Z_]*" which wrongly matches also the thunk
sections. The output layout is then different than expected. For
instance, the currently defined range [__indirect_thunk_start,
__indirect_thunk_end] becomes empty.
Prevent the problem by using ".." as the first separator, for example,
".text..__x86.indirect_thunk". This pattern is utilized by other
explicit section names which start with one of the standard prefixes,
such as ".text" or ".data", and that need to be individually selected in
the linker script.
[ nathan: Fix conflicts with SRSO and fold in fix issue brought up by
Andrew Cooper in post-review:
https://lore.kernel.org/20230803230323.1478869-1-andrew.cooper3@citrix.com ]
Fixes: dc5723b02e52 ("kbuild: add support for Clang LTO")
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230711091952.27944-2-petr.pavlu@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/vmlinux.lds.S | 8 ++++----
arch/x86/lib/retpoline.S | 8 ++++----
tools/objtool/check.c | 2 +-
3 files changed, 9 insertions(+), 9 deletions(-)
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -134,7 +134,7 @@ SECTIONS
KPROBES_TEXT
ALIGN_ENTRY_TEXT_BEGIN
#ifdef CONFIG_CPU_SRSO
- *(.text.__x86.rethunk_untrain)
+ *(.text..__x86.rethunk_untrain)
#endif
ENTRY_TEXT
@@ -145,7 +145,7 @@ SECTIONS
* definition.
*/
. = srso_alias_untrain_ret | (1 << 2) | (1 << 8) | (1 << 14) | (1 << 20);
- *(.text.__x86.rethunk_safe)
+ *(.text..__x86.rethunk_safe)
#endif
ALIGN_ENTRY_TEXT_END
SOFTIRQENTRY_TEXT
@@ -154,8 +154,8 @@ SECTIONS
#ifdef CONFIG_RETPOLINE
__indirect_thunk_start = .;
- *(.text.__x86.indirect_thunk)
- *(.text.__x86.return_thunk)
+ *(.text..__x86.indirect_thunk)
+ *(.text..__x86.return_thunk)
__indirect_thunk_end = .;
#endif
} :text =0xcccc
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -11,7 +11,7 @@
#include <asm/frame.h>
#include <asm/nops.h>
- .section .text.__x86.indirect_thunk
+ .section .text..__x86.indirect_thunk
.macro RETPOLINE reg
ANNOTATE_INTRA_FUNCTION_CALL
@@ -91,7 +91,7 @@ SYM_CODE_END(__x86_indirect_thunk_array)
* As a result, srso_alias_safe_ret() becomes a safe return.
*/
#ifdef CONFIG_CPU_SRSO
- .section .text.__x86.rethunk_untrain
+ .section .text..__x86.rethunk_untrain
SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
UNWIND_HINT_FUNC
@@ -102,7 +102,7 @@ SYM_START(srso_alias_untrain_ret, SYM_L_
SYM_FUNC_END(srso_alias_untrain_ret)
__EXPORT_THUNK(srso_alias_untrain_ret)
- .section .text.__x86.rethunk_safe
+ .section .text..__x86.rethunk_safe
#else
/* dummy definition for alternatives */
SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
@@ -120,7 +120,7 @@ SYM_START(srso_alias_safe_ret, SYM_L_GLO
int3
SYM_FUNC_END(srso_alias_safe_ret)
- .section .text.__x86.return_thunk
+ .section .text..__x86.return_thunk
SYM_CODE_START(srso_alias_return_thunk)
UNWIND_HINT_FUNC
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -379,7 +379,7 @@ static int decode_instructions(struct ob
if (!strcmp(sec->name, ".noinstr.text") ||
!strcmp(sec->name, ".entry.text") ||
- !strncmp(sec->name, ".text.__x86.", 12))
+ !strncmp(sec->name, ".text..__x86.", 13))
sec->noinstr = true;
for (offset = 0; offset < sec->sh.sh_size; offset += insn->len) {
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 186/194] objtool/x86: Fixup frame-pointer vs rethunk
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 185/194] x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 187/194] x86/srso: Correct the mitigation status when SMT is disabled Greg Kroah-Hartman
` (18 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Borislav Petkov (AMD), Josh Poimboeuf
From: Peter Zijlstra <peterz@infradead.org>
commit dbf46008775516f7f25c95b7760041c286299783 upstream.
For stack-validation of a frame-pointer build, objtool validates that
every CALL instruction is preceded by a frame-setup. The new SRSO
return thunks violate this with their RSB stuffing trickery.
Extend the __fentry__ exception to also cover the embedded_insn case
used for this. This cures:
vmlinux.o: warning: objtool: srso_untrain_ret+0xd: call without frame pointer save/setup
Fixes: 4ae68b26c3ab ("objtool/x86: Fix SRSO mess")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
Link: https://lore.kernel.org/r/20230816115921.GH980931@hirez.programming.kicks-ass.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/objtool/check.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -2450,12 +2450,17 @@ static int decode_sections(struct objtoo
return 0;
}
-static bool is_fentry_call(struct instruction *insn)
+static bool is_special_call(struct instruction *insn)
{
- if (insn->type == INSN_CALL &&
- insn->call_dest &&
- insn->call_dest->fentry)
- return true;
+ if (insn->type == INSN_CALL) {
+ struct symbol *dest = insn->call_dest;
+
+ if (!dest)
+ return false;
+
+ if (dest->fentry)
+ return true;
+ }
return false;
}
@@ -3448,7 +3453,7 @@ static int validate_branch(struct objtoo
if (ret)
return ret;
- if (opts.stackval && func && !is_fentry_call(insn) &&
+ if (opts.stackval && func && !is_special_call(insn) &&
!has_valid_stack_frame(&state)) {
WARN_FUNC("call without frame pointer save/setup",
sec, insn->offset);
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 187/194] x86/srso: Correct the mitigation status when SMT is disabled
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 186/194] objtool/x86: Fixup frame-pointer vs rethunk Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 188/194] arm64/ptrace: Ensure that SME is set up for target when writing SSVE state Greg Kroah-Hartman
` (17 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josh Poimboeuf,
Borislav Petkov (AMD)
From: Borislav Petkov (AMD) <bp@alien8.de>
commit 6405b72e8d17bd1875a56ae52d23ec3cd51b9d66 upstream.
Specify how is SRSO mitigated when SMT is disabled. Also, correct the
SMT check for that.
Fixes: e9fbc47b818b ("x86/srso: Disable the mitigation on unaffected configurations")
Suggested-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
Link: https://lore.kernel.org/r/20230814200813.p5czl47zssuej7nv@treble
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/bugs.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -2398,8 +2398,7 @@ static void __init srso_select_mitigatio
* Zen1/2 with SMT off aren't vulnerable after the right
* IBPB microcode has been applied.
*/
- if ((boot_cpu_data.x86 < 0x19) &&
- (!cpu_smt_possible() || (cpu_smt_control == CPU_SMT_DISABLED))) {
+ if (boot_cpu_data.x86 < 0x19 && !cpu_smt_possible()) {
setup_force_cpu_cap(X86_FEATURE_SRSO_NO);
return;
}
@@ -2689,7 +2688,7 @@ static ssize_t gds_show_state(char *buf)
static ssize_t srso_show_state(char *buf)
{
if (boot_cpu_has(X86_FEATURE_SRSO_NO))
- return sysfs_emit(buf, "Not affected\n");
+ return sysfs_emit(buf, "Mitigation: SMT disabled\n");
return sysfs_emit(buf, "%s%s\n",
srso_strings[srso_mitigation],
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 188/194] arm64/ptrace: Ensure that SME is set up for target when writing SSVE state
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 187/194] x86/srso: Correct the mitigation status when SMT is disabled Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 189/194] drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11 Greg Kroah-Hartman
` (16 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Spickett, Mark Brown,
Catalin Marinas
From: Mark Brown <broonie@kernel.org>
commit 5d0a8d2fba50e9c07cde4aad7fba28c008b07a5b upstream.
When we use NT_ARM_SSVE to either enable streaming mode or change the
vector length for a process we do not currently do anything to ensure that
there is storage allocated for the SME specific register state. If the
task had not previously used SME or we changed the vector length then
the task will not have had TIF_SME set or backing storage for ZA/ZT
allocated, resulting in inconsistent register sizes when saving state
and spurious traps which flush the newly set register state.
We should set TIF_SME to disable traps and ensure that storage is
allocated for ZA and ZT if it is not already allocated. This requires
modifying sme_alloc() to make the flush of any existing register state
optional so we don't disturb existing state for ZA and ZT.
Fixes: e12310a0d30f ("arm64/sme: Implement ptrace support for streaming mode SVE registers")
Reported-by: David Spickett <David.Spickett@arm.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: <stable@vger.kernel.org> # 5.19.x
Link: https://lore.kernel.org/r/20230810-arm64-fix-ptrace-race-v1-1-a5361fad2bd6@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/fpsimd.h | 4 ++--
arch/arm64/kernel/fpsimd.c | 6 +++---
arch/arm64/kernel/ptrace.c | 9 ++++++++-
arch/arm64/kernel/signal.c | 2 +-
4 files changed, 14 insertions(+), 7 deletions(-)
--- a/arch/arm64/include/asm/fpsimd.h
+++ b/arch/arm64/include/asm/fpsimd.h
@@ -339,7 +339,7 @@ static inline int sme_max_virtualisable_
return vec_max_virtualisable_vl(ARM64_VEC_SME);
}
-extern void sme_alloc(struct task_struct *task);
+extern void sme_alloc(struct task_struct *task, bool flush);
extern unsigned int sme_get_vl(void);
extern int sme_set_current_vl(unsigned long arg);
extern int sme_get_current_vl(void);
@@ -365,7 +365,7 @@ static inline void sme_smstart_sm(void)
static inline void sme_smstop_sm(void) { }
static inline void sme_smstop(void) { }
-static inline void sme_alloc(struct task_struct *task) { }
+static inline void sme_alloc(struct task_struct *task, bool flush) { }
static inline void sme_setup(void) { }
static inline unsigned int sme_get_vl(void) { return 0; }
static inline int sme_max_vl(void) { return 0; }
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -1239,9 +1239,9 @@ void fpsimd_release_task(struct task_str
* the interest of testability and predictability, the architecture
* guarantees that when ZA is enabled it will be zeroed.
*/
-void sme_alloc(struct task_struct *task)
+void sme_alloc(struct task_struct *task, bool flush)
{
- if (task->thread.za_state) {
+ if (task->thread.za_state && flush) {
memset(task->thread.za_state, 0, za_state_size(task));
return;
}
@@ -1460,7 +1460,7 @@ void do_sme_acc(unsigned long esr, struc
}
sve_alloc(current, false);
- sme_alloc(current);
+ sme_alloc(current, true);
if (!current->thread.sve_state || !current->thread.za_state) {
force_sig(SIGKILL);
return;
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -886,6 +886,13 @@ static int sve_set_common(struct task_st
break;
case ARM64_VEC_SME:
target->thread.svcr |= SVCR_SM_MASK;
+
+ /*
+ * Disable traps and ensure there is SME storage but
+ * preserve any currently set values in ZA/ZT.
+ */
+ sme_alloc(target, false);
+ set_tsk_thread_flag(target, TIF_SME);
break;
default:
WARN_ON_ONCE(1);
@@ -1107,7 +1114,7 @@ static int za_set(struct task_struct *ta
}
/* Allocate/reinit ZA storage */
- sme_alloc(target);
+ sme_alloc(target, true);
if (!target->thread.za_state) {
ret = -ENOMEM;
goto out;
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -430,7 +430,7 @@ static int restore_za_context(struct use
fpsimd_flush_task_state(current);
/* From now, fpsimd_thread_switch() won't touch thread.sve_state */
- sme_alloc(current);
+ sme_alloc(current, true);
if (!current->thread.za_state) {
current->thread.svcr &= ~SVCR_ZA_MASK;
clear_thread_flag(TIF_SME);
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 189/194] drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 188/194] arm64/ptrace: Ensure that SME is set up for target when writing SSVE state Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 190/194] drm/amdgpu: keep irq count in amdgpu_irq_disable_all Greg Kroah-Hartman
` (15 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Huang, Mario Limonciello,
Alex Deucher
From: Tim Huang <Tim.Huang@amd.com>
commit 730d44e1fa306a20746ad4a85da550662aed9daa upstream.
For SMU v13.0.4/11, driver does not need to stop RLC for S0i3,
the firmwares will handle that properly.
Signed-off-by: Tim Huang <Tim.Huang@amd.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -1562,9 +1562,9 @@ static int smu_disable_dpms(struct smu_c
/*
* For SMU 13.0.4/11, PMFW will handle the features disablement properly
- * for gpu reset case. Driver involvement is unnecessary.
+ * for gpu reset and S0i3 cases. Driver involvement is unnecessary.
*/
- if (amdgpu_in_reset(adev)) {
+ if (amdgpu_in_reset(adev) || adev->in_s0ix) {
switch (adev->ip_versions[MP1_HWIP][0]) {
case IP_VERSION(13, 0, 4):
case IP_VERSION(13, 0, 11):
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 190/194] drm/amdgpu: keep irq count in amdgpu_irq_disable_all
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 189/194] drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11 Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 191/194] af_unix: Fix null-ptr-deref in unix_stream_sendpage() Greg Kroah-Hartman
` (14 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guchun Chen, Christian König,
Alex Deucher
From: Guchun Chen <guchun.chen@amd.com>
commit 8ffd6f0442674f32c048ec8dffdbc5ec67829beb upstream.
This can clean up all irq warnings because of unbalanced
amdgpu_irq_get/put when unplugging/unbinding device, and leave
irq count decrease in each ip fini function.
Signed-off-by: Guchun Chen <guchun.chen@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
@@ -160,7 +160,6 @@ void amdgpu_irq_disable_all(struct amdgp
continue;
for (k = 0; k < src->num_types; ++k) {
- atomic_set(&src->enabled_types[k], 0);
r = src->funcs->set(adev, src, k,
AMDGPU_IRQ_STATE_DISABLE);
if (r)
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 191/194] af_unix: Fix null-ptr-deref in unix_stream_sendpage().
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 190/194] drm/amdgpu: keep irq count in amdgpu_irq_disable_all Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 192/194] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create Greg Kroah-Hartman
` (13 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bing-Jhong Billy Jheng,
Linus Torvalds, Kuniyuki Iwashima
From: Kuniyuki Iwashima <kuniyu@amazon.com>
Bing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage()
with detailed analysis and a nice repro.
unix_stream_sendpage() tries to add data to the last skb in the peer's
recv queue without locking the queue.
If the peer's FD is passed to another socket and the socket's FD is
passed to the peer, there is a loop between them. If we close both
sockets without receiving FD, the sockets will be cleaned up by garbage
collection.
The garbage collection iterates such sockets and unlinks skb with
FD from the socket's receive queue under the queue's lock.
So, there is a race where unix_stream_sendpage() could access an skb
locklessly that is being released by garbage collection, resulting in
use-after-free.
To avoid the issue, unix_stream_sendpage() must lock the peer's recv
queue.
Note the issue does not exist in 6.5+ thanks to the recent sendpage()
refactoring.
This patch is originally written by Linus Torvalds.
BUG: unable to handle page fault for address: ffff988004dd6870
PF: supervisor read access in kernel mode
PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
PREEMPT SMP PTI
CPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
RIP: 0010:kmem_cache_alloc_node+0xa2/0x1e0
Code: c0 0f 84 32 01 00 00 41 83 fd ff 74 10 48 8b 00 48 c1 e8 3a 41 39 c5 0f 85 1c 01 00 00 41 8b 44 24 28 49 8b 3c 24 48 8d 4a 40 <49> 8b 1c 06 4c 89 f0 65 48 0f c7 0f 0f 94 c0 84 c0 74 a1 41 8b 44
RSP: 0018:ffffc9000079fac0 EFLAGS: 00000246
RAX: 0000000000000070 RBX: 0000000000000005 RCX: 000000000001a284
RDX: 000000000001a244 RSI: 0000000000400cc0 RDI: 000000000002eee0
RBP: 0000000000400cc0 R08: 0000000000400cc0 R09: 0000000000000003
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888003970f00
R13: 00000000ffffffff R14: ffff988004dd6800 R15: 00000000000000e8
FS: 00007f174d6f3600(0000) GS:ffff88807db00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff988004dd6870 CR3: 00000000092be000 CR4: 00000000007506e0
PKRU: 55555554
Call Trace:
<TASK>
? __die_body.cold+0x1a/0x1f
? page_fault_oops+0xa9/0x1e0
? fixup_exception+0x1d/0x310
? exc_page_fault+0xa8/0x150
? asm_exc_page_fault+0x22/0x30
? kmem_cache_alloc_node+0xa2/0x1e0
? __alloc_skb+0x16c/0x1e0
__alloc_skb+0x16c/0x1e0
alloc_skb_with_frags+0x48/0x1e0
sock_alloc_send_pskb+0x234/0x270
unix_stream_sendmsg+0x1f5/0x690
sock_sendmsg+0x5d/0x60
____sys_sendmsg+0x210/0x260
___sys_sendmsg+0x83/0xd0
? kmem_cache_alloc+0xc6/0x1c0
? avc_disable+0x20/0x20
? percpu_counter_add_batch+0x53/0xc0
? alloc_empty_file+0x5d/0xb0
? alloc_file+0x91/0x170
? alloc_file_pseudo+0x94/0x100
? __fget_light+0x9f/0x120
__sys_sendmsg+0x54/0xa0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x69/0xd3
RIP: 0033:0x7f174d639a7d
Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 8a c1 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 de c1 f4 ff 48
RSP: 002b:00007ffcb563ea50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f174d639a7d
RDX: 0000000000000000 RSI: 00007ffcb563eab0 RDI: 0000000000000007
RBP: 00007ffcb563eb10 R08: 0000000000000000 R09: 00000000ffffffff
R10: 00000000004040a0 R11: 0000000000000293 R12: 00007ffcb563ec28
R13: 0000000000401398 R14: 0000000000403e00 R15: 00007f174d72c000
</TASK>
Fixes: 869e7c62486e ("net: af_unix: implement stream sendpage support")
Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
Reviewed-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/unix/af_unix.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2290,6 +2290,7 @@ static ssize_t unix_stream_sendpage(stru
if (false) {
alloc_skb:
+ spin_unlock(&other->sk_receive_queue.lock);
unix_state_unlock(other);
mutex_unlock(&unix_sk(other)->iolock);
newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
@@ -2329,6 +2330,7 @@ alloc_skb:
init_scm = false;
}
+ spin_lock(&other->sk_receive_queue.lock);
skb = skb_peek_tail(&other->sk_receive_queue);
if (tail && tail == skb) {
skb = newskb;
@@ -2359,14 +2361,11 @@ alloc_skb:
refcount_add(size, &sk->sk_wmem_alloc);
if (newskb) {
- err = unix_scm_to_skb(&scm, skb, false);
- if (err)
- goto err_state_unlock;
- spin_lock(&other->sk_receive_queue.lock);
+ unix_scm_to_skb(&scm, skb, false);
__skb_queue_tail(&other->sk_receive_queue, newskb);
- spin_unlock(&other->sk_receive_queue.lock);
}
+ spin_unlock(&other->sk_receive_queue.lock);
unix_state_unlock(other);
mutex_unlock(&unix_sk(other)->iolock);
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 192/194] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 191/194] af_unix: Fix null-ptr-deref in unix_stream_sendpage() Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 193/194] net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled Greg Kroah-Hartman
` (12 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Karol Herbst, Lyude Paul
From: Karol Herbst <kherbst@redhat.com>
commit 1b254b791d7b7dea6e8adc887fbbd51746d8bb27 upstream.
We can't simply free the connector after calling drm_connector_init on it.
We need to clean up the drm side first.
It might not fix all regressions from commit 2b5d1c29f6c4
("drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts"),
but at least it fixes a memory corruption in error handling related to
that commit.
Link: https://lore.kernel.org/lkml/20230806213107.GFZNARG6moWpFuSJ9W@fat_crate.local/
Fixes: 95983aea8003 ("drm/nouveau/disp: add connector class")
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230814144933.3956959-1-kherbst@redhat.com
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_connector.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -1407,8 +1407,7 @@ nouveau_connector_create(struct drm_devi
ret = nvif_conn_ctor(&disp->disp, nv_connector->base.name, nv_connector->index,
&nv_connector->conn);
if (ret) {
- kfree(nv_connector);
- return ERR_PTR(ret);
+ goto drm_conn_err;
}
}
@@ -1470,4 +1469,9 @@ nouveau_connector_create(struct drm_devi
drm_connector_register(connector);
return connector;
+
+drm_conn_err:
+ drm_connector_cleanup(connector);
+ kfree(nv_connector);
+ return ERR_PTR(ret);
}
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 193/194] net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 192/194] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 194/194] mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove Greg Kroah-Hartman
` (11 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jason Xing,
David S. Miller
From: Jason Xing <kernelxing@tencent.com>
commit e4dd0d3a2f64b8bd8029ec70f52bdbebd0644408 upstream.
In the real workload, I encountered an issue which could cause the RTO
timer to retransmit the skb per 1ms with linear option enabled. The amount
of lost-retransmitted skbs can go up to 1000+ instantly.
The root cause is that if the icsk_rto happens to be zero in the 6th round
(which is the TCP_THIN_LINEAR_RETRIES value), then it will always be zero
due to the changed calculation method in tcp_retransmit_timer() as follows:
icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
Above line could be converted to
icsk->icsk_rto = min(0 << 1, TCP_RTO_MAX) = 0
Therefore, the timer expires so quickly without any doubt.
I read through the RFC 6298 and found that the RTO value can be rounded
up to a certain value, in Linux, say TCP_RTO_MIN as default, which is
regarded as the lower bound in this patch as suggested by Eric.
Fixes: 36e31b0af587 ("net: TCP thin linear timeouts")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jason Xing <kernelxing@tencent.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_timer.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -586,7 +586,9 @@ out_reset_timer:
tcp_stream_is_thin(tp) &&
icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) {
icsk->icsk_backoff = 0;
- icsk->icsk_rto = min(__tcp_set_rto(tp), TCP_RTO_MAX);
+ icsk->icsk_rto = clamp(__tcp_set_rto(tp),
+ tcp_rto_min(sk),
+ TCP_RTO_MAX);
} else {
/* Use normal (exponential) backoff */
icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
^ permalink raw reply [flat|nested] 227+ messages in thread
* [PATCH 6.1 194/194] mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 193/194] net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled Greg Kroah-Hartman
@ 2023-08-21 19:42 ` Greg Kroah-Hartman
2023-08-21 22:58 ` [PATCH 6.1 000/194] 6.1.47-rc1 review Joel Fernandes
` (10 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-21 19:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König, Yangtao Li,
Adrian Hunter, Ulf Hansson
From: Yangtao Li <frank.li@vivo.com>
commit 58abdd80b93b09023ca03007b608685c41e3a289 upstream.
The order of function calls in sdhci_f_sdh30_remove is wrong,
let's call sdhci_pltfm_unregister first.
Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Fixes: 5def5c1c15bf ("mmc: sdhci-f-sdh30: Replace with sdhci_pltfm")
Signed-off-by: Yangtao Li <frank.li@vivo.com>
Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230727070051.17778-62-frank.li@vivo.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci_f_sdh30.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/mmc/host/sdhci_f_sdh30.c
+++ b/drivers/mmc/host/sdhci_f_sdh30.c
@@ -188,12 +188,14 @@ static int sdhci_f_sdh30_remove(struct p
{
struct sdhci_host *host = platform_get_drvdata(pdev);
struct f_sdhost_priv *priv = sdhci_f_sdhost_priv(host);
-
- clk_disable_unprepare(priv->clk_iface);
- clk_disable_unprepare(priv->clk);
+ struct clk *clk_iface = priv->clk_iface;
+ struct clk *clk = priv->clk;
sdhci_pltfm_unregister(pdev);
+ clk_disable_unprepare(clk_iface);
+ clk_disable_unprepare(clk);
+
return 0;
}
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2023-08-21 19:42 ` [PATCH 6.1 194/194] mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove Greg Kroah-Hartman
@ 2023-08-21 22:58 ` Joel Fernandes
2023-08-22 15:41 ` Joel Fernandes
2023-08-21 23:35 ` Takeshi Ogasawara
` (9 subsequent siblings)
204 siblings, 1 reply; 227+ messages in thread
From: Joel Fernandes @ 2023-08-21 22:58 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.47 release.
> There are 194 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
For RCU,
Tested-by: Joel Fernandes (Google) <joel@joelfernandes.org>
thanks,
- Joel
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 6.1.47-rc1
>
> Yangtao Li <frank.li@vivo.com>
> mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
>
> Jason Xing <kernelxing@tencent.com>
> net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
>
> Karol Herbst <kherbst@redhat.com>
> drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> af_unix: Fix null-ptr-deref in unix_stream_sendpage().
>
> Guchun Chen <guchun.chen@amd.com>
> drm/amdgpu: keep irq count in amdgpu_irq_disable_all
>
> Tim Huang <Tim.Huang@amd.com>
> drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11
>
> Mark Brown <broonie@kernel.org>
> arm64/ptrace: Ensure that SME is set up for target when writing SSVE state
>
> Borislav Petkov (AMD) <bp@alien8.de>
> x86/srso: Correct the mitigation status when SMT is disabled
>
> Peter Zijlstra <peterz@infradead.org>
> objtool/x86: Fixup frame-pointer vs rethunk
>
> Petr Pavlu <petr.pavlu@suse.com>
> x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG
>
> Borislav Petkov (AMD) <bp@alien8.de>
> x86/srso: Disable the mitigation on unaffected configurations
>
> Borislav Petkov (AMD) <bp@alien8.de>
> x86/CPU/AMD: Fix the DIV(0) initial fix attempt
>
> Sean Christopherson <seanjc@google.com>
> x86/retpoline: Don't clobber RFLAGS during srso_safe_ret()
>
> Peter Zijlstra <peterz@infradead.org>
> x86/static_call: Fix __static_call_fixup()
>
> Borislav Petkov (AMD) <bp@alien8.de>
> x86/srso: Explain the untraining sequences a bit more
>
> Peter Zijlstra <peterz@infradead.org>
> x86/cpu: Cleanup the untrain mess
>
> Peter Zijlstra <peterz@infradead.org>
> x86/cpu: Rename srso_(.*)_alias to srso_alias_\1
>
> Peter Zijlstra <peterz@infradead.org>
> x86/cpu: Rename original retbleed methods
>
> Peter Zijlstra <peterz@infradead.org>
> x86/cpu: Clean up SRSO return thunk mess
>
> Peter Zijlstra <peterz@infradead.org>
> x86/alternative: Make custom return thunk unconditional
>
> Peter Zijlstra <peterz@infradead.org>
> x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
>
> Peter Zijlstra <peterz@infradead.org>
> x86/cpu: Fix __x86_return_thunk symbol type
>
> Xin Long <lucien.xin@gmail.com>
> netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
>
> Mike Kravetz <mike.kravetz@oracle.com>
> hugetlb: do not clear hugetlb dtor until allocating vmemmap
>
> Saaem Rizvi <SyedSaaem.Rizvi@amd.com>
> drm/amd/display: Implement workaround for writing to OTG_PIXEL_RATE_DIV register
>
> Vincent Guittot <vincent.guittot@linaro.org>
> sched/fair: Remove capacity inversion detection
>
> Vincent Guittot <vincent.guittot@linaro.org>
> sched/fair: unlink misfit task from cpu overutilized
>
> Sergey Senozhatsky <senozhatsky@chromium.org>
> zsmalloc: allow only one active pool compaction context
>
> Daniel Miess <daniel.miess@amd.com>
> drm/amd/display: disable RCO for DCN314
>
> Arnd Bergmann <arnd@arndb.de>
> ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG
>
> Umio Yasuno <coelacanth_dream@protonmail.com>
> drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7
>
> Tim Huang <Tim.Huang@amd.com>
> drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix
>
> Mario Limonciello <mario.limonciello@amd.com>
> drm/amd: flush any delayed gfxoff on suspend entry
>
> Jani Nikula <jani.nikula@intel.com>
> drm/i915/sdvo: fix panel_type initialization
>
> Wander Lairson Costa <wander@redhat.com>
> drm/qxl: fix UAF on handle creation
>
> Yibin Ding <yibin.ding@unisoc.com>
> mmc: block: Fix in_flight[issue_type] value error
>
> Yang Yingliang <yangyingliang@huawei.com>
> mmc: wbsd: fix double mmc_free_host() in wbsd_init()
>
> Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
> blk-crypto: dynamically allocate fallback profile
>
> Yogesh Hegde <yogi.kernel@gmail.com>
> arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards
>
> Hawkins Jiawei <yin31149@gmail.com>
> virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case
>
> Mingzheng Xing <xingmingzheng@iscas.ac.cn>
> riscv: Handle zicsr/zifencei issue between gcc and binutils
>
> Russell Harmon via samba-technical <samba-technical@lists.samba.org>
> cifs: Release folio lock on fscache read hit.
>
> dengxiang <dengxiang@nfschina.com>
> ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
>
> Tony Lindgren <tony@atomide.com>
> serial: 8250: Fix oops for port->pm on uart_change_pm()
>
> Alexandre Ghiti <alexghiti@rivosinc.com>
> riscv: uaccess: Return the number of bytes effectively not copied
>
> Kailang Yang <kailang@realtek.com>
> ALSA: hda/realtek - Remodified 3k pull low procedure
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> soc: aspeed: socinfo: Add kfree for kstrdup
>
> Zev Weiss <zev@bewilderbeest.net>
> soc: aspeed: uart-routing: Use __sysfs_match_string
>
> Stefan Binding <sbinding@opensource.cirrus.com>
> ALSA: hda/realtek: Add quirks for HP G11 Laptops
>
> Jerome Brunet <jbrunet@baylibre.com>
> ASoC: meson: axg-tdm-formatter: fix channel slot allocation
>
> Zhang Shurong <zhang_shurong@foxmail.com>
> ASoC: rt5665: add missed regulator_bulk_disable
>
> Alexander Stein <alexander.stein@ew.tq-group.com>
> arm64: dts: imx93: Fix anatop node size
>
> Xiaolei Wang <xiaolei.wang@windriver.com>
> ARM: dts: imx: Set default tuning step for imx6sx usdhc
>
> Fabio Estevam <festevam@denx.de>
> arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration
>
> Andrej Picej <andrej.picej@norik.com>
> ARM: dts: imx6: phytec: fix RTC interrupt level
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: imx: align LED node names with dtschema
>
> Christopher Obbard <chris.obbard@collabora.com>
> arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+
>
> Christopher Obbard <chris.obbard@collabora.com>
> arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict
>
> Tony Lindgren <tony@atomide.com>
> bus: ti-sysc: Flush posted write on enable before reset
>
> Marcin Szycik <marcin.szycik@linux.intel.com>
> ice: Block switchdev mode when ADQ is active and vice versa
>
> Manish Chopra <manishc@marvell.com>
> qede: fix firmware halt over suspend and resume
>
> Eric Dumazet <edumazet@google.com>
> net: do not allow gso_size to be set to GSO_BY_FRAGS
>
> Abel Wu <wuyun.abel@bytedance.com>
> sock: Fix misuse of sk_under_memory_pressure()
>
> Edward Cree <ecree.xilinx@gmail.com>
> sfc: don't unregister flow_indr if it was never registered
>
> Alfred Lee <l00g33k@gmail.com>
> net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
>
> Andrii Staikov <andrii.staikov@intel.com>
> i40e: fix misleading debug logs
>
> Piotr Gardocki <piotrx.gardocki@intel.com>
> iavf: fix FDIR rule fields masks validation
>
> Jakub Kicinski <kuba@kernel.org>
> net: openvswitch: reject negative ifindex
>
> Ziyang Xuan <william.xuanziyang@huawei.com>
> team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
>
> Justin Chen <justin.chen@broadcom.com>
> net: phy: broadcom: stub c45 read/write for 54810
>
> Pablo Neira Ayuso <pablo@netfilter.org>
> netfilter: nft_dynset: disallow object maps
>
> Sishuai Gong <sishuai.system@gmail.com>
> ipvs: fix racy memcpy in proc_do_sync_threshold
>
> Florian Westphal <fw@strlen.de>
> netfilter: nf_tables: deactivate catchall elements in next generation
>
> Florian Westphal <fw@strlen.de>
> netfilter: nf_tables: fix false-positive lockdep splat
>
> Michal Schmidt <mschmidt@redhat.com>
> octeon_ep: cancel tx_timeout_task later in remove sequence
>
> Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
> net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source
>
> Luca Ceresoli <luca.ceresoli@bootlin.com>
> drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
>
> Petr Machata <petrm@nvidia.com>
> selftests: mirror_gre_changes: Tighten up the TTL test match
>
> Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
> net: phy: fix IRQ-based wake-on-lan over hibernate / power off
>
> Xiang Yang <xiangyang3@huawei.com>
> net: pcs: Add missing put_device call in miic_create
>
> Jason Wang <jasowang@redhat.com>
> virtio-net: set queues after driver_ok
>
> Laurent Vivier <lvivier@redhat.com>
> virtio_net: notify MAC address change on device initialization
>
> Lin Ma <linma@zju.edu.cn>
> xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
>
> Lin Ma <linma@zju.edu.cn>
> xfrm: add NULL check in xfrm_update_ae_params
>
> Zhengchao Shao <shaozhengchao@huawei.com>
> ip_vti: fix potential slab-use-after-free in decode_session6
>
> Zhengchao Shao <shaozhengchao@huawei.com>
> ip6_vti: fix slab-use-after-free in decode_session6
>
> Zhengchao Shao <shaozhengchao@huawei.com>
> xfrm: fix slab-use-after-free in decode_session6
>
> Lin Ma <linma@zju.edu.cn>
> net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
>
> Lin Ma <linma@zju.edu.cn>
> net: af_key: fix sadb_x_filter validation
>
> Lin Ma <linma@zju.edu.cn>
> net: xfrm: Fix xfrm_address_filter OOB read
>
> Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
> i2c: designware: Handle invalid SMBus block data response length value
>
> Quan Nguyen <quan@os.amperecomputing.com>
> i2c: designware: Correct length byte validation logic
>
> xiaoshoukui <xiaoshoukui@gmail.com>
> btrfs: fix BUG_ON condition in btrfs_cancel_balance
>
> Josef Bacik <josef@toxicpanda.com>
> btrfs: fix incorrect splitting in btrfs_drop_extent_map_range
>
> Sherry Sun <sherry.sun@nxp.com>
> tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms
>
> Yi Yang <yiyang13@huawei.com>
> tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
>
> Dragos Tatulea <dtatulea@nvidia.com>
> vdpa: Enable strict validation for netlinks ops
>
> Lin Ma <linma@zju.edu.cn>
> vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
>
> Lin Ma <linma@zju.edu.cn>
> vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
>
> Lin Ma <linma@zju.edu.cn>
> vdpa: Add features attr to vdpa_nl_policy for nlattr length check
>
> Nathan Lynch <nathanl@linux.ibm.com>
> powerpc/rtas_flash: allow user copy to flash block cache objects
>
> Yuanjun Gong <ruc_gongyuanjun@163.com>
> fbdev: mmp: fix value check in mmphw_probe()
>
> Parker Newman <pnewman@connecttech.com>
> i2c: tegra: Fix i2c-tegra DMA config option processing
>
> Yicong Yang <yangyicong@hisilicon.com>
> i2c: hisi: Only handle the interrupt of the driver's transfer
>
> Chengfeng Ye <dg573847474@gmail.com>
> i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
>
> Steve French <stfrench@microsoft.com>
> cifs: fix potential oops in cifs_oplock_break
>
> Eugenio Pérez <eperezma@redhat.com>
> vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary
>
> Dragos Tatulea <dtatulea@nvidia.com>
> vdpa/mlx5: Fix mr->initialized semantics
>
> Maxime Coquelin <maxime.coquelin@redhat.com>
> vduse: Use proper spinlock for IRQ injection
>
> Wolfram Sang <wsa+renesas@sang-engineering.com>
> virtio-mmio: don't break lifecycle of vm_dev
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix use-after-free of new block group that became unused
>
> David Sterba <dsterba@suse.com>
> btrfs: convert btrfs_block_group::seq_zone to runtime flag
>
> David Sterba <dsterba@suse.com>
> btrfs: convert btrfs_block_group::needs_free_space to runtime flag
>
> Naohiro Aota <naota@elisp.net>
> btrfs: move out now unused BG from the reclaim list
>
> Daniel Vetter <daniel.vetter@ffwll.ch>
> video/aperture: Only remove sysfb on the default vga pci device
>
> Thomas Zimmermann <tzimmermann@suse.de>
> fbdev/hyperv-fb: Do not set struct fb_info.apertures
>
> Xu Yang <xu.yang_2@nxp.com>
> ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
>
> Marc Zyngier <maz@kernel.org>
> KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption
>
> Hersen Wu <hersenxs.wu@amd.com>
> drm/amd/display: fix access hdcp_workqueue assert
>
> hersen wu <hersenxs.wu@amd.com>
> drm/amd/display: phase3 mst hdcp for multiple displays
>
> hersen wu <hersenxs.wu@amd.com>
> drm/amd/display: save restore hdcp state when display is unplugged from mst hub
>
> Song Yoong Siang <yoong.siang.song@intel.com>
> igc: read before write to SRRCTL register
>
> Chen Lin <chen.lin5@zte.com.cn>
> ring-buffer: Do not swap cpu_buffer during resize process
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Bluetooth: MGMT: Use correct address for memcpy()
>
> Benjamin Gray <bgray@linux.ibm.com>
> powerpc/kasan: Disable KCOV in KASAN code
>
> Luke D. Jones <luke@ljones.dev>
> ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V
>
> Luke D. Jones <luke@ljones.dev>
> ALSA: hda/realtek: Add quirk for ASUS ROG GA402X
>
> Luke D. Jones <luke@ljones.dev>
> ALSA: hda/realtek: Add quirk for ASUS ROG GX650P
>
> Tuo Li <islituo@gmail.com>
> ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
>
> dengxiang <dengxiang@nfschina.com>
> ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
>
> Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
> fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
>
> Jia-Ju Bai <baijiaju@buaa.edu.cn>
> fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
>
> Edward Lo <loyuantsung@gmail.com>
> fs/ntfs3: Enhance sanity check while generating attr_list
>
> shanzhulig <shanzhulig@gmail.com>
> drm/amdgpu: Fix potential fence use-after-free v2
>
> Xiubo Li <xiubli@redhat.com>
> ceph: try to dump the msgs when decoding fails
>
> Matthew Anderson <ruinairas1992@gmail.com>
> Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
>
> Zhengping Jiang <jiangzp@google.com>
> Bluetooth: L2CAP: Fix use-after-free
>
> Yuechao Zhao <yuechao.zhao@advantech.com.cn>
> watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
>
> Zhang Shurong <zhang_shurong@foxmail.com>
> firewire: net: fix use after free in fwnet_finish_incoming_packet()
>
> Mika Westerberg <mika.westerberg@linux.intel.com>
> thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth
>
> Mika Westerberg <mika.westerberg@linux.intel.com>
> thunderbolt: Add Intel Barlow Ridge PCI ID
>
> Armin Wolf <W_Armin@gmx.de>
> pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
>
> Tuo Li <islituo@gmail.com>
> gfs2: Fix possible data races in gfs2_show_options()
>
> Xu Yang <xu.yang_2@nxp.com>
> usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
>
> Xu Yang <xu.yang_2@nxp.com>
> usb: chipidea: imx: don't request QoS for imx8ulp
>
> Mika Westerberg <mika.westerberg@linux.intel.com>
> thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx()
>
> Hans Verkuil <hverkuil-cisco@xs4all.nl>
> media: platform: mediatek: vpu: fix NULL ptr dereference
>
> Avichal Rakesh <arakesh@google.com>
> usb: gadget: uvc: queue empty isoc requests if no video buffer is available
>
> Prashanth K <quic_prashk@quicinc.com>
> usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
>
> Andrey Konovalov <andrey.konovalov@linaro.org>
> media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250
>
> Yunfei Dong <yunfei.dong@mediatek.com>
> media: v4l2-mem2mem: add lock to protect parameter num_rdy
>
> Lu Hongfei <luhongfei@vivo.com>
> led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops
>
> Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> serial: stm32: Ignore return value of uart_remove_one_port() in .remove()
>
> Winston Wen <wentao@uniontech.com>
> cifs: fix session state check in reconnect to avoid use-after-free issue
>
> Paulo Alcantara <pc@manguebit.com>
> smb: client: fix warning in cifs_smb3_do_mount()
>
> Matthew Anderson <ruinairas1992@gmail.com>
> ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio
>
> Even Xu <even.xu@intel.com>
> HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID
>
> Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
> ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown()
>
> Daniel Miess <daniel.miess@amd.com>
> drm/amd/display: Enable dcn314 DPP RCO
>
> Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
> drm/amd/display: Skip DPP DTO update if root clock is gated
>
> Patrisious Haddad <phaddad@nvidia.com>
> RDMA/mlx5: Return the firmware result upon destroying QP/RQ
>
> Alvin Lee <alvin.lee2@amd.com>
> drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz
>
> Lang Yu <Lang.Yu@amd.com>
> drm/amdgpu: install stub fence into potential unused fence pointers
>
> Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
> iommu/amd: Introduce Disable IRTE Caching Support
>
> stuarthayhurst <stuart.a.hayhurst@gmail.com>
> HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard
>
> Ofir Bitton <obitton@habana.ai>
> accel/habanalabs: add pci health check during heartbeat
>
> gaoxu <gaoxu2@hihonor.com>
> dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
>
> Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
> ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> iopoll: Call cpu_relax() in busy loops
>
> Uday M Bhat <uday.m.bhat@intel.com>
> ASoC: Intel: sof_sdw: Add support for Rex soundwire
>
> Bard Liao <yung-chuan.liao@linux.intel.com>
> ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in _exit
>
> Oleksij Rempel <linux@rempel-privat.de>
> ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
>
> Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
> ASoC: amd: vangogh: Add check for acp config flags in vangogh platform
>
> Wolfram Sang <wsa+renesas@sang-engineering.com>
> drm: rcar-du: remove R-Car H3 ES1.* workarounds
>
> Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
> drm/stm: ltdc: fix late dereference check
>
> Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
> ASoC: SOF: amd: Add pci revision id check
>
> Sumit Gupta <sumitg@nvidia.com>
> PCI: tegra194: Fix possible array out of bounds access
>
> Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
> ASoC: Intel: sof_sdw: add quirk for LNL RVP
>
> Bard Liao <yung-chuan.liao@linux.intel.com>
> ASoC: Intel: sof_sdw: add quirk for MTL RVP
>
> Jack Xiao <Jack.Xiao@amd.com>
> drm/amdgpu: fix memory leak in mes self test
>
> hackyzh002 <hackyzh002@gmail.com>
> drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
>
> Longlong Yao <Longlong.Yao@amd.com>
> drm/amdgpu: fix calltrace warning in amddrm_buddy_fini
>
> Li Yang <leoyang.li@nxp.com>
> net: phy: at803x: fix the wol setting functions
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> net: phy: at803x: Use devm_regulator_get_enable_optional()
>
> Gerd Bayer <gbayer@linux.ibm.com>
> net/smc: Fix setsockopt and sysctl to specify same buffer size again
>
> D. Wythe <alibuda@linux.alibaba.com>
> net/smc: replace mutex rmbs_lock and sndbufs_lock with rw_semaphore
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: forwarding: tc_actions: Use ncat instead of nc
>
> Davide Caratti <dcaratti@redhat.com>
> selftests: forwarding: tc_actions: cleanup temporary files when test is aborted
>
> Andrew Yang <andrew.yang@mediatek.com>
> zsmalloc: fix races between modifications of fullness and isolated
>
> Nhat Pham <nphamcs@gmail.com>
> zsmalloc: consolidate zs_pool's migrate_lock and size_class's locks
>
> Maulik Shah <quic_mkshah@quicinc.com>
> cpuidle: psci: Move enabling OSI mode after power domains creation
>
> Ulf Hansson <ulf.hansson@linaro.org>
> cpuidle: psci: Extend information in log about OSI/PC mode
>
> Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
> mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
>
>
> -------------
>
> Diffstat:
>
> Documentation/admin-guide/hw-vuln/srso.rst | 4 +-
> Documentation/admin-guide/kernel-parameters.txt | 1 +
> Makefile | 4 +-
> arch/arm/boot/dts/imx50-kobo-aura.dts | 2 +-
> arch/arm/boot/dts/imx53-cx9020.dts | 10 +-
> arch/arm/boot/dts/imx53-m53evk.dts | 4 +-
> arch/arm/boot/dts/imx53-m53menlo.dts | 6 +-
> arch/arm/boot/dts/imx53-tx53.dtsi | 2 +-
> arch/arm/boot/dts/imx53-usbarmory.dts | 2 +-
> arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi | 6 +-
> arch/arm/boot/dts/imx6dl-prtrvt.dts | 4 +
> arch/arm/boot/dts/imx6dl-riotboard.dts | 4 +-
> arch/arm/boot/dts/imx6dl-yapp4-common.dtsi | 6 +-
> arch/arm/boot/dts/imx6q-gw5400-a.dts | 6 +-
> arch/arm/boot/dts/imx6q-h100.dts | 6 +-
> arch/arm/boot/dts/imx6q-kp.dtsi | 4 +-
> arch/arm/boot/dts/imx6q-marsboard.dts | 4 +-
> arch/arm/boot/dts/imx6q-tbs2910.dts | 2 +-
> arch/arm/boot/dts/imx6qdl-emcon.dtsi | 4 +-
> arch/arm/boot/dts/imx6qdl-gw51xx.dtsi | 4 +-
> arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 6 +-
> arch/arm/boot/dts/imx6qdl-gw53xx.dtsi | 6 +-
> arch/arm/boot/dts/imx6qdl-gw54xx.dtsi | 6 +-
> arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 2 +-
> arch/arm/boot/dts/imx6qdl-gw552x.dtsi | 6 +-
> arch/arm/boot/dts/imx6qdl-gw553x.dtsi | 4 +-
> arch/arm/boot/dts/imx6qdl-gw560x.dtsi | 6 +-
> arch/arm/boot/dts/imx6qdl-gw5903.dtsi | 2 +-
> arch/arm/boot/dts/imx6qdl-gw5904.dtsi | 6 +-
> arch/arm/boot/dts/imx6qdl-gw5907.dtsi | 4 +-
> arch/arm/boot/dts/imx6qdl-gw5910.dtsi | 6 +-
> arch/arm/boot/dts/imx6qdl-gw5912.dtsi | 6 +-
> arch/arm/boot/dts/imx6qdl-gw5913.dtsi | 4 +-
> arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi | 10 +-
> arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi | 4 +-
> arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi | 8 +-
> arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 4 +-
> arch/arm/boot/dts/imx6qdl-prti6q.dtsi | 11 +-
> arch/arm/boot/dts/imx6qdl-rex.dtsi | 2 +-
> arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 2 +-
> arch/arm/boot/dts/imx6qdl-sabresd.dtsi | 2 +-
> arch/arm/boot/dts/imx6qdl-ts7970.dtsi | 4 +-
> arch/arm/boot/dts/imx6qdl-tx6.dtsi | 2 +-
> arch/arm/boot/dts/imx6sl-evk.dts | 2 +-
> arch/arm/boot/dts/imx6sll-evk.dts | 2 +-
> arch/arm/boot/dts/imx6sll.dtsi | 2 +-
> arch/arm/boot/dts/imx6sx-sabreauto.dts | 2 +-
> arch/arm/boot/dts/imx6sx-udoo-neo.dtsi | 4 +-
> arch/arm/boot/dts/imx6sx.dtsi | 6 +
> arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi | 2 +-
> arch/arm/boot/dts/imx6ul-tx6ul.dtsi | 2 +-
> arch/arm64/boot/dts/freescale/imx8mm.dtsi | 7 +-
> arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +-
> arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +-
> .../boot/dts/rockchip/rk3399-rock-4c-plus.dts | 3 +-
> arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 6 +-
> arch/arm64/include/asm/fpsimd.h | 4 +-
> arch/arm64/include/asm/kvm_host.h | 2 +
> arch/arm64/kernel/fpsimd.c | 6 +-
> arch/arm64/kernel/ptrace.c | 9 +-
> arch/arm64/kernel/signal.c | 2 +-
> arch/arm64/kvm/arm.c | 6 +-
> arch/arm64/kvm/vgic/vgic-v3.c | 2 +-
> arch/arm64/kvm/vgic/vgic-v4.c | 7 +-
> arch/powerpc/kernel/rtas_flash.c | 6 +-
> arch/powerpc/mm/kasan/Makefile | 1 +
> arch/riscv/Kconfig | 28 +--
> arch/riscv/kernel/compat_vdso/Makefile | 8 +-
> arch/riscv/lib/uaccess.S | 11 +-
> arch/x86/include/asm/entry-common.h | 1 +
> arch/x86/include/asm/nospec-branch.h | 28 +--
> arch/x86/kernel/cpu/amd.c | 1 +
> arch/x86/kernel/cpu/bugs.c | 28 ++-
> arch/x86/kernel/static_call.c | 13 ++
> arch/x86/kernel/traps.c | 2 -
> arch/x86/kernel/vmlinux.lds.S | 20 +-
> arch/x86/kvm/svm/svm.c | 2 +
> arch/x86/lib/retpoline.S | 141 +++++++++-----
> block/blk-crypto-fallback.c | 36 ++--
> drivers/bluetooth/btusb.c | 3 +
> drivers/bus/ti-sysc.c | 2 +
> drivers/cpuidle/cpuidle-psci-domain.c | 42 ++--
> drivers/firewire/net.c | 6 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 8 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 41 +++-
> drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 9 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 1 -
> drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +-
> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 211 +++++++++++++++++----
> .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h | 14 ++
> .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 30 +++
> drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.h | 3 +-
> drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c | 8 +
> .../gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 5 +
> .../drm/amd/display/dc/dcn314/dcn314_resource.c | 20 ++
> drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c | 22 +++
> drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.h | 3 +-
> drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 2 +-
> .../gpu/drm/amd/display/dc/dcn32/dcn32_resource.h | 3 +-
> .../amd/display/dc/dml/dcn32/display_mode_vba_32.c | 4 +-
> .../amd/display/dc/dml/dcn32/display_mode_vba_32.h | 2 +-
> drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h | 1 +
> drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 +-
> .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 14 +-
> drivers/gpu/drm/i915/display/intel_sdvo.c | 2 +-
> drivers/gpu/drm/nouveau/nouveau_connector.c | 8 +-
> drivers/gpu/drm/panel/panel-simple.c | 24 +--
> drivers/gpu/drm/qxl/qxl_drv.h | 2 +-
> drivers/gpu/drm/qxl/qxl_dumb.c | 5 +-
> drivers/gpu/drm/qxl/qxl_gem.c | 25 ++-
> drivers/gpu/drm/qxl/qxl_ioctl.c | 6 +-
> drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 37 +---
> drivers/gpu/drm/rcar-du/rcar_du_drv.c | 48 -----
> drivers/gpu/drm/rcar-du/rcar_du_drv.h | 2 -
> drivers/gpu/drm/rcar-du/rcar_du_regs.h | 3 +-
> drivers/gpu/drm/stm/ltdc.c | 4 +-
> drivers/hid/hid-logitech-hidpp.c | 4 +
> drivers/hid/intel-ish-hid/ipc/hw-ish.h | 1 +
> drivers/hid/intel-ish-hid/ipc/pci-ish.c | 1 +
> drivers/i2c/busses/i2c-bcm-iproc.c | 11 +-
> drivers/i2c/busses/i2c-designware-master.c | 16 +-
> drivers/i2c/busses/i2c-hisi.c | 8 +
> drivers/i2c/busses/i2c-tegra.c | 2 +-
> drivers/infiniband/hw/mlx5/qpc.c | 10 +-
> drivers/iommu/amd/amd_iommu_types.h | 4 +
> drivers/iommu/amd/init.c | 36 ++++
> drivers/leds/rgb/leds-qcom-lpg.c | 8 +-
> drivers/media/platform/mediatek/vpu/mtk_vpu.c | 6 +-
> drivers/media/platform/qcom/camss/camss-vfe.c | 6 +-
> drivers/misc/habanalabs/common/device.c | 15 +-
> drivers/misc/habanalabs/common/habanalabs.h | 2 +
> drivers/misc/habanalabs/common/habanalabs_drv.c | 2 -
> drivers/mmc/core/block.c | 7 +-
> drivers/mmc/host/sdhci_f_sdh30.c | 66 +++----
> drivers/mmc/host/wbsd.c | 2 -
> drivers/net/dsa/mv88e6xxx/chip.c | 8 +
> drivers/net/ethernet/cadence/macb_main.c | 9 +-
> drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 +-
> drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 10 +
> drivers/net/ethernet/intel/iavf/iavf_fdir.c | 77 +++++++-
> drivers/net/ethernet/intel/iavf/iavf_fdir.h | 2 +
> drivers/net/ethernet/intel/ice/ice_eswitch.c | 6 +
> drivers/net/ethernet/intel/ice/ice_main.c | 5 +
> drivers/net/ethernet/intel/igc/igc_base.h | 11 +-
> drivers/net/ethernet/intel/igc/igc_main.c | 7 +-
> .../net/ethernet/marvell/octeon_ep/octep_main.c | 2 +-
> drivers/net/ethernet/qlogic/qede/qede_main.c | 10 +
> drivers/net/ethernet/sfc/tc.c | 2 +-
> drivers/net/pcs/pcs-rzn1-miic.c | 10 +-
> drivers/net/phy/at803x.c | 89 ++++-----
> drivers/net/phy/broadcom.c | 13 ++
> drivers/net/phy/phy_device.c | 13 +-
> drivers/net/team/team.c | 4 +-
> drivers/net/virtio_net.c | 26 ++-
> drivers/pci/controller/dwc/pcie-tegra194.c | 13 +-
> drivers/pcmcia/rsrc_nonstatic.c | 2 +
> drivers/soc/aspeed/aspeed-socinfo.c | 1 +
> drivers/soc/aspeed/aspeed-uart-routing.c | 2 +-
> drivers/thunderbolt/nhi.c | 2 +
> drivers/thunderbolt/nhi.h | 4 +
> drivers/thunderbolt/quirks.c | 8 +
> drivers/thunderbolt/retimer.c | 29 ++-
> drivers/tty/n_gsm.c | 3 +-
> drivers/tty/serial/8250/8250_port.c | 1 +
> drivers/tty/serial/fsl_lpuart.c | 4 +-
> drivers/tty/serial/stm32-usart.c | 5 +-
> drivers/usb/chipidea/ci_hdrc_imx.c | 5 +
> drivers/usb/chipidea/usbmisc_imx.c | 2 +-
> drivers/usb/gadget/function/u_serial.c | 3 +
> drivers/usb/gadget/function/uvc_video.c | 32 +++-
> drivers/vdpa/mlx5/core/mlx5_vdpa.h | 2 +
> drivers/vdpa/mlx5/core/mr.c | 105 +++++++---
> drivers/vdpa/mlx5/net/mlx5_vnet.c | 4 +-
> drivers/vdpa/vdpa.c | 9 +-
> drivers/vdpa/vdpa_user/vduse_dev.c | 8 +-
> drivers/video/aperture.c | 7 +-
> drivers/video/fbdev/hyperv_fb.c | 17 +-
> drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +-
> drivers/virtio/virtio_mmio.c | 5 +-
> drivers/watchdog/sp5100_tco.c | 4 +-
> fs/btrfs/block-group.c | 14 +-
> fs/btrfs/block-group.h | 18 +-
> fs/btrfs/extent_map.c | 6 +-
> fs/btrfs/free-space-tree.c | 10 +-
> fs/btrfs/tests/free-space-tree-tests.c | 2 +-
> fs/btrfs/volumes.c | 3 +-
> fs/btrfs/zoned.c | 7 +-
> fs/ceph/mds_client.c | 4 +
> fs/gfs2/super.c | 26 +--
> fs/ntfs3/frecord.c | 16 +-
> fs/ntfs3/fsntfs.c | 2 +-
> fs/ntfs3/index.c | 6 +
> fs/ntfs3/ntfs_fs.h | 2 +
> fs/ntfs3/record.c | 10 +-
> fs/smb/client/cifsfs.c | 28 +--
> fs/smb/client/file.c | 25 ++-
> fs/smb/client/smb2pdu.c | 6 +
> include/kvm/arm_vgic.h | 2 +-
> include/linux/iopoll.h | 2 +
> include/linux/virtio_net.h | 4 +
> include/media/v4l2-mem2mem.h | 18 +-
> include/net/sock.h | 6 +
> kernel/dma/remap.c | 4 +-
> kernel/sched/fair.c | 193 +++++++++----------
> kernel/sched/sched.h | 19 --
> kernel/trace/ring_buffer.c | 14 +-
> kernel/trace/trace.c | 3 +-
> mm/hugetlb.c | 75 +++++---
> mm/zsmalloc.c | 113 +++++------
> net/bluetooth/l2cap_core.c | 5 +
> net/bluetooth/mgmt.c | 2 +-
> net/core/sock.c | 2 +-
> net/ipv4/ip_vti.c | 4 +-
> net/ipv4/tcp_timer.c | 4 +-
> net/ipv6/ip6_vti.c | 4 +-
> net/key/af_key.c | 4 +-
> net/netfilter/ipvs/ip_vs_ctl.c | 4 +
> net/netfilter/nf_conntrack_proto_sctp.c | 6 +-
> net/netfilter/nf_tables_api.c | 1 +
> net/netfilter/nft_dynset.c | 3 +
> net/netfilter/nft_set_pipapo.c | 13 +-
> net/openvswitch/datapath.c | 8 +-
> net/smc/af_smc.c | 4 +-
> net/smc/smc.h | 2 +-
> net/smc/smc_clc.c | 4 +-
> net/smc/smc_core.c | 80 ++++----
> net/smc/smc_core.h | 4 +-
> net/smc/smc_llc.c | 16 +-
> net/smc/smc_sysctl.c | 10 +-
> net/unix/af_unix.c | 9 +-
> net/xfrm/xfrm_compat.c | 2 +-
> net/xfrm/xfrm_interface_core.c | 4 +-
> net/xfrm/xfrm_user.c | 14 +-
> sound/hda/hdac_regmap.c | 7 +-
> sound/pci/hda/patch_realtek.c | 91 ++++++++-
> sound/soc/amd/Kconfig | 1 +
> sound/soc/amd/vangogh/acp5x.h | 2 +
> sound/soc/amd/vangogh/pci-acp5x.c | 7 +-
> sound/soc/codecs/rt5665.c | 2 +
> sound/soc/intel/boards/sof_sdw.c | 25 +++
> sound/soc/intel/boards/sof_sdw_rt711_sdca.c | 3 +
> sound/soc/meson/axg-tdm-formatter.c | 42 ++--
> sound/soc/sof/amd/acp.h | 3 +
> sound/soc/sof/amd/pci-rmb.c | 3 +
> sound/soc/sof/amd/pci-rn.c | 3 +
> sound/soc/sof/core.c | 4 +-
> sound/soc/sof/intel/hda.c | 12 +-
> sound/usb/quirks-table.h | 29 +++
> tools/objtool/arch/x86/decode.c | 2 +-
> tools/objtool/check.c | 21 +-
> .../selftests/net/forwarding/mirror_gre_changes.sh | 3 +-
> .../testing/selftests/net/forwarding/tc_actions.sh | 18 +-
> 255 files changed, 2074 insertions(+), 1100 deletions(-)
>
>
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2023-08-21 22:58 ` [PATCH 6.1 000/194] 6.1.47-rc1 review Joel Fernandes
@ 2023-08-21 23:35 ` Takeshi Ogasawara
2023-08-22 3:00 ` Bagas Sanjaya
` (8 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Takeshi Ogasawara @ 2023-08-21 23:35 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
Hi Greg
On Tue, Aug 22, 2023 at 4:51 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.1.47 release.
> There are 194 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
6.1.47-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2023-08-21 23:35 ` Takeshi Ogasawara
@ 2023-08-22 3:00 ` Bagas Sanjaya
2023-08-22 10:55 ` Naresh Kamboju
` (7 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Bagas Sanjaya @ 2023-08-22 3:00 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
[-- Attachment #1: Type: text/plain, Size: 559 bytes --]
On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.47 release.
> There are 194 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
Successfully compiled and installed bindeb-pkgs on my computer (Acer
Aspire E15, Intel Core i3 Haswell). No noticeable regressions.
Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
--
An old man doll... just what I always wanted! - Clara
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2023-08-22 3:00 ` Bagas Sanjaya
@ 2023-08-22 10:55 ` Naresh Kamboju
2023-08-22 15:27 ` Salvatore Bonaccorso
2023-08-22 11:01 ` SeongJae Park
` (6 subsequent siblings)
204 siblings, 1 reply; 227+ messages in thread
From: Naresh Kamboju @ 2023-08-22 10:55 UTC (permalink / raw)
To: Greg Kroah-Hartman, Paul E. McKenney, Borislav Petkov
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Tue, 22 Aug 2023 at 01:21, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.1.47 release.
> There are 194 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
NOTE:
Kernel warnings noticed on x86_64 while booting the kernel.
Paul E. McKenney reported this last week [1] and discussions email
thread provided here.
[1] https://lore.kernel.org/lkml/4dc3d0ec-b827-4bce-8927-cfa5d837fd03@paulmck-laptop/T/
------------[ cut here ]------------
[ 1.395392] missing return thunk: __ret+0x5/0x7e-__ret+0x0/0x7e: e9
f6 ff ff ff
[ 1.395399] WARNING: CPU: 0 PID: 0 at
arch/x86/kernel/alternative.c:574 apply_returns+0x1c0/0x3d0
[ 1.397391] Modules linked in:
[ 1.398392] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.47-rc1 #1
[ 1.399391] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS
2.5 11/26/2020
[ 1.400392] RIP: 0010:apply_returns+0x1c0/0x3d0
## Build
* kernel: 6.1.47-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-6.1.y
* git commit: 5165f4e9738c48a220a13b073c6ccc24824aeb74
* git describe: v6.1.46-195-g5165f4e9738c
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.1.y/build/v6.1.46-195-g5165f4e9738c
## Test Regressions (compared to v6.1.46)
## Metric Regressions (compared to v6.1.46)
## Test Fixes (compared to v6.1.46)
## Metric Fixes (compared to v6.1.46)
## Test result summary
total: 150677, pass: 127511, fail: 4079, skip: 18915, xfail: 172
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 147 total, 145 passed, 2 failed
* arm64: 49 total, 46 passed, 3 failed
* i386: 39 total, 37 passed, 2 failed
* mips: 30 total, 28 passed, 2 failed
* parisc: 3 total, 3 passed, 0 failed
* powerpc: 36 total, 34 passed, 2 failed
* riscv: 16 total, 13 passed, 3 failed
* s390: 16 total, 14 passed, 2 failed
* sh: 14 total, 12 passed, 2 failed
* sparc: 8 total, 8 passed, 0 failed
* x86_64: 46 total, 44 passed, 2 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* perf
* rcutorture
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2023-08-22 10:55 ` Naresh Kamboju
@ 2023-08-22 11:01 ` SeongJae Park
2023-08-22 14:08 ` Shuah Khan
` (5 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: SeongJae Park @ 2023-08-22 11:01 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, damon, SeongJae Park
Hello,
On Mon, 21 Aug 2023 21:39:39 +0200 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 6.1.47 release.
> There are 194 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
# TODO: Cc damon@lists.linux.dev
This rc kernel passes DAMON functionality test[1] on my test machine.
Attaching the test results summary below. Please note that I retrieved the
kernel from linux-stable-rc tree[2].
Tested-by: SeongJae Park <sj@kernel.org>
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] 5165f4e9738c ("Linux 6.1.47-rc1")
Thanks,
SJ
[...]
---
# .config:1408:warning: override: reassigning to symbol CGROUPS
ok 15 selftests: damon-tests: build_nomemcg.sh
# kselftest dir '/home/sjpark/damon-tests-cont/linux/tools/testing/selftests/damon-tests' is in dirty state.
# the log is at '/home/sjpark/log'.
[32m
ok 1 selftests: damon: debugfs_attrs.sh
ok 2 selftests: damon: debugfs_schemes.sh
ok 3 selftests: damon: debugfs_target_ids.sh
ok 4 selftests: damon: debugfs_empty_targets.sh
ok 5 selftests: damon: debugfs_huge_count_read_write.sh
ok 6 selftests: damon: debugfs_duplicate_context_creation.sh
ok 7 selftests: damon: sysfs.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh
ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_m68k.sh
ok 12 selftests: damon-tests: build_arm64.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
_remote_run_corr.sh SUCCESS
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2023-08-22 11:01 ` SeongJae Park
@ 2023-08-22 14:08 ` Shuah Khan
2023-08-22 20:23 ` Florian Fainelli
` (4 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Shuah Khan @ 2023-08-22 14:08 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, Shuah Khan
On 8/21/23 13:39, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.47 release.
> There are 194 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-22 10:55 ` Naresh Kamboju
@ 2023-08-22 15:27 ` Salvatore Bonaccorso
2023-08-22 15:51 ` Greg Kroah-Hartman
0 siblings, 1 reply; 227+ messages in thread
From: Salvatore Bonaccorso @ 2023-08-22 15:27 UTC (permalink / raw)
To: Naresh Kamboju
Cc: Greg Kroah-Hartman, Paul E. McKenney, Borislav Petkov, stable,
patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, Peter Zijlstra
Hi,
[Adding Peter Zijlstra to CC]
On Tue, Aug 22, 2023 at 04:25:22PM +0530, Naresh Kamboju wrote:
> On Tue, 22 Aug 2023 at 01:21, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > This is the start of the stable review cycle for the 6.1.47 release.
> > There are 194 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
> Results from Linaro’s test farm.
> No regressions on arm64, arm, x86_64, and i386.
>
> Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
>
>
> NOTE:
> Kernel warnings noticed on x86_64 while booting the kernel.
> Paul E. McKenney reported this last week [1] and discussions email
> thread provided here.
>
> [1] https://lore.kernel.org/lkml/4dc3d0ec-b827-4bce-8927-cfa5d837fd03@paulmck-laptop/T/
Seeing the same warning for the 6.1.47-rc1, which is missing
4ae68b26c3ab ("objtool/x86: Fix SRSO mess"). Unfortunately the commit
will not apply cleanly to 6.1.y.
I guess we need at least as well dbcdbdfdf137 ("objtool: Rework
instruction -> symbol mapping"), but not sure this is enough.
Peter, is this correct?
Regards,
Salvatore
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 22:58 ` [PATCH 6.1 000/194] 6.1.47-rc1 review Joel Fernandes
@ 2023-08-22 15:41 ` Joel Fernandes
0 siblings, 0 replies; 227+ messages in thread
From: Joel Fernandes @ 2023-08-22 15:41 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Mon, Aug 21, 2023 at 10:58:53PM +0000, Joel Fernandes wrote:
> On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 6.1.47 release.
> > There are 194 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
> For RCU,
> Tested-by: Joel Fernandes (Google) <joel@joelfernandes.org>
I am getting the following warning which started after my last
successful 6.1.47-rc1 run. Looks like others already reported it, but
I am just archiving my finding here:
Thanks.
[ 2.169887] ------------[ cut here ]------------
[ 2.170593] missing return thunk: __alt_instructions_end+0x2256/0x227c-srso_untrain_ret+0x0/0x2: e9 c7 a0 ed fe
[ 2.171678] WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:572 apply_returns+0x1fb/0x230
[ 2.173592] Modules linked in:
[ 2.174625] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.47-rc1-g9beeea9636e6 #299
[ 2.175608] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 2.176593] RIP: 0010:apply_returns+0x1fb/0x230
[ 2.177592] Code: a5 01 00 0f 85 ef fe ff ff 49 89 d8 b9 05 00 00 00 4c 89 f2 48 89 de 48 c7 c7 60 3e 9d ad c6 05 fa 2c a5 01 01 e8 45 2d 04 00 <0f> 0b e9 c7 fe ff ff c7 84 24 89 00 00 00 cc cc cc cc 42 c7 84 04
[ 2.179589] RSP: 0000:ffffffffadc03e28 EFLAGS: 00010286
[ 2.180592] RAX: 0000000000000000 RBX: ffffffffae5292f2 RCX: 0000000000000000
[ 2.181591] RDX: 0000000000000003 RSI: 0000000000000001 RDI: 00000000ffffffff
[ 2.182595] RBP: 0000000000000000 R08: 00000000ffffdfff R09: 00000000ffffdfff
[ 2.184589] R10: ffffffffadc574a0 R11: ffffffffadc574a0 R12: ffffffffadc03e40
[ 2.185591] R13: ffffffffae520414 R14: ffffffffad4033be R15: ffffffffae5203f0
[ 2.186650] FS: 0000000000000000(0000) GS:ffff953a5ca00000(0000) knlGS:0000000000000000
[ 2.187637] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2.188592] CR2: ffff953a5fa01000 CR3: 000000001ee0c000 CR4: 00000000000006f0
[ 2.189639] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2.191589] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 2.192593] Call Trace:
[ 2.194683] <TASK>
[ 2.195595] ? __warn+0x78/0xc0
[ 2.197592] ? apply_returns+0x1fb/0x230
[ 2.198593] ? report_bug+0xe6/0x170
[ 2.199592] ? console_unlock+0x1a3/0x210
[ 2.200594] ? handle_bug+0x3c/0x70
[ 2.201594] ? exc_invalid_op+0x13/0x60
[ 2.202594] ? asm_exc_invalid_op+0x16/0x20
[ 2.203595] ? retbleed_return_thunk+0x7e/0x7e
[ 2.205593] ? apply_returns+0x1fb/0x230
[ 2.206594] ? apply_returns+0x1fb/0x230
[ 2.207596] alternative_instructions+0x43/0xf2
[ 2.208672] arch_cpu_finalize_init+0x28/0x47
[ 2.210595] start_kernel+0x5f9/0x6a5
[ 2.211597] secondary_startup_64_no_verify+0xe0/0xeb
[ 2.213649] </TASK>>
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-22 15:27 ` Salvatore Bonaccorso
@ 2023-08-22 15:51 ` Greg Kroah-Hartman
2023-08-22 17:27 ` Greg Kroah-Hartman
0 siblings, 1 reply; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-22 15:51 UTC (permalink / raw)
To: Salvatore Bonaccorso
Cc: Naresh Kamboju, Paul E. McKenney, Borislav Petkov, stable,
patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, Peter Zijlstra
On Tue, Aug 22, 2023 at 05:27:02PM +0200, Salvatore Bonaccorso wrote:
> Hi,
>
> [Adding Peter Zijlstra to CC]
>
> On Tue, Aug 22, 2023 at 04:25:22PM +0530, Naresh Kamboju wrote:
> > On Tue, 22 Aug 2023 at 01:21, Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > This is the start of the stable review cycle for the 6.1.47 release.
> > > There are 194 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > Anything received after that time might be too late.
> > >
> > > The whole patch series can be found in one patch at:
> > > https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
> > > or in the git tree and branch at:
> > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> > > and the diffstat can be found below.
> > >
> > > thanks,
> > >
> > > greg k-h
> >
> > Results from Linaro’s test farm.
> > No regressions on arm64, arm, x86_64, and i386.
> >
> > Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
> >
> >
> > NOTE:
> > Kernel warnings noticed on x86_64 while booting the kernel.
> > Paul E. McKenney reported this last week [1] and discussions email
> > thread provided here.
> >
> > [1] https://lore.kernel.org/lkml/4dc3d0ec-b827-4bce-8927-cfa5d837fd03@paulmck-laptop/T/
>
> Seeing the same warning for the 6.1.47-rc1, which is missing
> 4ae68b26c3ab ("objtool/x86: Fix SRSO mess"). Unfortunately the commit
> will not apply cleanly to 6.1.y.
I tried, and failed, let me try again...
> I guess we need at least as well dbcdbdfdf137 ("objtool: Rework
> instruction -> symbol mapping"), but not sure this is enough.
That gets messy fast, I tried to backport all of the 6.4 objtool changes
to 6.1, but ugh, the changes were highly intertwined with many other
things.
greg k-h
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-22 15:51 ` Greg Kroah-Hartman
@ 2023-08-22 17:27 ` Greg Kroah-Hartman
0 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-22 17:27 UTC (permalink / raw)
To: Salvatore Bonaccorso
Cc: Naresh Kamboju, Paul E. McKenney, Borislav Petkov, stable,
patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, Peter Zijlstra
[-- Attachment #1: Type: text/plain, Size: 2446 bytes --]
On Tue, Aug 22, 2023 at 05:51:27PM +0200, Greg Kroah-Hartman wrote:
> On Tue, Aug 22, 2023 at 05:27:02PM +0200, Salvatore Bonaccorso wrote:
> > Hi,
> >
> > [Adding Peter Zijlstra to CC]
> >
> > On Tue, Aug 22, 2023 at 04:25:22PM +0530, Naresh Kamboju wrote:
> > > On Tue, 22 Aug 2023 at 01:21, Greg Kroah-Hartman
> > > <gregkh@linuxfoundation.org> wrote:
> > > >
> > > > This is the start of the stable review cycle for the 6.1.47 release.
> > > > There are 194 patches in this series, all will be posted as a response
> > > > to this one. If anyone has any issues with these being applied, please
> > > > let me know.
> > > >
> > > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > > Anything received after that time might be too late.
> > > >
> > > > The whole patch series can be found in one patch at:
> > > > https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
> > > > or in the git tree and branch at:
> > > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> > > > and the diffstat can be found below.
> > > >
> > > > thanks,
> > > >
> > > > greg k-h
> > >
> > > Results from Linaro’s test farm.
> > > No regressions on arm64, arm, x86_64, and i386.
> > >
> > > Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
> > >
> > >
> > > NOTE:
> > > Kernel warnings noticed on x86_64 while booting the kernel.
> > > Paul E. McKenney reported this last week [1] and discussions email
> > > thread provided here.
> > >
> > > [1] https://lore.kernel.org/lkml/4dc3d0ec-b827-4bce-8927-cfa5d837fd03@paulmck-laptop/T/
> >
> > Seeing the same warning for the 6.1.47-rc1, which is missing
> > 4ae68b26c3ab ("objtool/x86: Fix SRSO mess"). Unfortunately the commit
> > will not apply cleanly to 6.1.y.
>
> I tried, and failed, let me try again...
>
> > I guess we need at least as well dbcdbdfdf137 ("objtool: Rework
> > instruction -> symbol mapping"), but not sure this is enough.
>
> That gets messy fast, I tried to backport all of the 6.4 objtool changes
> to 6.1, but ugh, the changes were highly intertwined with many other
> things.
Hm, I applied that, but now I get build errors:
vmlinux.o: warning: objtool: retbleed_return_thunk(): can't find starting instruction
and
incomplete ORC unwind tables in file: vmlinux
Failed to sort kernel tables
Attached below is my backport, what did I get wrong?
thanks,
greg k-h
[-- Attachment #2: objtool-x86-fix-srso-mess.patch --]
[-- Type: text/plain, Size: 4967 bytes --]
From 4ae68b26c3ab5a82aa271e6e9fc9b1a06e1d6b40 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Mon, 14 Aug 2023 13:44:29 +0200
Subject: objtool/x86: Fix SRSO mess
From: Peter Zijlstra <peterz@infradead.org>
commit 4ae68b26c3ab5a82aa271e6e9fc9b1a06e1d6b40 upstream.
Objtool --rethunk does two things:
- it collects all (tail) call's of __x86_return_thunk and places them
into .return_sites. These are typically compiler generated, but
RET also emits this same.
- it fudges the validation of the __x86_return_thunk symbol; because
this symbol is inside another instruction, it can't actually find
the instruction pointed to by the symbol offset and gets upset.
Because these two things pertained to the same symbol, there was no
pressing need to separate these two separate things.
However, alas, along comes SRSO and more crazy things to deal with
appeared.
The SRSO patch itself added the following symbol names to identify as
rethunk:
'srso_untrain_ret', 'srso_safe_ret' and '__ret'
Where '__ret' is the old retbleed return thunk, 'srso_safe_ret' is a
new similarly embedded return thunk, and 'srso_untrain_ret' is
completely unrelated to anything the above does (and was only included
because of that INT3 vs UD2 issue fixed previous).
Clear things up by adding a second category for the embedded instruction
thing.
Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230814121148.704502245@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/objtool/arch/x86/decode.c | 11 +++++++----
tools/objtool/check.c | 24 ++++++++++++++++++++++--
tools/objtool/include/objtool/arch.h | 1 +
tools/objtool/include/objtool/elf.h | 1 +
4 files changed, 31 insertions(+), 6 deletions(-)
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -796,8 +796,11 @@ bool arch_is_retpoline(struct symbol *sy
bool arch_is_rethunk(struct symbol *sym)
{
- return !strcmp(sym->name, "__x86_return_thunk") ||
- !strcmp(sym->name, "srso_untrain_ret") ||
- !strcmp(sym->name, "srso_safe_ret") ||
- !strcmp(sym->name, "retbleed_return_thunk");
+ return !strcmp(sym->name, "__x86_return_thunk");
+}
+
+bool arch_is_embedded_insn(struct symbol *sym)
+{
+ return !strcmp(sym->name, "retbleed_return_thunk") ||
+ !strcmp(sym->name, "srso_safe_ret");
}
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -418,7 +418,7 @@ static int decode_instructions(struct ob
}
list_for_each_entry(func, &sec->symbol_list, list) {
- if (func->type != STT_FUNC || func->alias != func)
+ if (func->embedded_insn || func->alias != func)
continue;
if (!find_insn(file, sec, func->offset)) {
@@ -1164,16 +1164,33 @@ static int add_ignore_alternatives(struc
return 0;
}
+/*
+ * Symbols that replace INSN_CALL_DYNAMIC, every (tail) call to such a symbol
+ * will be added to the .retpoline_sites section.
+ */
__weak bool arch_is_retpoline(struct symbol *sym)
{
return false;
}
+/*
+ * Symbols that replace INSN_RETURN, every (tail) call to such a symbol
+ * will be added to the .return_sites section.
+ */
__weak bool arch_is_rethunk(struct symbol *sym)
{
return false;
}
+/*
+ * Symbols that are embedded inside other instructions, because sometimes crazy
+ * code exists. These are mostly ignored for validation purposes.
+ */
+__weak bool arch_is_embedded_insn(struct symbol *sym)
+{
+ return false;
+}
+
#define NEGATIVE_RELOC ((void *)-1L)
static struct reloc *insn_reloc(struct objtool_file *file, struct instruction *insn)
@@ -1437,7 +1454,7 @@ static int add_jump_destinations(struct
* middle of another instruction. Objtool only
* knows about the outer instruction.
*/
- if (sym && sym->return_thunk) {
+ if (sym && sym->embedded_insn) {
add_return_call(file, insn, false);
continue;
}
@@ -2327,6 +2344,9 @@ static int classify_symbols(struct objto
if (arch_is_rethunk(func))
func->return_thunk = true;
+ if (arch_is_embedded_insn(func))
+ func->embedded_insn = true;
+
if (!strcmp(func->name, "__fentry__"))
func->fentry = true;
--- a/tools/objtool/include/objtool/arch.h
+++ b/tools/objtool/include/objtool/arch.h
@@ -90,6 +90,7 @@ int arch_decode_hint_reg(u8 sp_reg, int
bool arch_is_retpoline(struct symbol *sym);
bool arch_is_rethunk(struct symbol *sym);
+bool arch_is_embedded_insn(struct symbol *sym);
int arch_rewrite_retpolines(struct objtool_file *file);
--- a/tools/objtool/include/objtool/elf.h
+++ b/tools/objtool/include/objtool/elf.h
@@ -60,6 +60,7 @@ struct symbol {
u8 return_thunk : 1;
u8 fentry : 1;
u8 profiling_func : 1;
+ u8 embedded_insn : 1;
struct list_head pv_target;
};
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2023-08-22 14:08 ` Shuah Khan
@ 2023-08-22 20:23 ` Florian Fainelli
2023-08-22 23:55 ` Ron Economos
` (3 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Florian Fainelli @ 2023-08-22 20:23 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, srw, rwarsow,
conor
On 8/21/23 12:39, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.47 release.
> There are 194 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2023-08-22 20:23 ` Florian Fainelli
@ 2023-08-22 23:55 ` Ron Economos
2023-08-23 0:49 ` Guenter Roeck
` (2 subsequent siblings)
204 siblings, 0 replies; 227+ messages in thread
From: Ron Economos @ 2023-08-22 23:55 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
On 8/21/23 12:39 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.47 release.
> There are 194 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.47-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2023-08-22 23:55 ` Ron Economos
@ 2023-08-23 0:49 ` Guenter Roeck
2023-08-23 7:03 ` Greg Kroah-Hartman
2023-08-23 8:54 ` Sudip Mukherjee (Codethink)
2023-08-23 9:35 ` Conor Dooley
204 siblings, 1 reply; 227+ messages in thread
From: Guenter Roeck @ 2023-08-23 0:49 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.47 release.
> There are 194 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 157 pass: 156 fail: 1
Failed builds:
m68k:sun3_defconfig
Qemu test results:
total: 521 pass: 519 fail: 2
Failed tests:
arm:fuji-bmc:aspeed_g5_defconfig:notests:mem1G:mtd128,0,8,1:net,nic:aspeed-bmc-facebook-fuji:f2fs
arm:bletchley-bmc,fmc-model=mt25qu02g,spi-model=mt25qu02g:aspeed_g5_defconfig:notests:mem1G:mtd256:net,nic:aspeed-bmc-facebook-bletchley:f2fs
The m68k build failure is
Inconsistent kallsyms data
Try make KALLSYMS_EXTRA_PASS=1 as a workaround
I already have KALLSYMS_EXTRA_PASS=1 enabled, so that doesn't help.
Nothing to worry about. The f2fs crashes are still seen. They
also happen for other architectures, so it is not just an arm problem.
I'll probably just disable all f2fs testing going forward. If so I'll
send a note clarifying that the lack of reported test failures doesn't
mean that it works.
For x86 I get the same runtime warning as everyone else.
Guenter
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 0:49 ` Guenter Roeck
@ 2023-08-23 7:03 ` Greg Kroah-Hartman
2023-08-23 8:17 ` Naresh Kamboju
2023-08-23 13:28 ` Guenter Roeck
0 siblings, 2 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-23 7:03 UTC (permalink / raw)
To: Guenter Roeck
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
On Tue, Aug 22, 2023 at 05:49:54PM -0700, Guenter Roeck wrote:
> On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 6.1.47 release.
> > There are 194 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 157 pass: 156 fail: 1
> Failed builds:
> m68k:sun3_defconfig
> Qemu test results:
> total: 521 pass: 519 fail: 2
> Failed tests:
> arm:fuji-bmc:aspeed_g5_defconfig:notests:mem1G:mtd128,0,8,1:net,nic:aspeed-bmc-facebook-fuji:f2fs
> arm:bletchley-bmc,fmc-model=mt25qu02g,spi-model=mt25qu02g:aspeed_g5_defconfig:notests:mem1G:mtd256:net,nic:aspeed-bmc-facebook-bletchley:f2fs
>
> The m68k build failure is
>
> Inconsistent kallsyms data
> Try make KALLSYMS_EXTRA_PASS=1 as a workaround
>
> I already have KALLSYMS_EXTRA_PASS=1 enabled, so that doesn't help.
> Nothing to worry about. The f2fs crashes are still seen. They
> also happen for other architectures, so it is not just an arm problem.
> I'll probably just disable all f2fs testing going forward. If so I'll
> send a note clarifying that the lack of reported test failures doesn't
> mean that it works.
I'll look into this later this week, next week to resolve the f2fs
stuff. I wanted to get to the other known bug fixes first.
> For x86 I get the same runtime warning as everyone else.
Yeah, this is troubling...
Is it clang only? I'll dig into this today...
thanks,
greg k-h
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 7:03 ` Greg Kroah-Hartman
@ 2023-08-23 8:17 ` Naresh Kamboju
2023-08-23 8:27 ` Greg Kroah-Hartman
2023-08-23 13:30 ` Guenter Roeck
2023-08-23 13:28 ` Guenter Roeck
1 sibling, 2 replies; 227+ messages in thread
From: Naresh Kamboju @ 2023-08-23 8:17 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Guenter Roeck, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Wed, 23 Aug 2023 at 12:33, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Tue, Aug 22, 2023 at 05:49:54PM -0700, Guenter Roeck wrote:
> > On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > > This is the start of the stable review cycle for the 6.1.47 release.
> > > There are 194 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > Anything received after that time might be too late.
> > >
> >
> > Build results:
> > total: 157 pass: 156 fail: 1
> > Failed builds:
> > m68k:sun3_defconfig
> > Qemu test results:
> > total: 521 pass: 519 fail: 2
> > Failed tests:
> > arm:fuji-bmc:aspeed_g5_defconfig:notests:mem1G:mtd128,0,8,1:net,nic:aspeed-bmc-facebook-fuji:f2fs
> > arm:bletchley-bmc,fmc-model=mt25qu02g,spi-model=mt25qu02g:aspeed_g5_defconfig:notests:mem1G:mtd256:net,nic:aspeed-bmc-facebook-bletchley:f2fs
> >
> > The m68k build failure is
> >
> > Inconsistent kallsyms data
> > Try make KALLSYMS_EXTRA_PASS=1 as a workaround
> >
> > I already have KALLSYMS_EXTRA_PASS=1 enabled, so that doesn't help.
> > Nothing to worry about. The f2fs crashes are still seen. They
> > also happen for other architectures, so it is not just an arm problem.
> > I'll probably just disable all f2fs testing going forward. If so I'll
> > send a note clarifying that the lack of reported test failures doesn't
> > mean that it works.
>
> I'll look into this later this week, next week to resolve the f2fs
> stuff. I wanted to get to the other known bug fixes first.
>
> > For x86 I get the same runtime warning as everyone else.
>
> Yeah, this is troubling...
>
> Is it clang only? I'll dig into this today...
It is seen with gcc-13 and clang-17 with few extra configs.
We are not booting defconfig.
The Kconfigs are enabled with KFENCE.
I see this from lore
"
This is from overnight testing that hit this only in the KCSAN runs.
The KASAN and non-debug runs had no trouble.
Thanx, Paul
"
steps to reproduce:
-------------------
tuxmake --runtime podman --target-arch x86_64 --toolchain gcc-13
--kconfig https://storage.tuxsuite.com/public/linaro/lkft/builds/2UJAv99Wwi6YMltFjlQD5XRO5x4/config
Here is the links to details and build details,
[1]
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.1.y/build/v6.1.46-195-g5165f4e9738c/testrun/19256276/suite/log-parser-boot/test/check-kernel-exception/details/
[2]
https://storage.tuxsuite.com/public/linaro/lkft/builds/2UJAv99Wwi6YMltFjlQD5XRO5x4/
[3]
https://storage.tuxsuite.com/public/linaro/lkft/builds/2UJAv99Wwi6YMltFjlQD5XRO5x4/config
- Naresh
>
> thanks,
>
> greg k-h
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 8:17 ` Naresh Kamboju
@ 2023-08-23 8:27 ` Greg Kroah-Hartman
2023-08-23 13:30 ` Guenter Roeck
1 sibling, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-23 8:27 UTC (permalink / raw)
To: Naresh Kamboju
Cc: Guenter Roeck, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Wed, Aug 23, 2023 at 01:47:39PM +0530, Naresh Kamboju wrote:
> On Wed, 23 Aug 2023 at 12:33, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Tue, Aug 22, 2023 at 05:49:54PM -0700, Guenter Roeck wrote:
> > > On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > > > This is the start of the stable review cycle for the 6.1.47 release.
> > > > There are 194 patches in this series, all will be posted as a response
> > > > to this one. If anyone has any issues with these being applied, please
> > > > let me know.
> > > >
> > > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > > Anything received after that time might be too late.
> > > >
> > >
> > > Build results:
> > > total: 157 pass: 156 fail: 1
> > > Failed builds:
> > > m68k:sun3_defconfig
> > > Qemu test results:
> > > total: 521 pass: 519 fail: 2
> > > Failed tests:
> > > arm:fuji-bmc:aspeed_g5_defconfig:notests:mem1G:mtd128,0,8,1:net,nic:aspeed-bmc-facebook-fuji:f2fs
> > > arm:bletchley-bmc,fmc-model=mt25qu02g,spi-model=mt25qu02g:aspeed_g5_defconfig:notests:mem1G:mtd256:net,nic:aspeed-bmc-facebook-bletchley:f2fs
> > >
> > > The m68k build failure is
> > >
> > > Inconsistent kallsyms data
> > > Try make KALLSYMS_EXTRA_PASS=1 as a workaround
> > >
> > > I already have KALLSYMS_EXTRA_PASS=1 enabled, so that doesn't help.
> > > Nothing to worry about. The f2fs crashes are still seen. They
> > > also happen for other architectures, so it is not just an arm problem.
> > > I'll probably just disable all f2fs testing going forward. If so I'll
> > > send a note clarifying that the lack of reported test failures doesn't
> > > mean that it works.
> >
> > I'll look into this later this week, next week to resolve the f2fs
> > stuff. I wanted to get to the other known bug fixes first.
> >
> > > For x86 I get the same runtime warning as everyone else.
> >
> > Yeah, this is troubling...
> >
> > Is it clang only? I'll dig into this today...
>
> It is seen with gcc-13 and clang-17 with few extra configs.
> We are not booting defconfig.
>
> The Kconfigs are enabled with KFENCE.
>
> I see this from lore
> "
> This is from overnight testing that hit this only in the KCSAN runs.
> The KASAN and non-debug runs had no trouble.
>
> Thanx, Paul
>
> "
Ok, that's good, it's not going to hit "normal" users... :)
>
> steps to reproduce:
> -------------------
> tuxmake --runtime podman --target-arch x86_64 --toolchain gcc-13
> --kconfig https://storage.tuxsuite.com/public/linaro/lkft/builds/2UJAv99Wwi6YMltFjlQD5XRO5x4/config
>
>
> Here is the links to details and build details,
> [1]
> https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.1.y/build/v6.1.46-195-g5165f4e9738c/testrun/19256276/suite/log-parser-boot/test/check-kernel-exception/details/
>
> [2]
> https://storage.tuxsuite.com/public/linaro/lkft/builds/2UJAv99Wwi6YMltFjlQD5XRO5x4/
>
> [3]
> https://storage.tuxsuite.com/public/linaro/lkft/builds/2UJAv99Wwi6YMltFjlQD5XRO5x4/config
You are going to force me to use tuxmake again, aren't you...
I'll dig into this after lunch.
greg k-h
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2023-08-23 0:49 ` Guenter Roeck
@ 2023-08-23 8:54 ` Sudip Mukherjee (Codethink)
2023-08-23 9:26 ` Greg Kroah-Hartman
2023-08-23 9:35 ` Conor Dooley
204 siblings, 1 reply; 227+ messages in thread
From: Sudip Mukherjee (Codethink) @ 2023-08-23 8:54 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli, srw, rwarsow,
conor
Hi Greg,
On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.47 release.
> There are 194 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> Anything received after that time might be too late.
Build test (gcc version 12.3.1 20230625):
mips: 52 configs -> no failure
arm: 100 configs -> no failure
arm64: 3 configs -> no failure
x86_64: 4 configs -> no failure
alpha allmodconfig -> no failure
csky allmodconfig -> no failure
powerpc allmodconfig -> no failure
riscv allmodconfig -> no failure
s390 allmodconfig -> no failure
xtensa allmodconfig -> no failure
Boot test:
x86_64: Booted on my test laptop. Warning on boot, already reported by others.
x86_64: Booted on qemu. Warning on boot, already reported by others. [1]
arm64: Booted on rpi4b (4GB model). No regression. [2]
mips: Booted on ci20 board. No regression. [3]
[1]. https://openqa.qa.codethink.co.uk/tests/4765
[2]. https://openqa.qa.codethink.co.uk/tests/4773
[3]. https://openqa.qa.codethink.co.uk/tests/4772
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
--
Regards
Sudip
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 8:54 ` Sudip Mukherjee (Codethink)
@ 2023-08-23 9:26 ` Greg Kroah-Hartman
2023-08-23 10:32 ` Naresh Kamboju
2023-08-23 14:37 ` Sudip Mukherjee
0 siblings, 2 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-23 9:26 UTC (permalink / raw)
To: Sudip Mukherjee (Codethink)
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli, srw, rwarsow,
conor
On Wed, Aug 23, 2023 at 09:54:45AM +0100, Sudip Mukherjee (Codethink) wrote:
> Hi Greg,
>
> On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 6.1.47 release.
> > There are 194 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > Anything received after that time might be too late.
>
> Build test (gcc version 12.3.1 20230625):
> mips: 52 configs -> no failure
> arm: 100 configs -> no failure
> arm64: 3 configs -> no failure
> x86_64: 4 configs -> no failure
> alpha allmodconfig -> no failure
> csky allmodconfig -> no failure
> powerpc allmodconfig -> no failure
> riscv allmodconfig -> no failure
> s390 allmodconfig -> no failure
> xtensa allmodconfig -> no failure
>
> Boot test:
> x86_64: Booted on my test laptop. Warning on boot, already reported by others.
> x86_64: Booted on qemu. Warning on boot, already reported by others. [1]
> arm64: Booted on rpi4b (4GB model). No regression. [2]
> mips: Booted on ci20 board. No regression. [3]
>
> [1]. https://openqa.qa.codethink.co.uk/tests/4765
> [2]. https://openqa.qa.codethink.co.uk/tests/4773
> [3]. https://openqa.qa.codethink.co.uk/tests/4772
>
> Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
>
> --
> Regards
> Sudip
One question about the warning on boot, all still works afterward,
right? Or does the system not work?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2023-08-23 8:54 ` Sudip Mukherjee (Codethink)
@ 2023-08-23 9:35 ` Conor Dooley
2023-08-23 13:37 ` Guenter Roeck
2023-08-23 15:24 ` Greg Kroah-Hartman
204 siblings, 2 replies; 227+ messages in thread
From: Conor Dooley @ 2023-08-23 9:35 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
[-- Attachment #1: Type: text/plain, Size: 607 bytes --]
On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.47 release.
> There are 194 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Fails to build for me with gcc-11/binutils 2.37 on RISC-V. The problematic
patch is "riscv: Handle zicsr/zifencei issue between gcc and binutils".
Can you drop that please, probably from all of your branches. It
certainly affects 6.4 too & I don't personally test anything older than
6.1.
Thanks,
Conor.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 9:26 ` Greg Kroah-Hartman
@ 2023-08-23 10:32 ` Naresh Kamboju
2023-08-23 13:30 ` Guenter Roeck
2023-08-23 14:37 ` Sudip Mukherjee
1 sibling, 1 reply; 227+ messages in thread
From: Naresh Kamboju @ 2023-08-23 10:32 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Sudip Mukherjee (Codethink), stable, patches, linux-kernel,
torvalds, akpm, linux, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, srw, rwarsow, conor
On Wed, 23 Aug 2023 at 14:56, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Wed, Aug 23, 2023 at 09:54:45AM +0100, Sudip Mukherjee (Codethink) wrote:
> > Hi Greg,
> >
> > On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > > This is the start of the stable review cycle for the 6.1.47 release.
> > > There are 194 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > Anything received after that time might be too late.
> >
> > Build test (gcc version 12.3.1 20230625):
> > mips: 52 configs -> no failure
> > arm: 100 configs -> no failure
> > arm64: 3 configs -> no failure
> > x86_64: 4 configs -> no failure
> > alpha allmodconfig -> no failure
> > csky allmodconfig -> no failure
> > powerpc allmodconfig -> no failure
> > riscv allmodconfig -> no failure
> > s390 allmodconfig -> no failure
> > xtensa allmodconfig -> no failure
> >
> > Boot test:
> > x86_64: Booted on my test laptop. Warning on boot, already reported by others.
> > x86_64: Booted on qemu. Warning on boot, already reported by others. [1]
> > arm64: Booted on rpi4b (4GB model). No regression. [2]
> > mips: Booted on ci20 board. No regression. [3]
> >
> > [1]. https://openqa.qa.codethink.co.uk/tests/4765
> > [2]. https://openqa.qa.codethink.co.uk/tests/4773
> > [3]. https://openqa.qa.codethink.co.uk/tests/4772
> >
> > Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
> >
> > --
> > Regards
> > Sudip
>
> One question about the warning on boot, all still works afterward,
> right? Or does the system not work?
The warning while booting and root login successful and
LTP and other test runs are successful.
- Naresh
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 7:03 ` Greg Kroah-Hartman
2023-08-23 8:17 ` Naresh Kamboju
@ 2023-08-23 13:28 ` Guenter Roeck
1 sibling, 0 replies; 227+ messages in thread
From: Guenter Roeck @ 2023-08-23 13:28 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
On Wed, Aug 23, 2023 at 09:03:49AM +0200, Greg Kroah-Hartman wrote:
>
> > For x86 I get the same runtime warning as everyone else.
>
> Yeah, this is troubling...
>
> Is it clang only? I'll dig into this today...
>
No, I build with gcc. More specifically, gcc 11.4.0 and binutils 2.40.
Guenter
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 8:17 ` Naresh Kamboju
2023-08-23 8:27 ` Greg Kroah-Hartman
@ 2023-08-23 13:30 ` Guenter Roeck
2023-08-23 15:50 ` Greg Kroah-Hartman
1 sibling, 1 reply; 227+ messages in thread
From: Guenter Roeck @ 2023-08-23 13:30 UTC (permalink / raw)
To: Naresh Kamboju
Cc: Greg Kroah-Hartman, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Wed, Aug 23, 2023 at 01:47:39PM +0530, Naresh Kamboju wrote:
> On Wed, 23 Aug 2023 at 12:33, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Tue, Aug 22, 2023 at 05:49:54PM -0700, Guenter Roeck wrote:
> > > On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > > > This is the start of the stable review cycle for the 6.1.47 release.
> > > > There are 194 patches in this series, all will be posted as a response
> > > > to this one. If anyone has any issues with these being applied, please
> > > > let me know.
> > > >
> > > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > > Anything received after that time might be too late.
> > > >
> > >
> > > Build results:
> > > total: 157 pass: 156 fail: 1
> > > Failed builds:
> > > m68k:sun3_defconfig
> > > Qemu test results:
> > > total: 521 pass: 519 fail: 2
> > > Failed tests:
> > > arm:fuji-bmc:aspeed_g5_defconfig:notests:mem1G:mtd128,0,8,1:net,nic:aspeed-bmc-facebook-fuji:f2fs
> > > arm:bletchley-bmc,fmc-model=mt25qu02g,spi-model=mt25qu02g:aspeed_g5_defconfig:notests:mem1G:mtd256:net,nic:aspeed-bmc-facebook-bletchley:f2fs
> > >
> > > The m68k build failure is
> > >
> > > Inconsistent kallsyms data
> > > Try make KALLSYMS_EXTRA_PASS=1 as a workaround
> > >
> > > I already have KALLSYMS_EXTRA_PASS=1 enabled, so that doesn't help.
> > > Nothing to worry about. The f2fs crashes are still seen. They
> > > also happen for other architectures, so it is not just an arm problem.
> > > I'll probably just disable all f2fs testing going forward. If so I'll
> > > send a note clarifying that the lack of reported test failures doesn't
> > > mean that it works.
> >
> > I'll look into this later this week, next week to resolve the f2fs
> > stuff. I wanted to get to the other known bug fixes first.
> >
> > > For x86 I get the same runtime warning as everyone else.
> >
> > Yeah, this is troubling...
> >
> > Is it clang only? I'll dig into this today...
>
> It is seen with gcc-13 and clang-17 with few extra configs.
> We are not booting defconfig.
>
> The Kconfigs are enabled with KFENCE.
>
I have KFENCE enabled as well, so it may well be that this triggers
the warning. I don't see it in 6.4.y or upstream, though.
Guenter
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 10:32 ` Naresh Kamboju
@ 2023-08-23 13:30 ` Guenter Roeck
0 siblings, 0 replies; 227+ messages in thread
From: Guenter Roeck @ 2023-08-23 13:30 UTC (permalink / raw)
To: Naresh Kamboju
Cc: Greg Kroah-Hartman, Sudip Mukherjee (Codethink), stable, patches,
linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, srw, rwarsow, conor
On Wed, Aug 23, 2023 at 04:02:14PM +0530, Naresh Kamboju wrote:
> On Wed, 23 Aug 2023 at 14:56, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Wed, Aug 23, 2023 at 09:54:45AM +0100, Sudip Mukherjee (Codethink) wrote:
> > > Hi Greg,
> > >
> > > On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > > > This is the start of the stable review cycle for the 6.1.47 release.
> > > > There are 194 patches in this series, all will be posted as a response
> > > > to this one. If anyone has any issues with these being applied, please
> > > > let me know.
> > > >
> > > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > > Anything received after that time might be too late.
> > >
> > > Build test (gcc version 12.3.1 20230625):
> > > mips: 52 configs -> no failure
> > > arm: 100 configs -> no failure
> > > arm64: 3 configs -> no failure
> > > x86_64: 4 configs -> no failure
> > > alpha allmodconfig -> no failure
> > > csky allmodconfig -> no failure
> > > powerpc allmodconfig -> no failure
> > > riscv allmodconfig -> no failure
> > > s390 allmodconfig -> no failure
> > > xtensa allmodconfig -> no failure
> > >
> > > Boot test:
> > > x86_64: Booted on my test laptop. Warning on boot, already reported by others.
> > > x86_64: Booted on qemu. Warning on boot, already reported by others. [1]
> > > arm64: Booted on rpi4b (4GB model). No regression. [2]
> > > mips: Booted on ci20 board. No regression. [3]
> > >
> > > [1]. https://openqa.qa.codethink.co.uk/tests/4765
> > > [2]. https://openqa.qa.codethink.co.uk/tests/4773
> > > [3]. https://openqa.qa.codethink.co.uk/tests/4772
> > >
> > > Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
> > >
> > > --
> > > Regards
> > > Sudip
> >
> > One question about the warning on boot, all still works afterward,
> > right? Or does the system not work?
>
> The warning while booting and root login successful and
> LTP and other test runs are successful.
>
Same here.
Guenter
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 9:35 ` Conor Dooley
@ 2023-08-23 13:37 ` Guenter Roeck
2023-08-23 15:24 ` Greg Kroah-Hartman
1 sibling, 0 replies; 227+ messages in thread
From: Guenter Roeck @ 2023-08-23 13:37 UTC (permalink / raw)
To: Conor Dooley
Cc: Greg Kroah-Hartman, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Wed, Aug 23, 2023 at 10:35:54AM +0100, Conor Dooley wrote:
> On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 6.1.47 release.
> > There are 194 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
>
> Fails to build for me with gcc-11/binutils 2.37 on RISC-V. The problematic
> patch is "riscv: Handle zicsr/zifencei issue between gcc and binutils".
> Can you drop that please, probably from all of your branches. It
> certainly affects 6.4 too & I don't personally test anything older than
> 6.1.
>
If I recall correctly, I had to be careful with combining gcc versions
and binutils versions. gcc 11.4.0 combined with binutils 2.40 works fine
for me. Note that this doesn't just affect riscv. loongarch and ppc are
quite notorious for that as well.
Guenter
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 9:26 ` Greg Kroah-Hartman
2023-08-23 10:32 ` Naresh Kamboju
@ 2023-08-23 14:37 ` Sudip Mukherjee
1 sibling, 0 replies; 227+ messages in thread
From: Sudip Mukherjee @ 2023-08-23 14:37 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli, srw, rwarsow,
conor
On Wed, 23 Aug 2023 at 10:26, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Wed, Aug 23, 2023 at 09:54:45AM +0100, Sudip Mukherjee (Codethink) wrote:
> > Hi Greg,
> >
> > On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > > This is the start of the stable review cycle for the 6.1.47 release.
> > > There are 194 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > Anything received after that time might be too late.
> >
> > Build test (gcc version 12.3.1 20230625):
> > mips: 52 configs -> no failure
> > arm: 100 configs -> no failure
> > arm64: 3 configs -> no failure
> > x86_64: 4 configs -> no failure
> > alpha allmodconfig -> no failure
> > csky allmodconfig -> no failure
> > powerpc allmodconfig -> no failure
> > riscv allmodconfig -> no failure
> > s390 allmodconfig -> no failure
> > xtensa allmodconfig -> no failure
> >
> > Boot test:
> > x86_64: Booted on my test laptop. Warning on boot, already reported by others.
> > x86_64: Booted on qemu. Warning on boot, already reported by others. [1]
> > arm64: Booted on rpi4b (4GB model). No regression. [2]
> > mips: Booted on ci20 board. No regression. [3]
> >
> > [1]. https://openqa.qa.codethink.co.uk/tests/4765
> > [2]. https://openqa.qa.codethink.co.uk/tests/4773
> > [3]. https://openqa.qa.codethink.co.uk/tests/4772
> >
> > Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
> >
> > --
> > Regards
> > Sudip
>
> One question about the warning on boot, all still works afterward,
> right? Or does the system not work?
I did not notice any problem in testing after boot. Only the warning.
--
Regards
Sudip
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 9:35 ` Conor Dooley
2023-08-23 13:37 ` Guenter Roeck
@ 2023-08-23 15:24 ` Greg Kroah-Hartman
1 sibling, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-23 15:24 UTC (permalink / raw)
To: Conor Dooley
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Wed, Aug 23, 2023 at 10:35:54AM +0100, Conor Dooley wrote:
> On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 6.1.47 release.
> > There are 194 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
>
> Fails to build for me with gcc-11/binutils 2.37 on RISC-V. The problematic
> patch is "riscv: Handle zicsr/zifencei issue between gcc and binutils".
> Can you drop that please, probably from all of your branches. It
> certainly affects 6.4 too & I don't personally test anything older than
> 6.1.
I've dropped that patch now from all trees, thanks.
greg k-h
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 13:30 ` Guenter Roeck
@ 2023-08-23 15:50 ` Greg Kroah-Hartman
2023-08-24 13:35 ` Greg Kroah-Hartman
0 siblings, 1 reply; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-23 15:50 UTC (permalink / raw)
To: Guenter Roeck
Cc: Naresh Kamboju, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Wed, Aug 23, 2023 at 06:30:13AM -0700, Guenter Roeck wrote:
> On Wed, Aug 23, 2023 at 01:47:39PM +0530, Naresh Kamboju wrote:
> > On Wed, 23 Aug 2023 at 12:33, Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Tue, Aug 22, 2023 at 05:49:54PM -0700, Guenter Roeck wrote:
> > > > On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > > > > This is the start of the stable review cycle for the 6.1.47 release.
> > > > > There are 194 patches in this series, all will be posted as a response
> > > > > to this one. If anyone has any issues with these being applied, please
> > > > > let me know.
> > > > >
> > > > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > > > Anything received after that time might be too late.
> > > > >
> > > >
> > > > Build results:
> > > > total: 157 pass: 156 fail: 1
> > > > Failed builds:
> > > > m68k:sun3_defconfig
> > > > Qemu test results:
> > > > total: 521 pass: 519 fail: 2
> > > > Failed tests:
> > > > arm:fuji-bmc:aspeed_g5_defconfig:notests:mem1G:mtd128,0,8,1:net,nic:aspeed-bmc-facebook-fuji:f2fs
> > > > arm:bletchley-bmc,fmc-model=mt25qu02g,spi-model=mt25qu02g:aspeed_g5_defconfig:notests:mem1G:mtd256:net,nic:aspeed-bmc-facebook-bletchley:f2fs
> > > >
> > > > The m68k build failure is
> > > >
> > > > Inconsistent kallsyms data
> > > > Try make KALLSYMS_EXTRA_PASS=1 as a workaround
> > > >
> > > > I already have KALLSYMS_EXTRA_PASS=1 enabled, so that doesn't help.
> > > > Nothing to worry about. The f2fs crashes are still seen. They
> > > > also happen for other architectures, so it is not just an arm problem.
> > > > I'll probably just disable all f2fs testing going forward. If so I'll
> > > > send a note clarifying that the lack of reported test failures doesn't
> > > > mean that it works.
> > >
> > > I'll look into this later this week, next week to resolve the f2fs
> > > stuff. I wanted to get to the other known bug fixes first.
> > >
> > > > For x86 I get the same runtime warning as everyone else.
> > >
> > > Yeah, this is troubling...
> > >
> > > Is it clang only? I'll dig into this today...
> >
> > It is seen with gcc-13 and clang-17 with few extra configs.
> > We are not booting defconfig.
> >
> > The Kconfigs are enabled with KFENCE.
> >
> I have KFENCE enabled as well, so it may well be that this triggers
> the warning. I don't see it in 6.4.y or upstream, though.
Ok, let me rip out all the x86 and objtool patches from this release,
get it out the door with the good things in there that everyone else
needs, and then we can focus on this mess...
Maybe I'll just backport _all_ objtool changes to sync things up better,
last time I tried that it was a maze of twisty passages, all coated in
assembly...
thanks,
greg k-h
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-23 15:50 ` Greg Kroah-Hartman
@ 2023-08-24 13:35 ` Greg Kroah-Hartman
2023-08-24 15:08 ` Guenter Roeck
0 siblings, 1 reply; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-24 13:35 UTC (permalink / raw)
To: Guenter Roeck
Cc: Naresh Kamboju, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Wed, Aug 23, 2023 at 05:50:42PM +0200, Greg Kroah-Hartman wrote:
> On Wed, Aug 23, 2023 at 06:30:13AM -0700, Guenter Roeck wrote:
> > On Wed, Aug 23, 2023 at 01:47:39PM +0530, Naresh Kamboju wrote:
> > > On Wed, 23 Aug 2023 at 12:33, Greg Kroah-Hartman
> > > <gregkh@linuxfoundation.org> wrote:
> > > >
> > > > On Tue, Aug 22, 2023 at 05:49:54PM -0700, Guenter Roeck wrote:
> > > > > On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > > > > > This is the start of the stable review cycle for the 6.1.47 release.
> > > > > > There are 194 patches in this series, all will be posted as a response
> > > > > > to this one. If anyone has any issues with these being applied, please
> > > > > > let me know.
> > > > > >
> > > > > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > > > > Anything received after that time might be too late.
> > > > > >
> > > > >
> > > > > Build results:
> > > > > total: 157 pass: 156 fail: 1
> > > > > Failed builds:
> > > > > m68k:sun3_defconfig
> > > > > Qemu test results:
> > > > > total: 521 pass: 519 fail: 2
> > > > > Failed tests:
> > > > > arm:fuji-bmc:aspeed_g5_defconfig:notests:mem1G:mtd128,0,8,1:net,nic:aspeed-bmc-facebook-fuji:f2fs
> > > > > arm:bletchley-bmc,fmc-model=mt25qu02g,spi-model=mt25qu02g:aspeed_g5_defconfig:notests:mem1G:mtd256:net,nic:aspeed-bmc-facebook-bletchley:f2fs
> > > > >
> > > > > The m68k build failure is
> > > > >
> > > > > Inconsistent kallsyms data
> > > > > Try make KALLSYMS_EXTRA_PASS=1 as a workaround
> > > > >
> > > > > I already have KALLSYMS_EXTRA_PASS=1 enabled, so that doesn't help.
> > > > > Nothing to worry about. The f2fs crashes are still seen. They
> > > > > also happen for other architectures, so it is not just an arm problem.
> > > > > I'll probably just disable all f2fs testing going forward. If so I'll
> > > > > send a note clarifying that the lack of reported test failures doesn't
> > > > > mean that it works.
> > > >
> > > > I'll look into this later this week, next week to resolve the f2fs
> > > > stuff. I wanted to get to the other known bug fixes first.
> > > >
> > > > > For x86 I get the same runtime warning as everyone else.
> > > >
> > > > Yeah, this is troubling...
> > > >
> > > > Is it clang only? I'll dig into this today...
> > >
> > > It is seen with gcc-13 and clang-17 with few extra configs.
> > > We are not booting defconfig.
> > >
> > > The Kconfigs are enabled with KFENCE.
> > >
> > I have KFENCE enabled as well, so it may well be that this triggers
> > the warning. I don't see it in 6.4.y or upstream, though.
>
> Ok, let me rip out all the x86 and objtool patches from this release,
> get it out the door with the good things in there that everyone else
> needs, and then we can focus on this mess...
>
> Maybe I'll just backport _all_ objtool changes to sync things up better,
> last time I tried that it was a maze of twisty passages, all coated in
> assembly...
I got lost in the maze again today, ick.
Anyway, I give up. I'm just going to push out a -rc1 with just these
changes in it today, and if people are upset about the runtime warning,
then they can provide a working backport of this objtool patch.
Ideally, the CPU vendor who is causing this mess will do that, as it's
their issue we are spending all of this time on, not Linux's issue.
Also, oddly, I can not reproduce this problem here on my hardware at
all. Maybe because it's an AMD processor? If so, makes sense, as the
SRSO issue is only for Intel chips.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-24 13:35 ` Greg Kroah-Hartman
@ 2023-08-24 15:08 ` Guenter Roeck
2023-08-24 15:15 ` Greg Kroah-Hartman
0 siblings, 1 reply; 227+ messages in thread
From: Guenter Roeck @ 2023-08-24 15:08 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Naresh Kamboju, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Thu, Aug 24, 2023 at 03:35:55PM +0200, Greg Kroah-Hartman wrote:
> On Wed, Aug 23, 2023 at 05:50:42PM +0200, Greg Kroah-Hartman wrote:
> > On Wed, Aug 23, 2023 at 06:30:13AM -0700, Guenter Roeck wrote:
> > > On Wed, Aug 23, 2023 at 01:47:39PM +0530, Naresh Kamboju wrote:
> > > > On Wed, 23 Aug 2023 at 12:33, Greg Kroah-Hartman
> > > > <gregkh@linuxfoundation.org> wrote:
> > > > >
> > > > > On Tue, Aug 22, 2023 at 05:49:54PM -0700, Guenter Roeck wrote:
> > > > > > On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > > > > > > This is the start of the stable review cycle for the 6.1.47 release.
> > > > > > > There are 194 patches in this series, all will be posted as a response
> > > > > > > to this one. If anyone has any issues with these being applied, please
> > > > > > > let me know.
> > > > > > >
> > > > > > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > > > > > Anything received after that time might be too late.
> > > > > > >
> > > > > >
> > > > > > Build results:
> > > > > > total: 157 pass: 156 fail: 1
> > > > > > Failed builds:
> > > > > > m68k:sun3_defconfig
> > > > > > Qemu test results:
> > > > > > total: 521 pass: 519 fail: 2
> > > > > > Failed tests:
> > > > > > arm:fuji-bmc:aspeed_g5_defconfig:notests:mem1G:mtd128,0,8,1:net,nic:aspeed-bmc-facebook-fuji:f2fs
> > > > > > arm:bletchley-bmc,fmc-model=mt25qu02g,spi-model=mt25qu02g:aspeed_g5_defconfig:notests:mem1G:mtd256:net,nic:aspeed-bmc-facebook-bletchley:f2fs
> > > > > >
> > > > > > The m68k build failure is
> > > > > >
> > > > > > Inconsistent kallsyms data
> > > > > > Try make KALLSYMS_EXTRA_PASS=1 as a workaround
> > > > > >
> > > > > > I already have KALLSYMS_EXTRA_PASS=1 enabled, so that doesn't help.
> > > > > > Nothing to worry about. The f2fs crashes are still seen. They
> > > > > > also happen for other architectures, so it is not just an arm problem.
> > > > > > I'll probably just disable all f2fs testing going forward. If so I'll
> > > > > > send a note clarifying that the lack of reported test failures doesn't
> > > > > > mean that it works.
> > > > >
> > > > > I'll look into this later this week, next week to resolve the f2fs
> > > > > stuff. I wanted to get to the other known bug fixes first.
> > > > >
> > > > > > For x86 I get the same runtime warning as everyone else.
> > > > >
> > > > > Yeah, this is troubling...
> > > > >
> > > > > Is it clang only? I'll dig into this today...
> > > >
> > > > It is seen with gcc-13 and clang-17 with few extra configs.
> > > > We are not booting defconfig.
> > > >
> > > > The Kconfigs are enabled with KFENCE.
> > > >
> > > I have KFENCE enabled as well, so it may well be that this triggers
> > > the warning. I don't see it in 6.4.y or upstream, though.
> >
> > Ok, let me rip out all the x86 and objtool patches from this release,
> > get it out the door with the good things in there that everyone else
> > needs, and then we can focus on this mess...
> >
> > Maybe I'll just backport _all_ objtool changes to sync things up better,
> > last time I tried that it was a maze of twisty passages, all coated in
> > assembly...
>
> I got lost in the maze again today, ick.
>
> Anyway, I give up. I'm just going to push out a -rc1 with just these
> changes in it today, and if people are upset about the runtime warning,
> then they can provide a working backport of this objtool patch.
>
Or maybe just revert all srso patches.
> Ideally, the CPU vendor who is causing this mess will do that, as it's
> their issue we are spending all of this time on, not Linux's issue.
>
> Also, oddly, I can not reproduce this problem here on my hardware at
> all. Maybe because it's an AMD processor? If so, makes sense, as the
> SRSO issue is only for Intel chips.
>
Apparently I am lost in the maze as well. I am quite sure that SRSO
only applies to AMD CPUs, and
arch/x86/Kconfig:config CPU_SRSO
arch/x86/Kconfig: Enable the SRSO mitigation needed on AMD Zen1-4 machines.
seems to confirm that. What am I missing ? Do you mean the warning that
was supposed to be fixed with the objtool patch(es) is only seen on Intel
chips ?
Thanks,
Guenter
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-24 15:08 ` Guenter Roeck
@ 2023-08-24 15:15 ` Greg Kroah-Hartman
2023-08-24 15:58 ` Guenter Roeck
0 siblings, 1 reply; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-24 15:15 UTC (permalink / raw)
To: Guenter Roeck
Cc: Naresh Kamboju, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Thu, Aug 24, 2023 at 08:08:19AM -0700, Guenter Roeck wrote:
> On Thu, Aug 24, 2023 at 03:35:55PM +0200, Greg Kroah-Hartman wrote:
> > On Wed, Aug 23, 2023 at 05:50:42PM +0200, Greg Kroah-Hartman wrote:
> > > On Wed, Aug 23, 2023 at 06:30:13AM -0700, Guenter Roeck wrote:
> > > > On Wed, Aug 23, 2023 at 01:47:39PM +0530, Naresh Kamboju wrote:
> > > > > On Wed, 23 Aug 2023 at 12:33, Greg Kroah-Hartman
> > > > > <gregkh@linuxfoundation.org> wrote:
> > > > > >
> > > > > > On Tue, Aug 22, 2023 at 05:49:54PM -0700, Guenter Roeck wrote:
> > > > > > > On Mon, Aug 21, 2023 at 09:39:39PM +0200, Greg Kroah-Hartman wrote:
> > > > > > > > This is the start of the stable review cycle for the 6.1.47 release.
> > > > > > > > There are 194 patches in this series, all will be posted as a response
> > > > > > > > to this one. If anyone has any issues with these being applied, please
> > > > > > > > let me know.
> > > > > > > >
> > > > > > > > Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000.
> > > > > > > > Anything received after that time might be too late.
> > > > > > > >
> > > > > > >
> > > > > > > Build results:
> > > > > > > total: 157 pass: 156 fail: 1
> > > > > > > Failed builds:
> > > > > > > m68k:sun3_defconfig
> > > > > > > Qemu test results:
> > > > > > > total: 521 pass: 519 fail: 2
> > > > > > > Failed tests:
> > > > > > > arm:fuji-bmc:aspeed_g5_defconfig:notests:mem1G:mtd128,0,8,1:net,nic:aspeed-bmc-facebook-fuji:f2fs
> > > > > > > arm:bletchley-bmc,fmc-model=mt25qu02g,spi-model=mt25qu02g:aspeed_g5_defconfig:notests:mem1G:mtd256:net,nic:aspeed-bmc-facebook-bletchley:f2fs
> > > > > > >
> > > > > > > The m68k build failure is
> > > > > > >
> > > > > > > Inconsistent kallsyms data
> > > > > > > Try make KALLSYMS_EXTRA_PASS=1 as a workaround
> > > > > > >
> > > > > > > I already have KALLSYMS_EXTRA_PASS=1 enabled, so that doesn't help.
> > > > > > > Nothing to worry about. The f2fs crashes are still seen. They
> > > > > > > also happen for other architectures, so it is not just an arm problem.
> > > > > > > I'll probably just disable all f2fs testing going forward. If so I'll
> > > > > > > send a note clarifying that the lack of reported test failures doesn't
> > > > > > > mean that it works.
> > > > > >
> > > > > > I'll look into this later this week, next week to resolve the f2fs
> > > > > > stuff. I wanted to get to the other known bug fixes first.
> > > > > >
> > > > > > > For x86 I get the same runtime warning as everyone else.
> > > > > >
> > > > > > Yeah, this is troubling...
> > > > > >
> > > > > > Is it clang only? I'll dig into this today...
> > > > >
> > > > > It is seen with gcc-13 and clang-17 with few extra configs.
> > > > > We are not booting defconfig.
> > > > >
> > > > > The Kconfigs are enabled with KFENCE.
> > > > >
> > > > I have KFENCE enabled as well, so it may well be that this triggers
> > > > the warning. I don't see it in 6.4.y or upstream, though.
> > >
> > > Ok, let me rip out all the x86 and objtool patches from this release,
> > > get it out the door with the good things in there that everyone else
> > > needs, and then we can focus on this mess...
> > >
> > > Maybe I'll just backport _all_ objtool changes to sync things up better,
> > > last time I tried that it was a maze of twisty passages, all coated in
> > > assembly...
> >
> > I got lost in the maze again today, ick.
> >
> > Anyway, I give up. I'm just going to push out a -rc1 with just these
> > changes in it today, and if people are upset about the runtime warning,
> > then they can provide a working backport of this objtool patch.
> >
>
> Or maybe just revert all srso patches.
Hah, I wish.
{sigh}
I've notified the patch authors about this, hopefully they can come up
with something.
> > Ideally, the CPU vendor who is causing this mess will do that, as it's
> > their issue we are spending all of this time on, not Linux's issue.
> >
> > Also, oddly, I can not reproduce this problem here on my hardware at
> > all. Maybe because it's an AMD processor? If so, makes sense, as the
> > SRSO issue is only for Intel chips.
> >
>
> Apparently I am lost in the maze as well. I am quite sure that SRSO
> only applies to AMD CPUs, and
>
> arch/x86/Kconfig:config CPU_SRSO
> arch/x86/Kconfig: Enable the SRSO mitigation needed on AMD Zen1-4 machines.
>
> seems to confirm that. What am I missing ? Do you mean the warning that
> was supposed to be fixed with the objtool patch(es) is only seen on Intel
> chips ?
Ah, sorry, my confusion (too many different cpu bugs lately)
This might be an issue on AMD chips, but for some reason, in running
this kernel on my systems here, I have no boot warnings at all. I
blamed it on them being only AMD chips. If that's not the issue then I
really have no idea, sorry.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-24 15:15 ` Greg Kroah-Hartman
@ 2023-08-24 15:58 ` Guenter Roeck
2023-08-24 16:40 ` Greg Kroah-Hartman
0 siblings, 1 reply; 227+ messages in thread
From: Guenter Roeck @ 2023-08-24 15:58 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Naresh Kamboju, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Thu, Aug 24, 2023 at 05:15:30PM +0200, Greg Kroah-Hartman wrote:
[ ... ]
>
> This might be an issue on AMD chips, but for some reason, in running
> this kernel on my systems here, I have no boot warnings at all. I
> blamed it on them being only AMD chips. If that's not the issue then I
> really have no idea, sorry.
>
AFAIK it depends on the compiler used and on the enabled debug options.
At some point I lost track about what exactly has to be enabled to see
the problem. We see it a lot with our (ChromeOS) debug kernel testing
which has various debug options enabled, to the point where we may
temporarily remove the warning from the kernel to stop the noise.
Alternatively, as I had suggested earlier, we could revert all srso patches
because they only seem to cause trouble. So far I have been resisting that
because I am concerned that it would make things even worse (like one can
not really revert a heart surgery without doing even more damage).
Guenter
^ permalink raw reply [flat|nested] 227+ messages in thread
* Re: [PATCH 6.1 000/194] 6.1.47-rc1 review
2023-08-24 15:58 ` Guenter Roeck
@ 2023-08-24 16:40 ` Greg Kroah-Hartman
0 siblings, 0 replies; 227+ messages in thread
From: Greg Kroah-Hartman @ 2023-08-24 16:40 UTC (permalink / raw)
To: Guenter Roeck
Cc: Naresh Kamboju, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Thu, Aug 24, 2023 at 08:58:46AM -0700, Guenter Roeck wrote:
> On Thu, Aug 24, 2023 at 05:15:30PM +0200, Greg Kroah-Hartman wrote:
> [ ... ]
> >
> > This might be an issue on AMD chips, but for some reason, in running
> > this kernel on my systems here, I have no boot warnings at all. I
> > blamed it on them being only AMD chips. If that's not the issue then I
> > really have no idea, sorry.
> >
>
> AFAIK it depends on the compiler used and on the enabled debug options.
> At some point I lost track about what exactly has to be enabled to see
> the problem. We see it a lot with our (ChromeOS) debug kernel testing
> which has various debug options enabled, to the point where we may
> temporarily remove the warning from the kernel to stop the noise.
>
> Alternatively, as I had suggested earlier, we could revert all srso patches
> because they only seem to cause trouble. So far I have been resisting that
> because I am concerned that it would make things even worse (like one can
> not really revert a heart surgery without doing even more damage).
If you don't want the feature, you can disable it at build time (I
think), and I know you can disable it at runtime. But there are groups
out that that "need" this, to solve a known security hole in some cpus,
so it is required for them. To remove the code entirely would not be
good for them, so I will say, if they are the ones that need this, they
should help fix this warning, no one else should be seeing it :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 227+ messages in thread
end of thread, other threads:[~2023-08-24 16:40 UTC | newest]
Thread overview: 227+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-08-21 19:39 [PATCH 6.1 000/194] 6.1.47-rc1 review Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 001/194] mmc: sdhci-f-sdh30: Replace with sdhci_pltfm Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 002/194] cpuidle: psci: Extend information in log about OSI/PC mode Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 003/194] cpuidle: psci: Move enabling OSI mode after power domains creation Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 004/194] zsmalloc: consolidate zs_pools migrate_lock and size_classs locks Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 005/194] zsmalloc: fix races between modifications of fullness and isolated Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 006/194] selftests: forwarding: tc_actions: cleanup temporary files when test is aborted Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 007/194] selftests: forwarding: tc_actions: Use ncat instead of nc Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 008/194] net/smc: replace mutex rmbs_lock and sndbufs_lock with rw_semaphore Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 009/194] net/smc: Fix setsockopt and sysctl to specify same buffer size again Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 010/194] net: phy: at803x: Use devm_regulator_get_enable_optional() Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 011/194] net: phy: at803x: fix the wol setting functions Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 012/194] drm/amdgpu: fix calltrace warning in amddrm_buddy_fini Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 013/194] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 014/194] drm/amdgpu: fix memory leak in mes self test Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 015/194] ASoC: Intel: sof_sdw: add quirk for MTL RVP Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 016/194] ASoC: Intel: sof_sdw: add quirk for LNL RVP Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 017/194] PCI: tegra194: Fix possible array out of bounds access Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 018/194] ASoC: SOF: amd: Add pci revision id check Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 019/194] drm/stm: ltdc: fix late dereference check Greg Kroah-Hartman
2023-08-21 19:39 ` [PATCH 6.1 020/194] drm: rcar-du: remove R-Car H3 ES1.* workarounds Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 021/194] ASoC: amd: vangogh: Add check for acp config flags in vangogh platform Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 022/194] ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 023/194] ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in _exit Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 024/194] ASoC: Intel: sof_sdw: Add support for Rex soundwire Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 025/194] iopoll: Call cpu_relax() in busy loops Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 026/194] ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 027/194] dma-remap: use kvmalloc_array/kvfree for larger dma memory remap Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 028/194] accel/habanalabs: add pci health check during heartbeat Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 029/194] HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 030/194] iommu/amd: Introduce Disable IRTE Caching Support Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 031/194] drm/amdgpu: install stub fence into potential unused fence pointers Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 032/194] drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 033/194] RDMA/mlx5: Return the firmware result upon destroying QP/RQ Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 034/194] drm/amd/display: Skip DPP DTO update if root clock is gated Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 035/194] drm/amd/display: Enable dcn314 DPP RCO Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 036/194] ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown() Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 037/194] HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 038/194] ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 039/194] smb: client: fix warning in cifs_smb3_do_mount() Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 040/194] cifs: fix session state check in reconnect to avoid use-after-free issue Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 041/194] serial: stm32: Ignore return value of uart_remove_one_port() in .remove() Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 042/194] led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 043/194] media: v4l2-mem2mem: add lock to protect parameter num_rdy Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 044/194] media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250 Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 045/194] usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 046/194] usb: gadget: uvc: queue empty isoc requests if no video buffer is available Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 047/194] media: platform: mediatek: vpu: fix NULL ptr dereference Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 048/194] thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx() Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 049/194] usb: chipidea: imx: dont request QoS for imx8ulp Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 050/194] usb: chipidea: imx: add missing USB PHY DPDM wakeup setting Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 051/194] gfs2: Fix possible data races in gfs2_show_options() Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 052/194] pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 053/194] thunderbolt: Add Intel Barlow Ridge PCI ID Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 054/194] thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 055/194] firewire: net: fix use after free in fwnet_finish_incoming_packet() Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 056/194] watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub) Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 057/194] Bluetooth: L2CAP: Fix use-after-free Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 058/194] Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 059/194] ceph: try to dump the msgs when decoding fails Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 060/194] drm/amdgpu: Fix potential fence use-after-free v2 Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 061/194] fs/ntfs3: Enhance sanity check while generating attr_list Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 062/194] fs: ntfs3: Fix possible null-pointer dereferences in mi_read() Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 063/194] fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 064/194] ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 065/194] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 066/194] ALSA: hda/realtek: Add quirk for ASUS ROG GX650P Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 067/194] ALSA: hda/realtek: Add quirk for ASUS ROG GA402X Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 068/194] ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 069/194] powerpc/kasan: Disable KCOV in KASAN code Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 070/194] Bluetooth: MGMT: Use correct address for memcpy() Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 071/194] ring-buffer: Do not swap cpu_buffer during resize process Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 072/194] igc: read before write to SRRCTL register Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 073/194] drm/amd/display: save restore hdcp state when display is unplugged from mst hub Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 074/194] drm/amd/display: phase3 mst hdcp for multiple displays Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 075/194] drm/amd/display: fix access hdcp_workqueue assert Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 076/194] KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 077/194] ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 078/194] fbdev/hyperv-fb: Do not set struct fb_info.apertures Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 079/194] video/aperture: Only remove sysfb on the default vga pci device Greg Kroah-Hartman
2023-08-21 19:40 ` [PATCH 6.1 080/194] btrfs: move out now unused BG from the reclaim list Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 081/194] btrfs: convert btrfs_block_group::needs_free_space to runtime flag Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 082/194] btrfs: convert btrfs_block_group::seq_zone " Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 083/194] btrfs: fix use-after-free of new block group that became unused Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 084/194] virtio-mmio: dont break lifecycle of vm_dev Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 085/194] vduse: Use proper spinlock for IRQ injection Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 086/194] vdpa/mlx5: Fix mr->initialized semantics Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 087/194] vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 088/194] cifs: fix potential oops in cifs_oplock_break Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 089/194] i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 090/194] i2c: hisi: Only handle the interrupt of the drivers transfer Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 091/194] i2c: tegra: Fix i2c-tegra DMA config option processing Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 092/194] fbdev: mmp: fix value check in mmphw_probe() Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 093/194] powerpc/rtas_flash: allow user copy to flash block cache objects Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 094/194] vdpa: Add features attr to vdpa_nl_policy for nlattr length check Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 095/194] vdpa: Add queue index " Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 096/194] vdpa: Add max vqp " Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 097/194] vdpa: Enable strict validation for netlinks ops Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 098/194] tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 099/194] tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 100/194] btrfs: fix incorrect splitting in btrfs_drop_extent_map_range Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 101/194] btrfs: fix BUG_ON condition in btrfs_cancel_balance Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 102/194] i2c: designware: Correct length byte validation logic Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 103/194] i2c: designware: Handle invalid SMBus block data response length value Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 104/194] net: xfrm: Fix xfrm_address_filter OOB read Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 105/194] net: af_key: fix sadb_x_filter validation Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 106/194] net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 107/194] xfrm: fix slab-use-after-free in decode_session6 Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 108/194] ip6_vti: " Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 109/194] ip_vti: fix potential " Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 110/194] xfrm: add NULL check in xfrm_update_ae_params Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 111/194] xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 112/194] virtio_net: notify MAC address change on device initialization Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 113/194] virtio-net: set queues after driver_ok Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 114/194] net: pcs: Add missing put_device call in miic_create Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 115/194] net: phy: fix IRQ-based wake-on-lan over hibernate / power off Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 116/194] selftests: mirror_gre_changes: Tighten up the TTL test match Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 117/194] drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 118/194] net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 119/194] octeon_ep: cancel tx_timeout_task later in remove sequence Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 120/194] netfilter: nf_tables: fix false-positive lockdep splat Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 121/194] netfilter: nf_tables: deactivate catchall elements in next generation Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 122/194] ipvs: fix racy memcpy in proc_do_sync_threshold Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 123/194] netfilter: nft_dynset: disallow object maps Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 124/194] net: phy: broadcom: stub c45 read/write for 54810 Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 125/194] team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 126/194] net: openvswitch: reject negative ifindex Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 127/194] iavf: fix FDIR rule fields masks validation Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 128/194] i40e: fix misleading debug logs Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 129/194] net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 130/194] sfc: dont unregister flow_indr if it was never registered Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 131/194] sock: Fix misuse of sk_under_memory_pressure() Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 132/194] net: do not allow gso_size to be set to GSO_BY_FRAGS Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 133/194] qede: fix firmware halt over suspend and resume Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 134/194] ice: Block switchdev mode when ADQ is active and vice versa Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 135/194] bus: ti-sysc: Flush posted write on enable before reset Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 136/194] arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 137/194] arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4 Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 138/194] arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+ Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 139/194] ARM: dts: imx: align LED node names with dtschema Greg Kroah-Hartman
2023-08-21 19:41 ` [PATCH 6.1 140/194] ARM: dts: imx6: phytec: fix RTC interrupt level Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 141/194] arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 142/194] ARM: dts: imx: Set default tuning step for imx6sx usdhc Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 143/194] arm64: dts: imx93: Fix anatop node size Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 144/194] ASoC: rt5665: add missed regulator_bulk_disable Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 145/194] ASoC: meson: axg-tdm-formatter: fix channel slot allocation Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 146/194] ALSA: hda/realtek: Add quirks for HP G11 Laptops Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 147/194] soc: aspeed: uart-routing: Use __sysfs_match_string Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 148/194] soc: aspeed: socinfo: Add kfree for kstrdup Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 149/194] ALSA: hda/realtek - Remodified 3k pull low procedure Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 150/194] riscv: uaccess: Return the number of bytes effectively not copied Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 151/194] serial: 8250: Fix oops for port->pm on uart_change_pm() Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 152/194] ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 153/194] cifs: Release folio lock on fscache read hit Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 154/194] riscv: Handle zicsr/zifencei issue between gcc and binutils Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 155/194] virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 156/194] arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 157/194] blk-crypto: dynamically allocate fallback profile Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 158/194] mmc: wbsd: fix double mmc_free_host() in wbsd_init() Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 159/194] mmc: block: Fix in_flight[issue_type] value error Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 160/194] drm/qxl: fix UAF on handle creation Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 161/194] drm/i915/sdvo: fix panel_type initialization Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 162/194] drm/amd: flush any delayed gfxoff on suspend entry Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 163/194] drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 164/194] drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7 Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 165/194] ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 166/194] drm/amd/display: disable RCO for DCN314 Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 167/194] zsmalloc: allow only one active pool compaction context Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 168/194] sched/fair: unlink misfit task from cpu overutilized Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 169/194] sched/fair: Remove capacity inversion detection Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 170/194] drm/amd/display: Implement workaround for writing to OTG_PIXEL_RATE_DIV register Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 171/194] hugetlb: do not clear hugetlb dtor until allocating vmemmap Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 172/194] netfilter: set default timeout to 3 secs for sctp shutdown send and recv state Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 173/194] x86/cpu: Fix __x86_return_thunk symbol type Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 174/194] x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 175/194] x86/alternative: Make custom return thunk unconditional Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 176/194] x86/cpu: Clean up SRSO return thunk mess Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 177/194] x86/cpu: Rename original retbleed methods Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 178/194] x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 179/194] x86/cpu: Cleanup the untrain mess Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 180/194] x86/srso: Explain the untraining sequences a bit more Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 181/194] x86/static_call: Fix __static_call_fixup() Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 182/194] x86/retpoline: Dont clobber RFLAGS during srso_safe_ret() Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 183/194] x86/CPU/AMD: Fix the DIV(0) initial fix attempt Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 184/194] x86/srso: Disable the mitigation on unaffected configurations Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 185/194] x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 186/194] objtool/x86: Fixup frame-pointer vs rethunk Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 187/194] x86/srso: Correct the mitigation status when SMT is disabled Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 188/194] arm64/ptrace: Ensure that SME is set up for target when writing SSVE state Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 189/194] drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11 Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 190/194] drm/amdgpu: keep irq count in amdgpu_irq_disable_all Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 191/194] af_unix: Fix null-ptr-deref in unix_stream_sendpage() Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 192/194] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 193/194] net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled Greg Kroah-Hartman
2023-08-21 19:42 ` [PATCH 6.1 194/194] mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove Greg Kroah-Hartman
2023-08-21 22:58 ` [PATCH 6.1 000/194] 6.1.47-rc1 review Joel Fernandes
2023-08-22 15:41 ` Joel Fernandes
2023-08-21 23:35 ` Takeshi Ogasawara
2023-08-22 3:00 ` Bagas Sanjaya
2023-08-22 10:55 ` Naresh Kamboju
2023-08-22 15:27 ` Salvatore Bonaccorso
2023-08-22 15:51 ` Greg Kroah-Hartman
2023-08-22 17:27 ` Greg Kroah-Hartman
2023-08-22 11:01 ` SeongJae Park
2023-08-22 14:08 ` Shuah Khan
2023-08-22 20:23 ` Florian Fainelli
2023-08-22 23:55 ` Ron Economos
2023-08-23 0:49 ` Guenter Roeck
2023-08-23 7:03 ` Greg Kroah-Hartman
2023-08-23 8:17 ` Naresh Kamboju
2023-08-23 8:27 ` Greg Kroah-Hartman
2023-08-23 13:30 ` Guenter Roeck
2023-08-23 15:50 ` Greg Kroah-Hartman
2023-08-24 13:35 ` Greg Kroah-Hartman
2023-08-24 15:08 ` Guenter Roeck
2023-08-24 15:15 ` Greg Kroah-Hartman
2023-08-24 15:58 ` Guenter Roeck
2023-08-24 16:40 ` Greg Kroah-Hartman
2023-08-23 13:28 ` Guenter Roeck
2023-08-23 8:54 ` Sudip Mukherjee (Codethink)
2023-08-23 9:26 ` Greg Kroah-Hartman
2023-08-23 10:32 ` Naresh Kamboju
2023-08-23 13:30 ` Guenter Roeck
2023-08-23 14:37 ` Sudip Mukherjee
2023-08-23 9:35 ` Conor Dooley
2023-08-23 13:37 ` Guenter Roeck
2023-08-23 15:24 ` Greg Kroah-Hartman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).