* [PATCH 5.15 000/245] 5.15.150-rc1 review
@ 2024-02-27 13:23 Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 001/245] net/sched: Retire CBQ qdisc Greg Kroah-Hartman
` (255 more replies)
0 siblings, 256 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml
This is the start of the stable review cycle for the 5.15.150 release.
There are 245 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.15.150-rc1
Florian Westphal <fw@strlen.de>
netfilter: nf_tables: can't schedule in nft_chain_validate
Baokun Li <libaokun1@huawei.com>
ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks()
Baokun Li <libaokun1@huawei.com>
ext4: regenerate buddy after block freeing failed if under fc replay
Florian Westphal <fw@strlen.de>
netfilter: nf_tables: fix scheduling-while-atomic splat
Kuniyuki Iwashima <kuniyu@amazon.com>
arp: Prevent overflow in arp_req_get().
Bart Van Assche <bvanassche@acm.org>
fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
Shyam Prasad N <nspmangalore@gmail.com>
cifs: fix mid leak during reconnection after timeout threshold
Corey Minyard <minyard@acm.org>
i2c: imx: when being a target, mark the last read as processed
Corey Minyard <minyard@acm.org>
i2c: imx: Add timer for handling the stop condition
Armin Wolf <W_Armin@gmx.de>
drm/amd/display: Fix memory leak in dm_sw_fini()
Erik Kurzinger <ekurzinger@nvidia.com>
drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_flow_offload: release dst in case direct xmit path is used
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_flow_offload: reset dst in route object after setting up flow
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: flowtable: simplify route logic
Florian Westphal <fw@strlen.de>
netfilter: nf_tables: set dormant flag on hook register failure
Sabrina Dubroca <sd@queasysnail.net>
tls: stop recv() if initial process_rx_list gave us non-DATA
Jakub Kicinski <kuba@kernel.org>
tls: rx: drop pointless else after goto
Jakub Kicinski <kuba@kernel.org>
tls: rx: jump to a more appropriate label
Jason Gunthorpe <jgg@ziepe.ca>
s390: use the correct count for __iowrite64_copy()
Subbaraya Sundeep <sbhatta@marvell.com>
octeontx2-af: Consider the action set by PF
Guo Zhengkui <guozhengkui@vivo.com>
drm/nouveau/instmem: fix uninitialized_var.cocci warning
Kees Cook <keescook@chromium.org>
net: dev: Convert sa_data to flexible array in struct sockaddr
Wolfram Sang <wsa+renesas@sang-engineering.com>
packet: move from strlcpy with unused retval to strscpy
Vasiliy Kovalev <kovalev@altlinux.org>
ipv6: sr: fix possible use-after-free and null-ptr-deref
Daniil Dulov <d.dulov@aladdin.ru>
afs: Increase buffer size in afs_update_volume_status()
Martin KaFai Lau <martin.lau@kernel.org>
bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel
Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
ata: ahci_ceva: fix error handling for Xilinx GT PHY support
Serge Semin <Sergey.Semin@baikalelectronics.ru>
ata: libahci_platform: Introduce reset assertion/deassertion methods
Serge Semin <Sergey.Semin@baikalelectronics.ru>
ata: libahci_platform: Convert to using devm bulk clocks API
Eric Dumazet <edumazet@google.com>
ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
Eric Dumazet <edumazet@google.com>
ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
Pavel Sakharov <p.sakharov@ispras.ru>
net: stmmac: Fix incorrect dereference in interrupt handlers
Arnd Bergmann <arnd@arndb.de>
nouveau: fix function cast warnings
Randy Dunlap <rdunlap@infradead.org>
scsi: jazz_esp: Only build if SCSI core is builtin
Gianmarco Lusvardi <glusvardi@posteo.net>
bpf, scripts: Correct GPL license name
Arnd Bergmann <arnd@arndb.de>
RDMA/srpt: fix function pointer cast warnings
Heiko Stuebner <heiko.stuebner@cherry.de>
arm64: dts: rockchip: set num-cs property for spi on px30
Kamal Heib <kheib@redhat.com>
RDMA/qedr: Fix qedr_create_user_qp error flow
Bart Van Assche <bvanassche@acm.org>
RDMA/srpt: Support specifying the srpt_service_guid parameter
Mustafa Ismail <mustafa.ismail@intel.com>
RDMA/irdma: Add AE for too many RNRS
Mustafa Ismail <mustafa.ismail@intel.com>
RDMA/irdma: Set the CQ read threshold for GEN 1
Shiraz Saleem <shiraz.saleem@intel.com>
RDMA/irdma: Validate max_send_wr and max_recv_wr
Mike Marciniszyn <mike.marciniszyn@intel.com>
RDMA/irdma: Fix KASAN issue with tasklet
Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
RDMA/bnxt_re: Return error for SRQ resize
Zhipeng Lu <alexious@zju.edu.cn>
IB/hfi1: Fix a memleak in init_credit_return
Shyam Prasad N <sprasad@microsoft.com>
cifs: add a warning when the in-flight count goes negative
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: track port suspend state correctly in unsuccessful resume cases
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: decouple usb2 port resume and get_port_status request handling
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: clear usb2 resume related variables in one place.
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: rename resume_done to resume_timestamp
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: move port specific items such as state completions to port structure
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: cleanup xhci_hub_control port references
Paul Menzel <pmenzel@molgen.mpg.de>
ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
Tamim Khan <tamim@fusetak.com>
ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
Hans de Goede <hdegoede@redhat.com>
ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
Tamim Khan <tamim@fusetak.com>
ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
Kellen Renshaw <kellen.renshaw@canonical.com>
ACPI: resource: Add ASUS model S5402ZA to quirks
Hans de Goede <hdegoede@redhat.com>
ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2
Rafał Miłecki <rafal@milecki.pl>
ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
Alex Bee <knaerzche@gmail.com>
arm64: dts: rockchip: add SPDIF node for ROCK Pi 4
Alex Bee <knaerzche@gmail.com>
arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4
FUKAUMI Naoki <naoki@radxa.com>
arm64: dts: rockchip: fix regulator name on rk3399-rock-4
Yuezhang Mo <Yuezhang.Mo@sony.com>
exfat: support dynamic allocate bh for exfat_entry_set_cache
Johannes Berg <johannes.berg@intel.com>
wifi: iwlwifi: mvm: avoid baid size integer overflow
Ying Hsu <yinghsu@chromium.org>
igb: Fix igb_down hung on surprise removal
Gustavo A. R. Silva <gustavoars@kernel.org>
wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
Petr Oros <poros@redhat.com>
devlink: report devlink_port_type_warn source device
Martin KaFai Lau <martin.lau@kernel.org>
bpf: Address KCSAN report on bpf_lru_list
Maxime Bizon <mbizon@freebox.fr>
wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range
Yicong Yang <yangyicong@hisilicon.com>
sched/fair: Don't balance task to its current running CPU
Mark Rutland <mark.rutland@arm.com>
arm64: mm: fix VA-range sanity check
Youngmin Nam <youngmin.nam@samsung.com>
arm64: set __exception_irq_entry with __irq_entry as a default
Hans de Goede <hdegoede@redhat.com>
ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version)
Hans de Goede <hdegoede@redhat.com>
ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3
Hans de Goede <hdegoede@redhat.com>
ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A
David Sterba <dsterba@suse.com>
btrfs: add xxhash to fast checksum implementations
Thomas Gleixner <tglx@linutronix.de>
posix-timers: Ensure timer ID search-loop limit is valid
Yu Kuai <yukuai3@huawei.com>
md/raid10: prevent soft lockup while flush writes
Yu Kuai <yukuai3@huawei.com>
md: fix data corruption for raid456 when reshape restart while grow up
Zhong Jinghua <zhongjinghua@huawei.com>
nbd: Add the maximum limit of allocated index in nbd_dev_add
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
debugobjects: Recheck debug_objects_enabled before reporting
Florian Westphal <fw@strlen.de>
netfilter: nf_tables: add rescheduling points during loop detection walks
Peilin Ye <peilin.ye@bytedance.com>
net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs
Jeff LaBundy <jeff@labundy.com>
Input: iqs269a - do not poll during ATI
Jeff LaBundy <jeff@labundy.com>
Input: iqs269a - do not poll during suspend or resume
Jonathan Cameron <Jonathan.Cameron@huawei.com>
Input: iqs269a - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr()
Paul Cercueil <paul@crapouillou.net>
PM: core: Remove static qualifier in DEFINE_SIMPLE_DEV_PM_OPS macro
Paul Cercueil <paul@crapouillou.net>
mmc: mxc: Use the new PM macros
Paul Cercueil <paul@crapouillou.net>
mmc: jz4740: Use the new PM macros
Paul Cercueil <paul@crapouillou.net>
PM: core: Add new *_PM_OPS macros, deprecate old ones
Paul Cercueil <paul@crapouillou.net>
PM: core: Redefine pm_ptr() macro
Ganesh Goudar <ganeshgr@linux.ibm.com>
powerpc/eeh: Set channel state after notifying the drivers
Daniel Axtens <dja@axtens.net>
powerpc/eeh: Small refactor of eeh_handle_normal_event()
Nathan Lynch <nathanl@linux.ibm.com>
powerpc/rtas: ensure 4KB alignment for rtas_data_buf
Nathan Lynch <nathanl@linux.ibm.com>
powerpc/rtas: make all exports GPL
Wang Qing <wangqing@vivo.com>
net: ethernet: ti: add missing of_node_put before return
Li Jun <jun.li@nxp.com>
dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
Lucas Stach <l.stach@pengutronix.de>
clk: imx8mp: add clkout1/2 support
Marek Vasut <marex@denx.de>
clk: imx8mp: Add DISP2 pixel clock
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
serial: 8250: Remove serial_rs485 sanitization from em485
Enzo Matsumiya <ematsumiya@suse.de>
cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl()
Hui Su <suhui_kernel@163.com>
kernel/sched: Remove dl_boosted flag comment
Chuansheng Liu <chuansheng.liu@intel.com>
drm/i915/dg1: Update DMC_DEBUG3 register
Byungki Lee <dominicus79@gmail.com>
f2fs: write checkpoint during FG_GC
Chao Yu <chao@kernel.org>
f2fs: don't set GC_FAILURE_PIN for background GC
Yifan Zhang <yifan1.zhang@amd.com>
drm/amdgpu: init iommu after amdkfd device init
Stefano Garzarella <sgarzare@redhat.com>
tools/virtio: fix build
Arnaldo Carvalho de Melo <acme@redhat.com>
perf beauty: Update copy of linux/socket.h with the kernel sources
Arnaldo Carvalho de Melo <acme@redhat.com>
tools headers UAPI: Sync linux/fscrypt.h with the kernel sources
Rafał Miłecki <rafal@milecki.pl>
ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger
Sakari Ailus <sakari.ailus@linux.intel.com>
acpi: property: Let args be NULL in __acpi_node_get_property_reference
Luke D. Jones <luke@ljones.dev>
platform/x86: asus-wmi: Document the dgpu_disable sysfs attribute
Randy Dunlap <rdunlap@infradead.org>
clk: linux/clk-provider.h: fix kernel-doc warnings and typos
Guoqing Jiang <guoqing.jiang@linux.dev>
RDMA/siw: Correct wrong debug message
Guoqing Jiang <guoqing.jiang@linux.dev>
RDMA/siw: Balance the reference of cep->kref in the error path
Rafał Miłecki <rafal@milecki.pl>
ARM: dts: BCM53573: Drop nonexistent #usb-cells
Magali Lemes <magali.lemes@canonical.com>
selftests: net: vrf-xfrm-tests: change authentication and encryption algos
Eli Cohen <elic@nvidia.com>
vdpa/mlx5: Don't clear mr struct on destroy MR
Randy Dunlap <rdunlap@infradead.org>
MIPS: vpe-mt: drop physical_memsize
Randy Dunlap <rdunlap@infradead.org>
MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set
Nathan Lynch <nathanl@linux.ibm.com>
powerpc/pseries/lpar: add missing RTAS retry status handling
Nathan Lynch <nathanl@linux.ibm.com>
powerpc/perf/hv-24x7: add missing RTAS retry status handling
Nathan Lynch <nathanl@linux.ibm.com>
powerpc/pseries/lparcfg: add missing RTAS retry status handling
Chen-Yu Tsai <wenst@chromium.org>
clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC
Frederic Barrat <fbarrat@linux.ibm.com>
powerpc/powernv/ioda: Skip unallocated resources when mapping to PE
Luca Ellero <l.ellero@asem.it>
Input: ads7846 - don't check penirq immediately for 7845
Luca Ellero <l.ellero@asem.it>
Input: ads7846 - always set last command to PWRDOWN
Peng Fan <peng.fan@nxp.com>
clk: imx: avoid memory leak
Geert Uytterhoeven <geert+renesas@glider.be>
clk: renesas: cpg-mssr: Remove superfluous check in resume code
Luca Ellero <l.ellero@asem.it>
Input: ads7846 - don't report pressure for ads7845
Alexey Khoroshilov <khoroshilov@ispras.ru>
clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed
Jeff LaBundy <jeff@labundy.com>
Input: iqs269a - increase interrupt handler return delay
Jeff LaBundy <jeff@labundy.com>
Input: iqs269a - configure device with a single block write
Jeff LaBundy <jeff@labundy.com>
Input: iqs269a - drop unused device node references
Heiko Stuebner <heiko.stuebner@vrull.eu>
RISC-V: fix funct4 definition for c.jalr in parse_asm.h
Samuel Holland <samuel@sholland.org>
mtd: rawnand: sunxi: Fix the size of the last OOB region
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
Li Jun <jun.li@nxp.com>
clk: imx: imx8mp: add shared clk gate for usb suspend clk
Paolo Abeni <pabeni@redhat.com>
mptcp: fix lockless access in subflow ULP diag
Xu Yang <xu.yang_2@nxp.com>
usb: roles: don't get/set_role() when usb_role_switch is unregistered
Xu Yang <xu.yang_2@nxp.com>
usb: roles: fix NULL pointer issue when put module's reference
Krishna Kurapati <quic_kriskura@quicinc.com>
usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
Frank Li <Frank.Li@nxp.com>
usb: cdns3: fix memory double free when handle zero packet
Frank Li <Frank.Li@nxp.com>
usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
Pawel Laszczak <pawell@cadence.com>
usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers
Pawel Laszczak <pawell@cadence.com>
usb: cdnsp: blocked some cdns3 specific code
Thinh Nguyen <Thinh.Nguyen@synopsys.com>
usb: dwc3: gadget: Don't disconnect if not started
Lino Sanfilippo <l.sanfilippo@kunbus.com>
serial: amba-pl011: Fix DMA transmission in RS485 mode
Peter Zijlstra <peterz@infradead.org>
x86/alternative: Make custom return thunk unconditional
Borislav Petkov (AMD) <bp@alien8.de>
Revert "x86/alternative: Make custom return thunk unconditional"
Peter Zijlstra <peterz@infradead.org>
x86/returnthunk: Allow different return thunks
Peter Zijlstra <peterz@infradead.org>
x86/ftrace: Use alternative RET encoding
Peter Zijlstra <peterz@infradead.org>
x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch()
Peter Zijlstra <peterz@infradead.org>
x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR
Borislav Petkov (AMD) <bp@alien8.de>
Revert "x86/ftrace: Use alternative RET encoding"
Nikita Shubin <nikita.shubin@maquefel.me>
ARM: ep93xx: Add terminator to gpiod_lookup_table
Tom Parkin <tparkin@katalix.com>
l2tp: pass correct message length to ip6_append_data
Vidya Sagar <vidyas@nvidia.com>
PCI/MSI: Prevent MSI hardware interrupt number truncation
Vasiliy Kovalev <kovalev@altlinux.org>
gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
Oliver Upton <oliver.upton@linux.dev>
KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
Oliver Upton <oliver.upton@linux.dev>
KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
Hans de Goede <hdegoede@redhat.com>
platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names
Hans de Goede <hdegoede@redhat.com>
platform/x86: intel-vbtn: Stop calling "VBDL" from notify_handler
Mikulas Patocka <mpatocka@redhat.com>
dm-crypt: don't modify the data when using authenticated encryption
Thomas Hellström <thomas.hellstrom@linux.intel.com>
drm/ttm: Fix an invalid freeing on already freed page in error path
Daniel Vacek <neelx@redhat.com>
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
Gao Xiang <hsiangkao@linux.alibaba.com>
erofs: fix lz4 inplace decompression
Geert Uytterhoeven <geert+renesas@glider.be>
pmdomain: renesas: r8a77980-sysc: CR7 must be always on
Fedor Pchelkin <pchelkin@ispras.ru>
ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails
Eugen Hristev <eugen.hristev@collabora.com>
pmdomain: mediatek: fix race conditions with genpd
Yi Sun <yi.sun@unisoc.com>
virtio-blk: Ensure no requests in virtqueues before deleting vqs.
Prike Liang <Prike.Liang@amd.com>
drm/amdgpu: reset gpu for s3 suspend abort case
Prike Liang <Prike.Liang@amd.com>
drm/amdgpu: skip to program GFXDEC registers for suspend abort
Takashi Sakamoto <o-takashi@sakamocchi.jp>
firewire: core: send bus reset promptly on gap count error
Hannes Reinecke <hare@suse.de>
scsi: lpfc: Use unsigned type for num_sge
Zhang Rui <rui.zhang@intel.com>
hwmon: (coretemp) Enlarge per package core count limit
Andrew Bresticker <abrestic@rivosinc.com>
efi: Don't add memblocks for soft-reserved memory
Andrew Bresticker <abrestic@rivosinc.com>
efi: runtime: Fix potential overflow of soft-reserved region size
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: adding missing drv_mgd_complete_tx() call
Edward Adam Davis <eadavis@qq.com>
fs/ntfs3: Fix oob in ntfs_listxattr
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Update inode->i_size after success write into compressed file
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Correct function is_rst_area_valid
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Prevent generic message "attempt to access beyond end of device"
Ism Hong <ism.hong@gmail.com>
fs/ntfs3: use non-movable memory for ntfs3 MFT buffer cache
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Disable ATTR_LIST_ENTRY size check
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame()
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Fix detected field-spanning write (size 8) of single field "le->name"
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Print warning while fixing hard links count
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Correct hard links updating when dealing with DOS names
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Improve ntfs_dir_count
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Modified fix directory element type detection
Szilard Fabian <szfabian@bluemarch.art>
Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table
Zhang Yi <yi.zhang@huawei.com>
ext4: correct the hole length returned by ext4_map_blocks()
Daniel Wagner <dwagner@suse.de>
nvmet-fc: take ref count on tgtport before delete assoc
Daniel Wagner <dwagner@suse.de>
nvmet-fc: avoid deadlock on delete association path
Daniel Wagner <dwagner@suse.de>
nvmet-fc: abort command when there is no binding
Daniel Wagner <dwagner@suse.de>
nvmet-fc: hold reference on hostport match
Daniel Wagner <dwagner@suse.de>
nvmet-fc: defer cleanup using RCU properly
Daniel Wagner <dwagner@suse.de>
nvmet-fc: release reference on target port
Daniel Wagner <dwagner@suse.de>
nvmet-fcloop: swap the list_add_tail arguments
Daniel Wagner <dwagner@suse.de>
nvme-fc: do not wait in vain when unloading module
Alexander Tsoy <alexander@tsoy.me>
ALSA: usb-audio: Ignore clock selector errors for single connection
Xin Long <lucien.xin@gmail.com>
netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
Brenton Simpson <appsforartists@google.com>
Input: xpad - add Lenovo Legion Go controllers
Wolfram Sang <wsa+renesas@sang-engineering.com>
spi: sh-msiof: avoid integer overflow in constants
Chen-Yu Tsai <wens@csie.org>
ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
Alexander Tsoy <alexander@tsoy.me>
ALSA: usb-audio: Check presence of valid altsetting control
Guixin Liu <kanie@linux.alibaba.com>
nvmet-tcp: fix nvme tcp ida memory leak
Martin Blumenstingl <martin.blumenstingl@googlemail.com>
regulator: pwm-regulator: Add validity checks in continuous .get_voltage
Kunwu Chan <chentao@kylinos.cn>
dmaengine: ti: edma: Add some null pointer checks to the edma_probe
Baokun Li <libaokun1@huawei.com>
ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
Baokun Li <libaokun1@huawei.com>
ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
Baokun Li <libaokun1@huawei.com>
ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt
Phoenix Chen <asbeltogf@gmail.com>
platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet
Huang Pei <huangpei@loongson.cn>
MIPS: reserve exception vector space ONLY ONCE
Lennert Buytenhek <kernel@wantstofly.org>
ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
Conrad Kostecki <conikost@gentoo.org>
ahci: asm1166: correct count of reported ports
Devyn Liu <liudingyuan@huawei.com>
spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
Fullway Wang <fullwaywang@outlook.com>
fbdev: sis: Error out if pixclock equals zero
Fullway Wang <fullwaywang@outlook.com>
fbdev: savage: Error out if pixclock equals zero
Felix Fietkau <nbd@nbd.name>
wifi: mac80211: fix race condition on enabling fast-xmit
Michal Kazior <michal@plume.com>
wifi: cfg80211: fix missing interfaces when dumping
Vinod Koul <vkoul@kernel.org>
dmaengine: fsl-qdma: increase size of 'irq_name'
Vinod Koul <vkoul@kernel.org>
dmaengine: shdma: increase size of 'dev_id'
Dmitry Bogdanov <d.bogdanov@yadro.com>
scsi: target: core: Add TMF to tmr_list handling
Cyril Hrubis <chrubis@suse.cz>
sched/rt: Disallow writing invalid values to sched_rt_period_us
Cyril Hrubis <chrubis@suse.cz>
sched/rt: Fix sysctl_sched_rr_timeslice intial value
Andrei Vagin <avagin@google.com>
x86/fpu: Stop relying on userspace for info to fault in xsave buffer
Damien Le Moal <dlemoal@kernel.org>
zonefs: Improve error handling
Lokesh Gidra <lokeshgidra@google.com>
userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
Jiri Olsa <jolsa@kernel.org>
bpf: Remove trace_printk_lock
Jiri Olsa <jolsa@kernel.org>
bpf: Do cleanup in bpf_bprintf_cleanup only when needed
Jiri Olsa <jolsa@kernel.org>
bpf: Add struct for bin_args arg in bpf_bprintf_prepare
Dave Marchevsky <davemarchevsky@fb.com>
bpf: Merge printk and seq_printf VARARG max macros
Dan Carpenter <dan.carpenter@linaro.org>
PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq()
Cyril Hrubis <chrubis@suse.cz>
sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
Paulo Alcantara <pc@manguebit.com>
smb: client: fix parsing of SMB3.1.1 POSIX create context
Paulo Alcantara <pc@manguebit.com>
smb: client: fix potential OOBs in smb2_parse_contexts()
Paulo Alcantara <pc@manguebit.com>
smb: client: fix OOB in receive_encrypted_standard()
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: Retire dsmark qdisc
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: Retire ATM qdisc
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: Retire CBQ qdisc
-------------
Diffstat:
Documentation/ABI/testing/sysfs-platform-asus-wmi | 9 +
Makefile | 4 +-
arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 1 -
arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 2 -
arch/arm/boot/dts/bcm53573.dtsi | 20 +-
arch/arm/mach-ep93xx/core.c | 1 +
arch/arm64/boot/dts/rockchip/px30.dtsi | 2 +
arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 79 +-
arch/arm64/include/asm/exception.h | 5 -
arch/arm64/kvm/vgic/vgic-its.c | 5 +
arch/arm64/mm/mmu.c | 4 +-
arch/mips/include/asm/vpe.h | 1 -
arch/mips/kernel/smp-cps.c | 8 +-
arch/mips/kernel/traps.c | 8 +-
arch/mips/kernel/vpe-mt.c | 7 +-
arch/mips/lantiq/prom.c | 6 -
arch/powerpc/kernel/eeh_driver.c | 71 +-
arch/powerpc/kernel/rtas.c | 24 +-
arch/powerpc/perf/hv-24x7.c | 42 +-
arch/powerpc/platforms/powernv/pci-ioda.c | 3 +-
arch/powerpc/platforms/pseries/lpar.c | 20 +-
arch/powerpc/platforms/pseries/lparcfg.c | 20 +-
arch/riscv/include/asm/parse_asm.h | 2 +-
arch/s390/pci/pci.c | 2 +-
arch/x86/include/asm/nospec-branch.h | 2 +
arch/x86/include/asm/text-patching.h | 46 +-
arch/x86/kernel/alternative.c | 13 +-
arch/x86/kernel/fpu/signal.c | 12 +-
arch/x86/kernel/ftrace.c | 4 +-
arch/x86/kernel/paravirt.c | 23 +-
arch/x86/kernel/static_call.c | 2 +-
arch/x86/net/bpf_jit_comp.c | 2 +-
drivers/acpi/button.c | 9 +
drivers/acpi/property.c | 4 +
drivers/acpi/resource.c | 35 +
drivers/acpi/video_detect.c | 34 +
drivers/ata/ahci.c | 34 +-
drivers/ata/ahci.h | 6 +-
drivers/ata/ahci_ceva.c | 125 +-
drivers/ata/ahci_da850.c | 45 +-
drivers/ata/ahci_dm816.c | 4 +-
drivers/ata/libahci_platform.c | 135 +-
drivers/block/nbd.c | 3 +-
drivers/block/virtio_blk.c | 7 +-
drivers/clk/clk.c | 11 +
drivers/clk/imx/clk-imx8mp.c | 23 +-
drivers/clk/imx/clk.c | 3 +-
drivers/clk/qcom/gcc-qcs404.c | 24 +-
drivers/clk/qcom/gpucc-sc7180.c | 7 +-
drivers/clk/qcom/gpucc-sdm845.c | 7 +-
drivers/clk/renesas/renesas-cpg-mssr.c | 8 +-
drivers/dma/fsl-qdma.c | 2 +-
drivers/dma/sh/shdma.h | 2 +-
drivers/dma/ti/edma.c | 10 +
drivers/firewire/core-card.c | 18 +-
drivers/firmware/efi/arm-runtime.c | 2 +-
drivers/firmware/efi/efi-init.c | 19 +-
drivers/firmware/efi/riscv-runtime.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 8 +
drivers/gpu/drm/amd/amdgpu/soc15.c | 22 +
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
drivers/gpu/drm/drm_syncobj.c | 6 +-
.../gpu/drm/i915/display/intel_display_debugfs.c | 4 +-
drivers/gpu/drm/i915/i915_reg.h | 3 +-
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 8 +-
drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 2 +-
drivers/gpu/drm/ttm/ttm_pool.c | 2 +-
drivers/hwmon/coretemp.c | 2 +-
drivers/i2c/busses/i2c-imx.c | 97 +-
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 +-
drivers/infiniband/hw/hfi1/pio.c | 6 +-
drivers/infiniband/hw/hfi1/sdma.c | 2 +-
drivers/infiniband/hw/irdma/defs.h | 1 +
drivers/infiniband/hw/irdma/hw.c | 8 +
drivers/infiniband/hw/irdma/verbs.c | 9 +-
drivers/infiniband/hw/qedr/verbs.c | 11 +-
drivers/infiniband/sw/siw/siw_cm.c | 1 -
drivers/infiniband/sw/siw/siw_verbs.c | 2 +-
drivers/infiniband/ulp/srpt/ib_srpt.c | 17 +-
drivers/input/joystick/xpad.c | 2 +
drivers/input/misc/iqs269a.c | 335 ++--
drivers/input/serio/i8042-acpipnpio.h | 8 +
drivers/input/touchscreen/ads7846.c | 23 +-
drivers/md/dm-crypt.c | 6 +
drivers/md/md.c | 14 +-
drivers/md/raid10.c | 2 +
drivers/mmc/host/jz4740_mmc.c | 10 +-
drivers/mmc/host/mxcmmc.c | 6 +-
drivers/mtd/nand/raw/sunxi_nand.c | 2 +-
drivers/net/ethernet/intel/igb/igb_main.c | 5 +
.../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 4 +
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 20 -
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 29 +-
drivers/net/gtp.c | 10 +-
drivers/net/wireless/ath/ath11k/mac.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 +-
drivers/nvme/host/fc.c | 47 +-
drivers/nvme/target/fc.c | 131 +-
drivers/nvme/target/fcloop.c | 6 +-
drivers/nvme/target/tcp.c | 1 +
drivers/pci/controller/dwc/pcie-designware-ep.c | 3 +-
drivers/pci/msi.c | 2 +-
drivers/platform/x86/intel/vbtn.c | 3 -
drivers/platform/x86/touchscreen_dmi.c | 39 +-
drivers/regulator/pwm-regulator.c | 3 +
drivers/scsi/Kconfig | 2 +-
drivers/scsi/lpfc/lpfc_scsi.c | 12 +-
drivers/soc/mediatek/mtk-pm-domains.c | 15 +-
drivers/soc/renesas/r8a77980-sysc.c | 3 +-
drivers/spi/spi-hisi-sfc-v3xx.c | 5 +
drivers/spi/spi-sh-msiof.c | 16 +-
drivers/target/target_core_device.c | 5 -
drivers/target/target_core_transport.c | 4 +
drivers/tty/serial/8250/8250_port.c | 18 +-
drivers/tty/serial/amba-pl011.c | 60 +-
drivers/usb/cdns3/cdns3-gadget.c | 8 +-
drivers/usb/cdns3/core.c | 1 -
drivers/usb/cdns3/drd.c | 13 +-
drivers/usb/cdns3/drd.h | 6 +-
drivers/usb/cdns3/host.c | 16 +-
drivers/usb/dwc3/gadget.c | 5 +
drivers/usb/gadget/function/f_ncm.c | 10 +-
drivers/usb/host/xhci-hub.c | 228 +--
drivers/usb/host/xhci-mem.c | 10 +-
drivers/usb/host/xhci-ring.c | 13 +-
drivers/usb/host/xhci.h | 9 +-
drivers/usb/roles/class.c | 29 +-
drivers/vdpa/mlx5/core/mr.c | 1 -
drivers/video/fbdev/savage/savagefb_driver.c | 3 +
drivers/video/fbdev/sis/sis_main.c | 2 +
fs/afs/volume.c | 4 +-
fs/aio.c | 9 +-
fs/btrfs/disk-io.c | 3 +
fs/cifs/connect.c | 19 +-
fs/cifs/smb2file.c | 1 -
fs/cifs/smb2ops.c | 54 +-
fs/cifs/smb2pdu.c | 115 +-
fs/cifs/smb2proto.h | 16 +-
fs/erofs/decompressor.c | 34 +-
fs/exfat/dir.c | 15 +
fs/exfat/exfat_fs.h | 5 +-
fs/ext4/extents.c | 111 +-
fs/ext4/mballoc.c | 70 +-
fs/f2fs/gc.c | 39 +-
fs/ksmbd/smb2pdu.c | 8 +-
fs/ntfs3/attrib.c | 20 +-
fs/ntfs3/attrlist.c | 8 +-
fs/ntfs3/dir.c | 40 +-
fs/ntfs3/file.c | 2 +
fs/ntfs3/fslog.c | 14 +-
fs/ntfs3/fsntfs.c | 24 +
fs/ntfs3/inode.c | 2 +-
fs/ntfs3/ntfs.h | 4 +-
fs/ntfs3/ntfs_fs.h | 14 +-
fs/ntfs3/record.c | 16 +-
fs/ntfs3/xattr.c | 3 +
fs/zonefs/super.c | 68 +-
include/dt-bindings/clock/imx8mp-clock.h | 10 +-
include/linux/ahci_platform.h | 5 +-
include/linux/bpf.h | 14 +-
include/linux/clk-provider.h | 15 +-
include/linux/fs.h | 2 +
include/linux/pm.h | 80 +-
include/linux/sched.h | 4 -
include/linux/sched/signal.h | 2 +-
include/linux/socket.h | 5 +-
include/net/netfilter/nf_flow_table.h | 4 +-
include/net/tcp.h | 2 +-
kernel/bpf/bpf_lru_list.c | 21 +-
kernel/bpf/bpf_lru_list.h | 7 +-
kernel/bpf/helpers.c | 76 +-
kernel/bpf/verifier.c | 3 +-
kernel/sched/fair.c | 2 +-
kernel/sched/rt.c | 10 +-
kernel/sysctl.c | 4 +
kernel/time/posix-timers.c | 31 +-
kernel/trace/bpf_trace.c | 39 +-
lib/debugobjects.c | 9 +
mm/userfaultfd.c | 14 +-
net/core/dev.c | 2 +-
net/core/dev_ioctl.c | 2 +-
net/core/devlink.c | 5 +-
net/ipv4/arp.c | 3 +-
net/ipv4/devinet.c | 21 +-
net/ipv6/addrconf.c | 21 +-
net/ipv6/seg6.c | 20 +-
net/l2tp/l2tp_ip6.c | 2 +-
net/mac80211/mlme.c | 1 +
net/mac80211/sta_info.c | 2 +
net/mac80211/tx.c | 2 +-
net/mptcp/diag.c | 6 +-
net/netfilter/nf_conntrack_proto_sctp.c | 2 +-
net/netfilter/nf_flow_table_core.c | 41 +-
net/netfilter/nf_tables_api.c | 3 +
net/netfilter/nft_flow_offload.c | 14 +-
net/packet/af_packet.c | 12 +-
net/sched/Kconfig | 42 -
net/sched/Makefile | 3 -
net/sched/sch_api.c | 20 +-
net/sched/sch_atm.c | 710 --------
net/sched/sch_cbq.c | 1817 --------------------
net/sched/sch_dsmark.c | 522 ------
net/tls/tls_main.c | 2 +-
net/tls/tls_sw.c | 12 +-
net/wireless/nl80211.c | 1 +
net/wireless/wext-core.c | 6 +
scripts/bpf_doc.py | 2 +-
sound/soc/sunxi/sun4i-spdif.c | 5 +
sound/usb/clock.c | 10 +-
sound/usb/format.c | 20 +
tools/include/uapi/linux/fscrypt.h | 3 +-
tools/perf/trace/beauty/include/linux/socket.h | 2 +
tools/testing/selftests/net/vrf-xfrm-tests.sh | 32 +-
tools/virtio/linux/kernel.h | 2 +-
tools/virtio/linux/vringh.h | 1 +
218 files changed, 2296 insertions(+), 4619 deletions(-)
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 001/245] net/sched: Retire CBQ qdisc
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 002/245] net/sched: Retire ATM qdisc Greg Kroah-Hartman
` (254 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamal Hadi Salim, Jiri Pirko,
Paolo Abeni
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
commit 051d442098421c28c7951625652f61b1e15c4bd5 upstream.
While this amazing qdisc has served us well over the years it has not been
getting any tender love and care and has bitrotted over time.
It has become mostly a shooting target for syzkaller lately.
For this reason, we are retiring it. Goodbye CBQ - we loved you.
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/Kconfig | 17
net/sched/Makefile | 1
net/sched/sch_cbq.c | 1817 ----------------------------------------------------
3 files changed, 1835 deletions(-)
delete mode 100644 net/sched/sch_cbq.c
delete mode 100644 tools/testing/selftests/tc-testing/tc-tests/qdiscs/cbq.json
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -45,23 +45,6 @@ if NET_SCHED
comment "Queueing/Scheduling"
-config NET_SCH_CBQ
- tristate "Class Based Queueing (CBQ)"
- help
- Say Y here if you want to use the Class-Based Queueing (CBQ) packet
- scheduling algorithm. This algorithm classifies the waiting packets
- into a tree-like hierarchy of classes; the leaves of this tree are
- in turn scheduled by separate algorithms.
-
- See the top of <file:net/sched/sch_cbq.c> for more details.
-
- CBQ is a commonly used scheduler, so if you're unsure, you should
- say Y here. Then say Y to all the queueing algorithms below that you
- want to use as leaf disciplines.
-
- To compile this code as a module, choose M here: the
- module will be called sch_cbq.
-
config NET_SCH_HTB
tristate "Hierarchical Token Bucket (HTB)"
help
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -33,7 +33,6 @@ obj-$(CONFIG_NET_ACT_TUNNEL_KEY)+= act_t
obj-$(CONFIG_NET_ACT_CT) += act_ct.o
obj-$(CONFIG_NET_ACT_GATE) += act_gate.o
obj-$(CONFIG_NET_SCH_FIFO) += sch_fifo.o
-obj-$(CONFIG_NET_SCH_CBQ) += sch_cbq.o
obj-$(CONFIG_NET_SCH_HTB) += sch_htb.o
obj-$(CONFIG_NET_SCH_HFSC) += sch_hfsc.o
obj-$(CONFIG_NET_SCH_RED) += sch_red.o
--- a/net/sched/sch_cbq.c
+++ /dev/null
@@ -1,1817 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * net/sched/sch_cbq.c Class-Based Queueing discipline.
- *
- * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
- */
-
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/errno.h>
-#include <linux/skbuff.h>
-#include <net/netlink.h>
-#include <net/pkt_sched.h>
-#include <net/pkt_cls.h>
-
-
-/* Class-Based Queueing (CBQ) algorithm.
- =======================================
-
- Sources: [1] Sally Floyd and Van Jacobson, "Link-sharing and Resource
- Management Models for Packet Networks",
- IEEE/ACM Transactions on Networking, Vol.3, No.4, 1995
-
- [2] Sally Floyd, "Notes on CBQ and Guaranteed Service", 1995
-
- [3] Sally Floyd, "Notes on Class-Based Queueing: Setting
- Parameters", 1996
-
- [4] Sally Floyd and Michael Speer, "Experimental Results
- for Class-Based Queueing", 1998, not published.
-
- -----------------------------------------------------------------------
-
- Algorithm skeleton was taken from NS simulator cbq.cc.
- If someone wants to check this code against the LBL version,
- he should take into account that ONLY the skeleton was borrowed,
- the implementation is different. Particularly:
-
- --- The WRR algorithm is different. Our version looks more
- reasonable (I hope) and works when quanta are allowed to be
- less than MTU, which is always the case when real time classes
- have small rates. Note, that the statement of [3] is
- incomplete, delay may actually be estimated even if class
- per-round allotment is less than MTU. Namely, if per-round
- allotment is W*r_i, and r_1+...+r_k = r < 1
-
- delay_i <= ([MTU/(W*r_i)]*W*r + W*r + k*MTU)/B
-
- In the worst case we have IntServ estimate with D = W*r+k*MTU
- and C = MTU*r. The proof (if correct at all) is trivial.
-
-
- --- It seems that cbq-2.0 is not very accurate. At least, I cannot
- interpret some places, which look like wrong translations
- from NS. Anyone is advised to find these differences
- and explain to me, why I am wrong 8).
-
- --- Linux has no EOI event, so that we cannot estimate true class
- idle time. Workaround is to consider the next dequeue event
- as sign that previous packet is finished. This is wrong because of
- internal device queueing, but on a permanently loaded link it is true.
- Moreover, combined with clock integrator, this scheme looks
- very close to an ideal solution. */
-
-struct cbq_sched_data;
-
-
-struct cbq_class {
- struct Qdisc_class_common common;
- struct cbq_class *next_alive; /* next class with backlog in this priority band */
-
-/* Parameters */
- unsigned char priority; /* class priority */
- unsigned char priority2; /* priority to be used after overlimit */
- unsigned char ewma_log; /* time constant for idle time calculation */
-
- u32 defmap;
-
- /* Link-sharing scheduler parameters */
- long maxidle; /* Class parameters: see below. */
- long offtime;
- long minidle;
- u32 avpkt;
- struct qdisc_rate_table *R_tab;
-
- /* General scheduler (WRR) parameters */
- long allot;
- long quantum; /* Allotment per WRR round */
- long weight; /* Relative allotment: see below */
-
- struct Qdisc *qdisc; /* Ptr to CBQ discipline */
- struct cbq_class *split; /* Ptr to split node */
- struct cbq_class *share; /* Ptr to LS parent in the class tree */
- struct cbq_class *tparent; /* Ptr to tree parent in the class tree */
- struct cbq_class *borrow; /* NULL if class is bandwidth limited;
- parent otherwise */
- struct cbq_class *sibling; /* Sibling chain */
- struct cbq_class *children; /* Pointer to children chain */
-
- struct Qdisc *q; /* Elementary queueing discipline */
-
-
-/* Variables */
- unsigned char cpriority; /* Effective priority */
- unsigned char delayed;
- unsigned char level; /* level of the class in hierarchy:
- 0 for leaf classes, and maximal
- level of children + 1 for nodes.
- */
-
- psched_time_t last; /* Last end of service */
- psched_time_t undertime;
- long avgidle;
- long deficit; /* Saved deficit for WRR */
- psched_time_t penalized;
- struct gnet_stats_basic_packed bstats;
- struct gnet_stats_queue qstats;
- struct net_rate_estimator __rcu *rate_est;
- struct tc_cbq_xstats xstats;
-
- struct tcf_proto __rcu *filter_list;
- struct tcf_block *block;
-
- int filters;
-
- struct cbq_class *defaults[TC_PRIO_MAX + 1];
-};
-
-struct cbq_sched_data {
- struct Qdisc_class_hash clhash; /* Hash table of all classes */
- int nclasses[TC_CBQ_MAXPRIO + 1];
- unsigned int quanta[TC_CBQ_MAXPRIO + 1];
-
- struct cbq_class link;
-
- unsigned int activemask;
- struct cbq_class *active[TC_CBQ_MAXPRIO + 1]; /* List of all classes
- with backlog */
-
-#ifdef CONFIG_NET_CLS_ACT
- struct cbq_class *rx_class;
-#endif
- struct cbq_class *tx_class;
- struct cbq_class *tx_borrowed;
- int tx_len;
- psched_time_t now; /* Cached timestamp */
- unsigned int pmask;
-
- struct hrtimer delay_timer;
- struct qdisc_watchdog watchdog; /* Watchdog timer,
- started when CBQ has
- backlog, but cannot
- transmit just now */
- psched_tdiff_t wd_expires;
- int toplevel;
- u32 hgenerator;
-};
-
-
-#define L2T(cl, len) qdisc_l2t((cl)->R_tab, len)
-
-static inline struct cbq_class *
-cbq_class_lookup(struct cbq_sched_data *q, u32 classid)
-{
- struct Qdisc_class_common *clc;
-
- clc = qdisc_class_find(&q->clhash, classid);
- if (clc == NULL)
- return NULL;
- return container_of(clc, struct cbq_class, common);
-}
-
-#ifdef CONFIG_NET_CLS_ACT
-
-static struct cbq_class *
-cbq_reclassify(struct sk_buff *skb, struct cbq_class *this)
-{
- struct cbq_class *cl;
-
- for (cl = this->tparent; cl; cl = cl->tparent) {
- struct cbq_class *new = cl->defaults[TC_PRIO_BESTEFFORT];
-
- if (new != NULL && new != this)
- return new;
- }
- return NULL;
-}
-
-#endif
-
-/* Classify packet. The procedure is pretty complicated, but
- * it allows us to combine link sharing and priority scheduling
- * transparently.
- *
- * Namely, you can put link sharing rules (f.e. route based) at root of CBQ,
- * so that it resolves to split nodes. Then packets are classified
- * by logical priority, or a more specific classifier may be attached
- * to the split node.
- */
-
-static struct cbq_class *
-cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct cbq_class *head = &q->link;
- struct cbq_class **defmap;
- struct cbq_class *cl = NULL;
- u32 prio = skb->priority;
- struct tcf_proto *fl;
- struct tcf_result res;
-
- /*
- * Step 1. If skb->priority points to one of our classes, use it.
- */
- if (TC_H_MAJ(prio ^ sch->handle) == 0 &&
- (cl = cbq_class_lookup(q, prio)) != NULL)
- return cl;
-
- *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
- for (;;) {
- int result = 0;
- defmap = head->defaults;
-
- fl = rcu_dereference_bh(head->filter_list);
- /*
- * Step 2+n. Apply classifier.
- */
- result = tcf_classify(skb, NULL, fl, &res, true);
- if (!fl || result < 0)
- goto fallback;
- if (result == TC_ACT_SHOT)
- return NULL;
-
- cl = (void *)res.class;
- if (!cl) {
- if (TC_H_MAJ(res.classid))
- cl = cbq_class_lookup(q, res.classid);
- else if ((cl = defmap[res.classid & TC_PRIO_MAX]) == NULL)
- cl = defmap[TC_PRIO_BESTEFFORT];
-
- if (cl == NULL)
- goto fallback;
- }
- if (cl->level >= head->level)
- goto fallback;
-#ifdef CONFIG_NET_CLS_ACT
- switch (result) {
- case TC_ACT_QUEUED:
- case TC_ACT_STOLEN:
- case TC_ACT_TRAP:
- *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
- fallthrough;
- case TC_ACT_RECLASSIFY:
- return cbq_reclassify(skb, cl);
- }
-#endif
- if (cl->level == 0)
- return cl;
-
- /*
- * Step 3+n. If classifier selected a link sharing class,
- * apply agency specific classifier.
- * Repeat this procedure until we hit a leaf node.
- */
- head = cl;
- }
-
-fallback:
- cl = head;
-
- /*
- * Step 4. No success...
- */
- if (TC_H_MAJ(prio) == 0 &&
- !(cl = head->defaults[prio & TC_PRIO_MAX]) &&
- !(cl = head->defaults[TC_PRIO_BESTEFFORT]))
- return head;
-
- return cl;
-}
-
-/*
- * A packet has just been enqueued on the empty class.
- * cbq_activate_class adds it to the tail of active class list
- * of its priority band.
- */
-
-static inline void cbq_activate_class(struct cbq_class *cl)
-{
- struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
- int prio = cl->cpriority;
- struct cbq_class *cl_tail;
-
- cl_tail = q->active[prio];
- q->active[prio] = cl;
-
- if (cl_tail != NULL) {
- cl->next_alive = cl_tail->next_alive;
- cl_tail->next_alive = cl;
- } else {
- cl->next_alive = cl;
- q->activemask |= (1<<prio);
- }
-}
-
-/*
- * Unlink class from active chain.
- * Note that this same procedure is done directly in cbq_dequeue*
- * during round-robin procedure.
- */
-
-static void cbq_deactivate_class(struct cbq_class *this)
-{
- struct cbq_sched_data *q = qdisc_priv(this->qdisc);
- int prio = this->cpriority;
- struct cbq_class *cl;
- struct cbq_class *cl_prev = q->active[prio];
-
- do {
- cl = cl_prev->next_alive;
- if (cl == this) {
- cl_prev->next_alive = cl->next_alive;
- cl->next_alive = NULL;
-
- if (cl == q->active[prio]) {
- q->active[prio] = cl_prev;
- if (cl == q->active[prio]) {
- q->active[prio] = NULL;
- q->activemask &= ~(1<<prio);
- return;
- }
- }
- return;
- }
- } while ((cl_prev = cl) != q->active[prio]);
-}
-
-static void
-cbq_mark_toplevel(struct cbq_sched_data *q, struct cbq_class *cl)
-{
- int toplevel = q->toplevel;
-
- if (toplevel > cl->level) {
- psched_time_t now = psched_get_time();
-
- do {
- if (cl->undertime < now) {
- q->toplevel = cl->level;
- return;
- }
- } while ((cl = cl->borrow) != NULL && toplevel > cl->level);
- }
-}
-
-static int
-cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
- struct sk_buff **to_free)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- int ret;
- struct cbq_class *cl = cbq_classify(skb, sch, &ret);
-
-#ifdef CONFIG_NET_CLS_ACT
- q->rx_class = cl;
-#endif
- if (cl == NULL) {
- if (ret & __NET_XMIT_BYPASS)
- qdisc_qstats_drop(sch);
- __qdisc_drop(skb, to_free);
- return ret;
- }
-
- ret = qdisc_enqueue(skb, cl->q, to_free);
- if (ret == NET_XMIT_SUCCESS) {
- sch->q.qlen++;
- cbq_mark_toplevel(q, cl);
- if (!cl->next_alive)
- cbq_activate_class(cl);
- return ret;
- }
-
- if (net_xmit_drop_count(ret)) {
- qdisc_qstats_drop(sch);
- cbq_mark_toplevel(q, cl);
- cl->qstats.drops++;
- }
- return ret;
-}
-
-/* Overlimit action: penalize leaf class by adding offtime */
-static void cbq_overlimit(struct cbq_class *cl)
-{
- struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
- psched_tdiff_t delay = cl->undertime - q->now;
-
- if (!cl->delayed) {
- delay += cl->offtime;
-
- /*
- * Class goes to sleep, so that it will have no
- * chance to work avgidle. Let's forgive it 8)
- *
- * BTW cbq-2.0 has a crap in this
- * place, apparently they forgot to shift it by cl->ewma_log.
- */
- if (cl->avgidle < 0)
- delay -= (-cl->avgidle) - ((-cl->avgidle) >> cl->ewma_log);
- if (cl->avgidle < cl->minidle)
- cl->avgidle = cl->minidle;
- if (delay <= 0)
- delay = 1;
- cl->undertime = q->now + delay;
-
- cl->xstats.overactions++;
- cl->delayed = 1;
- }
- if (q->wd_expires == 0 || q->wd_expires > delay)
- q->wd_expires = delay;
-
- /* Dirty work! We must schedule wakeups based on
- * real available rate, rather than leaf rate,
- * which may be tiny (even zero).
- */
- if (q->toplevel == TC_CBQ_MAXLEVEL) {
- struct cbq_class *b;
- psched_tdiff_t base_delay = q->wd_expires;
-
- for (b = cl->borrow; b; b = b->borrow) {
- delay = b->undertime - q->now;
- if (delay < base_delay) {
- if (delay <= 0)
- delay = 1;
- base_delay = delay;
- }
- }
-
- q->wd_expires = base_delay;
- }
-}
-
-static psched_tdiff_t cbq_undelay_prio(struct cbq_sched_data *q, int prio,
- psched_time_t now)
-{
- struct cbq_class *cl;
- struct cbq_class *cl_prev = q->active[prio];
- psched_time_t sched = now;
-
- if (cl_prev == NULL)
- return 0;
-
- do {
- cl = cl_prev->next_alive;
- if (now - cl->penalized > 0) {
- cl_prev->next_alive = cl->next_alive;
- cl->next_alive = NULL;
- cl->cpriority = cl->priority;
- cl->delayed = 0;
- cbq_activate_class(cl);
-
- if (cl == q->active[prio]) {
- q->active[prio] = cl_prev;
- if (cl == q->active[prio]) {
- q->active[prio] = NULL;
- return 0;
- }
- }
-
- cl = cl_prev->next_alive;
- } else if (sched - cl->penalized > 0)
- sched = cl->penalized;
- } while ((cl_prev = cl) != q->active[prio]);
-
- return sched - now;
-}
-
-static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
-{
- struct cbq_sched_data *q = container_of(timer, struct cbq_sched_data,
- delay_timer);
- struct Qdisc *sch = q->watchdog.qdisc;
- psched_time_t now;
- psched_tdiff_t delay = 0;
- unsigned int pmask;
-
- now = psched_get_time();
-
- pmask = q->pmask;
- q->pmask = 0;
-
- while (pmask) {
- int prio = ffz(~pmask);
- psched_tdiff_t tmp;
-
- pmask &= ~(1<<prio);
-
- tmp = cbq_undelay_prio(q, prio, now);
- if (tmp > 0) {
- q->pmask |= 1<<prio;
- if (tmp < delay || delay == 0)
- delay = tmp;
- }
- }
-
- if (delay) {
- ktime_t time;
-
- time = 0;
- time = ktime_add_ns(time, PSCHED_TICKS2NS(now + delay));
- hrtimer_start(&q->delay_timer, time, HRTIMER_MODE_ABS_PINNED);
- }
-
- __netif_schedule(qdisc_root(sch));
- return HRTIMER_NORESTART;
-}
-
-/*
- * It is mission critical procedure.
- *
- * We "regenerate" toplevel cutoff, if transmitting class
- * has backlog and it is not regulated. It is not part of
- * original CBQ description, but looks more reasonable.
- * Probably, it is wrong. This question needs further investigation.
- */
-
-static inline void
-cbq_update_toplevel(struct cbq_sched_data *q, struct cbq_class *cl,
- struct cbq_class *borrowed)
-{
- if (cl && q->toplevel >= borrowed->level) {
- if (cl->q->q.qlen > 1) {
- do {
- if (borrowed->undertime == PSCHED_PASTPERFECT) {
- q->toplevel = borrowed->level;
- return;
- }
- } while ((borrowed = borrowed->borrow) != NULL);
- }
-#if 0
- /* It is not necessary now. Uncommenting it
- will save CPU cycles, but decrease fairness.
- */
- q->toplevel = TC_CBQ_MAXLEVEL;
-#endif
- }
-}
-
-static void
-cbq_update(struct cbq_sched_data *q)
-{
- struct cbq_class *this = q->tx_class;
- struct cbq_class *cl = this;
- int len = q->tx_len;
- psched_time_t now;
-
- q->tx_class = NULL;
- /* Time integrator. We calculate EOS time
- * by adding expected packet transmission time.
- */
- now = q->now + L2T(&q->link, len);
-
- for ( ; cl; cl = cl->share) {
- long avgidle = cl->avgidle;
- long idle;
-
- cl->bstats.packets++;
- cl->bstats.bytes += len;
-
- /*
- * (now - last) is total time between packet right edges.
- * (last_pktlen/rate) is "virtual" busy time, so that
- *
- * idle = (now - last) - last_pktlen/rate
- */
-
- idle = now - cl->last;
- if ((unsigned long)idle > 128*1024*1024) {
- avgidle = cl->maxidle;
- } else {
- idle -= L2T(cl, len);
-
- /* true_avgidle := (1-W)*true_avgidle + W*idle,
- * where W=2^{-ewma_log}. But cl->avgidle is scaled:
- * cl->avgidle == true_avgidle/W,
- * hence:
- */
- avgidle += idle - (avgidle>>cl->ewma_log);
- }
-
- if (avgidle <= 0) {
- /* Overlimit or at-limit */
-
- if (avgidle < cl->minidle)
- avgidle = cl->minidle;
-
- cl->avgidle = avgidle;
-
- /* Calculate expected time, when this class
- * will be allowed to send.
- * It will occur, when:
- * (1-W)*true_avgidle + W*delay = 0, i.e.
- * idle = (1/W - 1)*(-true_avgidle)
- * or
- * idle = (1 - W)*(-cl->avgidle);
- */
- idle = (-avgidle) - ((-avgidle) >> cl->ewma_log);
-
- /*
- * That is not all.
- * To maintain the rate allocated to the class,
- * we add to undertime virtual clock,
- * necessary to complete transmitted packet.
- * (len/phys_bandwidth has been already passed
- * to the moment of cbq_update)
- */
-
- idle -= L2T(&q->link, len);
- idle += L2T(cl, len);
-
- cl->undertime = now + idle;
- } else {
- /* Underlimit */
-
- cl->undertime = PSCHED_PASTPERFECT;
- if (avgidle > cl->maxidle)
- cl->avgidle = cl->maxidle;
- else
- cl->avgidle = avgidle;
- }
- if ((s64)(now - cl->last) > 0)
- cl->last = now;
- }
-
- cbq_update_toplevel(q, this, q->tx_borrowed);
-}
-
-static inline struct cbq_class *
-cbq_under_limit(struct cbq_class *cl)
-{
- struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
- struct cbq_class *this_cl = cl;
-
- if (cl->tparent == NULL)
- return cl;
-
- if (cl->undertime == PSCHED_PASTPERFECT || q->now >= cl->undertime) {
- cl->delayed = 0;
- return cl;
- }
-
- do {
- /* It is very suspicious place. Now overlimit
- * action is generated for not bounded classes
- * only if link is completely congested.
- * Though it is in agree with ancestor-only paradigm,
- * it looks very stupid. Particularly,
- * it means that this chunk of code will either
- * never be called or result in strong amplification
- * of burstiness. Dangerous, silly, and, however,
- * no another solution exists.
- */
- cl = cl->borrow;
- if (!cl) {
- this_cl->qstats.overlimits++;
- cbq_overlimit(this_cl);
- return NULL;
- }
- if (cl->level > q->toplevel)
- return NULL;
- } while (cl->undertime != PSCHED_PASTPERFECT && q->now < cl->undertime);
-
- cl->delayed = 0;
- return cl;
-}
-
-static inline struct sk_buff *
-cbq_dequeue_prio(struct Qdisc *sch, int prio)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct cbq_class *cl_tail, *cl_prev, *cl;
- struct sk_buff *skb;
- int deficit;
-
- cl_tail = cl_prev = q->active[prio];
- cl = cl_prev->next_alive;
-
- do {
- deficit = 0;
-
- /* Start round */
- do {
- struct cbq_class *borrow = cl;
-
- if (cl->q->q.qlen &&
- (borrow = cbq_under_limit(cl)) == NULL)
- goto skip_class;
-
- if (cl->deficit <= 0) {
- /* Class exhausted its allotment per
- * this round. Switch to the next one.
- */
- deficit = 1;
- cl->deficit += cl->quantum;
- goto next_class;
- }
-
- skb = cl->q->dequeue(cl->q);
-
- /* Class did not give us any skb :-(
- * It could occur even if cl->q->q.qlen != 0
- * f.e. if cl->q == "tbf"
- */
- if (skb == NULL)
- goto skip_class;
-
- cl->deficit -= qdisc_pkt_len(skb);
- q->tx_class = cl;
- q->tx_borrowed = borrow;
- if (borrow != cl) {
-#ifndef CBQ_XSTATS_BORROWS_BYTES
- borrow->xstats.borrows++;
- cl->xstats.borrows++;
-#else
- borrow->xstats.borrows += qdisc_pkt_len(skb);
- cl->xstats.borrows += qdisc_pkt_len(skb);
-#endif
- }
- q->tx_len = qdisc_pkt_len(skb);
-
- if (cl->deficit <= 0) {
- q->active[prio] = cl;
- cl = cl->next_alive;
- cl->deficit += cl->quantum;
- }
- return skb;
-
-skip_class:
- if (cl->q->q.qlen == 0 || prio != cl->cpriority) {
- /* Class is empty or penalized.
- * Unlink it from active chain.
- */
- cl_prev->next_alive = cl->next_alive;
- cl->next_alive = NULL;
-
- /* Did cl_tail point to it? */
- if (cl == cl_tail) {
- /* Repair it! */
- cl_tail = cl_prev;
-
- /* Was it the last class in this band? */
- if (cl == cl_tail) {
- /* Kill the band! */
- q->active[prio] = NULL;
- q->activemask &= ~(1<<prio);
- if (cl->q->q.qlen)
- cbq_activate_class(cl);
- return NULL;
- }
-
- q->active[prio] = cl_tail;
- }
- if (cl->q->q.qlen)
- cbq_activate_class(cl);
-
- cl = cl_prev;
- }
-
-next_class:
- cl_prev = cl;
- cl = cl->next_alive;
- } while (cl_prev != cl_tail);
- } while (deficit);
-
- q->active[prio] = cl_prev;
-
- return NULL;
-}
-
-static inline struct sk_buff *
-cbq_dequeue_1(struct Qdisc *sch)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct sk_buff *skb;
- unsigned int activemask;
-
- activemask = q->activemask & 0xFF;
- while (activemask) {
- int prio = ffz(~activemask);
- activemask &= ~(1<<prio);
- skb = cbq_dequeue_prio(sch, prio);
- if (skb)
- return skb;
- }
- return NULL;
-}
-
-static struct sk_buff *
-cbq_dequeue(struct Qdisc *sch)
-{
- struct sk_buff *skb;
- struct cbq_sched_data *q = qdisc_priv(sch);
- psched_time_t now;
-
- now = psched_get_time();
-
- if (q->tx_class)
- cbq_update(q);
-
- q->now = now;
-
- for (;;) {
- q->wd_expires = 0;
-
- skb = cbq_dequeue_1(sch);
- if (skb) {
- qdisc_bstats_update(sch, skb);
- sch->q.qlen--;
- return skb;
- }
-
- /* All the classes are overlimit.
- *
- * It is possible, if:
- *
- * 1. Scheduler is empty.
- * 2. Toplevel cutoff inhibited borrowing.
- * 3. Root class is overlimit.
- *
- * Reset 2d and 3d conditions and retry.
- *
- * Note, that NS and cbq-2.0 are buggy, peeking
- * an arbitrary class is appropriate for ancestor-only
- * sharing, but not for toplevel algorithm.
- *
- * Our version is better, but slower, because it requires
- * two passes, but it is unavoidable with top-level sharing.
- */
-
- if (q->toplevel == TC_CBQ_MAXLEVEL &&
- q->link.undertime == PSCHED_PASTPERFECT)
- break;
-
- q->toplevel = TC_CBQ_MAXLEVEL;
- q->link.undertime = PSCHED_PASTPERFECT;
- }
-
- /* No packets in scheduler or nobody wants to give them to us :-(
- * Sigh... start watchdog timer in the last case.
- */
-
- if (sch->q.qlen) {
- qdisc_qstats_overlimit(sch);
- if (q->wd_expires)
- qdisc_watchdog_schedule(&q->watchdog,
- now + q->wd_expires);
- }
- return NULL;
-}
-
-/* CBQ class maintenance routines */
-
-static void cbq_adjust_levels(struct cbq_class *this)
-{
- if (this == NULL)
- return;
-
- do {
- int level = 0;
- struct cbq_class *cl;
-
- cl = this->children;
- if (cl) {
- do {
- if (cl->level > level)
- level = cl->level;
- } while ((cl = cl->sibling) != this->children);
- }
- this->level = level + 1;
- } while ((this = this->tparent) != NULL);
-}
-
-static void cbq_normalize_quanta(struct cbq_sched_data *q, int prio)
-{
- struct cbq_class *cl;
- unsigned int h;
-
- if (q->quanta[prio] == 0)
- return;
-
- for (h = 0; h < q->clhash.hashsize; h++) {
- hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
- /* BUGGGG... Beware! This expression suffer of
- * arithmetic overflows!
- */
- if (cl->priority == prio) {
- cl->quantum = (cl->weight*cl->allot*q->nclasses[prio])/
- q->quanta[prio];
- }
- if (cl->quantum <= 0 ||
- cl->quantum > 32*qdisc_dev(cl->qdisc)->mtu) {
- pr_warn("CBQ: class %08x has bad quantum==%ld, repaired.\n",
- cl->common.classid, cl->quantum);
- cl->quantum = qdisc_dev(cl->qdisc)->mtu/2 + 1;
- }
- }
- }
-}
-
-static void cbq_sync_defmap(struct cbq_class *cl)
-{
- struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
- struct cbq_class *split = cl->split;
- unsigned int h;
- int i;
-
- if (split == NULL)
- return;
-
- for (i = 0; i <= TC_PRIO_MAX; i++) {
- if (split->defaults[i] == cl && !(cl->defmap & (1<<i)))
- split->defaults[i] = NULL;
- }
-
- for (i = 0; i <= TC_PRIO_MAX; i++) {
- int level = split->level;
-
- if (split->defaults[i])
- continue;
-
- for (h = 0; h < q->clhash.hashsize; h++) {
- struct cbq_class *c;
-
- hlist_for_each_entry(c, &q->clhash.hash[h],
- common.hnode) {
- if (c->split == split && c->level < level &&
- c->defmap & (1<<i)) {
- split->defaults[i] = c;
- level = c->level;
- }
- }
- }
- }
-}
-
-static void cbq_change_defmap(struct cbq_class *cl, u32 splitid, u32 def, u32 mask)
-{
- struct cbq_class *split = NULL;
-
- if (splitid == 0) {
- split = cl->split;
- if (!split)
- return;
- splitid = split->common.classid;
- }
-
- if (split == NULL || split->common.classid != splitid) {
- for (split = cl->tparent; split; split = split->tparent)
- if (split->common.classid == splitid)
- break;
- }
-
- if (split == NULL)
- return;
-
- if (cl->split != split) {
- cl->defmap = 0;
- cbq_sync_defmap(cl);
- cl->split = split;
- cl->defmap = def & mask;
- } else
- cl->defmap = (cl->defmap & ~mask) | (def & mask);
-
- cbq_sync_defmap(cl);
-}
-
-static void cbq_unlink_class(struct cbq_class *this)
-{
- struct cbq_class *cl, **clp;
- struct cbq_sched_data *q = qdisc_priv(this->qdisc);
-
- qdisc_class_hash_remove(&q->clhash, &this->common);
-
- if (this->tparent) {
- clp = &this->sibling;
- cl = *clp;
- do {
- if (cl == this) {
- *clp = cl->sibling;
- break;
- }
- clp = &cl->sibling;
- } while ((cl = *clp) != this->sibling);
-
- if (this->tparent->children == this) {
- this->tparent->children = this->sibling;
- if (this->sibling == this)
- this->tparent->children = NULL;
- }
- } else {
- WARN_ON(this->sibling != this);
- }
-}
-
-static void cbq_link_class(struct cbq_class *this)
-{
- struct cbq_sched_data *q = qdisc_priv(this->qdisc);
- struct cbq_class *parent = this->tparent;
-
- this->sibling = this;
- qdisc_class_hash_insert(&q->clhash, &this->common);
-
- if (parent == NULL)
- return;
-
- if (parent->children == NULL) {
- parent->children = this;
- } else {
- this->sibling = parent->children->sibling;
- parent->children->sibling = this;
- }
-}
-
-static void
-cbq_reset(struct Qdisc *sch)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct cbq_class *cl;
- int prio;
- unsigned int h;
-
- q->activemask = 0;
- q->pmask = 0;
- q->tx_class = NULL;
- q->tx_borrowed = NULL;
- qdisc_watchdog_cancel(&q->watchdog);
- hrtimer_cancel(&q->delay_timer);
- q->toplevel = TC_CBQ_MAXLEVEL;
- q->now = psched_get_time();
-
- for (prio = 0; prio <= TC_CBQ_MAXPRIO; prio++)
- q->active[prio] = NULL;
-
- for (h = 0; h < q->clhash.hashsize; h++) {
- hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
- qdisc_reset(cl->q);
-
- cl->next_alive = NULL;
- cl->undertime = PSCHED_PASTPERFECT;
- cl->avgidle = cl->maxidle;
- cl->deficit = cl->quantum;
- cl->cpriority = cl->priority;
- }
- }
-}
-
-
-static int cbq_set_lss(struct cbq_class *cl, struct tc_cbq_lssopt *lss)
-{
- if (lss->change & TCF_CBQ_LSS_FLAGS) {
- cl->share = (lss->flags & TCF_CBQ_LSS_ISOLATED) ? NULL : cl->tparent;
- cl->borrow = (lss->flags & TCF_CBQ_LSS_BOUNDED) ? NULL : cl->tparent;
- }
- if (lss->change & TCF_CBQ_LSS_EWMA)
- cl->ewma_log = lss->ewma_log;
- if (lss->change & TCF_CBQ_LSS_AVPKT)
- cl->avpkt = lss->avpkt;
- if (lss->change & TCF_CBQ_LSS_MINIDLE)
- cl->minidle = -(long)lss->minidle;
- if (lss->change & TCF_CBQ_LSS_MAXIDLE) {
- cl->maxidle = lss->maxidle;
- cl->avgidle = lss->maxidle;
- }
- if (lss->change & TCF_CBQ_LSS_OFFTIME)
- cl->offtime = lss->offtime;
- return 0;
-}
-
-static void cbq_rmprio(struct cbq_sched_data *q, struct cbq_class *cl)
-{
- q->nclasses[cl->priority]--;
- q->quanta[cl->priority] -= cl->weight;
- cbq_normalize_quanta(q, cl->priority);
-}
-
-static void cbq_addprio(struct cbq_sched_data *q, struct cbq_class *cl)
-{
- q->nclasses[cl->priority]++;
- q->quanta[cl->priority] += cl->weight;
- cbq_normalize_quanta(q, cl->priority);
-}
-
-static int cbq_set_wrr(struct cbq_class *cl, struct tc_cbq_wrropt *wrr)
-{
- struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
-
- if (wrr->allot)
- cl->allot = wrr->allot;
- if (wrr->weight)
- cl->weight = wrr->weight;
- if (wrr->priority) {
- cl->priority = wrr->priority - 1;
- cl->cpriority = cl->priority;
- if (cl->priority >= cl->priority2)
- cl->priority2 = TC_CBQ_MAXPRIO - 1;
- }
-
- cbq_addprio(q, cl);
- return 0;
-}
-
-static int cbq_set_fopt(struct cbq_class *cl, struct tc_cbq_fopt *fopt)
-{
- cbq_change_defmap(cl, fopt->split, fopt->defmap, fopt->defchange);
- return 0;
-}
-
-static const struct nla_policy cbq_policy[TCA_CBQ_MAX + 1] = {
- [TCA_CBQ_LSSOPT] = { .len = sizeof(struct tc_cbq_lssopt) },
- [TCA_CBQ_WRROPT] = { .len = sizeof(struct tc_cbq_wrropt) },
- [TCA_CBQ_FOPT] = { .len = sizeof(struct tc_cbq_fopt) },
- [TCA_CBQ_OVL_STRATEGY] = { .len = sizeof(struct tc_cbq_ovl) },
- [TCA_CBQ_RATE] = { .len = sizeof(struct tc_ratespec) },
- [TCA_CBQ_RTAB] = { .type = NLA_BINARY, .len = TC_RTAB_SIZE },
- [TCA_CBQ_POLICE] = { .len = sizeof(struct tc_cbq_police) },
-};
-
-static int cbq_opt_parse(struct nlattr *tb[TCA_CBQ_MAX + 1],
- struct nlattr *opt,
- struct netlink_ext_ack *extack)
-{
- int err;
-
- if (!opt) {
- NL_SET_ERR_MSG(extack, "CBQ options are required for this operation");
- return -EINVAL;
- }
-
- err = nla_parse_nested_deprecated(tb, TCA_CBQ_MAX, opt,
- cbq_policy, extack);
- if (err < 0)
- return err;
-
- if (tb[TCA_CBQ_WRROPT]) {
- const struct tc_cbq_wrropt *wrr = nla_data(tb[TCA_CBQ_WRROPT]);
-
- if (wrr->priority > TC_CBQ_MAXPRIO) {
- NL_SET_ERR_MSG(extack, "priority is bigger than TC_CBQ_MAXPRIO");
- err = -EINVAL;
- }
- }
- return err;
-}
-
-static int cbq_init(struct Qdisc *sch, struct nlattr *opt,
- struct netlink_ext_ack *extack)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct nlattr *tb[TCA_CBQ_MAX + 1];
- struct tc_ratespec *r;
- int err;
-
- qdisc_watchdog_init(&q->watchdog, sch);
- hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED);
- q->delay_timer.function = cbq_undelay;
-
- err = cbq_opt_parse(tb, opt, extack);
- if (err < 0)
- return err;
-
- if (!tb[TCA_CBQ_RTAB] || !tb[TCA_CBQ_RATE]) {
- NL_SET_ERR_MSG(extack, "Rate specification missing or incomplete");
- return -EINVAL;
- }
-
- r = nla_data(tb[TCA_CBQ_RATE]);
-
- q->link.R_tab = qdisc_get_rtab(r, tb[TCA_CBQ_RTAB], extack);
- if (!q->link.R_tab)
- return -EINVAL;
-
- err = tcf_block_get(&q->link.block, &q->link.filter_list, sch, extack);
- if (err)
- goto put_rtab;
-
- err = qdisc_class_hash_init(&q->clhash);
- if (err < 0)
- goto put_block;
-
- q->link.sibling = &q->link;
- q->link.common.classid = sch->handle;
- q->link.qdisc = sch;
- q->link.q = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
- sch->handle, NULL);
- if (!q->link.q)
- q->link.q = &noop_qdisc;
- else
- qdisc_hash_add(q->link.q, true);
-
- q->link.priority = TC_CBQ_MAXPRIO - 1;
- q->link.priority2 = TC_CBQ_MAXPRIO - 1;
- q->link.cpriority = TC_CBQ_MAXPRIO - 1;
- q->link.allot = psched_mtu(qdisc_dev(sch));
- q->link.quantum = q->link.allot;
- q->link.weight = q->link.R_tab->rate.rate;
-
- q->link.ewma_log = TC_CBQ_DEF_EWMA;
- q->link.avpkt = q->link.allot/2;
- q->link.minidle = -0x7FFFFFFF;
-
- q->toplevel = TC_CBQ_MAXLEVEL;
- q->now = psched_get_time();
-
- cbq_link_class(&q->link);
-
- if (tb[TCA_CBQ_LSSOPT])
- cbq_set_lss(&q->link, nla_data(tb[TCA_CBQ_LSSOPT]));
-
- cbq_addprio(q, &q->link);
- return 0;
-
-put_block:
- tcf_block_put(q->link.block);
-
-put_rtab:
- qdisc_put_rtab(q->link.R_tab);
- return err;
-}
-
-static int cbq_dump_rate(struct sk_buff *skb, struct cbq_class *cl)
-{
- unsigned char *b = skb_tail_pointer(skb);
-
- if (nla_put(skb, TCA_CBQ_RATE, sizeof(cl->R_tab->rate), &cl->R_tab->rate))
- goto nla_put_failure;
- return skb->len;
-
-nla_put_failure:
- nlmsg_trim(skb, b);
- return -1;
-}
-
-static int cbq_dump_lss(struct sk_buff *skb, struct cbq_class *cl)
-{
- unsigned char *b = skb_tail_pointer(skb);
- struct tc_cbq_lssopt opt;
-
- opt.flags = 0;
- if (cl->borrow == NULL)
- opt.flags |= TCF_CBQ_LSS_BOUNDED;
- if (cl->share == NULL)
- opt.flags |= TCF_CBQ_LSS_ISOLATED;
- opt.ewma_log = cl->ewma_log;
- opt.level = cl->level;
- opt.avpkt = cl->avpkt;
- opt.maxidle = cl->maxidle;
- opt.minidle = (u32)(-cl->minidle);
- opt.offtime = cl->offtime;
- opt.change = ~0;
- if (nla_put(skb, TCA_CBQ_LSSOPT, sizeof(opt), &opt))
- goto nla_put_failure;
- return skb->len;
-
-nla_put_failure:
- nlmsg_trim(skb, b);
- return -1;
-}
-
-static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
-{
- unsigned char *b = skb_tail_pointer(skb);
- struct tc_cbq_wrropt opt;
-
- memset(&opt, 0, sizeof(opt));
- opt.flags = 0;
- opt.allot = cl->allot;
- opt.priority = cl->priority + 1;
- opt.cpriority = cl->cpriority + 1;
- opt.weight = cl->weight;
- if (nla_put(skb, TCA_CBQ_WRROPT, sizeof(opt), &opt))
- goto nla_put_failure;
- return skb->len;
-
-nla_put_failure:
- nlmsg_trim(skb, b);
- return -1;
-}
-
-static int cbq_dump_fopt(struct sk_buff *skb, struct cbq_class *cl)
-{
- unsigned char *b = skb_tail_pointer(skb);
- struct tc_cbq_fopt opt;
-
- if (cl->split || cl->defmap) {
- opt.split = cl->split ? cl->split->common.classid : 0;
- opt.defmap = cl->defmap;
- opt.defchange = ~0;
- if (nla_put(skb, TCA_CBQ_FOPT, sizeof(opt), &opt))
- goto nla_put_failure;
- }
- return skb->len;
-
-nla_put_failure:
- nlmsg_trim(skb, b);
- return -1;
-}
-
-static int cbq_dump_attr(struct sk_buff *skb, struct cbq_class *cl)
-{
- if (cbq_dump_lss(skb, cl) < 0 ||
- cbq_dump_rate(skb, cl) < 0 ||
- cbq_dump_wrr(skb, cl) < 0 ||
- cbq_dump_fopt(skb, cl) < 0)
- return -1;
- return 0;
-}
-
-static int cbq_dump(struct Qdisc *sch, struct sk_buff *skb)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct nlattr *nest;
-
- nest = nla_nest_start_noflag(skb, TCA_OPTIONS);
- if (nest == NULL)
- goto nla_put_failure;
- if (cbq_dump_attr(skb, &q->link) < 0)
- goto nla_put_failure;
- return nla_nest_end(skb, nest);
-
-nla_put_failure:
- nla_nest_cancel(skb, nest);
- return -1;
-}
-
-static int
-cbq_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
-
- q->link.xstats.avgidle = q->link.avgidle;
- return gnet_stats_copy_app(d, &q->link.xstats, sizeof(q->link.xstats));
-}
-
-static int
-cbq_dump_class(struct Qdisc *sch, unsigned long arg,
- struct sk_buff *skb, struct tcmsg *tcm)
-{
- struct cbq_class *cl = (struct cbq_class *)arg;
- struct nlattr *nest;
-
- if (cl->tparent)
- tcm->tcm_parent = cl->tparent->common.classid;
- else
- tcm->tcm_parent = TC_H_ROOT;
- tcm->tcm_handle = cl->common.classid;
- tcm->tcm_info = cl->q->handle;
-
- nest = nla_nest_start_noflag(skb, TCA_OPTIONS);
- if (nest == NULL)
- goto nla_put_failure;
- if (cbq_dump_attr(skb, cl) < 0)
- goto nla_put_failure;
- return nla_nest_end(skb, nest);
-
-nla_put_failure:
- nla_nest_cancel(skb, nest);
- return -1;
-}
-
-static int
-cbq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
- struct gnet_dump *d)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct cbq_class *cl = (struct cbq_class *)arg;
- __u32 qlen;
-
- cl->xstats.avgidle = cl->avgidle;
- cl->xstats.undertime = 0;
- qdisc_qstats_qlen_backlog(cl->q, &qlen, &cl->qstats.backlog);
-
- if (cl->undertime != PSCHED_PASTPERFECT)
- cl->xstats.undertime = cl->undertime - q->now;
-
- if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
- d, NULL, &cl->bstats) < 0 ||
- gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
- gnet_stats_copy_queue(d, NULL, &cl->qstats, qlen) < 0)
- return -1;
-
- return gnet_stats_copy_app(d, &cl->xstats, sizeof(cl->xstats));
-}
-
-static int cbq_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
- struct Qdisc **old, struct netlink_ext_ack *extack)
-{
- struct cbq_class *cl = (struct cbq_class *)arg;
-
- if (new == NULL) {
- new = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
- cl->common.classid, extack);
- if (new == NULL)
- return -ENOBUFS;
- }
-
- *old = qdisc_replace(sch, new, &cl->q);
- return 0;
-}
-
-static struct Qdisc *cbq_leaf(struct Qdisc *sch, unsigned long arg)
-{
- struct cbq_class *cl = (struct cbq_class *)arg;
-
- return cl->q;
-}
-
-static void cbq_qlen_notify(struct Qdisc *sch, unsigned long arg)
-{
- struct cbq_class *cl = (struct cbq_class *)arg;
-
- cbq_deactivate_class(cl);
-}
-
-static unsigned long cbq_find(struct Qdisc *sch, u32 classid)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
-
- return (unsigned long)cbq_class_lookup(q, classid);
-}
-
-static void cbq_destroy_class(struct Qdisc *sch, struct cbq_class *cl)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
-
- WARN_ON(cl->filters);
-
- tcf_block_put(cl->block);
- qdisc_put(cl->q);
- qdisc_put_rtab(cl->R_tab);
- gen_kill_estimator(&cl->rate_est);
- if (cl != &q->link)
- kfree(cl);
-}
-
-static void cbq_destroy(struct Qdisc *sch)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct hlist_node *next;
- struct cbq_class *cl;
- unsigned int h;
-
-#ifdef CONFIG_NET_CLS_ACT
- q->rx_class = NULL;
-#endif
- /*
- * Filters must be destroyed first because we don't destroy the
- * classes from root to leafs which means that filters can still
- * be bound to classes which have been destroyed already. --TGR '04
- */
- for (h = 0; h < q->clhash.hashsize; h++) {
- hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
- tcf_block_put(cl->block);
- cl->block = NULL;
- }
- }
- for (h = 0; h < q->clhash.hashsize; h++) {
- hlist_for_each_entry_safe(cl, next, &q->clhash.hash[h],
- common.hnode)
- cbq_destroy_class(sch, cl);
- }
- qdisc_class_hash_destroy(&q->clhash);
-}
-
-static int
-cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **tca,
- unsigned long *arg, struct netlink_ext_ack *extack)
-{
- int err;
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct cbq_class *cl = (struct cbq_class *)*arg;
- struct nlattr *opt = tca[TCA_OPTIONS];
- struct nlattr *tb[TCA_CBQ_MAX + 1];
- struct cbq_class *parent;
- struct qdisc_rate_table *rtab = NULL;
-
- err = cbq_opt_parse(tb, opt, extack);
- if (err < 0)
- return err;
-
- if (tb[TCA_CBQ_OVL_STRATEGY] || tb[TCA_CBQ_POLICE]) {
- NL_SET_ERR_MSG(extack, "Neither overlimit strategy nor policing attributes can be used for changing class params");
- return -EOPNOTSUPP;
- }
-
- if (cl) {
- /* Check parent */
- if (parentid) {
- if (cl->tparent &&
- cl->tparent->common.classid != parentid) {
- NL_SET_ERR_MSG(extack, "Invalid parent id");
- return -EINVAL;
- }
- if (!cl->tparent && parentid != TC_H_ROOT) {
- NL_SET_ERR_MSG(extack, "Parent must be root");
- return -EINVAL;
- }
- }
-
- if (tb[TCA_CBQ_RATE]) {
- rtab = qdisc_get_rtab(nla_data(tb[TCA_CBQ_RATE]),
- tb[TCA_CBQ_RTAB], extack);
- if (rtab == NULL)
- return -EINVAL;
- }
-
- if (tca[TCA_RATE]) {
- err = gen_replace_estimator(&cl->bstats, NULL,
- &cl->rate_est,
- NULL,
- qdisc_root_sleeping_running(sch),
- tca[TCA_RATE]);
- if (err) {
- NL_SET_ERR_MSG(extack, "Failed to replace specified rate estimator");
- qdisc_put_rtab(rtab);
- return err;
- }
- }
-
- /* Change class parameters */
- sch_tree_lock(sch);
-
- if (cl->next_alive != NULL)
- cbq_deactivate_class(cl);
-
- if (rtab) {
- qdisc_put_rtab(cl->R_tab);
- cl->R_tab = rtab;
- }
-
- if (tb[TCA_CBQ_LSSOPT])
- cbq_set_lss(cl, nla_data(tb[TCA_CBQ_LSSOPT]));
-
- if (tb[TCA_CBQ_WRROPT]) {
- cbq_rmprio(q, cl);
- cbq_set_wrr(cl, nla_data(tb[TCA_CBQ_WRROPT]));
- }
-
- if (tb[TCA_CBQ_FOPT])
- cbq_set_fopt(cl, nla_data(tb[TCA_CBQ_FOPT]));
-
- if (cl->q->q.qlen)
- cbq_activate_class(cl);
-
- sch_tree_unlock(sch);
-
- return 0;
- }
-
- if (parentid == TC_H_ROOT)
- return -EINVAL;
-
- if (!tb[TCA_CBQ_WRROPT] || !tb[TCA_CBQ_RATE] || !tb[TCA_CBQ_LSSOPT]) {
- NL_SET_ERR_MSG(extack, "One of the following attributes MUST be specified: WRR, rate or link sharing");
- return -EINVAL;
- }
-
- rtab = qdisc_get_rtab(nla_data(tb[TCA_CBQ_RATE]), tb[TCA_CBQ_RTAB],
- extack);
- if (rtab == NULL)
- return -EINVAL;
-
- if (classid) {
- err = -EINVAL;
- if (TC_H_MAJ(classid ^ sch->handle) ||
- cbq_class_lookup(q, classid)) {
- NL_SET_ERR_MSG(extack, "Specified class not found");
- goto failure;
- }
- } else {
- int i;
- classid = TC_H_MAKE(sch->handle, 0x8000);
-
- for (i = 0; i < 0x8000; i++) {
- if (++q->hgenerator >= 0x8000)
- q->hgenerator = 1;
- if (cbq_class_lookup(q, classid|q->hgenerator) == NULL)
- break;
- }
- err = -ENOSR;
- if (i >= 0x8000) {
- NL_SET_ERR_MSG(extack, "Unable to generate classid");
- goto failure;
- }
- classid = classid|q->hgenerator;
- }
-
- parent = &q->link;
- if (parentid) {
- parent = cbq_class_lookup(q, parentid);
- err = -EINVAL;
- if (!parent) {
- NL_SET_ERR_MSG(extack, "Failed to find parentid");
- goto failure;
- }
- }
-
- err = -ENOBUFS;
- cl = kzalloc(sizeof(*cl), GFP_KERNEL);
- if (cl == NULL)
- goto failure;
-
- err = tcf_block_get(&cl->block, &cl->filter_list, sch, extack);
- if (err) {
- kfree(cl);
- goto failure;
- }
-
- if (tca[TCA_RATE]) {
- err = gen_new_estimator(&cl->bstats, NULL, &cl->rate_est,
- NULL,
- qdisc_root_sleeping_running(sch),
- tca[TCA_RATE]);
- if (err) {
- NL_SET_ERR_MSG(extack, "Couldn't create new estimator");
- tcf_block_put(cl->block);
- kfree(cl);
- goto failure;
- }
- }
-
- cl->R_tab = rtab;
- rtab = NULL;
- cl->q = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops, classid,
- NULL);
- if (!cl->q)
- cl->q = &noop_qdisc;
- else
- qdisc_hash_add(cl->q, true);
-
- cl->common.classid = classid;
- cl->tparent = parent;
- cl->qdisc = sch;
- cl->allot = parent->allot;
- cl->quantum = cl->allot;
- cl->weight = cl->R_tab->rate.rate;
-
- sch_tree_lock(sch);
- cbq_link_class(cl);
- cl->borrow = cl->tparent;
- if (cl->tparent != &q->link)
- cl->share = cl->tparent;
- cbq_adjust_levels(parent);
- cl->minidle = -0x7FFFFFFF;
- cbq_set_lss(cl, nla_data(tb[TCA_CBQ_LSSOPT]));
- cbq_set_wrr(cl, nla_data(tb[TCA_CBQ_WRROPT]));
- if (cl->ewma_log == 0)
- cl->ewma_log = q->link.ewma_log;
- if (cl->maxidle == 0)
- cl->maxidle = q->link.maxidle;
- if (cl->avpkt == 0)
- cl->avpkt = q->link.avpkt;
- if (tb[TCA_CBQ_FOPT])
- cbq_set_fopt(cl, nla_data(tb[TCA_CBQ_FOPT]));
- sch_tree_unlock(sch);
-
- qdisc_class_hash_grow(sch, &q->clhash);
-
- *arg = (unsigned long)cl;
- return 0;
-
-failure:
- qdisc_put_rtab(rtab);
- return err;
-}
-
-static int cbq_delete(struct Qdisc *sch, unsigned long arg,
- struct netlink_ext_ack *extack)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct cbq_class *cl = (struct cbq_class *)arg;
-
- if (cl->filters || cl->children || cl == &q->link)
- return -EBUSY;
-
- sch_tree_lock(sch);
-
- qdisc_purge_queue(cl->q);
-
- if (cl->next_alive)
- cbq_deactivate_class(cl);
-
- if (q->tx_borrowed == cl)
- q->tx_borrowed = q->tx_class;
- if (q->tx_class == cl) {
- q->tx_class = NULL;
- q->tx_borrowed = NULL;
- }
-#ifdef CONFIG_NET_CLS_ACT
- if (q->rx_class == cl)
- q->rx_class = NULL;
-#endif
-
- cbq_unlink_class(cl);
- cbq_adjust_levels(cl->tparent);
- cl->defmap = 0;
- cbq_sync_defmap(cl);
-
- cbq_rmprio(q, cl);
- sch_tree_unlock(sch);
-
- cbq_destroy_class(sch, cl);
- return 0;
-}
-
-static struct tcf_block *cbq_tcf_block(struct Qdisc *sch, unsigned long arg,
- struct netlink_ext_ack *extack)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct cbq_class *cl = (struct cbq_class *)arg;
-
- if (cl == NULL)
- cl = &q->link;
-
- return cl->block;
-}
-
-static unsigned long cbq_bind_filter(struct Qdisc *sch, unsigned long parent,
- u32 classid)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct cbq_class *p = (struct cbq_class *)parent;
- struct cbq_class *cl = cbq_class_lookup(q, classid);
-
- if (cl) {
- if (p && p->level <= cl->level)
- return 0;
- cl->filters++;
- return (unsigned long)cl;
- }
- return 0;
-}
-
-static void cbq_unbind_filter(struct Qdisc *sch, unsigned long arg)
-{
- struct cbq_class *cl = (struct cbq_class *)arg;
-
- cl->filters--;
-}
-
-static void cbq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
-{
- struct cbq_sched_data *q = qdisc_priv(sch);
- struct cbq_class *cl;
- unsigned int h;
-
- if (arg->stop)
- return;
-
- for (h = 0; h < q->clhash.hashsize; h++) {
- hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
- if (arg->count < arg->skip) {
- arg->count++;
- continue;
- }
- if (arg->fn(sch, (unsigned long)cl, arg) < 0) {
- arg->stop = 1;
- return;
- }
- arg->count++;
- }
- }
-}
-
-static const struct Qdisc_class_ops cbq_class_ops = {
- .graft = cbq_graft,
- .leaf = cbq_leaf,
- .qlen_notify = cbq_qlen_notify,
- .find = cbq_find,
- .change = cbq_change_class,
- .delete = cbq_delete,
- .walk = cbq_walk,
- .tcf_block = cbq_tcf_block,
- .bind_tcf = cbq_bind_filter,
- .unbind_tcf = cbq_unbind_filter,
- .dump = cbq_dump_class,
- .dump_stats = cbq_dump_class_stats,
-};
-
-static struct Qdisc_ops cbq_qdisc_ops __read_mostly = {
- .next = NULL,
- .cl_ops = &cbq_class_ops,
- .id = "cbq",
- .priv_size = sizeof(struct cbq_sched_data),
- .enqueue = cbq_enqueue,
- .dequeue = cbq_dequeue,
- .peek = qdisc_peek_dequeued,
- .init = cbq_init,
- .reset = cbq_reset,
- .destroy = cbq_destroy,
- .change = NULL,
- .dump = cbq_dump,
- .dump_stats = cbq_dump_stats,
- .owner = THIS_MODULE,
-};
-
-static int __init cbq_module_init(void)
-{
- return register_qdisc(&cbq_qdisc_ops);
-}
-static void __exit cbq_module_exit(void)
-{
- unregister_qdisc(&cbq_qdisc_ops);
-}
-module_init(cbq_module_init)
-module_exit(cbq_module_exit)
-MODULE_LICENSE("GPL");
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 002/245] net/sched: Retire ATM qdisc
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 001/245] net/sched: Retire CBQ qdisc Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 003/245] net/sched: Retire dsmark qdisc Greg Kroah-Hartman
` (253 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamal Hadi Salim, Jiri Pirko,
Paolo Abeni
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
commit fb38306ceb9e770adfb5ffa6e3c64047b55f7a07 upstream.
The ATM qdisc has served us well over the years but has not been getting much
TLC due to lack of known users. Most recently it has become a shooting target
for syzkaller. For this reason, we are retiring it.
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/Kconfig | 14 -
net/sched/Makefile | 1
net/sched/sch_atm.c | 710 ----------------------------------------------------
3 files changed, 725 deletions(-)
delete mode 100644 net/sched/sch_atm.c
delete mode 100644 tools/testing/selftests/tc-testing/tc-tests/qdiscs/atm.json
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -68,20 +68,6 @@ config NET_SCH_HFSC
To compile this code as a module, choose M here: the
module will be called sch_hfsc.
-config NET_SCH_ATM
- tristate "ATM Virtual Circuits (ATM)"
- depends on ATM
- help
- Say Y here if you want to use the ATM pseudo-scheduler. This
- provides a framework for invoking classifiers, which in turn
- select classes of this queuing discipline. Each class maps
- the flow(s) it is handling to a given virtual circuit.
-
- See the top of <file:net/sched/sch_atm.c> for more details.
-
- To compile this code as a module, choose M here: the
- module will be called sch_atm.
-
config NET_SCH_PRIO
tristate "Multi Band Priority Queueing (PRIO)"
help
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -45,7 +45,6 @@ obj-$(CONFIG_NET_SCH_TBF) += sch_tbf.o
obj-$(CONFIG_NET_SCH_TEQL) += sch_teql.o
obj-$(CONFIG_NET_SCH_PRIO) += sch_prio.o
obj-$(CONFIG_NET_SCH_MULTIQ) += sch_multiq.o
-obj-$(CONFIG_NET_SCH_ATM) += sch_atm.o
obj-$(CONFIG_NET_SCH_NETEM) += sch_netem.o
obj-$(CONFIG_NET_SCH_DRR) += sch_drr.o
obj-$(CONFIG_NET_SCH_PLUG) += sch_plug.o
--- a/net/sched/sch_atm.c
+++ /dev/null
@@ -1,710 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/* net/sched/sch_atm.c - ATM VC selection "queueing discipline" */
-
-/* Written 1998-2000 by Werner Almesberger, EPFL ICA */
-
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/init.h>
-#include <linux/interrupt.h>
-#include <linux/string.h>
-#include <linux/errno.h>
-#include <linux/skbuff.h>
-#include <linux/atmdev.h>
-#include <linux/atmclip.h>
-#include <linux/rtnetlink.h>
-#include <linux/file.h> /* for fput */
-#include <net/netlink.h>
-#include <net/pkt_sched.h>
-#include <net/pkt_cls.h>
-
-/*
- * The ATM queuing discipline provides a framework for invoking classifiers
- * (aka "filters"), which in turn select classes of this queuing discipline.
- * Each class maps the flow(s) it is handling to a given VC. Multiple classes
- * may share the same VC.
- *
- * When creating a class, VCs are specified by passing the number of the open
- * socket descriptor by which the calling process references the VC. The kernel
- * keeps the VC open at least until all classes using it are removed.
- *
- * In this file, most functions are named atm_tc_* to avoid confusion with all
- * the atm_* in net/atm. This naming convention differs from what's used in the
- * rest of net/sched.
- *
- * Known bugs:
- * - sometimes messes up the IP stack
- * - any manipulations besides the few operations described in the README, are
- * untested and likely to crash the system
- * - should lock the flow while there is data in the queue (?)
- */
-
-#define VCC2FLOW(vcc) ((struct atm_flow_data *) ((vcc)->user_back))
-
-struct atm_flow_data {
- struct Qdisc_class_common common;
- struct Qdisc *q; /* FIFO, TBF, etc. */
- struct tcf_proto __rcu *filter_list;
- struct tcf_block *block;
- struct atm_vcc *vcc; /* VCC; NULL if VCC is closed */
- void (*old_pop)(struct atm_vcc *vcc,
- struct sk_buff *skb); /* chaining */
- struct atm_qdisc_data *parent; /* parent qdisc */
- struct socket *sock; /* for closing */
- int ref; /* reference count */
- struct gnet_stats_basic_packed bstats;
- struct gnet_stats_queue qstats;
- struct list_head list;
- struct atm_flow_data *excess; /* flow for excess traffic;
- NULL to set CLP instead */
- int hdr_len;
- unsigned char hdr[]; /* header data; MUST BE LAST */
-};
-
-struct atm_qdisc_data {
- struct atm_flow_data link; /* unclassified skbs go here */
- struct list_head flows; /* NB: "link" is also on this
- list */
- struct tasklet_struct task; /* dequeue tasklet */
-};
-
-/* ------------------------- Class/flow operations ------------------------- */
-
-static inline struct atm_flow_data *lookup_flow(struct Qdisc *sch, u32 classid)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct atm_flow_data *flow;
-
- list_for_each_entry(flow, &p->flows, list) {
- if (flow->common.classid == classid)
- return flow;
- }
- return NULL;
-}
-
-static int atm_tc_graft(struct Qdisc *sch, unsigned long arg,
- struct Qdisc *new, struct Qdisc **old,
- struct netlink_ext_ack *extack)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct atm_flow_data *flow = (struct atm_flow_data *)arg;
-
- pr_debug("atm_tc_graft(sch %p,[qdisc %p],flow %p,new %p,old %p)\n",
- sch, p, flow, new, old);
- if (list_empty(&flow->list))
- return -EINVAL;
- if (!new)
- new = &noop_qdisc;
- *old = flow->q;
- flow->q = new;
- if (*old)
- qdisc_reset(*old);
- return 0;
-}
-
-static struct Qdisc *atm_tc_leaf(struct Qdisc *sch, unsigned long cl)
-{
- struct atm_flow_data *flow = (struct atm_flow_data *)cl;
-
- pr_debug("atm_tc_leaf(sch %p,flow %p)\n", sch, flow);
- return flow ? flow->q : NULL;
-}
-
-static unsigned long atm_tc_find(struct Qdisc *sch, u32 classid)
-{
- struct atm_qdisc_data *p __maybe_unused = qdisc_priv(sch);
- struct atm_flow_data *flow;
-
- pr_debug("%s(sch %p,[qdisc %p],classid %x)\n", __func__, sch, p, classid);
- flow = lookup_flow(sch, classid);
- pr_debug("%s: flow %p\n", __func__, flow);
- return (unsigned long)flow;
-}
-
-static unsigned long atm_tc_bind_filter(struct Qdisc *sch,
- unsigned long parent, u32 classid)
-{
- struct atm_qdisc_data *p __maybe_unused = qdisc_priv(sch);
- struct atm_flow_data *flow;
-
- pr_debug("%s(sch %p,[qdisc %p],classid %x)\n", __func__, sch, p, classid);
- flow = lookup_flow(sch, classid);
- if (flow)
- flow->ref++;
- pr_debug("%s: flow %p\n", __func__, flow);
- return (unsigned long)flow;
-}
-
-/*
- * atm_tc_put handles all destructions, including the ones that are explicitly
- * requested (atm_tc_destroy, etc.). The assumption here is that we never drop
- * anything that still seems to be in use.
- */
-static void atm_tc_put(struct Qdisc *sch, unsigned long cl)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct atm_flow_data *flow = (struct atm_flow_data *)cl;
-
- pr_debug("atm_tc_put(sch %p,[qdisc %p],flow %p)\n", sch, p, flow);
- if (--flow->ref)
- return;
- pr_debug("atm_tc_put: destroying\n");
- list_del_init(&flow->list);
- pr_debug("atm_tc_put: qdisc %p\n", flow->q);
- qdisc_put(flow->q);
- tcf_block_put(flow->block);
- if (flow->sock) {
- pr_debug("atm_tc_put: f_count %ld\n",
- file_count(flow->sock->file));
- flow->vcc->pop = flow->old_pop;
- sockfd_put(flow->sock);
- }
- if (flow->excess)
- atm_tc_put(sch, (unsigned long)flow->excess);
- if (flow != &p->link)
- kfree(flow);
- /*
- * If flow == &p->link, the qdisc no longer works at this point and
- * needs to be removed. (By the caller of atm_tc_put.)
- */
-}
-
-static void sch_atm_pop(struct atm_vcc *vcc, struct sk_buff *skb)
-{
- struct atm_qdisc_data *p = VCC2FLOW(vcc)->parent;
-
- pr_debug("sch_atm_pop(vcc %p,skb %p,[qdisc %p])\n", vcc, skb, p);
- VCC2FLOW(vcc)->old_pop(vcc, skb);
- tasklet_schedule(&p->task);
-}
-
-static const u8 llc_oui_ip[] = {
- 0xaa, /* DSAP: non-ISO */
- 0xaa, /* SSAP: non-ISO */
- 0x03, /* Ctrl: Unnumbered Information Command PDU */
- 0x00, /* OUI: EtherType */
- 0x00, 0x00,
- 0x08, 0x00
-}; /* Ethertype IP (0800) */
-
-static const struct nla_policy atm_policy[TCA_ATM_MAX + 1] = {
- [TCA_ATM_FD] = { .type = NLA_U32 },
- [TCA_ATM_EXCESS] = { .type = NLA_U32 },
-};
-
-static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
- struct nlattr **tca, unsigned long *arg,
- struct netlink_ext_ack *extack)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct atm_flow_data *flow = (struct atm_flow_data *)*arg;
- struct atm_flow_data *excess = NULL;
- struct nlattr *opt = tca[TCA_OPTIONS];
- struct nlattr *tb[TCA_ATM_MAX + 1];
- struct socket *sock;
- int fd, error, hdr_len;
- void *hdr;
-
- pr_debug("atm_tc_change(sch %p,[qdisc %p],classid %x,parent %x,"
- "flow %p,opt %p)\n", sch, p, classid, parent, flow, opt);
- /*
- * The concept of parents doesn't apply for this qdisc.
- */
- if (parent && parent != TC_H_ROOT && parent != sch->handle)
- return -EINVAL;
- /*
- * ATM classes cannot be changed. In order to change properties of the
- * ATM connection, that socket needs to be modified directly (via the
- * native ATM API. In order to send a flow to a different VC, the old
- * class needs to be removed and a new one added. (This may be changed
- * later.)
- */
- if (flow)
- return -EBUSY;
- if (opt == NULL)
- return -EINVAL;
-
- error = nla_parse_nested_deprecated(tb, TCA_ATM_MAX, opt, atm_policy,
- NULL);
- if (error < 0)
- return error;
-
- if (!tb[TCA_ATM_FD])
- return -EINVAL;
- fd = nla_get_u32(tb[TCA_ATM_FD]);
- pr_debug("atm_tc_change: fd %d\n", fd);
- if (tb[TCA_ATM_HDR]) {
- hdr_len = nla_len(tb[TCA_ATM_HDR]);
- hdr = nla_data(tb[TCA_ATM_HDR]);
- } else {
- hdr_len = RFC1483LLC_LEN;
- hdr = NULL; /* default LLC/SNAP for IP */
- }
- if (!tb[TCA_ATM_EXCESS])
- excess = NULL;
- else {
- excess = (struct atm_flow_data *)
- atm_tc_find(sch, nla_get_u32(tb[TCA_ATM_EXCESS]));
- if (!excess)
- return -ENOENT;
- }
- pr_debug("atm_tc_change: type %d, payload %d, hdr_len %d\n",
- opt->nla_type, nla_len(opt), hdr_len);
- sock = sockfd_lookup(fd, &error);
- if (!sock)
- return error; /* f_count++ */
- pr_debug("atm_tc_change: f_count %ld\n", file_count(sock->file));
- if (sock->ops->family != PF_ATMSVC && sock->ops->family != PF_ATMPVC) {
- error = -EPROTOTYPE;
- goto err_out;
- }
- /* @@@ should check if the socket is really operational or we'll crash
- on vcc->send */
- if (classid) {
- if (TC_H_MAJ(classid ^ sch->handle)) {
- pr_debug("atm_tc_change: classid mismatch\n");
- error = -EINVAL;
- goto err_out;
- }
- } else {
- int i;
- unsigned long cl;
-
- for (i = 1; i < 0x8000; i++) {
- classid = TC_H_MAKE(sch->handle, 0x8000 | i);
- cl = atm_tc_find(sch, classid);
- if (!cl)
- break;
- }
- }
- pr_debug("atm_tc_change: new id %x\n", classid);
- flow = kzalloc(sizeof(struct atm_flow_data) + hdr_len, GFP_KERNEL);
- pr_debug("atm_tc_change: flow %p\n", flow);
- if (!flow) {
- error = -ENOBUFS;
- goto err_out;
- }
-
- error = tcf_block_get(&flow->block, &flow->filter_list, sch,
- extack);
- if (error) {
- kfree(flow);
- goto err_out;
- }
-
- flow->q = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops, classid,
- extack);
- if (!flow->q)
- flow->q = &noop_qdisc;
- pr_debug("atm_tc_change: qdisc %p\n", flow->q);
- flow->sock = sock;
- flow->vcc = ATM_SD(sock); /* speedup */
- flow->vcc->user_back = flow;
- pr_debug("atm_tc_change: vcc %p\n", flow->vcc);
- flow->old_pop = flow->vcc->pop;
- flow->parent = p;
- flow->vcc->pop = sch_atm_pop;
- flow->common.classid = classid;
- flow->ref = 1;
- flow->excess = excess;
- list_add(&flow->list, &p->link.list);
- flow->hdr_len = hdr_len;
- if (hdr)
- memcpy(flow->hdr, hdr, hdr_len);
- else
- memcpy(flow->hdr, llc_oui_ip, sizeof(llc_oui_ip));
- *arg = (unsigned long)flow;
- return 0;
-err_out:
- sockfd_put(sock);
- return error;
-}
-
-static int atm_tc_delete(struct Qdisc *sch, unsigned long arg,
- struct netlink_ext_ack *extack)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct atm_flow_data *flow = (struct atm_flow_data *)arg;
-
- pr_debug("atm_tc_delete(sch %p,[qdisc %p],flow %p)\n", sch, p, flow);
- if (list_empty(&flow->list))
- return -EINVAL;
- if (rcu_access_pointer(flow->filter_list) || flow == &p->link)
- return -EBUSY;
- /*
- * Reference count must be 2: one for "keepalive" (set at class
- * creation), and one for the reference held when calling delete.
- */
- if (flow->ref < 2) {
- pr_err("atm_tc_delete: flow->ref == %d\n", flow->ref);
- return -EINVAL;
- }
- if (flow->ref > 2)
- return -EBUSY; /* catch references via excess, etc. */
- atm_tc_put(sch, arg);
- return 0;
-}
-
-static void atm_tc_walk(struct Qdisc *sch, struct qdisc_walker *walker)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct atm_flow_data *flow;
-
- pr_debug("atm_tc_walk(sch %p,[qdisc %p],walker %p)\n", sch, p, walker);
- if (walker->stop)
- return;
- list_for_each_entry(flow, &p->flows, list) {
- if (walker->count >= walker->skip &&
- walker->fn(sch, (unsigned long)flow, walker) < 0) {
- walker->stop = 1;
- break;
- }
- walker->count++;
- }
-}
-
-static struct tcf_block *atm_tc_tcf_block(struct Qdisc *sch, unsigned long cl,
- struct netlink_ext_ack *extack)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct atm_flow_data *flow = (struct atm_flow_data *)cl;
-
- pr_debug("atm_tc_find_tcf(sch %p,[qdisc %p],flow %p)\n", sch, p, flow);
- return flow ? flow->block : p->link.block;
-}
-
-/* --------------------------- Qdisc operations ---------------------------- */
-
-static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch,
- struct sk_buff **to_free)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct atm_flow_data *flow;
- struct tcf_result res;
- int result;
- int ret = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
-
- pr_debug("atm_tc_enqueue(skb %p,sch %p,[qdisc %p])\n", skb, sch, p);
- result = TC_ACT_OK; /* be nice to gcc */
- flow = NULL;
- if (TC_H_MAJ(skb->priority) != sch->handle ||
- !(flow = (struct atm_flow_data *)atm_tc_find(sch, skb->priority))) {
- struct tcf_proto *fl;
-
- list_for_each_entry(flow, &p->flows, list) {
- fl = rcu_dereference_bh(flow->filter_list);
- if (fl) {
- result = tcf_classify(skb, NULL, fl, &res, true);
- if (result < 0)
- continue;
- if (result == TC_ACT_SHOT)
- goto done;
-
- flow = (struct atm_flow_data *)res.class;
- if (!flow)
- flow = lookup_flow(sch, res.classid);
- goto drop;
- }
- }
- flow = NULL;
-done:
- ;
- }
- if (!flow) {
- flow = &p->link;
- } else {
- if (flow->vcc)
- ATM_SKB(skb)->atm_options = flow->vcc->atm_options;
- /*@@@ looks good ... but it's not supposed to work :-) */
-#ifdef CONFIG_NET_CLS_ACT
- switch (result) {
- case TC_ACT_QUEUED:
- case TC_ACT_STOLEN:
- case TC_ACT_TRAP:
- __qdisc_drop(skb, to_free);
- return NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
- case TC_ACT_SHOT:
- __qdisc_drop(skb, to_free);
- goto drop;
- case TC_ACT_RECLASSIFY:
- if (flow->excess)
- flow = flow->excess;
- else
- ATM_SKB(skb)->atm_options |= ATM_ATMOPT_CLP;
- break;
- }
-#endif
- }
-
- ret = qdisc_enqueue(skb, flow->q, to_free);
- if (ret != NET_XMIT_SUCCESS) {
-drop: __maybe_unused
- if (net_xmit_drop_count(ret)) {
- qdisc_qstats_drop(sch);
- if (flow)
- flow->qstats.drops++;
- }
- return ret;
- }
- /*
- * Okay, this may seem weird. We pretend we've dropped the packet if
- * it goes via ATM. The reason for this is that the outer qdisc
- * expects to be able to q->dequeue the packet later on if we return
- * success at this place. Also, sch->q.qdisc needs to reflect whether
- * there is a packet egligible for dequeuing or not. Note that the
- * statistics of the outer qdisc are necessarily wrong because of all
- * this. There's currently no correct solution for this.
- */
- if (flow == &p->link) {
- sch->q.qlen++;
- return NET_XMIT_SUCCESS;
- }
- tasklet_schedule(&p->task);
- return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
-}
-
-/*
- * Dequeue packets and send them over ATM. Note that we quite deliberately
- * avoid checking net_device's flow control here, simply because sch_atm
- * uses its own channels, which have nothing to do with any CLIP/LANE/or
- * non-ATM interfaces.
- */
-
-static void sch_atm_dequeue(struct tasklet_struct *t)
-{
- struct atm_qdisc_data *p = from_tasklet(p, t, task);
- struct Qdisc *sch = qdisc_from_priv(p);
- struct atm_flow_data *flow;
- struct sk_buff *skb;
-
- pr_debug("sch_atm_dequeue(sch %p,[qdisc %p])\n", sch, p);
- list_for_each_entry(flow, &p->flows, list) {
- if (flow == &p->link)
- continue;
- /*
- * If traffic is properly shaped, this won't generate nasty
- * little bursts. Otherwise, it may ... (but that's okay)
- */
- while ((skb = flow->q->ops->peek(flow->q))) {
- if (!atm_may_send(flow->vcc, skb->truesize))
- break;
-
- skb = qdisc_dequeue_peeked(flow->q);
- if (unlikely(!skb))
- break;
-
- qdisc_bstats_update(sch, skb);
- bstats_update(&flow->bstats, skb);
- pr_debug("atm_tc_dequeue: sending on class %p\n", flow);
- /* remove any LL header somebody else has attached */
- skb_pull(skb, skb_network_offset(skb));
- if (skb_headroom(skb) < flow->hdr_len) {
- struct sk_buff *new;
-
- new = skb_realloc_headroom(skb, flow->hdr_len);
- dev_kfree_skb(skb);
- if (!new)
- continue;
- skb = new;
- }
- pr_debug("sch_atm_dequeue: ip %p, data %p\n",
- skb_network_header(skb), skb->data);
- ATM_SKB(skb)->vcc = flow->vcc;
- memcpy(skb_push(skb, flow->hdr_len), flow->hdr,
- flow->hdr_len);
- refcount_add(skb->truesize,
- &sk_atm(flow->vcc)->sk_wmem_alloc);
- /* atm.atm_options are already set by atm_tc_enqueue */
- flow->vcc->send(flow->vcc, skb);
- }
- }
-}
-
-static struct sk_buff *atm_tc_dequeue(struct Qdisc *sch)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct sk_buff *skb;
-
- pr_debug("atm_tc_dequeue(sch %p,[qdisc %p])\n", sch, p);
- tasklet_schedule(&p->task);
- skb = qdisc_dequeue_peeked(p->link.q);
- if (skb)
- sch->q.qlen--;
- return skb;
-}
-
-static struct sk_buff *atm_tc_peek(struct Qdisc *sch)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
-
- pr_debug("atm_tc_peek(sch %p,[qdisc %p])\n", sch, p);
-
- return p->link.q->ops->peek(p->link.q);
-}
-
-static int atm_tc_init(struct Qdisc *sch, struct nlattr *opt,
- struct netlink_ext_ack *extack)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- int err;
-
- pr_debug("atm_tc_init(sch %p,[qdisc %p],opt %p)\n", sch, p, opt);
- INIT_LIST_HEAD(&p->flows);
- INIT_LIST_HEAD(&p->link.list);
- list_add(&p->link.list, &p->flows);
- p->link.q = qdisc_create_dflt(sch->dev_queue,
- &pfifo_qdisc_ops, sch->handle, extack);
- if (!p->link.q)
- p->link.q = &noop_qdisc;
- pr_debug("atm_tc_init: link (%p) qdisc %p\n", &p->link, p->link.q);
- p->link.vcc = NULL;
- p->link.sock = NULL;
- p->link.common.classid = sch->handle;
- p->link.ref = 1;
-
- err = tcf_block_get(&p->link.block, &p->link.filter_list, sch,
- extack);
- if (err)
- return err;
-
- tasklet_setup(&p->task, sch_atm_dequeue);
- return 0;
-}
-
-static void atm_tc_reset(struct Qdisc *sch)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct atm_flow_data *flow;
-
- pr_debug("atm_tc_reset(sch %p,[qdisc %p])\n", sch, p);
- list_for_each_entry(flow, &p->flows, list)
- qdisc_reset(flow->q);
-}
-
-static void atm_tc_destroy(struct Qdisc *sch)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct atm_flow_data *flow, *tmp;
-
- pr_debug("atm_tc_destroy(sch %p,[qdisc %p])\n", sch, p);
- list_for_each_entry(flow, &p->flows, list) {
- tcf_block_put(flow->block);
- flow->block = NULL;
- }
-
- list_for_each_entry_safe(flow, tmp, &p->flows, list) {
- if (flow->ref > 1)
- pr_err("atm_destroy: %p->ref = %d\n", flow, flow->ref);
- atm_tc_put(sch, (unsigned long)flow);
- }
- tasklet_kill(&p->task);
-}
-
-static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
- struct sk_buff *skb, struct tcmsg *tcm)
-{
- struct atm_qdisc_data *p = qdisc_priv(sch);
- struct atm_flow_data *flow = (struct atm_flow_data *)cl;
- struct nlattr *nest;
-
- pr_debug("atm_tc_dump_class(sch %p,[qdisc %p],flow %p,skb %p,tcm %p)\n",
- sch, p, flow, skb, tcm);
- if (list_empty(&flow->list))
- return -EINVAL;
- tcm->tcm_handle = flow->common.classid;
- tcm->tcm_info = flow->q->handle;
-
- nest = nla_nest_start_noflag(skb, TCA_OPTIONS);
- if (nest == NULL)
- goto nla_put_failure;
-
- if (nla_put(skb, TCA_ATM_HDR, flow->hdr_len, flow->hdr))
- goto nla_put_failure;
- if (flow->vcc) {
- struct sockaddr_atmpvc pvc;
- int state;
-
- memset(&pvc, 0, sizeof(pvc));
- pvc.sap_family = AF_ATMPVC;
- pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
- pvc.sap_addr.vpi = flow->vcc->vpi;
- pvc.sap_addr.vci = flow->vcc->vci;
- if (nla_put(skb, TCA_ATM_ADDR, sizeof(pvc), &pvc))
- goto nla_put_failure;
- state = ATM_VF2VS(flow->vcc->flags);
- if (nla_put_u32(skb, TCA_ATM_STATE, state))
- goto nla_put_failure;
- }
- if (flow->excess) {
- if (nla_put_u32(skb, TCA_ATM_EXCESS, flow->common.classid))
- goto nla_put_failure;
- } else {
- if (nla_put_u32(skb, TCA_ATM_EXCESS, 0))
- goto nla_put_failure;
- }
- return nla_nest_end(skb, nest);
-
-nla_put_failure:
- nla_nest_cancel(skb, nest);
- return -1;
-}
-static int
-atm_tc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
- struct gnet_dump *d)
-{
- struct atm_flow_data *flow = (struct atm_flow_data *)arg;
-
- if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
- d, NULL, &flow->bstats) < 0 ||
- gnet_stats_copy_queue(d, NULL, &flow->qstats, flow->q->q.qlen) < 0)
- return -1;
-
- return 0;
-}
-
-static int atm_tc_dump(struct Qdisc *sch, struct sk_buff *skb)
-{
- return 0;
-}
-
-static const struct Qdisc_class_ops atm_class_ops = {
- .graft = atm_tc_graft,
- .leaf = atm_tc_leaf,
- .find = atm_tc_find,
- .change = atm_tc_change,
- .delete = atm_tc_delete,
- .walk = atm_tc_walk,
- .tcf_block = atm_tc_tcf_block,
- .bind_tcf = atm_tc_bind_filter,
- .unbind_tcf = atm_tc_put,
- .dump = atm_tc_dump_class,
- .dump_stats = atm_tc_dump_class_stats,
-};
-
-static struct Qdisc_ops atm_qdisc_ops __read_mostly = {
- .cl_ops = &atm_class_ops,
- .id = "atm",
- .priv_size = sizeof(struct atm_qdisc_data),
- .enqueue = atm_tc_enqueue,
- .dequeue = atm_tc_dequeue,
- .peek = atm_tc_peek,
- .init = atm_tc_init,
- .reset = atm_tc_reset,
- .destroy = atm_tc_destroy,
- .dump = atm_tc_dump,
- .owner = THIS_MODULE,
-};
-
-static int __init atm_init(void)
-{
- return register_qdisc(&atm_qdisc_ops);
-}
-
-static void __exit atm_exit(void)
-{
- unregister_qdisc(&atm_qdisc_ops);
-}
-
-module_init(atm_init)
-module_exit(atm_exit)
-MODULE_LICENSE("GPL");
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 003/245] net/sched: Retire dsmark qdisc
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 001/245] net/sched: Retire CBQ qdisc Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 002/245] net/sched: Retire ATM qdisc Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 004/245] smb: client: fix OOB in receive_encrypted_standard() Greg Kroah-Hartman
` (252 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamal Hadi Salim, Jiri Pirko,
Paolo Abeni
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
commit bbe77c14ee6185a61ba6d5e435c1cbb489d2a9ed upstream.
The dsmark qdisc has served us well over the years for diffserv but has not
been getting much attention due to other more popular approaches to do diffserv
services. Most recently it has become a shooting target for syzkaller. For this
reason, we are retiring it.
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/Kconfig | 11 -
net/sched/Makefile | 1
net/sched/sch_dsmark.c | 522 -------------------------------------------------
3 files changed, 534 deletions(-)
delete mode 100644 net/sched/sch_dsmark.c
delete mode 100644 tools/testing/selftests/tc-testing/tc-tests/qdiscs/dsmark.json
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -186,17 +186,6 @@ config NET_SCH_GRED
To compile this code as a module, choose M here: the
module will be called sch_gred.
-config NET_SCH_DSMARK
- tristate "Differentiated Services marker (DSMARK)"
- help
- Say Y if you want to schedule packets according to the
- Differentiated Services architecture proposed in RFC 2475.
- Technical information on this method, with pointers to associated
- RFCs, is available at <http://www.gta.ufrj.br/diffserv/>.
-
- To compile this code as a module, choose M here: the
- module will be called sch_dsmark.
-
config NET_SCH_NETEM
tristate "Network emulator (NETEM)"
help
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -38,7 +38,6 @@ obj-$(CONFIG_NET_SCH_HFSC) += sch_hfsc.o
obj-$(CONFIG_NET_SCH_RED) += sch_red.o
obj-$(CONFIG_NET_SCH_GRED) += sch_gred.o
obj-$(CONFIG_NET_SCH_INGRESS) += sch_ingress.o
-obj-$(CONFIG_NET_SCH_DSMARK) += sch_dsmark.o
obj-$(CONFIG_NET_SCH_SFB) += sch_sfb.o
obj-$(CONFIG_NET_SCH_SFQ) += sch_sfq.o
obj-$(CONFIG_NET_SCH_TBF) += sch_tbf.o
--- a/net/sched/sch_dsmark.c
+++ /dev/null
@@ -1,522 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/* net/sched/sch_dsmark.c - Differentiated Services field marker */
-
-/* Written 1998-2000 by Werner Almesberger, EPFL ICA */
-
-
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/types.h>
-#include <linux/string.h>
-#include <linux/errno.h>
-#include <linux/skbuff.h>
-#include <linux/rtnetlink.h>
-#include <linux/bitops.h>
-#include <net/pkt_sched.h>
-#include <net/pkt_cls.h>
-#include <net/dsfield.h>
-#include <net/inet_ecn.h>
-#include <asm/byteorder.h>
-
-/*
- * classid class marking
- * ------- ----- -------
- * n/a 0 n/a
- * x:0 1 use entry [0]
- * ... ... ...
- * x:y y>0 y+1 use entry [y]
- * ... ... ...
- * x:indices-1 indices use entry [indices-1]
- * ... ... ...
- * x:y y+1 use entry [y & (indices-1)]
- * ... ... ...
- * 0xffff 0x10000 use entry [indices-1]
- */
-
-
-#define NO_DEFAULT_INDEX (1 << 16)
-
-struct mask_value {
- u8 mask;
- u8 value;
-};
-
-struct dsmark_qdisc_data {
- struct Qdisc *q;
- struct tcf_proto __rcu *filter_list;
- struct tcf_block *block;
- struct mask_value *mv;
- u16 indices;
- u8 set_tc_index;
- u32 default_index; /* index range is 0...0xffff */
-#define DSMARK_EMBEDDED_SZ 16
- struct mask_value embedded[DSMARK_EMBEDDED_SZ];
-};
-
-static inline int dsmark_valid_index(struct dsmark_qdisc_data *p, u16 index)
-{
- return index <= p->indices && index > 0;
-}
-
-/* ------------------------- Class/flow operations ------------------------- */
-
-static int dsmark_graft(struct Qdisc *sch, unsigned long arg,
- struct Qdisc *new, struct Qdisc **old,
- struct netlink_ext_ack *extack)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
-
- pr_debug("%s(sch %p,[qdisc %p],new %p,old %p)\n",
- __func__, sch, p, new, old);
-
- if (new == NULL) {
- new = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
- sch->handle, NULL);
- if (new == NULL)
- new = &noop_qdisc;
- }
-
- *old = qdisc_replace(sch, new, &p->q);
- return 0;
-}
-
-static struct Qdisc *dsmark_leaf(struct Qdisc *sch, unsigned long arg)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
- return p->q;
-}
-
-static unsigned long dsmark_find(struct Qdisc *sch, u32 classid)
-{
- return TC_H_MIN(classid) + 1;
-}
-
-static unsigned long dsmark_bind_filter(struct Qdisc *sch,
- unsigned long parent, u32 classid)
-{
- pr_debug("%s(sch %p,[qdisc %p],classid %x)\n",
- __func__, sch, qdisc_priv(sch), classid);
-
- return dsmark_find(sch, classid);
-}
-
-static void dsmark_unbind_filter(struct Qdisc *sch, unsigned long cl)
-{
-}
-
-static const struct nla_policy dsmark_policy[TCA_DSMARK_MAX + 1] = {
- [TCA_DSMARK_INDICES] = { .type = NLA_U16 },
- [TCA_DSMARK_DEFAULT_INDEX] = { .type = NLA_U16 },
- [TCA_DSMARK_SET_TC_INDEX] = { .type = NLA_FLAG },
- [TCA_DSMARK_MASK] = { .type = NLA_U8 },
- [TCA_DSMARK_VALUE] = { .type = NLA_U8 },
-};
-
-static int dsmark_change(struct Qdisc *sch, u32 classid, u32 parent,
- struct nlattr **tca, unsigned long *arg,
- struct netlink_ext_ack *extack)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
- struct nlattr *opt = tca[TCA_OPTIONS];
- struct nlattr *tb[TCA_DSMARK_MAX + 1];
- int err = -EINVAL;
-
- pr_debug("%s(sch %p,[qdisc %p],classid %x,parent %x), arg 0x%lx\n",
- __func__, sch, p, classid, parent, *arg);
-
- if (!dsmark_valid_index(p, *arg)) {
- err = -ENOENT;
- goto errout;
- }
-
- if (!opt)
- goto errout;
-
- err = nla_parse_nested_deprecated(tb, TCA_DSMARK_MAX, opt,
- dsmark_policy, NULL);
- if (err < 0)
- goto errout;
-
- if (tb[TCA_DSMARK_VALUE])
- p->mv[*arg - 1].value = nla_get_u8(tb[TCA_DSMARK_VALUE]);
-
- if (tb[TCA_DSMARK_MASK])
- p->mv[*arg - 1].mask = nla_get_u8(tb[TCA_DSMARK_MASK]);
-
- err = 0;
-
-errout:
- return err;
-}
-
-static int dsmark_delete(struct Qdisc *sch, unsigned long arg,
- struct netlink_ext_ack *extack)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
-
- if (!dsmark_valid_index(p, arg))
- return -EINVAL;
-
- p->mv[arg - 1].mask = 0xff;
- p->mv[arg - 1].value = 0;
-
- return 0;
-}
-
-static void dsmark_walk(struct Qdisc *sch, struct qdisc_walker *walker)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
- int i;
-
- pr_debug("%s(sch %p,[qdisc %p],walker %p)\n",
- __func__, sch, p, walker);
-
- if (walker->stop)
- return;
-
- for (i = 0; i < p->indices; i++) {
- if (p->mv[i].mask == 0xff && !p->mv[i].value)
- goto ignore;
- if (walker->count >= walker->skip) {
- if (walker->fn(sch, i + 1, walker) < 0) {
- walker->stop = 1;
- break;
- }
- }
-ignore:
- walker->count++;
- }
-}
-
-static struct tcf_block *dsmark_tcf_block(struct Qdisc *sch, unsigned long cl,
- struct netlink_ext_ack *extack)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
-
- return p->block;
-}
-
-/* --------------------------- Qdisc operations ---------------------------- */
-
-static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch,
- struct sk_buff **to_free)
-{
- unsigned int len = qdisc_pkt_len(skb);
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
- int err;
-
- pr_debug("%s(skb %p,sch %p,[qdisc %p])\n", __func__, skb, sch, p);
-
- if (p->set_tc_index) {
- int wlen = skb_network_offset(skb);
-
- switch (skb_protocol(skb, true)) {
- case htons(ETH_P_IP):
- wlen += sizeof(struct iphdr);
- if (!pskb_may_pull(skb, wlen) ||
- skb_try_make_writable(skb, wlen))
- goto drop;
-
- skb->tc_index = ipv4_get_dsfield(ip_hdr(skb))
- & ~INET_ECN_MASK;
- break;
-
- case htons(ETH_P_IPV6):
- wlen += sizeof(struct ipv6hdr);
- if (!pskb_may_pull(skb, wlen) ||
- skb_try_make_writable(skb, wlen))
- goto drop;
-
- skb->tc_index = ipv6_get_dsfield(ipv6_hdr(skb))
- & ~INET_ECN_MASK;
- break;
- default:
- skb->tc_index = 0;
- break;
- }
- }
-
- if (TC_H_MAJ(skb->priority) == sch->handle)
- skb->tc_index = TC_H_MIN(skb->priority);
- else {
- struct tcf_result res;
- struct tcf_proto *fl = rcu_dereference_bh(p->filter_list);
- int result = tcf_classify(skb, NULL, fl, &res, false);
-
- pr_debug("result %d class 0x%04x\n", result, res.classid);
-
- switch (result) {
-#ifdef CONFIG_NET_CLS_ACT
- case TC_ACT_QUEUED:
- case TC_ACT_STOLEN:
- case TC_ACT_TRAP:
- __qdisc_drop(skb, to_free);
- return NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
-
- case TC_ACT_SHOT:
- goto drop;
-#endif
- case TC_ACT_OK:
- skb->tc_index = TC_H_MIN(res.classid);
- break;
-
- default:
- if (p->default_index != NO_DEFAULT_INDEX)
- skb->tc_index = p->default_index;
- break;
- }
- }
-
- err = qdisc_enqueue(skb, p->q, to_free);
- if (err != NET_XMIT_SUCCESS) {
- if (net_xmit_drop_count(err))
- qdisc_qstats_drop(sch);
- return err;
- }
-
- sch->qstats.backlog += len;
- sch->q.qlen++;
-
- return NET_XMIT_SUCCESS;
-
-drop:
- qdisc_drop(skb, sch, to_free);
- return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
-}
-
-static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
- struct sk_buff *skb;
- u32 index;
-
- pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
-
- skb = qdisc_dequeue_peeked(p->q);
- if (skb == NULL)
- return NULL;
-
- qdisc_bstats_update(sch, skb);
- qdisc_qstats_backlog_dec(sch, skb);
- sch->q.qlen--;
-
- index = skb->tc_index & (p->indices - 1);
- pr_debug("index %d->%d\n", skb->tc_index, index);
-
- switch (skb_protocol(skb, true)) {
- case htons(ETH_P_IP):
- ipv4_change_dsfield(ip_hdr(skb), p->mv[index].mask,
- p->mv[index].value);
- break;
- case htons(ETH_P_IPV6):
- ipv6_change_dsfield(ipv6_hdr(skb), p->mv[index].mask,
- p->mv[index].value);
- break;
- default:
- /*
- * Only complain if a change was actually attempted.
- * This way, we can send non-IP traffic through dsmark
- * and don't need yet another qdisc as a bypass.
- */
- if (p->mv[index].mask != 0xff || p->mv[index].value)
- pr_warn("%s: unsupported protocol %d\n",
- __func__, ntohs(skb_protocol(skb, true)));
- break;
- }
-
- return skb;
-}
-
-static struct sk_buff *dsmark_peek(struct Qdisc *sch)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
-
- pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
-
- return p->q->ops->peek(p->q);
-}
-
-static int dsmark_init(struct Qdisc *sch, struct nlattr *opt,
- struct netlink_ext_ack *extack)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
- struct nlattr *tb[TCA_DSMARK_MAX + 1];
- int err = -EINVAL;
- u32 default_index = NO_DEFAULT_INDEX;
- u16 indices;
- int i;
-
- pr_debug("%s(sch %p,[qdisc %p],opt %p)\n", __func__, sch, p, opt);
-
- if (!opt)
- goto errout;
-
- err = tcf_block_get(&p->block, &p->filter_list, sch, extack);
- if (err)
- return err;
-
- err = nla_parse_nested_deprecated(tb, TCA_DSMARK_MAX, opt,
- dsmark_policy, NULL);
- if (err < 0)
- goto errout;
-
- err = -EINVAL;
- if (!tb[TCA_DSMARK_INDICES])
- goto errout;
- indices = nla_get_u16(tb[TCA_DSMARK_INDICES]);
-
- if (hweight32(indices) != 1)
- goto errout;
-
- if (tb[TCA_DSMARK_DEFAULT_INDEX])
- default_index = nla_get_u16(tb[TCA_DSMARK_DEFAULT_INDEX]);
-
- if (indices <= DSMARK_EMBEDDED_SZ)
- p->mv = p->embedded;
- else
- p->mv = kmalloc_array(indices, sizeof(*p->mv), GFP_KERNEL);
- if (!p->mv) {
- err = -ENOMEM;
- goto errout;
- }
- for (i = 0; i < indices; i++) {
- p->mv[i].mask = 0xff;
- p->mv[i].value = 0;
- }
- p->indices = indices;
- p->default_index = default_index;
- p->set_tc_index = nla_get_flag(tb[TCA_DSMARK_SET_TC_INDEX]);
-
- p->q = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops, sch->handle,
- NULL);
- if (p->q == NULL)
- p->q = &noop_qdisc;
- else
- qdisc_hash_add(p->q, true);
-
- pr_debug("%s: qdisc %p\n", __func__, p->q);
-
- err = 0;
-errout:
- return err;
-}
-
-static void dsmark_reset(struct Qdisc *sch)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
-
- pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
- if (p->q)
- qdisc_reset(p->q);
-}
-
-static void dsmark_destroy(struct Qdisc *sch)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
-
- pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
-
- tcf_block_put(p->block);
- qdisc_put(p->q);
- if (p->mv != p->embedded)
- kfree(p->mv);
-}
-
-static int dsmark_dump_class(struct Qdisc *sch, unsigned long cl,
- struct sk_buff *skb, struct tcmsg *tcm)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
- struct nlattr *opts = NULL;
-
- pr_debug("%s(sch %p,[qdisc %p],class %ld\n", __func__, sch, p, cl);
-
- if (!dsmark_valid_index(p, cl))
- return -EINVAL;
-
- tcm->tcm_handle = TC_H_MAKE(TC_H_MAJ(sch->handle), cl - 1);
- tcm->tcm_info = p->q->handle;
-
- opts = nla_nest_start_noflag(skb, TCA_OPTIONS);
- if (opts == NULL)
- goto nla_put_failure;
- if (nla_put_u8(skb, TCA_DSMARK_MASK, p->mv[cl - 1].mask) ||
- nla_put_u8(skb, TCA_DSMARK_VALUE, p->mv[cl - 1].value))
- goto nla_put_failure;
-
- return nla_nest_end(skb, opts);
-
-nla_put_failure:
- nla_nest_cancel(skb, opts);
- return -EMSGSIZE;
-}
-
-static int dsmark_dump(struct Qdisc *sch, struct sk_buff *skb)
-{
- struct dsmark_qdisc_data *p = qdisc_priv(sch);
- struct nlattr *opts = NULL;
-
- opts = nla_nest_start_noflag(skb, TCA_OPTIONS);
- if (opts == NULL)
- goto nla_put_failure;
- if (nla_put_u16(skb, TCA_DSMARK_INDICES, p->indices))
- goto nla_put_failure;
-
- if (p->default_index != NO_DEFAULT_INDEX &&
- nla_put_u16(skb, TCA_DSMARK_DEFAULT_INDEX, p->default_index))
- goto nla_put_failure;
-
- if (p->set_tc_index &&
- nla_put_flag(skb, TCA_DSMARK_SET_TC_INDEX))
- goto nla_put_failure;
-
- return nla_nest_end(skb, opts);
-
-nla_put_failure:
- nla_nest_cancel(skb, opts);
- return -EMSGSIZE;
-}
-
-static const struct Qdisc_class_ops dsmark_class_ops = {
- .graft = dsmark_graft,
- .leaf = dsmark_leaf,
- .find = dsmark_find,
- .change = dsmark_change,
- .delete = dsmark_delete,
- .walk = dsmark_walk,
- .tcf_block = dsmark_tcf_block,
- .bind_tcf = dsmark_bind_filter,
- .unbind_tcf = dsmark_unbind_filter,
- .dump = dsmark_dump_class,
-};
-
-static struct Qdisc_ops dsmark_qdisc_ops __read_mostly = {
- .next = NULL,
- .cl_ops = &dsmark_class_ops,
- .id = "dsmark",
- .priv_size = sizeof(struct dsmark_qdisc_data),
- .enqueue = dsmark_enqueue,
- .dequeue = dsmark_dequeue,
- .peek = dsmark_peek,
- .init = dsmark_init,
- .reset = dsmark_reset,
- .destroy = dsmark_destroy,
- .change = NULL,
- .dump = dsmark_dump,
- .owner = THIS_MODULE,
-};
-
-static int __init dsmark_module_init(void)
-{
- return register_qdisc(&dsmark_qdisc_ops);
-}
-
-static void __exit dsmark_module_exit(void)
-{
- unregister_qdisc(&dsmark_qdisc_ops);
-}
-
-module_init(dsmark_module_init)
-module_exit(dsmark_module_exit)
-
-MODULE_LICENSE("GPL");
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 004/245] smb: client: fix OOB in receive_encrypted_standard()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 003/245] net/sched: Retire dsmark qdisc Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 005/245] smb: client: fix potential OOBs in smb2_parse_contexts() Greg Kroah-Hartman
` (251 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Morris,
Paulo Alcantara (SUSE), Steve French, Guruswamy Basavaiah
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.com>
[ Upstream commit eec04ea119691e65227a97ce53c0da6b9b74b0b7 ]
Fix potential OOB in receive_encrypted_standard() if server returned a
large shdr->NextCommand that would end up writing off the end of
@next_buffer.
Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses")
Cc: stable@vger.kernel.org
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
[Guru: receive_encrypted_standard() is present in file smb2ops.c,
smb2ops.c file location is changed, modified patch accordingly.]
Signed-off-by: Guruswamy Basavaiah <guruswamy.basavaiah@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2ops.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -5153,6 +5153,7 @@ receive_encrypted_standard(struct TCP_Se
struct smb2_sync_hdr *shdr;
unsigned int pdu_length = server->pdu_size;
unsigned int buf_size;
+ unsigned int next_cmd;
struct mid_q_entry *mid_entry;
int next_is_large;
char *next_buffer = NULL;
@@ -5181,14 +5182,15 @@ receive_encrypted_standard(struct TCP_Se
next_is_large = server->large_buf;
one_more:
shdr = (struct smb2_sync_hdr *)buf;
- if (shdr->NextCommand) {
+ next_cmd = le32_to_cpu(shdr->NextCommand);
+ if (next_cmd) {
+ if (WARN_ON_ONCE(next_cmd > pdu_length))
+ return -1;
if (next_is_large)
next_buffer = (char *)cifs_buf_get();
else
next_buffer = (char *)cifs_small_buf_get();
- memcpy(next_buffer,
- buf + le32_to_cpu(shdr->NextCommand),
- pdu_length - le32_to_cpu(shdr->NextCommand));
+ memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd);
}
mid_entry = smb2_find_mid(server, buf);
@@ -5212,8 +5214,8 @@ one_more:
else
ret = cifs_handle_standard(server, mid_entry);
- if (ret == 0 && shdr->NextCommand) {
- pdu_length -= le32_to_cpu(shdr->NextCommand);
+ if (ret == 0 && next_cmd) {
+ pdu_length -= next_cmd;
server->large_buf = next_is_large;
if (next_is_large)
server->bigbuf = buf = next_buffer;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 005/245] smb: client: fix potential OOBs in smb2_parse_contexts()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 004/245] smb: client: fix OOB in receive_encrypted_standard() Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 006/245] smb: client: fix parsing of SMB3.1.1 POSIX create context Greg Kroah-Hartman
` (250 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Morris,
Paulo Alcantara (SUSE), Steve French, Guruswamy Basavaiah
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.com>
[ Upstream commit af1689a9b7701d9907dfc84d2a4b57c4bc907144 ]
Validate offsets and lengths before dereferencing create contexts in
smb2_parse_contexts().
This fixes following oops when accessing invalid create contexts from
server:
BUG: unable to handle page fault for address: ffff8881178d8cc3
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 4a01067 P4D 4a01067 PUD 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]
Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00
00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7
7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00
RSP: 0018:ffffc900007939e0 EFLAGS: 00010216
RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90
RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000
RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000
R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000
R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22
FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
? __die+0x23/0x70
? page_fault_oops+0x181/0x480
? search_module_extables+0x19/0x60
? srso_alias_return_thunk+0x5/0xfbef5
? exc_page_fault+0x1b6/0x1c0
? asm_exc_page_fault+0x26/0x30
? smb2_parse_contexts+0xa0/0x3a0 [cifs]
SMB2_open+0x38d/0x5f0 [cifs]
? smb2_is_path_accessible+0x138/0x260 [cifs]
smb2_is_path_accessible+0x138/0x260 [cifs]
cifs_is_path_remote+0x8d/0x230 [cifs]
cifs_mount+0x7e/0x350 [cifs]
cifs_smb3_do_mount+0x128/0x780 [cifs]
smb3_get_tree+0xd9/0x290 [cifs]
vfs_get_tree+0x2c/0x100
? capable+0x37/0x70
path_mount+0x2d7/0xb80
? srso_alias_return_thunk+0x5/0xfbef5
? _raw_spin_unlock_irqrestore+0x44/0x60
__x64_sys_mount+0x11a/0x150
do_syscall_64+0x47/0xf0
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f8737657b1e
Reported-by: Robert Morris <rtm@csail.mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
[Guru: Removed changes to cached_dir.c and checking return value
of smb2_parse_contexts in smb2ops.c]
Signed-off-by: Guruswamy Basavaiah <guruswamy.basavaiah@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2ops.c | 4 +-
fs/cifs/smb2pdu.c | 91 +++++++++++++++++++++++++++++++---------------------
fs/cifs/smb2proto.h | 12 ++++--
3 files changed, 65 insertions(+), 42 deletions(-)
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -908,10 +908,12 @@ int open_cached_dir(unsigned int xid, st
*/
kref_get(&tcon->crfid.refcount);
tcon->crfid.has_lease = true;
- smb2_parse_contexts(server, o_rsp,
+ rc = smb2_parse_contexts(server, rsp_iov,
&oparms.fid->epoch,
oparms.fid->lease_key, &oplock,
NULL, NULL);
+ if (rc)
+ goto oshr_exit;
} else
goto oshr_exit;
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2055,17 +2055,18 @@ parse_posix_ctxt(struct create_context *
posix->nlink, posix->mode, posix->reparse_tag);
}
-void
-smb2_parse_contexts(struct TCP_Server_Info *server,
- struct smb2_create_rsp *rsp,
- unsigned int *epoch, char *lease_key, __u8 *oplock,
- struct smb2_file_all_info *buf,
- struct create_posix_rsp *posix)
+int smb2_parse_contexts(struct TCP_Server_Info *server,
+ struct kvec *rsp_iov,
+ unsigned int *epoch,
+ char *lease_key, __u8 *oplock,
+ struct smb2_file_all_info *buf,
+ struct create_posix_rsp *posix)
{
- char *data_offset;
+ struct smb2_create_rsp *rsp = rsp_iov->iov_base;
struct create_context *cc;
- unsigned int next;
- unsigned int remaining;
+ size_t rem, off, len;
+ size_t doff, dlen;
+ size_t noff, nlen;
char *name;
static const char smb3_create_tag_posix[] = {
0x93, 0xAD, 0x25, 0x50, 0x9C,
@@ -2074,45 +2075,63 @@ smb2_parse_contexts(struct TCP_Server_In
};
*oplock = 0;
- data_offset = (char *)rsp + le32_to_cpu(rsp->CreateContextsOffset);
- remaining = le32_to_cpu(rsp->CreateContextsLength);
- cc = (struct create_context *)data_offset;
+
+ off = le32_to_cpu(rsp->CreateContextsOffset);
+ rem = le32_to_cpu(rsp->CreateContextsLength);
+ if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len)
+ return -EINVAL;
+ cc = (struct create_context *)((u8 *)rsp + off);
/* Initialize inode number to 0 in case no valid data in qfid context */
if (buf)
buf->IndexNumber = 0;
- while (remaining >= sizeof(struct create_context)) {
- name = le16_to_cpu(cc->NameOffset) + (char *)cc;
- if (le16_to_cpu(cc->NameLength) == 4 &&
- strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4) == 0)
- *oplock = server->ops->parse_lease_buf(cc, epoch,
- lease_key);
- else if (buf && (le16_to_cpu(cc->NameLength) == 4) &&
- strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4) == 0)
- parse_query_id_ctxt(cc, buf);
- else if ((le16_to_cpu(cc->NameLength) == 16)) {
- if (posix &&
- memcmp(name, smb3_create_tag_posix, 16) == 0)
+ while (rem >= sizeof(*cc)) {
+ doff = le16_to_cpu(cc->DataOffset);
+ dlen = le32_to_cpu(cc->DataLength);
+ if (check_add_overflow(doff, dlen, &len) || len > rem)
+ return -EINVAL;
+
+ noff = le16_to_cpu(cc->NameOffset);
+ nlen = le16_to_cpu(cc->NameLength);
+ if (noff + nlen >= doff)
+ return -EINVAL;
+
+ name = (char *)cc + noff;
+ switch (nlen) {
+ case 4:
+ if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) {
+ *oplock = server->ops->parse_lease_buf(cc, epoch,
+ lease_key);
+ } else if (buf &&
+ !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) {
+ parse_query_id_ctxt(cc, buf);
+ }
+ break;
+ case 16:
+ if (posix && !memcmp(name, smb3_create_tag_posix, 16))
parse_posix_ctxt(cc, buf, posix);
+ break;
+ default:
+ cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n",
+ __func__, nlen, dlen);
+ if (IS_ENABLED(CONFIG_CIFS_DEBUG2))
+ cifs_dump_mem("context data: ", cc, dlen);
+ break;
}
- /* else {
- cifs_dbg(FYI, "Context not matched with len %d\n",
- le16_to_cpu(cc->NameLength));
- cifs_dump_mem("Cctxt name: ", name, 4);
- } */
- next = le32_to_cpu(cc->Next);
- if (!next)
+ off = le32_to_cpu(cc->Next);
+ if (!off)
break;
- remaining -= next;
- cc = (struct create_context *)((char *)cc + next);
+ if (check_sub_overflow(rem, off, &rem))
+ return -EINVAL;
+ cc = (struct create_context *)((u8 *)cc + off);
}
if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE)
*oplock = rsp->OplockLevel;
- return;
+ return 0;
}
static int
@@ -2982,8 +3001,8 @@ SMB2_open(const unsigned int xid, struct
}
- smb2_parse_contexts(server, rsp, &oparms->fid->epoch,
- oparms->fid->lease_key, oplock, buf, posix);
+ rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch,
+ oparms->fid->lease_key, oplock, buf, posix);
creat_exit:
SMB2_open_free(&rqst);
free_rsp_buf(resp_buftype, rsp);
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -259,11 +259,13 @@ extern int smb3_validate_negotiate(const
extern enum securityEnum smb2_select_sectype(struct TCP_Server_Info *,
enum securityEnum);
-extern void smb2_parse_contexts(struct TCP_Server_Info *server,
- struct smb2_create_rsp *rsp,
- unsigned int *epoch, char *lease_key,
- __u8 *oplock, struct smb2_file_all_info *buf,
- struct create_posix_rsp *posix);
+int smb2_parse_contexts(struct TCP_Server_Info *server,
+ struct kvec *rsp_iov,
+ unsigned int *epoch,
+ char *lease_key, __u8 *oplock,
+ struct smb2_file_all_info *buf,
+ struct create_posix_rsp *posix);
+
extern int smb3_encryption_required(const struct cifs_tcon *tcon);
extern int smb2_validate_iov(unsigned int offset, unsigned int buffer_length,
struct kvec *iov, unsigned int min_buf_size);
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 006/245] smb: client: fix parsing of SMB3.1.1 POSIX create context
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 005/245] smb: client: fix potential OOBs in smb2_parse_contexts() Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 007/245] sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset Greg Kroah-Hartman
` (249 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara, Steve French,
Guruswamy Basavaiah
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.com>
[ Upstream commit 76025cc2285d9ede3d717fe4305d66f8be2d9346 ]
The data offset for the SMB3.1.1 POSIX create context will always be
8-byte aligned so having the check 'noff + nlen >= doff' in
smb2_parse_contexts() is wrong as it will lead to -EINVAL because noff
+ nlen == doff.
Fix the sanity check to correctly handle aligned create context data.
Fixes: af1689a9b770 ("smb: client: fix potential OOBs in smb2_parse_contexts()")
Signed-off-by: Paulo Alcantara <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
[Guru:smb2_parse_contexts() is present in file smb2ops.c,
smb2ops.c file location is changed, modified patch accordingly.]
Signed-off-by: Guruswamy Basavaiah <guruswamy.basavaiah@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2pdu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2094,7 +2094,7 @@ int smb2_parse_contexts(struct TCP_Serve
noff = le16_to_cpu(cc->NameOffset);
nlen = le16_to_cpu(cc->NameLength);
- if (noff + nlen >= doff)
+ if (noff + nlen > doff)
return -EINVAL;
name = (char *)cc + noff;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 007/245] sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 006/245] smb: client: fix parsing of SMB3.1.1 POSIX create context Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 008/245] PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq() Greg Kroah-Hartman
` (248 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cyril Hrubis, Peter Zijlstra (Intel),
Petr Vorel, Mel Gorman, Mahmoud Adam
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyril Hrubis <chrubis@suse.cz>
commit c1fc6484e1fb7cc2481d169bfef129a1b0676abe upstream.
The sched_rr_timeslice can be reset to default by writing value that is
<= 0. However after reading from this file we always got the last value
written, which is not useful at all.
$ echo -1 > /proc/sys/kernel/sched_rr_timeslice_ms
$ cat /proc/sys/kernel/sched_rr_timeslice_ms
-1
Fix this by setting the variable that holds the sysctl file value to the
jiffies_to_msecs(RR_TIMESLICE) in case that <= 0 value was written.
Signed-off-by: Cyril Hrubis <chrubis@suse.cz>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Petr Vorel <pvorel@suse.cz>
Acked-by: Mel Gorman <mgorman@suse.de>
Tested-by: Petr Vorel <pvorel@suse.cz>
Cc: Mahmoud Adam <mngyadam@amazon.com>
Link: https://lore.kernel.org/r/20230802151906.25258-3-chrubis@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/rt.c | 3 +++
1 file changed, 3 insertions(+)
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -2883,6 +2883,9 @@ int sched_rr_handler(struct ctl_table *t
sched_rr_timeslice =
sysctl_sched_rr_timeslice <= 0 ? RR_TIMESLICE :
msecs_to_jiffies(sysctl_sched_rr_timeslice);
+
+ if (sysctl_sched_rr_timeslice <= 0)
+ sysctl_sched_rr_timeslice = jiffies_to_msecs(RR_TIMESLICE);
}
mutex_unlock(&mutex);
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 008/245] PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 007/245] sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 009/245] bpf: Merge printk and seq_printf VARARG max macros Greg Kroah-Hartman
` (247 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Bjorn Helgaas,
Niklas Cassel, Ilpo Järvinen, Manivannan Sadhasivam
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit b5d1b4b46f856da1473c7ba9a5cdfcb55c9b2478 upstream.
The "msg_addr" variable is u64. However, the "aligned_offset" is an
unsigned int. This means that when the code does:
msg_addr &= ~aligned_offset;
it will unintentionally zero out the high 32 bits. Use ALIGN_DOWN() to do
the alignment instead.
Fixes: 2217fffcd63f ("PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support")
Link: https://lore.kernel.org/r/af59c7ad-ab93-40f7-ad4a-7ac0b14d37f5@moroto.mountain
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pcie-designware-ep.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
@@ -6,6 +6,7 @@
* Author: Kishon Vijay Abraham I <kishon@ti.com>
*/
+#include <linux/align.h>
#include <linux/of.h>
#include <linux/platform_device.h>
@@ -589,7 +590,7 @@ int dw_pcie_ep_raise_msix_irq(struct dw_
}
aligned_offset = msg_addr & (epc->mem->window.page_size - 1);
- msg_addr &= ~aligned_offset;
+ msg_addr = ALIGN_DOWN(msg_addr, epc->mem->window.page_size);
ret = dw_pcie_ep_map_addr(epc, func_no, 0, ep->msi_mem_phys, msg_addr,
epc->mem->window.page_size);
if (ret)
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 009/245] bpf: Merge printk and seq_printf VARARG max macros
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 008/245] PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq() Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 010/245] bpf: Add struct for bin_args arg in bpf_bprintf_prepare Greg Kroah-Hartman
` (246 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Marchevsky, Alexei Starovoitov,
Andrii Nakryiko, Thadeu Lima de Souza Cascardo
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Marchevsky <davemarchevsky@fb.com>
commit 335ff4990cf3bfa42d8846f9b3d8c09456f51801 upstream.
MAX_SNPRINTF_VARARGS and MAX_SEQ_PRINTF_VARARGS are used by bpf helpers
bpf_snprintf and bpf_seq_printf to limit their varargs. Both call into
bpf_bprintf_prepare for print formatting logic and have convenience
macros in libbpf (BPF_SNPRINTF, BPF_SEQ_PRINTF) which use the same
helper macros to convert varargs to a byte array.
Changing shared functionality to support more varargs for either bpf
helper would affect the other as well, so let's combine the _VARARGS
macros to make this more obvious.
Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210917182911.2426606-2-davemarchevsky@fb.com
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/bpf.h | 2 ++
kernel/bpf/helpers.c | 4 +---
kernel/trace/bpf_trace.c | 4 +---
3 files changed, 4 insertions(+), 6 deletions(-)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -2290,6 +2290,8 @@ void bpf_arch_poke_desc_update(struct bp
struct btf_id_set;
bool btf_id_set_contains(const struct btf_id_set *set, u32 id);
+#define MAX_BPRINTF_VARARGS 12
+
int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,
u32 **bin_buf, u32 num_args);
void bpf_bprintf_cleanup(void);
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -979,15 +979,13 @@ out:
return err;
}
-#define MAX_SNPRINTF_VARARGS 12
-
BPF_CALL_5(bpf_snprintf, char *, str, u32, str_size, char *, fmt,
const void *, data, u32, data_len)
{
int err, num_args;
u32 *bin_args;
- if (data_len % 8 || data_len > MAX_SNPRINTF_VARARGS * 8 ||
+ if (data_len % 8 || data_len > MAX_BPRINTF_VARARGS * 8 ||
(data_len && !data))
return -EINVAL;
num_args = data_len / 8;
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -414,15 +414,13 @@ const struct bpf_func_proto *bpf_get_tra
return &bpf_trace_printk_proto;
}
-#define MAX_SEQ_PRINTF_VARARGS 12
-
BPF_CALL_5(bpf_seq_printf, struct seq_file *, m, char *, fmt, u32, fmt_size,
const void *, data, u32, data_len)
{
int err, num_args;
u32 *bin_args;
- if (data_len & 7 || data_len > MAX_SEQ_PRINTF_VARARGS * 8 ||
+ if (data_len & 7 || data_len > MAX_BPRINTF_VARARGS * 8 ||
(data_len && !data))
return -EINVAL;
num_args = data_len / 8;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 010/245] bpf: Add struct for bin_args arg in bpf_bprintf_prepare
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 009/245] bpf: Merge printk and seq_printf VARARG max macros Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 011/245] bpf: Do cleanup in bpf_bprintf_cleanup only when needed Greg Kroah-Hartman
` (245 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Olsa, Daniel Borkmann,
Yonghong Song, Thadeu Lima de Souza Cascardo
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
commit 78aa1cc9404399a15d2a1205329c6a06236f5378 upstream.
Adding struct bpf_bprintf_data to hold bin_args argument for
bpf_bprintf_prepare function.
We will add another return argument to bpf_bprintf_prepare and
pass the struct to bpf_bprintf_cleanup for proper cleanup in
following changes.
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20221215214430.1336195-2-jolsa@kernel.org
[cascardo: there is no bpf_trace_vprintk in 5.15]
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/bpf.h | 7 ++++++-
kernel/bpf/helpers.c | 24 +++++++++++++-----------
kernel/bpf/verifier.c | 3 ++-
kernel/trace/bpf_trace.c | 22 +++++++++++++---------
4 files changed, 34 insertions(+), 22 deletions(-)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -2292,8 +2292,13 @@ bool btf_id_set_contains(const struct bt
#define MAX_BPRINTF_VARARGS 12
+struct bpf_bprintf_data {
+ u32 *bin_args;
+ bool get_bin_args;
+};
+
int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,
- u32 **bin_buf, u32 num_args);
+ u32 num_args, struct bpf_bprintf_data *data);
void bpf_bprintf_cleanup(void);
#endif /* _LINUX_BPF_H */
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -752,16 +752,16 @@ void bpf_bprintf_cleanup(void)
* Returns a negative value if fmt is an invalid format string or 0 otherwise.
*
* This can be used in two ways:
- * - Format string verification only: when bin_args is NULL
+ * - Format string verification only: when data->get_bin_args is false
* - Arguments preparation: in addition to the above verification, it writes in
- * bin_args a binary representation of arguments usable by bstr_printf where
- * pointers from BPF have been sanitized.
+ * data->bin_args a binary representation of arguments usable by bstr_printf
+ * where pointers from BPF have been sanitized.
*
* In argument preparation mode, if 0 is returned, safe temporary buffers are
* allocated and bpf_bprintf_cleanup should be called to free them after use.
*/
int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,
- u32 **bin_args, u32 num_args)
+ u32 num_args, struct bpf_bprintf_data *data)
{
char *unsafe_ptr = NULL, *tmp_buf = NULL, *tmp_buf_end, *fmt_end;
size_t sizeof_cur_arg, sizeof_cur_ip;
@@ -774,12 +774,12 @@ int bpf_bprintf_prepare(char *fmt, u32 f
return -EINVAL;
fmt_size = fmt_end - fmt;
- if (bin_args) {
+ if (data->get_bin_args) {
if (num_args && try_get_fmt_tmp_buf(&tmp_buf))
return -EBUSY;
tmp_buf_end = tmp_buf + MAX_BPRINTF_BUF_LEN;
- *bin_args = (u32 *)tmp_buf;
+ data->bin_args = (u32 *)tmp_buf;
}
for (i = 0; i < fmt_size; i++) {
@@ -980,24 +980,26 @@ out:
}
BPF_CALL_5(bpf_snprintf, char *, str, u32, str_size, char *, fmt,
- const void *, data, u32, data_len)
+ const void *, args, u32, data_len)
{
+ struct bpf_bprintf_data data = {
+ .get_bin_args = true,
+ };
int err, num_args;
- u32 *bin_args;
if (data_len % 8 || data_len > MAX_BPRINTF_VARARGS * 8 ||
- (data_len && !data))
+ (data_len && !args))
return -EINVAL;
num_args = data_len / 8;
/* ARG_PTR_TO_CONST_STR guarantees that fmt is zero-terminated so we
* can safely give an unbounded size.
*/
- err = bpf_bprintf_prepare(fmt, UINT_MAX, data, &bin_args, num_args);
+ err = bpf_bprintf_prepare(fmt, UINT_MAX, args, num_args, &data);
if (err < 0)
return err;
- err = bstr_printf(str, str_size, fmt, bin_args);
+ err = bstr_printf(str, str_size, fmt, data.bin_args);
bpf_bprintf_cleanup();
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6407,6 +6407,7 @@ static int check_bpf_snprintf_call(struc
struct bpf_reg_state *fmt_reg = ®s[BPF_REG_3];
struct bpf_reg_state *data_len_reg = ®s[BPF_REG_5];
struct bpf_map *fmt_map = fmt_reg->map_ptr;
+ struct bpf_bprintf_data data = {};
int err, fmt_map_off, num_args;
u64 fmt_addr;
char *fmt;
@@ -6431,7 +6432,7 @@ static int check_bpf_snprintf_call(struc
/* We are also guaranteed that fmt+fmt_map_off is NULL terminated, we
* can focus on validating the format specifiers.
*/
- err = bpf_bprintf_prepare(fmt, UINT_MAX, NULL, NULL, num_args);
+ err = bpf_bprintf_prepare(fmt, UINT_MAX, NULL, num_args, &data);
if (err < 0)
verbose(env, "Invalid format string\n");
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -369,18 +369,20 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt
u64, arg2, u64, arg3)
{
u64 args[MAX_TRACE_PRINTK_VARARGS] = { arg1, arg2, arg3 };
- u32 *bin_args;
+ struct bpf_bprintf_data data = {
+ .get_bin_args = true,
+ };
static char buf[BPF_TRACE_PRINTK_SIZE];
unsigned long flags;
int ret;
- ret = bpf_bprintf_prepare(fmt, fmt_size, args, &bin_args,
- MAX_TRACE_PRINTK_VARARGS);
+ ret = bpf_bprintf_prepare(fmt, fmt_size, args,
+ MAX_TRACE_PRINTK_VARARGS, &data);
if (ret < 0)
return ret;
raw_spin_lock_irqsave(&trace_printk_lock, flags);
- ret = bstr_printf(buf, sizeof(buf), fmt, bin_args);
+ ret = bstr_printf(buf, sizeof(buf), fmt, data.bin_args);
trace_bpf_trace_printk(buf);
raw_spin_unlock_irqrestore(&trace_printk_lock, flags);
@@ -415,21 +417,23 @@ const struct bpf_func_proto *bpf_get_tra
}
BPF_CALL_5(bpf_seq_printf, struct seq_file *, m, char *, fmt, u32, fmt_size,
- const void *, data, u32, data_len)
+ const void *, args, u32, data_len)
{
+ struct bpf_bprintf_data data = {
+ .get_bin_args = true,
+ };
int err, num_args;
- u32 *bin_args;
if (data_len & 7 || data_len > MAX_BPRINTF_VARARGS * 8 ||
- (data_len && !data))
+ (data_len && !args))
return -EINVAL;
num_args = data_len / 8;
- err = bpf_bprintf_prepare(fmt, fmt_size, data, &bin_args, num_args);
+ err = bpf_bprintf_prepare(fmt, fmt_size, args, num_args, &data);
if (err < 0)
return err;
- seq_bprintf(m, fmt, bin_args);
+ seq_bprintf(m, fmt, data.bin_args);
bpf_bprintf_cleanup();
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 011/245] bpf: Do cleanup in bpf_bprintf_cleanup only when needed
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 010/245] bpf: Add struct for bin_args arg in bpf_bprintf_prepare Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 012/245] bpf: Remove trace_printk_lock Greg Kroah-Hartman
` (244 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Olsa, Daniel Borkmann,
Yonghong Song, Thadeu Lima de Souza Cascardo
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
commit f19a4050455aad847fb93f18dc1fe502eb60f989 upstream.
Currently we always cleanup/decrement bpf_bprintf_nest_level variable
in bpf_bprintf_cleanup if it's > 0.
There's possible scenario where this could cause a problem, when
bpf_bprintf_prepare does not get bin_args buffer (because num_args is 0)
and following bpf_bprintf_cleanup call decrements bpf_bprintf_nest_level
variable, like:
in task context:
bpf_bprintf_prepare(num_args != 0) increments 'bpf_bprintf_nest_level = 1'
-> first irq :
bpf_bprintf_prepare(num_args == 0)
bpf_bprintf_cleanup decrements 'bpf_bprintf_nest_level = 0'
-> second irq:
bpf_bprintf_prepare(num_args != 0) bpf_bprintf_nest_level = 1
gets same buffer as task context above
Adding check to bpf_bprintf_cleanup and doing the real cleanup only if we
got bin_args data in the first place.
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20221215214430.1336195-3-jolsa@kernel.org
[cascardo: there is no bpf_trace_vprintk in 5.15]
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/bpf.h | 2 +-
kernel/bpf/helpers.c | 16 +++++++++-------
kernel/trace/bpf_trace.c | 4 ++--
3 files changed, 12 insertions(+), 10 deletions(-)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -2299,6 +2299,6 @@ struct bpf_bprintf_data {
int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,
u32 num_args, struct bpf_bprintf_data *data);
-void bpf_bprintf_cleanup(void);
+void bpf_bprintf_cleanup(struct bpf_bprintf_data *data);
#endif /* _LINUX_BPF_H */
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -738,12 +738,14 @@ static int try_get_fmt_tmp_buf(char **tm
return 0;
}
-void bpf_bprintf_cleanup(void)
+void bpf_bprintf_cleanup(struct bpf_bprintf_data *data)
{
- if (this_cpu_read(bpf_bprintf_nest_level)) {
- this_cpu_dec(bpf_bprintf_nest_level);
- preempt_enable();
- }
+ if (!data->bin_args)
+ return;
+ if (WARN_ON_ONCE(this_cpu_read(bpf_bprintf_nest_level) == 0))
+ return;
+ this_cpu_dec(bpf_bprintf_nest_level);
+ preempt_enable();
}
/*
@@ -975,7 +977,7 @@ nocopy_fmt:
err = 0;
out:
if (err)
- bpf_bprintf_cleanup();
+ bpf_bprintf_cleanup(data);
return err;
}
@@ -1001,7 +1003,7 @@ BPF_CALL_5(bpf_snprintf, char *, str, u3
err = bstr_printf(str, str_size, fmt, data.bin_args);
- bpf_bprintf_cleanup();
+ bpf_bprintf_cleanup(&data);
return err + 1;
}
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -387,7 +387,7 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt
trace_bpf_trace_printk(buf);
raw_spin_unlock_irqrestore(&trace_printk_lock, flags);
- bpf_bprintf_cleanup();
+ bpf_bprintf_cleanup(&data);
return ret;
}
@@ -435,7 +435,7 @@ BPF_CALL_5(bpf_seq_printf, struct seq_fi
seq_bprintf(m, fmt, data.bin_args);
- bpf_bprintf_cleanup();
+ bpf_bprintf_cleanup(&data);
return seq_has_overflowed(m) ? -EOVERFLOW : 0;
}
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 012/245] bpf: Remove trace_printk_lock
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 011/245] bpf: Do cleanup in bpf_bprintf_cleanup only when needed Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 013/245] userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb Greg Kroah-Hartman
` (243 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao Sun, Andrii Nakryiko, Jiri Olsa,
Daniel Borkmann, Yonghong Song, Thadeu Lima de Souza Cascardo
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
commit e2bb9e01d589f7fa82573aedd2765ff9b277816a upstream.
Both bpf_trace_printk and bpf_trace_vprintk helpers use static buffer guarded
with trace_printk_lock spin lock.
The spin lock contention causes issues with bpf programs attached to
contention_begin tracepoint [1][2].
Andrii suggested we could get rid of the contention by using trylock, but we
could actually get rid of the spinlock completely by using percpu buffers the
same way as for bin_args in bpf_bprintf_prepare function.
Adding new return 'buf' argument to struct bpf_bprintf_data and making
bpf_bprintf_prepare to return also the buffer for printk helpers.
[1] https://lore.kernel.org/bpf/CACkBjsakT_yWxnSWr4r-0TpPvbKm9-OBmVUhJb7hV3hY8fdCkw@mail.gmail.com/
[2] https://lore.kernel.org/bpf/CACkBjsaCsTovQHFfkqJKto6S4Z8d02ud1D7MPESrHa1cVNNTrw@mail.gmail.com/
Reported-by: Hao Sun <sunhao.th@gmail.com>
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20221215214430.1336195-4-jolsa@kernel.org
[cascardo: there is no bpf_trace_vprintk in 5.15]
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/bpf.h | 3 +++
kernel/bpf/helpers.c | 31 +++++++++++++++++++------------
kernel/trace/bpf_trace.c | 11 +++--------
3 files changed, 25 insertions(+), 20 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index d18f717b6e7e..ef8fc639a575 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -2287,10 +2287,13 @@ struct btf_id_set;
bool btf_id_set_contains(const struct btf_id_set *set, u32 id);
#define MAX_BPRINTF_VARARGS 12
+#define MAX_BPRINTF_BUF 1024
struct bpf_bprintf_data {
u32 *bin_args;
+ char *buf;
bool get_bin_args;
+ bool get_buf;
};
int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index cfa23c7112ed..c8827d1ff3c5 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -710,19 +710,20 @@ static int bpf_trace_copy_string(char *buf, void *unsafe_ptr, char fmt_ptype,
/* Per-cpu temp buffers used by printf-like helpers to store the bprintf binary
* arguments representation.
*/
-#define MAX_BPRINTF_BUF_LEN 512
+#define MAX_BPRINTF_BIN_ARGS 512
/* Support executing three nested bprintf helper calls on a given CPU */
#define MAX_BPRINTF_NEST_LEVEL 3
struct bpf_bprintf_buffers {
- char tmp_bufs[MAX_BPRINTF_NEST_LEVEL][MAX_BPRINTF_BUF_LEN];
+ char bin_args[MAX_BPRINTF_BIN_ARGS];
+ char buf[MAX_BPRINTF_BUF];
};
-static DEFINE_PER_CPU(struct bpf_bprintf_buffers, bpf_bprintf_bufs);
+
+static DEFINE_PER_CPU(struct bpf_bprintf_buffers[MAX_BPRINTF_NEST_LEVEL], bpf_bprintf_bufs);
static DEFINE_PER_CPU(int, bpf_bprintf_nest_level);
-static int try_get_fmt_tmp_buf(char **tmp_buf)
+static int try_get_buffers(struct bpf_bprintf_buffers **bufs)
{
- struct bpf_bprintf_buffers *bufs;
int nest_level;
preempt_disable();
@@ -732,15 +733,14 @@ static int try_get_fmt_tmp_buf(char **tmp_buf)
preempt_enable();
return -EBUSY;
}
- bufs = this_cpu_ptr(&bpf_bprintf_bufs);
- *tmp_buf = bufs->tmp_bufs[nest_level - 1];
+ *bufs = this_cpu_ptr(&bpf_bprintf_bufs[nest_level - 1]);
return 0;
}
void bpf_bprintf_cleanup(struct bpf_bprintf_data *data)
{
- if (!data->bin_args)
+ if (!data->bin_args && !data->buf)
return;
if (WARN_ON_ONCE(this_cpu_read(bpf_bprintf_nest_level) == 0))
return;
@@ -765,7 +765,9 @@ void bpf_bprintf_cleanup(struct bpf_bprintf_data *data)
int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,
u32 num_args, struct bpf_bprintf_data *data)
{
+ bool get_buffers = (data->get_bin_args && num_args) || data->get_buf;
char *unsafe_ptr = NULL, *tmp_buf = NULL, *tmp_buf_end, *fmt_end;
+ struct bpf_bprintf_buffers *buffers = NULL;
size_t sizeof_cur_arg, sizeof_cur_ip;
int err, i, num_spec = 0;
u64 cur_arg;
@@ -776,14 +778,19 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,
return -EINVAL;
fmt_size = fmt_end - fmt;
- if (data->get_bin_args) {
- if (num_args && try_get_fmt_tmp_buf(&tmp_buf))
- return -EBUSY;
+ if (get_buffers && try_get_buffers(&buffers))
+ return -EBUSY;
- tmp_buf_end = tmp_buf + MAX_BPRINTF_BUF_LEN;
+ if (data->get_bin_args) {
+ if (num_args)
+ tmp_buf = buffers->bin_args;
+ tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;
data->bin_args = (u32 *)tmp_buf;
}
+ if (data->get_buf)
+ data->buf = buffers->buf;
+
for (i = 0; i < fmt_size; i++) {
if ((!isprint(fmt[i]) && !isspace(fmt[i])) || !isascii(fmt[i])) {
err = -EINVAL;
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 2bc85a87f020..a1dc0ff1962e 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -360,8 +360,6 @@ static const struct bpf_func_proto *bpf_get_probe_write_proto(void)
return &bpf_probe_write_user_proto;
}
-static DEFINE_RAW_SPINLOCK(trace_printk_lock);
-
#define MAX_TRACE_PRINTK_VARARGS 3
#define BPF_TRACE_PRINTK_SIZE 1024
@@ -371,9 +369,8 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
u64 args[MAX_TRACE_PRINTK_VARARGS] = { arg1, arg2, arg3 };
struct bpf_bprintf_data data = {
.get_bin_args = true,
+ .get_buf = true,
};
- static char buf[BPF_TRACE_PRINTK_SIZE];
- unsigned long flags;
int ret;
ret = bpf_bprintf_prepare(fmt, fmt_size, args,
@@ -381,11 +378,9 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
if (ret < 0)
return ret;
- raw_spin_lock_irqsave(&trace_printk_lock, flags);
- ret = bstr_printf(buf, sizeof(buf), fmt, data.bin_args);
+ ret = bstr_printf(data.buf, MAX_BPRINTF_BUF, fmt, data.bin_args);
- trace_bpf_trace_printk(buf);
- raw_spin_unlock_irqrestore(&trace_printk_lock, flags);
+ trace_bpf_trace_printk(data.buf);
bpf_bprintf_cleanup(&data);
--
2.34.1
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 013/245] userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 012/245] bpf: Remove trace_printk_lock Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 014/245] zonefs: Improve error handling Greg Kroah-Hartman
` (242 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lokesh Gidra, Andrea Arcangeli,
Mike Rapoport, Axel Rasmussen, Brian Geffon, David Hildenbrand,
Jann Horn, Kalesh Singh, Matthew Wilcox (Oracle),
Nicolas Geoffray, Peter Xu, Suren Baghdasaryan, Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lokesh Gidra <lokeshgidra@google.com>
commit 67695f18d55924b2013534ef3bdc363bc9e14605 upstream.
In mfill_atomic_hugetlb(), mmap_changing isn't being checked
again if we drop mmap_lock and reacquire it. When the lock is not held,
mmap_changing could have been incremented. This is also inconsistent
with the behavior in mfill_atomic().
Link: https://lkml.kernel.org/r/20240117223729.1444522-1-lokeshgidra@google.com
Fixes: df2cc96e77011 ("userfaultfd: prevent non-cooperative events vs mcopy_atomic races")
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Nicolas Geoffray <ngeoffray@google.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/userfaultfd.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -289,6 +289,7 @@ static __always_inline ssize_t __mcopy_a
unsigned long dst_start,
unsigned long src_start,
unsigned long len,
+ atomic_t *mmap_changing,
enum mcopy_atomic_mode mode)
{
int vm_shared = dst_vma->vm_flags & VM_SHARED;
@@ -405,6 +406,15 @@ retry:
goto out;
}
mmap_read_lock(dst_mm);
+ /*
+ * If memory mappings are changing because of non-cooperative
+ * operation (e.g. mremap) running in parallel, bail out and
+ * request the user to retry later
+ */
+ if (mmap_changing && atomic_read(mmap_changing)) {
+ err = -EAGAIN;
+ break;
+ }
dst_vma = NULL;
goto retry;
@@ -440,6 +450,7 @@ extern ssize_t __mcopy_atomic_hugetlb(st
unsigned long dst_start,
unsigned long src_start,
unsigned long len,
+ atomic_t *mmap_changing,
enum mcopy_atomic_mode mode);
#endif /* CONFIG_HUGETLB_PAGE */
@@ -561,7 +572,8 @@ retry:
*/
if (is_vm_hugetlb_page(dst_vma))
return __mcopy_atomic_hugetlb(dst_mm, dst_vma, dst_start,
- src_start, len, mcopy_mode);
+ src_start, len, mmap_changing,
+ mcopy_mode);
if (!vma_is_anonymous(dst_vma) && !vma_is_shmem(dst_vma))
goto out_unlock;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 014/245] zonefs: Improve error handling
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 013/245] userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 015/245] x86/fpu: Stop relying on userspace for info to fault in xsave buffer Greg Kroah-Hartman
` (241 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinichiro Kawasaki, Damien Le Moal,
Johannes Thumshirn, Himanshu Madhani
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
commit 14db5f64a971fce3d8ea35de4dfc7f443a3efb92 upstream.
Write error handling is racy and can sometime lead to the error recovery
path wrongly changing the inode size of a sequential zone file to an
incorrect value which results in garbage data being readable at the end
of a file. There are 2 problems:
1) zonefs_file_dio_write() updates a zone file write pointer offset
after issuing a direct IO with iomap_dio_rw(). This update is done
only if the IO succeed for synchronous direct writes. However, for
asynchronous direct writes, the update is done without waiting for
the IO completion so that the next asynchronous IO can be
immediately issued. However, if an asynchronous IO completes with a
failure right before the i_truncate_mutex lock protecting the update,
the update may change the value of the inode write pointer offset
that was corrected by the error path (zonefs_io_error() function).
2) zonefs_io_error() is called when a read or write error occurs. This
function executes a report zone operation using the callback function
zonefs_io_error_cb(), which does all the error recovery handling
based on the current zone condition, write pointer position and
according to the mount options being used. However, depending on the
zoned device being used, a report zone callback may be executed in a
context that is different from the context of __zonefs_io_error(). As
a result, zonefs_io_error_cb() may be executed without the inode
truncate mutex lock held, which can lead to invalid error processing.
Fix both problems as follows:
- Problem 1: Perform the inode write pointer offset update before a
direct write is issued with iomap_dio_rw(). This is safe to do as
partial direct writes are not supported (IOMAP_DIO_PARTIAL is not
set) and any failed IO will trigger the execution of zonefs_io_error()
which will correct the inode write pointer offset to reflect the
current state of the one on the device.
- Problem 2: Change zonefs_io_error_cb() into zonefs_handle_io_error()
and call this function directly from __zonefs_io_error() after
obtaining the zone information using blkdev_report_zones() with a
simple callback function that copies to a local stack variable the
struct blk_zone obtained from the device. This ensures that error
handling is performed holding the inode truncate mutex.
This change also simplifies error handling for conventional zone files
by bypassing the execution of report zones entirely. This is safe to
do because the condition of conventional zones cannot be read-only or
offline and conventional zone files are always fully mapped with a
constant file size.
Reported-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Fixes: 8dcc1a9d90c1 ("fs: New zonefs file system")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/zonefs/super.c | 70 ++++++++++++++++++++++++++++++------------------------
1 file changed, 40 insertions(+), 30 deletions(-)
--- a/fs/zonefs/super.c
+++ b/fs/zonefs/super.c
@@ -327,16 +327,18 @@ static loff_t zonefs_check_zone_conditio
}
}
-struct zonefs_ioerr_data {
- struct inode *inode;
- bool write;
-};
-
static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx,
void *data)
{
- struct zonefs_ioerr_data *err = data;
- struct inode *inode = err->inode;
+ struct blk_zone *z = data;
+
+ *z = *zone;
+ return 0;
+}
+
+static void zonefs_handle_io_error(struct inode *inode, struct blk_zone *zone,
+ bool write)
+{
struct zonefs_inode_info *zi = ZONEFS_I(inode);
struct super_block *sb = inode->i_sb;
struct zonefs_sb_info *sbi = ZONEFS_SB(sb);
@@ -352,8 +354,8 @@ static int zonefs_io_error_cb(struct blk
isize = i_size_read(inode);
if (zone->cond != BLK_ZONE_COND_OFFLINE &&
zone->cond != BLK_ZONE_COND_READONLY &&
- !err->write && isize == data_size)
- return 0;
+ !write && isize == data_size)
+ return;
/*
* At this point, we detected either a bad zone or an inconsistency
@@ -374,8 +376,9 @@ static int zonefs_io_error_cb(struct blk
* In all cases, warn about inode size inconsistency and handle the
* IO error according to the zone condition and to the mount options.
*/
- if (zi->i_ztype == ZONEFS_ZTYPE_SEQ && isize != data_size)
- zonefs_warn(sb, "inode %lu: invalid size %lld (should be %lld)\n",
+ if (isize != data_size)
+ zonefs_warn(sb,
+ "inode %lu: invalid size %lld (should be %lld)\n",
inode->i_ino, isize, data_size);
/*
@@ -435,8 +438,6 @@ static int zonefs_io_error_cb(struct blk
zonefs_update_stats(inode, data_size);
zonefs_i_size_write(inode, data_size);
zi->i_wpoffset = data_size;
-
- return 0;
}
/*
@@ -450,23 +451,25 @@ static void __zonefs_io_error(struct ino
{
struct zonefs_inode_info *zi = ZONEFS_I(inode);
struct super_block *sb = inode->i_sb;
- struct zonefs_sb_info *sbi = ZONEFS_SB(sb);
unsigned int noio_flag;
- unsigned int nr_zones = 1;
- struct zonefs_ioerr_data err = {
- .inode = inode,
- .write = write,
- };
+ struct blk_zone zone;
int ret;
/*
- * The only files that have more than one zone are conventional zone
- * files with aggregated conventional zones, for which the inode zone
- * size is always larger than the device zone size.
- */
- if (zi->i_zone_size > bdev_zone_sectors(sb->s_bdev))
- nr_zones = zi->i_zone_size >>
- (sbi->s_zone_sectors_shift + SECTOR_SHIFT);
+ * Conventional zone have no write pointer and cannot become read-only
+ * or offline. So simply fake a report for a single or aggregated zone
+ * and let zonefs_handle_io_error() correct the zone inode information
+ * according to the mount options.
+ */
+ if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) {
+ zone.start = zi->i_zsector;
+ zone.len = zi->i_max_size >> SECTOR_SHIFT;
+ zone.wp = zone.start + zone.len;
+ zone.type = BLK_ZONE_TYPE_CONVENTIONAL;
+ zone.cond = BLK_ZONE_COND_NOT_WP;
+ zone.capacity = zone.len;
+ goto handle_io_error;
+ }
/*
* Memory allocations in blkdev_report_zones() can trigger a memory
@@ -477,12 +480,19 @@ static void __zonefs_io_error(struct ino
* the GFP_NOIO context avoids both problems.
*/
noio_flag = memalloc_noio_save();
- ret = blkdev_report_zones(sb->s_bdev, zi->i_zsector, nr_zones,
- zonefs_io_error_cb, &err);
- if (ret != nr_zones)
+ ret = blkdev_report_zones(sb->s_bdev, zi->i_zsector, 1,
+ zonefs_io_error_cb, &zone);
+ memalloc_noio_restore(noio_flag);
+ if (ret != 1) {
zonefs_err(sb, "Get inode %lu zone information failed %d\n",
inode->i_ino, ret);
- memalloc_noio_restore(noio_flag);
+ zonefs_warn(sb, "remounting filesystem read-only\n");
+ sb->s_flags |= SB_RDONLY;
+ return;
+ }
+
+handle_io_error:
+ zonefs_handle_io_error(inode, &zone, write);
}
static void zonefs_io_error(struct inode *inode, bool write)
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 015/245] x86/fpu: Stop relying on userspace for info to fault in xsave buffer
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 014/245] zonefs: Improve error handling Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 016/245] sched/rt: Fix sysctl_sched_rr_timeslice intial value Greg Kroah-Hartman
` (240 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Bogomolov,
Thomas Gleixner, Andrei Vagin, Dave Hansen
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Vagin <avagin@google.com>
commit d877550eaf2dc9090d782864c96939397a3c6835 upstream.
Before this change, the expected size of the user space buffer was
taken from fx_sw->xstate_size. fx_sw->xstate_size can be changed
from user-space, so it is possible construct a sigreturn frame where:
* fx_sw->xstate_size is smaller than the size required by valid bits in
fx_sw->xfeatures.
* user-space unmaps parts of the sigrame fpu buffer so that not all of
the buffer required by xrstor is accessible.
In this case, xrstor tries to restore and accesses the unmapped area
which results in a fault. But fault_in_readable succeeds because buf +
fx_sw->xstate_size is within the still mapped area, so it goes back and
tries xrstor again. It will spin in this loop forever.
Instead, fault in the maximum size which can be touched by XRSTOR (taken
from fpstate->user_size).
[ dhansen: tweak subject / changelog ]
Fixes: fcb3635f5018 ("x86/fpu/signal: Handle #PF in the direct restore path")
Reported-by: Konstantin Bogomolov <bogomolov@google.com>
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrei Vagin <avagin@google.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc:stable@vger.kernel.org
Link: https://lore.kernel.org/all/20240130063603.3392627-1-avagin%40google.com
Link: https://lore.kernel.org/all/20240130063603.3392627-1-avagin%40google.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/fpu/signal.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c
@@ -246,12 +246,13 @@ static int __restore_fpregs_from_user(vo
* Attempt to restore the FPU registers directly from user memory.
* Pagefaults are handled and any errors returned are fatal.
*/
-static int restore_fpregs_from_user(void __user *buf, u64 xrestore,
- bool fx_only, unsigned int size)
+static int restore_fpregs_from_user(void __user *buf, u64 xrestore, bool fx_only)
{
struct fpu *fpu = ¤t->thread.fpu;
int ret;
+ /* Restore enabled features only. */
+ xrestore &= xfeatures_mask_all & XFEATURE_MASK_USER_SUPPORTED;
retry:
fpregs_lock();
pagefault_disable();
@@ -278,7 +279,7 @@ retry:
if (ret != -EFAULT)
return -EINVAL;
- if (!fault_in_readable(buf, size))
+ if (!fault_in_readable(buf, fpu_user_xstate_size))
goto retry;
return -EFAULT;
}
@@ -303,7 +304,6 @@ retry:
static int __fpu_restore_sig(void __user *buf, void __user *buf_fx,
bool ia32_fxstate)
{
- int state_size = fpu_kernel_xstate_size;
struct task_struct *tsk = current;
struct fpu *fpu = &tsk->thread.fpu;
struct user_i387_ia32_struct env;
@@ -319,7 +319,6 @@ static int __fpu_restore_sig(void __user
return ret;
fx_only = !fx_sw_user.magic1;
- state_size = fx_sw_user.xstate_size;
user_xfeatures = fx_sw_user.xfeatures;
} else {
user_xfeatures = XFEATURE_MASK_FPSSE;
@@ -332,8 +331,7 @@ static int __fpu_restore_sig(void __user
* faults. If it does, fall back to the slow path below, going
* through the kernel buffer with the enabled pagefault handler.
*/
- return restore_fpregs_from_user(buf_fx, user_xfeatures, fx_only,
- state_size);
+ return restore_fpregs_from_user(buf_fx, user_xfeatures, fx_only);
}
/*
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 016/245] sched/rt: Fix sysctl_sched_rr_timeslice intial value
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 015/245] x86/fpu: Stop relying on userspace for info to fault in xsave buffer Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 017/245] sched/rt: Disallow writing invalid values to sched_rt_period_us Greg Kroah-Hartman
` (239 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cyril Hrubis, Peter Zijlstra (Intel),
Petr Vorel, Mel Gorman
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyril Hrubis <chrubis@suse.cz>
commit c7fcb99877f9f542c918509b2801065adcaf46fa upstream.
There is a 10% rounding error in the intial value of the
sysctl_sched_rr_timeslice with CONFIG_HZ_300=y.
This was found with LTP test sched_rr_get_interval01:
sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed
sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns
sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90
sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed
sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns
sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90
What this test does is to compare the return value from the
sched_rr_get_interval() and the sched_rr_timeslice_ms sysctl file and
fails if they do not match.
The problem it found is the intial sysctl file value which was computed as:
static int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE;
which works fine as long as MSEC_PER_SEC is multiple of HZ, however it
introduces 10% rounding error for CONFIG_HZ_300:
(MSEC_PER_SEC / HZ) * (100 * HZ / 1000)
(1000 / 300) * (100 * 300 / 1000)
3 * 30 = 90
This can be easily fixed by reversing the order of the multiplication
and division. After this fix we get:
(MSEC_PER_SEC * (100 * HZ / 1000)) / HZ
(1000 * (100 * 300 / 1000)) / 300
(1000 * 30) / 300 = 100
Fixes: 975e155ed873 ("sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in milliseconds")
Signed-off-by: Cyril Hrubis <chrubis@suse.cz>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Petr Vorel <pvorel@suse.cz>
Acked-by: Mel Gorman <mgorman@suse.de>
Tested-by: Petr Vorel <pvorel@suse.cz>
Link: https://lore.kernel.org/r/20230802151906.25258-2-chrubis@suse.cz
[ pvorel: rebased for 5.15, 5.10 ]
Signed-off-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/rt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -8,7 +8,7 @@
#include "pelt.h"
int sched_rr_timeslice = RR_TIMESLICE;
-int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE;
+int sysctl_sched_rr_timeslice = (MSEC_PER_SEC * RR_TIMESLICE) / HZ;
/* More than 4 hours if BW_SHIFT equals 20. */
static const u64 max_rt_runtime = MAX_BW;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 017/245] sched/rt: Disallow writing invalid values to sched_rt_period_us
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 016/245] sched/rt: Fix sysctl_sched_rr_timeslice intial value Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 018/245] scsi: target: core: Add TMF to tmr_list handling Greg Kroah-Hartman
` (238 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cyril Hrubis, Ingo Molnar,
Petr Vorel
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyril Hrubis <chrubis@suse.cz>
commit 079be8fc630943d9fc70a97807feb73d169ee3fc upstream.
The validation of the value written to sched_rt_period_us was broken
because:
- the sysclt_sched_rt_period is declared as unsigned int
- parsed by proc_do_intvec()
- the range is asserted after the value parsed by proc_do_intvec()
Because of this negative values written to the file were written into a
unsigned integer that were later on interpreted as large positive
integers which did passed the check:
if (sysclt_sched_rt_period <= 0)
return EINVAL;
This commit fixes the parsing by setting explicit range for both
perid_us and runtime_us into the sched_rt_sysctls table and processes
the values with proc_dointvec_minmax() instead.
Alternatively if we wanted to use full range of unsigned int for the
period value we would have to split the proc_handler and use
proc_douintvec() for it however even the
Documentation/scheduller/sched-rt-group.rst describes the range as 1 to
INT_MAX.
As far as I can tell the only problem this causes is that the sysctl
file allows writing negative values which when read back may confuse
userspace.
There is also a LTP test being submitted for these sysctl files at:
http://patchwork.ozlabs.org/project/ltp/patch/20230901144433.2526-1-chrubis@suse.cz/
Signed-off-by: Cyril Hrubis <chrubis@suse.cz>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20231002115553.3007-2-chrubis@suse.cz
[ pvorel: rebased for 5.15, 5.10 ]
Reviewed-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/rt.c | 5 +----
kernel/sysctl.c | 4 ++++
2 files changed, 5 insertions(+), 4 deletions(-)
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -2806,9 +2806,6 @@ static int sched_rt_global_constraints(v
static int sched_rt_global_validate(void)
{
- if (sysctl_sched_rt_period <= 0)
- return -EINVAL;
-
if ((sysctl_sched_rt_runtime != RUNTIME_INF) &&
((sysctl_sched_rt_runtime > sysctl_sched_rt_period) ||
((u64)sysctl_sched_rt_runtime *
@@ -2839,7 +2836,7 @@ int sched_rt_handler(struct ctl_table *t
old_period = sysctl_sched_rt_period;
old_runtime = sysctl_sched_rt_runtime;
- ret = proc_dointvec(table, write, buffer, lenp, ppos);
+ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
if (!ret && write) {
ret = sched_rt_global_validate();
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1821,6 +1821,8 @@ static struct ctl_table kern_table[] = {
.maxlen = sizeof(unsigned int),
.mode = 0644,
.proc_handler = sched_rt_handler,
+ .extra1 = SYSCTL_ONE,
+ .extra2 = SYSCTL_INT_MAX,
},
{
.procname = "sched_rt_runtime_us",
@@ -1828,6 +1830,8 @@ static struct ctl_table kern_table[] = {
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = sched_rt_handler,
+ .extra1 = SYSCTL_NEG_ONE,
+ .extra2 = SYSCTL_INT_MAX,
},
{
.procname = "sched_deadline_period_max_us",
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 018/245] scsi: target: core: Add TMF to tmr_list handling
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 017/245] sched/rt: Disallow writing invalid values to sched_rt_period_us Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 019/245] dmaengine: shdma: increase size of dev_id Greg Kroah-Hartman
` (237 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Bogdanov, Mike Christie,
Martin K. Petersen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Bogdanov <d.bogdanov@yadro.com>
[ Upstream commit 83ab68168a3d990d5ff39ab030ad5754cbbccb25 ]
An abort that is responded to by iSCSI itself is added to tmr_list but does
not go to target core. A LUN_RESET that goes through tmr_list takes a
refcounter on the abort and waits for completion. However, the abort will
be never complete because it was not started in target core.
Unable to locate ITT: 0x05000000 on CID: 0
Unable to locate RefTaskTag: 0x05000000 on CID: 0.
wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop
wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop
...
INFO: task kworker/0:2:49 blocked for more than 491 seconds.
task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800
Workqueue: events target_tmr_work [target_core_mod]
Call Trace:
__switch_to+0x2c4/0x470
_schedule+0x314/0x1730
schedule+0x64/0x130
schedule_timeout+0x168/0x430
wait_for_completion+0x140/0x270
target_put_cmd_and_wait+0x64/0xb0 [target_core_mod]
core_tmr_lun_reset+0x30/0xa0 [target_core_mod]
target_tmr_work+0xc8/0x1b0 [target_core_mod]
process_one_work+0x2d4/0x5d0
worker_thread+0x78/0x6c0
To fix this, only add abort to tmr_list if it will be handled by target
core.
Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Link: https://lore.kernel.org/r/20240111125941.8688-1-d.bogdanov@yadro.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/target_core_device.c | 5 -----
drivers/target/target_core_transport.c | 4 ++++
2 files changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 813de805f815a..d4185c1bed8a8 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -147,7 +147,6 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd)
struct se_session *se_sess = se_cmd->se_sess;
struct se_node_acl *nacl = se_sess->se_node_acl;
struct se_tmr_req *se_tmr = se_cmd->se_tmr_req;
- unsigned long flags;
rcu_read_lock();
deve = target_nacl_find_deve(nacl, se_cmd->orig_fe_lun);
@@ -178,10 +177,6 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd)
se_cmd->se_dev = rcu_dereference_raw(se_lun->lun_se_dev);
se_tmr->tmr_dev = rcu_dereference_raw(se_lun->lun_se_dev);
- spin_lock_irqsave(&se_tmr->tmr_dev->se_tmr_lock, flags);
- list_add_tail(&se_tmr->tmr_list, &se_tmr->tmr_dev->dev_tmr_list);
- spin_unlock_irqrestore(&se_tmr->tmr_dev->se_tmr_lock, flags);
-
return 0;
}
EXPORT_SYMBOL(transport_lookup_tmr_lun);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 72edf5bd75ee6..ac2d0e7d58ab7 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -3568,6 +3568,10 @@ int transport_generic_handle_tmr(
unsigned long flags;
bool aborted = false;
+ spin_lock_irqsave(&cmd->se_dev->se_tmr_lock, flags);
+ list_add_tail(&cmd->se_tmr_req->tmr_list, &cmd->se_dev->dev_tmr_list);
+ spin_unlock_irqrestore(&cmd->se_dev->se_tmr_lock, flags);
+
spin_lock_irqsave(&cmd->t_state_lock, flags);
if (cmd->transport_state & CMD_T_ABORTED) {
aborted = true;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 019/245] dmaengine: shdma: increase size of dev_id
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 018/245] scsi: target: core: Add TMF to tmr_list handling Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 020/245] dmaengine: fsl-qdma: increase size of irq_name Greg Kroah-Hartman
` (236 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vinod Koul, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <vkoul@kernel.org>
[ Upstream commit 404290240827c3bb5c4e195174a8854eef2f89ac ]
We seem to have hit warnings of 'output may be truncated' which is fixed
by increasing the size of 'dev_id'
drivers/dma/sh/shdmac.c: In function ‘sh_dmae_probe’:
drivers/dma/sh/shdmac.c:541:34: error: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size 9 [-Werror=format-truncation=]
541 | "sh-dmae%d.%d", pdev->id, id);
| ^~
In function ‘sh_dmae_chan_probe’,
inlined from ‘sh_dmae_probe’ at drivers/dma/sh/shdmac.c:845:9:
drivers/dma/sh/shdmac.c:541:26: note: directive argument in the range [0, 2147483647]
541 | "sh-dmae%d.%d", pdev->id, id);
| ^~~~~~~~~~~~~~
drivers/dma/sh/shdmac.c:541:26: note: directive argument in the range [0, 19]
drivers/dma/sh/shdmac.c:540:17: note: ‘snprintf’ output between 11 and 21 bytes into a destination of size 16
540 | snprintf(sh_chan->dev_id, sizeof(sh_chan->dev_id),
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
541 | "sh-dmae%d.%d", pdev->id, id);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/sh/shdma.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/sh/shdma.h b/drivers/dma/sh/shdma.h
index 9c121a4b33ad8..f97d80343aea4 100644
--- a/drivers/dma/sh/shdma.h
+++ b/drivers/dma/sh/shdma.h
@@ -25,7 +25,7 @@ struct sh_dmae_chan {
const struct sh_dmae_slave_config *config; /* Slave DMA configuration */
int xmit_shift; /* log_2(bytes_per_xfer) */
void __iomem *base;
- char dev_id[16]; /* unique name per DMAC of channel */
+ char dev_id[32]; /* unique name per DMAC of channel */
int pm_error;
dma_addr_t slave_addr;
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 020/245] dmaengine: fsl-qdma: increase size of irq_name
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 019/245] dmaengine: shdma: increase size of dev_id Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 021/245] wifi: cfg80211: fix missing interfaces when dumping Greg Kroah-Hartman
` (235 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vinod Koul, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <vkoul@kernel.org>
[ Upstream commit 6386f6c995b3ab91c72cfb76e4465553c555a8da ]
We seem to have hit warnings of 'output may be truncated' which is fixed
by increasing the size of 'irq_name'
drivers/dma/fsl-qdma.c: In function ‘fsl_qdma_irq_init’:
drivers/dma/fsl-qdma.c:824:46: error: ‘%d’ directive writing between 1 and 11 bytes into a region of size 10 [-Werror=format-overflow=]
824 | sprintf(irq_name, "qdma-queue%d", i);
| ^~
drivers/dma/fsl-qdma.c:824:35: note: directive argument in the range [-2147483641, 2147483646]
824 | sprintf(irq_name, "qdma-queue%d", i);
| ^~~~~~~~~~~~~~
drivers/dma/fsl-qdma.c:824:17: note: ‘sprintf’ output between 12 and 22 bytes into a destination of size 20
824 | sprintf(irq_name, "qdma-queue%d", i);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/fsl-qdma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c
index 69385f32e2756..f383f219ed008 100644
--- a/drivers/dma/fsl-qdma.c
+++ b/drivers/dma/fsl-qdma.c
@@ -805,7 +805,7 @@ fsl_qdma_irq_init(struct platform_device *pdev,
int i;
int cpu;
int ret;
- char irq_name[20];
+ char irq_name[32];
fsl_qdma->error_irq =
platform_get_irq_byname(pdev, "qdma-error");
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 021/245] wifi: cfg80211: fix missing interfaces when dumping
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 020/245] dmaengine: fsl-qdma: increase size of irq_name Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 022/245] wifi: mac80211: fix race condition on enabling fast-xmit Greg Kroah-Hartman
` (234 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Kazior, Johannes Berg,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kazior <michal@plume.com>
[ Upstream commit a6e4f85d3820d00694ed10f581f4c650445dbcda ]
The nl80211_dump_interface() supports resumption
in case nl80211_send_iface() doesn't have the
resources to complete its work.
The logic would store the progress as iteration
offsets for rdev and wdev loops.
However the logic did not properly handle
resumption for non-last rdev. Assuming a system
with 2 rdevs, with 2 wdevs each, this could
happen:
dump(cb=[0, 0]):
if_start=cb[1] (=0)
send rdev0.wdev0 -> ok
send rdev0.wdev1 -> yield
cb[1] = 1
dump(cb=[0, 1]):
if_start=cb[1] (=1)
send rdev0.wdev1 -> ok
// since if_start=1 the rdev0.wdev0 got skipped
// through if_idx < if_start
send rdev1.wdev1 -> ok
The if_start needs to be reset back to 0 upon wdev
loop end.
The problem is actually hard to hit on a desktop,
and even on most routers. The prerequisites for
this manifesting was:
- more than 1 wiphy
- a few handful of interfaces
- dump without rdev or wdev filter
I was seeing this with 4 wiphys 9 interfaces each.
It'd miss 6 interfaces from the last wiphy
reported to userspace.
Signed-off-by: Michal Kazior <michal@plume.com>
Link: https://msgid.link/20240116142340.89678-1-kazikcz@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/nl80211.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 82b93380afec4..4a8b701440ebd 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3737,6 +3737,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
if_idx++;
}
+ if_start = 0;
wp_idx++;
}
out:
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 022/245] wifi: mac80211: fix race condition on enabling fast-xmit
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 021/245] wifi: cfg80211: fix missing interfaces when dumping Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 023/245] fbdev: savage: Error out if pixclock equals zero Greg Kroah-Hartman
` (233 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Johannes Berg,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit bcbc84af1183c8cf3d1ca9b78540c2185cd85e7f ]
fast-xmit must only be enabled after the sta has been uploaded to the driver,
otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls
to the driver, leading to potential crashes because of uninitialized drv_priv
data.
Add a missing sta->uploaded check and re-check fast xmit after inserting a sta.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://msgid.link/20240104181059.84032-1-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/sta_info.c | 2 ++
net/mac80211/tx.c | 2 +-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index e10bcfa20526d..f4deee1926e58 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -696,6 +696,8 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
if (ieee80211_vif_is_mesh(&sdata->vif))
mesh_accept_plinks_update(sdata);
+ ieee80211_check_fast_xmit(sta);
+
return 0;
out_remove:
sta_info_hash_del(local, sta);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 481b6b34797da..c4e6fbe4343ee 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2965,7 +2965,7 @@ void ieee80211_check_fast_xmit(struct sta_info *sta)
sdata->vif.type == NL80211_IFTYPE_STATION)
goto out;
- if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
+ if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED) || !sta->uploaded)
goto out;
if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 023/245] fbdev: savage: Error out if pixclock equals zero
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 022/245] wifi: mac80211: fix race condition on enabling fast-xmit Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 024/245] fbdev: sis: " Greg Kroah-Hartman
` (232 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fullway Wang, Helge Deller,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fullway Wang <fullwaywang@outlook.com>
[ Upstream commit 04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288 ]
The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of pixclock,
it may cause divide-by-zero error.
Although pixclock is checked in savagefb_decode_var(), but it is not
checked properly in savagefb_probe(). Fix this by checking whether
pixclock is zero in the function savagefb_check_var() before
info->var.pixclock is used as the divisor.
This is similar to CVE-2022-3061 in i740fb which was fixed by
commit 15cf0b8.
Signed-off-by: Fullway Wang <fullwaywang@outlook.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/savage/savagefb_driver.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c
index 0ac750cc5ea13..94ebd8af50cf7 100644
--- a/drivers/video/fbdev/savage/savagefb_driver.c
+++ b/drivers/video/fbdev/savage/savagefb_driver.c
@@ -868,6 +868,9 @@ static int savagefb_check_var(struct fb_var_screeninfo *var,
DBG("savagefb_check_var");
+ if (!var->pixclock)
+ return -EINVAL;
+
var->transp.offset = 0;
var->transp.length = 0;
switch (var->bits_per_pixel) {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 024/245] fbdev: sis: Error out if pixclock equals zero
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 023/245] fbdev: savage: Error out if pixclock equals zero Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 025/245] spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected Greg Kroah-Hartman
` (231 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fullway Wang, Helge Deller,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fullway Wang <fullwaywang@outlook.com>
[ Upstream commit e421946be7d9bf545147bea8419ef8239cb7ca52 ]
The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of pixclock,
it may cause divide-by-zero error.
In sisfb_check_var(), var->pixclock is used as a divisor to caculate
drate before it is checked against zero. Fix this by checking it
at the beginning.
This is similar to CVE-2022-3061 in i740fb which was fixed by
commit 15cf0b8.
Signed-off-by: Fullway Wang <fullwaywang@outlook.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/sis/sis_main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/video/fbdev/sis/sis_main.c b/drivers/video/fbdev/sis/sis_main.c
index 266a5582f94d3..c6e21ba008953 100644
--- a/drivers/video/fbdev/sis/sis_main.c
+++ b/drivers/video/fbdev/sis/sis_main.c
@@ -1474,6 +1474,8 @@ sisfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
vtotal = var->upper_margin + var->lower_margin + var->vsync_len;
+ if (!var->pixclock)
+ return -EINVAL;
pixclock = var->pixclock;
if((var->vmode & FB_VMODE_MASK) == FB_VMODE_NONINTERLACED) {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 025/245] spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 024/245] fbdev: sis: " Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 026/245] ahci: asm1166: correct count of reported ports Greg Kroah-Hartman
` (230 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Devyn Liu, Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devyn Liu <liudingyuan@huawei.com>
[ Upstream commit de8b6e1c231a95abf95ad097b993d34b31458ec9 ]
Return IRQ_NONE from the interrupt handler when no interrupt was
detected. Because an empty interrupt will cause a null pointer error:
Unable to handle kernel NULL pointer dereference at virtual
address 0000000000000008
Call trace:
complete+0x54/0x100
hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx]
__handle_irq_event_percpu+0x64/0x1e0
handle_irq_event+0x7c/0x1cc
Signed-off-by: Devyn Liu <liudingyuan@huawei.com>
Link: https://msgid.link/r/20240123071149.917678-1-liudingyuan@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-hisi-sfc-v3xx.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/spi/spi-hisi-sfc-v3xx.c b/drivers/spi/spi-hisi-sfc-v3xx.c
index d3a23b1c2a4c5..61bf00dfe9c33 100644
--- a/drivers/spi/spi-hisi-sfc-v3xx.c
+++ b/drivers/spi/spi-hisi-sfc-v3xx.c
@@ -377,6 +377,11 @@ static const struct spi_controller_mem_ops hisi_sfc_v3xx_mem_ops = {
static irqreturn_t hisi_sfc_v3xx_isr(int irq, void *data)
{
struct hisi_sfc_v3xx_host *host = data;
+ u32 reg;
+
+ reg = readl(host->regbase + HISI_SFC_V3XX_INT_STAT);
+ if (!reg)
+ return IRQ_NONE;
hisi_sfc_v3xx_disable_int(host);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 026/245] ahci: asm1166: correct count of reported ports
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 025/245] spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 027/245] ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers Greg Kroah-Hartman
` (229 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Conrad Kostecki, Hans de Goede,
Niklas Cassel, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Conrad Kostecki <conikost@gentoo.org>
[ Upstream commit 0077a504e1a4468669fd2e011108db49133db56e ]
The ASM1166 SATA host controller always reports wrongly,
that it has 32 ports. But in reality, it only has six ports.
This seems to be a hardware issue, as all tested ASM1166
SATA host controllers reports such high count of ports.
Example output: ahci 0000:09:00.0: AHCI 0001.0301
32 slots 32 ports 6 Gbps 0xffffff3f impl SATA mode.
By adjusting the port_map, the count is limited to six ports.
New output: ahci 0000:09:00.0: AHCI 0001.0301
32 slots 32 ports 6 Gbps 0x3f impl SATA mode.
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=211873
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218346
Signed-off-by: Conrad Kostecki <conikost@gentoo.org>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/ahci.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 3147b2e6cd8c9..56fcb1dec6af8 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -658,6 +658,11 @@ MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets");
static void ahci_pci_save_initial_config(struct pci_dev *pdev,
struct ahci_host_priv *hpriv)
{
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && pdev->device == 0x1166) {
+ dev_info(&pdev->dev, "ASM1166 has only six ports\n");
+ hpriv->saved_port_map = 0x3f;
+ }
+
if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) {
dev_info(&pdev->dev, "JMB361 has only one port\n");
hpriv->force_port_map = 1;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 027/245] ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 026/245] ahci: asm1166: correct count of reported ports Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 028/245] MIPS: reserve exception vector space ONLY ONCE Greg Kroah-Hartman
` (228 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lennert Buytenhek, Niklas Cassel,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lennert Buytenhek <kernel@wantstofly.org>
[ Upstream commit 20730e9b277873deeb6637339edcba64468f3da3 ]
With one of the on-board ASM1061 AHCI controllers (1b21:0612) on an
ASUSTeK Pro WS WRX80E-SAGE SE WIFI mainboard, a controller hang was
observed that was immediately preceded by the following kernel
messages:
ahci 0000:28:00.0: Using 64-bit DMA addresses
ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00000 flags=0x0000]
ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00300 flags=0x0000]
ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00380 flags=0x0000]
ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00400 flags=0x0000]
ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00680 flags=0x0000]
ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00700 flags=0x0000]
The first message is produced by code in drivers/iommu/dma-iommu.c
which is accompanied by the following comment that seems to apply:
/*
* Try to use all the 32-bit PCI addresses first. The original SAC vs.
* DAC reasoning loses relevance with PCIe, but enough hardware and
* firmware bugs are still lurking out there that it's safest not to
* venture into the 64-bit space until necessary.
*
* If your device goes wrong after seeing the notice then likely either
* its driver is not setting DMA masks accurately, the hardware has
* some inherent bug in handling >32-bit addresses, or not all the
* expected address bits are wired up between the device and the IOMMU.
*/
Asking the ASM1061 on a discrete PCIe card to DMA from I/O virtual
address 0xffffffff00000000 produces the following I/O page faults:
vfio-pci 0000:07:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0x7ff00000000 flags=0x0010]
vfio-pci 0000:07:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0x7ff00000500 flags=0x0010]
Note that the upper 21 bits of the logged DMA address are zero. (When
asking a different PCIe device in the same PCIe slot to DMA to the
same I/O virtual address, we do see all the upper 32 bits of the DMA
address as 1, so this is not an issue with the chipset or IOMMU
configuration on the test system.)
Also, hacking libahci to always set the upper 21 bits of all DMA
addresses to 1 produces no discernible effect on the behavior of the
ASM1061, and mkfs/mount/scrub/etc work as without this hack.
This all strongly suggests that the ASM1061 has a 43 bit DMA address
limit, and this commit therefore adds a quirk to deal with this limit.
This issue probably applies to (some of) the other supported ASMedia
parts as well, but we limit it to the PCI IDs known to refer to
ASM1061 parts, as that's the only part we know for sure to be affected
by this issue at this point.
Link: https://lore.kernel.org/linux-ide/ZaZ2PIpEId-rl6jv@wantstofly.org/
Signed-off-by: Lennert Buytenhek <kernel@wantstofly.org>
[cassel: drop date from error messages in commit log]
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/ahci.c | 29 +++++++++++++++++++++++------
drivers/ata/ahci.h | 1 +
2 files changed, 24 insertions(+), 6 deletions(-)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 56fcb1dec6af8..b0a8aac008bae 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -49,6 +49,7 @@ enum {
enum board_ids {
/* board IDs by feature in alphabetical order */
board_ahci,
+ board_ahci_43bit_dma,
board_ahci_ign_iferr,
board_ahci_low_power,
board_ahci_no_debounce_delay,
@@ -129,6 +130,13 @@ static const struct ata_port_info ahci_port_info[] = {
.udma_mask = ATA_UDMA6,
.port_ops = &ahci_ops,
},
+ [board_ahci_43bit_dma] = {
+ AHCI_HFLAGS (AHCI_HFLAG_43BIT_ONLY),
+ .flags = AHCI_FLAG_COMMON,
+ .pio_mask = ATA_PIO4,
+ .udma_mask = ATA_UDMA6,
+ .port_ops = &ahci_ops,
+ },
[board_ahci_ign_iferr] = {
AHCI_HFLAGS (AHCI_HFLAG_IGN_IRQ_IF_ERR),
.flags = AHCI_FLAG_COMMON,
@@ -598,11 +606,11 @@ static const struct pci_device_id ahci_pci_tbl[] = {
{ PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */
{ PCI_VDEVICE(PROMISE, 0x3781), board_ahci }, /* FastTrak TX8660 ahci-mode */
- /* Asmedia */
+ /* ASMedia */
{ PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci }, /* ASM1060 */
{ PCI_VDEVICE(ASMEDIA, 0x0602), board_ahci }, /* ASM1060 */
- { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci }, /* ASM1061 */
- { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci }, /* ASM1062 */
+ { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci_43bit_dma }, /* ASM1061 */
+ { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci_43bit_dma }, /* ASM1061/1062 */
{ PCI_VDEVICE(ASMEDIA, 0x0621), board_ahci }, /* ASM1061R */
{ PCI_VDEVICE(ASMEDIA, 0x0622), board_ahci }, /* ASM1062R */
@@ -955,11 +963,20 @@ static int ahci_pci_device_resume(struct device *dev)
#endif /* CONFIG_PM */
-static int ahci_configure_dma_masks(struct pci_dev *pdev, int using_dac)
+static int ahci_configure_dma_masks(struct pci_dev *pdev,
+ struct ahci_host_priv *hpriv)
{
- const int dma_bits = using_dac ? 64 : 32;
+ int dma_bits;
int rc;
+ if (hpriv->cap & HOST_CAP_64) {
+ dma_bits = 64;
+ if (hpriv->flags & AHCI_HFLAG_43BIT_ONLY)
+ dma_bits = 43;
+ } else {
+ dma_bits = 32;
+ }
+
/*
* If the device fixup already set the dma_mask to some non-standard
* value, don't extend it here. This happens on STA2X11, for example.
@@ -1937,7 +1954,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
ahci_gtf_filter_workaround(host);
/* initialize adapter */
- rc = ahci_configure_dma_masks(pdev, hpriv->cap & HOST_CAP_64);
+ rc = ahci_configure_dma_masks(pdev, hpriv);
if (rc)
return rc;
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index dcc2d92cf6b62..69557e602e2ea 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -244,6 +244,7 @@ enum {
AHCI_HFLAG_IGN_NOTSUPP_POWER_ON = BIT(27), /* ignore -EOPNOTSUPP
from phy_power_on() */
AHCI_HFLAG_NO_SXS = BIT(28), /* SXS not supported */
+ AHCI_HFLAG_43BIT_ONLY = BIT(29), /* 43bit DMA addr limit */
/* ap->flags bits */
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 028/245] MIPS: reserve exception vector space ONLY ONCE
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 027/245] ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 029/245] platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet Greg Kroah-Hartman
` (227 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Bogendoerfer, Huang Pei,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Pei <huangpei@loongson.cn>
[ Upstream commit abcabb9e30a1f9a69c76776f8abffc31c377b542 ]
"cpu_probe" is called both by BP and APs, but reserving exception vector
(like 0x0-0x1000) called by "cpu_probe" need once and calling on APs is
too late since memblock is unavailable at that time.
So, reserve exception vector ONLY by BP.
Suggested-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Huang Pei <huangpei@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/kernel/traps.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index afb2c955d99ef..5c01a21a216b9 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -2001,7 +2001,13 @@ unsigned long vi_handlers[64];
void reserve_exception_space(phys_addr_t addr, unsigned long size)
{
- memblock_reserve(addr, size);
+ /*
+ * reserve exception space on CPUs other than CPU0
+ * is too late, since memblock is unavailable when APs
+ * up
+ */
+ if (smp_processor_id() == 0)
+ memblock_reserve(addr, size);
}
void __init *set_except_vector(int n, void *addr)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 029/245] platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 028/245] MIPS: reserve exception vector space ONLY ONCE Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 030/245] ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt Greg Kroah-Hartman
` (226 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Phoenix Chen, Hans de Goede,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phoenix Chen <asbeltogf@gmail.com>
[ Upstream commit 1abdf288b0ef5606f76b6e191fa6df05330e3d7e ]
Add touch screen info for TECLAST X16 Plus tablet.
Signed-off-by: Phoenix Chen <asbeltogf@gmail.com>
Link: https://lore.kernel.org/r/20240126095308.5042-1-asbeltogf@gmail.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/touchscreen_dmi.c | 35 ++++++++++++++++++++++++++
1 file changed, 35 insertions(+)
diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
index f129e29b295d9..397283893f39f 100644
--- a/drivers/platform/x86/touchscreen_dmi.c
+++ b/drivers/platform/x86/touchscreen_dmi.c
@@ -916,6 +916,32 @@ static const struct ts_dmi_data teclast_tbook11_data = {
.properties = teclast_tbook11_props,
};
+static const struct property_entry teclast_x16_plus_props[] = {
+ PROPERTY_ENTRY_U32("touchscreen-min-x", 8),
+ PROPERTY_ENTRY_U32("touchscreen-min-y", 14),
+ PROPERTY_ENTRY_U32("touchscreen-size-x", 1916),
+ PROPERTY_ENTRY_U32("touchscreen-size-y", 1264),
+ PROPERTY_ENTRY_BOOL("touchscreen-inverted-y"),
+ PROPERTY_ENTRY_STRING("firmware-name", "gsl3692-teclast-x16-plus.fw"),
+ PROPERTY_ENTRY_U32("silead,max-fingers", 10),
+ PROPERTY_ENTRY_BOOL("silead,home-button"),
+ { }
+};
+
+static const struct ts_dmi_data teclast_x16_plus_data = {
+ .embedded_fw = {
+ .name = "silead/gsl3692-teclast-x16-plus.fw",
+ .prefix = { 0xf0, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00 },
+ .length = 43560,
+ .sha256 = { 0x9d, 0xb0, 0x3d, 0xf1, 0x00, 0x3c, 0xb5, 0x25,
+ 0x62, 0x8a, 0xa0, 0x93, 0x4b, 0xe0, 0x4e, 0x75,
+ 0xd1, 0x27, 0xb1, 0x65, 0x3c, 0xba, 0xa5, 0x0f,
+ 0xcd, 0xb4, 0xbe, 0x00, 0xbb, 0xf6, 0x43, 0x29 },
+ },
+ .acpi_name = "MSSL1680:00",
+ .properties = teclast_x16_plus_props,
+};
+
static const struct property_entry teclast_x3_plus_props[] = {
PROPERTY_ENTRY_U32("touchscreen-size-x", 1980),
PROPERTY_ENTRY_U32("touchscreen-size-y", 1500),
@@ -1552,6 +1578,15 @@ const struct dmi_system_id touchscreen_dmi_table[] = {
DMI_MATCH(DMI_PRODUCT_SKU, "E5A6_A1"),
},
},
+ {
+ /* Teclast X16 Plus */
+ .driver_data = (void *)&teclast_x16_plus_data,
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "TECLAST"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Default string"),
+ DMI_MATCH(DMI_PRODUCT_SKU, "D3A5_A1"),
+ },
+ },
{
/* Teclast X3 Plus */
.driver_data = (void *)&teclast_x3_plus_data,
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 030/245] ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 029/245] platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 031/245] ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Greg Kroah-Hartman
` (225 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baokun Li, Jan Kara, Theodore Tso,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun1@huawei.com>
[ Upstream commit 993bf0f4c393b3667830918f9247438a8f6fdb5b ]
Determine if bb_fragments is 0 instead of determining bb_free to eliminate
the risk of dividing by zero when the block bitmap is corrupted.
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20240104142040.2835097-6-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/mballoc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 762c2f8b5b2a8..48930df9ae565 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -853,7 +853,7 @@ mb_update_avg_fragment_size(struct super_block *sb, struct ext4_group_info *grp)
{
struct ext4_sb_info *sbi = EXT4_SB(sb);
- if (!test_opt2(sb, MB_OPTIMIZE_SCAN) || grp->bb_free == 0)
+ if (!test_opt2(sb, MB_OPTIMIZE_SCAN) || grp->bb_fragments == 0)
return;
write_lock(&sbi->s_mb_rb_lock);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 031/245] ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 030/245] ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 032/245] ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Greg Kroah-Hartman
` (224 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baokun Li, Jan Kara, Theodore Tso,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun1@huawei.com>
[ Upstream commit 4530b3660d396a646aad91a787b6ab37cf604b53 ]
Determine if the group block bitmap is corrupted before using ac_b_ex in
ext4_mb_try_best_found() to avoid allocating blocks from a group with a
corrupted block bitmap in the following concurrency and making the
situation worse.
ext4_mb_regular_allocator
ext4_lock_group(sb, group)
ext4_mb_good_group
// check if the group bbitmap is corrupted
ext4_mb_complex_scan_group
// Scan group gets ac_b_ex but doesn't use it
ext4_unlock_group(sb, group)
ext4_mark_group_bitmap_corrupted(group)
// The block bitmap was corrupted during
// the group unlock gap.
ext4_mb_try_best_found
ext4_lock_group(ac->ac_sb, group)
ext4_mb_use_best_found
mb_mark_used
// Allocating blocks in block bitmap corrupted group
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20240104142040.2835097-7-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/mballoc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 48930df9ae565..3e4be376a479a 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2197,6 +2197,9 @@ int ext4_mb_try_best_found(struct ext4_allocation_context *ac,
return err;
ext4_lock_group(ac->ac_sb, group);
+ if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)))
+ goto out;
+
max = mb_find_extent(e4b, ex.fe_start, ex.fe_len, &ex);
if (max > 0) {
@@ -2204,6 +2207,7 @@ int ext4_mb_try_best_found(struct ext4_allocation_context *ac,
ext4_mb_use_best_found(ac, e4b);
}
+out:
ext4_unlock_group(ac->ac_sb, group);
ext4_mb_unload_buddy(e4b);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 032/245] ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 031/245] ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 033/245] dmaengine: ti: edma: Add some null pointer checks to the edma_probe Greg Kroah-Hartman
` (223 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baokun Li, Jan Kara, Theodore Tso,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun1@huawei.com>
[ Upstream commit 832698373a25950942c04a512daa652c18a9b513 ]
Places the logic for checking if the group's block bitmap is corrupt under
the protection of the group lock to avoid allocating blocks from the group
with a corrupted block bitmap.
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20240104142040.2835097-8-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/mballoc.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 3e4be376a479a..622f60d9e1c68 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2236,12 +2236,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
if (err)
return err;
- if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) {
- ext4_mb_unload_buddy(e4b);
- return 0;
- }
-
ext4_lock_group(ac->ac_sb, group);
+ if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)))
+ goto out;
+
max = mb_find_extent(e4b, ac->ac_g_ex.fe_start,
ac->ac_g_ex.fe_len, &ex);
ex.fe_logical = 0xDEADFA11; /* debug value */
@@ -2274,6 +2272,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
ac->ac_b_ex = ex;
ext4_mb_use_best_found(ac, e4b);
}
+out:
ext4_unlock_group(ac->ac_sb, group);
ext4_mb_unload_buddy(e4b);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 033/245] dmaengine: ti: edma: Add some null pointer checks to the edma_probe
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 032/245] ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 034/245] regulator: pwm-regulator: Add validity checks in continuous .get_voltage Greg Kroah-Hartman
` (222 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kunwu Chan, Vinod Koul, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <chentao@kylinos.cn>
[ Upstream commit 6e2276203ac9ff10fc76917ec9813c660f627369 ]
devm_kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure. Ensure the allocation was successful
by checking the pointer validity.
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Link: https://lore.kernel.org/r/20240118031929.192192-1-chentao@kylinos.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/ti/edma.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
index a1adc8d91fd8d..69292d4a0c441 100644
--- a/drivers/dma/ti/edma.c
+++ b/drivers/dma/ti/edma.c
@@ -2462,6 +2462,11 @@ static int edma_probe(struct platform_device *pdev)
if (irq > 0) {
irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccint",
dev_name(dev));
+ if (!irq_name) {
+ ret = -ENOMEM;
+ goto err_disable_pm;
+ }
+
ret = devm_request_irq(dev, irq, dma_irq_handler, 0, irq_name,
ecc);
if (ret) {
@@ -2478,6 +2483,11 @@ static int edma_probe(struct platform_device *pdev)
if (irq > 0) {
irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccerrint",
dev_name(dev));
+ if (!irq_name) {
+ ret = -ENOMEM;
+ goto err_disable_pm;
+ }
+
ret = devm_request_irq(dev, irq, dma_ccerr_handler, 0, irq_name,
ecc);
if (ret) {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 034/245] regulator: pwm-regulator: Add validity checks in continuous .get_voltage
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 033/245] dmaengine: ti: edma: Add some null pointer checks to the edma_probe Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 035/245] nvmet-tcp: fix nvme tcp ida memory leak Greg Kroah-Hartman
` (221 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Martin Blumenstingl, Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[ Upstream commit c92688cac239794e4a1d976afa5203a4d3a2ac0e ]
Continuous regulators can be configured to operate only in a certain
duty cycle range (for example from 0..91%). Add a check to error out if
the duty cycle translates to an unsupported (or out of range) voltage.
Suggested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Link: https://msgid.link/r/20240113224628.377993-2-martin.blumenstingl@googlemail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/pwm-regulator.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/regulator/pwm-regulator.c b/drivers/regulator/pwm-regulator.c
index 7629476d94aeb..f4d9d9455dea6 100644
--- a/drivers/regulator/pwm-regulator.c
+++ b/drivers/regulator/pwm-regulator.c
@@ -158,6 +158,9 @@ static int pwm_regulator_get_voltage(struct regulator_dev *rdev)
pwm_get_state(drvdata->pwm, &pstate);
voltage = pwm_get_relative_duty_cycle(&pstate, duty_unit);
+ if (voltage < min(max_uV_duty, min_uV_duty) ||
+ voltage > max(max_uV_duty, min_uV_duty))
+ return -ENOTRECOVERABLE;
/*
* The dutycycle for min_uV might be greater than the one for max_uV.
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 035/245] nvmet-tcp: fix nvme tcp ida memory leak
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 034/245] regulator: pwm-regulator: Add validity checks in continuous .get_voltage Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 036/245] ALSA: usb-audio: Check presence of valid altsetting control Greg Kroah-Hartman
` (220 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guixin Liu, Christoph Hellwig,
Chaitanya Kulkarni, Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit 47c5dd66c1840524572dcdd956f4af2bdb6fbdff ]
The nvmet_tcp_queue_ida should be destroy when the nvmet-tcp module
exit.
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/tcp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 4f2164a3f466b..8468a41322f25 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1884,6 +1884,7 @@ static void __exit nvmet_tcp_exit(void)
flush_workqueue(nvmet_wq);
destroy_workqueue(nvmet_tcp_wq);
+ ida_destroy(&nvmet_tcp_queue_ida);
}
module_init(nvmet_tcp_init);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 036/245] ALSA: usb-audio: Check presence of valid altsetting control
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 035/245] nvmet-tcp: fix nvme tcp ida memory leak Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 037/245] ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 Greg Kroah-Hartman
` (219 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Tsoy, Takashi Iwai,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Tsoy <alexander@tsoy.me>
[ Upstream commit 346f59d1e8ed0eed41c80e1acb657e484c308e6a ]
Many devices with a single alternate setting do not have a Valid
Alternate Setting Control and validation performed by
validate_sample_rate_table_v2v3() doesn't work on them and is not
really needed. So check the presense of control before sending
altsetting validation requests.
MOTU Microbook IIc is suffering the most without this check. It
takes up to 40 seconds to bootup due to how slow it switches
sampling rates:
[ 2659.164824] usb 3-2: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice= 0.60
[ 2659.164827] usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 2659.164829] usb 3-2: Product: MicroBook IIc
[ 2659.164830] usb 3-2: Manufacturer: MOTU
[ 2659.166204] usb 3-2: Found last interface = 3
[ 2679.322298] usb 3-2: No valid sample rate available for 1:1, assuming a firmware bug
[ 2679.322306] usb 3-2: 1:1: add audio endpoint 0x3
[ 2679.322321] usb 3-2: Creating new data endpoint #3
[ 2679.322552] usb 3-2: 1:1 Set sample rate 96000, clock 1
[ 2684.362250] usb 3-2: 2:1: cannot get freq (v2/v3): err -110
[ 2694.444700] usb 3-2: No valid sample rate available for 2:1, assuming a firmware bug
[ 2694.444707] usb 3-2: 2:1: add audio endpoint 0x84
[ 2694.444721] usb 3-2: Creating new data endpoint #84
[ 2699.482103] usb 3-2: 2:1 Set sample rate 96000, clock 1
Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
Link: https://lore.kernel.org/r/20240129121254.3454481-1-alexander@tsoy.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/format.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/sound/usb/format.c b/sound/usb/format.c
index ab5fed9f55b60..3b45d0ee76938 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -470,9 +470,11 @@ static int validate_sample_rate_table_v2v3(struct snd_usb_audio *chip,
int clock)
{
struct usb_device *dev = chip->dev;
+ struct usb_host_interface *alts;
unsigned int *table;
unsigned int nr_rates;
int i, err;
+ u32 bmControls;
/* performing the rate verification may lead to unexpected USB bus
* behavior afterwards by some unknown reason. Do this only for the
@@ -481,6 +483,24 @@ static int validate_sample_rate_table_v2v3(struct snd_usb_audio *chip,
if (!(chip->quirk_flags & QUIRK_FLAG_VALIDATE_RATES))
return 0; /* don't perform the validation as default */
+ alts = snd_usb_get_host_interface(chip, fp->iface, fp->altsetting);
+ if (!alts)
+ return 0;
+
+ if (fp->protocol == UAC_VERSION_3) {
+ struct uac3_as_header_descriptor *as = snd_usb_find_csint_desc(
+ alts->extra, alts->extralen, NULL, UAC_AS_GENERAL);
+ bmControls = le32_to_cpu(as->bmControls);
+ } else {
+ struct uac2_as_header_descriptor *as = snd_usb_find_csint_desc(
+ alts->extra, alts->extralen, NULL, UAC_AS_GENERAL);
+ bmControls = as->bmControls;
+ }
+
+ if (!uac_v2v3_control_is_readable(bmControls,
+ UAC2_AS_VAL_ALT_SETTINGS))
+ return 0;
+
table = kcalloc(fp->nr_rates, sizeof(*table), GFP_KERNEL);
if (!table)
return -ENOMEM;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 037/245] ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 036/245] ALSA: usb-audio: Check presence of valid altsetting control Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 038/245] spi: sh-msiof: avoid integer overflow in constants Greg Kroah-Hartman
` (218 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai, Andre Przywara,
Jernej Skrabec, Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@csie.org>
[ Upstream commit 0adf963b8463faa44653e22e56ce55f747e68868 ]
The SPDIF hardware block found in the H616 SoC has the same layout as
the one found in the H6 SoC, except that it is missing the receiver
side.
Since the driver currently only supports the transmit function, support
for the H616 is identical to what is currently done for the H6.
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://msgid.link/r/20240127163247.384439-4-wens@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sunxi/sun4i-spdif.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c
index a10949bf0ca1e..dd8d13f3fd121 100644
--- a/sound/soc/sunxi/sun4i-spdif.c
+++ b/sound/soc/sunxi/sun4i-spdif.c
@@ -464,6 +464,11 @@ static const struct of_device_id sun4i_spdif_of_match[] = {
.compatible = "allwinner,sun50i-h6-spdif",
.data = &sun50i_h6_spdif_quirks,
},
+ {
+ .compatible = "allwinner,sun50i-h616-spdif",
+ /* Essentially the same as the H6, but without RX */
+ .data = &sun50i_h6_spdif_quirks,
+ },
{ /* sentinel */ }
};
MODULE_DEVICE_TABLE(of, sun4i_spdif_of_match);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 038/245] spi: sh-msiof: avoid integer overflow in constants
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 037/245] ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 039/245] Input: xpad - add Lenovo Legion Go controllers Greg Kroah-Hartman
` (217 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Geert Uytterhoeven,
Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit 6500ad28fd5d67d5ca0fee9da73c463090842440 ]
cppcheck rightfully warned:
drivers/spi/spi-sh-msiof.c:792:28: warning: Signed integer overflow for expression '7<<29'. [integerOverflow]
sh_msiof_write(p, SIFCTR, SIFCTR_TFWM_1 | SIFCTR_RFWM_1);
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://msgid.link/r/20240130094053.10672-1-wsa+renesas@sang-engineering.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sh-msiof.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index eb2c64e0a5f7c..b7b3ec76e2cbd 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -137,14 +137,14 @@ struct sh_msiof_spi_priv {
/* SIFCTR */
#define SIFCTR_TFWM_MASK GENMASK(31, 29) /* Transmit FIFO Watermark */
-#define SIFCTR_TFWM_64 (0 << 29) /* Transfer Request when 64 empty stages */
-#define SIFCTR_TFWM_32 (1 << 29) /* Transfer Request when 32 empty stages */
-#define SIFCTR_TFWM_24 (2 << 29) /* Transfer Request when 24 empty stages */
-#define SIFCTR_TFWM_16 (3 << 29) /* Transfer Request when 16 empty stages */
-#define SIFCTR_TFWM_12 (4 << 29) /* Transfer Request when 12 empty stages */
-#define SIFCTR_TFWM_8 (5 << 29) /* Transfer Request when 8 empty stages */
-#define SIFCTR_TFWM_4 (6 << 29) /* Transfer Request when 4 empty stages */
-#define SIFCTR_TFWM_1 (7 << 29) /* Transfer Request when 1 empty stage */
+#define SIFCTR_TFWM_64 (0UL << 29) /* Transfer Request when 64 empty stages */
+#define SIFCTR_TFWM_32 (1UL << 29) /* Transfer Request when 32 empty stages */
+#define SIFCTR_TFWM_24 (2UL << 29) /* Transfer Request when 24 empty stages */
+#define SIFCTR_TFWM_16 (3UL << 29) /* Transfer Request when 16 empty stages */
+#define SIFCTR_TFWM_12 (4UL << 29) /* Transfer Request when 12 empty stages */
+#define SIFCTR_TFWM_8 (5UL << 29) /* Transfer Request when 8 empty stages */
+#define SIFCTR_TFWM_4 (6UL << 29) /* Transfer Request when 4 empty stages */
+#define SIFCTR_TFWM_1 (7UL << 29) /* Transfer Request when 1 empty stage */
#define SIFCTR_TFUA_MASK GENMASK(26, 20) /* Transmit FIFO Usable Area */
#define SIFCTR_TFUA_SHIFT 20
#define SIFCTR_TFUA(i) ((i) << SIFCTR_TFUA_SHIFT)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 039/245] Input: xpad - add Lenovo Legion Go controllers
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 038/245] spi: sh-msiof: avoid integer overflow in constants Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 040/245] netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new Greg Kroah-Hartman
` (216 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brenton Simpson, Dmitry Torokhov,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brenton Simpson <appsforartists@google.com>
[ Upstream commit 80441f76ee67002437db61f3b317ed80cce085d2 ]
The Lenovo Legion Go is a handheld gaming system, similar to a Steam Deck.
It has a gamepad (including rear paddles), 3 gyroscopes, a trackpad,
volume buttons, a power button, and 2 LED ring lights.
The Legion Go firmware presents these controls as a USB hub with various
devices attached. In its default state, the gamepad is presented as an
Xbox controller connected to this hub. (By holding a combination of
buttons, it can be changed to use the older DirectInput API.)
This patch teaches the existing Xbox controller module `xpad` to bind to
the controller in the Legion Go, which enables support for the:
- directional pad,
- analog sticks (including clicks),
- X, Y, A, B,
- start and select (or menu and capture),
- shoulder buttons, and
- rumble.
The trackpad, touchscreen, volume controls, and power button are already
supported via existing kernel modules. Two of the face buttons, the
gyroscopes, rear paddles, and LEDs are not.
After this patch lands, the Legion Go will be mostly functional in Linux,
out-of-the-box. The various components of the USB hub can be synthesized
into a single logical controller (including the additional buttons) in
userspace with [Handheld Daemon](https://github.com/hhd-dev/hhd), which
makes the Go fully functional.
Signed-off-by: Brenton Simpson <appsforartists@google.com>
Link: https://lore.kernel.org/r/20240118183546.418064-1-appsforartists@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/joystick/xpad.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 1ff0d4e24fe68..f0b1dac938222 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -276,6 +276,7 @@ static const struct xpad_device {
{ 0x1689, 0xfd00, "Razer Onza Tournament Edition", 0, XTYPE_XBOX360 },
{ 0x1689, 0xfd01, "Razer Onza Classic Edition", 0, XTYPE_XBOX360 },
{ 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 },
+ { 0x17ef, 0x6182, "Lenovo Legion Controller for Windows", 0, XTYPE_XBOX360 },
{ 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 },
{ 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 },
{ 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
@@ -464,6 +465,7 @@ static const struct usb_device_id xpad_table[] = {
XPAD_XBOX360_VENDOR(0x15e4), /* Numark X-Box 360 controllers */
XPAD_XBOX360_VENDOR(0x162e), /* Joytech X-Box 360 controllers */
XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */
+ XPAD_XBOX360_VENDOR(0x17ef), /* Lenovo */
XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */
XPAD_XBOX360_VENDOR(0x1bad), /* Harminix Rock Band Guitar and Drums */
XPAD_XBOX360_VENDOR(0x20d6), /* PowerA Controllers */
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 040/245] netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 039/245] Input: xpad - add Lenovo Legion Go controllers Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 041/245] ALSA: usb-audio: Ignore clock selector errors for single connection Greg Kroah-Hartman
` (215 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xin Long, Pablo Neira Ayuso,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit 6e348067ee4bc5905e35faa3a8fafa91c9124bc7 ]
The annotation says in sctp_new(): "If it is a shutdown ack OOTB packet, we
expect a return shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8)".
However, it does not check SCTP_CID_SHUTDOWN_ACK before setting vtag[REPLY]
in the conntrack entry(ct).
Because of that, if the ct in Router disappears for some reason in [1]
with the packet sequence like below:
Client > Server: sctp (1) [INIT] [init tag: 3201533963]
Server > Client: sctp (1) [INIT ACK] [init tag: 972498433]
Client > Server: sctp (1) [COOKIE ECHO]
Server > Client: sctp (1) [COOKIE ACK]
Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057809]
Server > Client: sctp (1) [SACK] [cum ack 3075057809]
Server > Client: sctp (1) [HB REQ]
(the ct in Router disappears somehow) <-------- [1]
Client > Server: sctp (1) [HB ACK]
Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810]
Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810]
Client > Server: sctp (1) [HB REQ]
Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810]
Client > Server: sctp (1) [HB REQ]
Client > Server: sctp (1) [ABORT]
when processing HB ACK packet in Router it calls sctp_new() to initialize
the new ct with vtag[REPLY] set to HB_ACK packet's vtag.
Later when sending DATA from Client, all the SACKs from Server will get
dropped in Router, as the SACK packet's vtag does not match vtag[REPLY]
in the ct. The worst thing is the vtag in this ct will never get fixed
by the upcoming packets from Server.
This patch fixes it by checking SCTP_CID_SHUTDOWN_ACK before setting
vtag[REPLY] in the ct in sctp_new() as the annotation says. With this
fix, it will leave vtag[REPLY] in ct to 0 in the case above, and the
next HB REQ/ACK from Server is able to fix the vtag as its value is 0
in nf_conntrack_sctp_packet().
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_proto_sctp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index c94a9971d790c..7ffd698497f2a 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -299,7 +299,7 @@ sctp_new(struct nf_conn *ct, const struct sk_buff *skb,
pr_debug("Setting vtag %x for secondary conntrack\n",
sh->vtag);
ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] = sh->vtag;
- } else {
+ } else if (sch->type == SCTP_CID_SHUTDOWN_ACK) {
/* If it is a shutdown ack OOTB packet, we expect a return
shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
pr_debug("Setting vtag %x for new conn OOTB\n",
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 041/245] ALSA: usb-audio: Ignore clock selector errors for single connection
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 040/245] netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 042/245] nvme-fc: do not wait in vain when unloading module Greg Kroah-Hartman
` (214 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Tsoy, Takashi Iwai,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Tsoy <alexander@tsoy.me>
[ Upstream commit eaa1b01fe709d6a236a9cec74813e0400601fd23 ]
For devices with multiple clock sources connected to a selector, we need
to check what a clock selector control request has returned. This is
needed to ensure that a requested clock source is indeed selected and for
autoclock feature to work.
For devices with single clock source connected, if we get an error there
is nothing else we can do about it. We can't skip clock selector setup as
it is required by some devices. So lets just ignore error in this case.
This should fix various buggy Mackie devices:
[ 649.109785] usb 1-1.3: parse_audio_format_rates_v2v3(): unable to find clock source (clock -32)
[ 649.111946] usb 1-1.3: parse_audio_format_rates_v2v3(): unable to find clock source (clock -32)
[ 649.113822] usb 1-1.3: parse_audio_format_rates_v2v3(): unable to find clock source (clock -32)
There is also interesting info from the Windows documentation [1] (this
is probably why manufacturers dont't even test this feature):
"The USB Audio 2.0 driver doesn't support clock selection. The driver
uses the Clock Source Entity, which is selected by default and never
issues a Clock Selector Control SET CUR request."
Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/audio/usb-2-0-audio-drivers [1]
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217314
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218175
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218342
Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
Link: https://lore.kernel.org/r/20240201115308.17838-1-alexander@tsoy.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/clock.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/sound/usb/clock.c b/sound/usb/clock.c
index ccca9efa7d33f..970e14ff54d14 100644
--- a/sound/usb/clock.c
+++ b/sound/usb/clock.c
@@ -328,8 +328,16 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip,
if (chip->quirk_flags & QUIRK_FLAG_SKIP_CLOCK_SELECTOR)
return ret;
err = uac_clock_selector_set_val(chip, entity_id, cur);
- if (err < 0)
+ if (err < 0) {
+ if (pins == 1) {
+ usb_audio_dbg(chip,
+ "%s(): selector returned an error, "
+ "assuming a firmware bug, id %d, ret %d\n",
+ __func__, clock_id, err);
+ return ret;
+ }
return err;
+ }
}
if (!validate || ret > 0 || !chip->autoclock)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 042/245] nvme-fc: do not wait in vain when unloading module
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 041/245] ALSA: usb-audio: Ignore clock selector errors for single connection Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 043/245] nvmet-fcloop: swap the list_add_tail arguments Greg Kroah-Hartman
` (213 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Hannes Reinecke,
Daniel Wagner, Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <dwagner@suse.de>
[ Upstream commit 70fbfc47a392b98e5f8dba70c6efc6839205c982 ]
The module exit path has race between deleting all controllers and
freeing 'left over IDs'. To prevent double free a synchronization
between nvme_delete_ctrl and ida_destroy has been added by the initial
commit.
There is some logic around trying to prevent from hanging forever in
wait_for_completion, though it does not handling all cases. E.g.
blktests is able to reproduce the situation where the module unload
hangs forever.
If we completely rely on the cleanup code executed from the
nvme_delete_ctrl path, all IDs will be freed eventually. This makes
calling ida_destroy unnecessary. We only have to ensure that all
nvme_delete_ctrl code has been executed before we leave
nvme_fc_exit_module. This is done by flushing the nvme_delete_wq
workqueue.
While at it, remove the unused nvme_fc_wq workqueue too.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/fc.c | 47 ++++++------------------------------------
1 file changed, 6 insertions(+), 41 deletions(-)
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index aa14ad963d910..8dfd317509aa6 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -220,11 +220,6 @@ static LIST_HEAD(nvme_fc_lport_list);
static DEFINE_IDA(nvme_fc_local_port_cnt);
static DEFINE_IDA(nvme_fc_ctrl_cnt);
-static struct workqueue_struct *nvme_fc_wq;
-
-static bool nvme_fc_waiting_to_unload;
-static DECLARE_COMPLETION(nvme_fc_unload_proceed);
-
/*
* These items are short-term. They will eventually be moved into
* a generic FC class. See comments in module init.
@@ -254,8 +249,6 @@ nvme_fc_free_lport(struct kref *ref)
/* remove from transport list */
spin_lock_irqsave(&nvme_fc_lock, flags);
list_del(&lport->port_list);
- if (nvme_fc_waiting_to_unload && list_empty(&nvme_fc_lport_list))
- complete(&nvme_fc_unload_proceed);
spin_unlock_irqrestore(&nvme_fc_lock, flags);
ida_simple_remove(&nvme_fc_local_port_cnt, lport->localport.port_num);
@@ -3904,10 +3897,6 @@ static int __init nvme_fc_init_module(void)
{
int ret;
- nvme_fc_wq = alloc_workqueue("nvme_fc_wq", WQ_MEM_RECLAIM, 0);
- if (!nvme_fc_wq)
- return -ENOMEM;
-
/*
* NOTE:
* It is expected that in the future the kernel will combine
@@ -3925,7 +3914,7 @@ static int __init nvme_fc_init_module(void)
ret = class_register(&fc_class);
if (ret) {
pr_err("couldn't register class fc\n");
- goto out_destroy_wq;
+ return ret;
}
/*
@@ -3949,8 +3938,6 @@ static int __init nvme_fc_init_module(void)
device_destroy(&fc_class, MKDEV(0, 0));
out_destroy_class:
class_unregister(&fc_class);
-out_destroy_wq:
- destroy_workqueue(nvme_fc_wq);
return ret;
}
@@ -3970,45 +3957,23 @@ nvme_fc_delete_controllers(struct nvme_fc_rport *rport)
spin_unlock(&rport->lock);
}
-static void
-nvme_fc_cleanup_for_unload(void)
+static void __exit nvme_fc_exit_module(void)
{
struct nvme_fc_lport *lport;
struct nvme_fc_rport *rport;
-
- list_for_each_entry(lport, &nvme_fc_lport_list, port_list) {
- list_for_each_entry(rport, &lport->endp_list, endp_list) {
- nvme_fc_delete_controllers(rport);
- }
- }
-}
-
-static void __exit nvme_fc_exit_module(void)
-{
unsigned long flags;
- bool need_cleanup = false;
spin_lock_irqsave(&nvme_fc_lock, flags);
- nvme_fc_waiting_to_unload = true;
- if (!list_empty(&nvme_fc_lport_list)) {
- need_cleanup = true;
- nvme_fc_cleanup_for_unload();
- }
+ list_for_each_entry(lport, &nvme_fc_lport_list, port_list)
+ list_for_each_entry(rport, &lport->endp_list, endp_list)
+ nvme_fc_delete_controllers(rport);
spin_unlock_irqrestore(&nvme_fc_lock, flags);
- if (need_cleanup) {
- pr_info("%s: waiting for ctlr deletes\n", __func__);
- wait_for_completion(&nvme_fc_unload_proceed);
- pr_info("%s: ctrl deletes complete\n", __func__);
- }
+ flush_workqueue(nvme_delete_wq);
nvmf_unregister_transport(&nvme_fc_transport);
- ida_destroy(&nvme_fc_local_port_cnt);
- ida_destroy(&nvme_fc_ctrl_cnt);
-
device_destroy(&fc_class, MKDEV(0, 0));
class_unregister(&fc_class);
- destroy_workqueue(nvme_fc_wq);
}
module_init(nvme_fc_init_module);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 043/245] nvmet-fcloop: swap the list_add_tail arguments
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 042/245] nvme-fc: do not wait in vain when unloading module Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 044/245] nvmet-fc: release reference on target port Greg Kroah-Hartman
` (212 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Hannes Reinecke,
Daniel Wagner, Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <dwagner@suse.de>
[ Upstream commit dcfad4ab4d6733f2861cd241d8532a0004fc835a ]
The first argument of list_add_tail function is the new element which
should be added to the list which is the second argument. Swap the
arguments to allow processing more than one element at a time.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fcloop.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index c780af36c1d4a..f5b8442b653db 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -358,7 +358,7 @@ fcloop_h2t_ls_req(struct nvme_fc_local_port *localport,
if (!rport->targetport) {
tls_req->status = -ECONNREFUSED;
spin_lock(&rport->lock);
- list_add_tail(&rport->ls_list, &tls_req->ls_list);
+ list_add_tail(&tls_req->ls_list, &rport->ls_list);
spin_unlock(&rport->lock);
queue_work(nvmet_wq, &rport->ls_work);
return ret;
@@ -391,7 +391,7 @@ fcloop_h2t_xmt_ls_rsp(struct nvmet_fc_target_port *targetport,
if (remoteport) {
rport = remoteport->private;
spin_lock(&rport->lock);
- list_add_tail(&rport->ls_list, &tls_req->ls_list);
+ list_add_tail(&tls_req->ls_list, &rport->ls_list);
spin_unlock(&rport->lock);
queue_work(nvmet_wq, &rport->ls_work);
}
@@ -446,7 +446,7 @@ fcloop_t2h_ls_req(struct nvmet_fc_target_port *targetport, void *hosthandle,
if (!tport->remoteport) {
tls_req->status = -ECONNREFUSED;
spin_lock(&tport->lock);
- list_add_tail(&tport->ls_list, &tls_req->ls_list);
+ list_add_tail(&tls_req->ls_list, &tport->ls_list);
spin_unlock(&tport->lock);
queue_work(nvmet_wq, &tport->ls_work);
return ret;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 044/245] nvmet-fc: release reference on target port
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 043/245] nvmet-fcloop: swap the list_add_tail arguments Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 045/245] nvmet-fc: defer cleanup using RCU properly Greg Kroah-Hartman
` (211 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Christoph Hellwig,
Daniel Wagner, Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <dwagner@suse.de>
[ Upstream commit c691e6d7e13dab81ac8c7489c83b5dea972522a5 ]
In case we return early out of __nvmet_fc_finish_ls_req() we still have
to release the reference on the target port.
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 00a2a591f5c1f..80df50ed7e3aa 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -359,7 +359,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
if (!lsop->req_queued) {
spin_unlock_irqrestore(&tgtport->lock, flags);
- return;
+ goto out_puttgtport;
}
list_del(&lsop->lsreq_list);
@@ -372,6 +372,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
(lsreq->rqstlen + lsreq->rsplen),
DMA_BIDIRECTIONAL);
+out_puttgtport:
nvmet_fc_tgtport_put(tgtport);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 045/245] nvmet-fc: defer cleanup using RCU properly
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 044/245] nvmet-fc: release reference on target port Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 046/245] nvmet-fc: hold reference on hostport match Greg Kroah-Hartman
` (210 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Hannes Reinecke,
Daniel Wagner, Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <dwagner@suse.de>
[ Upstream commit 4049dc96b8de7aeb3addcea039446e464726a525 ]
When the target executes a disconnect and the host triggers a reconnect
immediately, the reconnect command still finds an existing association.
The reconnect crashes later on because nvmet_fc_delete_target_assoc
blindly removes resources while the reconnect code wants to use it.
To address this, nvmet_fc_find_target_assoc should not be able to
lookup an association which is being removed. The association list
is already under RCU lifetime management, so let's properly use it
and remove the association from the list and wait for a grace period
before cleaning up all. This means we also can drop the RCU management
on the queues, because this is now handled via the association itself.
A second step split the execution context so that the initial disconnect
command can complete without running the reconnect code in the same
context. As usual, this is done by deferring the ->done to a workqueue.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fc.c | 83 ++++++++++++++++++----------------------
1 file changed, 37 insertions(+), 46 deletions(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 80df50ed7e3aa..97f4ec37f36da 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -165,7 +165,7 @@ struct nvmet_fc_tgt_assoc {
struct nvmet_fc_hostport *hostport;
struct nvmet_fc_ls_iod *rcv_disconn;
struct list_head a_list;
- struct nvmet_fc_tgt_queue __rcu *queues[NVMET_NR_QUEUES + 1];
+ struct nvmet_fc_tgt_queue *queues[NVMET_NR_QUEUES + 1];
struct kref ref;
struct work_struct del_work;
struct rcu_head rcu;
@@ -802,14 +802,11 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc,
if (!queue)
return NULL;
- if (!nvmet_fc_tgt_a_get(assoc))
- goto out_free_queue;
-
queue->work_q = alloc_workqueue("ntfc%d.%d.%d", 0, 0,
assoc->tgtport->fc_target_port.port_num,
assoc->a_id, qid);
if (!queue->work_q)
- goto out_a_put;
+ goto out_free_queue;
queue->qid = qid;
queue->sqsize = sqsize;
@@ -831,15 +828,13 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc,
goto out_fail_iodlist;
WARN_ON(assoc->queues[qid]);
- rcu_assign_pointer(assoc->queues[qid], queue);
+ assoc->queues[qid] = queue;
return queue;
out_fail_iodlist:
nvmet_fc_destroy_fcp_iodlist(assoc->tgtport, queue);
destroy_workqueue(queue->work_q);
-out_a_put:
- nvmet_fc_tgt_a_put(assoc);
out_free_queue:
kfree(queue);
return NULL;
@@ -852,12 +847,8 @@ nvmet_fc_tgt_queue_free(struct kref *ref)
struct nvmet_fc_tgt_queue *queue =
container_of(ref, struct nvmet_fc_tgt_queue, ref);
- rcu_assign_pointer(queue->assoc->queues[queue->qid], NULL);
-
nvmet_fc_destroy_fcp_iodlist(queue->assoc->tgtport, queue);
- nvmet_fc_tgt_a_put(queue->assoc);
-
destroy_workqueue(queue->work_q);
kfree_rcu(queue, rcu);
@@ -969,7 +960,7 @@ nvmet_fc_find_target_queue(struct nvmet_fc_tgtport *tgtport,
rcu_read_lock();
list_for_each_entry_rcu(assoc, &tgtport->assoc_list, a_list) {
if (association_id == assoc->association_id) {
- queue = rcu_dereference(assoc->queues[qid]);
+ queue = assoc->queues[qid];
if (queue &&
(!atomic_read(&queue->connected) ||
!nvmet_fc_tgt_q_get(queue)))
@@ -1172,13 +1163,18 @@ nvmet_fc_target_assoc_free(struct kref *ref)
struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
struct nvmet_fc_ls_iod *oldls;
unsigned long flags;
+ int i;
+
+ for (i = NVMET_NR_QUEUES; i >= 0; i--) {
+ if (assoc->queues[i])
+ nvmet_fc_delete_target_queue(assoc->queues[i]);
+ }
/* Send Disconnect now that all i/o has completed */
nvmet_fc_xmt_disconnect_assoc(assoc);
nvmet_fc_free_hostport(assoc->hostport);
spin_lock_irqsave(&tgtport->lock, flags);
- list_del_rcu(&assoc->a_list);
oldls = assoc->rcv_disconn;
spin_unlock_irqrestore(&tgtport->lock, flags);
/* if pending Rcv Disconnect Association LS, send rsp now */
@@ -1208,7 +1204,7 @@ static void
nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
{
struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
- struct nvmet_fc_tgt_queue *queue;
+ unsigned long flags;
int i, terminating;
terminating = atomic_xchg(&assoc->terminating, 1);
@@ -1217,29 +1213,21 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
if (terminating)
return;
+ spin_lock_irqsave(&tgtport->lock, flags);
+ list_del_rcu(&assoc->a_list);
+ spin_unlock_irqrestore(&tgtport->lock, flags);
- for (i = NVMET_NR_QUEUES; i >= 0; i--) {
- rcu_read_lock();
- queue = rcu_dereference(assoc->queues[i]);
- if (!queue) {
- rcu_read_unlock();
- continue;
- }
+ synchronize_rcu();
- if (!nvmet_fc_tgt_q_get(queue)) {
- rcu_read_unlock();
- continue;
- }
- rcu_read_unlock();
- nvmet_fc_delete_target_queue(queue);
- nvmet_fc_tgt_q_put(queue);
+ /* ensure all in-flight I/Os have been processed */
+ for (i = NVMET_NR_QUEUES; i >= 0; i--) {
+ if (assoc->queues[i])
+ flush_workqueue(assoc->queues[i]->work_q);
}
dev_info(tgtport->dev,
"{%d:%d} Association deleted\n",
tgtport->fc_target_port.port_num, assoc->a_id);
-
- nvmet_fc_tgt_a_put(assoc);
}
static struct nvmet_fc_tgt_assoc *
@@ -1492,9 +1480,8 @@ __nvmet_fc_free_assocs(struct nvmet_fc_tgtport *tgtport)
list_for_each_entry_rcu(assoc, &tgtport->assoc_list, a_list) {
if (!nvmet_fc_tgt_a_get(assoc))
continue;
- if (!queue_work(nvmet_wq, &assoc->del_work))
- /* already deleting - release local reference */
- nvmet_fc_tgt_a_put(assoc);
+ queue_work(nvmet_wq, &assoc->del_work);
+ nvmet_fc_tgt_a_put(assoc);
}
rcu_read_unlock();
}
@@ -1547,9 +1534,8 @@ nvmet_fc_invalidate_host(struct nvmet_fc_target_port *target_port,
continue;
assoc->hostport->invalid = 1;
noassoc = false;
- if (!queue_work(nvmet_wq, &assoc->del_work))
- /* already deleting - release local reference */
- nvmet_fc_tgt_a_put(assoc);
+ queue_work(nvmet_wq, &assoc->del_work);
+ nvmet_fc_tgt_a_put(assoc);
}
spin_unlock_irqrestore(&tgtport->lock, flags);
@@ -1581,7 +1567,7 @@ nvmet_fc_delete_ctrl(struct nvmet_ctrl *ctrl)
rcu_read_lock();
list_for_each_entry_rcu(assoc, &tgtport->assoc_list, a_list) {
- queue = rcu_dereference(assoc->queues[0]);
+ queue = assoc->queues[0];
if (queue && queue->nvme_sq.ctrl == ctrl) {
if (nvmet_fc_tgt_a_get(assoc))
found_ctrl = true;
@@ -1593,9 +1579,8 @@ nvmet_fc_delete_ctrl(struct nvmet_ctrl *ctrl)
nvmet_fc_tgtport_put(tgtport);
if (found_ctrl) {
- if (!queue_work(nvmet_wq, &assoc->del_work))
- /* already deleting - release local reference */
- nvmet_fc_tgt_a_put(assoc);
+ queue_work(nvmet_wq, &assoc->del_work);
+ nvmet_fc_tgt_a_put(assoc);
return;
}
@@ -1625,6 +1610,8 @@ nvmet_fc_unregister_targetport(struct nvmet_fc_target_port *target_port)
/* terminate any outstanding associations */
__nvmet_fc_free_assocs(tgtport);
+ flush_workqueue(nvmet_wq);
+
/*
* should terminate LS's as well. However, LS's will be generated
* at the tail end of association termination, so they likely don't
@@ -1870,9 +1857,6 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport,
sizeof(struct fcnvme_ls_disconnect_assoc_acc)),
FCNVME_LS_DISCONNECT_ASSOC);
- /* release get taken in nvmet_fc_find_target_assoc */
- nvmet_fc_tgt_a_put(assoc);
-
/*
* The rules for LS response says the response cannot
* go back until ABTS's have been sent for all outstanding
@@ -1887,8 +1871,6 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport,
assoc->rcv_disconn = iod;
spin_unlock_irqrestore(&tgtport->lock, flags);
- nvmet_fc_delete_target_assoc(assoc);
-
if (oldls) {
dev_info(tgtport->dev,
"{%d:%d} Multiple Disconnect Association LS's "
@@ -1904,6 +1886,9 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport,
nvmet_fc_xmt_ls_rsp(tgtport, oldls);
}
+ queue_work(nvmet_wq, &assoc->del_work);
+ nvmet_fc_tgt_a_put(assoc);
+
return false;
}
@@ -2902,6 +2887,9 @@ nvmet_fc_remove_port(struct nvmet_port *port)
nvmet_fc_portentry_unbind(pe);
+ /* terminate any outstanding associations */
+ __nvmet_fc_free_assocs(pe->tgtport);
+
kfree(pe);
}
@@ -2933,6 +2921,9 @@ static int __init nvmet_fc_init_module(void)
static void __exit nvmet_fc_exit_module(void)
{
+ /* ensure any shutdown operation, e.g. delete ctrls have finished */
+ flush_workqueue(nvmet_wq);
+
/* sanity check - all lports should be removed */
if (!list_empty(&nvmet_fc_target_list))
pr_warn("%s: targetport list not empty\n", __func__);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 046/245] nvmet-fc: hold reference on hostport match
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 045/245] nvmet-fc: defer cleanup using RCU properly Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 047/245] nvmet-fc: abort command when there is no binding Greg Kroah-Hartman
` (209 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Christoph Hellwig,
Daniel Wagner, Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <dwagner@suse.de>
[ Upstream commit ca121a0f7515591dba0eb5532bfa7ace4dc153ce ]
The hostport data structure is shared between the association, this why
we keep track of the users via a refcount. So we should not decrement
the refcount on a match and free the hostport several times.
Reported by KASAN.
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fc.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 97f4ec37f36da..06d11bb7b944b 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1069,8 +1069,6 @@ nvmet_fc_alloc_hostport(struct nvmet_fc_tgtport *tgtport, void *hosthandle)
/* new allocation not needed */
kfree(newhost);
newhost = match;
- /* no new allocation - release reference */
- nvmet_fc_tgtport_put(tgtport);
} else {
newhost->tgtport = tgtport;
newhost->hosthandle = hosthandle;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 047/245] nvmet-fc: abort command when there is no binding
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 046/245] nvmet-fc: hold reference on hostport match Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 048/245] nvmet-fc: avoid deadlock on delete association path Greg Kroah-Hartman
` (208 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Christoph Hellwig,
Daniel Wagner, Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <dwagner@suse.de>
[ Upstream commit 3146345c2e9c2f661527054e402b0cfad80105a4 ]
When the target port has not active port binding, there is no point in
trying to process the command as it has to fail anyway. Instead adding
checks to all commands abort the command early.
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fc.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 06d11bb7b944b..20d3013be08ab 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1101,6 +1101,9 @@ nvmet_fc_alloc_target_assoc(struct nvmet_fc_tgtport *tgtport, void *hosthandle)
int idx;
bool needrandom = true;
+ if (!tgtport->pe)
+ return NULL;
+
assoc = kzalloc(sizeof(*assoc), GFP_KERNEL);
if (!assoc)
return NULL;
@@ -2523,8 +2526,9 @@ nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
fod->req.cmd = &fod->cmdiubuf.sqe;
fod->req.cqe = &fod->rspiubuf.cqe;
- if (tgtport->pe)
- fod->req.port = tgtport->pe->port;
+ if (!tgtport->pe)
+ goto transport_error;
+ fod->req.port = tgtport->pe->port;
/* clear any response payload */
memset(&fod->rspiubuf, 0, sizeof(fod->rspiubuf));
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 048/245] nvmet-fc: avoid deadlock on delete association path
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 047/245] nvmet-fc: abort command when there is no binding Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 049/245] nvmet-fc: take ref count on tgtport before delete assoc Greg Kroah-Hartman
` (207 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Daniel Wagner,
Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <dwagner@suse.de>
[ Upstream commit 710c69dbaccdac312e32931abcb8499c1525d397 ]
When deleting an association the shutdown path is deadlocking because we
try to flush the nvmet_wq nested. Avoid this by deadlock by deferring
the put work into its own work item.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fc.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 20d3013be08ab..1ef075b159b9d 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -111,6 +111,8 @@ struct nvmet_fc_tgtport {
struct nvmet_fc_port_entry *pe;
struct kref ref;
u32 max_sg_cnt;
+
+ struct work_struct put_work;
};
struct nvmet_fc_port_entry {
@@ -248,6 +250,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
+static void nvmet_fc_put_tgtport_work(struct work_struct *work)
+{
+ struct nvmet_fc_tgtport *tgtport =
+ container_of(work, struct nvmet_fc_tgtport, put_work);
+
+ nvmet_fc_tgtport_put(tgtport);
+}
static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
struct nvmet_fc_fcp_iod *fod);
@@ -359,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
if (!lsop->req_queued) {
spin_unlock_irqrestore(&tgtport->lock, flags);
- goto out_puttgtport;
+ goto out_putwork;
}
list_del(&lsop->lsreq_list);
@@ -372,8 +381,8 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
(lsreq->rqstlen + lsreq->rsplen),
DMA_BIDIRECTIONAL);
-out_puttgtport:
- nvmet_fc_tgtport_put(tgtport);
+out_putwork:
+ queue_work(nvmet_wq, &tgtport->put_work);
}
static int
@@ -1404,6 +1413,7 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
kref_init(&newrec->ref);
ida_init(&newrec->assoc_cnt);
newrec->max_sg_cnt = template->max_sgl_segments;
+ INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
ret = nvmet_fc_alloc_ls_iodlist(newrec);
if (ret) {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 049/245] nvmet-fc: take ref count on tgtport before delete assoc
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 048/245] nvmet-fc: avoid deadlock on delete association path Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 050/245] ext4: correct the hole length returned by ext4_map_blocks() Greg Kroah-Hartman
` (206 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Daniel Wagner,
Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <dwagner@suse.de>
[ Upstream commit fe506a74589326183297d5abdda02d0c76ae5a8b ]
We have to ensure that the tgtport is not going away
before be have remove all the associations.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fc.c | 31 +++++++++++++++++++++++--------
1 file changed, 23 insertions(+), 8 deletions(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1ef075b159b9d..d3ca59ae4c7af 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1092,13 +1092,28 @@ nvmet_fc_alloc_hostport(struct nvmet_fc_tgtport *tgtport, void *hosthandle)
}
static void
-nvmet_fc_delete_assoc(struct work_struct *work)
+nvmet_fc_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+{
+ nvmet_fc_delete_target_assoc(assoc);
+ nvmet_fc_tgt_a_put(assoc);
+}
+
+static void
+nvmet_fc_delete_assoc_work(struct work_struct *work)
{
struct nvmet_fc_tgt_assoc *assoc =
container_of(work, struct nvmet_fc_tgt_assoc, del_work);
+ struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
- nvmet_fc_delete_target_assoc(assoc);
- nvmet_fc_tgt_a_put(assoc);
+ nvmet_fc_delete_assoc(assoc);
+ nvmet_fc_tgtport_put(tgtport);
+}
+
+static void
+nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+{
+ nvmet_fc_tgtport_get(assoc->tgtport);
+ queue_work(nvmet_wq, &assoc->del_work);
}
static struct nvmet_fc_tgt_assoc *
@@ -1132,7 +1147,7 @@ nvmet_fc_alloc_target_assoc(struct nvmet_fc_tgtport *tgtport, void *hosthandle)
assoc->a_id = idx;
INIT_LIST_HEAD(&assoc->a_list);
kref_init(&assoc->ref);
- INIT_WORK(&assoc->del_work, nvmet_fc_delete_assoc);
+ INIT_WORK(&assoc->del_work, nvmet_fc_delete_assoc_work);
atomic_set(&assoc->terminating, 0);
while (needrandom) {
@@ -1491,7 +1506,7 @@ __nvmet_fc_free_assocs(struct nvmet_fc_tgtport *tgtport)
list_for_each_entry_rcu(assoc, &tgtport->assoc_list, a_list) {
if (!nvmet_fc_tgt_a_get(assoc))
continue;
- queue_work(nvmet_wq, &assoc->del_work);
+ nvmet_fc_schedule_delete_assoc(assoc);
nvmet_fc_tgt_a_put(assoc);
}
rcu_read_unlock();
@@ -1545,7 +1560,7 @@ nvmet_fc_invalidate_host(struct nvmet_fc_target_port *target_port,
continue;
assoc->hostport->invalid = 1;
noassoc = false;
- queue_work(nvmet_wq, &assoc->del_work);
+ nvmet_fc_schedule_delete_assoc(assoc);
nvmet_fc_tgt_a_put(assoc);
}
spin_unlock_irqrestore(&tgtport->lock, flags);
@@ -1590,7 +1605,7 @@ nvmet_fc_delete_ctrl(struct nvmet_ctrl *ctrl)
nvmet_fc_tgtport_put(tgtport);
if (found_ctrl) {
- queue_work(nvmet_wq, &assoc->del_work);
+ nvmet_fc_schedule_delete_assoc(assoc);
nvmet_fc_tgt_a_put(assoc);
return;
}
@@ -1897,7 +1912,7 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport,
nvmet_fc_xmt_ls_rsp(tgtport, oldls);
}
- queue_work(nvmet_wq, &assoc->del_work);
+ nvmet_fc_schedule_delete_assoc(assoc);
nvmet_fc_tgt_a_put(assoc);
return false;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 050/245] ext4: correct the hole length returned by ext4_map_blocks()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 049/245] nvmet-fc: take ref count on tgtport before delete assoc Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 051/245] Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table Greg Kroah-Hartman
` (205 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Yi, Jan Kara, Theodore Tso,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <yi.zhang@huawei.com>
[ Upstream commit 6430dea07e85958fa87d0276c0c4388dd51e630b ]
In ext4_map_blocks(), if we can't find a range of mapping in the
extents cache, we are calling ext4_ext_map_blocks() to search the real
path and ext4_ext_determine_hole() to determine the hole range. But if
the querying range was partially or completely overlaped by a delalloc
extent, we can't find it in the real extent path, so the returned hole
length could be incorrect.
Fortunately, ext4_ext_put_gap_in_cache() have already handle delalloc
extent, but it searches start from the expanded hole_start, doesn't
start from the querying range, so the delalloc extent found could not be
the one that overlaped the querying range, plus, it also didn't adjust
the hole length. Let's just remove ext4_ext_put_gap_in_cache(), handle
delalloc and insert adjusted hole extent in ext4_ext_determine_hole().
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Suggested-by: Jan Kara <jack@suse.cz>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20240127015825.1608160-4-yi.zhang@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/extents.c | 111 +++++++++++++++++++++++++++++-----------------
1 file changed, 70 insertions(+), 41 deletions(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 592be39e3d51f..cece004b32d5c 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2227,7 +2227,7 @@ static int ext4_fill_es_cache_info(struct inode *inode,
/*
- * ext4_ext_determine_hole - determine hole around given block
+ * ext4_ext_find_hole - find hole around given block according to the given path
* @inode: inode we lookup in
* @path: path in extent tree to @lblk
* @lblk: pointer to logical block around which we want to determine hole
@@ -2239,9 +2239,9 @@ static int ext4_fill_es_cache_info(struct inode *inode,
* The function returns the length of a hole starting at @lblk. We update @lblk
* to the beginning of the hole if we managed to find it.
*/
-static ext4_lblk_t ext4_ext_determine_hole(struct inode *inode,
- struct ext4_ext_path *path,
- ext4_lblk_t *lblk)
+static ext4_lblk_t ext4_ext_find_hole(struct inode *inode,
+ struct ext4_ext_path *path,
+ ext4_lblk_t *lblk)
{
int depth = ext_depth(inode);
struct ext4_extent *ex;
@@ -2268,30 +2268,6 @@ static ext4_lblk_t ext4_ext_determine_hole(struct inode *inode,
return len;
}
-/*
- * ext4_ext_put_gap_in_cache:
- * calculate boundaries of the gap that the requested block fits into
- * and cache this gap
- */
-static void
-ext4_ext_put_gap_in_cache(struct inode *inode, ext4_lblk_t hole_start,
- ext4_lblk_t hole_len)
-{
- struct extent_status es;
-
- ext4_es_find_extent_range(inode, &ext4_es_is_delayed, hole_start,
- hole_start + hole_len - 1, &es);
- if (es.es_len) {
- /* There's delayed extent containing lblock? */
- if (es.es_lblk <= hole_start)
- return;
- hole_len = min(es.es_lblk - hole_start, hole_len);
- }
- ext_debug(inode, " -> %u:%u\n", hole_start, hole_len);
- ext4_es_insert_extent(inode, hole_start, hole_len, ~0,
- EXTENT_STATUS_HOLE);
-}
-
/*
* ext4_ext_rm_idx:
* removes index from the index block.
@@ -4064,6 +4040,69 @@ static int get_implied_cluster_alloc(struct super_block *sb,
return 0;
}
+/*
+ * Determine hole length around the given logical block, first try to
+ * locate and expand the hole from the given @path, and then adjust it
+ * if it's partially or completely converted to delayed extents, insert
+ * it into the extent cache tree if it's indeed a hole, finally return
+ * the length of the determined extent.
+ */
+static ext4_lblk_t ext4_ext_determine_insert_hole(struct inode *inode,
+ struct ext4_ext_path *path,
+ ext4_lblk_t lblk)
+{
+ ext4_lblk_t hole_start, len;
+ struct extent_status es;
+
+ hole_start = lblk;
+ len = ext4_ext_find_hole(inode, path, &hole_start);
+again:
+ ext4_es_find_extent_range(inode, &ext4_es_is_delayed, hole_start,
+ hole_start + len - 1, &es);
+ if (!es.es_len)
+ goto insert_hole;
+
+ /*
+ * There's a delalloc extent in the hole, handle it if the delalloc
+ * extent is in front of, behind and straddle the queried range.
+ */
+ if (lblk >= es.es_lblk + es.es_len) {
+ /*
+ * The delalloc extent is in front of the queried range,
+ * find again from the queried start block.
+ */
+ len -= lblk - hole_start;
+ hole_start = lblk;
+ goto again;
+ } else if (in_range(lblk, es.es_lblk, es.es_len)) {
+ /*
+ * The delalloc extent containing lblk, it must have been
+ * added after ext4_map_blocks() checked the extent status
+ * tree, adjust the length to the delalloc extent's after
+ * lblk.
+ */
+ len = es.es_lblk + es.es_len - lblk;
+ return len;
+ } else {
+ /*
+ * The delalloc extent is partially or completely behind
+ * the queried range, update hole length until the
+ * beginning of the delalloc extent.
+ */
+ len = min(es.es_lblk - hole_start, len);
+ }
+
+insert_hole:
+ /* Put just found gap into cache to speed up subsequent requests */
+ ext_debug(inode, " -> %u:%u\n", hole_start, len);
+ ext4_es_insert_extent(inode, hole_start, len, ~0, EXTENT_STATUS_HOLE);
+
+ /* Update hole_len to reflect hole size after lblk */
+ if (hole_start != lblk)
+ len -= lblk - hole_start;
+
+ return len;
+}
/*
* Block allocation/map/preallocation routine for extents based files
@@ -4181,22 +4220,12 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
* we couldn't try to create block if create flag is zero
*/
if ((flags & EXT4_GET_BLOCKS_CREATE) == 0) {
- ext4_lblk_t hole_start, hole_len;
+ ext4_lblk_t len;
- hole_start = map->m_lblk;
- hole_len = ext4_ext_determine_hole(inode, path, &hole_start);
- /*
- * put just found gap into cache to speed up
- * subsequent requests
- */
- ext4_ext_put_gap_in_cache(inode, hole_start, hole_len);
+ len = ext4_ext_determine_insert_hole(inode, path, map->m_lblk);
- /* Update hole_len to reflect hole size after map->m_lblk */
- if (hole_start != map->m_lblk)
- hole_len -= map->m_lblk - hole_start;
map->m_pblk = 0;
- map->m_len = min_t(unsigned int, map->m_len, hole_len);
-
+ map->m_len = min_t(unsigned int, map->m_len, len);
goto out;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 051/245] Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 050/245] ext4: correct the hole length returned by ext4_map_blocks() Greg Kroah-Hartman
@ 2024-02-27 13:23 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 052/245] fs/ntfs3: Modified fix directory element type detection Greg Kroah-Hartman
` (204 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Szilard Fabian, Dmitry Torokhov,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Szilard Fabian <szfabian@bluemarch.art>
[ Upstream commit 4255447ad34c5c3785fcdcf76cfa0271d6e5ed39 ]
Another Fujitsu-related patch.
In the initial boot stage the integrated keyboard of Fujitsu Lifebook U728
refuses to work and it's not possible to type for example a dm-crypt
passphrase without the help of an external keyboard.
i8042.nomux kernel parameter resolves this issue but using that a PS/2
mouse is detected. This input device is unused even when the i2c-hid-acpi
kernel module is blacklisted making the integrated ELAN touchpad
(04F3:3092) not working at all.
So this notebook uses a hid-over-i2c touchpad which is managed by the
i2c_designware input driver. Since you can't find a PS/2 mouse port on this
computer and you can't connect a PS/2 mouse to it even with an official
port replicator I think it's safe to not use the PS/2 mouse port at all.
Signed-off-by: Szilard Fabian <szfabian@bluemarch.art>
Link: https://lore.kernel.org/r/20240103014717.127307-2-szfabian@bluemarch.art
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h
index 359d1a287a78e..d4792950bcffd 100644
--- a/drivers/input/serio/i8042-acpipnpio.h
+++ b/drivers/input/serio/i8042-acpipnpio.h
@@ -625,6 +625,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = {
},
.driver_data = (void *)(SERIO_QUIRK_NOAUX)
},
+ {
+ /* Fujitsu Lifebook U728 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U728"),
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOAUX)
+ },
{
/* Gigabyte M912 */
.matches = {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 052/245] fs/ntfs3: Modified fix directory element type detection
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2024-02-27 13:23 ` [PATCH 5.15 051/245] Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 053/245] fs/ntfs3: Improve ntfs_dir_count Greg Kroah-Hartman
` (203 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konstantin Komarov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 22457c047ed971f2f2e33be593ddfabd9639a409 ]
Unfortunately reparse attribute is used for many purposes (several dozens).
It is not possible here to know is this name symlink or not.
To get exactly the type of name we should to open inode (read mft).
getattr for opened file (fstat) correctly returns symlink.
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/dir.c | 30 +++++++++++++++++++++++++-----
1 file changed, 25 insertions(+), 5 deletions(-)
diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
index d4d9f4ffb6d9a..c2fb76bb28f47 100644
--- a/fs/ntfs3/dir.c
+++ b/fs/ntfs3/dir.c
@@ -309,11 +309,31 @@ static inline int ntfs_filldir(struct ntfs_sb_info *sbi, struct ntfs_inode *ni,
return 0;
}
- /* NTFS: symlinks are "dir + reparse" or "file + reparse" */
- if (fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT)
- dt_type = DT_LNK;
- else
- dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG;
+ /*
+ * NTFS: symlinks are "dir + reparse" or "file + reparse"
+ * Unfortunately reparse attribute is used for many purposes (several dozens).
+ * It is not possible here to know is this name symlink or not.
+ * To get exactly the type of name we should to open inode (read mft).
+ * getattr for opened file (fstat) correctly returns symlink.
+ */
+ dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG;
+
+ /*
+ * It is not reliable to detect the type of name using duplicated information
+ * stored in parent directory.
+ * The only correct way to get the type of name - read MFT record and find ATTR_STD.
+ * The code below is not good idea.
+ * It does additional locks/reads just to get the type of name.
+ * Should we use additional mount option to enable branch below?
+ */
+ if ((fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) &&
+ ino != ni->mi.rno) {
+ struct inode *inode = ntfs_iget5(sbi->sb, &e->ref, NULL);
+ if (!IS_ERR_OR_NULL(inode)) {
+ dt_type = fs_umode_to_dtype(inode->i_mode);
+ iput(inode);
+ }
+ }
return !dir_emit(ctx, (s8 *)name, name_len, ino, dt_type);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 053/245] fs/ntfs3: Improve ntfs_dir_count
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 052/245] fs/ntfs3: Modified fix directory element type detection Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 054/245] fs/ntfs3: Correct hard links updating when dealing with DOS names Greg Kroah-Hartman
` (202 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konstantin Komarov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 6a799c928b78b14999b7705c4cca0f88e297fe96 ]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/dir.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
index c2fb76bb28f47..72cdfa8727d3c 100644
--- a/fs/ntfs3/dir.c
+++ b/fs/ntfs3/dir.c
@@ -515,11 +515,9 @@ static int ntfs_dir_count(struct inode *dir, bool *is_empty, size_t *dirs,
struct INDEX_HDR *hdr;
const struct ATTR_FILE_NAME *fname;
u32 e_size, off, end;
- u64 vbo = 0;
size_t drs = 0, fles = 0, bit = 0;
- loff_t i_size = ni->vfs_inode.i_size;
struct indx_node *node = NULL;
- u8 index_bits = ni->dir.index_bits;
+ size_t max_indx = ni->vfs_inode.i_size >> ni->dir.index_bits;
if (is_empty)
*is_empty = true;
@@ -563,7 +561,7 @@ static int ntfs_dir_count(struct inode *dir, bool *is_empty, size_t *dirs,
fles += 1;
}
- if (vbo >= i_size)
+ if (bit >= max_indx)
goto out;
err = indx_used_bit(&ni->dir, ni, &bit);
@@ -573,8 +571,7 @@ static int ntfs_dir_count(struct inode *dir, bool *is_empty, size_t *dirs,
if (bit == MINUS_ONE_T)
goto out;
- vbo = (u64)bit << index_bits;
- if (vbo >= i_size)
+ if (bit >= max_indx)
goto out;
err = indx_read(&ni->dir, ni, bit << ni->dir.idx2vbn_bits,
@@ -584,7 +581,6 @@ static int ntfs_dir_count(struct inode *dir, bool *is_empty, size_t *dirs,
hdr = &node->index->ihdr;
bit += 1;
- vbo = (u64)bit << ni->dir.idx2vbn_bits;
}
out:
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 054/245] fs/ntfs3: Correct hard links updating when dealing with DOS names
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 053/245] fs/ntfs3: Improve ntfs_dir_count Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 055/245] fs/ntfs3: Print warning while fixing hard links count Greg Kroah-Hartman
` (201 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konstantin Komarov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 1918c10e137eae266b8eb0ab1cc14421dcb0e3e2 ]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/record.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 938fc286963f2..ac43e4a6d57d1 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -509,8 +509,20 @@ bool mi_remove_attr(struct ntfs_inode *ni, struct mft_inode *mi,
return false;
if (ni && is_attr_indexed(attr)) {
- le16_add_cpu(&ni->mi.mrec->hard_links, -1);
- ni->mi.dirty = true;
+ u16 links = le16_to_cpu(ni->mi.mrec->hard_links);
+ struct ATTR_FILE_NAME *fname =
+ attr->type != ATTR_NAME ?
+ NULL :
+ resident_data_ex(attr,
+ SIZEOF_ATTRIBUTE_FILENAME);
+ if (fname && fname->type == FILE_NAME_DOS) {
+ /* Do not decrease links count deleting DOS name. */
+ } else if (!links) {
+ /* minor error. Not critical. */
+ } else {
+ ni->mi.mrec->hard_links = cpu_to_le16(links - 1);
+ ni->mi.dirty = true;
+ }
}
used -= asize;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 055/245] fs/ntfs3: Print warning while fixing hard links count
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 054/245] fs/ntfs3: Correct hard links updating when dealing with DOS names Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 056/245] fs/ntfs3: Fix detected field-spanning write (size 8) of single field "le->name" Greg Kroah-Hartman
` (200 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konstantin Komarov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 85ba2a75faee759809a7e43b4c103ac59bac1026 ]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 176b04a5d1adb..0ff673bb4b2be 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -402,7 +402,6 @@ static struct inode *ntfs_read_mft(struct inode *inode,
goto out;
if (!is_match && name) {
- /* Reuse rec as buffer for ascii name. */
err = -ENOENT;
goto out;
}
@@ -417,6 +416,7 @@ static struct inode *ntfs_read_mft(struct inode *inode,
if (names != le16_to_cpu(rec->hard_links)) {
/* Correct minor error on the fly. Do not mark inode as dirty. */
+ ntfs_inode_warn(inode, "Correct links count -> %u.", names);
rec->hard_links = cpu_to_le16(names);
ni->mi.dirty = true;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 056/245] fs/ntfs3: Fix detected field-spanning write (size 8) of single field "le->name"
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 055/245] fs/ntfs3: Print warning while fixing hard links count Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 057/245] fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() Greg Kroah-Hartman
` (199 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konstantin Komarov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit d155617006ebc172a80d3eb013c4b867f9a8ada4 ]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/ntfs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h
index 0f38d558169a1..8b580515b1d6e 100644
--- a/fs/ntfs3/ntfs.h
+++ b/fs/ntfs3/ntfs.h
@@ -517,7 +517,7 @@ struct ATTR_LIST_ENTRY {
__le64 vcn; // 0x08: Starting VCN of this attribute.
struct MFT_REF ref; // 0x10: MFT record number with attribute.
__le16 id; // 0x18: struct ATTRIB ID.
- __le16 name[3]; // 0x1A: Just to align. To get real name can use bNameOffset.
+ __le16 name[]; // 0x1A: Just to align. To get real name can use name_off.
}; // sizeof(0x20)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 057/245] fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 056/245] fs/ntfs3: Fix detected field-spanning write (size 8) of single field "le->name" Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 058/245] fs/ntfs3: Disable ATTR_LIST_ENTRY size check Greg Kroah-Hartman
` (198 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konstantin Komarov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit aaab47f204aaf47838241d57bf8662c8840de60a ]
It is preferable to exit through the out: label because
internal debugging functions are located there.
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/attrib.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index 1d5ac2164d94f..64a6d255c4686 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -1583,8 +1583,10 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size,
le_b = NULL;
attr_b = ni_find_attr(ni, NULL, &le_b, ATTR_DATA, NULL,
0, NULL, &mi_b);
- if (!attr_b)
- return -ENOENT;
+ if (!attr_b) {
+ err = -ENOENT;
+ goto out;
+ }
attr = attr_b;
le = le_b;
@@ -1665,13 +1667,15 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size,
ok:
run_truncate_around(run, vcn);
out:
- if (new_valid > data_size)
- new_valid = data_size;
+ if (attr_b) {
+ if (new_valid > data_size)
+ new_valid = data_size;
- valid_size = le64_to_cpu(attr_b->nres.valid_size);
- if (new_valid != valid_size) {
- attr_b->nres.valid_size = cpu_to_le64(valid_size);
- mi_b->dirty = true;
+ valid_size = le64_to_cpu(attr_b->nres.valid_size);
+ if (new_valid != valid_size) {
+ attr_b->nres.valid_size = cpu_to_le64(valid_size);
+ mi_b->dirty = true;
+ }
}
return err;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 058/245] fs/ntfs3: Disable ATTR_LIST_ENTRY size check
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 057/245] fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 059/245] fs/ntfs3: use non-movable memory for ntfs3 MFT buffer cache Greg Kroah-Hartman
` (197 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
Konstantin Komarov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 4cdfb6e7bc9c80142d33bf1d4653a73fa678ba56 ]
The use of sizeof(struct ATTR_LIST_ENTRY) has been replaced with le_size(0)
due to alignment peculiarities on different platforms.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202312071005.g6YrbaIe-lkp@intel.com/
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/attrlist.c | 8 ++++----
fs/ntfs3/ntfs.h | 2 --
2 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c
index 0c6a68e71e7d4..723e49ec83ce7 100644
--- a/fs/ntfs3/attrlist.c
+++ b/fs/ntfs3/attrlist.c
@@ -127,12 +127,13 @@ struct ATTR_LIST_ENTRY *al_enumerate(struct ntfs_inode *ni,
{
size_t off;
u16 sz;
+ const unsigned le_min_size = le_size(0);
if (!le) {
le = ni->attr_list.le;
} else {
sz = le16_to_cpu(le->size);
- if (sz < sizeof(struct ATTR_LIST_ENTRY)) {
+ if (sz < le_min_size) {
/* Impossible 'cause we should not return such le. */
return NULL;
}
@@ -141,7 +142,7 @@ struct ATTR_LIST_ENTRY *al_enumerate(struct ntfs_inode *ni,
/* Check boundary. */
off = PtrOffset(ni->attr_list.le, le);
- if (off + sizeof(struct ATTR_LIST_ENTRY) > ni->attr_list.size) {
+ if (off + le_min_size > ni->attr_list.size) {
/* The regular end of list. */
return NULL;
}
@@ -149,8 +150,7 @@ struct ATTR_LIST_ENTRY *al_enumerate(struct ntfs_inode *ni,
sz = le16_to_cpu(le->size);
/* Check le for errors. */
- if (sz < sizeof(struct ATTR_LIST_ENTRY) ||
- off + sz > ni->attr_list.size ||
+ if (sz < le_min_size || off + sz > ni->attr_list.size ||
sz < le->name_off + le->name_len * sizeof(short)) {
return NULL;
}
diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h
index 8b580515b1d6e..ba26a465b3091 100644
--- a/fs/ntfs3/ntfs.h
+++ b/fs/ntfs3/ntfs.h
@@ -521,8 +521,6 @@ struct ATTR_LIST_ENTRY {
}; // sizeof(0x20)
-static_assert(sizeof(struct ATTR_LIST_ENTRY) == 0x20);
-
static inline u32 le_size(u8 name_len)
{
return ALIGN(offsetof(struct ATTR_LIST_ENTRY, name) +
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 059/245] fs/ntfs3: use non-movable memory for ntfs3 MFT buffer cache
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 058/245] fs/ntfs3: Disable ATTR_LIST_ENTRY size check Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 060/245] fs/ntfs3: Prevent generic message "attempt to access beyond end of device" Greg Kroah-Hartman
` (196 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ism Hong, Konstantin Komarov,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ism Hong <ism.hong@gmail.com>
[ Upstream commit d6d33f03baa43d763fe094ca926eeae7d3421d07 ]
Since the buffer cache for ntfs3 metadata is not released until the file
system is unmounted, allocating from the movable zone may result in cma
allocation failures. This is due to the page still being used by ntfs3,
leading to migration failures.
To address this, this commit use sb_bread_umovable() instead of
sb_bread(). This change prevents allocation from the movable zone,
ensuring compatibility with scenarios where the buffer head is not
released until unmount. This patch is inspired by commit
a8ac900b8163("ext4: use non-movable memory for the ext4 superblock").
The issue is found when playing video files stored in NTFS on the
Android TV platform. During this process, the media parser reads the
video file, causing ntfs3 to allocate buffer cache from the CMA area.
Subsequently, the hardware decoder attempts to allocate memory from the
same CMA area. However, the page is still in use by ntfs3, resulting in
a migrate failure in alloc_contig_range().
The pinned page and allocating stacktrace reported by page owner shows
below:
page:ffffffff00b68880 refcount:3 mapcount:0 mapping:ffffff80046aa828
index:0xc0040 pfn:0x20fa4
aops:def_blk_aops ino:0
flags: 0x2020(active|private)
page dumped because: migration failure
page last allocated via order 0, migratetype Movable,
gfp_mask 0x108c48
(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE),
page_owner tracks the page as allocated
prep_new_page
get_page_from_freelist
__alloc_pages_nodemask
pagecache_get_page
__getblk_gfp
__bread_gfp
ntfs_read_run_nb
ntfs_read_bh
mi_read
ntfs_iget5
dir_search_u
ntfs_lookup
__lookup_slow
lookup_slow
walk_component
path_lookupat
Signed-off-by: Ism Hong <ism.hong@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/ntfs_fs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
index 9812765000439..ffc8dfbb310ff 100644
--- a/fs/ntfs3/ntfs_fs.h
+++ b/fs/ntfs3/ntfs_fs.h
@@ -1014,7 +1014,7 @@ static inline u64 bytes_to_block(const struct super_block *sb, u64 size)
static inline struct buffer_head *ntfs_bread(struct super_block *sb,
sector_t block)
{
- struct buffer_head *bh = sb_bread(sb, block);
+ struct buffer_head *bh = sb_bread_unmovable(sb, block);
if (bh)
return bh;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 060/245] fs/ntfs3: Prevent generic message "attempt to access beyond end of device"
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 059/245] fs/ntfs3: use non-movable memory for ntfs3 MFT buffer cache Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 061/245] fs/ntfs3: Correct function is_rst_area_valid Greg Kroah-Hartman
` (195 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konstantin Komarov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 5ca87d01eba7bdfe9536a157ca33c1455bb8d16c ]
It used in test environment.
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fsntfs.c | 24 ++++++++++++++++++++++++
fs/ntfs3/ntfs_fs.h | 14 +-------------
2 files changed, 25 insertions(+), 13 deletions(-)
diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
index 110690edbf621..1b082b7a67ee2 100644
--- a/fs/ntfs3/fsntfs.c
+++ b/fs/ntfs3/fsntfs.c
@@ -981,6 +981,30 @@ static inline __le32 security_hash(const void *sd, size_t bytes)
return cpu_to_le32(hash);
}
+/*
+ * simple wrapper for sb_bread_unmovable.
+ */
+struct buffer_head *ntfs_bread(struct super_block *sb, sector_t block)
+{
+ struct ntfs_sb_info *sbi = sb->s_fs_info;
+ struct buffer_head *bh;
+
+ if (unlikely(block >= sbi->volume.blocks)) {
+ /* prevent generic message "attempt to access beyond end of device" */
+ ntfs_err(sb, "try to read out of volume at offset 0x%llx",
+ (u64)block << sb->s_blocksize_bits);
+ return NULL;
+ }
+
+ bh = sb_bread_unmovable(sb, block);
+ if (bh)
+ return bh;
+
+ ntfs_err(sb, "failed to read volume at offset 0x%llx",
+ (u64)block << sb->s_blocksize_bits);
+ return NULL;
+}
+
int ntfs_sb_read(struct super_block *sb, u64 lbo, size_t bytes, void *buffer)
{
struct block_device *bdev = sb->s_bdev;
diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
index ffc8dfbb310ff..12a3b41d351c9 100644
--- a/fs/ntfs3/ntfs_fs.h
+++ b/fs/ntfs3/ntfs_fs.h
@@ -581,6 +581,7 @@ bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes);
int log_replay(struct ntfs_inode *ni, bool *initialized);
/* Globals from fsntfs.c */
+struct buffer_head *ntfs_bread(struct super_block *sb, sector_t block);
bool ntfs_fix_pre_write(struct NTFS_RECORD_HEADER *rhdr, size_t bytes);
int ntfs_fix_post_read(struct NTFS_RECORD_HEADER *rhdr, size_t bytes,
bool simple);
@@ -1011,19 +1012,6 @@ static inline u64 bytes_to_block(const struct super_block *sb, u64 size)
return (size + sb->s_blocksize - 1) >> sb->s_blocksize_bits;
}
-static inline struct buffer_head *ntfs_bread(struct super_block *sb,
- sector_t block)
-{
- struct buffer_head *bh = sb_bread_unmovable(sb, block);
-
- if (bh)
- return bh;
-
- ntfs_err(sb, "failed to read volume at offset 0x%llx",
- (u64)block << sb->s_blocksize_bits);
- return NULL;
-}
-
static inline struct ntfs_inode *ntfs_i(struct inode *inode)
{
return container_of(inode, struct ntfs_inode, vfs_inode);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 061/245] fs/ntfs3: Correct function is_rst_area_valid
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 060/245] fs/ntfs3: Prevent generic message "attempt to access beyond end of device" Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 062/245] fs/ntfs3: Update inode->i_size after success write into compressed file Greg Kroah-Hartman
` (194 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Morris, Konstantin Komarov,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 1b7dd28e14c4728ae1a815605ca33ffb4ce1b309 ]
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fslog.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 8b95c06e5a4c5..6ba1357f3ed4c 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -465,7 +465,7 @@ static inline bool is_rst_area_valid(const struct RESTART_HDR *rhdr)
{
const struct RESTART_AREA *ra;
u16 cl, fl, ul;
- u32 off, l_size, file_dat_bits, file_size_round;
+ u32 off, l_size, seq_bits;
u16 ro = le16_to_cpu(rhdr->ra_off);
u32 sys_page = le32_to_cpu(rhdr->sys_page_size);
@@ -511,13 +511,15 @@ static inline bool is_rst_area_valid(const struct RESTART_HDR *rhdr)
/* Make sure the sequence number bits match the log file size. */
l_size = le64_to_cpu(ra->l_size);
- file_dat_bits = sizeof(u64) * 8 - le32_to_cpu(ra->seq_num_bits);
- file_size_round = 1u << (file_dat_bits + 3);
- if (file_size_round != l_size &&
- (file_size_round < l_size || (file_size_round / 2) > l_size)) {
- return false;
+ seq_bits = sizeof(u64) * 8 + 3;
+ while (l_size) {
+ l_size >>= 1;
+ seq_bits -= 1;
}
+ if (seq_bits != ra->seq_num_bits)
+ return false;
+
/* The log page data offset and record header length must be quad-aligned. */
if (!IS_ALIGNED(le16_to_cpu(ra->data_off), 8) ||
!IS_ALIGNED(le16_to_cpu(ra->rec_hdr_len), 8))
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 062/245] fs/ntfs3: Update inode->i_size after success write into compressed file
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 061/245] fs/ntfs3: Correct function is_rst_area_valid Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 063/245] fs/ntfs3: Fix oob in ntfs_listxattr Greg Kroah-Hartman
` (193 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Giovanni Santini, Konstantin Komarov,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit d68968440b1a75dee05cfac7f368f1aa139e1911 ]
Reported-by: Giovanni Santini <giovannisantini93@yahoo.it>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/file.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c
index c526e0427f2bf..6d4f3431bc75a 100644
--- a/fs/ntfs3/file.c
+++ b/fs/ntfs3/file.c
@@ -1090,6 +1090,8 @@ static ssize_t ntfs_compress_write(struct kiocb *iocb, struct iov_iter *from)
iocb->ki_pos += written;
if (iocb->ki_pos > ni->i_valid)
ni->i_valid = iocb->ki_pos;
+ if (iocb->ki_pos > i_size)
+ i_size_write(inode, iocb->ki_pos);
return written;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 063/245] fs/ntfs3: Fix oob in ntfs_listxattr
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 062/245] fs/ntfs3: Update inode->i_size after success write into compressed file Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 064/245] wifi: mac80211: adding missing drv_mgd_complete_tx() call Greg Kroah-Hartman
` (192 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Edward Adam Davis,
Konstantin Komarov, Sasha Levin, syzbot+65e940cfb8f99a97aca7
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <eadavis@qq.com>
[ Upstream commit 731ab1f9828800df871c5a7ab9ffe965317d3f15 ]
The length of name cannot exceed the space occupied by ea.
Reported-and-tested-by: syzbot+65e940cfb8f99a97aca7@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/xattr.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
index 8e739023e3057..d0b75d7f58a7b 100644
--- a/fs/ntfs3/xattr.c
+++ b/fs/ntfs3/xattr.c
@@ -217,6 +217,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer,
if (!ea->name_len)
break;
+ if (ea->name_len > ea_size)
+ break;
+
if (buffer) {
/* Check if we can use field ea->name */
if (off + ea_size > size)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 064/245] wifi: mac80211: adding missing drv_mgd_complete_tx() call
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 063/245] fs/ntfs3: Fix oob in ntfs_listxattr Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 065/245] efi: runtime: Fix potential overflow of soft-reserved region size Greg Kroah-Hartman
` (191 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johannes Berg, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit c042600c17d8c490279f0ae2baee29475fe8047d ]
There's a call to drv_mgd_prepare_tx() and so there should
be one to drv_mgd_complete_tx(), but on this path it's not.
Add it.
Link: https://msgid.link/20240131164824.2f0922a514e1.I5aac89b93bcead88c374187d70cad0599d29d2c8@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mlme.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index cc6d38a2e6d5a..5da0c2a2e293e 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -5923,6 +5923,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
ieee80211_report_disconnect(sdata, frame_buf,
sizeof(frame_buf), true,
req->reason_code, false);
+ drv_mgd_complete_tx(sdata->local, sdata, &info);
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 065/245] efi: runtime: Fix potential overflow of soft-reserved region size
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 064/245] wifi: mac80211: adding missing drv_mgd_complete_tx() call Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 066/245] efi: Dont add memblocks for soft-reserved memory Greg Kroah-Hartman
` (190 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Bresticker, Ard Biesheuvel,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Bresticker <abrestic@rivosinc.com>
[ Upstream commit de1034b38a346ef6be25fe8792f5d1e0684d5ff4 ]
md_size will have been narrowed if we have >= 4GB worth of pages in a
soft-reserved region.
Signed-off-by: Andrew Bresticker <abrestic@rivosinc.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/arm-runtime.c | 2 +-
drivers/firmware/efi/riscv-runtime.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
index 3359ae2adf24b..9054c2852580d 100644
--- a/drivers/firmware/efi/arm-runtime.c
+++ b/drivers/firmware/efi/arm-runtime.c
@@ -107,7 +107,7 @@ static int __init arm_enable_runtime_services(void)
efi_memory_desc_t *md;
for_each_efi_memory_desc(md) {
- int md_size = md->num_pages << EFI_PAGE_SHIFT;
+ u64 md_size = md->num_pages << EFI_PAGE_SHIFT;
struct resource *res;
if (!(md->attribute & EFI_MEMORY_SP))
diff --git a/drivers/firmware/efi/riscv-runtime.c b/drivers/firmware/efi/riscv-runtime.c
index d28e715d2bcc8..6711e64eb0b16 100644
--- a/drivers/firmware/efi/riscv-runtime.c
+++ b/drivers/firmware/efi/riscv-runtime.c
@@ -85,7 +85,7 @@ static int __init riscv_enable_runtime_services(void)
efi_memory_desc_t *md;
for_each_efi_memory_desc(md) {
- int md_size = md->num_pages << EFI_PAGE_SHIFT;
+ u64 md_size = md->num_pages << EFI_PAGE_SHIFT;
struct resource *res;
if (!(md->attribute & EFI_MEMORY_SP))
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 066/245] efi: Dont add memblocks for soft-reserved memory
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 065/245] efi: runtime: Fix potential overflow of soft-reserved region size Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 067/245] hwmon: (coretemp) Enlarge per package core count limit Greg Kroah-Hartman
` (189 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Bresticker, Ard Biesheuvel,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Bresticker <abrestic@rivosinc.com>
[ Upstream commit 0bcff59ef7a652fcdc6d535554b63278c2406c8f ]
Adding memblocks for soft-reserved regions prevents them from later being
hotplugged in by dax_kmem.
Signed-off-by: Andrew Bresticker <abrestic@rivosinc.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/efi-init.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/firmware/efi/efi-init.c b/drivers/firmware/efi/efi-init.c
index b2c829e95bd14..4639ac6e4f9af 100644
--- a/drivers/firmware/efi/efi-init.c
+++ b/drivers/firmware/efi/efi-init.c
@@ -141,15 +141,6 @@ static __init int is_usable_memory(efi_memory_desc_t *md)
case EFI_BOOT_SERVICES_DATA:
case EFI_CONVENTIONAL_MEMORY:
case EFI_PERSISTENT_MEMORY:
- /*
- * Special purpose memory is 'soft reserved', which means it
- * is set aside initially, but can be hotplugged back in or
- * be assigned to the dax driver after boot.
- */
- if (efi_soft_reserve_enabled() &&
- (md->attribute & EFI_MEMORY_SP))
- return false;
-
/*
* According to the spec, these regions are no longer reserved
* after calling ExitBootServices(). However, we can only use
@@ -194,6 +185,16 @@ static __init void reserve_regions(void)
size = npages << PAGE_SHIFT;
if (is_memory(md)) {
+ /*
+ * Special purpose memory is 'soft reserved', which
+ * means it is set aside initially. Don't add a memblock
+ * for it now so that it can be hotplugged back in or
+ * be assigned to the dax driver after boot.
+ */
+ if (efi_soft_reserve_enabled() &&
+ (md->attribute & EFI_MEMORY_SP))
+ continue;
+
early_init_dt_add_memory_arch(paddr, size);
if (!is_usable_memory(md))
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 067/245] hwmon: (coretemp) Enlarge per package core count limit
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 066/245] efi: Dont add memblocks for soft-reserved memory Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 068/245] scsi: lpfc: Use unsigned type for num_sge Greg Kroah-Hartman
` (188 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhang Rui, Guenter Roeck,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <rui.zhang@intel.com>
[ Upstream commit 34cf8c657cf0365791cdc658ddbca9cc907726ce ]
Currently, coretemp driver supports only 128 cores per package.
This loses some core temperature information on systems that have more
than 128 cores per package.
[ 58.685033] coretemp coretemp.0: Adding Core 128 failed
[ 58.692009] coretemp coretemp.0: Adding Core 129 failed
...
Enlarge the limitation to 512 because there are platforms with more than
256 cores per package.
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Link: https://lore.kernel.org/r/20240202092144.71180-4-rui.zhang@intel.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/coretemp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index d67d972d18aa2..cbe2f874b5e2f 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -40,7 +40,7 @@ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
#define PKG_SYSFS_ATTR_NO 1 /* Sysfs attribute for package temp */
#define BASE_SYSFS_ATTR_NO 2 /* Sysfs Base attr no for coretemp */
-#define NUM_REAL_CORES 128 /* Number of Real cores per cpu */
+#define NUM_REAL_CORES 512 /* Number of Real cores per cpu */
#define CORETEMP_NAME_LENGTH 28 /* String Length of attrs */
#define MAX_CORE_ATTRS 4 /* Maximum no of basic attrs */
#define TOTAL_ATTRS (MAX_CORE_ATTRS + 1)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 068/245] scsi: lpfc: Use unsigned type for num_sge
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 067/245] hwmon: (coretemp) Enlarge per package core count limit Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 069/245] firewire: core: send bus reset promptly on gap count error Greg Kroah-Hartman
` (187 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Daniel Wagner,
Martin K. Petersen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <hare@suse.de>
[ Upstream commit d6c1b19153f92e95e5e1801d540e98771053afae ]
LUNs going into "failed ready running" state observed on >1T and on even
numbers of size (2T, 4T, 6T, 8T and 10T). The issue occurs when DIF is
enabled at the host.
The kernel logs:
Cannot setup S/G List for HBAIO segs 1/1 SGL 512 SCSI 256: 3 0
The host lpfc driver is failing to setup scatter/gather list (protection
data) for the I/Os.
The return type lpfc_bg_setup_sgl()/lpfc_bg_setup_sgl_prot() causes the
compiler to remove the most significant bit. Use an unsigned type instead.
Signed-off-by: Hannes Reinecke <hare@suse.de>
[dwagner: added commit message]
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Link: https://lore.kernel.org/r/20231220162658.12392-1-dwagner@suse.de
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_scsi.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index 4813adec0301d..6d1a3cbd6b3c4 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -1983,7 +1983,7 @@ lpfc_bg_setup_bpl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc,
*
* Returns the number of SGEs added to the SGL.
**/
-static int
+static uint32_t
lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc,
struct sli4_sge *sgl, int datasegcnt,
struct lpfc_io_buf *lpfc_cmd)
@@ -1991,8 +1991,8 @@ lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc,
struct scatterlist *sgde = NULL; /* s/g data entry */
struct sli4_sge_diseed *diseed = NULL;
dma_addr_t physaddr;
- int i = 0, num_sge = 0, status;
- uint32_t reftag;
+ int i = 0, status;
+ uint32_t reftag, num_sge = 0;
uint8_t txop, rxop;
#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
uint32_t rc;
@@ -2164,7 +2164,7 @@ lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc,
*
* Returns the number of SGEs added to the SGL.
**/
-static int
+static uint32_t
lpfc_bg_setup_sgl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc,
struct sli4_sge *sgl, int datacnt, int protcnt,
struct lpfc_io_buf *lpfc_cmd)
@@ -2188,8 +2188,8 @@ lpfc_bg_setup_sgl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc,
uint32_t rc;
#endif
uint32_t checking = 1;
- uint32_t dma_offset = 0;
- int num_sge = 0, j = 2;
+ uint32_t dma_offset = 0, num_sge = 0;
+ int j = 2;
struct sli4_hybrid_sgl *sgl_xtra = NULL;
sgpe = scsi_prot_sglist(sc);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 069/245] firewire: core: send bus reset promptly on gap count error
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 068/245] scsi: lpfc: Use unsigned type for num_sge Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 070/245] drm/amdgpu: skip to program GFXDEC registers for suspend abort Greg Kroah-Hartman
` (186 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adam Goldman, Takashi Sakamoto,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
[ Upstream commit 7ed4380009e96d9e9c605e12822e987b35b05648 ]
If we are bus manager and the bus has inconsistent gap counts, send a
bus reset immediately instead of trying to read the root node's config
ROM first. Otherwise, we could spend a lot of time trying to read the
config ROM but never succeeding.
This eliminates a 50+ second delay before the FireWire bus is usable after
a newly connected device is powered on in certain circumstances.
The delay occurs if a gap count inconsistency occurs, we are not the root
node, and we become bus manager. One scenario that causes this is with a TI
XIO2213B OHCI, the first time a Sony DSR-25 is powered on after being
connected to the FireWire cable. In this configuration, the Linux box will
not receive the initial PHY configuration packet sent by the DSR-25 as IRM,
resulting in the DSR-25 having a gap count of 44 while the Linux box has a
gap count of 63.
FireWire devices have a gap count parameter, which is set to 63 on power-up
and can be changed with a PHY configuration packet. This determines the
duration of the subaction and arbitration gaps. For reliable communication,
all nodes on a FireWire bus must have the same gap count.
A node may have zero or more of the following roles: root node, bus manager
(BM), isochronous resource manager (IRM), and cycle master. Unless a root
node was forced with a PHY configuration packet, any node might become root
node after a bus reset. Only the root node can become cycle master. If the
root node is not cycle master capable, the BM or IRM should force a change
of root node.
After a bus reset, each node sends a self-ID packet, which contains its
current gap count. A single bus reset does not change the gap count, but
two bus resets in a row will set the gap count to 63. Because a consistent
gap count is required for reliable communication, IEEE 1394a-2000 requires
that the bus manager generate a bus reset if it detects that the gap count
is inconsistent.
When the gap count is inconsistent, build_tree() will notice this after the
self identification process. It will set card->gap_count to the invalid
value 0. If we become bus master, this will force bm_work() to send a bus
reset when it performs gap count optimization.
After a bus reset, there is no bus manager. We will almost always try to
become bus manager. Once we become bus manager, we will first determine
whether the root node is cycle master capable. Then, we will determine if
the gap count should be changed. If either the root node or the gap count
should be changed, we will generate a bus reset.
To determine if the root node is cycle master capable, we read its
configuration ROM. bm_work() will wait until we have finished trying to
read the configuration ROM.
However, an inconsistent gap count can make this take a long time.
read_config_rom() will read the first few quadlets from the config ROM. Due
to the gap count inconsistency, eventually one of the reads will time out.
When read_config_rom() fails, fw_device_init() calls it again until
MAX_RETRIES is reached. This takes 50+ seconds.
Once we give up trying to read the configuration ROM, bm_work() will wake
up, assume that the root node is not cycle master capable, and do a bus
reset. Hopefully, this will resolve the gap count inconsistency.
This change makes bm_work() check for an inconsistent gap count before
waiting for the root node's configuration ROM. If the gap count is
inconsistent, bm_work() will immediately do a bus reset. This eliminates
the 50+ second delay and rapidly brings the bus to a working state.
I considered that if the gap count is inconsistent, a PHY configuration
packet might not be successful, so it could be desirable to skip the PHY
configuration packet before the bus reset in this case. However, IEEE
1394a-2000 and IEEE 1394-2008 say that the bus manager may transmit a PHY
configuration packet before a bus reset when correcting a gap count error.
Since the standard endorses this, I decided it's safe to retain the PHY
configuration packet transmission.
Normally, after a topology change, we will reset the bus a maximum of 5
times to change the root node and perform gap count optimization. However,
if there is a gap count inconsistency, we must always generate a bus reset.
Otherwise the gap count inconsistency will persist and communication will
be unreliable. For that reason, if there is a gap count inconstency, we
generate a bus reset even if we already reached the 5 reset limit.
Signed-off-by: Adam Goldman <adamg@pobox.com>
Reference: https://sourceforge.net/p/linux1394/mailman/message/58727806/
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firewire/core-card.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
index f3b3953cac834..be195ba834632 100644
--- a/drivers/firewire/core-card.c
+++ b/drivers/firewire/core-card.c
@@ -429,7 +429,23 @@ static void bm_work(struct work_struct *work)
*/
card->bm_generation = generation;
- if (root_device == NULL) {
+ if (card->gap_count == 0) {
+ /*
+ * If self IDs have inconsistent gap counts, do a
+ * bus reset ASAP. The config rom read might never
+ * complete, so don't wait for it. However, still
+ * send a PHY configuration packet prior to the
+ * bus reset. The PHY configuration packet might
+ * fail, but 1394-2008 8.4.5.2 explicitly permits
+ * it in this case, so it should be safe to try.
+ */
+ new_root_id = local_id;
+ /*
+ * We must always send a bus reset if the gap count
+ * is inconsistent, so bypass the 5-reset limit.
+ */
+ card->bm_retries = 0;
+ } else if (root_device == NULL) {
/*
* Either link_on is false, or we failed to read the
* config rom. In either case, pick another root.
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 070/245] drm/amdgpu: skip to program GFXDEC registers for suspend abort
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 069/245] firewire: core: send bus reset promptly on gap count error Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 071/245] drm/amdgpu: reset gpu for s3 suspend abort case Greg Kroah-Hartman
` (185 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Prike Liang, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prike Liang <Prike.Liang@amd.com>
[ Upstream commit 93bafa32a6918154aa0caf9f66679a32c2431357 ]
In the suspend abort cases, the gfx power rail doesn't turn off so
some GFXDEC registers/CSB can't reset to default value and at this
moment reinitialize GFXDEC/CSB will result in an unexpected error.
So let skip those program sequence for the suspend abort case.
Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 ++
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 ++
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 8 ++++++++
3 files changed, 12 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 1f1e7966beb51..dbef22f56482e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1045,6 +1045,8 @@ struct amdgpu_device {
bool in_s3;
bool in_s4;
bool in_s0ix;
+ /* indicate amdgpu suspension status */
+ bool suspend_complete;
atomic_t in_gpu_reset;
enum pp_mp1_state mp1_state;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index deae92fde3b88..57943e9008710 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -2252,6 +2252,7 @@ static int amdgpu_pmops_suspend(struct device *dev)
struct drm_device *drm_dev = dev_get_drvdata(dev);
struct amdgpu_device *adev = drm_to_adev(drm_dev);
+ adev->suspend_complete = false;
if (amdgpu_acpi_is_s0ix_active(adev))
adev->in_s0ix = true;
else
@@ -2264,6 +2265,7 @@ static int amdgpu_pmops_suspend_noirq(struct device *dev)
struct drm_device *drm_dev = dev_get_drvdata(dev);
struct amdgpu_device *adev = drm_to_adev(drm_dev);
+ adev->suspend_complete = true;
if (amdgpu_acpi_should_gpu_reset(adev))
return amdgpu_asic_reset(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index de1fab165041f..fb37c0d4b35b4 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -3268,6 +3268,14 @@ static int gfx_v9_0_cp_gfx_start(struct amdgpu_device *adev)
gfx_v9_0_cp_gfx_enable(adev, true);
+ /* Now only limit the quirk on the APU gfx9 series and already
+ * confirmed that the APU gfx10/gfx11 needn't such update.
+ */
+ if (adev->flags & AMD_IS_APU &&
+ adev->in_s3 && !adev->suspend_complete) {
+ DRM_INFO(" Will skip the CSB packet resubmit\n");
+ return 0;
+ }
r = amdgpu_ring_alloc(ring, gfx_v9_0_get_csb_size(adev) + 4 + 3);
if (r) {
DRM_ERROR("amdgpu: cp failed to lock ring (%d).\n", r);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 071/245] drm/amdgpu: reset gpu for s3 suspend abort case
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 070/245] drm/amdgpu: skip to program GFXDEC registers for suspend abort Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 072/245] virtio-blk: Ensure no requests in virtqueues before deleting vqs Greg Kroah-Hartman
` (184 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Prike Liang, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prike Liang <Prike.Liang@amd.com>
[ Upstream commit 6ef82ac664bb9568ca3956e0d9c9c478e25077ff ]
In the s3 suspend abort case some type of gfx9 power
rail not turn off from FCH side and this will put the
GPU in an unknown power status, so let's reset the gpu
to a known good power state before reinitialize gpu
device.
Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/soc15.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index e8c0e77e1b018..6a3486f52d698 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -1490,10 +1490,32 @@ static int soc15_common_suspend(void *handle)
return soc15_common_hw_fini(adev);
}
+static bool soc15_need_reset_on_resume(struct amdgpu_device *adev)
+{
+ u32 sol_reg;
+
+ sol_reg = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_81);
+
+ /* Will reset for the following suspend abort cases.
+ * 1) Only reset limit on APU side, dGPU hasn't checked yet.
+ * 2) S3 suspend abort and TOS already launched.
+ */
+ if (adev->flags & AMD_IS_APU && adev->in_s3 &&
+ !adev->suspend_complete &&
+ sol_reg)
+ return true;
+
+ return false;
+}
+
static int soc15_common_resume(void *handle)
{
struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+ if (soc15_need_reset_on_resume(adev)) {
+ dev_info(adev->dev, "S3 suspend abort case, let's reset ASIC.\n");
+ soc15_asic_reset(adev);
+ }
return soc15_common_hw_init(adev);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 072/245] virtio-blk: Ensure no requests in virtqueues before deleting vqs.
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 071/245] drm/amdgpu: reset gpu for s3 suspend abort case Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 073/245] pmdomain: mediatek: fix race conditions with genpd Greg Kroah-Hartman
` (183 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yi Sun, Stefan Hajnoczi, Jens Axboe,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Sun <yi.sun@unisoc.com>
[ Upstream commit 4ce6e2db00de8103a0687fb0f65fd17124a51aaa ]
Ensure no remaining requests in virtqueues before resetting vdev and
deleting virtqueues. Otherwise these requests will never be completed.
It may cause the system to become unresponsive.
Function blk_mq_quiesce_queue() can ensure that requests have become
in_flight status, but it cannot guarantee that requests have been
processed by the device. Virtqueues should never be deleted before
all requests become complete status.
Function blk_mq_freeze_queue() ensure that all requests in virtqueues
become complete status. And no requests can enter in virtqueues.
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Link: https://lore.kernel.org/r/20240129085250.1550594-1-yi.sun@unisoc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/virtio_blk.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index affeca0dbc7ea..7f73e7447ecb5 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -989,14 +989,15 @@ static int virtblk_freeze(struct virtio_device *vdev)
{
struct virtio_blk *vblk = vdev->priv;
+ /* Ensure no requests in virtqueues before deleting vqs. */
+ blk_mq_freeze_queue(vblk->disk->queue);
+
/* Ensure we don't receive any more interrupts */
vdev->config->reset(vdev);
/* Make sure no work handler is accessing the device. */
flush_work(&vblk->config_work);
- blk_mq_quiesce_queue(vblk->disk->queue);
-
vdev->config->del_vqs(vdev);
kfree(vblk->vqs);
@@ -1014,7 +1015,7 @@ static int virtblk_restore(struct virtio_device *vdev)
virtio_device_ready(vdev);
- blk_mq_unquiesce_queue(vblk->disk->queue);
+ blk_mq_unfreeze_queue(vblk->disk->queue);
return 0;
}
#endif
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 073/245] pmdomain: mediatek: fix race conditions with genpd
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 072/245] virtio-blk: Ensure no requests in virtqueues before deleting vqs Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 074/245] ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails Greg Kroah-Hartman
` (182 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eugen Hristev, Ulf Hansson,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugen Hristev <eugen.hristev@collabora.com>
[ Upstream commit c41336f4d69057cbf88fed47951379b384540df5 ]
If the power domains are registered first with genpd and *after that*
the driver attempts to power them on in the probe sequence, then it is
possible that a race condition occurs if genpd tries to power them on
in the same time.
The same is valid for powering them off before unregistering them
from genpd.
Attempt to fix race conditions by first removing the domains from genpd
and *after that* powering down domains.
Also first power up the domains and *after that* register them
to genpd.
Fixes: 59b644b01cf4 ("soc: mediatek: Add MediaTek SCPSYS power domains")
Signed-off-by: Eugen Hristev <eugen.hristev@collabora.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231225133615.78993-1-eugen.hristev@collabora.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/mediatek/mtk-pm-domains.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/drivers/soc/mediatek/mtk-pm-domains.c b/drivers/soc/mediatek/mtk-pm-domains.c
index 52ecde8e446cf..9e649b7077c6a 100644
--- a/drivers/soc/mediatek/mtk-pm-domains.c
+++ b/drivers/soc/mediatek/mtk-pm-domains.c
@@ -493,6 +493,11 @@ static int scpsys_add_subdomain(struct scpsys *scpsys, struct device_node *paren
goto err_put_node;
}
+ /* recursive call to add all subdomains */
+ ret = scpsys_add_subdomain(scpsys, child);
+ if (ret)
+ goto err_put_node;
+
ret = pm_genpd_add_subdomain(parent_pd, child_pd);
if (ret) {
dev_err(scpsys->dev, "failed to add %s subdomain to parent %s\n",
@@ -502,11 +507,6 @@ static int scpsys_add_subdomain(struct scpsys *scpsys, struct device_node *paren
dev_dbg(scpsys->dev, "%s add subdomain: %s\n", parent_pd->name,
child_pd->name);
}
-
- /* recursive call to add all subdomains */
- ret = scpsys_add_subdomain(scpsys, child);
- if (ret)
- goto err_put_node;
}
return 0;
@@ -520,9 +520,6 @@ static void scpsys_remove_one_domain(struct scpsys_domain *pd)
{
int ret;
- if (scpsys_domain_is_on(pd))
- scpsys_power_off(&pd->genpd);
-
/*
* We're in the error cleanup already, so we only complain,
* but won't emit another error on top of the original one.
@@ -532,6 +529,8 @@ static void scpsys_remove_one_domain(struct scpsys_domain *pd)
dev_err(pd->scpsys->dev,
"failed to remove domain '%s' : %d - state may be inconsistent\n",
pd->genpd.name, ret);
+ if (scpsys_domain_is_on(pd))
+ scpsys_power_off(&pd->genpd);
clk_bulk_put(pd->num_clks, pd->clks);
clk_bulk_put(pd->num_subsys_clks, pd->subsys_clks);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 074/245] ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 073/245] pmdomain: mediatek: fix race conditions with genpd Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 075/245] pmdomain: renesas: r8a77980-sysc: CR7 must be always on Greg Kroah-Hartman
` (181 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Namjae Jeon,
Steve French, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit 108a020c64434fed4b69762879d78cd24088b4c7 ]
ksmbd_iov_pin_rsp_read() doesn't free the provided aux buffer if it
fails. Seems to be the caller's responsibility to clear the buffer in
error case.
Found by Linux Verification Center (linuxtesting.org).
Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound")
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ksmbd/smb2pdu.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index 7e8f1c89124fa..0613b8d14409c 100644
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -6175,8 +6175,10 @@ static noinline int smb2_read_pipe(struct ksmbd_work *work)
err = ksmbd_iov_pin_rsp_read(work, (void *)rsp,
offsetof(struct smb2_read_rsp, Buffer),
aux_payload_buf, nbytes);
- if (err)
+ if (err) {
+ kvfree(aux_payload_buf);
goto out;
+ }
kvfree(rpc_resp);
} else {
err = ksmbd_iov_pin_rsp(work, (void *)rsp,
@@ -6386,8 +6388,10 @@ int smb2_read(struct ksmbd_work *work)
err = ksmbd_iov_pin_rsp_read(work, (void *)rsp,
offsetof(struct smb2_read_rsp, Buffer),
aux_payload_buf, nbytes);
- if (err)
+ if (err) {
+ kvfree(aux_payload_buf);
goto out;
+ }
ksmbd_fd_put(work, fp);
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 075/245] pmdomain: renesas: r8a77980-sysc: CR7 must be always on
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 074/245] ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 076/245] erofs: fix lz4 inplace decompression Greg Kroah-Hartman
` (180 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Ulf Hansson,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit f0e4a1356466ec1858ae8e5c70bea2ce5e55008b ]
The power domain containing the Cortex-R7 CPU core on the R-Car V3H SoC
must always be in power-on state, unlike on other SoCs in the R-Car Gen3
family. See Table 9.4 "Power domains" in the R-Car Series, 3rd
Generation Hardware User’s Manual Rev.1.00 and later.
Fix this by marking the domain as a CPU domain without control
registers, so the driver will not touch it.
Fixes: 41d6d8bd8ae9 ("soc: renesas: rcar-sysc: add R8A77980 support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/fdad9a86132d53ecddf72b734dac406915c4edc0.1705076735.git.geert+renesas@glider.be
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/renesas/r8a77980-sysc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/soc/renesas/r8a77980-sysc.c b/drivers/soc/renesas/r8a77980-sysc.c
index 39ca84a67daad..621e411fc9991 100644
--- a/drivers/soc/renesas/r8a77980-sysc.c
+++ b/drivers/soc/renesas/r8a77980-sysc.c
@@ -25,7 +25,8 @@ static const struct rcar_sysc_area r8a77980_areas[] __initconst = {
PD_CPU_NOCR },
{ "ca53-cpu3", 0x200, 3, R8A77980_PD_CA53_CPU3, R8A77980_PD_CA53_SCU,
PD_CPU_NOCR },
- { "cr7", 0x240, 0, R8A77980_PD_CR7, R8A77980_PD_ALWAYS_ON },
+ { "cr7", 0x240, 0, R8A77980_PD_CR7, R8A77980_PD_ALWAYS_ON,
+ PD_CPU_NOCR },
{ "a3ir", 0x180, 0, R8A77980_PD_A3IR, R8A77980_PD_ALWAYS_ON },
{ "a2ir0", 0x400, 0, R8A77980_PD_A2IR0, R8A77980_PD_A3IR },
{ "a2ir1", 0x400, 1, R8A77980_PD_A2IR1, R8A77980_PD_A3IR },
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 076/245] erofs: fix lz4 inplace decompression
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 075/245] pmdomain: renesas: r8a77980-sysc: CR7 must be always on Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 077/245] IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Greg Kroah-Hartman
` (179 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yifan Zhao, Gao Xiang, Juhyung Park
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <hsiangkao@linux.alibaba.com>
commit 3c12466b6b7bf1e56f9b32c366a3d83d87afb4de upstream.
Currently EROFS can map another compressed buffer for inplace
decompression, that was used to handle the cases that some pages of
compressed data are actually not in-place I/O.
However, like most simple LZ77 algorithms, LZ4 expects the compressed
data is arranged at the end of the decompressed buffer and it
explicitly uses memmove() to handle overlapping:
__________________________________________________________
|_ direction of decompression --> ____ |_ compressed data _|
Although EROFS arranges compressed data like this, it typically maps two
individual virtual buffers so the relative order is uncertain.
Previously, it was hardly observed since LZ4 only uses memmove() for
short overlapped literals and x86/arm64 memmove implementations seem to
completely cover it up and they don't have this issue. Juhyung reported
that EROFS data corruption can be found on a new Intel x86 processor.
After some analysis, it seems that recent x86 processors with the new
FSRM feature expose this issue with "rep movsb".
Let's strictly use the decompressed buffer for lz4 inplace
decompression for now. Later, as an useful improvement, we could try
to tie up these two buffers together in the correct order.
Reported-and-tested-by: Juhyung Park <qkrwngud825@gmail.com>
Closes: https://lore.kernel.org/r/CAD14+f2AVKf8Fa2OO1aAUdDNTDsVzzR6ctU_oJSmTyd6zSYR2Q@mail.gmail.com
Fixes: 0ffd71bcc3a0 ("staging: erofs: introduce LZ4 decompression inplace")
Fixes: 598162d05080 ("erofs: support decompress big pcluster for lz4 backend")
Cc: stable <stable@vger.kernel.org> # 5.4+
Tested-by: Yifan Zhao <zhaoyifan@sjtu.edu.cn>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20231206045534.3920847-1-hsiangkao@linux.alibaba.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/erofs/decompressor.c | 34 +++++++++++++++++-----------------
1 file changed, 17 insertions(+), 17 deletions(-)
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -124,11 +124,11 @@ static int z_erofs_lz4_prepare_destpages
}
static void *z_erofs_handle_inplace_io(struct z_erofs_decompress_req *rq,
- void *inpage, unsigned int *inputmargin, int *maptype,
- bool support_0padding)
+ void *inpage, void *out, unsigned int *inputmargin, int *maptype,
+ bool support_0padding)
{
unsigned int nrpages_in, nrpages_out;
- unsigned int ofull, oend, inputsize, total, i, j;
+ unsigned int ofull, oend, inputsize, total, i;
struct page **in;
void *src, *tmp;
@@ -143,12 +143,13 @@ static void *z_erofs_handle_inplace_io(s
ofull - oend < LZ4_DECOMPRESS_INPLACE_MARGIN(inputsize))
goto docopy;
- for (i = 0; i < nrpages_in; ++i) {
- DBG_BUGON(rq->in[i] == NULL);
- for (j = 0; j < nrpages_out - nrpages_in + i; ++j)
- if (rq->out[j] == rq->in[i])
- goto docopy;
- }
+ for (i = 0; i < nrpages_in; ++i)
+ if (rq->out[nrpages_out - nrpages_in + i] !=
+ rq->in[i])
+ goto docopy;
+ kunmap_atomic(inpage);
+ *maptype = 3;
+ return out + ((nrpages_out - nrpages_in) << PAGE_SHIFT);
}
if (nrpages_in <= 1) {
@@ -156,7 +157,6 @@ static void *z_erofs_handle_inplace_io(s
return inpage;
}
kunmap_atomic(inpage);
- might_sleep();
src = erofs_vm_map_ram(rq->in, nrpages_in);
if (!src)
return ERR_PTR(-ENOMEM);
@@ -193,10 +193,10 @@ docopy:
return src;
}
-static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq, u8 *out)
+static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq, u8 *dst)
{
unsigned int inputmargin;
- u8 *headpage, *src;
+ u8 *out, *headpage, *src;
bool support_0padding;
int ret, maptype;
@@ -220,11 +220,12 @@ static int z_erofs_lz4_decompress(struct
}
rq->inputsize -= inputmargin;
- src = z_erofs_handle_inplace_io(rq, headpage, &inputmargin, &maptype,
- support_0padding);
+ src = z_erofs_handle_inplace_io(rq, headpage, dst, &inputmargin,
+ &maptype, support_0padding);
if (IS_ERR(src))
return PTR_ERR(src);
+ out = dst + rq->pageofs_out;
/* legacy format could compress extra data in a pcluster. */
if (rq->partial_decoding || !support_0padding)
ret = LZ4_decompress_safe_partial(src + inputmargin, out,
@@ -253,7 +254,7 @@ static int z_erofs_lz4_decompress(struct
vm_unmap_ram(src, PAGE_ALIGN(rq->inputsize) >> PAGE_SHIFT);
} else if (maptype == 2) {
erofs_put_pcpubuf(src);
- } else {
+ } else if (maptype != 3) {
DBG_BUGON(1);
return -EFAULT;
}
@@ -354,8 +355,7 @@ static int z_erofs_decompress_generic(st
dst_maptype = 2;
dstmap_out:
- ret = alg->decompress(rq, dst + rq->pageofs_out);
-
+ ret = alg->decompress(rq, dst);
if (!dst_maptype)
kunmap_atomic(dst);
else if (dst_maptype == 2)
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 077/245] IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 076/245] erofs: fix lz4 inplace decompression Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 078/245] drm/ttm: Fix an invalid freeing on already freed page in error path Greg Kroah-Hartman
` (178 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mats Kronberg, Daniel Vacek,
Leon Romanovsky
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vacek <neelx@redhat.com>
commit e6f57c6881916df39db7d95981a8ad2b9c3458d6 upstream.
Unfortunately the commit `fd8958efe877` introduced another error
causing the `descs` array to overflow. This reults in further crashes
easily reproducible by `sendmsg` system call.
[ 1080.836473] general protection fault, probably for non-canonical address 0x400300015528b00a: 0000 [#1] PREEMPT SMP PTI
[ 1080.869326] RIP: 0010:hfi1_ipoib_build_ib_tx_headers.constprop.0+0xe1/0x2b0 [hfi1]
--
[ 1080.974535] Call Trace:
[ 1080.976990] <TASK>
[ 1081.021929] hfi1_ipoib_send_dma_common+0x7a/0x2e0 [hfi1]
[ 1081.027364] hfi1_ipoib_send_dma_list+0x62/0x270 [hfi1]
[ 1081.032633] hfi1_ipoib_send+0x112/0x300 [hfi1]
[ 1081.042001] ipoib_start_xmit+0x2a9/0x2d0 [ib_ipoib]
[ 1081.046978] dev_hard_start_xmit+0xc4/0x210
--
[ 1081.148347] __sys_sendmsg+0x59/0xa0
crash> ipoib_txreq 0xffff9cfeba229f00
struct ipoib_txreq {
txreq = {
list = {
next = 0xffff9cfeba229f00,
prev = 0xffff9cfeba229f00
},
descp = 0xffff9cfeba229f40,
coalesce_buf = 0x0,
wait = 0xffff9cfea4e69a48,
complete = 0xffffffffc0fe0760 <hfi1_ipoib_sdma_complete>,
packet_len = 0x46d,
tlen = 0x0,
num_desc = 0x0,
desc_limit = 0x6,
next_descq_idx = 0x45c,
coalesce_idx = 0x0,
flags = 0x0,
descs = {{
qw = {0x8024000120dffb00, 0x4} # SDMA_DESC0_FIRST_DESC_FLAG (bit 63)
}, {
qw = { 0x3800014231b108, 0x4}
}, {
qw = { 0x310000e4ee0fcf0, 0x8}
}, {
qw = { 0x3000012e9f8000, 0x8}
}, {
qw = { 0x59000dfb9d0000, 0x8}
}, {
qw = { 0x78000e02e40000, 0x8}
}}
},
sdma_hdr = 0x400300015528b000, <<< invalid pointer in the tx request structure
sdma_status = 0x0, SDMA_DESC0_LAST_DESC_FLAG (bit 62)
complete = 0x0,
priv = 0x0,
txq = 0xffff9cfea4e69880,
skb = 0xffff9d099809f400
}
If an SDMA send consists of exactly 6 descriptors and requires dword
padding (in the 7th descriptor), the sdma_txreq descriptor array is not
properly expanded and the packet will overflow into the container
structure. This results in a panic when the send completion runs. The
exact panic varies depending on what elements of the container structure
get corrupted. The fix is to use the correct expression in
_pad_sdma_tx_descs() to test the need to expand the descriptor array.
With this patch the crashes are no longer reproducible and the machine is
stable.
Fixes: fd8958efe877 ("IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors")
Cc: stable@vger.kernel.org
Reported-by: Mats Kronberg <kronberg@nsc.liu.se>
Tested-by: Mats Kronberg <kronberg@nsc.liu.se>
Signed-off-by: Daniel Vacek <neelx@redhat.com>
Link: https://lore.kernel.org/r/20240201081009.1109442-1-neelx@redhat.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/hfi1/sdma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/hw/hfi1/sdma.c
+++ b/drivers/infiniband/hw/hfi1/sdma.c
@@ -3158,7 +3158,7 @@ int _pad_sdma_tx_descs(struct hfi1_devda
{
int rval = 0;
- if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) {
+ if ((unlikely(tx->num_desc == tx->desc_limit))) {
rval = _extend_sdma_tx_descs(dd, tx);
if (rval) {
__sdma_txclean(dd, tx);
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 078/245] drm/ttm: Fix an invalid freeing on already freed page in error path
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 077/245] IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 079/245] dm-crypt: dont modify the data when using authenticated encryption Greg Kroah-Hartman
` (177 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Hellström,
Christian König, Dave Airlie, Huang Rui, dri-devel,
Matthew Auld
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <thomas.hellstrom@linux.intel.com>
commit 40510a941d27d405a82dc3320823d875f94625df upstream.
If caching mode change fails due to, for example, OOM we
free the allocated pages in a two-step process. First the pages
for which the caching change has already succeeded. Secondly
the pages for which a caching change did not succeed.
However the second step was incorrectly freeing the pages already
freed in the first step.
Fix.
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Fixes: 379989e7cbdc ("drm/ttm/pool: Fix ttm_pool_alloc error path")
Cc: Christian König <christian.koenig@amd.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Christian Koenig <christian.koenig@amd.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.4+
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240221073324.3303-1-thomas.hellstrom@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ttm/ttm_pool.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/ttm/ttm_pool.c
+++ b/drivers/gpu/drm/ttm/ttm_pool.c
@@ -384,7 +384,7 @@ static void ttm_pool_free_range(struct t
enum ttm_caching caching,
pgoff_t start_page, pgoff_t end_page)
{
- struct page **pages = tt->pages;
+ struct page **pages = &tt->pages[start_page];
unsigned int order;
pgoff_t i, nr;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 079/245] dm-crypt: dont modify the data when using authenticated encryption
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 078/245] drm/ttm: Fix an invalid freeing on already freed page in error path Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 080/245] platform/x86: intel-vbtn: Stop calling "VBDL" from notify_handler Greg Kroah-Hartman
` (176 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Mike Snitzer
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 50c70240097ce41fe6bce6478b80478281e4d0f7 upstream.
It was said that authenticated encryption could produce invalid tag when
the data that is being encrypted is modified [1]. So, fix this problem by
copying the data into the clone bio first and then encrypt them inside the
clone bio.
This may reduce performance, but it is needed to prevent the user from
corrupting the device by writing data with O_DIRECT and modifying them at
the same time.
[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-crypt.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2065,6 +2065,12 @@ static void kcryptd_crypt_write_convert(
io->ctx.bio_out = clone;
io->ctx.iter_out = clone->bi_iter;
+ if (crypt_integrity_aead(cc)) {
+ bio_copy_data(clone, io->base_bio);
+ io->ctx.bio_in = clone;
+ io->ctx.iter_in = clone->bi_iter;
+ }
+
sector += bio_sectors(clone);
crypt_inc_pending(io);
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 080/245] platform/x86: intel-vbtn: Stop calling "VBDL" from notify_handler
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 079/245] dm-crypt: dont modify the data when using authenticated encryption Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 081/245] platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names Greg Kroah-Hartman
` (175 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Kobel, regressions,
Arnold Gozum, Hans de Goede
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit 84c16d01ff219bc0a5dca5219db6b8b86a6854fb upstream.
Commit 14c200b7ca46 ("platform/x86: intel-vbtn: Fix missing
tablet-mode-switch events") causes 2 issues on the ThinkPad X1 Tablet Gen2:
1. The ThinkPad will wake up immediately from suspend
2. When put in tablet mode SW_TABLET_MODE reverts to 0 after about 1 second
Both these issues are caused by the "VBDL" ACPI method call added
at the end of the notify_handler.
And it never became entirely clear if this call is even necessary to fix
the issue of missing tablet-mode-switch events on the Dell Inspiron 7352.
Drop the "VBDL" ACPI method call again to fix the 2 issues this is
causing on the ThinkPad X1 Tablet Gen2.
Fixes: 14c200b7ca46 ("platform/x86: intel-vbtn: Fix missing tablet-mode-switch events")
Reported-by: Alexander Kobel <a-kobel@a-kobel.de>
Closes: https://lore.kernel.org/platform-driver-x86/295984ce-bd4b-49bd-adc5-ffe7c898d7f0@a-kobel.de/
Cc: regressions@lists.linux.dev
Cc: Arnold Gozum <arngozum@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Tested-by: Alexander Kobel <a-kobel@a-kobel.de>
Link: https://lore.kernel.org/r/20240216203300.245826-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel/vbtn.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/platform/x86/intel/vbtn.c b/drivers/platform/x86/intel/vbtn.c
index 210b0a81b7ec..084c355c86f5 100644
--- a/drivers/platform/x86/intel/vbtn.c
+++ b/drivers/platform/x86/intel/vbtn.c
@@ -200,9 +200,6 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)
autorelease = val && (!ke_rel || ke_rel->type == KE_IGNORE);
sparse_keymap_report_event(input_dev, event, val, autorelease);
-
- /* Some devices need this to report further events */
- acpi_evaluate_object(handle, "VBDL", NULL, NULL);
}
/*
--
2.44.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 081/245] platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 080/245] platform/x86: intel-vbtn: Stop calling "VBDL" from notify_handler Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 082/245] KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler Greg Kroah-Hartman
` (174 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuppuswamy Sathyanarayanan,
Hans de Goede
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit dbcbfd662a725641d118fb3ae5ffb7be4e3d0fb0 upstream.
On some devices the ACPI name of the touchscreen is e.g. either
MSSL1680:00 or MSSL1680:01 depending on the BIOS version.
This happens for example on the "Chuwi Hi8 Air" tablet where the initial
commit's ts_data uses "MSSL1680:00" but the tablets from the github issue
and linux-hardware.org probe linked below both use "MSSL1680:01".
Replace the strcmp() match on ts_data->acpi_name with a strstarts()
check to allow using a partial match on just the ACPI HID of "MSSL1680"
and change the ts_data->acpi_name for the "Chuwi Hi8 Air" accordingly
to fix the touchscreen not working on models where it is "MSSL1680:01".
Note this drops the length check for I2C_NAME_SIZE. This never was
necessary since the ACPI names used are never more then 11 chars and
I2C_NAME_SIZE is 20 so the replaced strncmp() would always stop long
before reaching I2C_NAME_SIZE.
Link: https://linux-hardware.org/?computer=AC4301C0542A
Fixes: bbb97d728f77 ("platform/x86: touchscreen_dmi: Add info for the Chuwi Hi8 Air tablet")
Closes: https://github.com/onitake/gsl-firmware/issues/91
Cc: stable@vger.kernel.org
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20240212120608.30469-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/touchscreen_dmi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/platform/x86/touchscreen_dmi.c
+++ b/drivers/platform/x86/touchscreen_dmi.c
@@ -50,7 +50,7 @@ static const struct property_entry chuwi
};
static const struct ts_dmi_data chuwi_hi8_air_data = {
- .acpi_name = "MSSL1680:00",
+ .acpi_name = "MSSL1680",
.properties = chuwi_hi8_air_props,
};
@@ -1745,7 +1745,7 @@ static void ts_dmi_add_props(struct i2c_
int error;
if (has_acpi_companion(dev) &&
- !strncmp(ts_data->acpi_name, client->name, I2C_NAME_SIZE)) {
+ strstarts(client->name, ts_data->acpi_name)) {
error = device_create_managed_software_node(dev, ts_data->properties, NULL);
if (error)
dev_err(dev, "failed to add properties: %d\n", error);
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 082/245] KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 081/245] platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 083/245] KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() Greg Kroah-Hartman
` (173 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Upton, Marc Zyngier
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <oliver.upton@linux.dev>
commit 85a71ee9a0700f6c18862ef3b0011ed9dad99aca upstream.
It is possible that an LPI mapped in a different ITS gets unmapped while
handling the MOVALL command. If that is the case, there is no state that
can be migrated to the destination. Silently ignore it and continue
migrating other LPIs.
Cc: stable@vger.kernel.org
Fixes: ff9c114394aa ("KVM: arm/arm64: GICv4: Handle MOVALL applied to a vPE")
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Link: https://lore.kernel.org/r/20240221092732.4126848-3-oliver.upton@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/vgic/vgic-its.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm64/kvm/vgic/vgic-its.c
+++ b/arch/arm64/kvm/vgic/vgic-its.c
@@ -1374,6 +1374,8 @@ static int vgic_its_cmd_handle_movall(st
for (i = 0; i < irq_count; i++) {
irq = vgic_get_irq(kvm, NULL, intids[i]);
+ if (!irq)
+ continue;
update_affinity(irq, vcpu2);
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 083/245] KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 082/245] KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 084/245] gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() Greg Kroah-Hartman
` (172 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Upton, Marc Zyngier
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <oliver.upton@linux.dev>
commit 8d3a7dfb801d157ac423261d7cd62c33e95375f8 upstream.
vgic_get_irq() may not return a valid descriptor if there is no ITS that
holds a valid translation for the specified INTID. If that is the case,
it is safe to silently ignore it and continue processing the LPI pending
table.
Cc: stable@vger.kernel.org
Fixes: 33d3bc9556a7 ("KVM: arm64: vgic-its: Read initial LPI pending table")
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Link: https://lore.kernel.org/r/20240221092732.4126848-2-oliver.upton@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/vgic/vgic-its.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/arm64/kvm/vgic/vgic-its.c
+++ b/arch/arm64/kvm/vgic/vgic-its.c
@@ -462,6 +462,9 @@ static int its_sync_lpi_pending_table(st
}
irq = vgic_get_irq(vcpu->kvm, NULL, intids[i]);
+ if (!irq)
+ continue;
+
raw_spin_lock_irqsave(&irq->irq_lock, flags);
irq->pending_latch = pendmask & (1U << bit_nr);
vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 084/245] gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 083/245] KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 085/245] PCI/MSI: Prevent MSI hardware interrupt number truncation Greg Kroah-Hartman
` (171 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vasiliy Kovalev, Jakub Kicinski
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <kovalev@altlinux.org>
commit 136cfaca22567a03bbb3bf53a43d8cb5748b80ec upstream.
The gtp_net_ops pernet operations structure for the subsystem must be
registered before registering the generic netlink family.
Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug:
general protection fault, probably for non-canonical address
0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014
RIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]
Code: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86
df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80>
3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74
RSP: 0018:ffff888014107220 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000
FS: 00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
? show_regs+0x90/0xa0
? die_addr+0x50/0xd0
? exc_general_protection+0x148/0x220
? asm_exc_general_protection+0x22/0x30
? gtp_genl_dump_pdp+0x1be/0x800 [gtp]
? __alloc_skb+0x1dd/0x350
? __pfx___alloc_skb+0x10/0x10
genl_dumpit+0x11d/0x230
netlink_dump+0x5b9/0xce0
? lockdep_hardirqs_on_prepare+0x253/0x430
? __pfx_netlink_dump+0x10/0x10
? kasan_save_track+0x10/0x40
? __kasan_kmalloc+0x9b/0xa0
? genl_start+0x675/0x970
__netlink_dump_start+0x6fc/0x9f0
genl_family_rcv_msg_dumpit+0x1bb/0x2d0
? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10
? genl_op_from_small+0x2a/0x440
? cap_capable+0x1d0/0x240
? __pfx_genl_start+0x10/0x10
? __pfx_genl_dumpit+0x10/0x10
? __pfx_genl_done+0x10/0x10
? security_capable+0x9d/0xe0
Cc: stable@vger.kernel.org
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Link: https://lore.kernel.org/r/20240214162733.34214-1-kovalev@altlinux.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/gtp.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -1426,20 +1426,20 @@ static int __init gtp_init(void)
if (err < 0)
goto error_out;
- err = genl_register_family(>p_genl_family);
+ err = register_pernet_subsys(>p_net_ops);
if (err < 0)
goto unreg_rtnl_link;
- err = register_pernet_subsys(>p_net_ops);
+ err = genl_register_family(>p_genl_family);
if (err < 0)
- goto unreg_genl_family;
+ goto unreg_pernet_subsys;
pr_info("GTP module loaded (pdp ctx size %zd bytes)\n",
sizeof(struct pdp_ctx));
return 0;
-unreg_genl_family:
- genl_unregister_family(>p_genl_family);
+unreg_pernet_subsys:
+ unregister_pernet_subsys(>p_net_ops);
unreg_rtnl_link:
rtnl_link_unregister(>p_link_ops);
error_out:
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 085/245] PCI/MSI: Prevent MSI hardware interrupt number truncation
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 084/245] gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 086/245] l2tp: pass correct message length to ip6_append_data Greg Kroah-Hartman
` (170 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vidya Sagar, Thomas Gleixner,
Shanker Donthineni
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <vidyas@nvidia.com>
commit db744ddd59be798c2627efbfc71f707f5a935a40 upstream.
While calculating the hardware interrupt number for a MSI interrupt, the
higher bits (i.e. from bit-5 onwards a.k.a domain_nr >= 32) of the PCI
domain number gets truncated because of the shifted value casting to return
type of pci_domain_nr() which is 'int'. This for example is resulting in
same hardware interrupt number for devices 0019:00:00.0 and 0039:00:00.0.
To address this cast the PCI domain number to 'irq_hw_number_t' before left
shifting it to calculate the hardware interrupt number.
Please note that this fixes the issue only on 64-bit systems and doesn't
change the behavior for 32-bit systems i.e. the 32-bit systems continue to
have the issue. Since the issue surfaces only if there are too many PCIe
controllers in the system which usually is the case in modern server
systems and they don't tend to run 32-bit kernels.
Fixes: 3878eaefb89a ("PCI/MSI: Enhance core to support hierarchy irqdomain")
Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Shanker Donthineni <sdonthineni@nvidia.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240115135649.708536-1-vidyas@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/msi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -1311,7 +1311,7 @@ static irq_hw_number_t pci_msi_domain_ca
return (irq_hw_number_t)desc->msi_attrib.entry_nr |
pci_dev_id(dev) << 11 |
- (pci_domain_nr(dev->bus) & 0xFFFFFFFF) << 27;
+ ((irq_hw_number_t)(pci_domain_nr(dev->bus) & 0xFFFFFFFF)) << 27;
}
static inline bool pci_msi_desc_is_multi_msi(struct msi_desc *desc)
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 086/245] l2tp: pass correct message length to ip6_append_data
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 085/245] PCI/MSI: Prevent MSI hardware interrupt number truncation Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 087/245] ARM: ep93xx: Add terminator to gpiod_lookup_table Greg Kroah-Hartman
` (169 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Tom Parkin,
Simon Horman, Paolo Abeni
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Parkin <tparkin@katalix.com>
commit 359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79 upstream.
l2tp_ip6_sendmsg needs to avoid accounting for the transport header
twice when splicing more data into an already partially-occupied skbuff.
To manage this, we check whether the skbuff contains data using
skb_queue_empty when deciding how much data to append using
ip6_append_data.
However, the code which performed the calculation was incorrect:
ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0;
...due to C operator precedence, this ends up setting ulen to
transhdrlen for messages with a non-zero length, which results in
corrupted packets on the wire.
Add parentheses to correct the calculation in line with the original
intent.
Fixes: 9d4c75800f61 ("ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()")
Cc: David Howells <dhowells@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Tom Parkin <tparkin@katalix.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240220122156.43131-1-tparkin@katalix.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_ip6.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -628,7 +628,7 @@ static int l2tp_ip6_sendmsg(struct sock
back_from_confirm:
lock_sock(sk);
- ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0;
+ ulen = len + (skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0);
err = ip6_append_data(sk, ip_generic_getfrag, msg,
ulen, transhdrlen, &ipc6,
&fl6, (struct rt6_info *)dst,
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 087/245] ARM: ep93xx: Add terminator to gpiod_lookup_table
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 086/245] l2tp: pass correct message length to ip6_append_data Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 088/245] Revert "x86/ftrace: Use alternative RET encoding" Greg Kroah-Hartman
` (168 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Nikita Shubin,
Linus Walleij, Alexander Sverdlin, Arnd Bergmann
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Shubin <nikita.shubin@maquefel.me>
commit fdf87a0dc26d0550c60edc911cda42f9afec3557 upstream.
Without the terminator, if a con_id is passed to gpio_find() that
does not exist in the lookup table the function will not stop looping
correctly, and eventually cause an oops.
Cc: stable@vger.kernel.org
Fixes: b2e63555592f ("i2c: gpio: Convert to use descriptors")
Reported-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Nikita Shubin <nikita.shubin@maquefel.me>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://lore.kernel.org/r/20240205102337.439002-1-alexander.sverdlin@gmail.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-ep93xx/core.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/mach-ep93xx/core.c
+++ b/arch/arm/mach-ep93xx/core.c
@@ -337,6 +337,7 @@ static struct gpiod_lookup_table ep93xx_
GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
GPIO_LOOKUP_IDX("G", 0, NULL, 1,
GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
+ { }
},
};
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 088/245] Revert "x86/ftrace: Use alternative RET encoding"
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 087/245] ARM: ep93xx: Add terminator to gpiod_lookup_table Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 089/245] x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR Greg Kroah-Hartman
` (167 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Borislav Petkov (AMD)
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Borislav Petkov (AMD)" <bp@alien8.de>
This reverts commit 3eb602ad6a94a76941f93173131a71ad36fa1324.
Revert the backport of upstream commit
1f001e9da6bb ("x86/ftrace: Use alternative RET encoding")
in favor of a proper backport after backporting the commit which adds
__text_gen_insn().
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/ftrace.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -311,7 +311,7 @@ union ftrace_op_code_union {
} __attribute__((packed));
};
-#define RET_SIZE (IS_ENABLED(CONFIG_RETPOLINE) ? 5 : 1 + IS_ENABLED(CONFIG_SLS))
+#define RET_SIZE 1 + IS_ENABLED(CONFIG_SLS)
static unsigned long
create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
@@ -367,12 +367,7 @@ create_trampoline(struct ftrace_ops *ops
goto fail;
ip = trampoline + size;
-
- /* The trampoline ends with ret(q) */
- if (cpu_feature_enabled(X86_FEATURE_RETHUNK))
- memcpy(ip, text_gen_insn(JMP32_INSN_OPCODE, ip, &__x86_return_thunk), JMP32_INSN_SIZE);
- else
- memcpy(ip, retq, sizeof(retq));
+ memcpy(ip, retq, RET_SIZE);
/* No need to test direct calls on created trampolines */
if (ops->flags & FTRACE_OPS_FL_SAVE_REGS) {
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 089/245] x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 088/245] Revert "x86/ftrace: Use alternative RET encoding" Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 090/245] x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() Greg Kroah-Hartman
` (166 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Josh Poimboeuf, Borislav Petkov (AMD)
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
Upstream commit: bbf92368b0b1fe472d489e62d3340d7897e9c697
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lore.kernel.org/r/20220308154317.638561109@infradead.org
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/text-patching.h | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/text-patching.h
+++ b/arch/x86/include/asm/text-patching.h
@@ -101,13 +101,21 @@ void *text_gen_insn(u8 opcode, const voi
static union text_poke_insn insn; /* per instance */
int size = text_opcode_size(opcode);
+ /*
+ * Hide the addresses to avoid the compiler folding in constants when
+ * referencing code, these can mess up annotations like
+ * ANNOTATE_NOENDBR.
+ */
+ OPTIMIZER_HIDE_VAR(addr);
+ OPTIMIZER_HIDE_VAR(dest);
+
insn.opcode = opcode;
if (size > 1) {
insn.disp = (long)dest - (long)(addr + size);
if (size == 2) {
/*
- * Ensure that for JMP9 the displacement
+ * Ensure that for JMP8 the displacement
* actually fits the signed byte.
*/
BUG_ON((insn.disp >> 31) != (insn.disp >> 7));
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 090/245] x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 089/245] x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 091/245] x86/ftrace: Use alternative RET encoding Greg Kroah-Hartman
` (165 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Josh Poimboeuf, Borislav Petkov (AMD)
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
Upstream commit: ba27d1a80871eb8dbeddf34ec7d396c149cbb8d7
Less duplication is more better.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lore.kernel.org/r/20220308154317.697253958@infradead.org
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/text-patching.h | 20 ++++++++++++++------
arch/x86/kernel/paravirt.c | 23 +++--------------------
2 files changed, 17 insertions(+), 26 deletions(-)
--- a/arch/x86/include/asm/text-patching.h
+++ b/arch/x86/include/asm/text-patching.h
@@ -96,32 +96,40 @@ union text_poke_insn {
};
static __always_inline
-void *text_gen_insn(u8 opcode, const void *addr, const void *dest)
+void __text_gen_insn(void *buf, u8 opcode, const void *addr, const void *dest, int size)
{
- static union text_poke_insn insn; /* per instance */
- int size = text_opcode_size(opcode);
+ union text_poke_insn *insn = buf;
+
+ BUG_ON(size < text_opcode_size(opcode));
/*
* Hide the addresses to avoid the compiler folding in constants when
* referencing code, these can mess up annotations like
* ANNOTATE_NOENDBR.
*/
+ OPTIMIZER_HIDE_VAR(insn);
OPTIMIZER_HIDE_VAR(addr);
OPTIMIZER_HIDE_VAR(dest);
- insn.opcode = opcode;
+ insn->opcode = opcode;
if (size > 1) {
- insn.disp = (long)dest - (long)(addr + size);
+ insn->disp = (long)dest - (long)(addr + size);
if (size == 2) {
/*
* Ensure that for JMP8 the displacement
* actually fits the signed byte.
*/
- BUG_ON((insn.disp >> 31) != (insn.disp >> 7));
+ BUG_ON((insn->disp >> 31) != (insn->disp >> 7));
}
}
+}
+static __always_inline
+void *text_gen_insn(u8 opcode, const void *addr, const void *dest)
+{
+ static union text_poke_insn insn; /* per instance */
+ __text_gen_insn(&insn, opcode, addr, dest, text_opcode_size(opcode));
return &insn.text;
}
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -58,29 +58,12 @@ static void paravirt_BUG(void)
BUG();
}
-struct branch {
- unsigned char opcode;
- u32 delta;
-} __attribute__((packed));
-
static unsigned paravirt_patch_call(void *insn_buff, const void *target,
unsigned long addr, unsigned len)
{
- const int call_len = 5;
- struct branch *b = insn_buff;
- unsigned long delta = (unsigned long)target - (addr+call_len);
-
- if (len < call_len) {
- pr_warn("paravirt: Failed to patch indirect CALL at %ps\n", (void *)addr);
- /* Kernel might not be viable if patching fails, bail out: */
- BUG_ON(1);
- }
-
- b->opcode = 0xe8; /* call */
- b->delta = delta;
- BUILD_BUG_ON(sizeof(*b) != call_len);
-
- return call_len;
+ __text_gen_insn(insn_buff, CALL_INSN_OPCODE,
+ (void *)addr, target, CALL_INSN_SIZE);
+ return CALL_INSN_SIZE;
}
#ifdef CONFIG_PARAVIRT_XXL
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 091/245] x86/ftrace: Use alternative RET encoding
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 090/245] x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 092/245] x86/returnthunk: Allow different return thunks Greg Kroah-Hartman
` (164 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Borislav Petkov, Josh Poimboeuf, Borislav Petkov (AMD)
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
Upstream commit: 1f001e9da6bbf482311e45e48f53c2bd2179e59c
Use the return thunk in ftrace trampolines, if needed.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/ftrace.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -311,7 +311,7 @@ union ftrace_op_code_union {
} __attribute__((packed));
};
-#define RET_SIZE 1 + IS_ENABLED(CONFIG_SLS)
+#define RET_SIZE (IS_ENABLED(CONFIG_RETPOLINE) ? 5 : 1 + IS_ENABLED(CONFIG_SLS))
static unsigned long
create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
@@ -367,7 +367,10 @@ create_trampoline(struct ftrace_ops *ops
goto fail;
ip = trampoline + size;
- memcpy(ip, retq, RET_SIZE);
+ if (cpu_feature_enabled(X86_FEATURE_RETHUNK))
+ __text_gen_insn(ip, JMP32_INSN_OPCODE, ip, &__x86_return_thunk, JMP32_INSN_SIZE);
+ else
+ memcpy(ip, retq, sizeof(retq));
/* No need to test direct calls on created trampolines */
if (ops->flags & FTRACE_OPS_FL_SAVE_REGS) {
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 092/245] x86/returnthunk: Allow different return thunks
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 091/245] x86/ftrace: Use alternative RET encoding Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 093/245] Revert "x86/alternative: Make custom return thunk unconditional" Greg Kroah-Hartman
` (163 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Thomas Gleixner, Borislav Petkov (AMD)
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
Upstream commit: 770ae1b709528a6a173b5c7b183818ee9b45e376
In preparation for call depth tracking on Intel SKL CPUs, make it possible
to patch in a SKL specific return thunk.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20220915111147.680469665@infradead.org
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/nospec-branch.h | 6 ++++++
arch/x86/kernel/alternative.c | 19 ++++++++++++++-----
arch/x86/kernel/cpu/bugs.c | 2 ++
arch/x86/kernel/ftrace.c | 2 +-
arch/x86/kernel/static_call.c | 2 +-
arch/x86/net/bpf_jit_comp.c | 2 +-
6 files changed, 25 insertions(+), 8 deletions(-)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -207,6 +207,12 @@ extern void srso_alias_untrain_ret(void)
extern void entry_untrain_ret(void);
extern void entry_ibpb(void);
+#ifdef CONFIG_CALL_THUNKS
+extern void (*x86_return_thunk)(void);
+#else
+#define x86_return_thunk (&__x86_return_thunk)
+#endif
+
#ifdef CONFIG_RETPOLINE
typedef u8 retpoline_thunk_t[RETPOLINE_THUNK_SIZE];
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -521,6 +521,11 @@ void __init_or_module noinline apply_ret
}
#ifdef CONFIG_RETHUNK
+
+#ifdef CONFIG_CALL_THUNKS
+void (*x86_return_thunk)(void) __ro_after_init = &__x86_return_thunk;
+#endif
+
/*
* Rewrite the compiler generated return thunk tail-calls.
*
@@ -536,14 +541,18 @@ static int patch_return(void *addr, stru
{
int i = 0;
- if (cpu_feature_enabled(X86_FEATURE_RETHUNK))
- return -1;
-
- bytes[i++] = RET_INSN_OPCODE;
+ if (cpu_feature_enabled(X86_FEATURE_RETHUNK)) {
+ if (x86_return_thunk == __x86_return_thunk)
+ return -1;
+
+ i = JMP32_INSN_SIZE;
+ __text_gen_insn(bytes, JMP32_INSN_OPCODE, addr, x86_return_thunk, i);
+ } else {
+ bytes[i++] = RET_INSN_OPCODE;
+ }
for (; i < insn->length;)
bytes[i++] = INT3_INSN_OPCODE;
-
return i;
}
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -62,7 +62,9 @@ EXPORT_SYMBOL_GPL(x86_pred_cmd);
static DEFINE_MUTEX(spec_ctrl_mutex);
+#ifdef CONFIG_CALL_THUNKS
void (*x86_return_thunk)(void) __ro_after_init = &__x86_return_thunk;
+#endif
/* Update SPEC_CTRL MSR and its cached copy unconditionally */
static void update_spec_ctrl(u64 val)
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -368,7 +368,7 @@ create_trampoline(struct ftrace_ops *ops
ip = trampoline + size;
if (cpu_feature_enabled(X86_FEATURE_RETHUNK))
- __text_gen_insn(ip, JMP32_INSN_OPCODE, ip, &__x86_return_thunk, JMP32_INSN_SIZE);
+ __text_gen_insn(ip, JMP32_INSN_OPCODE, ip, x86_return_thunk, JMP32_INSN_SIZE);
else
memcpy(ip, retq, sizeof(retq));
--- a/arch/x86/kernel/static_call.c
+++ b/arch/x86/kernel/static_call.c
@@ -52,7 +52,7 @@ static void __ref __static_call_transfor
case RET:
if (cpu_feature_enabled(X86_FEATURE_RETHUNK))
- code = text_gen_insn(JMP32_INSN_OPCODE, insn, &__x86_return_thunk);
+ code = text_gen_insn(JMP32_INSN_OPCODE, insn, x86_return_thunk);
else
code = &retinsn;
break;
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -411,7 +411,7 @@ static void emit_return(u8 **pprog, u8 *
u8 *prog = *pprog;
if (cpu_feature_enabled(X86_FEATURE_RETHUNK)) {
- emit_jump(&prog, &__x86_return_thunk, ip);
+ emit_jump(&prog, x86_return_thunk, ip);
} else {
EMIT1(0xC3); /* ret */
if (IS_ENABLED(CONFIG_SLS))
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 093/245] Revert "x86/alternative: Make custom return thunk unconditional"
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 092/245] x86/returnthunk: Allow different return thunks Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 094/245] x86/alternative: Make custom return thunk unconditional Greg Kroah-Hartman
` (162 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Borislav Petkov (AMD)
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Borislav Petkov (AMD)" <bp@alien8.de>
This reverts commit 08f7cfd44f77b2796582bc26164fdef44dd33b6c.
Revert the backport of upstream commit:
095b8303f383 ("x86/alternative: Make custom return thunk unconditional")
in order to backport the full version now that
770ae1b70952 ("x86/returnthunk: Allow different return thunks")
has been backported.
Revert it here so that the build breakage is kept at minimum.
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/nospec-branch.h | 4 ----
arch/x86/kernel/cpu/bugs.c | 4 ----
2 files changed, 8 deletions(-)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -190,11 +190,7 @@
_ASM_PTR " 999b\n\t" \
".popsection\n\t"
-#ifdef CONFIG_RETHUNK
extern void __x86_return_thunk(void);
-#else
-static inline void __x86_return_thunk(void) {}
-#endif
extern void retbleed_return_thunk(void);
extern void srso_return_thunk(void);
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -62,10 +62,6 @@ EXPORT_SYMBOL_GPL(x86_pred_cmd);
static DEFINE_MUTEX(spec_ctrl_mutex);
-#ifdef CONFIG_CALL_THUNKS
-void (*x86_return_thunk)(void) __ro_after_init = &__x86_return_thunk;
-#endif
-
/* Update SPEC_CTRL MSR and its cached copy unconditionally */
static void update_spec_ctrl(u64 val)
{
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 094/245] x86/alternative: Make custom return thunk unconditional
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 093/245] Revert "x86/alternative: Make custom return thunk unconditional" Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 095/245] serial: amba-pl011: Fix DMA transmission in RS485 mode Greg Kroah-Hartman
` (161 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Borislav Petkov (AMD)
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
Upstream commit: 095b8303f3835c68ac4a8b6d754ca1c3b6230711
There is infrastructure to rewrite return thunks to point to any
random thunk one desires, unwrap that from CALL_THUNKS, which up to
now was the sole user of that.
[ bp: Make the thunks visible on 32-bit and add ifdeffery for the
32-bit builds. ]
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230814121148.775293785@infradead.org
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/nospec-branch.h | 8 ++++----
arch/x86/kernel/alternative.c | 4 ----
arch/x86/kernel/cpu/bugs.c | 2 ++
3 files changed, 6 insertions(+), 8 deletions(-)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -190,7 +190,11 @@
_ASM_PTR " 999b\n\t" \
".popsection\n\t"
+#ifdef CONFIG_RETHUNK
extern void __x86_return_thunk(void);
+#else
+static inline void __x86_return_thunk(void) {}
+#endif
extern void retbleed_return_thunk(void);
extern void srso_return_thunk(void);
@@ -203,11 +207,7 @@ extern void srso_alias_untrain_ret(void)
extern void entry_untrain_ret(void);
extern void entry_ibpb(void);
-#ifdef CONFIG_CALL_THUNKS
extern void (*x86_return_thunk)(void);
-#else
-#define x86_return_thunk (&__x86_return_thunk)
-#endif
#ifdef CONFIG_RETPOLINE
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -522,10 +522,6 @@ void __init_or_module noinline apply_ret
#ifdef CONFIG_RETHUNK
-#ifdef CONFIG_CALL_THUNKS
-void (*x86_return_thunk)(void) __ro_after_init = &__x86_return_thunk;
-#endif
-
/*
* Rewrite the compiler generated return thunk tail-calls.
*
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -62,6 +62,8 @@ EXPORT_SYMBOL_GPL(x86_pred_cmd);
static DEFINE_MUTEX(spec_ctrl_mutex);
+void (*x86_return_thunk)(void) __ro_after_init = &__x86_return_thunk;
+
/* Update SPEC_CTRL MSR and its cached copy unconditionally */
static void update_spec_ctrl(u64 val)
{
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 095/245] serial: amba-pl011: Fix DMA transmission in RS485 mode
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 094/245] x86/alternative: Make custom return thunk unconditional Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 096/245] usb: dwc3: gadget: Dont disconnect if not started Greg Kroah-Hartman
` (160 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lino Sanfilippo
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
commit 3b69e32e151bc4a4e3c785cbdb1f918d5ee337ed upstream.
When DMA is used in RS485 mode make sure that the UARTs tx section is
enabled before the DMA buffers are queued for transmission.
Cc: stable@vger.kernel.org
Fixes: 8d479237727c ("serial: amba-pl011: add RS485 support")
Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
Link: https://lore.kernel.org/r/20240216224709.9928-2-l.sanfilippo@kunbus.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/amba-pl011.c | 60 ++++++++++++++++++++--------------------
1 file changed, 30 insertions(+), 30 deletions(-)
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1350,11 +1350,41 @@ static void pl011_start_tx_pio(struct ua
}
}
+static void pl011_rs485_tx_start(struct uart_amba_port *uap)
+{
+ struct uart_port *port = &uap->port;
+ u32 cr;
+
+ /* Enable transmitter */
+ cr = pl011_read(uap, REG_CR);
+ cr |= UART011_CR_TXE;
+
+ /* Disable receiver if half-duplex */
+ if (!(port->rs485.flags & SER_RS485_RX_DURING_TX))
+ cr &= ~UART011_CR_RXE;
+
+ if (port->rs485.flags & SER_RS485_RTS_ON_SEND)
+ cr &= ~UART011_CR_RTS;
+ else
+ cr |= UART011_CR_RTS;
+
+ pl011_write(cr, uap, REG_CR);
+
+ if (port->rs485.delay_rts_before_send)
+ mdelay(port->rs485.delay_rts_before_send);
+
+ uap->rs485_tx_started = true;
+}
+
static void pl011_start_tx(struct uart_port *port)
{
struct uart_amba_port *uap =
container_of(port, struct uart_amba_port, port);
+ if ((uap->port.rs485.flags & SER_RS485_ENABLED) &&
+ !uap->rs485_tx_started)
+ pl011_rs485_tx_start(uap);
+
if (!pl011_dma_tx_start(uap))
pl011_start_tx_pio(uap);
}
@@ -1436,42 +1466,12 @@ static bool pl011_tx_char(struct uart_am
return true;
}
-static void pl011_rs485_tx_start(struct uart_amba_port *uap)
-{
- struct uart_port *port = &uap->port;
- u32 cr;
-
- /* Enable transmitter */
- cr = pl011_read(uap, REG_CR);
- cr |= UART011_CR_TXE;
-
- /* Disable receiver if half-duplex */
- if (!(port->rs485.flags & SER_RS485_RX_DURING_TX))
- cr &= ~UART011_CR_RXE;
-
- if (port->rs485.flags & SER_RS485_RTS_ON_SEND)
- cr &= ~UART011_CR_RTS;
- else
- cr |= UART011_CR_RTS;
-
- pl011_write(cr, uap, REG_CR);
-
- if (port->rs485.delay_rts_before_send)
- mdelay(port->rs485.delay_rts_before_send);
-
- uap->rs485_tx_started = true;
-}
-
/* Returns true if tx interrupts have to be (kept) enabled */
static bool pl011_tx_chars(struct uart_amba_port *uap, bool from_irq)
{
struct circ_buf *xmit = &uap->port.state->xmit;
int count = uap->fifosize >> 1;
- if ((uap->port.rs485.flags & SER_RS485_ENABLED) &&
- !uap->rs485_tx_started)
- pl011_rs485_tx_start(uap);
-
if (uap->port.x_char) {
if (!pl011_tx_char(uap, uap->port.x_char, from_irq))
return true;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 096/245] usb: dwc3: gadget: Dont disconnect if not started
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 095/245] serial: amba-pl011: Fix DMA transmission in RS485 mode Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 097/245] usb: cdnsp: blocked some cdns3 specific code Greg Kroah-Hartman
` (159 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Szyprowski, Thinh Nguyen
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit b191a18cb5c47109ca696370a74a5062a70adfd0 upstream.
Don't go through soft-disconnection sequence if the controller hasn't
started. Otherwise, there will be timeout and warning reports from the
soft-disconnection flow.
Cc: stable@vger.kernel.org
Fixes: 61a348857e86 ("usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Closes: https://lore.kernel.org/linux-usb/20240215233536.7yejlj3zzkl23vjd@synopsys.com/T/#mb0661cd5f9272602af390c18392b9a36da4f96e6
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/e3be9b929934e0680a6f4b8f6eb11b18ae9c7e07.1708043922.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/gadget.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2501,6 +2501,11 @@ static int dwc3_gadget_soft_disconnect(s
int ret;
spin_lock_irqsave(&dwc->lock, flags);
+ if (!dwc->pullups_connected) {
+ spin_unlock_irqrestore(&dwc->lock, flags);
+ return 0;
+ }
+
dwc->connected = false;
/*
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 097/245] usb: cdnsp: blocked some cdns3 specific code
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 096/245] usb: dwc3: gadget: Dont disconnect if not started Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 098/245] usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers Greg Kroah-Hartman
` (158 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pawel Laszczak
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Laszczak <pawell@cadence.com>
commit 18a6be674306c9acb05c08e5c3fd376ef50a917c upstream.
host.c file has some parts of code that were introduced for CDNS3 driver
and should not be used with CDNSP driver.
This patch blocks using these parts of codes by CDNSP driver.
These elements include:
- xhci_plat_cdns3_xhci object
- cdns3 specific XECP_PORT_CAP_REG register
- cdns3 specific XECP_AUX_CTRL_REG1 register
cc: stable@vger.kernel.org
Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Link: https://lore.kernel.org/r/20240206104018.48272-1-pawell@cadence.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/host.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/drivers/usb/cdns3/host.c
+++ b/drivers/usb/cdns3/host.c
@@ -17,6 +17,11 @@
#include "../host/xhci.h"
#include "../host/xhci-plat.h"
+/*
+ * The XECP_PORT_CAP_REG and XECP_AUX_CTRL_REG1 exist only
+ * in Cadence USB3 dual-role controller, so it can't be used
+ * with Cadence CDNSP dual-role controller.
+ */
#define XECP_PORT_CAP_REG 0x8000
#define XECP_AUX_CTRL_REG1 0x8120
@@ -56,6 +61,8 @@ static const struct xhci_plat_priv xhci_
.resume_quirk = xhci_cdns3_resume_quirk,
};
+static const struct xhci_plat_priv xhci_plat_cdnsp_xhci;
+
static int __cdns_host_init(struct cdns *cdns)
{
struct platform_device *xhci;
@@ -80,8 +87,13 @@ static int __cdns_host_init(struct cdns
goto err1;
}
- cdns->xhci_plat_data = kmemdup(&xhci_plat_cdns3_xhci,
- sizeof(struct xhci_plat_priv), GFP_KERNEL);
+ if (cdns->version < CDNSP_CONTROLLER_V2)
+ cdns->xhci_plat_data = kmemdup(&xhci_plat_cdns3_xhci,
+ sizeof(struct xhci_plat_priv), GFP_KERNEL);
+ else
+ cdns->xhci_plat_data = kmemdup(&xhci_plat_cdnsp_xhci,
+ sizeof(struct xhci_plat_priv), GFP_KERNEL);
+
if (!cdns->xhci_plat_data) {
ret = -ENOMEM;
goto err1;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 098/245] usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 097/245] usb: cdnsp: blocked some cdns3 specific code Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 099/245] usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() Greg Kroah-Hartman
` (157 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pawel Laszczak
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Laszczak <pawell@cadence.com>
commit 47625b018c6bc788bc10dd654c82696eb0a5ef11 upstream.
Cadence have several controllers from 0x000403xx family but current
driver suuport detecting only one with DID equal 0x0004034E.
It causes that if someone uses different CDNSP controller then driver
will use incorrect version and register space.
Patch fix this issue.
cc: stable@vger.kernel.org
Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Link: https://lore.kernel.org/r/20240215121609.259772-1-pawell@cadence.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/core.c | 1 -
drivers/usb/cdns3/drd.c | 13 +++++++++----
drivers/usb/cdns3/drd.h | 6 +++++-
3 files changed, 14 insertions(+), 6 deletions(-)
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -394,7 +394,6 @@ pm_put:
return ret;
}
-
/**
* cdns_wakeup_irq - interrupt handler for wakeup events
* @irq: irq number for cdns3/cdnsp core device
--- a/drivers/usb/cdns3/drd.c
+++ b/drivers/usb/cdns3/drd.c
@@ -156,7 +156,8 @@ bool cdns_is_device(struct cdns *cdns)
*/
static void cdns_otg_disable_irq(struct cdns *cdns)
{
- writel(0, &cdns->otg_irq_regs->ien);
+ if (cdns->version)
+ writel(0, &cdns->otg_irq_regs->ien);
}
/**
@@ -418,15 +419,20 @@ int cdns_drd_init(struct cdns *cdns)
cdns->otg_regs = (void __iomem *)&cdns->otg_v1_regs->cmd;
- if (readl(&cdns->otg_cdnsp_regs->did) == OTG_CDNSP_DID) {
+ state = readl(&cdns->otg_cdnsp_regs->did);
+
+ if (OTG_CDNSP_CHECK_DID(state)) {
cdns->otg_irq_regs = (struct cdns_otg_irq_regs __iomem *)
&cdns->otg_cdnsp_regs->ien;
cdns->version = CDNSP_CONTROLLER_V2;
- } else {
+ } else if (OTG_CDNS3_CHECK_DID(state)) {
cdns->otg_irq_regs = (struct cdns_otg_irq_regs __iomem *)
&cdns->otg_v1_regs->ien;
writel(1, &cdns->otg_v1_regs->simulate);
cdns->version = CDNS3_CONTROLLER_V1;
+ } else {
+ dev_err(cdns->dev, "not supporte DID=0x%08x\n", state);
+ return -EINVAL;
}
dev_dbg(cdns->dev, "DRD version v1 (ID: %08x, rev: %08x)\n",
@@ -479,7 +485,6 @@ int cdns_drd_exit(struct cdns *cdns)
return 0;
}
-
/* Indicate the cdns3 core was power lost before */
bool cdns_power_is_lost(struct cdns *cdns)
{
--- a/drivers/usb/cdns3/drd.h
+++ b/drivers/usb/cdns3/drd.h
@@ -79,7 +79,11 @@ struct cdnsp_otg_regs {
__le32 susp_timing_ctrl;
};
-#define OTG_CDNSP_DID 0x0004034E
+/* CDNSP driver supports 0x000403xx Cadence USB controller family. */
+#define OTG_CDNSP_CHECK_DID(did) (((did) & GENMASK(31, 8)) == 0x00040300)
+
+/* CDNS3 driver supports 0x000402xx Cadence USB controller family. */
+#define OTG_CDNS3_CHECK_DID(did) (((did) & GENMASK(31, 8)) == 0x00040200)
/*
* Common registers interface for both CDNS3 and CDNSP version of DRD.
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 099/245] usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 098/245] usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 100/245] usb: cdns3: fix memory double free when handle zero packet Greg Kroah-Hartman
` (156 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li, Roger Quadros, Peter Chen
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <Frank.Li@nxp.com>
commit cd45f99034b0c8c9cb346dd0d6407a95ca3d36f6 upstream.
...
cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
list_del_init(&priv_req->list);
...
'priv_req' actually free at cdns3_gadget_ep_free_request(). But
list_del_init() use priv_req->list after it.
[ 1542.642868][ T534] BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xd4
[ 1542.642868][ T534]
[ 1542.653162][ T534] Use-after-free read at 0x000000009ed0ba99 (in kfence-#3):
[ 1542.660311][ T534] __list_del_entry_valid+0x10/0xd4
[ 1542.665375][ T534] cdns3_gadget_ep_disable+0x1f8/0x388 [cdns3]
[ 1542.671571][ T534] usb_ep_disable+0x44/0xe4
[ 1542.675948][ T534] ffs_func_eps_disable+0x64/0xc8
[ 1542.680839][ T534] ffs_func_set_alt+0x74/0x368
[ 1542.685478][ T534] ffs_func_disable+0x18/0x28
Move list_del_init() before cdns3_gadget_ep_free_request() to resolve this
problem.
Cc: stable@vger.kernel.org
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Roger Quadros <rogerq@kernel.org>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20240202154217.661867-1-Frank.Li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/cdns3-gadget.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2537,11 +2537,11 @@ static int cdns3_gadget_ep_disable(struc
while (!list_empty(&priv_ep->wa2_descmiss_req_list)) {
priv_req = cdns3_next_priv_request(&priv_ep->wa2_descmiss_req_list);
+ list_del_init(&priv_req->list);
kfree(priv_req->request.buf);
cdns3_gadget_ep_free_request(&priv_ep->endpoint,
&priv_req->request);
- list_del_init(&priv_req->list);
--priv_ep->wa2_counter;
}
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 100/245] usb: cdns3: fix memory double free when handle zero packet
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 099/245] usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 101/245] usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs Greg Kroah-Hartman
` (155 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li, Roger Quadros, Peter Chen
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <Frank.Li@nxp.com>
commit 5fd9e45f1ebcd57181358af28506e8a661a260b3 upstream.
829 if (request->complete) {
830 spin_unlock(&priv_dev->lock);
831 usb_gadget_giveback_request(&priv_ep->endpoint,
832 request);
833 spin_lock(&priv_dev->lock);
834 }
835
836 if (request->buf == priv_dev->zlp_buf)
837 cdns3_gadget_ep_free_request(&priv_ep->endpoint, request);
Driver append an additional zero packet request when queue a packet, which
length mod max packet size is 0. When transfer complete, run to line 831,
usb_gadget_giveback_request() will free this requestion. 836 condition is
true, so cdns3_gadget_ep_free_request() free this request again.
Log:
[ 1920.140696][ T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3]
[ 1920.140696][ T150]
[ 1920.151837][ T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36):
[ 1920.159082][ T150] cdns3_gadget_giveback+0x134/0x2c0 [cdns3]
[ 1920.164988][ T150] cdns3_transfer_completed+0x438/0x5f8 [cdns3]
Add check at line 829, skip call usb_gadget_giveback_request() if it is
additional zero length packet request. Needn't call
usb_gadget_giveback_request() because it is allocated in this driver.
Cc: stable@vger.kernel.org
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Roger Quadros <rogerq@kernel.org>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20240202154217.661867-2-Frank.Li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/cdns3-gadget.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -826,7 +826,11 @@ void cdns3_gadget_giveback(struct cdns3_
return;
}
- if (request->complete) {
+ /*
+ * zlp request is appended by driver, needn't call usb_gadget_giveback_request() to notify
+ * gadget composite driver.
+ */
+ if (request->complete && request->buf != priv_dev->zlp_buf) {
spin_unlock(&priv_dev->lock);
usb_gadget_giveback_request(&priv_ep->endpoint,
request);
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 101/245] usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 100/245] usb: cdns3: fix memory double free when handle zero packet Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 102/245] usb: roles: fix NULL pointer issue when put modules reference Greg Kroah-Hartman
` (154 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krishna Kurapati,
Maciej Żenczykowski
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <quic_kriskura@quicinc.com>
commit 76c51146820c5dac629f21deafab0a7039bc3ccd upstream.
It is observed sometimes when tethering is used over NCM with Windows 11
as host, at some instances, the gadget_giveback has one byte appended at
the end of a proper NTB. When the NTB is parsed, unwrap call looks for
any leftover bytes in SKB provided by u_ether and if there are any pending
bytes, it treats them as a separate NTB and parses it. But in case the
second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that
were parsed properly in the first NTB and saved in rx_list are dropped.
Adding a few custom traces showed the following:
[002] d..1 7828.532866: dwc3_gadget_giveback: ep1out:
req 000000003868811a length 1025/16384 zsI ==> 0
[002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025
[002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342
[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67
[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400
[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10
[002] d..1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames
In this case, the giveback is of 1025 bytes and block length is 1024.
The rest 1 byte (which is 0x00) won't be parsed resulting in drop of
all datagrams in rx_list.
Same is case with packets of size 2048:
[002] d..1 7828.557948: dwc3_gadget_giveback: ep1out:
req 0000000011dfd96e length 2049/16384 zsI ==> 0
[002] d..1 7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342
[002] d..1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800
Lecroy shows one byte coming in extra confirming that the byte is coming
in from PC:
Transfer 2959 - Bytes Transferred(1025) Timestamp((18.524 843 590)
- Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590)
--- Packet 4063861
Data(1024 bytes)
Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590)
--- Packet 4063863
Data(1 byte)
Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722)
According to Windows driver, no ZLP is needed if wBlockLength is non-zero,
because the non-zero wBlockLength has already told the function side the
size of transfer to be expected. However, there are in-market NCM devices
that rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize.
To deal with such devices, it pads an extra 0 at end so the transfer is no
longer multiple of wMaxPacketSize.
Cc: <stable@vger.kernel.org>
Fixes: 9f6ce4240a2b ("usb: gadget: f_ncm.c added")
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Link: https://lore.kernel.org/r/20240205074650.200304-1-quic_kriskura@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_ncm.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1344,7 +1344,15 @@ parse_ntb:
"Parsed NTB with %d frames\n", dgram_counter);
to_process -= block_len;
- if (to_process != 0) {
+
+ /*
+ * Windows NCM driver avoids USB ZLPs by adding a 1-byte
+ * zero pad as needed.
+ */
+ if (to_process == 1 &&
+ (*(unsigned char *)(ntb_ptr + block_len) == 0x00)) {
+ to_process--;
+ } else if (to_process > 0) {
ntb_ptr = (unsigned char *)(ntb_ptr + block_len);
goto parse_ntb;
}
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 102/245] usb: roles: fix NULL pointer issue when put modules reference
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 101/245] usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 103/245] usb: roles: dont get/set_role() when usb_role_switch is unregistered Greg Kroah-Hartman
` (153 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Yang, Heikki Krogerus
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
commit 1c9be13846c0b2abc2480602f8ef421360e1ad9e upstream.
In current design, usb role class driver will get usb_role_switch parent's
module reference after the user get usb_role_switch device and put the
reference after the user put the usb_role_switch device. However, the
parent device of usb_role_switch may be removed before the user put the
usb_role_switch. If so, then, NULL pointer issue will be met when the user
put the parent module's reference.
This will save the module pointer in structure of usb_role_switch. Then,
we don't need to find module by iterating long relations.
Fixes: 5c54fcac9a9d ("usb: roles: Take care of driver module reference counting")
cc: stable@vger.kernel.org
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240129093739.2371530-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/roles/class.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
--- a/drivers/usb/roles/class.c
+++ b/drivers/usb/roles/class.c
@@ -19,6 +19,7 @@ static struct class *role_class;
struct usb_role_switch {
struct device dev;
struct mutex lock; /* device lock*/
+ struct module *module; /* the module this device depends on */
enum usb_role role;
/* From descriptor */
@@ -133,7 +134,7 @@ struct usb_role_switch *usb_role_switch_
usb_role_switch_match);
if (!IS_ERR_OR_NULL(sw))
- WARN_ON(!try_module_get(sw->dev.parent->driver->owner));
+ WARN_ON(!try_module_get(sw->module));
return sw;
}
@@ -155,7 +156,7 @@ struct usb_role_switch *fwnode_usb_role_
sw = fwnode_connection_find_match(fwnode, "usb-role-switch",
NULL, usb_role_switch_match);
if (!IS_ERR_OR_NULL(sw))
- WARN_ON(!try_module_get(sw->dev.parent->driver->owner));
+ WARN_ON(!try_module_get(sw->module));
return sw;
}
@@ -170,7 +171,7 @@ EXPORT_SYMBOL_GPL(fwnode_usb_role_switch
void usb_role_switch_put(struct usb_role_switch *sw)
{
if (!IS_ERR_OR_NULL(sw)) {
- module_put(sw->dev.parent->driver->owner);
+ module_put(sw->module);
put_device(&sw->dev);
}
}
@@ -187,15 +188,18 @@ struct usb_role_switch *
usb_role_switch_find_by_fwnode(const struct fwnode_handle *fwnode)
{
struct device *dev;
+ struct usb_role_switch *sw = NULL;
if (!fwnode)
return NULL;
dev = class_find_device_by_fwnode(role_class, fwnode);
- if (dev)
- WARN_ON(!try_module_get(dev->parent->driver->owner));
+ if (dev) {
+ sw = to_role_switch(dev);
+ WARN_ON(!try_module_get(sw->module));
+ }
- return dev ? to_role_switch(dev) : NULL;
+ return sw;
}
EXPORT_SYMBOL_GPL(usb_role_switch_find_by_fwnode);
@@ -337,6 +341,7 @@ usb_role_switch_register(struct device *
sw->set = desc->set;
sw->get = desc->get;
+ sw->module = parent->driver->owner;
sw->dev.parent = parent;
sw->dev.fwnode = desc->fwnode;
sw->dev.class = role_class;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 103/245] usb: roles: dont get/set_role() when usb_role_switch is unregistered
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 102/245] usb: roles: fix NULL pointer issue when put modules reference Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 104/245] mptcp: fix lockless access in subflow ULP diag Greg Kroah-Hartman
` (152 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Yang, Heikki Krogerus
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
commit b787a3e781759026a6212736ef8e52cf83d1821a upstream.
There is a possibility that usb_role_switch device is unregistered before
the user put usb_role_switch. In this case, the user may still want to
get/set_role() since the user can't sense the changes of usb_role_switch.
This will add a flag to show if usb_role_switch is already registered and
avoid unwanted behaviors.
Fixes: fde0aa6c175a ("usb: common: Small class for USB role switches")
cc: stable@vger.kernel.org
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240129093739.2371530-2-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/roles/class.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/usb/roles/class.c
+++ b/drivers/usb/roles/class.c
@@ -21,6 +21,7 @@ struct usb_role_switch {
struct mutex lock; /* device lock*/
struct module *module; /* the module this device depends on */
enum usb_role role;
+ bool registered;
/* From descriptor */
struct device *usb2_port;
@@ -47,6 +48,9 @@ int usb_role_switch_set_role(struct usb_
if (IS_ERR_OR_NULL(sw))
return 0;
+ if (!sw->registered)
+ return -EOPNOTSUPP;
+
mutex_lock(&sw->lock);
ret = sw->set(sw, role);
@@ -72,7 +76,7 @@ enum usb_role usb_role_switch_get_role(s
{
enum usb_role role;
- if (IS_ERR_OR_NULL(sw))
+ if (IS_ERR_OR_NULL(sw) || !sw->registered)
return USB_ROLE_NONE;
mutex_lock(&sw->lock);
@@ -356,6 +360,8 @@ usb_role_switch_register(struct device *
return ERR_PTR(ret);
}
+ sw->registered = true;
+
/* TODO: Symlinks for the host port and the device controller. */
return sw;
@@ -370,8 +376,10 @@ EXPORT_SYMBOL_GPL(usb_role_switch_regist
*/
void usb_role_switch_unregister(struct usb_role_switch *sw)
{
- if (!IS_ERR_OR_NULL(sw))
+ if (!IS_ERR_OR_NULL(sw)) {
+ sw->registered = false;
device_unregister(&sw->dev);
+ }
}
EXPORT_SYMBOL_GPL(usb_role_switch_unregister);
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 104/245] mptcp: fix lockless access in subflow ULP diag
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 103/245] usb: roles: dont get/set_role() when usb_role_switch is unregistered Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 105/245] clk: imx: imx8mp: add shared clk gate for usb suspend clk Greg Kroah-Hartman
` (151 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Mat Martineau,
Matthieu Baerts (NGI0), David S. Miller
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit b8adb69a7d29c2d33eb327bca66476fb6066516b upstream.
Since the introduction of the subflow ULP diag interface, the
dump callback accessed all the subflow data with lockless.
We need either to annotate all the read and write operation accordingly,
or acquire the subflow socket lock. Let's do latter, even if slower, to
avoid a diffstat havoc.
Fixes: 5147dfb50832 ("mptcp: allow dumping subflow context to userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/tcp.h | 2 +-
net/mptcp/diag.c | 6 +++++-
net/tls/tls_main.c | 2 +-
3 files changed, 7 insertions(+), 3 deletions(-)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -2233,7 +2233,7 @@ struct tcp_ulp_ops {
/* cleanup ulp */
void (*release)(struct sock *sk);
/* diagnostic */
- int (*get_info)(const struct sock *sk, struct sk_buff *skb);
+ int (*get_info)(struct sock *sk, struct sk_buff *skb);
size_t (*get_info_size)(const struct sock *sk);
/* clone ulp */
void (*clone)(const struct request_sock *req, struct sock *newsk,
--- a/net/mptcp/diag.c
+++ b/net/mptcp/diag.c
@@ -13,17 +13,19 @@
#include <uapi/linux/mptcp.h>
#include "protocol.h"
-static int subflow_get_info(const struct sock *sk, struct sk_buff *skb)
+static int subflow_get_info(struct sock *sk, struct sk_buff *skb)
{
struct mptcp_subflow_context *sf;
struct nlattr *start;
u32 flags = 0;
+ bool slow;
int err;
start = nla_nest_start_noflag(skb, INET_ULP_INFO_MPTCP);
if (!start)
return -EMSGSIZE;
+ slow = lock_sock_fast(sk);
rcu_read_lock();
sf = rcu_dereference(inet_csk(sk)->icsk_ulp_data);
if (!sf) {
@@ -69,11 +71,13 @@ static int subflow_get_info(const struct
}
rcu_read_unlock();
+ unlock_sock_fast(sk, slow);
nla_nest_end(skb, start);
return 0;
nla_failure:
rcu_read_unlock();
+ unlock_sock_fast(sk, slow);
nla_nest_cancel(skb, start);
return err;
}
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -805,7 +805,7 @@ static void tls_update(struct sock *sk,
}
}
-static int tls_get_info(const struct sock *sk, struct sk_buff *skb)
+static int tls_get_info(struct sock *sk, struct sk_buff *skb)
{
u16 version, cipher_type;
struct tls_context *ctx;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 105/245] clk: imx: imx8mp: add shared clk gate for usb suspend clk
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 104/245] mptcp: fix lockless access in subflow ULP diag Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 106/245] clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents Greg Kroah-Hartman
` (150 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Stein, Li Jun, Abel Vesa,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Jun <jun.li@nxp.com>
[ Upstream commit ed1f4ccfe947a3e1018a3bd7325134574c7ff9b3 ]
32K usb suspend clock gate is shared with usb_root_clk, this
shared clock gate was initially defined only for usb suspend
clock, usb suspend clk is kept on while system is active or
system sleep with usb wakeup enabled, so usb root clock is
fine with this situation; with the commit cf7f3f4fa9e5
("clk: imx8mp: fix usb_root_clk parent"), this clock gate is
changed to be for usb root clock, but usb root clock will
be off while usb is suspended, so usb suspend clock will be
gated too, this cause some usb functionalities will not work,
so define this clock to be a shared clock gate to conform with
the real HW status.
Fixes: 9c140d9926761 ("clk: imx: Add support for i.MX8MP clock driver")
Cc: stable@vger.kernel.org # v5.19+
Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://lore.kernel.org/r/1664549663-20364-2-git-send-email-jun.li@nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk-imx8mp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c
index 2f898c0bc867c..aeb611eaabd3b 100644
--- a/drivers/clk/imx/clk-imx8mp.c
+++ b/drivers/clk/imx/clk-imx8mp.c
@@ -17,6 +17,7 @@
static u32 share_count_nand;
static u32 share_count_media;
+static u32 share_count_usb;
static const char * const pll_ref_sels[] = { "osc_24m", "dummy", "dummy", "dummy", };
static const char * const audio_pll1_bypass_sels[] = {"audio_pll1", "audio_pll1_ref_sel", };
@@ -667,7 +668,8 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
hws[IMX8MP_CLK_UART2_ROOT] = imx_clk_hw_gate4("uart2_root_clk", "uart2", ccm_base + 0x44a0, 0);
hws[IMX8MP_CLK_UART3_ROOT] = imx_clk_hw_gate4("uart3_root_clk", "uart3", ccm_base + 0x44b0, 0);
hws[IMX8MP_CLK_UART4_ROOT] = imx_clk_hw_gate4("uart4_root_clk", "uart4", ccm_base + 0x44c0, 0);
- hws[IMX8MP_CLK_USB_ROOT] = imx_clk_hw_gate4("usb_root_clk", "hsio_axi", ccm_base + 0x44d0, 0);
+ hws[IMX8MP_CLK_USB_ROOT] = imx_clk_hw_gate2_shared2("usb_root_clk", "hsio_axi", ccm_base + 0x44d0, 0, &share_count_usb);
+ hws[IMX8MP_CLK_USB_SUSP] = imx_clk_hw_gate2_shared2("usb_suspend_clk", "osc_32k", ccm_base + 0x44d0, 0, &share_count_usb);
hws[IMX8MP_CLK_USB_PHY_ROOT] = imx_clk_hw_gate4("usb_phy_root_clk", "usb_phy_ref", ccm_base + 0x44f0, 0);
hws[IMX8MP_CLK_USDHC1_ROOT] = imx_clk_hw_gate4("usdhc1_root_clk", "usdhc1", ccm_base + 0x4510, 0);
hws[IMX8MP_CLK_USDHC2_ROOT] = imx_clk_hw_gate4("usdhc2_root_clk", "usdhc2", ccm_base + 0x4520, 0);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 106/245] clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 105/245] clk: imx: imx8mp: add shared clk gate for usb suspend clk Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 107/245] clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents Greg Kroah-Hartman
` (149 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Bjorn Andersson,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 712c64caf31374de57aa193a9dff57172b2f6f82 ]
On the QCS404 platform the driver for the Global Clock Controller
doens't define gpll0_out_aux and gpll4_out_aux clocks, so it's not
possible to use them as parents. Remove entries for these clocks.
Note: backporting this patch to earlier kernels would also require a
previous patch which switches the gcc driver to use ARRAY_SIZE for
parent data arrays.
Fixes: 652f1813c113 ("clk: qcom: gcc: Add global clock controller driver for QCS404")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221226042154.2666748-6-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-qcs404.c | 16 ----------------
1 file changed, 16 deletions(-)
diff --git a/drivers/clk/qcom/gcc-qcs404.c b/drivers/clk/qcom/gcc-qcs404.c
index 46d314d692505..4299fe8f19274 100644
--- a/drivers/clk/qcom/gcc-qcs404.c
+++ b/drivers/clk/qcom/gcc-qcs404.c
@@ -25,11 +25,9 @@ enum {
P_CORE_BI_PLL_TEST_SE,
P_DSI0_PHY_PLL_OUT_BYTECLK,
P_DSI0_PHY_PLL_OUT_DSICLK,
- P_GPLL0_OUT_AUX,
P_GPLL0_OUT_MAIN,
P_GPLL1_OUT_MAIN,
P_GPLL3_OUT_MAIN,
- P_GPLL4_OUT_AUX,
P_GPLL4_OUT_MAIN,
P_GPLL6_OUT_AUX,
P_HDMI_PHY_PLL_CLK,
@@ -109,28 +107,24 @@ static const char * const gcc_parent_names_4[] = {
static const struct parent_map gcc_parent_map_5[] = {
{ P_XO, 0 },
{ P_DSI0_PHY_PLL_OUT_BYTECLK, 1 },
- { P_GPLL0_OUT_AUX, 2 },
{ P_CORE_BI_PLL_TEST_SE, 7 },
};
static const char * const gcc_parent_names_5[] = {
"cxo",
"dsi0pll_byteclk_src",
- "gpll0_out_aux",
"core_bi_pll_test_se",
};
static const struct parent_map gcc_parent_map_6[] = {
{ P_XO, 0 },
{ P_DSI0_PHY_PLL_OUT_BYTECLK, 2 },
- { P_GPLL0_OUT_AUX, 3 },
{ P_CORE_BI_PLL_TEST_SE, 7 },
};
static const char * const gcc_parent_names_6[] = {
"cxo",
"dsi0_phy_pll_out_byteclk",
- "gpll0_out_aux",
"core_bi_pll_test_se",
};
@@ -139,7 +133,6 @@ static const struct parent_map gcc_parent_map_7[] = {
{ P_GPLL0_OUT_MAIN, 1 },
{ P_GPLL3_OUT_MAIN, 2 },
{ P_GPLL6_OUT_AUX, 3 },
- { P_GPLL4_OUT_AUX, 4 },
{ P_CORE_BI_PLL_TEST_SE, 7 },
};
@@ -148,7 +141,6 @@ static const char * const gcc_parent_names_7[] = {
"gpll0_out_main",
"gpll3_out_main",
"gpll6_out_aux",
- "gpll4_out_aux",
"core_bi_pll_test_se",
};
@@ -207,14 +199,12 @@ static const char * const gcc_parent_names_11[] = {
static const struct parent_map gcc_parent_map_12[] = {
{ P_XO, 0 },
{ P_DSI0_PHY_PLL_OUT_DSICLK, 1 },
- { P_GPLL0_OUT_AUX, 2 },
{ P_CORE_BI_PLL_TEST_SE, 7 },
};
static const char * const gcc_parent_names_12[] = {
"cxo",
"dsi0pll_pclk_src",
- "gpll0_out_aux",
"core_bi_pll_test_se",
};
@@ -237,40 +227,34 @@ static const char * const gcc_parent_names_13[] = {
static const struct parent_map gcc_parent_map_14[] = {
{ P_XO, 0 },
{ P_GPLL0_OUT_MAIN, 1 },
- { P_GPLL4_OUT_AUX, 2 },
{ P_CORE_BI_PLL_TEST_SE, 7 },
};
static const char * const gcc_parent_names_14[] = {
"cxo",
"gpll0_out_main",
- "gpll4_out_aux",
"core_bi_pll_test_se",
};
static const struct parent_map gcc_parent_map_15[] = {
{ P_XO, 0 },
- { P_GPLL0_OUT_AUX, 2 },
{ P_CORE_BI_PLL_TEST_SE, 7 },
};
static const char * const gcc_parent_names_15[] = {
"cxo",
- "gpll0_out_aux",
"core_bi_pll_test_se",
};
static const struct parent_map gcc_parent_map_16[] = {
{ P_XO, 0 },
{ P_GPLL0_OUT_MAIN, 1 },
- { P_GPLL0_OUT_AUX, 2 },
{ P_CORE_BI_PLL_TEST_SE, 7 },
};
static const char * const gcc_parent_names_16[] = {
"cxo",
"gpll0_out_main",
- "gpll0_out_aux",
"core_bi_pll_test_se",
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 107/245] clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 106/245] clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 108/245] mtd: rawnand: sunxi: Fix the size of the last OOB region Greg Kroah-Hartman
` (148 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 47d94d30cd3dcc743241b4208b1eec7247610c84 ]
The QCS404 uses 28nm LPM DSI PHY, which registers dsi0pll and
dsi0pllbyte clocks. Fix all DSI PHY clock names used as parents inside
the GCC driver.
Fixes: 652f1813c113 ("clk: qcom: gcc: Add global clock controller driver for QCS404")
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221226042154.2666748-7-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-qcs404.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/clk/qcom/gcc-qcs404.c b/drivers/clk/qcom/gcc-qcs404.c
index 4299fe8f19274..a7a9884799cd3 100644
--- a/drivers/clk/qcom/gcc-qcs404.c
+++ b/drivers/clk/qcom/gcc-qcs404.c
@@ -112,7 +112,7 @@ static const struct parent_map gcc_parent_map_5[] = {
static const char * const gcc_parent_names_5[] = {
"cxo",
- "dsi0pll_byteclk_src",
+ "dsi0pllbyte",
"core_bi_pll_test_se",
};
@@ -124,7 +124,7 @@ static const struct parent_map gcc_parent_map_6[] = {
static const char * const gcc_parent_names_6[] = {
"cxo",
- "dsi0_phy_pll_out_byteclk",
+ "dsi0pllbyte",
"core_bi_pll_test_se",
};
@@ -167,7 +167,7 @@ static const struct parent_map gcc_parent_map_9[] = {
static const char * const gcc_parent_names_9[] = {
"cxo",
"gpll0_out_main",
- "dsi0_phy_pll_out_dsiclk",
+ "dsi0pll",
"gpll6_out_aux",
"core_bi_pll_test_se",
};
@@ -204,7 +204,7 @@ static const struct parent_map gcc_parent_map_12[] = {
static const char * const gcc_parent_names_12[] = {
"cxo",
- "dsi0pll_pclk_src",
+ "dsi0pll",
"core_bi_pll_test_se",
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 108/245] mtd: rawnand: sunxi: Fix the size of the last OOB region
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 107/245] clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 109/245] RISC-V: fix funct4 definition for c.jalr in parse_asm.h Greg Kroah-Hartman
` (147 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Holland, Dhruva Gole,
Miquel Raynal, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <samuel@sholland.org>
[ Upstream commit 34569d869532b54d6e360d224a0254dcdd6a1785 ]
The previous code assigned to the wrong structure member.
Fixes: c66811e6d350 ("mtd: nand: sunxi: switch to mtd_ooblayout_ops")
Signed-off-by: Samuel Holland <samuel@sholland.org>
Acked-By: Dhruva Gole <d-gole@ti.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20221229181526.53766-6-samuel@sholland.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/sunxi_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index ea953e31933eb..e03dcdd8bd589 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -1609,7 +1609,7 @@ static int sunxi_nand_ooblayout_free(struct mtd_info *mtd, int section,
if (section < ecc->steps)
oobregion->length = 4;
else
- oobregion->offset = mtd->oobsize - oobregion->offset;
+ oobregion->length = mtd->oobsize - oobregion->offset;
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 109/245] RISC-V: fix funct4 definition for c.jalr in parse_asm.h
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 108/245] mtd: rawnand: sunxi: Fix the size of the last OOB region Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 110/245] Input: iqs269a - drop unused device node references Greg Kroah-Hartman
` (146 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Jones, Lad Prabhakar,
Heiko Stuebner, Palmer Dabbelt, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Stuebner <heiko.stuebner@vrull.eu>
[ Upstream commit a3775634f6da23f5511d0282d7e792cf606e5f3b ]
The opcode definition for c.jalr is
c.jalr c_rs1_n0 1..0=2 15..13=4 12=1 6..2=0
This means funct4 consisting of bit [15:12] is 1001b, so the value is 0x9.
Fixes: edde5584c7ab ("riscv: Add SW single-step support for KDB")
Reported-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Heiko Stuebner <heiko.stuebner@vrull.eu>
Link: https://lore.kernel.org/r/20221223221332.4127602-2-heiko@sntech.de
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/include/asm/parse_asm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/include/asm/parse_asm.h b/arch/riscv/include/asm/parse_asm.h
index 3cd00332d70f5..ad254da85e615 100644
--- a/arch/riscv/include/asm/parse_asm.h
+++ b/arch/riscv/include/asm/parse_asm.h
@@ -128,7 +128,7 @@
#define FUNCT3_C_J 0xa000
#define FUNCT3_C_JAL 0x2000
#define FUNCT4_C_JR 0x8000
-#define FUNCT4_C_JALR 0xf000
+#define FUNCT4_C_JALR 0x9000
#define FUNCT12_SRET 0x10200000
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 110/245] Input: iqs269a - drop unused device node references
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 109/245] RISC-V: fix funct4 definition for c.jalr in parse_asm.h Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 111/245] Input: iqs269a - configure device with a single block write Greg Kroah-Hartman
` (145 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff LaBundy, Dmitry Torokhov,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff LaBundy <jeff@labundy.com>
[ Upstream commit 59bc9cb3b80abaa42643abede0d5db8477901d9c ]
Each call to device/fwnode_get_named_child_node() must be matched
with a call to fwnode_handle_put() once the corresponding node is
no longer in use. This ensures a reference count remains balanced
in the case of dynamic device tree support.
Currently, the driver does not call fwnode_handle_put() on nested
event nodes. This patch solves this problem by adding the missing
instances of fwnode_handle_put().
As part of this change, the logic which parses each channel's key
code is gently refactored in order to reduce the number of places
from which fwnode_handle_put() is called.
Fixes: 04e49867fad1 ("Input: add support for Azoteq IQS269A")
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Link: https://lore.kernel.org/r/Y7Rsx68k/gvDVXAt@nixie71
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/iqs269a.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/input/misc/iqs269a.c b/drivers/input/misc/iqs269a.c
index a348247d3d38f..ea3c97c5f764f 100644
--- a/drivers/input/misc/iqs269a.c
+++ b/drivers/input/misc/iqs269a.c
@@ -694,6 +694,7 @@ static int iqs269_parse_chan(struct iqs269_private *iqs269,
dev_err(&client->dev,
"Invalid channel %u threshold: %u\n",
reg, val);
+ fwnode_handle_put(ev_node);
return -EINVAL;
}
@@ -707,6 +708,7 @@ static int iqs269_parse_chan(struct iqs269_private *iqs269,
dev_err(&client->dev,
"Invalid channel %u hysteresis: %u\n",
reg, val);
+ fwnode_handle_put(ev_node);
return -EINVAL;
}
@@ -721,8 +723,16 @@ static int iqs269_parse_chan(struct iqs269_private *iqs269,
}
}
- if (fwnode_property_read_u32(ev_node, "linux,code", &val))
+ error = fwnode_property_read_u32(ev_node, "linux,code", &val);
+ fwnode_handle_put(ev_node);
+ if (error == -EINVAL) {
continue;
+ } else if (error) {
+ dev_err(&client->dev,
+ "Failed to read channel %u code: %d\n", reg,
+ error);
+ return error;
+ }
switch (reg) {
case IQS269_CHx_HALL_ACTIVE:
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 111/245] Input: iqs269a - configure device with a single block write
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 110/245] Input: iqs269a - drop unused device node references Greg Kroah-Hartman
@ 2024-02-27 13:24 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 112/245] Input: iqs269a - increase interrupt handler return delay Greg Kroah-Hartman
` (144 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff LaBundy, Mattijs Korpershoek,
Dmitry Torokhov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff LaBundy <jeff@labundy.com>
[ Upstream commit 3689abfc4e369a643d758a02fb9ad0b2403d6d6d ]
Unless it is being done as part of servicing a soft reset interrupt,
configuring channels on-the-fly (as is the case when writing to the
ati_trigger attribute) may cause GPIO3 (which reflects the state of
touch for a selected channel) to be inadvertently asserted.
To solve this problem, follow the vendor's recommendation and write
all channel configuration as well as the REDO_ATI register field as
part of a single block write. This ensures the device has been told
to re-calibrate itself following an I2C stop condition, after which
sensing resumes and GPIO3 may be asserted.
Fixes: 04e49867fad1 ("Input: add support for Azoteq IQS269A")
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
Link: https://lore.kernel.org/r/Y7Rs8GyV7g0nF5Yy@nixie71
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/iqs269a.c | 98 ++++++++++++++----------------------
1 file changed, 39 insertions(+), 59 deletions(-)
diff --git a/drivers/input/misc/iqs269a.c b/drivers/input/misc/iqs269a.c
index ea3c97c5f764f..2124d08c55b79 100644
--- a/drivers/input/misc/iqs269a.c
+++ b/drivers/input/misc/iqs269a.c
@@ -96,8 +96,6 @@
#define IQS269_MISC_B_TRACKING_UI_ENABLE BIT(4)
#define IQS269_MISC_B_FILT_STR_SLIDER GENMASK(1, 0)
-#define IQS269_CHx_SETTINGS 0x8C
-
#define IQS269_CHx_ENG_A_MEAS_CAP_SIZE BIT(15)
#define IQS269_CHx_ENG_A_RX_GND_INACTIVE BIT(13)
#define IQS269_CHx_ENG_A_LOCAL_CAP_SIZE BIT(12)
@@ -245,6 +243,18 @@ struct iqs269_ver_info {
u8 padding;
} __packed;
+struct iqs269_ch_reg {
+ u8 rx_enable;
+ u8 tx_enable;
+ __be16 engine_a;
+ __be16 engine_b;
+ __be16 ati_comp;
+ u8 thresh[3];
+ u8 hyst;
+ u8 assoc_select;
+ u8 assoc_weight;
+} __packed;
+
struct iqs269_sys_reg {
__be16 general;
u8 active;
@@ -266,18 +276,7 @@ struct iqs269_sys_reg {
u8 timeout_swipe;
u8 thresh_swipe;
u8 redo_ati;
-} __packed;
-
-struct iqs269_ch_reg {
- u8 rx_enable;
- u8 tx_enable;
- __be16 engine_a;
- __be16 engine_b;
- __be16 ati_comp;
- u8 thresh[3];
- u8 hyst;
- u8 assoc_select;
- u8 assoc_weight;
+ struct iqs269_ch_reg ch_reg[IQS269_NUM_CH];
} __packed;
struct iqs269_flags {
@@ -292,7 +291,6 @@ struct iqs269_private {
struct regmap *regmap;
struct mutex lock;
struct iqs269_switch_desc switches[ARRAY_SIZE(iqs269_events)];
- struct iqs269_ch_reg ch_reg[IQS269_NUM_CH];
struct iqs269_sys_reg sys_reg;
struct input_dev *keypad;
struct input_dev *slider[IQS269_NUM_SL];
@@ -307,6 +305,7 @@ struct iqs269_private {
static int iqs269_ati_mode_set(struct iqs269_private *iqs269,
unsigned int ch_num, unsigned int mode)
{
+ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg;
u16 engine_a;
if (ch_num >= IQS269_NUM_CH)
@@ -317,12 +316,12 @@ static int iqs269_ati_mode_set(struct iqs269_private *iqs269,
mutex_lock(&iqs269->lock);
- engine_a = be16_to_cpu(iqs269->ch_reg[ch_num].engine_a);
+ engine_a = be16_to_cpu(ch_reg[ch_num].engine_a);
engine_a &= ~IQS269_CHx_ENG_A_ATI_MODE_MASK;
engine_a |= (mode << IQS269_CHx_ENG_A_ATI_MODE_SHIFT);
- iqs269->ch_reg[ch_num].engine_a = cpu_to_be16(engine_a);
+ ch_reg[ch_num].engine_a = cpu_to_be16(engine_a);
iqs269->ati_current = false;
mutex_unlock(&iqs269->lock);
@@ -333,13 +332,14 @@ static int iqs269_ati_mode_set(struct iqs269_private *iqs269,
static int iqs269_ati_mode_get(struct iqs269_private *iqs269,
unsigned int ch_num, unsigned int *mode)
{
+ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg;
u16 engine_a;
if (ch_num >= IQS269_NUM_CH)
return -EINVAL;
mutex_lock(&iqs269->lock);
- engine_a = be16_to_cpu(iqs269->ch_reg[ch_num].engine_a);
+ engine_a = be16_to_cpu(ch_reg[ch_num].engine_a);
mutex_unlock(&iqs269->lock);
engine_a &= IQS269_CHx_ENG_A_ATI_MODE_MASK;
@@ -351,6 +351,7 @@ static int iqs269_ati_mode_get(struct iqs269_private *iqs269,
static int iqs269_ati_base_set(struct iqs269_private *iqs269,
unsigned int ch_num, unsigned int base)
{
+ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg;
u16 engine_b;
if (ch_num >= IQS269_NUM_CH)
@@ -379,12 +380,12 @@ static int iqs269_ati_base_set(struct iqs269_private *iqs269,
mutex_lock(&iqs269->lock);
- engine_b = be16_to_cpu(iqs269->ch_reg[ch_num].engine_b);
+ engine_b = be16_to_cpu(ch_reg[ch_num].engine_b);
engine_b &= ~IQS269_CHx_ENG_B_ATI_BASE_MASK;
engine_b |= base;
- iqs269->ch_reg[ch_num].engine_b = cpu_to_be16(engine_b);
+ ch_reg[ch_num].engine_b = cpu_to_be16(engine_b);
iqs269->ati_current = false;
mutex_unlock(&iqs269->lock);
@@ -395,13 +396,14 @@ static int iqs269_ati_base_set(struct iqs269_private *iqs269,
static int iqs269_ati_base_get(struct iqs269_private *iqs269,
unsigned int ch_num, unsigned int *base)
{
+ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg;
u16 engine_b;
if (ch_num >= IQS269_NUM_CH)
return -EINVAL;
mutex_lock(&iqs269->lock);
- engine_b = be16_to_cpu(iqs269->ch_reg[ch_num].engine_b);
+ engine_b = be16_to_cpu(ch_reg[ch_num].engine_b);
mutex_unlock(&iqs269->lock);
switch (engine_b & IQS269_CHx_ENG_B_ATI_BASE_MASK) {
@@ -429,6 +431,7 @@ static int iqs269_ati_base_get(struct iqs269_private *iqs269,
static int iqs269_ati_target_set(struct iqs269_private *iqs269,
unsigned int ch_num, unsigned int target)
{
+ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg;
u16 engine_b;
if (ch_num >= IQS269_NUM_CH)
@@ -439,12 +442,12 @@ static int iqs269_ati_target_set(struct iqs269_private *iqs269,
mutex_lock(&iqs269->lock);
- engine_b = be16_to_cpu(iqs269->ch_reg[ch_num].engine_b);
+ engine_b = be16_to_cpu(ch_reg[ch_num].engine_b);
engine_b &= ~IQS269_CHx_ENG_B_ATI_TARGET_MASK;
engine_b |= target / 32;
- iqs269->ch_reg[ch_num].engine_b = cpu_to_be16(engine_b);
+ ch_reg[ch_num].engine_b = cpu_to_be16(engine_b);
iqs269->ati_current = false;
mutex_unlock(&iqs269->lock);
@@ -455,13 +458,14 @@ static int iqs269_ati_target_set(struct iqs269_private *iqs269,
static int iqs269_ati_target_get(struct iqs269_private *iqs269,
unsigned int ch_num, unsigned int *target)
{
+ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg;
u16 engine_b;
if (ch_num >= IQS269_NUM_CH)
return -EINVAL;
mutex_lock(&iqs269->lock);
- engine_b = be16_to_cpu(iqs269->ch_reg[ch_num].engine_b);
+ engine_b = be16_to_cpu(ch_reg[ch_num].engine_b);
mutex_unlock(&iqs269->lock);
*target = (engine_b & IQS269_CHx_ENG_B_ATI_TARGET_MASK) * 32;
@@ -531,13 +535,7 @@ static int iqs269_parse_chan(struct iqs269_private *iqs269,
if (fwnode_property_present(ch_node, "azoteq,slider1-select"))
iqs269->sys_reg.slider_select[1] |= BIT(reg);
- ch_reg = &iqs269->ch_reg[reg];
-
- error = regmap_raw_read(iqs269->regmap,
- IQS269_CHx_SETTINGS + reg * sizeof(*ch_reg) / 2,
- ch_reg, sizeof(*ch_reg));
- if (error)
- return error;
+ ch_reg = &iqs269->sys_reg.ch_reg[reg];
error = iqs269_parse_mask(ch_node, "azoteq,rx-enable",
&ch_reg->rx_enable);
@@ -1042,10 +1040,8 @@ static int iqs269_parse_prop(struct iqs269_private *iqs269)
static int iqs269_dev_init(struct iqs269_private *iqs269)
{
- struct iqs269_sys_reg *sys_reg = &iqs269->sys_reg;
- struct iqs269_ch_reg *ch_reg;
unsigned int val;
- int error, i;
+ int error;
mutex_lock(&iqs269->lock);
@@ -1055,27 +1051,8 @@ static int iqs269_dev_init(struct iqs269_private *iqs269)
if (error)
goto err_mutex;
- for (i = 0; i < IQS269_NUM_CH; i++) {
- if (!(sys_reg->active & BIT(i)))
- continue;
-
- ch_reg = &iqs269->ch_reg[i];
-
- error = regmap_raw_write(iqs269->regmap,
- IQS269_CHx_SETTINGS + i *
- sizeof(*ch_reg) / 2, ch_reg,
- sizeof(*ch_reg));
- if (error)
- goto err_mutex;
- }
-
- /*
- * The REDO-ATI and ATI channel selection fields must be written in the
- * same block write, so every field between registers 0x80 through 0x8B
- * (inclusive) must be written as well.
- */
- error = regmap_raw_write(iqs269->regmap, IQS269_SYS_SETTINGS, sys_reg,
- sizeof(*sys_reg));
+ error = regmap_raw_write(iqs269->regmap, IQS269_SYS_SETTINGS,
+ &iqs269->sys_reg, sizeof(iqs269->sys_reg));
if (error)
goto err_mutex;
@@ -1349,6 +1326,7 @@ static ssize_t hall_bin_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
struct iqs269_private *iqs269 = dev_get_drvdata(dev);
+ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg;
struct i2c_client *client = iqs269->client;
unsigned int val;
int error;
@@ -1363,8 +1341,8 @@ static ssize_t hall_bin_show(struct device *dev,
if (error)
return error;
- switch (iqs269->ch_reg[IQS269_CHx_HALL_ACTIVE].rx_enable &
- iqs269->ch_reg[IQS269_CHx_HALL_INACTIVE].rx_enable) {
+ switch (ch_reg[IQS269_CHx_HALL_ACTIVE].rx_enable &
+ ch_reg[IQS269_CHx_HALL_INACTIVE].rx_enable) {
case IQS269_HALL_PAD_R:
val &= IQS269_CAL_DATA_A_HALL_BIN_R_MASK;
val >>= IQS269_CAL_DATA_A_HALL_BIN_R_SHIFT;
@@ -1444,9 +1422,10 @@ static ssize_t rx_enable_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
struct iqs269_private *iqs269 = dev_get_drvdata(dev);
+ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg;
return scnprintf(buf, PAGE_SIZE, "%u\n",
- iqs269->ch_reg[iqs269->ch_num].rx_enable);
+ ch_reg[iqs269->ch_num].rx_enable);
}
static ssize_t rx_enable_store(struct device *dev,
@@ -1454,6 +1433,7 @@ static ssize_t rx_enable_store(struct device *dev,
size_t count)
{
struct iqs269_private *iqs269 = dev_get_drvdata(dev);
+ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg;
unsigned int val;
int error;
@@ -1466,7 +1446,7 @@ static ssize_t rx_enable_store(struct device *dev,
mutex_lock(&iqs269->lock);
- iqs269->ch_reg[iqs269->ch_num].rx_enable = val;
+ ch_reg[iqs269->ch_num].rx_enable = val;
iqs269->ati_current = false;
mutex_unlock(&iqs269->lock);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 112/245] Input: iqs269a - increase interrupt handler return delay
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2024-02-27 13:24 ` [PATCH 5.15 111/245] Input: iqs269a - configure device with a single block write Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 113/245] clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed Greg Kroah-Hartman
` (143 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff LaBundy, Mattijs Korpershoek,
Dmitry Torokhov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff LaBundy <jeff@labundy.com>
[ Upstream commit e023cc4abde3c01b895660b0e5a8488deb36b8c1 ]
The time the device takes to deassert its RDY output following an
I2C stop condition scales with the core clock frequency.
To prevent level-triggered interrupts from being reasserted after
the interrupt handler returns, increase the time before returning
to account for the worst-case delay (~140 us) plus margin.
Fixes: 04e49867fad1 ("Input: add support for Azoteq IQS269A")
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
Link: https://lore.kernel.org/r/Y7Rs484ypy4dab5G@nixie71
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/iqs269a.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/misc/iqs269a.c b/drivers/input/misc/iqs269a.c
index 2124d08c55b79..1530efd301c24 100644
--- a/drivers/input/misc/iqs269a.c
+++ b/drivers/input/misc/iqs269a.c
@@ -151,7 +151,7 @@
#define IQS269_PWR_MODE_POLL_SLEEP_US IQS269_ATI_POLL_SLEEP_US
#define IQS269_PWR_MODE_POLL_TIMEOUT_US IQS269_ATI_POLL_TIMEOUT_US
-#define iqs269_irq_wait() usleep_range(100, 150)
+#define iqs269_irq_wait() usleep_range(200, 250)
enum iqs269_local_cap_size {
IQS269_LOCAL_CAP_SIZE_0,
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 113/245] clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 112/245] Input: iqs269a - increase interrupt handler return delay Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 114/245] Input: ads7846 - dont report pressure for ads7845 Greg Kroah-Hartman
` (142 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Khoroshilov,
Geert Uytterhoeven, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Khoroshilov <khoroshilov@ispras.ru>
[ Upstream commit fbfd614aeaa2853c2c575299dfe2458db8eff67e ]
If cpg_mssr_common_init() fails after assigning priv to global variable
cpg_mssr_priv, it deallocates priv, but cpg_mssr_priv keeps dangling
pointer that potentially can be used later.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1f7db7bbf031 ("clk: renesas: cpg-mssr: Add early clock support")
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/1671806417-32623-1-git-send-email-khoroshilov@ispras.ru
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/renesas-cpg-mssr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
index 21f762aa21313..ed67b90fc1b0c 100644
--- a/drivers/clk/renesas/renesas-cpg-mssr.c
+++ b/drivers/clk/renesas/renesas-cpg-mssr.c
@@ -957,7 +957,6 @@ static int __init cpg_mssr_common_init(struct device *dev,
goto out_err;
}
- cpg_mssr_priv = priv;
priv->num_core_clks = info->num_total_core_clks;
priv->num_mod_clks = info->num_hw_mod_clks;
priv->last_dt_core_clk = info->last_dt_core_clk;
@@ -987,6 +986,8 @@ static int __init cpg_mssr_common_init(struct device *dev,
if (error)
goto out_err;
+ cpg_mssr_priv = priv;
+
return 0;
out_err:
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 114/245] Input: ads7846 - dont report pressure for ads7845
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 113/245] clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 115/245] clk: renesas: cpg-mssr: Remove superfluous check in resume code Greg Kroah-Hartman
` (141 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Ellero, Andy Shevchenko,
Dmitry Torokhov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ellero <l.ellero@asem.it>
[ Upstream commit d50584d783313c8b05b84d0b07a2142f1bde46dd ]
ADS7845 doesn't support pressure.
Avoid the following error reported by libinput-list-devices:
"ADS7845 Touchscreen: kernel bug: device has min == max on ABS_PRESSURE".
Fixes: ffa458c1bd9b ("spi: ads7846 driver")
Signed-off-by: Luca Ellero <l.ellero@asem.it>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20230126105227.47648-2-l.ellero@asem.it
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/touchscreen/ads7846.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index f113a27aeb1ef..ef04988edf0c2 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -1323,8 +1323,9 @@ static int ads7846_probe(struct spi_device *spi)
pdata->y_min ? : 0,
pdata->y_max ? : MAX_12BIT,
0, 0);
- input_set_abs_params(input_dev, ABS_PRESSURE,
- pdata->pressure_min, pdata->pressure_max, 0, 0);
+ if (ts->model != 7845)
+ input_set_abs_params(input_dev, ABS_PRESSURE,
+ pdata->pressure_min, pdata->pressure_max, 0, 0);
/*
* Parse common framework properties. Must be done here to ensure the
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 115/245] clk: renesas: cpg-mssr: Remove superfluous check in resume code
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 114/245] Input: ads7846 - dont report pressure for ads7845 Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 116/245] clk: imx: avoid memory leak Greg Kroah-Hartman
` (140 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 1c052043c79af5f70e80e2acd4dd70904ae08666 ]
When the code flow arrives at printing the error message in
cpg_mssr_resume_noirq(), we know for sure that we are not running on an
RZ/A Soc, as the code checked for that before.
Fixes: ace342097768e35f ("clk: renesas: cpg-mssr: Fix STBCR suspend/resume handling")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/144a3e66d748c0c17f3524ac8fa6ece5bf5b6f1e.1673425314.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/renesas-cpg-mssr.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
index ed67b90fc1b0c..54c5d35fe2ae3 100644
--- a/drivers/clk/renesas/renesas-cpg-mssr.c
+++ b/drivers/clk/renesas/renesas-cpg-mssr.c
@@ -911,9 +911,8 @@ static int cpg_mssr_resume_noirq(struct device *dev)
}
if (!i)
- dev_warn(dev, "Failed to enable %s%u[0x%x]\n",
- priv->reg_layout == CLK_REG_LAYOUT_RZ_A ?
- "STB" : "SMSTP", reg, oldval & mask);
+ dev_warn(dev, "Failed to enable SMSTP%u[0x%x]\n", reg,
+ oldval & mask);
}
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 116/245] clk: imx: avoid memory leak
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 115/245] clk: renesas: cpg-mssr: Remove superfluous check in resume code Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 117/245] Input: ads7846 - always set last command to PWRDOWN Greg Kroah-Hartman
` (139 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peng Fan, Abel Vesa, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit f4419db4086e8c31821da14140e81498516a3c75 ]
In case imx_register_uart_clocks return early, the imx_uart_clocks
memory will be no freed. So execute kfree always to avoid memory leak.
Fixes: 379c9a24cc23 ("clk: imx: Fix reparenting of UARTs not associated with stdout")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://lore.kernel.org/r/20230104110032.1220721-2-peng.fan@oss.nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/imx/clk.c b/drivers/clk/imx/clk.c
index 7cc669934253a..d4cf0c7045ab2 100644
--- a/drivers/clk/imx/clk.c
+++ b/drivers/clk/imx/clk.c
@@ -201,9 +201,10 @@ static int __init imx_clk_disable_uart(void)
clk_disable_unprepare(imx_uart_clocks[i]);
clk_put(imx_uart_clocks[i]);
}
- kfree(imx_uart_clocks);
}
+ kfree(imx_uart_clocks);
+
return 0;
}
late_initcall_sync(imx_clk_disable_uart);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 117/245] Input: ads7846 - always set last command to PWRDOWN
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 116/245] clk: imx: avoid memory leak Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 118/245] Input: ads7846 - dont check penirq immediately for 7845 Greg Kroah-Hartman
` (138 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Ellero, Andy Shevchenko,
Dmitry Torokhov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ellero <l.ellero@asem.it>
[ Upstream commit 13f82ca3878db8284a70ef9711d7f710a31eb562 ]
Controllers that report pressure (e.g. ADS7846) use 5 commands and the
correct sequence is READ_X, READ_Y, READ_Z1, READ_Z2, PWRDOWN.
Controllers that don't report pressure (e.g. ADS7845/ADS7843) use only 3
commands and the correct sequence should be READ_X, READ_Y, PWRDOWN. But
the sequence sent was incorrect: READ_X, READ_Y, READ_Z1.
Fix this by setting the third (and last) command to PWRDOWN.
Fixes: ffa458c1bd9b ("spi: ads7846 driver")
Signed-off-by: Luca Ellero <l.ellero@asem.it>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20230126105227.47648-3-l.ellero@asem.it
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/touchscreen/ads7846.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index ef04988edf0c2..f416a4bcd72bf 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -1074,6 +1074,9 @@ static int ads7846_setup_spi_msg(struct ads7846 *ts,
struct ads7846_buf_layout *l = &packet->l[cmd_idx];
unsigned int max_count;
+ if (cmd_idx == packet->cmds - 1)
+ cmd_idx = ADS7846_PWDOWN;
+
if (ads7846_cmd_need_settle(cmd_idx))
max_count = packet->count + packet->count_skip;
else
@@ -1110,7 +1113,12 @@ static int ads7846_setup_spi_msg(struct ads7846 *ts,
for (cmd_idx = 0; cmd_idx < packet->cmds; cmd_idx++) {
struct ads7846_buf_layout *l = &packet->l[cmd_idx];
- u8 cmd = ads7846_get_cmd(cmd_idx, vref);
+ u8 cmd;
+
+ if (cmd_idx == packet->cmds - 1)
+ cmd_idx = ADS7846_PWDOWN;
+
+ cmd = ads7846_get_cmd(cmd_idx, vref);
for (b = 0; b < l->count; b++)
packet->tx[l->offset + b].cmd = cmd;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 118/245] Input: ads7846 - dont check penirq immediately for 7845
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 117/245] Input: ads7846 - always set last command to PWRDOWN Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 119/245] powerpc/powernv/ioda: Skip unallocated resources when mapping to PE Greg Kroah-Hartman
` (137 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Ellero, Andy Shevchenko,
Dmitry Torokhov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ellero <l.ellero@asem.it>
[ Upstream commit fa9f4275b20ec7b2a8fb05c66362d10b36f9efec ]
To discard false readings, one should use "ti,penirq-recheck-delay-usecs".
Checking get_pendown_state() at the beginning, most of the time fails
causing malfunctioning.
Fixes: ffa458c1bd9b ("spi: ads7846 driver")
Signed-off-by: Luca Ellero <l.ellero@asem.it>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20230126105227.47648-4-l.ellero@asem.it
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/touchscreen/ads7846.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index f416a4bcd72bf..1db61185f7bec 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -851,14 +851,8 @@ static void ads7846_report_state(struct ads7846 *ts)
if (x == MAX_12BIT)
x = 0;
- if (ts->model == 7843) {
+ if (ts->model == 7843 || ts->model == 7845) {
Rt = ts->pressure_max / 2;
- } else if (ts->model == 7845) {
- if (get_pendown_state(ts))
- Rt = ts->pressure_max / 2;
- else
- Rt = 0;
- dev_vdbg(&ts->spi->dev, "x/y: %d/%d, PD %d\n", x, y, Rt);
} else if (likely(x && z1)) {
/* compute touch pressure resistance using equation #2 */
Rt = z2;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 119/245] powerpc/powernv/ioda: Skip unallocated resources when mapping to PE
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 118/245] Input: ads7846 - dont check penirq immediately for 7845 Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 120/245] clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC Greg Kroah-Hartman
` (136 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Jeffery, Frederic Barrat,
Michael Ellerman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Barrat <fbarrat@linux.ibm.com>
[ Upstream commit e64e71056f323a1e178dccf04d4c0f032d84436c ]
pnv_ioda_setup_pe_res() calls opal to map a resource with a PE. However,
the code assumes the resource is allocated and it uses the resource
address to find out the segment(s) which need to be mapped to the
PE. In the unlikely case where the resource hasn't been allocated, the
computation for the segment number is garbage, which can lead to
invalid memory access and potentially a kernel crash, such as:
[ ] pci_bus 0002:02: Configuring PE for bus
[ ] pci 0002:02 : [PE# fc] Secondary bus 0x0000000000000002..0x0000000000000002 associated with PE#fc
[ ] BUG: Kernel NULL pointer dereference on write at 0x00000000
[ ] Faulting instruction address: 0xc00000000005eac4
[ ] Oops: Kernel access of bad area, sig: 7 [#1]
[ ] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
[ ] Modules linked in:
[ ] CPU: 12 PID: 1 Comm: swapper/20 Not tainted 5.10.50-openpower1 #2
[ ] NIP: c00000000005eac4 LR: c00000000005ea44 CTR: 0000000030061b9c
[ ] REGS: c000200007383650 TRAP: 0300 Not tainted (5.10.50-openpower1)
[ ] MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 44000224 XER: 20040000
[ ] CFAR: c00000000005eaa0 DAR: 0000000000000000 DSISR: 02080000 IRQMASK: 0
[ ] GPR00: c00000000005dd98 c0002000073838e0 c00000000185de00 c000200fff018960
[ ] GPR04: 00000000000000fc 0000000000000003 0000000000000000 0000000000000000
[ ] GPR08: 0000000000000000 0000000000000000 0000000000000000 9000000000001033
[ ] GPR12: 0000000031cb0000 c000000ffffe6a80 c000000000010a58 0000000000000000
[ ] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[ ] GPR20: 0000000000000000 0000000000000000 0000000000000000 c00000000711e200
[ ] GPR24: 0000000000000100 c000200009501120 c00020000cee2800 00000000000003ff
[ ] GPR28: c000200fff018960 0000000000000000 c000200ffcb7fd00 0000000000000000
[ ] NIP [c00000000005eac4] pnv_ioda_setup_pe_res+0x94/0x1a0
[ ] LR [c00000000005ea44] pnv_ioda_setup_pe_res+0x14/0x1a0
[ ] Call Trace:
[ ] [c0002000073838e0] [c00000000005eb98] pnv_ioda_setup_pe_res+0x168/0x1a0 (unreliable)
[ ] [c000200007383970] [c00000000005dd98] pnv_pci_ioda_dma_dev_setup+0x43c/0x970
[ ] [c000200007383a60] [c000000000032cdc] pcibios_bus_add_device+0x78/0x18c
[ ] [c000200007383aa0] [c00000000028f2bc] pci_bus_add_device+0x28/0xbc
[ ] [c000200007383b10] [c00000000028f3a0] pci_bus_add_devices+0x50/0x7c
[ ] [c000200007383b50] [c00000000028f3c4] pci_bus_add_devices+0x74/0x7c
[ ] [c000200007383b90] [c00000000028f3c4] pci_bus_add_devices+0x74/0x7c
[ ] [c000200007383bd0] [c00000000069ad0c] pcibios_init+0xf0/0x104
[ ] [c000200007383c50] [c0000000000106d8] do_one_initcall+0x84/0x1c4
[ ] [c000200007383d20] [c0000000006910b8] kernel_init_freeable+0x264/0x268
[ ] [c000200007383dc0] [c000000000010a68] kernel_init+0x18/0x138
[ ] [c000200007383e20] [c00000000000cbfc] ret_from_kernel_thread+0x5c/0x80
[ ] Instruction dump:
[ ] 7f89e840 409d000c 7fbbf840 409c000c 38210090 4848f448 809c002c e95e0120
[ ] 7ba91764 38a00003 57a7043e 38c00000 <7c8a492e> 5484043e e87e0018 4bff23bd
Hitting the problem is not that easy. It was seen with a (semi-bogus)
PCI device with a class code of 0. The generic PCI framework doesn't
allocate resources in such a case.
The patch is simply skipping resources which are still flagged with
IORESOURCE_UNSET.
We don't have the problem with 64-bit mem resources, as the address of
the resource is checked to be within the range of the 64-bit mmio
window. See pnv_ioda_reserve_dev_m64_pe() and pnv_pci_is_m64().
Reported-by: Andrew Jeffery <andrew@aj.id.au>
Fixes: 23e79425fe7c ("powerpc/powernv: Simplify pnv_ioda_setup_pe_seg()")
Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20230120093215.19496-1-fbarrat@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/powernv/pci-ioda.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 624822a810193..8cf9e9f29763c 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -2334,7 +2334,8 @@ static void pnv_ioda_setup_pe_res(struct pnv_ioda_pe *pe,
int index;
int64_t rc;
- if (!res || !res->flags || res->start > res->end)
+ if (!res || !res->flags || res->start > res->end ||
+ res->flags & IORESOURCE_UNSET)
return;
if (res->flags & IORESOURCE_IO) {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 120/245] clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 119/245] powerpc/powernv/ioda: Skip unallocated resources when mapping to PE Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 121/245] clk: qcom: gpucc-sdm845: " Greg Kroah-Hartman
` (135 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephen Boyd, Dmitry Baryshkov,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 658c82caffa042b351f5a1b6325819297a951a04 ]
The gdsc_init() function will rewrite the CLK_DIS_WAIT field while
registering the GDSC (writing the value 0x2 by default). This will
override the setting done in the driver's probe function.
Set cx_gdsc.clk_dis_wait_val to 8 to follow the intention of the probe
function.
Fixes: 745ff069a49c ("clk: qcom: Add graphics clock controller driver for SC7180")
Reviewed-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230201172305.993146-1-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gpucc-sc7180.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/clk/qcom/gpucc-sc7180.c b/drivers/clk/qcom/gpucc-sc7180.c
index d738251cba17d..6839b4b71a2f4 100644
--- a/drivers/clk/qcom/gpucc-sc7180.c
+++ b/drivers/clk/qcom/gpucc-sc7180.c
@@ -21,8 +21,6 @@
#define CX_GMU_CBCR_SLEEP_SHIFT 4
#define CX_GMU_CBCR_WAKE_MASK 0xF
#define CX_GMU_CBCR_WAKE_SHIFT 8
-#define CLK_DIS_WAIT_SHIFT 12
-#define CLK_DIS_WAIT_MASK (0xf << CLK_DIS_WAIT_SHIFT)
enum {
P_BI_TCXO,
@@ -160,6 +158,7 @@ static struct clk_branch gpu_cc_cxo_clk = {
static struct gdsc cx_gdsc = {
.gdscr = 0x106c,
.gds_hw_ctrl = 0x1540,
+ .clk_dis_wait_val = 8,
.pd = {
.name = "cx_gdsc",
},
@@ -242,10 +241,6 @@ static int gpu_cc_sc7180_probe(struct platform_device *pdev)
value = 0xF << CX_GMU_CBCR_WAKE_SHIFT | 0xF << CX_GMU_CBCR_SLEEP_SHIFT;
regmap_update_bits(regmap, 0x1098, mask, value);
- /* Configure clk_dis_wait for gpu_cx_gdsc */
- regmap_update_bits(regmap, 0x106c, CLK_DIS_WAIT_MASK,
- 8 << CLK_DIS_WAIT_SHIFT);
-
return qcom_cc_really_probe(pdev, &gpu_cc_sc7180_desc, regmap);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 121/245] clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 120/245] clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 122/245] clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() Greg Kroah-Hartman
` (134 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephen Boyd, Dmitry Baryshkov,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit cb81719e3c1165ef1bc33137dc628f750eed8ea4 ]
The gdsc_init() function will rewrite the CLK_DIS_WAIT field while
registering the GDSC (writing the value 0x2 by default). This will
override the setting done in the driver's probe function.
Set cx_gdsc.clk_dis_wait_val to 8 to follow the intention of the probe
function.
Fixes: 453361cdd757 ("clk: qcom: Add graphics clock controller driver for SDM845")
Reviewed-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230201172305.993146-2-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gpucc-sdm845.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/clk/qcom/gpucc-sdm845.c b/drivers/clk/qcom/gpucc-sdm845.c
index 110b54401bc6d..970d7414bdf0e 100644
--- a/drivers/clk/qcom/gpucc-sdm845.c
+++ b/drivers/clk/qcom/gpucc-sdm845.c
@@ -22,8 +22,6 @@
#define CX_GMU_CBCR_SLEEP_SHIFT 4
#define CX_GMU_CBCR_WAKE_MASK 0xf
#define CX_GMU_CBCR_WAKE_SHIFT 8
-#define CLK_DIS_WAIT_SHIFT 12
-#define CLK_DIS_WAIT_MASK (0xf << CLK_DIS_WAIT_SHIFT)
enum {
P_BI_TCXO,
@@ -121,6 +119,7 @@ static struct clk_branch gpu_cc_cxo_clk = {
static struct gdsc gpu_cx_gdsc = {
.gdscr = 0x106c,
.gds_hw_ctrl = 0x1540,
+ .clk_dis_wait_val = 0x8,
.pd = {
.name = "gpu_cx_gdsc",
},
@@ -193,10 +192,6 @@ static int gpu_cc_sdm845_probe(struct platform_device *pdev)
value = 0xf << CX_GMU_CBCR_WAKE_SHIFT | 0xf << CX_GMU_CBCR_SLEEP_SHIFT;
regmap_update_bits(regmap, 0x1098, mask, value);
- /* Configure clk_dis_wait for gpu_cx_gdsc */
- regmap_update_bits(regmap, 0x106c, CLK_DIS_WAIT_MASK,
- 8 << CLK_DIS_WAIT_SHIFT);
-
return qcom_cc_really_probe(pdev, &gpu_cc_sdm845_desc, regmap);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 122/245] clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 121/245] clk: qcom: gpucc-sdm845: " Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 123/245] powerpc/pseries/lparcfg: add missing RTAS retry status handling Greg Kroah-Hartman
` (133 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai,
AngeloGioacchino Del Regno, Stephen Boyd, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wenst@chromium.org>
[ Upstream commit 79200d5851c8e7179f68a4a6f162d8f1bde4986f ]
In the previous commits that added CLK_OPS_PARENT_ENABLE, support for
this flag was only added to rate change operations (rate setting and
reparent) and disabling unused subtree. It was not added to the
clock gate related operations. Any hardware driver that needs it for
these operations will either see bogus results, or worse, hang.
This has been seen on MT8192 and MT8195, where the imp_ii2_* clk
drivers set this, but dumping debugfs clk_summary would cause it
to hang.
Prepare parent on prepare and enable parent on enable dependencies are
already handled automatically by the core as part of its sequencing.
Whether the case for "enable parent on prepare" should be supported by
this flag or not is not clear, and thus ignored for now.
This change solely fixes the handling of clk_core_is_enabled, i.e.
enabling the parent clock when reading the hardware state. Unfortunately
clk_core_is_enabled is called in a variety of places, sometimes with
the enable clock already held. To avoid deadlocking, the core will
ignore readouts and just return false if CLK_OPS_PARENT_ENABLE is set
but the parent isn't currently enabled.
Fixes: fc8726a2c021 ("clk: core: support clocks which requires parents enable (part 2)")
Fixes: a4b3518d146f ("clk: core: support clocks which requires parents enable (part 1)")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20230103092330.494102-1-wenst@chromium.org
Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index b37af6b27e9c6..bf9057a8fbf06 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -251,6 +251,17 @@ static bool clk_core_is_enabled(struct clk_core *core)
}
}
+ /*
+ * This could be called with the enable lock held, or from atomic
+ * context. If the parent isn't enabled already, we can't do
+ * anything here. We can also assume this clock isn't enabled.
+ */
+ if ((core->flags & CLK_OPS_PARENT_ENABLE) && core->parent)
+ if (!clk_core_is_enabled(core->parent)) {
+ ret = false;
+ goto done;
+ }
+
ret = core->ops->is_enabled(core->hw);
done:
if (core->rpm_enabled)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 123/245] powerpc/pseries/lparcfg: add missing RTAS retry status handling
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 122/245] clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 124/245] powerpc/perf/hv-24x7: " Greg Kroah-Hartman
` (132 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Lynch, Michael Ellerman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <nathanl@linux.ibm.com>
[ Upstream commit 5d08633e5f6564b60f1cbe09af3af40a74d66431 ]
The ibm,get-system-parameter RTAS function may return -2 or 990x,
which indicate that the caller should try again.
lparcfg's parse_system_parameter_string() ignores this, making it
possible to intermittently report incorrect SPLPAR characteristics.
Move the RTAS call into a coventional rtas_busy_delay()-based loop.
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-4-26929c8cce78@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/lparcfg.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
index 19503a8797823..a291b5a94d4da 100644
--- a/arch/powerpc/platforms/pseries/lparcfg.c
+++ b/arch/powerpc/platforms/pseries/lparcfg.c
@@ -322,6 +322,7 @@ static void parse_mpp_x_data(struct seq_file *m)
*/
static void parse_system_parameter_string(struct seq_file *m)
{
+ const s32 token = rtas_token("ibm,get-system-parameter");
int call_status;
unsigned char *local_buffer = kmalloc(SPLPAR_MAXLENGTH, GFP_KERNEL);
@@ -331,16 +332,15 @@ static void parse_system_parameter_string(struct seq_file *m)
return;
}
- spin_lock(&rtas_data_buf_lock);
- memset(rtas_data_buf, 0, SPLPAR_MAXLENGTH);
- call_status = rtas_call(rtas_token("ibm,get-system-parameter"), 3, 1,
- NULL,
- SPLPAR_CHARACTERISTICS_TOKEN,
- __pa(rtas_data_buf),
- RTAS_DATA_BUF_SIZE);
- memcpy(local_buffer, rtas_data_buf, SPLPAR_MAXLENGTH);
- local_buffer[SPLPAR_MAXLENGTH - 1] = '\0';
- spin_unlock(&rtas_data_buf_lock);
+ do {
+ spin_lock(&rtas_data_buf_lock);
+ memset(rtas_data_buf, 0, SPLPAR_MAXLENGTH);
+ call_status = rtas_call(token, 3, 1, NULL, SPLPAR_CHARACTERISTICS_TOKEN,
+ __pa(rtas_data_buf), RTAS_DATA_BUF_SIZE);
+ memcpy(local_buffer, rtas_data_buf, SPLPAR_MAXLENGTH);
+ local_buffer[SPLPAR_MAXLENGTH - 1] = '\0';
+ spin_unlock(&rtas_data_buf_lock);
+ } while (rtas_busy_delay(call_status));
if (call_status != 0) {
printk(KERN_INFO
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 124/245] powerpc/perf/hv-24x7: add missing RTAS retry status handling
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 123/245] powerpc/pseries/lparcfg: add missing RTAS retry status handling Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 125/245] powerpc/pseries/lpar: " Greg Kroah-Hartman
` (131 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Lynch, Michael Ellerman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <nathanl@linux.ibm.com>
[ Upstream commit cc4b26eab1859fa1a70711872caaf6414809973f ]
The ibm,get-system-parameter RTAS function may return -2 or 990x,
which indicate that the caller should try again. read_24x7_sys_info()
ignores this, allowing transient failures in reporting processor
module information.
Move the RTAS call into a coventional rtas_busy_delay()-based loop,
along with the parsing of results on success.
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Fixes: 8ba214267382 ("powerpc/hv-24x7: Add rtas call in hv-24x7 driver to get processor details")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-2-26929c8cce78@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/perf/hv-24x7.c | 42 ++++++++++++++++---------------------
1 file changed, 18 insertions(+), 24 deletions(-)
diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c
index 284ccc90fb11c..f68fa53f4b1a2 100644
--- a/arch/powerpc/perf/hv-24x7.c
+++ b/arch/powerpc/perf/hv-24x7.c
@@ -79,9 +79,8 @@ static u32 phys_coresperchip; /* Physical cores per chip */
*/
void read_24x7_sys_info(void)
{
- int call_status, len, ntypes;
-
- spin_lock(&rtas_data_buf_lock);
+ const s32 token = rtas_token("ibm,get-system-parameter");
+ int call_status;
/*
* Making system parameter: chips and sockets and cores per chip
@@ -91,32 +90,27 @@ void read_24x7_sys_info(void)
phys_chipspersocket = 1;
phys_coresperchip = 1;
- call_status = rtas_call(rtas_token("ibm,get-system-parameter"), 3, 1,
- NULL,
- PROCESSOR_MODULE_INFO,
- __pa(rtas_data_buf),
- RTAS_DATA_BUF_SIZE);
+ do {
+ spin_lock(&rtas_data_buf_lock);
+ call_status = rtas_call(token, 3, 1, NULL, PROCESSOR_MODULE_INFO,
+ __pa(rtas_data_buf), RTAS_DATA_BUF_SIZE);
+ if (call_status == 0) {
+ int ntypes = be16_to_cpup((__be16 *)&rtas_data_buf[2]);
+ int len = be16_to_cpup((__be16 *)&rtas_data_buf[0]);
+
+ if (len >= 8 && ntypes != 0) {
+ phys_sockets = be16_to_cpup((__be16 *)&rtas_data_buf[4]);
+ phys_chipspersocket = be16_to_cpup((__be16 *)&rtas_data_buf[6]);
+ phys_coresperchip = be16_to_cpup((__be16 *)&rtas_data_buf[8]);
+ }
+ }
+ spin_unlock(&rtas_data_buf_lock);
+ } while (rtas_busy_delay(call_status));
if (call_status != 0) {
pr_err("Error calling get-system-parameter %d\n",
call_status);
- } else {
- len = be16_to_cpup((__be16 *)&rtas_data_buf[0]);
- if (len < 8)
- goto out;
-
- ntypes = be16_to_cpup((__be16 *)&rtas_data_buf[2]);
-
- if (!ntypes)
- goto out;
-
- phys_sockets = be16_to_cpup((__be16 *)&rtas_data_buf[4]);
- phys_chipspersocket = be16_to_cpup((__be16 *)&rtas_data_buf[6]);
- phys_coresperchip = be16_to_cpup((__be16 *)&rtas_data_buf[8]);
}
-
-out:
- spin_unlock(&rtas_data_buf_lock);
}
/* Domains for which more than one result element are returned for each event. */
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 125/245] powerpc/pseries/lpar: add missing RTAS retry status handling
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 124/245] powerpc/perf/hv-24x7: " Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 126/245] MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set Greg Kroah-Hartman
` (130 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Lynch, Michael Ellerman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <nathanl@linux.ibm.com>
[ Upstream commit daa8ab59044610aa8ef2ee45a6c157b5e11635e9 ]
The ibm,get-system-parameter RTAS function may return -2 or 990x,
which indicate that the caller should try again.
pseries_lpar_read_hblkrm_characteristics() ignores this, making it
possible to incorrectly detect TLB block invalidation characteristics
at boot.
Move the RTAS call into a coventional rtas_busy_delay()-based loop.
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Fixes: 1211ee61b4a8 ("powerpc/pseries: Read TLB Block Invalidate Characteristics")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-3-26929c8cce78@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/lpar.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index fce0237b07155..6c196b9413553 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -1434,22 +1434,22 @@ static inline void __init check_lp_set_hblkrm(unsigned int lp,
void __init pseries_lpar_read_hblkrm_characteristics(void)
{
+ const s32 token = rtas_token("ibm,get-system-parameter");
unsigned char local_buffer[SPLPAR_TLB_BIC_MAXLENGTH];
int call_status, len, idx, bpsize;
if (!firmware_has_feature(FW_FEATURE_BLOCK_REMOVE))
return;
- spin_lock(&rtas_data_buf_lock);
- memset(rtas_data_buf, 0, RTAS_DATA_BUF_SIZE);
- call_status = rtas_call(rtas_token("ibm,get-system-parameter"), 3, 1,
- NULL,
- SPLPAR_TLB_BIC_TOKEN,
- __pa(rtas_data_buf),
- RTAS_DATA_BUF_SIZE);
- memcpy(local_buffer, rtas_data_buf, SPLPAR_TLB_BIC_MAXLENGTH);
- local_buffer[SPLPAR_TLB_BIC_MAXLENGTH - 1] = '\0';
- spin_unlock(&rtas_data_buf_lock);
+ do {
+ spin_lock(&rtas_data_buf_lock);
+ memset(rtas_data_buf, 0, RTAS_DATA_BUF_SIZE);
+ call_status = rtas_call(token, 3, 1, NULL, SPLPAR_TLB_BIC_TOKEN,
+ __pa(rtas_data_buf), RTAS_DATA_BUF_SIZE);
+ memcpy(local_buffer, rtas_data_buf, SPLPAR_TLB_BIC_MAXLENGTH);
+ local_buffer[SPLPAR_TLB_BIC_MAXLENGTH - 1] = '\0';
+ spin_unlock(&rtas_data_buf_lock);
+ } while (rtas_busy_delay(call_status));
if (call_status != 0) {
pr_warn("%s %s Error calling get-system-parameter (0x%x)\n",
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 126/245] MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 125/245] powerpc/pseries/lpar: " Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 127/245] MIPS: vpe-mt: drop physical_memsize Greg Kroah-Hartman
` (129 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Dengcheng Zhu,
Paul Burton, Thomas Bogendoerfer, linux-mips, Sergei Shtylyov,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 6f02e39fa40f16c24e7a5c599a854c0d1682788d ]
When MIPS_CPS=y, MIPS_CPS_PM is not set, HOTPLUG_CPU is not set, and
KEXEC=y, cps_shutdown_this_cpu() attempts to call cps_pm_enter_state(),
which is not built when MIPS_CPS_PM is not set.
Conditionally execute the else branch based on CONFIG_HOTPLUG_CPU
to remove the build error.
This build failure is from a randconfig file.
mips-linux-ld: arch/mips/kernel/smp-cps.o: in function `$L162':
smp-cps.c:(.text.cps_kexec_nonboot_cpu+0x31c): undefined reference to `cps_pm_enter_state'
Fixes: 1447864bee4c ("MIPS: kexec: CPS systems to halt nonboot CPUs")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Dengcheng Zhu <dzhu@wavecomp.com>
Cc: Paul Burton <paulburton@kernel.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: linux-mips@vger.kernel.org
Cc: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/kernel/smp-cps.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/mips/kernel/smp-cps.c b/arch/mips/kernel/smp-cps.c
index bcd6a944b8397..f2df0cae1b4d9 100644
--- a/arch/mips/kernel/smp-cps.c
+++ b/arch/mips/kernel/smp-cps.c
@@ -424,9 +424,11 @@ static void cps_shutdown_this_cpu(enum cpu_death death)
wmb();
}
} else {
- pr_debug("Gating power to core %d\n", core);
- /* Power down the core */
- cps_pm_enter_state(CPS_PM_POWER_GATED);
+ if (IS_ENABLED(CONFIG_HOTPLUG_CPU)) {
+ pr_debug("Gating power to core %d\n", core);
+ /* Power down the core */
+ cps_pm_enter_state(CPS_PM_POWER_GATED);
+ }
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 127/245] MIPS: vpe-mt: drop physical_memsize
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 126/245] MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 128/245] vdpa/mlx5: Dont clear mr struct on destroy MR Greg Kroah-Hartman
` (128 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, kernel test robot,
Dengcheng Zhu, John Crispin, Thomas Bogendoerfer,
Philippe Mathieu-Daudé, Steven J. Hill, Qais Yousef,
Yang Yingliang, Hauke Mehrtens, James Hogan, linux-mips,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 91dc288f4edf0d768e46c2c6d33e0ab703403459 ]
When neither LANTIQ nor MIPS_MALTA is set, 'physical_memsize' is not
declared. This causes the build to fail with:
mips-linux-ld: arch/mips/kernel/vpe-mt.o: in function `vpe_run':
arch/mips/kernel/vpe-mt.c:(.text.vpe_run+0x280): undefined reference to `physical_memsize'
LANTIQ is not using 'physical_memsize' and MIPS_MALTA's use of it is
self-contained in mti-malta/malta-dtshim.c.
Use of physical_memsize in vpe-mt.c appears to be unused, so eliminate
this loader mode completely and require VPE programs to be compiled with
DFLT_STACK_SIZE and DFLT_HEAP_SIZE defined.
Fixes: 9050d50e2244 ("MIPS: lantiq: Set physical_memsize")
Fixes: 1a2a6d7e8816 ("MIPS: APRP: Split VPE loader into separate files.")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/all/202302030625.2g3E98sY-lkp@intel.com/
Cc: Dengcheng Zhu <dzhu@wavecomp.com>
Cc: John Crispin <john@phrozen.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: "Steven J. Hill" <Steven.Hill@imgtec.com>
Cc: Qais Yousef <Qais.Yousef@imgtec.com>
Cc: Yang Yingliang <yangyingliang@huawei.com>
Cc: Hauke Mehrtens <hauke@hauke-m.de>
Cc: James Hogan <jhogan@kernel.org>
Cc: linux-mips@vger.kernel.org
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/include/asm/vpe.h | 1 -
arch/mips/kernel/vpe-mt.c | 7 +++----
arch/mips/lantiq/prom.c | 6 ------
3 files changed, 3 insertions(+), 11 deletions(-)
diff --git a/arch/mips/include/asm/vpe.h b/arch/mips/include/asm/vpe.h
index baa949a744cb4..ef7e078296079 100644
--- a/arch/mips/include/asm/vpe.h
+++ b/arch/mips/include/asm/vpe.h
@@ -102,7 +102,6 @@ struct vpe_control {
struct list_head tc_list; /* Thread contexts */
};
-extern unsigned long physical_memsize;
extern struct vpe_control vpecontrol;
extern const struct file_operations vpe_fops;
diff --git a/arch/mips/kernel/vpe-mt.c b/arch/mips/kernel/vpe-mt.c
index 84a82b551ec35..223d6274f2e5b 100644
--- a/arch/mips/kernel/vpe-mt.c
+++ b/arch/mips/kernel/vpe-mt.c
@@ -92,12 +92,11 @@ int vpe_run(struct vpe *v)
write_tc_c0_tchalt(read_tc_c0_tchalt() & ~TCHALT_H);
/*
- * The sde-kit passes 'memsize' to __start in $a3, so set something
- * here... Or set $a3 to zero and define DFLT_STACK_SIZE and
- * DFLT_HEAP_SIZE when you compile your program
+ * We don't pass the memsize here, so VPE programs need to be
+ * compiled with DFLT_STACK_SIZE and DFLT_HEAP_SIZE defined.
*/
+ mttgpr(7, 0);
mttgpr(6, v->ntcs);
- mttgpr(7, physical_memsize);
/* set up VPE1 */
/*
diff --git a/arch/mips/lantiq/prom.c b/arch/mips/lantiq/prom.c
index bc9f58fcbdf94..86c743747e79a 100644
--- a/arch/mips/lantiq/prom.c
+++ b/arch/mips/lantiq/prom.c
@@ -22,12 +22,6 @@
DEFINE_SPINLOCK(ebu_lock);
EXPORT_SYMBOL_GPL(ebu_lock);
-/*
- * This is needed by the VPE loader code, just set it to 0 and assume
- * that the firmware hardcodes this value to something useful.
- */
-unsigned long physical_memsize = 0L;
-
/*
* this struct is filled by the soc specific detection code and holds
* information about the specific soc type, revision and name
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 128/245] vdpa/mlx5: Dont clear mr struct on destroy MR
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 127/245] MIPS: vpe-mt: drop physical_memsize Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 129/245] selftests: net: vrf-xfrm-tests: change authentication and encryption algos Greg Kroah-Hartman
` (127 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eli Cohen, Michael S. Tsirkin,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eli Cohen <elic@nvidia.com>
[ Upstream commit aef24311bd2d8a6d39a80c34f278b0fd1692aed3 ]
Clearing the mr struct erases the lock owner and causes warnings to be
emitted. It is not required to clear the mr so remove the memset call.
Fixes: 94abbccdf291 ("vdpa/mlx5: Add shared memory registration code")
Signed-off-by: Eli Cohen <elic@nvidia.com>
Message-Id: <20230206121956.1149356-1-elic@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/mlx5/core/mr.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c
index ff010c6d0cd39..bdc7595fcb0e3 100644
--- a/drivers/vdpa/mlx5/core/mr.c
+++ b/drivers/vdpa/mlx5/core/mr.c
@@ -505,7 +505,6 @@ void mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev)
else
destroy_dma_mr(mvdev, mr);
- memset(mr, 0, sizeof(*mr));
mr->initialized = false;
out:
mutex_unlock(&mr->mkey_mtx);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 129/245] selftests: net: vrf-xfrm-tests: change authentication and encryption algos
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 128/245] vdpa/mlx5: Dont clear mr struct on destroy MR Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 130/245] ARM: dts: BCM53573: Drop nonexistent #usb-cells Greg Kroah-Hartman
` (126 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Ahern, Magali Lemes,
Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magali Lemes <magali.lemes@canonical.com>
[ Upstream commit cb43c60e64ca67fcc9d23bd08f51d2ab8209d9d7 ]
The vrf-xfrm-tests tests use the hmac(md5) and cbc(des3_ede)
algorithms for performing authentication and encryption, respectively.
This causes the tests to fail when fips=1 is set, since these algorithms
are not allowed in FIPS mode. Therefore, switch from hmac(md5) and
cbc(des3_ede) to hmac(sha1) and cbc(aes), which are FIPS compliant.
Fixes: 3f251d741150 ("selftests: Add tests for vrf and xfrms")
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Magali Lemes <magali.lemes@canonical.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/vrf-xfrm-tests.sh | 32 +++++++++----------
1 file changed, 16 insertions(+), 16 deletions(-)
diff --git a/tools/testing/selftests/net/vrf-xfrm-tests.sh b/tools/testing/selftests/net/vrf-xfrm-tests.sh
index 184da81f554ff..452638ae8aed8 100755
--- a/tools/testing/selftests/net/vrf-xfrm-tests.sh
+++ b/tools/testing/selftests/net/vrf-xfrm-tests.sh
@@ -264,60 +264,60 @@ setup_xfrm()
ip -netns host1 xfrm state add src ${HOST1_4} dst ${HOST2_4} \
proto esp spi ${SPI_1} reqid 0 mode tunnel \
replay-window 4 replay-oseq 0x4 \
- auth-trunc 'hmac(md5)' ${AUTH_1} 96 \
- enc 'cbc(des3_ede)' ${ENC_1} \
+ auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \
+ enc 'cbc(aes)' ${ENC_1} \
sel src ${h1_4} dst ${h2_4} ${devarg}
ip -netns host2 xfrm state add src ${HOST1_4} dst ${HOST2_4} \
proto esp spi ${SPI_1} reqid 0 mode tunnel \
replay-window 4 replay-oseq 0x4 \
- auth-trunc 'hmac(md5)' ${AUTH_1} 96 \
- enc 'cbc(des3_ede)' ${ENC_1} \
+ auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \
+ enc 'cbc(aes)' ${ENC_1} \
sel src ${h1_4} dst ${h2_4}
ip -netns host1 xfrm state add src ${HOST2_4} dst ${HOST1_4} \
proto esp spi ${SPI_2} reqid 0 mode tunnel \
replay-window 4 replay-oseq 0x4 \
- auth-trunc 'hmac(md5)' ${AUTH_2} 96 \
- enc 'cbc(des3_ede)' ${ENC_2} \
+ auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \
+ enc 'cbc(aes)' ${ENC_2} \
sel src ${h2_4} dst ${h1_4} ${devarg}
ip -netns host2 xfrm state add src ${HOST2_4} dst ${HOST1_4} \
proto esp spi ${SPI_2} reqid 0 mode tunnel \
replay-window 4 replay-oseq 0x4 \
- auth-trunc 'hmac(md5)' ${AUTH_2} 96 \
- enc 'cbc(des3_ede)' ${ENC_2} \
+ auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \
+ enc 'cbc(aes)' ${ENC_2} \
sel src ${h2_4} dst ${h1_4}
ip -6 -netns host1 xfrm state add src ${HOST1_6} dst ${HOST2_6} \
proto esp spi ${SPI_1} reqid 0 mode tunnel \
replay-window 4 replay-oseq 0x4 \
- auth-trunc 'hmac(md5)' ${AUTH_1} 96 \
- enc 'cbc(des3_ede)' ${ENC_1} \
+ auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \
+ enc 'cbc(aes)' ${ENC_1} \
sel src ${h1_6} dst ${h2_6} ${devarg}
ip -6 -netns host2 xfrm state add src ${HOST1_6} dst ${HOST2_6} \
proto esp spi ${SPI_1} reqid 0 mode tunnel \
replay-window 4 replay-oseq 0x4 \
- auth-trunc 'hmac(md5)' ${AUTH_1} 96 \
- enc 'cbc(des3_ede)' ${ENC_1} \
+ auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \
+ enc 'cbc(aes)' ${ENC_1} \
sel src ${h1_6} dst ${h2_6}
ip -6 -netns host1 xfrm state add src ${HOST2_6} dst ${HOST1_6} \
proto esp spi ${SPI_2} reqid 0 mode tunnel \
replay-window 4 replay-oseq 0x4 \
- auth-trunc 'hmac(md5)' ${AUTH_2} 96 \
- enc 'cbc(des3_ede)' ${ENC_2} \
+ auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \
+ enc 'cbc(aes)' ${ENC_2} \
sel src ${h2_6} dst ${h1_6} ${devarg}
ip -6 -netns host2 xfrm state add src ${HOST2_6} dst ${HOST1_6} \
proto esp spi ${SPI_2} reqid 0 mode tunnel \
replay-window 4 replay-oseq 0x4 \
- auth-trunc 'hmac(md5)' ${AUTH_2} 96 \
- enc 'cbc(des3_ede)' ${ENC_2} \
+ auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \
+ enc 'cbc(aes)' ${ENC_2} \
sel src ${h2_6} dst ${h1_6}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 130/245] ARM: dts: BCM53573: Drop nonexistent #usb-cells
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 129/245] selftests: net: vrf-xfrm-tests: change authentication and encryption algos Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 131/245] RDMA/siw: Balance the reference of cep->kref in the error path Greg Kroah-Hartman
` (125 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafał Miłecki,
Florian Fainelli, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <rafal@milecki.pl>
[ Upstream commit 05d2c3d552b8c92fc397377d9d1112fc58e2cd59 ]
Such property simply doesn't exist (is not documented or used anywhere).
This fixes:
arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: usb@d000: Unevaluated properties are not allowed ('#usb-cells' was unexpected)
From schema: Documentation/devicetree/bindings/usb/generic-ohci.yaml
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Link: https://lore.kernel.org/r/20230707114004.2740-2-zajec5@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm53573.dtsi | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
index 933b6a380c367..85a23dc52423c 100644
--- a/arch/arm/boot/dts/bcm53573.dtsi
+++ b/arch/arm/boot/dts/bcm53573.dtsi
@@ -159,8 +159,6 @@ ehci_port2: port@2 {
};
ohci: usb@d000 {
- #usb-cells = <0>;
-
compatible = "generic-ohci";
reg = <0xd000 0x1000>;
interrupt-parent = <&gic>;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 131/245] RDMA/siw: Balance the reference of cep->kref in the error path
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 130/245] ARM: dts: BCM53573: Drop nonexistent #usb-cells Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 132/245] RDMA/siw: Correct wrong debug message Greg Kroah-Hartman
` (124 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoqing Jiang, Bernard Metzler,
Leon Romanovsky, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <guoqing.jiang@linux.dev>
[ Upstream commit b056327bee09e6b86683d3f709a438ccd6031d72 ]
The siw_connect can go to err in below after cep is allocated successfully:
1. If siw_cm_alloc_work returns failure. In this case socket is not
assoicated with cep so siw_cep_put can't be called by siw_socket_disassoc.
We need to call siw_cep_put twice since cep->kref is increased once after
it was initialized.
2. If siw_cm_queue_work can't find a work, which means siw_cep_get is not
called in siw_cm_queue_work, so cep->kref is increased twice by siw_cep_get
and when associate socket with cep after it was initialized. So we need to
call siw_cep_put three times (one in siw_socket_disassoc).
3. siw_send_mpareqrep returns error, this scenario is similar as 2.
So we need to remove one siw_cep_put in the error path.
Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
Link: https://lore.kernel.org/r/20230821133255.31111-2-guoqing.jiang@linux.dev
Acked-by: Bernard Metzler <bmt@zurich.ibm.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/siw/siw_cm.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index ecd19a7408679..116f1c38384b6 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -1504,7 +1504,6 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
cep->cm_id = NULL;
id->rem_ref(id);
- siw_cep_put(cep);
qp->cep = NULL;
siw_cep_put(cep);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 132/245] RDMA/siw: Correct wrong debug message
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 131/245] RDMA/siw: Balance the reference of cep->kref in the error path Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 133/245] clk: linux/clk-provider.h: fix kernel-doc warnings and typos Greg Kroah-Hartman
` (123 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoqing Jiang, Bernard Metzler,
Leon Romanovsky, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <guoqing.jiang@linux.dev>
[ Upstream commit bee024d20451e4ce04ea30099cad09f7f75d288b ]
We need to print num_sle first then pbl->max_buf per the condition.
Also replace mem->pbl with pbl while at it.
Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
Link: https://lore.kernel.org/r/20230821133255.31111-3-guoqing.jiang@linux.dev
Acked-by: Bernard Metzler <bmt@zurich.ibm.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/siw/siw_verbs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
index 9c7fbda9e068a..124242e387a59 100644
--- a/drivers/infiniband/sw/siw/siw_verbs.c
+++ b/drivers/infiniband/sw/siw/siw_verbs.c
@@ -1492,7 +1492,7 @@ int siw_map_mr_sg(struct ib_mr *base_mr, struct scatterlist *sl, int num_sle,
if (pbl->max_buf < num_sle) {
siw_dbg_mem(mem, "too many SGE's: %d > %d\n",
- mem->pbl->max_buf, num_sle);
+ num_sle, pbl->max_buf);
return -ENOMEM;
}
for_each_sg(sl, slp, num_sle, i) {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 133/245] clk: linux/clk-provider.h: fix kernel-doc warnings and typos
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 132/245] RDMA/siw: Correct wrong debug message Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 134/245] platform/x86: asus-wmi: Document the dgpu_disable sysfs attribute Greg Kroah-Hartman
` (122 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Michael Turquette,
Stephen Boyd, linux-clk, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 84aefafe6b294041b7fa0757414c4a29c1bdeea2 ]
Fix spelling of "Structure".
Fix multiple kernel-doc warnings:
clk-provider.h:269: warning: Function parameter or member 'recalc_rate' not described in 'clk_ops'
clk-provider.h:468: warning: Function parameter or member 'parent_data' not described in 'clk_hw_register_fixed_rate_with_accuracy_parent_data'
clk-provider.h:468: warning: Excess function parameter 'parent_name' description in 'clk_hw_register_fixed_rate_with_accuracy_parent_data'
clk-provider.h:482: warning: Function parameter or member 'parent_data' not described in 'clk_hw_register_fixed_rate_parent_accuracy'
clk-provider.h:482: warning: Excess function parameter 'parent_name' description in 'clk_hw_register_fixed_rate_parent_accuracy'
clk-provider.h:687: warning: Function parameter or member 'flags' not described in 'clk_divider'
clk-provider.h:1164: warning: Function parameter or member 'flags' not described in 'clk_fractional_divider'
clk-provider.h:1164: warning: Function parameter or member 'approximation' not described in 'clk_fractional_divider'
clk-provider.h:1213: warning: Function parameter or member 'flags' not described in 'clk_multiplier'
Fixes: 9fba738a53dd ("clk: add duty cycle support")
Fixes: b2476490ef11 ("clk: introduce the common clock framework")
Fixes: 2d34f09e79c9 ("clk: fixed-rate: Add support for specifying parents via DT/pointers")
Fixes: f5290d8e4f0c ("clk: asm9260: use parent index to link the reference clock")
Fixes: 9d9f78ed9af0 ("clk: basic clock hardware types")
Fixes: e2d0e90fae82 ("clk: new basic clk type for fractional divider")
Fixes: f2e0a53271a4 ("clk: Add a basic multiplier clock")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Michael Turquette <mturquette@baylibre.com>
Cc: Stephen Boyd <sboyd@kernel.org>
Cc: linux-clk@vger.kernel.org
Link: https://lore.kernel.org/r/20230930221428.18463-1-rdunlap@infradead.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/clk-provider.h | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index 6cace09ba63d0..7d5ca15ac66ba 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -61,7 +61,7 @@ struct clk_rate_request {
};
/**
- * struct clk_duty - Struture encoding the duty cycle ratio of a clock
+ * struct clk_duty - Structure encoding the duty cycle ratio of a clock
*
* @num: Numerator of the duty cycle ratio
* @den: Denominator of the duty cycle ratio
@@ -116,7 +116,7 @@ struct clk_duty {
* @restore_context: Restore the context of the clock after a restoration
* of power.
*
- * @recalc_rate Recalculate the rate of this clock, by querying hardware. The
+ * @recalc_rate: Recalculate the rate of this clock, by querying hardware. The
* parent rate is an input parameter. It is up to the caller to
* ensure that the prepare_mutex is held across this call.
* Returns the calculated rate. Optional, but recommended - if
@@ -442,7 +442,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
* clock with the clock framework
* @dev: device that is registering this clock
* @name: name of this clock
- * @parent_name: name of clock's parent
+ * @parent_data: name of clock's parent
* @flags: framework-specific flags
* @fixed_rate: non-adjustable clock rate
* @fixed_accuracy: non-adjustable clock accuracy
@@ -457,7 +457,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
* the clock framework
* @dev: device that is registering this clock
* @name: name of this clock
- * @parent_name: name of clock's parent
+ * @parent_data: name of clock's parent
* @flags: framework-specific flags
* @fixed_rate: non-adjustable clock rate
*/
@@ -593,7 +593,7 @@ struct clk_div_table {
* Clock with an adjustable divider affecting its output frequency. Implements
* .recalc_rate, .set_rate and .round_rate
*
- * Flags:
+ * @flags:
* CLK_DIVIDER_ONE_BASED - by default the divisor is the value read from the
* register plus one. If CLK_DIVIDER_ONE_BASED is set then the divider is
* the raw value read from the register, with the value of zero considered
@@ -1023,11 +1023,12 @@ struct clk_hw *devm_clk_hw_register_fixed_factor(struct device *dev,
* @mwidth: width of the numerator bit field
* @nshift: shift to the denominator bit field
* @nwidth: width of the denominator bit field
+ * @approximation: clk driver's callback for calculating the divider clock
* @lock: register lock
*
* Clock with adjustable fractional divider affecting its output frequency.
*
- * Flags:
+ * @flags:
* CLK_FRAC_DIVIDER_ZERO_BASED - by default the numerator and denominator
* is the value read from the register. If CLK_FRAC_DIVIDER_ZERO_BASED
* is set then the numerator and denominator are both the value read
@@ -1086,7 +1087,7 @@ void clk_hw_unregister_fractional_divider(struct clk_hw *hw);
* Clock with an adjustable multiplier affecting its output frequency.
* Implements .recalc_rate, .set_rate and .round_rate
*
- * Flags:
+ * @flags:
* CLK_MULTIPLIER_ZERO_BYPASS - By default, the multiplier is the value read
* from the register, with 0 being a valid value effectively
* zeroing the output clock rate. If CLK_MULTIPLIER_ZERO_BYPASS is
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 134/245] platform/x86: asus-wmi: Document the dgpu_disable sysfs attribute
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 133/245] clk: linux/clk-provider.h: fix kernel-doc warnings and typos Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 135/245] acpi: property: Let args be NULL in __acpi_node_get_property_reference Greg Kroah-Hartman
` (121 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luke D. Jones, Hans de Goede,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke D. Jones <luke@ljones.dev>
[ Upstream commit 7e64c486e807c8edfbd3a0c8e44ad7a1896dbec8 ]
The dgpu_disable attribute was not documented, this adds the
required documentation.
Fixes: 98829e84dc67 ("asus-wmi: Add dgpu disable method")
Signed-off-by: Luke D. Jones <luke@ljones.dev>
Link: https://lore.kernel.org/r/20220812222509.292692-2-luke@ljones.dev
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/ABI/testing/sysfs-platform-asus-wmi | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/Documentation/ABI/testing/sysfs-platform-asus-wmi b/Documentation/ABI/testing/sysfs-platform-asus-wmi
index 04885738cf156..0f8f0772d6f3b 100644
--- a/Documentation/ABI/testing/sysfs-platform-asus-wmi
+++ b/Documentation/ABI/testing/sysfs-platform-asus-wmi
@@ -57,3 +57,12 @@ Description:
* 0 - default,
* 1 - overboost,
* 2 - silent
+
+What: /sys/devices/platform/<platform>/dgpu_disable
+Date: Aug 2022
+KernelVersion: 5.17
+Contact: "Luke Jones" <luke@ljones.dev>
+Description:
+ Disable discrete GPU:
+ * 0 - Enable dGPU,
+ * 1 - Disable dGPU
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 135/245] acpi: property: Let args be NULL in __acpi_node_get_property_reference
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 134/245] platform/x86: asus-wmi: Document the dgpu_disable sysfs attribute Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 136/245] ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger Greg Kroah-Hartman
` (120 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Andy Shevchenko,
Heikki Krogerus, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit bef52aa0f3de1b7d8c258c13b16e577361dabf3a ]
fwnode_get_property_reference_args() may not be called with args argument
NULL on ACPI, OF already supports this. Add the missing NULL checks and
document this.
The purpose is to be able to count the references.
Fixes: 977d5ad39f3e ("ACPI: Convert ACPI reference args to generic fwnode reference args")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20231109101010.1329587-2-sakari.ailus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/property.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 488915328646e..9ab7f7184343a 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -639,6 +639,7 @@ acpi_fwnode_get_named_child_node(const struct fwnode_handle *fwnode,
* @index: Index of the reference to return
* @num_args: Maximum number of arguments after each reference
* @args: Location to store the returned reference with optional arguments
+ * (may be NULL)
*
* Find property with @name, verifify that it is a package containing at least
* one object reference and if so, store the ACPI device object pointer to the
@@ -697,6 +698,9 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
if (ret)
return ret == -ENODEV ? -EINVAL : ret;
+ if (!args)
+ return 0;
+
args->fwnode = acpi_fwnode_handle(device);
args->nargs = 0;
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 136/245] ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 135/245] acpi: property: Let args be NULL in __acpi_node_get_property_reference Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 137/245] tools headers UAPI: Sync linux/fscrypt.h with the kernel sources Greg Kroah-Hartman
` (119 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafał Miłecki,
Florian Fainelli, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <rafal@milecki.pl>
[ Upstream commit be7e1e5b0f67c58ec4be0a54db23b6a4fa6e2116 ]
There is no such trigger documented or implemented in Linux. It was a
copy & paste mistake.
This fixes:
arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: leds: led-wlan:linux,default-trigger: 'oneOf' conditional failed, one must be fixed:
'default-off' is not one of ['backlight', 'default-on', 'heartbeat', 'disk-activity', 'disk-read', 'disk-write', 'timer', 'pattern', 'audio-micmute', 'audio-mute', 'bluetooth-power', 'flash', 'kbd-capslock', 'mtd', 'nand-disk', 'none', 'torch', 'usb-gadget', 'usb-host', 'usbport']
'default-off' does not match '^cpu[0-9]*$'
'default-off' does not match '^hci[0-9]+-power$'
'default-off' does not match '^mmc[0-9]+$'
'default-off' does not match '^phy[0-9]+tx$'
From schema: Documentation/devicetree/bindings/leds/leds-gpio.yaml
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Link: https://lore.kernel.org/r/20230707114004.2740-1-zajec5@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 1 -
arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 2 --
2 files changed, 3 deletions(-)
diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
index 00e688b45d981..5901160919dcd 100644
--- a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
+++ b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
@@ -26,7 +26,6 @@ leds {
wlan {
label = "bcm53xx:blue:wlan";
gpios = <&chipcommon 10 GPIO_ACTIVE_LOW>;
- linux,default-trigger = "default-off";
};
system {
diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
index 78c80a5d3f4fa..8e7483272d47d 100644
--- a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
+++ b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
@@ -26,7 +26,6 @@ leds {
5ghz {
label = "bcm53xx:blue:5ghz";
gpios = <&chipcommon 11 GPIO_ACTIVE_HIGH>;
- linux,default-trigger = "default-off";
};
system {
@@ -42,7 +41,6 @@ pcie0_leds {
2ghz {
label = "bcm53xx:blue:2ghz";
gpios = <&pcie0_chipcommon 3 GPIO_ACTIVE_HIGH>;
- linux,default-trigger = "default-off";
};
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 137/245] tools headers UAPI: Sync linux/fscrypt.h with the kernel sources
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 136/245] ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 138/245] perf beauty: Update copy of linux/socket.h " Greg Kroah-Hartman
` (118 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Herbert Xu,
Ian Rogers, Jiri Olsa, Namhyung Kim, Nathan Huckleberry,
Arnaldo Carvalho de Melo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit fabe0c61d842637b722344bcd49bfb1b76e2cc68 ]
To pick the changes from:
6b2a51ff03bf0c54 ("fscrypt: Add HCTR2 support for filename encryption")
That don't result in any changes in tooling, just causes this to be
rebuilt:
CC /tmp/build/perf-urgent/trace/beauty/sync_file_range.o
LD /tmp/build/perf-urgent/trace/beauty/perf-in.o
addressing this perf build warning:
Warning: Kernel ABI header at 'tools/include/uapi/linux/fscrypt.h' differs from latest version at 'include/uapi/linux/fscrypt.h'
diff -u tools/include/uapi/linux/fscrypt.h include/uapi/linux/fscrypt.h
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Nathan Huckleberry <nhuck@google.com>
Link: https://lore.kernel.org/lkml/Yvzl8C7O1b+hf9GS@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/uapi/linux/fscrypt.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/include/uapi/linux/fscrypt.h b/tools/include/uapi/linux/fscrypt.h
index 9f4428be3e362..a756b29afcc23 100644
--- a/tools/include/uapi/linux/fscrypt.h
+++ b/tools/include/uapi/linux/fscrypt.h
@@ -27,7 +27,8 @@
#define FSCRYPT_MODE_AES_128_CBC 5
#define FSCRYPT_MODE_AES_128_CTS 6
#define FSCRYPT_MODE_ADIANTUM 9
-/* If adding a mode number > 9, update FSCRYPT_MODE_MAX in fscrypt_private.h */
+#define FSCRYPT_MODE_AES_256_HCTR2 10
+/* If adding a mode number > 10, update FSCRYPT_MODE_MAX in fscrypt_private.h */
/*
* Legacy policy version; ad-hoc KDF and no key verification.
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 138/245] perf beauty: Update copy of linux/socket.h with the kernel sources
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 137/245] tools headers UAPI: Sync linux/fscrypt.h with the kernel sources Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 139/245] tools/virtio: fix build Greg Kroah-Hartman
` (117 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David S. Miller, Florian Westphal,
Jeremy Kerr, Arnaldo Carvalho de Melo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 6da2a45e15af4f706fed211f8eb57a40cc7abfc7 ]
To pick the changes in:
99ce45d5e7dbde39 ("mctp: Implement extended addressing")
55c42fa7fa331f98 ("mptcp: add MPTCP_INFO getsockopt")
That don't result in any changes in the tables generated from that
header.
A table generator for setsockopt is needed, probably will be done in the
5.16 cycle.
This silences this perf build warning:
Warning: Kernel ABI header at 'tools/perf/trace/beauty/include/linux/socket.h' differs from latest version at 'include/linux/socket.h'
diff -u tools/perf/trace/beauty/include/linux/socket.h include/linux/socket.h
Cc: David S. Miller <davem@davemloft.net>
Cc: Florian Westphal <fw@strlen.de>
Cc: Jeremy Kerr <jk@codeconstruct.com.au>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/trace/beauty/include/linux/socket.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/perf/trace/beauty/include/linux/socket.h b/tools/perf/trace/beauty/include/linux/socket.h
index 041d6032a3489..8ef26d89ef495 100644
--- a/tools/perf/trace/beauty/include/linux/socket.h
+++ b/tools/perf/trace/beauty/include/linux/socket.h
@@ -364,6 +364,8 @@ struct ucred {
#define SOL_KCM 281
#define SOL_TLS 282
#define SOL_XDP 283
+#define SOL_MPTCP 284
+#define SOL_MCTP 285
/* IPX options */
#define IPX_TYPE 1
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 139/245] tools/virtio: fix build
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 138/245] perf beauty: Update copy of linux/socket.h " Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 140/245] drm/amdgpu: init iommu after amdkfd device init Greg Kroah-Hartman
` (116 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefano Garzarella,
Michael S. Tsirkin, Eugenio Pérez, Peng Fan, Jason Wang,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <sgarzare@redhat.com>
[ Upstream commit d650f830f38b19039958f3f4504ceeb2b5922da7 ]
Fix the build caused by the following changes:
- phys_addr_t is now defined in tools/include/linux/types.h
- dev_warn_once() is used in drivers/virtio/virtio_ring.c
- linux/uio.h included by vringh.h use INT_MAX defined in limits.h
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-Id: <20220705072249.7867-1-sgarzare@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/virtio/linux/kernel.h | 2 +-
tools/virtio/linux/vringh.h | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
index a4beb719d2174..8b877167933d1 100644
--- a/tools/virtio/linux/kernel.h
+++ b/tools/virtio/linux/kernel.h
@@ -30,7 +30,6 @@
#define READ 0
#define WRITE 1
-typedef unsigned long long phys_addr_t;
typedef unsigned long long dma_addr_t;
typedef size_t __kernel_size_t;
typedef unsigned int __wsum;
@@ -137,6 +136,7 @@ static inline void *krealloc_array(void *p, size_t new_n, size_t new_size, gfp_t
#endif
#define dev_err(dev, format, ...) fprintf (stderr, format, ## __VA_ARGS__)
#define dev_warn(dev, format, ...) fprintf (stderr, format, ## __VA_ARGS__)
+#define dev_warn_once(dev, format, ...) fprintf (stderr, format, ## __VA_ARGS__)
#define min(x, y) ({ \
typeof(x) _min1 = (x); \
diff --git a/tools/virtio/linux/vringh.h b/tools/virtio/linux/vringh.h
index 9348957be56e4..e11c6aece7341 100644
--- a/tools/virtio/linux/vringh.h
+++ b/tools/virtio/linux/vringh.h
@@ -1 +1,2 @@
+#include <limits.h>
#include "../../../include/linux/vringh.h"
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 140/245] drm/amdgpu: init iommu after amdkfd device init
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 139/245] tools/virtio: fix build Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 141/245] f2fs: dont set GC_FAILURE_PIN for background GC Greg Kroah-Hartman
` (115 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, James Zhu,
Felix Kuehling, Alex Deucher, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifan Zhang <yifan1.zhang@amd.com>
[ Upstream commit 286826d7d976e7646b09149d9bc2899d74ff962b ]
This patch is to fix clinfo failure in Raven/Picasso:
Number of platforms: 1
Platform Profile: FULL_PROFILE
Platform Version: OpenCL 2.2 AMD-APP (3364.0)
Platform Name: AMD Accelerated Parallel Processing
Platform Vendor: Advanced Micro Devices, Inc.
Platform Extensions: cl_khr_icd cl_amd_event_callback
Platform Name: AMD Accelerated Parallel Processing Number of devices: 0
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: James Zhu <James.Zhu@amd.com>
Tested-by: James Zhu <James.Zhu@amd.com>
Acked-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 5f6c32ec674d3..222a1d9ecf163 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2487,10 +2487,6 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
if (r)
goto init_failed;
- r = amdgpu_amdkfd_resume_iommu(adev);
- if (r)
- goto init_failed;
-
r = amdgpu_device_ip_hw_init_phase1(adev);
if (r)
goto init_failed;
@@ -2529,6 +2525,10 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
if (!adev->gmc.xgmi.pending_reset)
amdgpu_amdkfd_device_init(adev);
+ r = amdgpu_amdkfd_resume_iommu(adev);
+ if (r)
+ goto init_failed;
+
amdgpu_fru_get_product_info(adev);
init_failed:
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 141/245] f2fs: dont set GC_FAILURE_PIN for background GC
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 140/245] drm/amdgpu: init iommu after amdkfd device init Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 142/245] f2fs: write checkpoint during FG_GC Greg Kroah-Hartman
` (114 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 642c0969916eaa4878cb74f36752108e590b0389 ]
So that it can reduce the possibility that file be unpinned forcely by
foreground GC due to .i_gc_failures[GC_FAILURE_PIN] exceeds threshold.
Signed-off-by: Chao Yu <chao.yu@oppo.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/gc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index 7010440cb64c8..d016504fad4b9 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1199,7 +1199,8 @@ static int move_data_block(struct inode *inode, block_t bidx,
}
if (f2fs_is_pinned_file(inode)) {
- f2fs_pin_file_control(inode, true);
+ if (gc_type == FG_GC)
+ f2fs_pin_file_control(inode, true);
err = -EAGAIN;
goto out;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 142/245] f2fs: write checkpoint during FG_GC
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 141/245] f2fs: dont set GC_FAILURE_PIN for background GC Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 143/245] drm/i915/dg1: Update DMC_DEBUG3 register Greg Kroah-Hartman
` (113 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Byungki Lee, Chao Yu, Jaegeuk Kim,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Byungki Lee <dominicus79@gmail.com>
[ Upstream commit a9163b947ae8f7af7cb8d63606cd87b9facbfe74 ]
If there's not enough free sections each of which consistis of large segments,
we can hit no free section for upcoming section allocation. Let's reclaim some
prefree segments by writing checkpoints.
Signed-off-by: Byungki Lee <dominicus79@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/gc.c | 38 +++++++++++++++++++++++---------------
1 file changed, 23 insertions(+), 15 deletions(-)
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index d016504fad4b9..2c13f308c74e3 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1782,23 +1782,31 @@ int f2fs_gc(struct f2fs_sb_info *sbi, bool sync,
if (sync)
goto stop;
- if (has_not_enough_free_secs(sbi, sec_freed, 0)) {
- if (skipped_round <= MAX_SKIP_GC_COUNT ||
- skipped_round * 2 < round) {
- segno = NULL_SEGNO;
- goto gc_more;
- }
+ if (!has_not_enough_free_secs(sbi, sec_freed, 0))
+ goto stop;
- if (first_skipped < last_skipped &&
- (last_skipped - first_skipped) >
- sbi->skipped_gc_rwsem) {
- f2fs_drop_inmem_pages_all(sbi, true);
- segno = NULL_SEGNO;
- goto gc_more;
- }
- if (gc_type == FG_GC && !is_sbi_flag_set(sbi, SBI_CP_DISABLED))
+ if (skipped_round <= MAX_SKIP_GC_COUNT || skipped_round * 2 < round) {
+
+ /* Write checkpoint to reclaim prefree segments */
+ if (free_sections(sbi) < NR_CURSEG_PERSIST_TYPE &&
+ prefree_segments(sbi) &&
+ !is_sbi_flag_set(sbi, SBI_CP_DISABLED)) {
ret = f2fs_write_checkpoint(sbi, &cpc);
- }
+ if (ret)
+ goto stop;
+ }
+ segno = NULL_SEGNO;
+ goto gc_more;
+ }
+ if (first_skipped < last_skipped &&
+ (last_skipped - first_skipped) >
+ sbi->skipped_gc_rwsem) {
+ f2fs_drop_inmem_pages_all(sbi, true);
+ segno = NULL_SEGNO;
+ goto gc_more;
+ }
+ if (gc_type == FG_GC && !is_sbi_flag_set(sbi, SBI_CP_DISABLED))
+ ret = f2fs_write_checkpoint(sbi, &cpc);
stop:
SIT_I(sbi)->last_victim[ALLOC_NEXT] = 0;
SIT_I(sbi)->last_victim[FLUSH_DEVICE] = init_segno;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 143/245] drm/i915/dg1: Update DMC_DEBUG3 register
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 142/245] f2fs: write checkpoint during FG_GC Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 144/245] kernel/sched: Remove dl_boosted flag comment Greg Kroah-Hartman
` (112 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Roper, Jani Nikula,
Chuansheng Liu, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuansheng Liu <chuansheng.liu@intel.com>
[ Upstream commit b60668cb4c57a7cc451de781ae49f5e9cc375eaf ]
Current DMC_DEBUG3(_MMIO(0x101090)) address is for TGL,
it is wrong for DG1. Just like commit 5bcc95ca382e
("drm/i915/dg1: Update DMC_DEBUG register"), correct
this issue for DG1 platform to avoid wrong register
being read.
BSpec: 49788
v2: fix "not wrong" typo. (Jani)
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220211002933.84240-1-chuansheng.liu@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_display_debugfs.c | 4 ++--
drivers/gpu/drm/i915/i915_reg.h | 3 ++-
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_display_debugfs.c b/drivers/gpu/drm/i915/display/intel_display_debugfs.c
index b136a0fc0963b..6b3e2e053f457 100644
--- a/drivers/gpu/drm/i915/display/intel_display_debugfs.c
+++ b/drivers/gpu/drm/i915/display/intel_display_debugfs.c
@@ -571,8 +571,8 @@ static int i915_dmc_info(struct seq_file *m, void *unused)
* reg for DC3CO debugging and validation,
* but TGL DMC f/w is using DMC_DEBUG3 reg for DC3CO counter.
*/
- seq_printf(m, "DC3CO count: %d\n",
- intel_de_read(dev_priv, DMC_DEBUG3));
+ seq_printf(m, "DC3CO count: %d\n", intel_de_read(dev_priv, IS_DGFX(dev_priv) ?
+ DG1_DMC_DEBUG3 : TGL_DMC_DEBUG3));
} else {
dc5_reg = IS_BROXTON(dev_priv) ? BXT_DMC_DC3_DC5_COUNT :
SKL_DMC_DC3_DC5_COUNT;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 3c70aa5229e5a..906982d6370d0 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -7841,7 +7841,8 @@ enum {
#define TGL_DMC_DEBUG_DC6_COUNT _MMIO(0x101088)
#define DG1_DMC_DEBUG_DC5_COUNT _MMIO(0x134154)
-#define DMC_DEBUG3 _MMIO(0x101090)
+#define TGL_DMC_DEBUG3 _MMIO(0x101090)
+#define DG1_DMC_DEBUG3 _MMIO(0x13415c)
/* Display Internal Timeout Register */
#define RM_TIMEOUT _MMIO(0x42060)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 144/245] kernel/sched: Remove dl_boosted flag comment
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 143/245] drm/i915/dg1: Update DMC_DEBUG3 register Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 145/245] cifs: remove useless parameter is_fsctl from SMB2_ioctl() Greg Kroah-Hartman
` (111 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Su, Peter Zijlstra (Intel),
Daniel Bristot de Oliveira, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <suhui_kernel@163.com>
[ Upstream commit 0e3872499de1a1230cef5221607d71aa09264bd5 ]
since commit 2279f540ea7d ("sched/deadline: Fix priority
inheritance with multiple scheduling classes"), we should not
keep it here.
Signed-off-by: Hui Su <suhui_kernel@163.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Link: https://lore.kernel.org/r/20220107095254.GA49258@localhost.localdomain
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/sched.h | 4 ----
1 file changed, 4 deletions(-)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 7bfc2b45cd99b..9b3cfe685cb45 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -608,10 +608,6 @@ struct sched_dl_entity {
* task has to wait for a replenishment to be performed at the
* next firing of dl_timer.
*
- * @dl_boosted tells if we are boosted due to DI. If so we are
- * outside bandwidth enforcement mechanism (but only until we
- * exit the critical section);
- *
* @dl_yielded tells if task gave up the CPU before consuming
* all its available runtime during the last job.
*
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 145/245] cifs: remove useless parameter is_fsctl from SMB2_ioctl()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 144/245] kernel/sched: Remove dl_boosted flag comment Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 146/245] serial: 8250: Remove serial_rs485 sanitization from em485 Greg Kroah-Hartman
` (110 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Enzo Matsumiya, Tom Talpey,
Steve French, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enzo Matsumiya <ematsumiya@suse.de>
[ Upstream commit 400d0ad63b190895e29f43bc75b1260111d3fd34 ]
SMB2_ioctl() is always called with is_fsctl = true, so doesn't make any
sense to have it at all.
Thus, always set SMB2_0_IOCTL_IS_FSCTL flag on the request.
Also, as per MS-SMB2 3.3.5.15 "Receiving an SMB2 IOCTL Request", servers
must fail the request if the request flags is zero anyway.
Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Reviewed-by: Tom Talpey <tom@talpey.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/smb2file.c | 1 -
fs/cifs/smb2ops.c | 35 +++++++++++++----------------------
fs/cifs/smb2pdu.c | 20 +++++++++-----------
fs/cifs/smb2proto.h | 4 ++--
4 files changed, 24 insertions(+), 36 deletions(-)
diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
index f5dcc4940b6da..9dfd2dd612c25 100644
--- a/fs/cifs/smb2file.c
+++ b/fs/cifs/smb2file.c
@@ -61,7 +61,6 @@ smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms,
nr_ioctl_req.Reserved = 0;
rc = SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid,
fid->volatile_fid, FSCTL_LMR_REQUEST_RESILIENCY,
- true /* is_fsctl */,
(char *)&nr_ioctl_req, sizeof(nr_ioctl_req),
CIFSMaxBufSize, NULL, NULL /* no return info */);
if (rc == -EOPNOTSUPP) {
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 6f09e889e74d7..a8f33e8261344 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -647,7 +647,7 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon)
struct cifs_ses *ses = tcon->ses;
rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
- FSCTL_QUERY_NETWORK_INTERFACE_INFO, true /* is_fsctl */,
+ FSCTL_QUERY_NETWORK_INTERFACE_INFO,
NULL /* no data input */, 0 /* no data input */,
CIFSMaxBufSize, (char **)&out_buf, &ret_data_len);
if (rc == -EOPNOTSUPP) {
@@ -1582,9 +1582,8 @@ SMB2_request_res_key(const unsigned int xid, struct cifs_tcon *tcon,
struct resume_key_req *res_key;
rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
- FSCTL_SRV_REQUEST_RESUME_KEY, true /* is_fsctl */,
- NULL, 0 /* no input */, CIFSMaxBufSize,
- (char **)&res_key, &ret_data_len);
+ FSCTL_SRV_REQUEST_RESUME_KEY, NULL, 0 /* no input */,
+ CIFSMaxBufSize, (char **)&res_key, &ret_data_len);
if (rc == -EOPNOTSUPP) {
pr_warn_once("Server share %s does not support copy range\n", tcon->treeName);
@@ -1726,7 +1725,7 @@ smb2_ioctl_query_info(const unsigned int xid,
rqst[1].rq_nvec = SMB2_IOCTL_IOV_SIZE;
rc = SMB2_ioctl_init(tcon, server, &rqst[1], COMPOUND_FID, COMPOUND_FID,
- qi.info_type, true, buffer, qi.output_buffer_length,
+ qi.info_type, buffer, qi.output_buffer_length,
CIFSMaxBufSize - MAX_SMB2_CREATE_RESPONSE_SIZE -
MAX_SMB2_CLOSE_RESPONSE_SIZE);
free_req1_func = SMB2_ioctl_free;
@@ -1902,9 +1901,8 @@ smb2_copychunk_range(const unsigned int xid,
retbuf = NULL;
rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
- true /* is_fsctl */, (char *)pcchunk,
- sizeof(struct copychunk_ioctl), CIFSMaxBufSize,
- (char **)&retbuf, &ret_data_len);
+ (char *)pcchunk, sizeof(struct copychunk_ioctl),
+ CIFSMaxBufSize, (char **)&retbuf, &ret_data_len);
if (rc == 0) {
if (ret_data_len !=
sizeof(struct copychunk_ioctl_rsp)) {
@@ -2064,7 +2062,6 @@ static bool smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
cfile->fid.volatile_fid, FSCTL_SET_SPARSE,
- true /* is_fctl */,
&setsparse, 1, CIFSMaxBufSize, NULL, NULL);
if (rc) {
tcon->broken_sparse_sup = true;
@@ -2147,7 +2144,6 @@ smb2_duplicate_extents(const unsigned int xid,
rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
trgtfile->fid.volatile_fid,
FSCTL_DUPLICATE_EXTENTS_TO_FILE,
- true /* is_fsctl */,
(char *)&dup_ext_buf,
sizeof(struct duplicate_extents_to_file),
CIFSMaxBufSize, NULL,
@@ -2182,7 +2178,6 @@ smb3_set_integrity(const unsigned int xid, struct cifs_tcon *tcon,
return SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
cfile->fid.volatile_fid,
FSCTL_SET_INTEGRITY_INFORMATION,
- true /* is_fsctl */,
(char *)&integr_info,
sizeof(struct fsctl_set_integrity_information_req),
CIFSMaxBufSize, NULL,
@@ -2235,7 +2230,6 @@ smb3_enum_snapshots(const unsigned int xid, struct cifs_tcon *tcon,
rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
cfile->fid.volatile_fid,
FSCTL_SRV_ENUMERATE_SNAPSHOTS,
- true /* is_fsctl */,
NULL, 0 /* no input data */, max_response_size,
(char **)&retbuf,
&ret_data_len);
@@ -2920,7 +2914,6 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses,
do {
rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
FSCTL_DFS_GET_REFERRALS,
- true /* is_fsctl */,
(char *)dfs_req, dfs_req_size, CIFSMaxBufSize,
(char **)&dfs_rsp, &dfs_rsp_size);
if (!is_retryable_error(rc))
@@ -3129,8 +3122,7 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
rc = SMB2_ioctl_init(tcon, server,
&rqst[1], fid.persistent_fid,
- fid.volatile_fid, FSCTL_GET_REPARSE_POINT,
- true /* is_fctl */, NULL, 0,
+ fid.volatile_fid, FSCTL_GET_REPARSE_POINT, NULL, 0,
CIFSMaxBufSize -
MAX_SMB2_CREATE_RESPONSE_SIZE -
MAX_SMB2_CLOSE_RESPONSE_SIZE);
@@ -3310,8 +3302,7 @@ smb2_query_reparse_tag(const unsigned int xid, struct cifs_tcon *tcon,
rc = SMB2_ioctl_init(tcon, server,
&rqst[1], COMPOUND_FID,
- COMPOUND_FID, FSCTL_GET_REPARSE_POINT,
- true /* is_fctl */, NULL, 0,
+ COMPOUND_FID, FSCTL_GET_REPARSE_POINT, NULL, 0,
CIFSMaxBufSize -
MAX_SMB2_CREATE_RESPONSE_SIZE -
MAX_SMB2_CLOSE_RESPONSE_SIZE);
@@ -3587,7 +3578,7 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
fsctl_buf.BeyondFinalZero = cpu_to_le64(offset + len);
rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
- cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA, true,
+ cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA,
(char *)&fsctl_buf,
sizeof(struct file_zero_data_information),
0, NULL, NULL);
@@ -3648,7 +3639,7 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon,
rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA,
- true /* is_fctl */, (char *)&fsctl_buf,
+ (char *)&fsctl_buf,
sizeof(struct file_zero_data_information),
CIFSMaxBufSize, NULL, NULL);
filemap_invalidate_unlock(inode->i_mapping);
@@ -3710,7 +3701,7 @@ static int smb3_simple_fallocate_range(unsigned int xid,
in_data.length = cpu_to_le64(len);
rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
cfile->fid.volatile_fid,
- FSCTL_QUERY_ALLOCATED_RANGES, true,
+ FSCTL_QUERY_ALLOCATED_RANGES,
(char *)&in_data, sizeof(in_data),
1024 * sizeof(struct file_allocated_range_buffer),
(char **)&out_data, &out_data_len);
@@ -4022,7 +4013,7 @@ static loff_t smb3_llseek(struct file *file, struct cifs_tcon *tcon, loff_t offs
rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
cfile->fid.volatile_fid,
- FSCTL_QUERY_ALLOCATED_RANGES, true,
+ FSCTL_QUERY_ALLOCATED_RANGES,
(char *)&in_data, sizeof(in_data),
sizeof(struct file_allocated_range_buffer),
(char **)&out_data, &out_data_len);
@@ -4082,7 +4073,7 @@ static int smb3_fiemap(struct cifs_tcon *tcon,
rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
cfile->fid.volatile_fid,
- FSCTL_QUERY_ALLOCATED_RANGES, true,
+ FSCTL_QUERY_ALLOCATED_RANGES,
(char *)&in_data, sizeof(in_data),
1024 * sizeof(struct file_allocated_range_buffer),
(char **)&out_data, &out_data_len);
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index b2b35edd6a310..61b18f802048f 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1152,7 +1152,7 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
}
rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
- FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
+ FSCTL_VALIDATE_NEGOTIATE_INFO,
(char *)pneg_inbuf, inbuflen, CIFSMaxBufSize,
(char **)&pneg_rsp, &rsplen);
if (rc == -EOPNOTSUPP) {
@@ -3013,7 +3013,7 @@ int
SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
struct smb_rqst *rqst,
u64 persistent_fid, u64 volatile_fid, u32 opcode,
- bool is_fsctl, char *in_data, u32 indatalen,
+ char *in_data, u32 indatalen,
__u32 max_response_size)
{
struct smb2_ioctl_req *req;
@@ -3088,10 +3088,8 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
req->sync_hdr.CreditCharge =
cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size),
SMB2_MAX_BUFFER_SIZE));
- if (is_fsctl)
- req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
- else
- req->Flags = 0;
+ /* always an FSCTL (for now) */
+ req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
/* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */
if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO)
@@ -3118,9 +3116,9 @@ SMB2_ioctl_free(struct smb_rqst *rqst)
*/
int
SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
- u64 volatile_fid, u32 opcode, bool is_fsctl,
- char *in_data, u32 indatalen, u32 max_out_data_len,
- char **out_data, u32 *plen /* returned data len */)
+ u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen,
+ u32 max_out_data_len, char **out_data,
+ u32 *plen /* returned data len */)
{
struct smb_rqst rqst;
struct smb2_ioctl_rsp *rsp = NULL;
@@ -3162,7 +3160,7 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
rc = SMB2_ioctl_init(tcon, server,
&rqst, persistent_fid, volatile_fid, opcode,
- is_fsctl, in_data, indatalen, max_out_data_len);
+ in_data, indatalen, max_out_data_len);
if (rc)
goto ioctl_exit;
@@ -3244,7 +3242,7 @@ SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
cpu_to_le16(COMPRESSION_FORMAT_DEFAULT);
rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
- FSCTL_SET_COMPRESSION, true /* is_fsctl */,
+ FSCTL_SET_COMPRESSION,
(char *)&fsctl_input /* data input */,
2 /* in data len */, CIFSMaxBufSize /* max out data */,
&ret_data /* out data */, NULL);
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 6c5a4d44b248a..ada1d7338f34f 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -144,13 +144,13 @@ extern int SMB2_open_init(struct cifs_tcon *tcon,
extern void SMB2_open_free(struct smb_rqst *rqst);
extern int SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon,
u64 persistent_fid, u64 volatile_fid, u32 opcode,
- bool is_fsctl, char *in_data, u32 indatalen, u32 maxoutlen,
+ char *in_data, u32 indatalen, u32 maxoutlen,
char **out_data, u32 *plen /* returned data len */);
extern int SMB2_ioctl_init(struct cifs_tcon *tcon,
struct TCP_Server_Info *server,
struct smb_rqst *rqst,
u64 persistent_fid, u64 volatile_fid, u32 opcode,
- bool is_fsctl, char *in_data, u32 indatalen,
+ char *in_data, u32 indatalen,
__u32 max_response_size);
extern void SMB2_ioctl_free(struct smb_rqst *rqst);
extern int SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon,
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 146/245] serial: 8250: Remove serial_rs485 sanitization from em485
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 145/245] cifs: remove useless parameter is_fsctl from SMB2_ioctl() Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 147/245] clk: imx8mp: Add DISP2 pixel clock Greg Kroah-Hartman
` (109 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 84f2faa7852e1f55d89bb0c99b3a672b87b11f87 ]
Serial core handles serial_rs485 sanitization.
When em485 init fails, there are two possible paths of entry:
1) uart_rs485_config (init path) that fully clears port->rs485 on
error.
2) ioctl path with a pre-existing, valid port->rs485 unto which the
kernel falls back on error and port->rs485 should therefore be
kept untouched. The temporary rs485 struct is not returned to
userspace in case of error so its flag don't matter.
...Thus SER_RS485_ENABLED clearing on error can/should be dropped.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://lore.kernel.org/r/20220606100433.13793-37-ilpo.jarvinen@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_port.c | 18 ++----------------
1 file changed, 2 insertions(+), 16 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 45a8f76f562e7..4fce318bc83ca 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -670,13 +670,6 @@ int serial8250_em485_config(struct uart_port *port, struct serial_rs485 *rs485)
rs485->flags &= ~SER_RS485_RTS_AFTER_SEND;
}
- /* clamp the delays to [0, 100ms] */
- rs485->delay_rts_before_send = min(rs485->delay_rts_before_send, 100U);
- rs485->delay_rts_after_send = min(rs485->delay_rts_after_send, 100U);
-
- memset(rs485->padding, 0, sizeof(rs485->padding));
- port->rs485 = *rs485;
-
gpiod_set_value(port->rs485_term_gpio,
rs485->flags & SER_RS485_TERMINATE_BUS);
@@ -684,15 +677,8 @@ int serial8250_em485_config(struct uart_port *port, struct serial_rs485 *rs485)
* Both serial8250_em485_init() and serial8250_em485_destroy()
* are idempotent.
*/
- if (rs485->flags & SER_RS485_ENABLED) {
- int ret = serial8250_em485_init(up);
-
- if (ret) {
- rs485->flags &= ~SER_RS485_ENABLED;
- port->rs485.flags &= ~SER_RS485_ENABLED;
- }
- return ret;
- }
+ if (rs485->flags & SER_RS485_ENABLED)
+ return serial8250_em485_init(up);
serial8250_em485_destroy(up);
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 147/245] clk: imx8mp: Add DISP2 pixel clock
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 146/245] serial: 8250: Remove serial_rs485 sanitization from em485 Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 148/245] clk: imx8mp: add clkout1/2 support Greg Kroah-Hartman
` (108 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Abel Vesa,
Fabio Estevam, NXP Linux Team, Peng Fan, Shawn Guo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@denx.de>
[ Upstream commit 39772efd98adecbd5b8c6096d465d2fcbafbde6a ]
Add pixel clock for second LCDIFv3 interface. Both LCDIFv3 interfaces use
the same set of parent clock, so deduplicate imx8mp_media_disp1_pix_sels
into common imx8mp_media_disp_pix_sels and use it for both.
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Abel Vesa <abel.vesa@nxp.com>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: NXP Linux Team <linux-imx@nxp.com>
Cc: Peng Fan <peng.fan@nxp.com>
Cc: Shawn Guo <shawnguo@kernel.org>
Reviewed-by: Abel Vesa <abel.vesa@nxp.com>
Link: https://lore.kernel.org/r/20220313123949.207284-1-marex@denx.de
Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
Stable-dep-of: 5c1f7f109094 ("dt-bindings: clocks: imx8mp: Add ID for usb suspend clock")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk-imx8mp.c | 5 +++--
include/dt-bindings/clock/imx8mp-clock.h | 4 +++-
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c
index aeb611eaabd3b..b1c83f9809123 100644
--- a/drivers/clk/imx/clk-imx8mp.c
+++ b/drivers/clk/imx/clk-imx8mp.c
@@ -355,7 +355,7 @@ static const char * const imx8mp_media_mipi_phy1_ref_sels[] = {"osc_24m", "sys_p
"clk_ext2", "audio_pll2_out",
"video_pll1_out", };
-static const char * const imx8mp_media_disp1_pix_sels[] = {"osc_24m", "video_pll1_out", "audio_pll2_out",
+static const char * const imx8mp_media_disp_pix_sels[] = {"osc_24m", "video_pll1_out", "audio_pll2_out",
"audio_pll1_out", "sys_pll1_800m",
"sys_pll2_1000m", "sys_pll3_out", "clk_ext4", };
@@ -548,6 +548,7 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
hws[IMX8MP_CLK_AHB] = imx8m_clk_hw_composite_bus_critical("ahb_root", imx8mp_ahb_sels, ccm_base + 0x9000);
hws[IMX8MP_CLK_AUDIO_AHB] = imx8m_clk_hw_composite_bus("audio_ahb", imx8mp_audio_ahb_sels, ccm_base + 0x9100);
hws[IMX8MP_CLK_MIPI_DSI_ESC_RX] = imx8m_clk_hw_composite_bus("mipi_dsi_esc_rx", imx8mp_mipi_dsi_esc_rx_sels, ccm_base + 0x9200);
+ hws[IMX8MP_CLK_MEDIA_DISP2_PIX] = imx8m_clk_hw_composite("media_disp2_pix", imx8mp_media_disp_pix_sels, ccm_base + 0x9300);
hws[IMX8MP_CLK_IPG_ROOT] = imx_clk_hw_divider2("ipg_root", "ahb_root", ccm_base + 0x9080, 0, 1);
@@ -609,7 +610,7 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
hws[IMX8MP_CLK_USDHC3] = imx8m_clk_hw_composite("usdhc3", imx8mp_usdhc3_sels, ccm_base + 0xbc80);
hws[IMX8MP_CLK_MEDIA_CAM1_PIX] = imx8m_clk_hw_composite("media_cam1_pix", imx8mp_media_cam1_pix_sels, ccm_base + 0xbd00);
hws[IMX8MP_CLK_MEDIA_MIPI_PHY1_REF] = imx8m_clk_hw_composite("media_mipi_phy1_ref", imx8mp_media_mipi_phy1_ref_sels, ccm_base + 0xbd80);
- hws[IMX8MP_CLK_MEDIA_DISP1_PIX] = imx8m_clk_hw_composite("media_disp1_pix", imx8mp_media_disp1_pix_sels, ccm_base + 0xbe00);
+ hws[IMX8MP_CLK_MEDIA_DISP1_PIX] = imx8m_clk_hw_composite("media_disp1_pix", imx8mp_media_disp_pix_sels, ccm_base + 0xbe00);
hws[IMX8MP_CLK_MEDIA_CAM2_PIX] = imx8m_clk_hw_composite("media_cam2_pix", imx8mp_media_cam2_pix_sels, ccm_base + 0xbe80);
hws[IMX8MP_CLK_MEDIA_LDB] = imx8m_clk_hw_composite("media_ldb", imx8mp_media_ldb_sels, ccm_base + 0xbf00);
hws[IMX8MP_CLK_MEMREPAIR] = imx8m_clk_hw_composite_critical("mem_repair", imx8mp_memrepair_sels, ccm_base + 0xbf80);
diff --git a/include/dt-bindings/clock/imx8mp-clock.h b/include/dt-bindings/clock/imx8mp-clock.h
index 43927a1b9e940..4fff3e57f460b 100644
--- a/include/dt-bindings/clock/imx8mp-clock.h
+++ b/include/dt-bindings/clock/imx8mp-clock.h
@@ -319,7 +319,9 @@
#define IMX8MP_CLK_HSIO_AXI 311
#define IMX8MP_CLK_MEDIA_ISP 312
-#define IMX8MP_CLK_END 313
+#define IMX8MP_CLK_MEDIA_DISP2_PIX 313
+
+#define IMX8MP_CLK_END 314
#define IMX8MP_CLK_AUDIOMIX_SAI1_IPG 0
#define IMX8MP_CLK_AUDIOMIX_SAI1_MCLK1 1
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 148/245] clk: imx8mp: add clkout1/2 support
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 147/245] clk: imx8mp: Add DISP2 pixel clock Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 149/245] dt-bindings: clocks: imx8mp: Add ID for usb suspend clock Greg Kroah-Hartman
` (107 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lucas Stach, Abel Vesa, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <l.stach@pengutronix.de>
[ Upstream commit 43896f56b59eeaf08687fa976257ae7083d01b41 ]
clkout1 and clkout2 allow to supply clocks from the SoC to the board,
which is used by some board designs to provide reference clocks.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Reviewed-by: Abel Vesa <abel.vesa@nxp.com>
Link: https://lore.kernel.org/r/20220427162131.3127303-1-l.stach@pengutronix.de
Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
Stable-dep-of: 5c1f7f109094 ("dt-bindings: clocks: imx8mp: Add ID for usb suspend clock")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk-imx8mp.c | 14 ++++++++++++++
include/dt-bindings/clock/imx8mp-clock.h | 9 +++++++--
2 files changed, 21 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c
index b1c83f9809123..cdeacdc143b5c 100644
--- a/drivers/clk/imx/clk-imx8mp.c
+++ b/drivers/clk/imx/clk-imx8mp.c
@@ -396,6 +396,11 @@ static const char * const imx8mp_sai7_sels[] = {"osc_24m", "audio_pll1_out", "au
static const char * const imx8mp_dram_core_sels[] = {"dram_pll_out", "dram_alt_root", };
+static const char * const imx8mp_clkout_sels[] = {"audio_pll1_out", "audio_pll2_out", "video_pll1_out",
+ "dummy", "dummy", "gpu_pll_out", "vpu_pll_out",
+ "arm_pll_out", "sys_pll1", "sys_pll2", "sys_pll3",
+ "dummy", "dummy", "osc_24m", "dummy", "osc_32k"};
+
static struct clk_hw **hws;
static struct clk_hw_onecell_data *clk_hw_data;
@@ -514,6 +519,15 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
hws[IMX8MP_SYS_PLL2_500M] = imx_clk_hw_fixed_factor("sys_pll2_500m", "sys_pll2_500m_cg", 1, 2);
hws[IMX8MP_SYS_PLL2_1000M] = imx_clk_hw_fixed_factor("sys_pll2_1000m", "sys_pll2_out", 1, 1);
+ hws[IMX8MP_CLK_CLKOUT1_SEL] = imx_clk_hw_mux2("clkout1_sel", anatop_base + 0x128, 4, 4,
+ imx8mp_clkout_sels, ARRAY_SIZE(imx8mp_clkout_sels));
+ hws[IMX8MP_CLK_CLKOUT1_DIV] = imx_clk_hw_divider("clkout1_div", "clkout1_sel", anatop_base + 0x128, 0, 4);
+ hws[IMX8MP_CLK_CLKOUT1] = imx_clk_hw_gate("clkout1", "clkout1_div", anatop_base + 0x128, 8);
+ hws[IMX8MP_CLK_CLKOUT2_SEL] = imx_clk_hw_mux2("clkout2_sel", anatop_base + 0x128, 20, 4,
+ imx8mp_clkout_sels, ARRAY_SIZE(imx8mp_clkout_sels));
+ hws[IMX8MP_CLK_CLKOUT2_DIV] = imx_clk_hw_divider("clkout2_div", "clkout2_sel", anatop_base + 0x128, 16, 4);
+ hws[IMX8MP_CLK_CLKOUT2] = imx_clk_hw_gate("clkout2", "clkout2_div", anatop_base + 0x128, 24);
+
hws[IMX8MP_CLK_A53_DIV] = imx8m_clk_hw_composite_core("arm_a53_div", imx8mp_a53_sels, ccm_base + 0x8000);
hws[IMX8MP_CLK_A53_SRC] = hws[IMX8MP_CLK_A53_DIV];
hws[IMX8MP_CLK_A53_CG] = hws[IMX8MP_CLK_A53_DIV];
diff --git a/include/dt-bindings/clock/imx8mp-clock.h b/include/dt-bindings/clock/imx8mp-clock.h
index 4fff3e57f460b..a02fd723168cc 100644
--- a/include/dt-bindings/clock/imx8mp-clock.h
+++ b/include/dt-bindings/clock/imx8mp-clock.h
@@ -318,10 +318,15 @@
#define IMX8MP_CLK_AUDIO_AXI 310
#define IMX8MP_CLK_HSIO_AXI 311
#define IMX8MP_CLK_MEDIA_ISP 312
-
#define IMX8MP_CLK_MEDIA_DISP2_PIX 313
+#define IMX8MP_CLK_CLKOUT1_SEL 314
+#define IMX8MP_CLK_CLKOUT1_DIV 315
+#define IMX8MP_CLK_CLKOUT1 316
+#define IMX8MP_CLK_CLKOUT2_SEL 317
+#define IMX8MP_CLK_CLKOUT2_DIV 318
+#define IMX8MP_CLK_CLKOUT2 319
-#define IMX8MP_CLK_END 314
+#define IMX8MP_CLK_END 320
#define IMX8MP_CLK_AUDIOMIX_SAI1_IPG 0
#define IMX8MP_CLK_AUDIOMIX_SAI1_MCLK1 1
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 149/245] dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 148/245] clk: imx8mp: add clkout1/2 support Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 150/245] net: ethernet: ti: add missing of_node_put before return Greg Kroah-Hartman
` (106 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Alexander Stein,
Li Jun, Abel Vesa, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Jun <jun.li@nxp.com>
[ Upstream commit 5c1f7f1090947d494c30042123e0ec846f696336 ]
usb suspend clock has a gate shared with usb_root_clk.
Fixes: 9c140d9926761 ("clk: imx: Add support for i.MX8MP clock driver")
Cc: stable@vger.kernel.org # v5.19+
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://lore.kernel.org/r/1664549663-20364-1-git-send-email-jun.li@nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/dt-bindings/clock/imx8mp-clock.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/dt-bindings/clock/imx8mp-clock.h b/include/dt-bindings/clock/imx8mp-clock.h
index a02fd723168cc..5e872b01d5ab8 100644
--- a/include/dt-bindings/clock/imx8mp-clock.h
+++ b/include/dt-bindings/clock/imx8mp-clock.h
@@ -325,8 +325,9 @@
#define IMX8MP_CLK_CLKOUT2_SEL 317
#define IMX8MP_CLK_CLKOUT2_DIV 318
#define IMX8MP_CLK_CLKOUT2 319
+#define IMX8MP_CLK_USB_SUSP 320
-#define IMX8MP_CLK_END 320
+#define IMX8MP_CLK_END 321
#define IMX8MP_CLK_AUDIOMIX_SAI1_IPG 0
#define IMX8MP_CLK_AUDIOMIX_SAI1_MCLK1 1
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 150/245] net: ethernet: ti: add missing of_node_put before return
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 149/245] dt-bindings: clocks: imx8mp: Add ID for usb suspend clock Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 151/245] powerpc/rtas: make all exports GPL Greg Kroah-Hartman
` (105 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Qing, David S. Miller,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Qing <wangqing@vivo.com>
[ Upstream commit be565ec71d1d59438bed0c7ed0a252a327e0b0ef ]
Fix following coccicheck warning:
WARNING: Function "for_each_child_of_node"
should have of_node_put() before return.
Early exits from for_each_child_of_node should decrement the
node reference counter.
Signed-off-by: Wang Qing <wangqing@vivo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 29 ++++++++++++++++--------
1 file changed, 20 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
index 1fa6f0dacd2de..f94d6d322df42 100644
--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
@@ -1856,13 +1856,14 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)
if (ret < 0) {
dev_err(dev, "%pOF error reading port_id %d\n",
port_np, ret);
- return ret;
+ goto of_node_put;
}
if (!port_id || port_id > common->port_num) {
dev_err(dev, "%pOF has invalid port_id %u %s\n",
port_np, port_id, port_np->name);
- return -EINVAL;
+ ret = -EINVAL;
+ goto of_node_put;
}
port = am65_common_get_port(common, port_id);
@@ -1878,8 +1879,10 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)
(AM65_CPSW_NU_FRAM_PORT_OFFSET * (port_id - 1));
port->slave.mac_sl = cpsw_sl_get("am65", dev, port->port_base);
- if (IS_ERR(port->slave.mac_sl))
- return PTR_ERR(port->slave.mac_sl);
+ if (IS_ERR(port->slave.mac_sl)) {
+ ret = PTR_ERR(port->slave.mac_sl);
+ goto of_node_put;
+ }
port->disabled = !of_device_is_available(port_np);
if (port->disabled) {
@@ -1892,7 +1895,7 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)
ret = PTR_ERR(port->slave.ifphy);
dev_err(dev, "%pOF error retrieving port phy: %d\n",
port_np, ret);
- return ret;
+ goto of_node_put;
}
port->slave.mac_only =
@@ -1901,10 +1904,12 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)
/* get phy/link info */
if (of_phy_is_fixed_link(port_np)) {
ret = of_phy_register_fixed_link(port_np);
- if (ret)
- return dev_err_probe(dev, ret,
+ if (ret) {
+ ret = dev_err_probe(dev, ret,
"failed to register fixed-link phy %pOF\n",
port_np);
+ goto of_node_put;
+ }
port->slave.phy_node = of_node_get(port_np);
} else {
port->slave.phy_node =
@@ -1914,14 +1919,15 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)
if (!port->slave.phy_node) {
dev_err(dev,
"slave[%d] no phy found\n", port_id);
- return -ENODEV;
+ ret = -ENODEV;
+ goto of_node_put;
}
ret = of_get_phy_mode(port_np, &port->slave.phy_if);
if (ret) {
dev_err(dev, "%pOF read phy-mode err %d\n",
port_np, ret);
- return ret;
+ goto of_node_put;
}
ret = of_get_mac_address(port_np, port->slave.mac_addr);
@@ -1944,6 +1950,11 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)
}
return 0;
+
+of_node_put:
+ of_node_put(port_np);
+ of_node_put(node);
+ return ret;
}
static void am65_cpsw_pcpu_stats_free(void *data)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 151/245] powerpc/rtas: make all exports GPL
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 150/245] net: ethernet: ti: add missing of_node_put before return Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 152/245] powerpc/rtas: ensure 4KB alignment for rtas_data_buf Greg Kroah-Hartman
` (104 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Lynch, Laurent Dufour,
Michael Ellerman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <nathanl@linux.ibm.com>
[ Upstream commit 9bce6243848dfd0ff7c2be6e8d82ab9b1e6c7858 ]
The first symbol exports of RTAS functions and data came with the (now
removed) scanlog driver in 2003:
https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git/commit/?id=f92e361842d5251e50562b09664082dcbd0548bb
At the time this was applied, EXPORT_SYMBOL_GPL() was very new, and
the exports of rtas_call() etc have remained non-GPL. As new APIs have
been added to the RTAS subsystem, their symbol exports have followed
the convention set by existing code.
However, the historical evidence is that RTAS function exports have been
added over time only to satisfy the needs of in-kernel users, and these
clients must have fairly intimate knowledge of how the APIs work to use
them safely. No out of tree users are known, and future ones seem
unlikely.
Arguably the default for RTAS symbols should have become
EXPORT_SYMBOL_GPL once it was available. Let's make it so now, and
exceptions can be evaluated as needed.
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Reviewed-by: Laurent Dufour <laurent.dufour@fr.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20230124140448.45938-3-nathanl@linux.ibm.com
Stable-dep-of: 836b5b9fcc8e ("powerpc/rtas: ensure 4KB alignment for rtas_data_buf")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/rtas.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index a4cd2484dbca2..4da9baa0fbe8c 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -68,10 +68,10 @@ struct rtas_t rtas = {
EXPORT_SYMBOL(rtas);
DEFINE_SPINLOCK(rtas_data_buf_lock);
-EXPORT_SYMBOL(rtas_data_buf_lock);
+EXPORT_SYMBOL_GPL(rtas_data_buf_lock);
char rtas_data_buf[RTAS_DATA_BUF_SIZE] __cacheline_aligned;
-EXPORT_SYMBOL(rtas_data_buf);
+EXPORT_SYMBOL_GPL(rtas_data_buf);
unsigned long rtas_rmo_buf;
@@ -80,7 +80,7 @@ unsigned long rtas_rmo_buf;
* This is done like this so rtas_flash can be a module.
*/
void (*rtas_flash_term_hook)(int);
-EXPORT_SYMBOL(rtas_flash_term_hook);
+EXPORT_SYMBOL_GPL(rtas_flash_term_hook);
/* RTAS use home made raw locking instead of spin_lock_irqsave
* because those can be called from within really nasty contexts
@@ -328,7 +328,7 @@ void rtas_progress(char *s, unsigned short hex)
spin_unlock(&progress_lock);
}
-EXPORT_SYMBOL(rtas_progress); /* needed by rtas_flash module */
+EXPORT_SYMBOL_GPL(rtas_progress); /* needed by rtas_flash module */
int rtas_token(const char *service)
{
@@ -338,7 +338,7 @@ int rtas_token(const char *service)
tokp = of_get_property(rtas.dev, service, NULL);
return tokp ? be32_to_cpu(*tokp) : RTAS_UNKNOWN_SERVICE;
}
-EXPORT_SYMBOL(rtas_token);
+EXPORT_SYMBOL_GPL(rtas_token);
int rtas_service_present(const char *service)
{
@@ -498,7 +498,7 @@ int rtas_call(int token, int nargs, int nret, int *outputs, ...)
}
return ret;
}
-EXPORT_SYMBOL(rtas_call);
+EXPORT_SYMBOL_GPL(rtas_call);
/* For RTAS_BUSY (-2), delay for 1 millisecond. For an extended busy status
* code of 990n, perform the hinted delay of 10^n (last digit) milliseconds.
@@ -533,7 +533,7 @@ unsigned int rtas_busy_delay(int status)
return ms;
}
-EXPORT_SYMBOL(rtas_busy_delay);
+EXPORT_SYMBOL_GPL(rtas_busy_delay);
static int rtas_error_rc(int rtas_rc)
{
@@ -579,7 +579,7 @@ int rtas_get_power_level(int powerdomain, int *level)
return rtas_error_rc(rc);
return rc;
}
-EXPORT_SYMBOL(rtas_get_power_level);
+EXPORT_SYMBOL_GPL(rtas_get_power_level);
int rtas_set_power_level(int powerdomain, int level, int *setlevel)
{
@@ -597,7 +597,7 @@ int rtas_set_power_level(int powerdomain, int level, int *setlevel)
return rtas_error_rc(rc);
return rc;
}
-EXPORT_SYMBOL(rtas_set_power_level);
+EXPORT_SYMBOL_GPL(rtas_set_power_level);
int rtas_get_sensor(int sensor, int index, int *state)
{
@@ -615,7 +615,7 @@ int rtas_get_sensor(int sensor, int index, int *state)
return rtas_error_rc(rc);
return rc;
}
-EXPORT_SYMBOL(rtas_get_sensor);
+EXPORT_SYMBOL_GPL(rtas_get_sensor);
int rtas_get_sensor_fast(int sensor, int index, int *state)
{
@@ -676,7 +676,7 @@ int rtas_set_indicator(int indicator, int index, int new_value)
return rtas_error_rc(rc);
return rc;
}
-EXPORT_SYMBOL(rtas_set_indicator);
+EXPORT_SYMBOL_GPL(rtas_set_indicator);
/*
* Ignoring RTAS extended delay
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 152/245] powerpc/rtas: ensure 4KB alignment for rtas_data_buf
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 151/245] powerpc/rtas: make all exports GPL Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 153/245] powerpc/eeh: Small refactor of eeh_handle_normal_event() Greg Kroah-Hartman
` (103 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Lynch, Michael Ellerman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <nathanl@linux.ibm.com>
[ Upstream commit 836b5b9fcc8e09cea7e8a59a070349a00e818308 ]
Some RTAS functions that have work area parameters impose alignment
requirements on the work area passed to them by the OS. Examples
include:
- ibm,configure-connector
- ibm,update-nodes
- ibm,update-properties
4KB is the greatest alignment required by PAPR for such
buffers. rtas_data_buf used to have a __page_aligned attribute in the
arch/ppc64 days, but that was changed to __cacheline_aligned for
unknown reasons by commit 033ef338b6e0 ("powerpc: Merge rtas.c into
arch/powerpc/kernel"). That works out to 128-byte alignment
on ppc64, which isn't right.
This was found by inspection and I'm not aware of any real problems
caused by this. Either current RTAS implementations don't enforce the
alignment constraints, or rtas_data_buf is always being placed at a
4KB boundary by accident (or both, perhaps).
Use __aligned(SZ_4K) to ensure the rtas_data_buf has alignment
appropriate for all users.
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Fixes: 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-6-26929c8cce78@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/rtas.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 4da9baa0fbe8c..d01a0ad57e38e 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -70,7 +70,7 @@ EXPORT_SYMBOL(rtas);
DEFINE_SPINLOCK(rtas_data_buf_lock);
EXPORT_SYMBOL_GPL(rtas_data_buf_lock);
-char rtas_data_buf[RTAS_DATA_BUF_SIZE] __cacheline_aligned;
+char rtas_data_buf[RTAS_DATA_BUF_SIZE] __aligned(SZ_4K);
EXPORT_SYMBOL_GPL(rtas_data_buf);
unsigned long rtas_rmo_buf;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 153/245] powerpc/eeh: Small refactor of eeh_handle_normal_event()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 152/245] powerpc/rtas: ensure 4KB alignment for rtas_data_buf Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 154/245] powerpc/eeh: Set channel state after notifying the drivers Greg Kroah-Hartman
` (102 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Axtens, Michael Ellerman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Axtens <dja@axtens.net>
[ Upstream commit 10b34ece132ee46dc4e6459c765d180c422a09fa ]
The control flow of eeh_handle_normal_event() is a bit tricky.
Break out one of the error handling paths - rather than be in an else
block, we'll make it part of the regular body of the function and put a
'goto out;' in the true limb of the if.
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211015070628.1331635-1-dja@axtens.net
Stable-dep-of: 9efcdaac36e1 ("powerpc/eeh: Set channel state after notifying the drivers")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/eeh_driver.c | 69 ++++++++++++++++----------------
1 file changed, 35 insertions(+), 34 deletions(-)
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index 3eff6a4888e79..cb3ac555c9446 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -1054,45 +1054,46 @@ void eeh_handle_normal_event(struct eeh_pe *pe)
}
pr_info("EEH: Recovery successful.\n");
- } else {
- /*
- * About 90% of all real-life EEH failures in the field
- * are due to poorly seated PCI cards. Only 10% or so are
- * due to actual, failed cards.
- */
- pr_err("EEH: Unable to recover from failure from PHB#%x-PE#%x.\n"
- "Please try reseating or replacing it\n",
- pe->phb->global_number, pe->addr);
+ goto out;
+ }
- eeh_slot_error_detail(pe, EEH_LOG_PERM);
+ /*
+ * About 90% of all real-life EEH failures in the field
+ * are due to poorly seated PCI cards. Only 10% or so are
+ * due to actual, failed cards.
+ */
+ pr_err("EEH: Unable to recover from failure from PHB#%x-PE#%x.\n"
+ "Please try reseating or replacing it\n",
+ pe->phb->global_number, pe->addr);
- /* Notify all devices that they're about to go down. */
- eeh_set_channel_state(pe, pci_channel_io_perm_failure);
- eeh_set_irq_state(pe, false);
- eeh_pe_report("error_detected(permanent failure)", pe,
- eeh_report_failure, NULL);
+ eeh_slot_error_detail(pe, EEH_LOG_PERM);
- /* Mark the PE to be removed permanently */
- eeh_pe_state_mark(pe, EEH_PE_REMOVED);
+ /* Notify all devices that they're about to go down. */
+ eeh_set_channel_state(pe, pci_channel_io_perm_failure);
+ eeh_set_irq_state(pe, false);
+ eeh_pe_report("error_detected(permanent failure)", pe,
+ eeh_report_failure, NULL);
- /*
- * Shut down the device drivers for good. We mark
- * all removed devices correctly to avoid access
- * the their PCI config any more.
- */
- if (pe->type & EEH_PE_VF) {
- eeh_pe_dev_traverse(pe, eeh_rmv_device, NULL);
- eeh_pe_dev_mode_mark(pe, EEH_DEV_REMOVED);
- } else {
- eeh_pe_state_clear(pe, EEH_PE_PRI_BUS, true);
- eeh_pe_dev_mode_mark(pe, EEH_DEV_REMOVED);
+ /* Mark the PE to be removed permanently */
+ eeh_pe_state_mark(pe, EEH_PE_REMOVED);
- pci_lock_rescan_remove();
- pci_hp_remove_devices(bus);
- pci_unlock_rescan_remove();
- /* The passed PE should no longer be used */
- return;
- }
+ /*
+ * Shut down the device drivers for good. We mark
+ * all removed devices correctly to avoid access
+ * the their PCI config any more.
+ */
+ if (pe->type & EEH_PE_VF) {
+ eeh_pe_dev_traverse(pe, eeh_rmv_device, NULL);
+ eeh_pe_dev_mode_mark(pe, EEH_DEV_REMOVED);
+ } else {
+ eeh_pe_state_clear(pe, EEH_PE_PRI_BUS, true);
+ eeh_pe_dev_mode_mark(pe, EEH_DEV_REMOVED);
+
+ pci_lock_rescan_remove();
+ pci_hp_remove_devices(bus);
+ pci_unlock_rescan_remove();
+ /* The passed PE should no longer be used */
+ return;
}
out:
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 154/245] powerpc/eeh: Set channel state after notifying the drivers
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 153/245] powerpc/eeh: Small refactor of eeh_handle_normal_event() Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 155/245] PM: core: Redefine pm_ptr() macro Greg Kroah-Hartman
` (101 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mahesh Salgaonkar, Ganesh Goudar,
Michael Ellerman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ganesh Goudar <ganeshgr@linux.ibm.com>
[ Upstream commit 9efcdaac36e1643a1b7f5337e6143ce142d381b1 ]
When a PCI error is encountered 6th time in an hour we
set the channel state to perm_failure and notify the
driver about the permanent failure.
However, after upstream commit 38ddc011478e ("powerpc/eeh:
Make permanently failed devices non-actionable"), EEH handler
stops calling any routine once the device is marked as
permanent failure. This issue can lead to fatal consequences
like kernel hang with certain PCI devices.
Following log is observed with lpfc driver, with and without
this change, Without this change kernel hangs, If PCI error
is encountered 6 times for a device in an hour.
Without the change
EEH: Beginning: 'error_detected(permanent failure)'
PCI 0132:60:00.0#600000: EEH: not actionable (1,1,1)
PCI 0132:60:00.1#600000: EEH: not actionable (1,1,1)
EEH: Finished:'error_detected(permanent failure)'
With the change
EEH: Beginning: 'error_detected(permanent failure)'
EEH: Invoking lpfc->error_detected(permanent failure)
EEH: lpfc driver reports: 'disconnect'
EEH: Invoking lpfc->error_detected(permanent failure)
EEH: lpfc driver reports: 'disconnect'
EEH: Finished:'error_detected(permanent failure)'
To fix the issue, set channel state to permanent failure after
notifying the drivers.
Fixes: 38ddc011478e ("powerpc/eeh: Make permanently failed devices non-actionable")
Suggested-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
Signed-off-by: Ganesh Goudar <ganeshgr@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20230209105649.127707-1-ganeshgr@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/eeh_driver.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index cb3ac555c9446..665d847ef9b5a 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -1069,10 +1069,10 @@ void eeh_handle_normal_event(struct eeh_pe *pe)
eeh_slot_error_detail(pe, EEH_LOG_PERM);
/* Notify all devices that they're about to go down. */
- eeh_set_channel_state(pe, pci_channel_io_perm_failure);
eeh_set_irq_state(pe, false);
eeh_pe_report("error_detected(permanent failure)", pe,
eeh_report_failure, NULL);
+ eeh_set_channel_state(pe, pci_channel_io_perm_failure);
/* Mark the PE to be removed permanently */
eeh_pe_state_mark(pe, EEH_PE_REMOVED);
@@ -1189,10 +1189,10 @@ void eeh_handle_special_event(void)
/* Notify all devices to be down */
eeh_pe_state_clear(pe, EEH_PE_PRI_BUS, true);
- eeh_set_channel_state(pe, pci_channel_io_perm_failure);
eeh_pe_report(
"error_detected(permanent failure)", pe,
eeh_report_failure, NULL);
+ eeh_set_channel_state(pe, pci_channel_io_perm_failure);
pci_lock_rescan_remove();
list_for_each_entry(hose, &hose_list, list_node) {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 155/245] PM: core: Redefine pm_ptr() macro
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 154/245] powerpc/eeh: Set channel state after notifying the drivers Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 156/245] PM: core: Add new *_PM_OPS macros, deprecate old ones Greg Kroah-Hartman
` (100 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Cercueil, Jonathan Cameron,
Arnd Bergmann, Rafael J. Wysocki, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <paul@crapouillou.net>
[ Upstream commit c06ef740d401d0f4ab188882bf6f8d9cf0f75eaf ]
The pm_ptr() macro was previously conditionally defined, according to
the value of the CONFIG_PM option. This meant that the pointed structure
was either referenced (if CONFIG_PM was set), or never referenced (if
CONFIG_PM was not set), causing it to be detected as unused by the
compiler.
This worked fine, but required the __maybe_unused compiler attribute to
be used to every symbol pointed to by a pointer wrapped with pm_ptr().
We can do better. With this change, the pm_ptr() is now defined the
same, independently of the value of CONFIG_PM. It now uses the (?:)
ternary operator to conditionally resolve to its argument. Since the
condition is known at compile time, the compiler will then choose to
discard the unused symbols, which won't need to be tagged with
__maybe_unused anymore.
This pm_ptr() macro is usually used with pointers to dev_pm_ops
structures created with SIMPLE_DEV_PM_OPS() or similar macros. These do
use a __maybe_unused flag, which is now useless with this change, so it
later can be removed. However in the meantime it causes no harm, and all
the drivers still compile fine with the new pm_ptr() macro.
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/pm.h | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/include/linux/pm.h b/include/linux/pm.h
index 1d8209c09686c..b88ac7dcf2a20 100644
--- a/include/linux/pm.h
+++ b/include/linux/pm.h
@@ -373,11 +373,7 @@ const struct dev_pm_ops __maybe_unused name = { \
SET_RUNTIME_PM_OPS(suspend_fn, resume_fn, idle_fn) \
}
-#ifdef CONFIG_PM
-#define pm_ptr(_ptr) (_ptr)
-#else
-#define pm_ptr(_ptr) NULL
-#endif
+#define pm_ptr(_ptr) PTR_IF(IS_ENABLED(CONFIG_PM), (_ptr))
/*
* PM_EVENT_ messages
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 156/245] PM: core: Add new *_PM_OPS macros, deprecate old ones
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 155/245] PM: core: Redefine pm_ptr() macro Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 157/245] mmc: jz4740: Use the new PM macros Greg Kroah-Hartman
` (99 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Cercueil, Jonathan Cameron,
Rafael J. Wysocki, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <paul@crapouillou.net>
[ Upstream commit 1a3c7bb088266fa2db017be299f91f1c1894c857 ]
This commit introduces the following macros:
SYSTEM_SLEEP_PM_OPS()
LATE_SYSTEM_SLEEP_PM_OPS()
NOIRQ_SYSTEM_SLEEP_PM_OPS()
RUNTIME_PM_OPS()
These new macros are very similar to their SET_*_PM_OPS() equivalent.
They however differ in the fact that the callbacks they set will always
be seen as referenced by the compiler. This means that the callback
functions don't need to be wrapped with a #ifdef CONFIG_PM guard, or
tagged with __maybe_unused, to prevent the compiler from complaining
about unused static symbols. The compiler will then simply evaluate at
compile time whether or not these symbols are dead code.
The callbacks that are only useful with CONFIG_PM_SLEEP is enabled, are
now also wrapped with a new pm_sleep_ptr() macro, which is inspired from
pm_ptr(). This is needed for drivers that use different callbacks for
sleep and runtime PM, to handle the case where CONFIG_PM is set and
CONFIG_PM_SLEEP is not.
This commit also deprecates the following macros:
SIMPLE_DEV_PM_OPS()
UNIVERSAL_DEV_PM_OPS()
And introduces the following macros:
DEFINE_SIMPLE_DEV_PM_OPS()
DEFINE_UNIVERSAL_DEV_PM_OPS()
These macros are similar to the functions they were created to replace,
with the following differences:
- They use the new macros introduced above, and as such always
reference the provided callback functions.
- They are not tagged with __maybe_unused. They are meant to be used
with pm_ptr() or pm_sleep_ptr() for DEFINE_UNIVERSAL_DEV_PM_OPS()
and DEFINE_SIMPLE_DEV_PM_OPS() respectively.
- They declare the symbol static, since every driver seems to do that
anyway; and if a non-static use-case is needed an indirection pointer
could be used.
The point of this change, is to progressively switch from a code model
where PM callbacks are all protected behind CONFIG_PM guards, to a code
model where the PM callbacks are always seen by the compiler, but
discarded if not used.
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/pm.h | 74 +++++++++++++++++++++++++++++++---------------
1 file changed, 50 insertions(+), 24 deletions(-)
diff --git a/include/linux/pm.h b/include/linux/pm.h
index b88ac7dcf2a20..fc9691cb01b4f 100644
--- a/include/linux/pm.h
+++ b/include/linux/pm.h
@@ -300,47 +300,59 @@ struct dev_pm_ops {
int (*runtime_idle)(struct device *dev);
};
+#define SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
+ .suspend = pm_sleep_ptr(suspend_fn), \
+ .resume = pm_sleep_ptr(resume_fn), \
+ .freeze = pm_sleep_ptr(suspend_fn), \
+ .thaw = pm_sleep_ptr(resume_fn), \
+ .poweroff = pm_sleep_ptr(suspend_fn), \
+ .restore = pm_sleep_ptr(resume_fn),
+
+#define LATE_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
+ .suspend_late = pm_sleep_ptr(suspend_fn), \
+ .resume_early = pm_sleep_ptr(resume_fn), \
+ .freeze_late = pm_sleep_ptr(suspend_fn), \
+ .thaw_early = pm_sleep_ptr(resume_fn), \
+ .poweroff_late = pm_sleep_ptr(suspend_fn), \
+ .restore_early = pm_sleep_ptr(resume_fn),
+
+#define NOIRQ_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
+ .suspend_noirq = pm_sleep_ptr(suspend_fn), \
+ .resume_noirq = pm_sleep_ptr(resume_fn), \
+ .freeze_noirq = pm_sleep_ptr(suspend_fn), \
+ .thaw_noirq = pm_sleep_ptr(resume_fn), \
+ .poweroff_noirq = pm_sleep_ptr(suspend_fn), \
+ .restore_noirq = pm_sleep_ptr(resume_fn),
+
+#define RUNTIME_PM_OPS(suspend_fn, resume_fn, idle_fn) \
+ .runtime_suspend = suspend_fn, \
+ .runtime_resume = resume_fn, \
+ .runtime_idle = idle_fn,
+
#ifdef CONFIG_PM_SLEEP
#define SET_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
- .suspend = suspend_fn, \
- .resume = resume_fn, \
- .freeze = suspend_fn, \
- .thaw = resume_fn, \
- .poweroff = suspend_fn, \
- .restore = resume_fn,
+ SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn)
#else
#define SET_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn)
#endif
#ifdef CONFIG_PM_SLEEP
#define SET_LATE_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
- .suspend_late = suspend_fn, \
- .resume_early = resume_fn, \
- .freeze_late = suspend_fn, \
- .thaw_early = resume_fn, \
- .poweroff_late = suspend_fn, \
- .restore_early = resume_fn,
+ LATE_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn)
#else
#define SET_LATE_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn)
#endif
#ifdef CONFIG_PM_SLEEP
#define SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
- .suspend_noirq = suspend_fn, \
- .resume_noirq = resume_fn, \
- .freeze_noirq = suspend_fn, \
- .thaw_noirq = resume_fn, \
- .poweroff_noirq = suspend_fn, \
- .restore_noirq = resume_fn,
+ NOIRQ_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn)
#else
#define SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn)
#endif
#ifdef CONFIG_PM
#define SET_RUNTIME_PM_OPS(suspend_fn, resume_fn, idle_fn) \
- .runtime_suspend = suspend_fn, \
- .runtime_resume = resume_fn, \
- .runtime_idle = idle_fn,
+ RUNTIME_PM_OPS(suspend_fn, resume_fn, idle_fn)
#else
#define SET_RUNTIME_PM_OPS(suspend_fn, resume_fn, idle_fn)
#endif
@@ -349,9 +361,9 @@ struct dev_pm_ops {
* Use this if you want to use the same suspend and resume callbacks for suspend
* to RAM and hibernation.
*/
-#define SIMPLE_DEV_PM_OPS(name, suspend_fn, resume_fn) \
-const struct dev_pm_ops __maybe_unused name = { \
- SET_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
+#define DEFINE_SIMPLE_DEV_PM_OPS(name, suspend_fn, resume_fn) \
+static const struct dev_pm_ops name = { \
+ SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
}
/*
@@ -367,6 +379,19 @@ const struct dev_pm_ops __maybe_unused name = { \
* .resume_early(), to the same routines as .runtime_suspend() and
* .runtime_resume(), respectively (and analogously for hibernation).
*/
+#define DEFINE_UNIVERSAL_DEV_PM_OPS(name, suspend_fn, resume_fn, idle_fn) \
+static const struct dev_pm_ops name = { \
+ SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
+ RUNTIME_PM_OPS(suspend_fn, resume_fn, idle_fn) \
+}
+
+/* Deprecated. Use DEFINE_SIMPLE_DEV_PM_OPS() instead. */
+#define SIMPLE_DEV_PM_OPS(name, suspend_fn, resume_fn) \
+const struct dev_pm_ops __maybe_unused name = { \
+ SET_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
+}
+
+/* Deprecated. Use DEFINE_UNIVERSAL_DEV_PM_OPS() instead. */
#define UNIVERSAL_DEV_PM_OPS(name, suspend_fn, resume_fn, idle_fn) \
const struct dev_pm_ops __maybe_unused name = { \
SET_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
@@ -374,6 +399,7 @@ const struct dev_pm_ops __maybe_unused name = { \
}
#define pm_ptr(_ptr) PTR_IF(IS_ENABLED(CONFIG_PM), (_ptr))
+#define pm_sleep_ptr(_ptr) PTR_IF(IS_ENABLED(CONFIG_PM_SLEEP), (_ptr))
/*
* PM_EVENT_ messages
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 157/245] mmc: jz4740: Use the new PM macros
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 156/245] PM: core: Add new *_PM_OPS macros, deprecate old ones Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 158/245] mmc: mxc: " Greg Kroah-Hartman
` (98 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Cercueil, Ulf Hansson,
Rafael J. Wysocki, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <paul@crapouillou.net>
[ Upstream commit e0d64ecc621715e9c7807e952b68475c62bbf630 ]
- Use DEFINE_SIMPLE_DEV_PM_OPS() instead of the SIMPLE_DEV_PM_OPS()
macro. This makes it possible to remove the __maybe_unused flags
on the callback functions.
- Since we only have callbacks for suspend/resume, we can conditionally
compile the dev_pm_ops structure for when CONFIG_PM_SLEEP is enabled;
so use the pm_sleep_ptr() macro instead of pm_ptr().
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/jz4740_mmc.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/mmc/host/jz4740_mmc.c b/drivers/mmc/host/jz4740_mmc.c
index 8586447d4b4f2..ef3fe837b49d2 100644
--- a/drivers/mmc/host/jz4740_mmc.c
+++ b/drivers/mmc/host/jz4740_mmc.c
@@ -1133,17 +1133,17 @@ static int jz4740_mmc_remove(struct platform_device *pdev)
return 0;
}
-static int __maybe_unused jz4740_mmc_suspend(struct device *dev)
+static int jz4740_mmc_suspend(struct device *dev)
{
return pinctrl_pm_select_sleep_state(dev);
}
-static int __maybe_unused jz4740_mmc_resume(struct device *dev)
+static int jz4740_mmc_resume(struct device *dev)
{
return pinctrl_select_default_state(dev);
}
-static SIMPLE_DEV_PM_OPS(jz4740_mmc_pm_ops, jz4740_mmc_suspend,
+DEFINE_SIMPLE_DEV_PM_OPS(jz4740_mmc_pm_ops, jz4740_mmc_suspend,
jz4740_mmc_resume);
static struct platform_driver jz4740_mmc_driver = {
@@ -1153,7 +1153,7 @@ static struct platform_driver jz4740_mmc_driver = {
.name = "jz4740-mmc",
.probe_type = PROBE_PREFER_ASYNCHRONOUS,
.of_match_table = of_match_ptr(jz4740_mmc_of_match),
- .pm = pm_ptr(&jz4740_mmc_pm_ops),
+ .pm = pm_sleep_ptr(&jz4740_mmc_pm_ops),
},
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 158/245] mmc: mxc: Use the new PM macros
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 157/245] mmc: jz4740: Use the new PM macros Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 159/245] PM: core: Remove static qualifier in DEFINE_SIMPLE_DEV_PM_OPS macro Greg Kroah-Hartman
` (97 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Cercueil, Ulf Hansson,
Rafael J. Wysocki, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <paul@crapouillou.net>
[ Upstream commit 2cdbd92c2d1dff07ad56c39f5857ee644bbd2c8a ]
Use DEFINE_SIMPLE_DEV_PM_OPS() instead of the SIMPLE_DEV_PM_OPS()
macro, along with using pm_sleep_ptr() as this driver doesn't handle
runtime PM.
This makes it possible to remove the #ifdef CONFIG_PM guard around
the suspend/resume functions.
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/mxcmmc.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
index 97227ad717150..b5f65f39ced1c 100644
--- a/drivers/mmc/host/mxcmmc.c
+++ b/drivers/mmc/host/mxcmmc.c
@@ -1185,7 +1185,6 @@ static int mxcmci_remove(struct platform_device *pdev)
return 0;
}
-#ifdef CONFIG_PM_SLEEP
static int mxcmci_suspend(struct device *dev)
{
struct mmc_host *mmc = dev_get_drvdata(dev);
@@ -1212,9 +1211,8 @@ static int mxcmci_resume(struct device *dev)
return ret;
}
-#endif
-static SIMPLE_DEV_PM_OPS(mxcmci_pm_ops, mxcmci_suspend, mxcmci_resume);
+DEFINE_SIMPLE_DEV_PM_OPS(mxcmci_pm_ops, mxcmci_suspend, mxcmci_resume);
static struct platform_driver mxcmci_driver = {
.probe = mxcmci_probe,
@@ -1222,7 +1220,7 @@ static struct platform_driver mxcmci_driver = {
.driver = {
.name = DRIVER_NAME,
.probe_type = PROBE_PREFER_ASYNCHRONOUS,
- .pm = &mxcmci_pm_ops,
+ .pm = pm_sleep_ptr(&mxcmci_pm_ops),
.of_match_table = mxcmci_of_match,
}
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 159/245] PM: core: Remove static qualifier in DEFINE_SIMPLE_DEV_PM_OPS macro
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 158/245] mmc: mxc: " Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 160/245] Input: iqs269a - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Greg Kroah-Hartman
` (96 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Cercueil, Jonathan Cameron,
Ulf Hansson, Rafael J. Wysocki, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <paul@crapouillou.net>
[ Upstream commit 52cc1d7f9786d2be44a3ab9b5b48416a7618e713 ]
Keep this macro in line with the other ones. This makes it possible to
use them in the cases where the underlying dev_pm_ops structure is
exported.
Restore the "static" qualifier in the two drivers where the
DEFINE_SIMPLE_DEV_PM_OPS macro was used.
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/jz4740_mmc.c | 4 ++--
drivers/mmc/host/mxcmmc.c | 2 +-
include/linux/pm.h | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/mmc/host/jz4740_mmc.c b/drivers/mmc/host/jz4740_mmc.c
index ef3fe837b49d2..2254db44fb02c 100644
--- a/drivers/mmc/host/jz4740_mmc.c
+++ b/drivers/mmc/host/jz4740_mmc.c
@@ -1143,8 +1143,8 @@ static int jz4740_mmc_resume(struct device *dev)
return pinctrl_select_default_state(dev);
}
-DEFINE_SIMPLE_DEV_PM_OPS(jz4740_mmc_pm_ops, jz4740_mmc_suspend,
- jz4740_mmc_resume);
+static DEFINE_SIMPLE_DEV_PM_OPS(jz4740_mmc_pm_ops, jz4740_mmc_suspend,
+ jz4740_mmc_resume);
static struct platform_driver jz4740_mmc_driver = {
.probe = jz4740_mmc_probe,
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
index b5f65f39ced1c..2e39b2cb1cafa 100644
--- a/drivers/mmc/host/mxcmmc.c
+++ b/drivers/mmc/host/mxcmmc.c
@@ -1212,7 +1212,7 @@ static int mxcmci_resume(struct device *dev)
return ret;
}
-DEFINE_SIMPLE_DEV_PM_OPS(mxcmci_pm_ops, mxcmci_suspend, mxcmci_resume);
+static DEFINE_SIMPLE_DEV_PM_OPS(mxcmci_pm_ops, mxcmci_suspend, mxcmci_resume);
static struct platform_driver mxcmci_driver = {
.probe = mxcmci_probe,
diff --git a/include/linux/pm.h b/include/linux/pm.h
index fc9691cb01b4f..d1c19f5b1380f 100644
--- a/include/linux/pm.h
+++ b/include/linux/pm.h
@@ -362,7 +362,7 @@ struct dev_pm_ops {
* to RAM and hibernation.
*/
#define DEFINE_SIMPLE_DEV_PM_OPS(name, suspend_fn, resume_fn) \
-static const struct dev_pm_ops name = { \
+const struct dev_pm_ops name = { \
SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 160/245] Input: iqs269a - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 159/245] PM: core: Remove static qualifier in DEFINE_SIMPLE_DEV_PM_OPS macro Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 161/245] Input: iqs269a - do not poll during suspend or resume Greg Kroah-Hartman
` (95 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Cameron, Jeff LaBundy,
Linus Walleij, Dmitry Torokhov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[ Upstream commit 29eac950768a48651e2389f7d3f2ad597f6e58d1 ]
SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection
against unused function warnings. The new combination of pm_sleep_ptr()
and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions,
thus suppressing the warning, but still allowing the unused code to be
removed. Thus also drop the __maybe_unused markings.
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: Jeff LaBundy <jeff@labundy.com>
Reviewed-by: Jeff LaBundy <jeff@labundy.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20230102181842.718010-9-jic23@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/iqs269a.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/input/misc/iqs269a.c b/drivers/input/misc/iqs269a.c
index 1530efd301c24..07eda05d783ef 100644
--- a/drivers/input/misc/iqs269a.c
+++ b/drivers/input/misc/iqs269a.c
@@ -1687,7 +1687,7 @@ static int iqs269_probe(struct i2c_client *client)
return error;
}
-static int __maybe_unused iqs269_suspend(struct device *dev)
+static int iqs269_suspend(struct device *dev)
{
struct iqs269_private *iqs269 = dev_get_drvdata(dev);
struct i2c_client *client = iqs269->client;
@@ -1746,7 +1746,7 @@ static int __maybe_unused iqs269_suspend(struct device *dev)
return error;
}
-static int __maybe_unused iqs269_resume(struct device *dev)
+static int iqs269_resume(struct device *dev)
{
struct iqs269_private *iqs269 = dev_get_drvdata(dev);
struct i2c_client *client = iqs269->client;
@@ -1793,7 +1793,7 @@ static int __maybe_unused iqs269_resume(struct device *dev)
return error;
}
-static SIMPLE_DEV_PM_OPS(iqs269_pm, iqs269_suspend, iqs269_resume);
+static DEFINE_SIMPLE_DEV_PM_OPS(iqs269_pm, iqs269_suspend, iqs269_resume);
static const struct of_device_id iqs269_of_match[] = {
{ .compatible = "azoteq,iqs269a" },
@@ -1805,7 +1805,7 @@ static struct i2c_driver iqs269_i2c_driver = {
.driver = {
.name = "iqs269a",
.of_match_table = iqs269_of_match,
- .pm = &iqs269_pm,
+ .pm = pm_sleep_ptr(&iqs269_pm),
},
.probe_new = iqs269_probe,
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 161/245] Input: iqs269a - do not poll during suspend or resume
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 160/245] Input: iqs269a - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 162/245] Input: iqs269a - do not poll during ATI Greg Kroah-Hartman
` (94 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff LaBundy, Mattijs Korpershoek,
Dmitry Torokhov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff LaBundy <jeff@labundy.com>
[ Upstream commit 18ab69c8ca5678324efbeed874b707ce7b2feae1 ]
Polling the device while it transitions from automatic to manual
power mode switching may keep the device from actually finishing
the transition. The process appears to time out depending on the
polling rate and the device's core clock frequency.
This is ultimately unnecessary in the first place; instead it is
sufficient to write the desired mode during initialization, then
disable automatic switching at suspend. This eliminates the need
to ensure the device is prepared for a manual change and removes
the 'suspend_mode' variable.
Similarly, polling the device while it transitions from one mode
to another under manual control may time out as well. This added
step does not appear to be necessary either, so drop it.
Fixes: 04e49867fad1 ("Input: add support for Azoteq IQS269A")
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
Link: https://lore.kernel.org/r/Y7Rs+eEXlRw4Vq57@nixie71
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/iqs269a.c | 118 +++++++++--------------------------
1 file changed, 31 insertions(+), 87 deletions(-)
diff --git a/drivers/input/misc/iqs269a.c b/drivers/input/misc/iqs269a.c
index 07eda05d783ef..ff6cbc2f5d76c 100644
--- a/drivers/input/misc/iqs269a.c
+++ b/drivers/input/misc/iqs269a.c
@@ -148,9 +148,6 @@
#define IQS269_ATI_POLL_TIMEOUT_US (iqs269->delay_mult * 500000)
#define IQS269_ATI_STABLE_DELAY_MS (iqs269->delay_mult * 150)
-#define IQS269_PWR_MODE_POLL_SLEEP_US IQS269_ATI_POLL_SLEEP_US
-#define IQS269_PWR_MODE_POLL_TIMEOUT_US IQS269_ATI_POLL_TIMEOUT_US
-
#define iqs269_irq_wait() usleep_range(200, 250)
enum iqs269_local_cap_size {
@@ -295,7 +292,6 @@ struct iqs269_private {
struct input_dev *keypad;
struct input_dev *slider[IQS269_NUM_SL];
unsigned int keycode[ARRAY_SIZE(iqs269_events) * IQS269_NUM_CH];
- unsigned int suspend_mode;
unsigned int delay_mult;
unsigned int ch_num;
bool hall_enable;
@@ -767,17 +763,6 @@ static int iqs269_parse_prop(struct iqs269_private *iqs269)
iqs269->hall_enable = device_property_present(&client->dev,
"azoteq,hall-enable");
- if (!device_property_read_u32(&client->dev, "azoteq,suspend-mode",
- &val)) {
- if (val > IQS269_SYS_SETTINGS_PWR_MODE_MAX) {
- dev_err(&client->dev, "Invalid suspend mode: %u\n",
- val);
- return -EINVAL;
- }
-
- iqs269->suspend_mode = val;
- }
-
error = regmap_raw_read(iqs269->regmap, IQS269_SYS_SETTINGS, sys_reg,
sizeof(*sys_reg));
if (error)
@@ -1005,6 +990,17 @@ static int iqs269_parse_prop(struct iqs269_private *iqs269)
general &= ~IQS269_SYS_SETTINGS_DIS_AUTO;
general &= ~IQS269_SYS_SETTINGS_PWR_MODE_MASK;
+ if (!device_property_read_u32(&client->dev, "azoteq,suspend-mode",
+ &val)) {
+ if (val > IQS269_SYS_SETTINGS_PWR_MODE_MAX) {
+ dev_err(&client->dev, "Invalid suspend mode: %u\n",
+ val);
+ return -EINVAL;
+ }
+
+ general |= (val << IQS269_SYS_SETTINGS_PWR_MODE_SHIFT);
+ }
+
if (!device_property_read_u32(&client->dev, "azoteq,ulp-update",
&val)) {
if (val > IQS269_SYS_SETTINGS_ULP_UPDATE_MAX) {
@@ -1687,59 +1683,30 @@ static int iqs269_probe(struct i2c_client *client)
return error;
}
+static u16 iqs269_general_get(struct iqs269_private *iqs269)
+{
+ u16 general = be16_to_cpu(iqs269->sys_reg.general);
+
+ general &= ~IQS269_SYS_SETTINGS_REDO_ATI;
+ general &= ~IQS269_SYS_SETTINGS_ACK_RESET;
+
+ return general | IQS269_SYS_SETTINGS_DIS_AUTO;
+}
+
static int iqs269_suspend(struct device *dev)
{
struct iqs269_private *iqs269 = dev_get_drvdata(dev);
struct i2c_client *client = iqs269->client;
- unsigned int val;
int error;
+ u16 general = iqs269_general_get(iqs269);
- if (!iqs269->suspend_mode)
+ if (!(general & IQS269_SYS_SETTINGS_PWR_MODE_MASK))
return 0;
disable_irq(client->irq);
- /*
- * Automatic power mode switching must be disabled before the device is
- * forced into any particular power mode. In this case, the device will
- * transition into normal-power mode.
- */
- error = regmap_update_bits(iqs269->regmap, IQS269_SYS_SETTINGS,
- IQS269_SYS_SETTINGS_DIS_AUTO, ~0);
- if (error)
- goto err_irq;
-
- /*
- * The following check ensures the device has completed its transition
- * into normal-power mode before a manual mode switch is performed.
- */
- error = regmap_read_poll_timeout(iqs269->regmap, IQS269_SYS_FLAGS, val,
- !(val & IQS269_SYS_FLAGS_PWR_MODE_MASK),
- IQS269_PWR_MODE_POLL_SLEEP_US,
- IQS269_PWR_MODE_POLL_TIMEOUT_US);
- if (error)
- goto err_irq;
-
- error = regmap_update_bits(iqs269->regmap, IQS269_SYS_SETTINGS,
- IQS269_SYS_SETTINGS_PWR_MODE_MASK,
- iqs269->suspend_mode <<
- IQS269_SYS_SETTINGS_PWR_MODE_SHIFT);
- if (error)
- goto err_irq;
-
- /*
- * This last check ensures the device has completed its transition into
- * the desired power mode to prevent any spurious interrupts from being
- * triggered after iqs269_suspend has already returned.
- */
- error = regmap_read_poll_timeout(iqs269->regmap, IQS269_SYS_FLAGS, val,
- (val & IQS269_SYS_FLAGS_PWR_MODE_MASK)
- == (iqs269->suspend_mode <<
- IQS269_SYS_FLAGS_PWR_MODE_SHIFT),
- IQS269_PWR_MODE_POLL_SLEEP_US,
- IQS269_PWR_MODE_POLL_TIMEOUT_US);
+ error = regmap_write(iqs269->regmap, IQS269_SYS_SETTINGS, general);
-err_irq:
iqs269_irq_wait();
enable_irq(client->irq);
@@ -1750,43 +1717,20 @@ static int iqs269_resume(struct device *dev)
{
struct iqs269_private *iqs269 = dev_get_drvdata(dev);
struct i2c_client *client = iqs269->client;
- unsigned int val;
int error;
+ u16 general = iqs269_general_get(iqs269);
- if (!iqs269->suspend_mode)
+ if (!(general & IQS269_SYS_SETTINGS_PWR_MODE_MASK))
return 0;
disable_irq(client->irq);
- error = regmap_update_bits(iqs269->regmap, IQS269_SYS_SETTINGS,
- IQS269_SYS_SETTINGS_PWR_MODE_MASK, 0);
- if (error)
- goto err_irq;
-
- /*
- * This check ensures the device has returned to normal-power mode
- * before automatic power mode switching is re-enabled.
- */
- error = regmap_read_poll_timeout(iqs269->regmap, IQS269_SYS_FLAGS, val,
- !(val & IQS269_SYS_FLAGS_PWR_MODE_MASK),
- IQS269_PWR_MODE_POLL_SLEEP_US,
- IQS269_PWR_MODE_POLL_TIMEOUT_US);
- if (error)
- goto err_irq;
-
- error = regmap_update_bits(iqs269->regmap, IQS269_SYS_SETTINGS,
- IQS269_SYS_SETTINGS_DIS_AUTO, 0);
- if (error)
- goto err_irq;
-
- /*
- * This step reports any events that may have been "swallowed" as a
- * result of polling PWR_MODE (which automatically acknowledges any
- * pending interrupts).
- */
- error = iqs269_report(iqs269);
+ error = regmap_write(iqs269->regmap, IQS269_SYS_SETTINGS,
+ general & ~IQS269_SYS_SETTINGS_PWR_MODE_MASK);
+ if (!error)
+ error = regmap_write(iqs269->regmap, IQS269_SYS_SETTINGS,
+ general & ~IQS269_SYS_SETTINGS_DIS_AUTO);
-err_irq:
iqs269_irq_wait();
enable_irq(client->irq);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 162/245] Input: iqs269a - do not poll during ATI
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 161/245] Input: iqs269a - do not poll during suspend or resume Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 163/245] net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs Greg Kroah-Hartman
` (93 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff LaBundy, Mattijs Korpershoek,
Dmitry Torokhov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff LaBundy <jeff@labundy.com>
[ Upstream commit b08134eb254db56e9ce8170d9b82f0d7a616b6f8 ]
After initial start-up, the driver triggers ATI (calibration) with
the newly loaded register configuration in place. Next, the driver
polls a register field to ensure ATI completed in a timely fashion
and that the device is ready to sense.
However, communicating with the device over I2C while ATI is under-
way may induce noise in the device and cause ATI to fail. As such,
the vendor recommends not to poll the device during ATI.
To solve this problem, let the device naturally signal to the host
that ATI is complete by way of an interrupt. A completion prevents
the device from successfully probing until this happens.
As an added benefit, initial switch states are now reported in the
interrupt handler at the same time ATI status is checked. As such,
duplicate code that reports initial switch states has been removed
from iqs269_input_init().
The former logic that scaled ATI timeout and filter settling delay
is not carried forward with the new implementation, as it produces
overly conservative delays at the lower clock rate.
Rather, a single timeout that covers both clock rates is used. The
filter settling delay does not happen to be necessary and has been
removed as well.
Fixes: 04e49867fad1 ("Input: add support for Azoteq IQS269A")
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
Link: https://lore.kernel.org/r/Y7RtB2T7AF9rYMjK@nixie71
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/iqs269a.c | 97 +++++++++++++++++-------------------
1 file changed, 46 insertions(+), 51 deletions(-)
diff --git a/drivers/input/misc/iqs269a.c b/drivers/input/misc/iqs269a.c
index ff6cbc2f5d76c..f4c3aff3895bc 100644
--- a/drivers/input/misc/iqs269a.c
+++ b/drivers/input/misc/iqs269a.c
@@ -9,6 +9,7 @@
* axial sliders presented by the device.
*/
+#include <linux/completion.h>
#include <linux/delay.h>
#include <linux/device.h>
#include <linux/err.h>
@@ -144,10 +145,6 @@
#define IQS269_NUM_CH 8
#define IQS269_NUM_SL 2
-#define IQS269_ATI_POLL_SLEEP_US (iqs269->delay_mult * 10000)
-#define IQS269_ATI_POLL_TIMEOUT_US (iqs269->delay_mult * 500000)
-#define IQS269_ATI_STABLE_DELAY_MS (iqs269->delay_mult * 150)
-
#define iqs269_irq_wait() usleep_range(200, 250)
enum iqs269_local_cap_size {
@@ -289,10 +286,10 @@ struct iqs269_private {
struct mutex lock;
struct iqs269_switch_desc switches[ARRAY_SIZE(iqs269_events)];
struct iqs269_sys_reg sys_reg;
+ struct completion ati_done;
struct input_dev *keypad;
struct input_dev *slider[IQS269_NUM_SL];
unsigned int keycode[ARRAY_SIZE(iqs269_events) * IQS269_NUM_CH];
- unsigned int delay_mult;
unsigned int ch_num;
bool hall_enable;
bool ati_current;
@@ -973,13 +970,8 @@ static int iqs269_parse_prop(struct iqs269_private *iqs269)
general = be16_to_cpu(sys_reg->general);
- if (device_property_present(&client->dev, "azoteq,clk-div")) {
+ if (device_property_present(&client->dev, "azoteq,clk-div"))
general |= IQS269_SYS_SETTINGS_CLK_DIV;
- iqs269->delay_mult = 4;
- } else {
- general &= ~IQS269_SYS_SETTINGS_CLK_DIV;
- iqs269->delay_mult = 1;
- }
/*
* Configure the device to automatically switch between normal and low-
@@ -1036,7 +1028,6 @@ static int iqs269_parse_prop(struct iqs269_private *iqs269)
static int iqs269_dev_init(struct iqs269_private *iqs269)
{
- unsigned int val;
int error;
mutex_lock(&iqs269->lock);
@@ -1052,14 +1043,12 @@ static int iqs269_dev_init(struct iqs269_private *iqs269)
if (error)
goto err_mutex;
- error = regmap_read_poll_timeout(iqs269->regmap, IQS269_SYS_FLAGS, val,
- !(val & IQS269_SYS_FLAGS_IN_ATI),
- IQS269_ATI_POLL_SLEEP_US,
- IQS269_ATI_POLL_TIMEOUT_US);
- if (error)
- goto err_mutex;
+ /*
+ * The following delay gives the device time to deassert its RDY output
+ * so as to prevent an interrupt from being serviced prematurely.
+ */
+ usleep_range(2000, 2100);
- msleep(IQS269_ATI_STABLE_DELAY_MS);
iqs269->ati_current = true;
err_mutex:
@@ -1071,10 +1060,8 @@ static int iqs269_dev_init(struct iqs269_private *iqs269)
static int iqs269_input_init(struct iqs269_private *iqs269)
{
struct i2c_client *client = iqs269->client;
- struct iqs269_flags flags;
unsigned int sw_code, keycode;
int error, i, j;
- u8 dir_mask, state;
iqs269->keypad = devm_input_allocate_device(&client->dev);
if (!iqs269->keypad)
@@ -1087,23 +1074,7 @@ static int iqs269_input_init(struct iqs269_private *iqs269)
iqs269->keypad->name = "iqs269a_keypad";
iqs269->keypad->id.bustype = BUS_I2C;
- if (iqs269->hall_enable) {
- error = regmap_raw_read(iqs269->regmap, IQS269_SYS_FLAGS,
- &flags, sizeof(flags));
- if (error) {
- dev_err(&client->dev,
- "Failed to read initial status: %d\n", error);
- return error;
- }
- }
-
for (i = 0; i < ARRAY_SIZE(iqs269_events); i++) {
- dir_mask = flags.states[IQS269_ST_OFFS_DIR];
- if (!iqs269_events[i].dir_up)
- dir_mask = ~dir_mask;
-
- state = flags.states[iqs269_events[i].st_offs] & dir_mask;
-
sw_code = iqs269->switches[i].code;
for (j = 0; j < IQS269_NUM_CH; j++) {
@@ -1116,13 +1087,9 @@ static int iqs269_input_init(struct iqs269_private *iqs269)
switch (j) {
case IQS269_CHx_HALL_ACTIVE:
if (iqs269->hall_enable &&
- iqs269->switches[i].enabled) {
+ iqs269->switches[i].enabled)
input_set_capability(iqs269->keypad,
EV_SW, sw_code);
- input_report_switch(iqs269->keypad,
- sw_code,
- state & BIT(j));
- }
fallthrough;
case IQS269_CHx_HALL_INACTIVE:
@@ -1138,14 +1105,6 @@ static int iqs269_input_init(struct iqs269_private *iqs269)
}
}
- input_sync(iqs269->keypad);
-
- error = input_register_device(iqs269->keypad);
- if (error) {
- dev_err(&client->dev, "Failed to register keypad: %d\n", error);
- return error;
- }
-
for (i = 0; i < IQS269_NUM_SL; i++) {
if (!iqs269->sys_reg.slider_select[i])
continue;
@@ -1205,6 +1164,9 @@ static int iqs269_report(struct iqs269_private *iqs269)
return error;
}
+ if (be16_to_cpu(flags.system) & IQS269_SYS_FLAGS_IN_ATI)
+ return 0;
+
error = regmap_raw_read(iqs269->regmap, IQS269_SLIDER_X, slider_x,
sizeof(slider_x));
if (error) {
@@ -1267,6 +1229,12 @@ static int iqs269_report(struct iqs269_private *iqs269)
input_sync(iqs269->keypad);
+ /*
+ * The following completion signals that ATI has finished, any initial
+ * switch states have been reported and the keypad can be registered.
+ */
+ complete_all(&iqs269->ati_done);
+
return 0;
}
@@ -1298,6 +1266,9 @@ static ssize_t counts_show(struct device *dev,
if (!iqs269->ati_current || iqs269->hall_enable)
return -EPERM;
+ if (!completion_done(&iqs269->ati_done))
+ return -EBUSY;
+
/*
* Unsolicited I2C communication prompts the device to assert its RDY
* pin, so disable the interrupt line until the operation is finished
@@ -1554,7 +1525,9 @@ static ssize_t ati_trigger_show(struct device *dev,
{
struct iqs269_private *iqs269 = dev_get_drvdata(dev);
- return scnprintf(buf, PAGE_SIZE, "%u\n", iqs269->ati_current);
+ return scnprintf(buf, PAGE_SIZE, "%u\n",
+ iqs269->ati_current &&
+ completion_done(&iqs269->ati_done));
}
static ssize_t ati_trigger_store(struct device *dev,
@@ -1574,6 +1547,7 @@ static ssize_t ati_trigger_store(struct device *dev,
return count;
disable_irq(client->irq);
+ reinit_completion(&iqs269->ati_done);
error = iqs269_dev_init(iqs269);
@@ -1583,6 +1557,10 @@ static ssize_t ati_trigger_store(struct device *dev,
if (error)
return error;
+ if (!wait_for_completion_timeout(&iqs269->ati_done,
+ msecs_to_jiffies(2000)))
+ return -ETIMEDOUT;
+
return count;
}
@@ -1641,6 +1619,7 @@ static int iqs269_probe(struct i2c_client *client)
}
mutex_init(&iqs269->lock);
+ init_completion(&iqs269->ati_done);
error = regmap_raw_read(iqs269->regmap, IQS269_VER_INFO, &ver_info,
sizeof(ver_info));
@@ -1676,6 +1655,22 @@ static int iqs269_probe(struct i2c_client *client)
return error;
}
+ if (!wait_for_completion_timeout(&iqs269->ati_done,
+ msecs_to_jiffies(2000))) {
+ dev_err(&client->dev, "Failed to complete ATI\n");
+ return -ETIMEDOUT;
+ }
+
+ /*
+ * The keypad may include one or more switches and is not registered
+ * until ATI is complete and the initial switch states are read.
+ */
+ error = input_register_device(iqs269->keypad);
+ if (error) {
+ dev_err(&client->dev, "Failed to register keypad: %d\n", error);
+ return error;
+ }
+
error = devm_device_add_group(&client->dev, &iqs269_attr_group);
if (error)
dev_err(&client->dev, "Failed to add attributes: %d\n", error);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 163/245] net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 162/245] Input: iqs269a - do not poll during ATI Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 164/245] netfilter: nf_tables: add rescheduling points during loop detection walks Greg Kroah-Hartman
` (92 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pedro Tammela, Jamal Hadi Salim,
Vlad Buslov, Peilin Ye, Paolo Abeni, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peilin Ye <peilin.ye@bytedance.com>
[ Upstream commit 2d5f6a8d7aef7852a9ecc555f88c673a1c91754f ]
Grafting ingress and clsact Qdiscs does not need a for-loop in
qdisc_graft(). Refactor it. No functional changes intended.
Tested-by: Pedro Tammela <pctammela@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: Peilin Ye <peilin.ye@bytedance.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_api.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index fa79dbd3601fa..7fdc2c1f87561 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1044,12 +1044,12 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
if (parent == NULL) {
unsigned int i, num_q, ingress;
+ struct netdev_queue *dev_queue;
ingress = 0;
num_q = dev->num_tx_queues;
if ((q && q->flags & TCQ_F_INGRESS) ||
(new && new->flags & TCQ_F_INGRESS)) {
- num_q = 1;
ingress = 1;
if (!dev_ingress_queue(dev)) {
NL_SET_ERR_MSG(extack, "Device does not have an ingress queue");
@@ -1065,18 +1065,18 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
if (new && new->ops->attach && !ingress)
goto skip;
- for (i = 0; i < num_q; i++) {
- struct netdev_queue *dev_queue = dev_ingress_queue(dev);
-
- if (!ingress)
+ if (!ingress) {
+ for (i = 0; i < num_q; i++) {
dev_queue = netdev_get_tx_queue(dev, i);
+ old = dev_graft_qdisc(dev_queue, new);
- old = dev_graft_qdisc(dev_queue, new);
- if (new && i > 0)
- qdisc_refcount_inc(new);
-
- if (!ingress)
+ if (new && i > 0)
+ qdisc_refcount_inc(new);
qdisc_put(old);
+ }
+ } else {
+ dev_queue = dev_ingress_queue(dev);
+ old = dev_graft_qdisc(dev_queue, new);
}
skip:
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 164/245] netfilter: nf_tables: add rescheduling points during loop detection walks
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 163/245] net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 165/245] debugobjects: Recheck debug_objects_enabled before reporting Greg Kroah-Hartman
` (91 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 81ea010667417ef3f218dfd99b69769fe66c2b67 ]
Add explicit rescheduling points during ruleset walk.
Switching to a faster algorithm is possible but this is a much
smaller change, suitable for nf tree.
Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1460
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 3ad2b22886ff0..361fbbd430ad8 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3442,6 +3442,8 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
if (err < 0)
return err;
}
+
+ cond_resched();
}
return 0;
@@ -10041,9 +10043,13 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
break;
}
}
+
+ cond_resched();
}
list_for_each_entry(set, &ctx->table->sets, list) {
+ cond_resched();
+
if (!nft_is_active_next(ctx->net, set))
continue;
if (!(set->flags & NFT_SET_MAP) ||
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 165/245] debugobjects: Recheck debug_objects_enabled before reporting
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 164/245] netfilter: nf_tables: add rescheduling points during loop detection walks Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 166/245] nbd: Add the maximum limit of allocated index in nbd_dev_add Greg Kroah-Hartman
` (90 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Thomas Gleixner,
Tetsuo Handa, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit 8b64d420fe2450f82848178506d3e3a0bd195539 ]
syzbot is reporting false a positive ODEBUG message immediately after
ODEBUG was disabled due to OOM.
[ 1062.309646][T22911] ODEBUG: Out of memory. ODEBUG disabled
[ 1062.886755][ T5171] ------------[ cut here ]------------
[ 1062.892770][ T5171] ODEBUG: assert_init not available (active state 0) object: ffffc900056afb20 object type: timer_list hint: process_timeout+0x0/0x40
CPU 0 [ T5171] CPU 1 [T22911]
-------------- --------------
debug_object_assert_init() {
if (!debug_objects_enabled)
return;
db = get_bucket(addr);
lookup_object_or_alloc() {
debug_objects_enabled = 0;
return NULL;
}
debug_objects_oom() {
pr_warn("Out of memory. ODEBUG disabled\n");
// all buckets get emptied here, and
}
lookup_object_or_alloc(addr, db, descr, false, true) {
// this bucket is already empty.
return ERR_PTR(-ENOENT);
}
// Emits false positive warning.
debug_print_object(&o, "assert_init");
}
Recheck debug_object_enabled in debug_print_object() to avoid that.
Reported-by: syzbot <syzbot+7937ba6a50bdd00fffdf@syzkaller.appspotmail.com>
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/492fe2ae-5141-d548-ebd5-62f5fe2e57f7@I-love.SAKURA.ne.jp
Closes: https://syzkaller.appspot.com/bug?extid=7937ba6a50bdd00fffdf
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/debugobjects.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 09fddc0ea6d39..3972e2123e554 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -501,6 +501,15 @@ static void debug_print_object(struct debug_obj *obj, char *msg)
const struct debug_obj_descr *descr = obj->descr;
static int limit;
+ /*
+ * Don't report if lookup_object_or_alloc() by the current thread
+ * failed because lookup_object_or_alloc()/debug_objects_oom() by a
+ * concurrent thread turned off debug_objects_enabled and cleared
+ * the hash buckets.
+ */
+ if (!debug_objects_enabled)
+ return;
+
if (limit < 5 && descr != descr_test) {
void *hint = descr->debug_hint ?
descr->debug_hint(obj->object) : NULL;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 166/245] nbd: Add the maximum limit of allocated index in nbd_dev_add
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 165/245] debugobjects: Recheck debug_objects_enabled before reporting Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 167/245] md: fix data corruption for raid456 when reshape restart while grow up Greg Kroah-Hartman
` (89 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhong Jinghua, Christoph Hellwig,
Jens Axboe, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhong Jinghua <zhongjinghua@huawei.com>
[ Upstream commit f12bc113ce904777fd6ca003b473b427782b3dde ]
If the index allocated by idr_alloc greater than MINORMASK >> part_shift,
the device number will overflow, resulting in failure to create a block
device.
Fix it by imiting the size of the max allocation.
Signed-off-by: Zhong Jinghua <zhongjinghua@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230605122159.2134384-1-zhongjinghua@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/nbd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index e563aa407e888..d379a047d4273 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1715,7 +1715,8 @@ static struct nbd_device *nbd_dev_add(int index, unsigned int refs)
if (err == -ENOSPC)
err = -EEXIST;
} else {
- err = idr_alloc(&nbd_index_idr, nbd, 0, 0, GFP_KERNEL);
+ err = idr_alloc(&nbd_index_idr, nbd, 0,
+ (MINORMASK >> part_shift) + 1, GFP_KERNEL);
if (err >= 0)
index = err;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 167/245] md: fix data corruption for raid456 when reshape restart while grow up
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 166/245] nbd: Add the maximum limit of allocated index in nbd_dev_add Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 168/245] md/raid10: prevent soft lockup while flush writes Greg Kroah-Hartman
` (88 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Neuwirth, Yu Kuai, Song Liu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 873f50ece41aad5c4f788a340960c53774b5526e ]
Currently, if reshape is interrupted, echo "reshape" to sync_action will
restart reshape from scratch, for example:
echo frozen > sync_action
echo reshape > sync_action
This will corrupt data before reshape_position if the array is growing,
fix the problem by continue reshape from reshape_position.
Reported-by: Peter Neuwirth <reddunur@online.de>
Link: https://lore.kernel.org/linux-raid/e2f96772-bfbc-f43b-6da1-f520e5164536@online.de/
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230512015610.821290-3-yukuai1@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index ff65e5eddfa18..a17f2f725822a 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4919,11 +4919,21 @@ action_store(struct mddev *mddev, const char *page, size_t len)
return -EINVAL;
err = mddev_lock(mddev);
if (!err) {
- if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
+ if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) {
err = -EBUSY;
- else {
+ } else if (mddev->reshape_position == MaxSector ||
+ mddev->pers->check_reshape == NULL ||
+ mddev->pers->check_reshape(mddev)) {
clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
err = mddev->pers->start_reshape(mddev);
+ } else {
+ /*
+ * If reshape is still in progress, and
+ * md_check_recovery() can continue to reshape,
+ * don't restart reshape because data can be
+ * corrupted for raid456.
+ */
+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
}
mddev_unlock(mddev);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 168/245] md/raid10: prevent soft lockup while flush writes
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 167/245] md: fix data corruption for raid456 when reshape restart while grow up Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 169/245] posix-timers: Ensure timer ID search-loop limit is valid Greg Kroah-Hartman
` (87 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Song Liu, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 010444623e7f4da6b4a4dd603a7da7469981e293 ]
Currently, there is no limit for raid1/raid10 plugged bio. While flushing
writes, raid1 has cond_resched() while raid10 doesn't, and too many
writes can cause soft lockup.
Follow up soft lockup can be triggered easily with writeback test for
raid10 with ramdisks:
watchdog: BUG: soft lockup - CPU#10 stuck for 27s! [md0_raid10:1293]
Call Trace:
<TASK>
call_rcu+0x16/0x20
put_object+0x41/0x80
__delete_object+0x50/0x90
delete_object_full+0x2b/0x40
kmemleak_free+0x46/0xa0
slab_free_freelist_hook.constprop.0+0xed/0x1a0
kmem_cache_free+0xfd/0x300
mempool_free_slab+0x1f/0x30
mempool_free+0x3a/0x100
bio_free+0x59/0x80
bio_put+0xcf/0x2c0
free_r10bio+0xbf/0xf0
raid_end_bio_io+0x78/0xb0
one_write_done+0x8a/0xa0
raid10_end_write_request+0x1b4/0x430
bio_endio+0x175/0x320
brd_submit_bio+0x3b9/0x9b7 [brd]
__submit_bio+0x69/0xe0
submit_bio_noacct_nocheck+0x1e6/0x5a0
submit_bio_noacct+0x38c/0x7e0
flush_pending_writes+0xf0/0x240
raid10d+0xac/0x1ed0
Fix the problem by adding cond_resched() to raid10 like what raid1 did.
Note that unlimited plugged bio still need to be optimized, for example,
in the case of lots of dirty pages writeback, this will take lots of
memory and io will spend a long time in plug, hence io latency is bad.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230529131106.2123367-2-yukuai1@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid10.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 910e7db7d5736..ae84aaa1645c2 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -903,6 +903,7 @@ static void flush_pending_writes(struct r10conf *conf)
else
submit_bio_noacct(bio);
bio = next;
+ cond_resched();
}
blk_finish_plug(&plug);
} else
@@ -1116,6 +1117,7 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
else
submit_bio_noacct(bio);
bio = next;
+ cond_resched();
}
kfree(plug);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 169/245] posix-timers: Ensure timer ID search-loop limit is valid
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 168/245] md/raid10: prevent soft lockup while flush writes Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 170/245] btrfs: add xxhash to fast checksum implementations Greg Kroah-Hartman
` (86 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5c54bd3eb218bb595aa9,
Dmitry Vyukov, Thomas Gleixner, Frederic Weisbecker, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
[ Upstream commit 8ce8849dd1e78dadcee0ec9acbd259d239b7069f ]
posix_timer_add() tries to allocate a posix timer ID by starting from the
cached ID which was stored by the last successful allocation.
This is done in a loop searching the ID space for a free slot one by
one. The loop has to terminate when the search wrapped around to the
starting point.
But that's racy vs. establishing the starting point. That is read out
lockless, which leads to the following problem:
CPU0 CPU1
posix_timer_add()
start = sig->posix_timer_id;
lock(hash_lock);
... posix_timer_add()
if (++sig->posix_timer_id < 0)
start = sig->posix_timer_id;
sig->posix_timer_id = 0;
So CPU1 can observe a negative start value, i.e. -1, and the loop break
never happens because the condition can never be true:
if (sig->posix_timer_id == start)
break;
While this is unlikely to ever turn into an endless loop as the ID space is
huge (INT_MAX), the racy read of the start value caught the attention of
KCSAN and Dmitry unearthed that incorrectness.
Rewrite it so that all id operations are under the hash lock.
Reported-by: syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Link: https://lore.kernel.org/r/87bkhzdn6g.ffs@tglx
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/sched/signal.h | 2 +-
kernel/time/posix-timers.c | 31 ++++++++++++++++++-------------
2 files changed, 19 insertions(+), 14 deletions(-)
diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
index 5f0e8403e8ceb..9743f7d173a0b 100644
--- a/include/linux/sched/signal.h
+++ b/include/linux/sched/signal.h
@@ -125,7 +125,7 @@ struct signal_struct {
#ifdef CONFIG_POSIX_TIMERS
/* POSIX.1b Interval Timers */
- int posix_timer_id;
+ unsigned int next_posix_timer_id;
struct list_head posix_timers;
/* ITIMER_REAL timer for the process */
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index ed3c4a9543982..2d6cf93ca370a 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -140,25 +140,30 @@ static struct k_itimer *posix_timer_by_id(timer_t id)
static int posix_timer_add(struct k_itimer *timer)
{
struct signal_struct *sig = current->signal;
- int first_free_id = sig->posix_timer_id;
struct hlist_head *head;
- int ret = -ENOENT;
+ unsigned int cnt, id;
- do {
+ /*
+ * FIXME: Replace this by a per signal struct xarray once there is
+ * a plan to handle the resulting CRIU regression gracefully.
+ */
+ for (cnt = 0; cnt <= INT_MAX; cnt++) {
spin_lock(&hash_lock);
- head = &posix_timers_hashtable[hash(sig, sig->posix_timer_id)];
- if (!__posix_timers_find(head, sig, sig->posix_timer_id)) {
+ id = sig->next_posix_timer_id;
+
+ /* Write the next ID back. Clamp it to the positive space */
+ sig->next_posix_timer_id = (id + 1) & INT_MAX;
+
+ head = &posix_timers_hashtable[hash(sig, id)];
+ if (!__posix_timers_find(head, sig, id)) {
hlist_add_head_rcu(&timer->t_hash, head);
- ret = sig->posix_timer_id;
+ spin_unlock(&hash_lock);
+ return id;
}
- if (++sig->posix_timer_id < 0)
- sig->posix_timer_id = 0;
- if ((sig->posix_timer_id == first_free_id) && (ret == -ENOENT))
- /* Loop over all possible ids completed */
- ret = -EAGAIN;
spin_unlock(&hash_lock);
- } while (ret == -ENOENT);
- return ret;
+ }
+ /* POSIX return code when no timer ID could be allocated */
+ return -EAGAIN;
}
static inline void unlock_timer(struct k_itimer *timr, unsigned long flags)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 170/245] btrfs: add xxhash to fast checksum implementations
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 169/245] posix-timers: Ensure timer ID search-loop limit is valid Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 171/245] ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A Greg Kroah-Hartman
` (85 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, David Sterba,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <dsterba@suse.com>
[ Upstream commit efcfcbc6a36195c42d98e0ee697baba36da94dc8 ]
The implementation of XXHASH is now CPU only but still fast enough to be
considered for the synchronous checksumming, like non-generic crc32c.
A userspace benchmark comparing it to various implementations (patched
hash-speedtest from btrfs-progs):
Block size: 4096
Iterations: 1000000
Implementation: builtin
Units: CPU cycles
NULL-NOP: cycles: 73384294, cycles/i 73
NULL-MEMCPY: cycles: 228033868, cycles/i 228, 61664.320 MiB/s
CRC32C-ref: cycles: 24758559416, cycles/i 24758, 567.950 MiB/s
CRC32C-NI: cycles: 1194350470, cycles/i 1194, 11773.433 MiB/s
CRC32C-ADLERSW: cycles: 6150186216, cycles/i 6150, 2286.372 MiB/s
CRC32C-ADLERHW: cycles: 626979180, cycles/i 626, 22427.453 MiB/s
CRC32C-PCL: cycles: 466746732, cycles/i 466, 30126.699 MiB/s
XXHASH: cycles: 860656400, cycles/i 860, 16338.188 MiB/s
Comparing purely software implementation (ref), current outdated
accelerated using crc32q instruction (NI), optimized implementations by
M. Adler (https://stackoverflow.com/questions/17645167/implementing-sse-4-2s-crc32c-in-software/17646775#17646775)
and the best one that was taken from kernel using the PCLMULQDQ
instruction (PCL).
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/disk-io.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 9ae7c12668cda..c1dfde886b1e3 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2338,6 +2338,9 @@ static int btrfs_init_csum_hash(struct btrfs_fs_info *fs_info, u16 csum_type)
if (!strstr(crypto_shash_driver_name(csum_shash), "generic"))
set_bit(BTRFS_FS_CSUM_IMPL_FAST, &fs_info->flags);
break;
+ case BTRFS_CSUM_TYPE_XXHASH:
+ set_bit(BTRFS_FS_CSUM_IMPL_FAST, &fs_info->flags);
+ break;
default:
break;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 171/245] ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 170/245] btrfs: add xxhash to fast checksum implementations Greg Kroah-Hartman
@ 2024-02-27 13:25 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 172/245] ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3 Greg Kroah-Hartman
` (84 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 4fd5556608bfa9c2bf276fc115ef04288331aded ]
The LID0 device on the Nextbook Ares 8A tablet always reports lid
closed causing userspace to suspend the device as soon as booting
is complete.
Add a DMI quirk to disable the broken lid functionality.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/button.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 1f9b9a4c38c7d..d8b1481141385 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -77,6 +77,15 @@ static const struct dmi_system_id dmi_lid_quirks[] = {
},
.driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_DISABLED,
},
+ {
+ /* Nextbook Ares 8A tablet, _LID device always reports lid closed */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "CherryTrail"),
+ DMI_MATCH(DMI_BIOS_VERSION, "M882"),
+ },
+ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_DISABLED,
+ },
{
/*
* Lenovo Yoga 9 14ITL5, initial notification of the LID device
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 172/245] ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2024-02-27 13:25 ` [PATCH 5.15 171/245] ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 173/245] ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version) Greg Kroah-Hartman
` (83 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 48436f2e9834b46b47b038b605c8142a1c07bc85 ]
Linux defaults to picking the non-working ACPI video backlight interface
on the Apple iMac11,3 .
Add a DMI quirk to pick the working native radeon_bl0 interface instead.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: bd5d93df86a7 ("ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version)")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/video_detect.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 5afc42d52e49b..be923911e87c1 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -341,6 +341,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "82BK"),
},
},
+ {
+ .callback = video_detect_force_native,
+ /* Apple iMac11,3 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac11,3"),
+ },
+ },
{
/* https://bugzilla.redhat.com/show_bug.cgi?id=1217249 */
.callback = video_detect_force_native,
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 173/245] ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version)
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 172/245] ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3 Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 174/245] arm64: set __exception_irq_entry with __irq_entry as a default Greg Kroah-Hartman
` (82 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit bd5d93df86a7ddf98a2a37e9c3751e3cb334a66c ]
Linux defaults to picking the non-working ACPI video backlight interface
on the Lenovo ThinkPad X131e (3371 AMD version).
Add a DMI quirk to pick the working native radeon_bl0 interface instead.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/video_detect.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index be923911e87c1..28e816be4753e 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -341,6 +341,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "82BK"),
},
},
+ {
+ .callback = video_detect_force_native,
+ /* Lenovo ThinkPad X131e (3371 AMD version) */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "3371"),
+ },
+ },
{
.callback = video_detect_force_native,
/* Apple iMac11,3 */
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 174/245] arm64: set __exception_irq_entry with __irq_entry as a default
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 173/245] ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version) Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 175/245] arm64: mm: fix VA-range sanity check Greg Kroah-Hartman
` (81 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Youngmin Nam, SEO HOYOUNG,
Mark Rutland, Catalin Marinas, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youngmin Nam <youngmin.nam@samsung.com>
[ Upstream commit f6794950f0e5ba37e3bbedda4d6ab0aad7395dd3 ]
filter_irq_stacks() is supposed to cut entries which are related irq entries
from its call stack.
And in_irqentry_text() which is called by filter_irq_stacks()
uses __irqentry_text_start/end symbol to find irq entries in callstack.
But it doesn't work correctly as without "CONFIG_FUNCTION_GRAPH_TRACER",
arm64 kernel doesn't include gic_handle_irq which is entry point of arm64 irq
between __irqentry_text_start and __irqentry_text_end as we discussed in below link.
https://lore.kernel.org/all/CACT4Y+aReMGLYua2rCLHgFpS9io5cZC04Q8GLs-uNmrn1ezxYQ@mail.gmail.com/#t
This problem can makes unintentional deep call stack entries especially
in KASAN enabled situation as below.
[ 2479.383395]I[0:launcher-loader: 1719] Stack depot reached limit capacity
[ 2479.383538]I[0:launcher-loader: 1719] WARNING: CPU: 0 PID: 1719 at lib/stackdepot.c:129 __stack_depot_save+0x464/0x46c
[ 2479.385693]I[0:launcher-loader: 1719] pstate: 624000c5 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
[ 2479.385724]I[0:launcher-loader: 1719] pc : __stack_depot_save+0x464/0x46c
[ 2479.385751]I[0:launcher-loader: 1719] lr : __stack_depot_save+0x460/0x46c
[ 2479.385774]I[0:launcher-loader: 1719] sp : ffffffc0080073c0
[ 2479.385793]I[0:launcher-loader: 1719] x29: ffffffc0080073e0 x28: ffffffd00b78a000 x27: 0000000000000000
[ 2479.385839]I[0:launcher-loader: 1719] x26: 000000000004d1dd x25: ffffff891474f000 x24: 00000000ca64d1dd
[ 2479.385882]I[0:launcher-loader: 1719] x23: 0000000000000200 x22: 0000000000000220 x21: 0000000000000040
[ 2479.385925]I[0:launcher-loader: 1719] x20: ffffffc008007440 x19: 0000000000000000 x18: 0000000000000000
[ 2479.385969]I[0:launcher-loader: 1719] x17: 2065726568207475 x16: 000000000000005e x15: 2d2d2d2d2d2d2d20
[ 2479.386013]I[0:launcher-loader: 1719] x14: 5d39313731203a72 x13: 00000000002f6b30 x12: 00000000002f6af8
[ 2479.386057]I[0:launcher-loader: 1719] x11: 00000000ffffffff x10: ffffffb90aacf000 x9 : e8a74a6c16008800
[ 2479.386101]I[0:launcher-loader: 1719] x8 : e8a74a6c16008800 x7 : 00000000002f6b30 x6 : 00000000002f6af8
[ 2479.386145]I[0:launcher-loader: 1719] x5 : ffffffc0080070c8 x4 : ffffffd00b192380 x3 : ffffffd0092b313c
[ 2479.386189]I[0:launcher-loader: 1719] x2 : 0000000000000001 x1 : 0000000000000004 x0 : 0000000000000022
[ 2479.386231]I[0:launcher-loader: 1719] Call trace:
[ 2479.386248]I[0:launcher-loader: 1719] __stack_depot_save+0x464/0x46c
[ 2479.386273]I[0:launcher-loader: 1719] kasan_save_stack+0x58/0x70
[ 2479.386303]I[0:launcher-loader: 1719] save_stack_info+0x34/0x138
[ 2479.386331]I[0:launcher-loader: 1719] kasan_save_free_info+0x18/0x24
[ 2479.386358]I[0:launcher-loader: 1719] ____kasan_slab_free+0x16c/0x170
[ 2479.386385]I[0:launcher-loader: 1719] __kasan_slab_free+0x10/0x20
[ 2479.386410]I[0:launcher-loader: 1719] kmem_cache_free+0x238/0x53c
[ 2479.386435]I[0:launcher-loader: 1719] mempool_free_slab+0x1c/0x28
[ 2479.386460]I[0:launcher-loader: 1719] mempool_free+0x7c/0x1a0
[ 2479.386484]I[0:launcher-loader: 1719] bvec_free+0x34/0x80
[ 2479.386514]I[0:launcher-loader: 1719] bio_free+0x60/0x98
[ 2479.386540]I[0:launcher-loader: 1719] bio_put+0x50/0x21c
[ 2479.386567]I[0:launcher-loader: 1719] f2fs_write_end_io+0x4ac/0x4d0
[ 2479.386594]I[0:launcher-loader: 1719] bio_endio+0x2dc/0x300
[ 2479.386622]I[0:launcher-loader: 1719] __dm_io_complete+0x324/0x37c
[ 2479.386650]I[0:launcher-loader: 1719] dm_io_dec_pending+0x60/0xa4
[ 2479.386676]I[0:launcher-loader: 1719] clone_endio+0xf8/0x2f0
[ 2479.386700]I[0:launcher-loader: 1719] bio_endio+0x2dc/0x300
[ 2479.386727]I[0:launcher-loader: 1719] blk_update_request+0x258/0x63c
[ 2479.386754]I[0:launcher-loader: 1719] scsi_end_request+0x50/0x304
[ 2479.386782]I[0:launcher-loader: 1719] scsi_io_completion+0x88/0x160
[ 2479.386808]I[0:launcher-loader: 1719] scsi_finish_command+0x17c/0x194
[ 2479.386833]I[0:launcher-loader: 1719] scsi_complete+0xcc/0x158
[ 2479.386859]I[0:launcher-loader: 1719] blk_mq_complete_request+0x4c/0x5c
[ 2479.386885]I[0:launcher-loader: 1719] scsi_done_internal+0xf4/0x1e0
[ 2479.386910]I[0:launcher-loader: 1719] scsi_done+0x14/0x20
[ 2479.386935]I[0:launcher-loader: 1719] ufshcd_compl_one_cqe+0x578/0x71c
[ 2479.386963]I[0:launcher-loader: 1719] ufshcd_mcq_poll_cqe_nolock+0xc8/0x150
[ 2479.386991]I[0:launcher-loader: 1719] ufshcd_intr+0x868/0xc0c
[ 2479.387017]I[0:launcher-loader: 1719] __handle_irq_event_percpu+0xd0/0x348
[ 2479.387044]I[0:launcher-loader: 1719] handle_irq_event_percpu+0x24/0x74
[ 2479.387068]I[0:launcher-loader: 1719] handle_irq_event+0x74/0xe0
[ 2479.387091]I[0:launcher-loader: 1719] handle_fasteoi_irq+0x174/0x240
[ 2479.387118]I[0:launcher-loader: 1719] handle_irq_desc+0x7c/0x2c0
[ 2479.387147]I[0:launcher-loader: 1719] generic_handle_domain_irq+0x1c/0x28
[ 2479.387174]I[0:launcher-loader: 1719] gic_handle_irq+0x64/0x158
[ 2479.387204]I[0:launcher-loader: 1719] call_on_irq_stack+0x2c/0x54
[ 2479.387231]I[0:launcher-loader: 1719] do_interrupt_handler+0x70/0xa0
[ 2479.387258]I[0:launcher-loader: 1719] el1_interrupt+0x34/0x68
[ 2479.387283]I[0:launcher-loader: 1719] el1h_64_irq_handler+0x18/0x24
[ 2479.387308]I[0:launcher-loader: 1719] el1h_64_irq+0x68/0x6c
[ 2479.387332]I[0:launcher-loader: 1719] blk_attempt_bio_merge+0x8/0x170
[ 2479.387356]I[0:launcher-loader: 1719] blk_mq_attempt_bio_merge+0x78/0x98
[ 2479.387383]I[0:launcher-loader: 1719] blk_mq_submit_bio+0x324/0xa40
[ 2479.387409]I[0:launcher-loader: 1719] __submit_bio+0x104/0x138
[ 2479.387436]I[0:launcher-loader: 1719] submit_bio_noacct_nocheck+0x1d0/0x4a0
[ 2479.387462]I[0:launcher-loader: 1719] submit_bio_noacct+0x618/0x804
[ 2479.387487]I[0:launcher-loader: 1719] submit_bio+0x164/0x180
[ 2479.387511]I[0:launcher-loader: 1719] f2fs_submit_read_bio+0xe4/0x1c4
[ 2479.387537]I[0:launcher-loader: 1719] f2fs_mpage_readpages+0x888/0xa4c
[ 2479.387563]I[0:launcher-loader: 1719] f2fs_readahead+0xd4/0x19c
[ 2479.387587]I[0:launcher-loader: 1719] read_pages+0xb0/0x4ac
[ 2479.387614]I[0:launcher-loader: 1719] page_cache_ra_unbounded+0x238/0x288
[ 2479.387642]I[0:launcher-loader: 1719] do_page_cache_ra+0x60/0x6c
[ 2479.387669]I[0:launcher-loader: 1719] page_cache_ra_order+0x318/0x364
[ 2479.387695]I[0:launcher-loader: 1719] ondemand_readahead+0x30c/0x3d8
[ 2479.387722]I[0:launcher-loader: 1719] page_cache_sync_ra+0xb4/0xc8
[ 2479.387749]I[0:launcher-loader: 1719] filemap_read+0x268/0xd24
[ 2479.387777]I[0:launcher-loader: 1719] f2fs_file_read_iter+0x1a0/0x62c
[ 2479.387806]I[0:launcher-loader: 1719] vfs_read+0x258/0x34c
[ 2479.387831]I[0:launcher-loader: 1719] ksys_pread64+0x8c/0xd0
[ 2479.387857]I[0:launcher-loader: 1719] __arm64_sys_pread64+0x48/0x54
[ 2479.387881]I[0:launcher-loader: 1719] invoke_syscall+0x58/0x158
[ 2479.387909]I[0:launcher-loader: 1719] el0_svc_common+0xf0/0x134
[ 2479.387935]I[0:launcher-loader: 1719] do_el0_svc+0x44/0x114
[ 2479.387961]I[0:launcher-loader: 1719] el0_svc+0x2c/0x80
[ 2479.387985]I[0:launcher-loader: 1719] el0t_64_sync_handler+0x48/0x114
[ 2479.388010]I[0:launcher-loader: 1719] el0t_64_sync+0x190/0x194
[ 2479.388038]I[0:launcher-loader: 1719] Kernel panic - not syncing: kernel: panic_on_warn set ...
So let's set __exception_irq_entry with __irq_entry as a default.
Applying this patch, we can see gic_hande_irq is included in Systemp.map as below.
* Before
ffffffc008010000 T __do_softirq
ffffffc008010000 T __irqentry_text_end
ffffffc008010000 T __irqentry_text_start
ffffffc008010000 T __softirqentry_text_start
ffffffc008010000 T _stext
ffffffc00801066c T __softirqentry_text_end
ffffffc008010670 T __entry_text_start
* After
ffffffc008010000 T __irqentry_text_start
ffffffc008010000 T _stext
ffffffc008010000 t gic_handle_irq
ffffffc00801013c t gic_handle_irq
ffffffc008010294 T __irqentry_text_end
ffffffc008010298 T __do_softirq
ffffffc008010298 T __softirqentry_text_start
ffffffc008010904 T __softirqentry_text_end
ffffffc008010908 T __entry_text_start
Signed-off-by: Youngmin Nam <youngmin.nam@samsung.com>
Signed-off-by: SEO HOYOUNG <hy50.seo@samsung.com>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Link: https://lore.kernel.org/r/20230424010436.779733-1-youngmin.nam@samsung.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/exception.h | 5 -----
1 file changed, 5 deletions(-)
diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h
index 515ebe24fd44f..fe4aa233a90ed 100644
--- a/arch/arm64/include/asm/exception.h
+++ b/arch/arm64/include/asm/exception.h
@@ -8,16 +8,11 @@
#define __ASM_EXCEPTION_H
#include <asm/esr.h>
-#include <asm/kprobes.h>
#include <asm/ptrace.h>
#include <linux/interrupt.h>
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
#define __exception_irq_entry __irq_entry
-#else
-#define __exception_irq_entry __kprobes
-#endif
static inline unsigned long disr_to_esr(u64 disr)
{
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 175/245] arm64: mm: fix VA-range sanity check
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 174/245] arm64: set __exception_irq_entry with __irq_entry as a default Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 176/245] sched/fair: Dont balance task to its current running CPU Greg Kroah-Hartman
` (80 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Russell King,
Steve Capper, Will Deacon, Russell King (Oracle), Catalin Marinas,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
[ Upstream commit ab9b4008092c86dc12497af155a0901cc1156999 ]
Both create_mapping_noalloc() and update_mapping_prot() sanity-check
their 'virt' parameter, but the check itself doesn't make much sense.
The condition used today appears to be a historical accident.
The sanity-check condition:
if ((virt >= PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}
... can only be true for the KASAN shadow region or the module region,
and there's no reason to exclude these specifically for creating and
updateing mappings.
When arm64 support was first upstreamed in commit:
c1cc1552616d0f35 ("arm64: MMU initialisation")
... the condition was:
if (virt < VMALLOC_START) {
[ ... warning here ... ]
return;
}
At the time, VMALLOC_START was the lowest kernel address, and this was
checking whether 'virt' would be translated via TTBR1.
Subsequently in commit:
14c127c957c1c607 ("arm64: mm: Flip kernel VA space")
... the condition was changed to:
if ((virt >= VA_START) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}
This appear to have been a thinko. The commit moved the linear map to
the bottom of the kernel address space, with VMALLOC_START being at the
halfway point. The old condition would warn for changes to the linear
map below this, and at the time VA_START was the end of the linear map.
Subsequently we cleaned up the naming of VA_START in commit:
77ad4ce69321abbe ("arm64: memory: rename VA_START to PAGE_END")
... keeping the erroneous condition as:
if ((virt >= PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}
Correct the condition to check against the start of the TTBR1 address
space, which is currently PAGE_OFFSET. This simplifies the logic, and
more clearly matches the "outside kernel range" message in the warning.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Steve Capper <steve.capper@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://lore.kernel.org/r/20230615102628.1052103-1-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/mm/mmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 6680689242df3..fc86e7465df42 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -435,7 +435,7 @@ static phys_addr_t pgd_pgtable_alloc(int shift)
static void __init create_mapping_noalloc(phys_addr_t phys, unsigned long virt,
phys_addr_t size, pgprot_t prot)
{
- if ((virt >= PAGE_END) && (virt < VMALLOC_START)) {
+ if (virt < PAGE_OFFSET) {
pr_warn("BUG: not creating mapping for %pa at 0x%016lx - outside kernel range\n",
&phys, virt);
return;
@@ -462,7 +462,7 @@ void __init create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys,
static void update_mapping_prot(phys_addr_t phys, unsigned long virt,
phys_addr_t size, pgprot_t prot)
{
- if ((virt >= PAGE_END) && (virt < VMALLOC_START)) {
+ if (virt < PAGE_OFFSET) {
pr_warn("BUG: not updating mapping for %pa at 0x%016lx - outside kernel range\n",
&phys, virt);
return;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 176/245] sched/fair: Dont balance task to its current running CPU
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 175/245] arm64: mm: fix VA-range sanity check Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 177/245] wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range Greg Kroah-Hartman
` (79 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Guittot, Yicong Yang,
Peter Zijlstra (Intel), Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <yangyicong@hisilicon.com>
[ Upstream commit 0dd37d6dd33a9c23351e6115ae8cdac7863bc7de ]
We've run into the case that the balancer tries to balance a migration
disabled task and trigger the warning in set_task_cpu() like below:
------------[ cut here ]------------
WARNING: CPU: 7 PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240
Modules linked in: hclgevf xt_CHECKSUM ipt_REJECT nf_reject_ipv4 <...snip>
CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G O 6.1.0-rc4+ #1
Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 12/09/2021
pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : set_task_cpu+0x188/0x240
lr : load_balance+0x5d0/0xc60
sp : ffff80000803bc70
x29: ffff80000803bc70 x28: ffff004089e190e8 x27: ffff004089e19040
x26: ffff007effcabc38 x25: 0000000000000000 x24: 0000000000000001
x23: ffff80000803be84 x22: 000000000000000c x21: ffffb093e79e2a78
x20: 000000000000000c x19: ffff004089e19040 x18: 0000000000000000
x17: 0000000000001fad x16: 0000000000000030 x15: 0000000000000000
x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000001 x10: 0000000000000400 x9 : ffffb093e4cee530
x8 : 00000000fffffffe x7 : 0000000000ce168a x6 : 000000000000013e
x5 : 00000000ffffffe1 x4 : 0000000000000001 x3 : 0000000000000b2a
x2 : 0000000000000b2a x1 : ffffb093e6d6c510 x0 : 0000000000000001
Call trace:
set_task_cpu+0x188/0x240
load_balance+0x5d0/0xc60
rebalance_domains+0x26c/0x380
_nohz_idle_balance.isra.0+0x1e0/0x370
run_rebalance_domains+0x6c/0x80
__do_softirq+0x128/0x3d8
____do_softirq+0x18/0x24
call_on_irq_stack+0x2c/0x38
do_softirq_own_stack+0x24/0x3c
__irq_exit_rcu+0xcc/0xf4
irq_exit_rcu+0x18/0x24
el1_interrupt+0x4c/0xe4
el1h_64_irq_handler+0x18/0x2c
el1h_64_irq+0x74/0x78
arch_cpu_idle+0x18/0x4c
default_idle_call+0x58/0x194
do_idle+0x244/0x2b0
cpu_startup_entry+0x30/0x3c
secondary_start_kernel+0x14c/0x190
__secondary_switched+0xb0/0xb4
---[ end trace 0000000000000000 ]---
Further investigation shows that the warning is superfluous, the migration
disabled task is just going to be migrated to its current running CPU.
This is because that on load balance if the dst_cpu is not allowed by the
task, we'll re-select a new_dst_cpu as a candidate. If no task can be
balanced to dst_cpu we'll try to balance the task to the new_dst_cpu
instead. In this case when the migration disabled task is not on CPU it
only allows to run on its current CPU, load balance will select its
current CPU as new_dst_cpu and later triggers the warning above.
The new_dst_cpu is chosen from the env->dst_grpmask. Currently it
contains CPUs in sched_group_span() and if we have overlapped groups it's
possible to run into this case. This patch makes env->dst_grpmask of
group_balance_mask() which exclude any CPUs from the busiest group and
solve the issue. For balancing in a domain with no overlapped groups
the behaviour keeps same as before.
Suggested-by: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Link: https://lore.kernel.org/r/20230530082507.10444-1-yangyicong@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index fd8b5656641b7..b55d51b4105cd 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -10177,7 +10177,7 @@ static int load_balance(int this_cpu, struct rq *this_rq,
.sd = sd,
.dst_cpu = this_cpu,
.dst_rq = this_rq,
- .dst_grpmask = sched_group_span(sd->groups),
+ .dst_grpmask = group_balance_mask(sd->groups),
.idle = idle,
.loop_break = sched_nr_migrate_break,
.cpus = cpus,
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 177/245] wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 176/245] sched/fair: Dont balance task to its current running CPU Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 178/245] bpf: Address KCSAN report on bpf_lru_list Greg Kroah-Hartman
` (78 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maxime Bizon, Kalle Valo,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Bizon <mbizon@freebox.fr>
[ Upstream commit e2ceb1de2f83aafd8003f0b72dfd4b7441e97d14 ]
Because of what seems to be a typo, a 6Ghz-only phy for which the BDF
does not allow the 7115Mhz channel will fail to register:
WARNING: CPU: 2 PID: 106 at net/wireless/core.c:907 wiphy_register+0x914/0x954
Modules linked in: ath11k_pci sbsa_gwdt
CPU: 2 PID: 106 Comm: kworker/u8:5 Not tainted 6.3.0-rc7-next-20230418-00549-g1e096a17625a-dirty #9
Hardware name: Freebox V7R Board (DT)
Workqueue: ath11k_qmi_driver_event ath11k_qmi_driver_event_work
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wiphy_register+0x914/0x954
lr : ieee80211_register_hw+0x67c/0xc10
sp : ffffff800b123aa0
x29: ffffff800b123aa0 x28: 0000000000000000 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000006 x24: ffffffc008d51418
x23: ffffffc008cb0838 x22: ffffff80176c2460 x21: 0000000000000168
x20: ffffff80176c0000 x19: ffffff80176c03e0 x18: 0000000000000014
x17: 00000000cbef338c x16: 00000000d2a26f21 x15: 00000000ad6bb85f
x14: 0000000000000020 x13: 0000000000000020 x12: 00000000ffffffbd
x11: 0000000000000208 x10: 00000000fffffdf7 x9 : ffffffc009394718
x8 : ffffff80176c0528 x7 : 000000007fffffff x6 : 0000000000000006
x5 : 0000000000000005 x4 : ffffff800b304284 x3 : ffffff800b304284
x2 : ffffff800b304d98 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
wiphy_register+0x914/0x954
ieee80211_register_hw+0x67c/0xc10
ath11k_mac_register+0x7c4/0xe10
ath11k_core_qmi_firmware_ready+0x1f4/0x570
ath11k_qmi_driver_event_work+0x198/0x590
process_one_work+0x1b8/0x328
worker_thread+0x6c/0x414
kthread+0x100/0x104
ret_from_fork+0x10/0x20
---[ end trace 0000000000000000 ]---
ath11k_pci 0002:01:00.0: ieee80211 registration failed: -22
ath11k_pci 0002:01:00.0: failed register the radio with mac80211: -22
ath11k_pci 0002:01:00.0: failed to create pdev core: -22
Signed-off-by: Maxime Bizon <mbizon@freebox.fr>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230421145445.2612280-1-mbizon@freebox.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index ae6e14fe03c72..c58fd836d4ade 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -6312,7 +6312,7 @@ static int ath11k_mac_setup_channels_rates(struct ath11k *ar,
}
if (supported_bands & WMI_HOST_WLAN_5G_CAP) {
- if (reg_cap->high_5ghz_chan >= ATH11K_MAX_6G_FREQ) {
+ if (reg_cap->high_5ghz_chan >= ATH11K_MIN_6G_FREQ) {
channels = kmemdup(ath11k_6ghz_channels,
sizeof(ath11k_6ghz_channels), GFP_KERNEL);
if (!channels) {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 178/245] bpf: Address KCSAN report on bpf_lru_list
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 177/245] wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 179/245] devlink: report devlink_port_type_warn source device Greg Kroah-Hartman
` (77 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+ebe648a84e8784763f82,
Martin KaFai Lau, Yonghong Song, Alexei Starovoitov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <martin.lau@kernel.org>
[ Upstream commit ee9fd0ac3017c4313be91a220a9ac4c99dde7ad4 ]
KCSAN reported a data-race when accessing node->ref.
Although node->ref does not have to be accurate,
take this chance to use a more common READ_ONCE() and WRITE_ONCE()
pattern instead of data_race().
There is an existing bpf_lru_node_is_ref() and bpf_lru_node_set_ref().
This patch also adds bpf_lru_node_clear_ref() to do the
WRITE_ONCE(node->ref, 0) also.
==================================================================
BUG: KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
write to 0xffff888137038deb of 1 bytes by task 11240 on cpu 1:
__bpf_lru_node_move kernel/bpf/bpf_lru_list.c:113 [inline]
__bpf_lru_list_rotate_active kernel/bpf/bpf_lru_list.c:149 [inline]
__bpf_lru_list_rotate+0x1bf/0x750 kernel/bpf/bpf_lru_list.c:240
bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:329 [inline]
bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline]
bpf_lru_pop_free+0x638/0xe20 kernel/bpf/bpf_lru_list.c:499
prealloc_lru_pop kernel/bpf/hashtab.c:290 [inline]
__htab_lru_percpu_map_update_elem+0xe7/0x820 kernel/bpf/hashtab.c:1316
bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313
bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200
generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687
bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534
__sys_bpf+0x338/0x810
__do_sys_bpf kernel/bpf/syscall.c:5096 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5094 [inline]
__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffff888137038deb of 1 bytes by task 11241 on cpu 0:
bpf_lru_node_set_ref kernel/bpf/bpf_lru_list.h:70 [inline]
__htab_lru_percpu_map_update_elem+0x2f1/0x820 kernel/bpf/hashtab.c:1332
bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313
bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200
generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687
bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534
__sys_bpf+0x338/0x810
__do_sys_bpf kernel/bpf/syscall.c:5096 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5094 [inline]
__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x01 -> 0x00
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 11241 Comm: syz-executor.3 Not tainted 6.3.0-rc7-syzkaller-00136-g6a66fdd29ea1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
==================================================================
Reported-by: syzbot+ebe648a84e8784763f82@syzkaller.appspotmail.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/r/20230511043748.1384166-1-martin.lau@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/bpf_lru_list.c | 21 +++++++++++++--------
kernel/bpf/bpf_lru_list.h | 7 ++-----
2 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c
index d99e89f113c43..3dabdd137d102 100644
--- a/kernel/bpf/bpf_lru_list.c
+++ b/kernel/bpf/bpf_lru_list.c
@@ -41,7 +41,12 @@ static struct list_head *local_pending_list(struct bpf_lru_locallist *loc_l)
/* bpf_lru_node helpers */
static bool bpf_lru_node_is_ref(const struct bpf_lru_node *node)
{
- return node->ref;
+ return READ_ONCE(node->ref);
+}
+
+static void bpf_lru_node_clear_ref(struct bpf_lru_node *node)
+{
+ WRITE_ONCE(node->ref, 0);
}
static void bpf_lru_list_count_inc(struct bpf_lru_list *l,
@@ -89,7 +94,7 @@ static void __bpf_lru_node_move_in(struct bpf_lru_list *l,
bpf_lru_list_count_inc(l, tgt_type);
node->type = tgt_type;
- node->ref = 0;
+ bpf_lru_node_clear_ref(node);
list_move(&node->list, &l->lists[tgt_type]);
}
@@ -110,7 +115,7 @@ static void __bpf_lru_node_move(struct bpf_lru_list *l,
bpf_lru_list_count_inc(l, tgt_type);
node->type = tgt_type;
}
- node->ref = 0;
+ bpf_lru_node_clear_ref(node);
/* If the moving node is the next_inactive_rotation candidate,
* move the next_inactive_rotation pointer also.
@@ -353,7 +358,7 @@ static void __local_list_add_pending(struct bpf_lru *lru,
*(u32 *)((void *)node + lru->hash_offset) = hash;
node->cpu = cpu;
node->type = BPF_LRU_LOCAL_LIST_T_PENDING;
- node->ref = 0;
+ bpf_lru_node_clear_ref(node);
list_add(&node->list, local_pending_list(loc_l));
}
@@ -419,7 +424,7 @@ static struct bpf_lru_node *bpf_percpu_lru_pop_free(struct bpf_lru *lru,
if (!list_empty(free_list)) {
node = list_first_entry(free_list, struct bpf_lru_node, list);
*(u32 *)((void *)node + lru->hash_offset) = hash;
- node->ref = 0;
+ bpf_lru_node_clear_ref(node);
__bpf_lru_node_move(l, node, BPF_LRU_LIST_T_INACTIVE);
}
@@ -522,7 +527,7 @@ static void bpf_common_lru_push_free(struct bpf_lru *lru,
}
node->type = BPF_LRU_LOCAL_LIST_T_FREE;
- node->ref = 0;
+ bpf_lru_node_clear_ref(node);
list_move(&node->list, local_free_list(loc_l));
raw_spin_unlock_irqrestore(&loc_l->lock, flags);
@@ -568,7 +573,7 @@ static void bpf_common_lru_populate(struct bpf_lru *lru, void *buf,
node = (struct bpf_lru_node *)(buf + node_offset);
node->type = BPF_LRU_LIST_T_FREE;
- node->ref = 0;
+ bpf_lru_node_clear_ref(node);
list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]);
buf += elem_size;
}
@@ -594,7 +599,7 @@ static void bpf_percpu_lru_populate(struct bpf_lru *lru, void *buf,
node = (struct bpf_lru_node *)(buf + node_offset);
node->cpu = cpu;
node->type = BPF_LRU_LIST_T_FREE;
- node->ref = 0;
+ bpf_lru_node_clear_ref(node);
list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]);
i++;
buf += elem_size;
diff --git a/kernel/bpf/bpf_lru_list.h b/kernel/bpf/bpf_lru_list.h
index 6b12f06ee18c3..9c12ee453c616 100644
--- a/kernel/bpf/bpf_lru_list.h
+++ b/kernel/bpf/bpf_lru_list.h
@@ -63,11 +63,8 @@ struct bpf_lru {
static inline void bpf_lru_node_set_ref(struct bpf_lru_node *node)
{
- /* ref is an approximation on access frequency. It does not
- * have to be very accurate. Hence, no protection is used.
- */
- if (!node->ref)
- node->ref = 1;
+ if (!READ_ONCE(node->ref))
+ WRITE_ONCE(node->ref, 1);
}
int bpf_lru_init(struct bpf_lru *lru, bool percpu, u32 hash_offset,
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 179/245] devlink: report devlink_port_type_warn source device
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 178/245] bpf: Address KCSAN report on bpf_lru_list Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 180/245] wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() Greg Kroah-Hartman
` (76 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Oros, Pavan Chebbi,
Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <poros@redhat.com>
[ Upstream commit a52305a81d6bb74b90b400dfa56455d37872fe4b ]
devlink_port_type_warn is scheduled for port devlink and warning
when the port type is not set. But from this warning it is not easy
found out which device (driver) has no devlink port set.
[ 3709.975552] Type was not set for devlink port.
[ 3709.975579] WARNING: CPU: 1 PID: 13092 at net/devlink/leftover.c:6775 devlink_port_type_warn+0x11/0x20
[ 3709.993967] Modules linked in: openvswitch nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nfnetlink bluetooth rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs vhost_net vhost vhost_iotlb tap tun bridge stp llc qrtr intel_rapl_msr intel_rapl_common i10nm_edac nfit libnvdimm x86_pkg_temp_thermal mlx5_ib intel_powerclamp coretemp dell_wmi ledtrig_audio sparse_keymap ipmi_ssif kvm_intel ib_uverbs rfkill ib_core video kvm iTCO_wdt acpi_ipmi intel_vsec irqbypass ipmi_si iTCO_vendor_support dcdbas ipmi_devintf mei_me ipmi_msghandler rapl mei intel_cstate isst_if_mmio isst_if_mbox_pci dell_smbios intel_uncore isst_if_common i2c_i801 dell_wmi_descriptor wmi_bmof i2c_smbus intel_pch_thermal pcspkr acpi_power_meter xfs libcrc32c sd_mod sg nvme_tcp mgag200 i2c_algo_bit nvme_fabrics drm_shmem_helper drm_kms_helper nvme syscopyarea ahci sysfillrect sysimgblt nvme_core fb_sys_fops crct10dif_pclmul libahci mlx5_core sfc crc32_pclmul nvme_common drm
[ 3709.994030] crc32c_intel mtd t10_pi mlxfw libata tg3 mdio megaraid_sas psample ghash_clmulni_intel pci_hyperv_intf wmi dm_multipath sunrpc dm_mirror dm_region_hash dm_log dm_mod be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse
[ 3710.108431] CPU: 1 PID: 13092 Comm: kworker/1:1 Kdump: loaded Not tainted 5.14.0-319.el9.x86_64 #1
[ 3710.108435] Hardware name: Dell Inc. PowerEdge R750/0PJ80M, BIOS 1.8.2 09/14/2022
[ 3710.108437] Workqueue: events devlink_port_type_warn
[ 3710.108440] RIP: 0010:devlink_port_type_warn+0x11/0x20
[ 3710.108443] Code: 84 76 fe ff ff 48 c7 03 20 0e 1a ad 31 c0 e9 96 fd ff ff 66 0f 1f 44 00 00 0f 1f 44 00 00 48 c7 c7 18 24 4e ad e8 ef 71 62 ff <0f> 0b c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f6 87
[ 3710.108445] RSP: 0018:ff3b6d2e8b3c7e90 EFLAGS: 00010282
[ 3710.108447] RAX: 0000000000000000 RBX: ff366d6580127080 RCX: 0000000000000027
[ 3710.108448] RDX: 0000000000000027 RSI: 00000000ffff86de RDI: ff366d753f41f8c8
[ 3710.108449] RBP: ff366d658ff5a0c0 R08: ff366d753f41f8c0 R09: ff3b6d2e8b3c7e18
[ 3710.108450] R10: 0000000000000001 R11: 0000000000000023 R12: ff366d753f430600
[ 3710.108451] R13: ff366d753f436900 R14: 0000000000000000 R15: ff366d753f436905
[ 3710.108452] FS: 0000000000000000(0000) GS:ff366d753f400000(0000) knlGS:0000000000000000
[ 3710.108453] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3710.108454] CR2: 00007f1c57bc74e0 CR3: 000000111d26a001 CR4: 0000000000773ee0
[ 3710.108456] PKRU: 55555554
[ 3710.108457] Call Trace:
[ 3710.108458] <TASK>
[ 3710.108459] process_one_work+0x1e2/0x3b0
[ 3710.108466] ? rescuer_thread+0x390/0x390
[ 3710.108468] worker_thread+0x50/0x3a0
[ 3710.108471] ? rescuer_thread+0x390/0x390
[ 3710.108473] kthread+0xdd/0x100
[ 3710.108477] ? kthread_complete_and_exit+0x20/0x20
[ 3710.108479] ret_from_fork+0x1f/0x30
[ 3710.108485] </TASK>
[ 3710.108486] ---[ end trace 1b4b23cd0c65d6a0 ]---
After patch:
[ 402.473064] ice 0000:41:00.0: Type was not set for devlink port.
[ 402.473064] ice 0000:41:00.1: Type was not set for devlink port.
Signed-off-by: Petr Oros <poros@redhat.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Link: https://lore.kernel.org/r/20230615095447.8259-1-poros@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/devlink.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/core/devlink.c b/net/core/devlink.c
index db76c55e1a6d7..7113ae79f5228 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -9055,7 +9055,10 @@ EXPORT_SYMBOL_GPL(devlink_free);
static void devlink_port_type_warn(struct work_struct *work)
{
- WARN(true, "Type was not set for devlink port.");
+ struct devlink_port *port = container_of(to_delayed_work(work),
+ struct devlink_port,
+ type_warn_dw);
+ dev_warn(port->devlink->dev, "Type was not set for devlink port.");
}
static bool devlink_port_type_should_warn(struct devlink_port *devlink_port)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 180/245] wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 179/245] devlink: report devlink_port_type_warn source device Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 181/245] igb: Fix igb_down hung on surprise removal Greg Kroah-Hartman
` (75 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gustavo A. R. Silva, Simon Horman,
Johannes Berg, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <gustavoars@kernel.org>
[ Upstream commit 71e7552c90db2a2767f5c17c7ec72296b0d92061 ]
-Wstringop-overflow is legitimately warning us about extra_size
pontentially being zero at some point, hence potenially ending
up _allocating_ zero bytes of memory for extra pointer and then
trying to access such object in a call to copy_from_user().
Fix this by adding a sanity check to ensure we never end up
trying to allocate zero bytes of data for extra pointer, before
continue executing the rest of the code in the function.
Address the following -Wstringop-overflow warning seen when built
m68k architecture with allyesconfig configuration:
from net/wireless/wext-core.c:11:
In function '_copy_from_user',
inlined from 'copy_from_user' at include/linux/uaccess.h:183:7,
inlined from 'ioctl_standard_iw_point' at net/wireless/wext-core.c:825:7:
arch/m68k/include/asm/string.h:48:25: warning: '__builtin_memset' writing 1 or more bytes into a region of size 0 overflows the destination [-Wstringop-overflow=]
48 | #define memset(d, c, n) __builtin_memset(d, c, n)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/uaccess.h:153:17: note: in expansion of macro 'memset'
153 | memset(to + (n - res), 0, res);
| ^~~~~~
In function 'kmalloc',
inlined from 'kzalloc' at include/linux/slab.h:694:9,
inlined from 'ioctl_standard_iw_point' at net/wireless/wext-core.c:819:10:
include/linux/slab.h:577:16: note: at offset 1 into destination object of size 0 allocated by '__kmalloc'
577 | return __kmalloc(size, flags);
| ^~~~~~~~~~~~~~~~~~~~~~
This help with the ongoing efforts to globally enable
-Wstringop-overflow.
Link: https://github.com/KSPP/linux/issues/315
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/ZItSlzvIpjdjNfd8@work
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/wext-core.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index fe8765c4075d3..8a4b85f96a13a 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -799,6 +799,12 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
}
}
+ /* Sanity-check to ensure we never end up _allocating_ zero
+ * bytes of data for extra.
+ */
+ if (extra_size <= 0)
+ return -EFAULT;
+
/* kzalloc() ensures NULL-termination for essid_compat. */
extra = kzalloc(extra_size, GFP_KERNEL);
if (!extra)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 181/245] igb: Fix igb_down hung on surprise removal
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 180/245] wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 182/245] wifi: iwlwifi: mvm: avoid baid size integer overflow Greg Kroah-Hartman
` (74 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ying Hsu, Tony Nguyen, Simon Horman,
Jakub Kicinski, Sasha Levin, Pucha Himasekhar Reddy
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ying Hsu <yinghsu@chromium.org>
[ Upstream commit 004d25060c78fc31f66da0fa439c544dda1ac9d5 ]
In a setup where a Thunderbolt hub connects to Ethernet and a display
through USB Type-C, users may experience a hung task timeout when they
remove the cable between the PC and the Thunderbolt hub.
This is because the igb_down function is called multiple times when
the Thunderbolt hub is unplugged. For example, the igb_io_error_detected
triggers the first call, and the igb_remove triggers the second call.
The second call to igb_down will block at napi_synchronize.
Here's the call trace:
__schedule+0x3b0/0xddb
? __mod_timer+0x164/0x5d3
schedule+0x44/0xa8
schedule_timeout+0xb2/0x2a4
? run_local_timers+0x4e/0x4e
msleep+0x31/0x38
igb_down+0x12c/0x22a [igb 6615058754948bfde0bf01429257eb59f13030d4]
__igb_close+0x6f/0x9c [igb 6615058754948bfde0bf01429257eb59f13030d4]
igb_close+0x23/0x2b [igb 6615058754948bfde0bf01429257eb59f13030d4]
__dev_close_many+0x95/0xec
dev_close_many+0x6e/0x103
unregister_netdevice_many+0x105/0x5b1
unregister_netdevice_queue+0xc2/0x10d
unregister_netdev+0x1c/0x23
igb_remove+0xa7/0x11c [igb 6615058754948bfde0bf01429257eb59f13030d4]
pci_device_remove+0x3f/0x9c
device_release_driver_internal+0xfe/0x1b4
pci_stop_bus_device+0x5b/0x7f
pci_stop_bus_device+0x30/0x7f
pci_stop_bus_device+0x30/0x7f
pci_stop_and_remove_bus_device+0x12/0x19
pciehp_unconfigure_device+0x76/0xe9
pciehp_disable_slot+0x6e/0x131
pciehp_handle_presence_or_link_change+0x7a/0x3f7
pciehp_ist+0xbe/0x194
irq_thread_fn+0x22/0x4d
? irq_thread+0x1fd/0x1fd
irq_thread+0x17b/0x1fd
? irq_forced_thread_fn+0x5f/0x5f
kthread+0x142/0x153
? __irq_get_irqchip_state+0x46/0x46
? kthread_associate_blkcg+0x71/0x71
ret_from_fork+0x1f/0x30
In this case, igb_io_error_detected detaches the network interface
and requests a PCIE slot reset, however, the PCIE reset callback is
not being invoked and thus the Ethernet connection breaks down.
As the PCIE error in this case is a non-fatal one, requesting a
slot reset can be avoided.
This patch fixes the task hung issue and preserves Ethernet
connection by ignoring non-fatal PCIE errors.
Signed-off-by: Ying Hsu <yinghsu@chromium.org>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230620174732.4145155-1-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igb/igb_main.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index c01114cabbb09..7c42a99be5065 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -9451,6 +9451,11 @@ static pci_ers_result_t igb_io_error_detected(struct pci_dev *pdev,
struct net_device *netdev = pci_get_drvdata(pdev);
struct igb_adapter *adapter = netdev_priv(netdev);
+ if (state == pci_channel_io_normal) {
+ dev_warn(&pdev->dev, "Non-correctable non-fatal error reported.\n");
+ return PCI_ERS_RESULT_CAN_RECOVER;
+ }
+
netif_device_detach(netdev);
if (state == pci_channel_io_perm_failure)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 182/245] wifi: iwlwifi: mvm: avoid baid size integer overflow
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 181/245] igb: Fix igb_down hung on surprise removal Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 183/245] exfat: support dynamic allocate bh for exfat_entry_set_cache Greg Kroah-Hartman
` (73 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roee Goldfiner, Johannes Berg,
Gregory Greenman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 1a528ab1da324d078ec60283c34c17848580df24 ]
Roee reported various hard-to-debug crashes with pings in
EHT aggregation scenarios. Enabling KASAN showed that we
access the BAID allocation out of bounds, and looking at
the code a bit shows that since the reorder buffer entry
(struct iwl_mvm_reorder_buf_entry) is 128 bytes if debug
such as lockdep is enabled, then staring from an agg size
512 we overflow the size calculation, and allocate a much
smaller structure than we should, causing slab corruption
once we initialize this.
Fix this by simply using u32 instead of u16.
Reported-by: Roee Goldfiner <roee.h.goldfiner@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230620125813.f428c856030d.I2c2bb808e945adb71bc15f5b2bac2d8957ea90eb@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 45dfee3ad8c60..2d1755598b475 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2544,7 +2544,7 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
}
if (iwl_mvm_has_new_rx_api(mvm) && start) {
- u16 reorder_buf_size = buf_size * sizeof(baid_data->entries[0]);
+ u32 reorder_buf_size = buf_size * sizeof(baid_data->entries[0]);
/* sparse doesn't like the __align() so don't check */
#ifndef __CHECKER__
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 183/245] exfat: support dynamic allocate bh for exfat_entry_set_cache
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 182/245] wifi: iwlwifi: mvm: avoid baid size integer overflow Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 184/245] arm64: dts: rockchip: fix regulator name on rk3399-rock-4 Greg Kroah-Hartman
` (72 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuezhang Mo, Andy Wu, Aoyama Wataru,
Sungjong Seo, Namjae Jeon, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <Yuezhang.Mo@sony.com>
[ Upstream commit a3ff29a95fde16906304455aa8c0bd84eb770258 ]
In special cases, a file or a directory may occupied more than 19
directory entries, pre-allocating 3 bh is not enough. Such as
- Support vendor secondary directory entry in the future.
- Since file directory entry is damaged, the SecondaryCount
field is bigger than 18.
So this commit supports dynamic allocation of bh.
Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Andy Wu <Andy.Wu@sony.com>
Reviewed-by: Aoyama Wataru <wataru.aoyama@sony.com>
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/dir.c | 15 +++++++++++++++
fs/exfat/exfat_fs.h | 5 ++++-
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c
index f6dd4fc8eaf45..be7570d01ae1a 100644
--- a/fs/exfat/dir.c
+++ b/fs/exfat/dir.c
@@ -618,6 +618,10 @@ int exfat_free_dentry_set(struct exfat_entry_set_cache *es, int sync)
bforget(es->bh[i]);
else
brelse(es->bh[i]);
+
+ if (IS_DYNAMIC_ES(es))
+ kfree(es->bh);
+
kfree(es);
return err;
}
@@ -853,6 +857,7 @@ struct exfat_entry_set_cache *exfat_get_dentry_set(struct super_block *sb,
/* byte offset in sector */
off = EXFAT_BLK_OFFSET(byte_offset, sb);
es->start_off = off;
+ es->bh = es->__bh;
/* sector offset in cluster */
sec = EXFAT_B_TO_BLK(byte_offset, sb);
@@ -872,6 +877,16 @@ struct exfat_entry_set_cache *exfat_get_dentry_set(struct super_block *sb,
es->num_entries = num_entries;
num_bh = EXFAT_B_TO_BLK_ROUND_UP(off + num_entries * DENTRY_SIZE, sb);
+ if (num_bh > ARRAY_SIZE(es->__bh)) {
+ es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_KERNEL);
+ if (!es->bh) {
+ brelse(bh);
+ kfree(es);
+ return NULL;
+ }
+ es->bh[0] = bh;
+ }
+
for (i = 1; i < num_bh; i++) {
/* get the next sector */
if (exfat_is_last_sector_in_cluster(sbi, sec)) {
diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h
index db538709dafa0..58816ee3162c4 100644
--- a/fs/exfat/exfat_fs.h
+++ b/fs/exfat/exfat_fs.h
@@ -170,10 +170,13 @@ struct exfat_entry_set_cache {
bool modified;
unsigned int start_off;
int num_bh;
- struct buffer_head *bh[DIR_CACHE_SIZE];
+ struct buffer_head *__bh[DIR_CACHE_SIZE];
+ struct buffer_head **bh;
unsigned int num_entries;
};
+#define IS_DYNAMIC_ES(es) ((es)->__bh != (es)->bh)
+
struct exfat_dir_entry {
struct exfat_chain dir;
int entry;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 184/245] arm64: dts: rockchip: fix regulator name on rk3399-rock-4
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 183/245] exfat: support dynamic allocate bh for exfat_entry_set_cache Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 185/245] arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4 Greg Kroah-Hartman
` (71 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, FUKAUMI Naoki, Heiko Stuebner,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUKAUMI Naoki <naoki@radxa.com>
[ Upstream commit 69448624b770aa88a71536a16900dd3cc6002919 ]
fix regulator name
ref:
https://dl.radxa.com/rockpi4/docs/hw/rockpi4/rockpi4_v13_sch_20181112.pdf
Signed-off-by: FUKAUMI Naoki <naoki@radxa.com>
Link: https://lore.kernel.org/r/20220909195006.127957-4-naoki@radxa.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 25 ++++++++++---------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
index 8b70e831aff23..203460d46f182 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
@@ -98,24 +98,25 @@ vcc5v0_host: vcc5v0-host-regulator {
vin-supply = <&vcc5v0_sys>;
};
- vcc5v0_typec: vcc5v0-typec-regulator {
+ vbus_typec: vbus-typec-regulator {
compatible = "regulator-fixed";
enable-active-high;
gpio = <&gpio1 RK_PA3 GPIO_ACTIVE_HIGH>;
pinctrl-names = "default";
pinctrl-0 = <&vcc5v0_typec_en>;
- regulator-name = "vcc5v0_typec";
+ regulator-name = "vbus_typec";
regulator-always-on;
vin-supply = <&vcc5v0_sys>;
};
- vcc_lan: vcc3v3-phy-regulator {
+ vcc3v3_lan: vcc3v3-lan-regulator {
compatible = "regulator-fixed";
- regulator-name = "vcc_lan";
+ regulator-name = "vcc3v3_lan";
regulator-always-on;
regulator-boot-on;
regulator-min-microvolt = <3300000>;
regulator-max-microvolt = <3300000>;
+ vin-supply = <&vcc3v3_sys>;
};
vdd_log: vdd-log {
@@ -162,7 +163,7 @@ &gmac {
assigned-clocks = <&cru SCLK_RMII_SRC>;
assigned-clock-parents = <&clkin_gmac>;
clock_in_out = "input";
- phy-supply = <&vcc_lan>;
+ phy-supply = <&vcc3v3_lan>;
phy-mode = "rgmii";
pinctrl-names = "default";
pinctrl-0 = <&rgmii_pins>;
@@ -267,8 +268,8 @@ regulator-state-mem {
};
};
- vcc1v8_codec: LDO_REG1 {
- regulator-name = "vcc1v8_codec";
+ vcca1v8_codec: LDO_REG1 {
+ regulator-name = "vcca1v8_codec";
regulator-always-on;
regulator-boot-on;
regulator-min-microvolt = <1800000>;
@@ -278,8 +279,8 @@ regulator-state-mem {
};
};
- vcc1v8_hdmi: LDO_REG2 {
- regulator-name = "vcc1v8_hdmi";
+ vcca1v8_hdmi: LDO_REG2 {
+ regulator-name = "vcca1v8_hdmi";
regulator-always-on;
regulator-boot-on;
regulator-min-microvolt = <1800000>;
@@ -336,8 +337,8 @@ regulator-state-mem {
};
};
- vcc0v9_hdmi: LDO_REG7 {
- regulator-name = "vcc0v9_hdmi";
+ vcca0v9_hdmi: LDO_REG7 {
+ regulator-name = "vcca0v9_hdmi";
regulator-always-on;
regulator-boot-on;
regulator-min-microvolt = <900000>;
@@ -456,7 +457,7 @@ &io_domains {
status = "okay";
bt656-supply = <&vcc_3v0>;
- audio-supply = <&vcc1v8_codec>;
+ audio-supply = <&vcca1v8_codec>;
sdmmc-supply = <&vcc_sdio>;
gpio1830-supply = <&vcc_3v0>;
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 185/245] arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 184/245] arm64: dts: rockchip: fix regulator name on rk3399-rock-4 Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 186/245] arm64: dts: rockchip: add SPDIF node " Greg Kroah-Hartman
` (70 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Bee, Heiko Stuebner,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Bee <knaerzche@gmail.com>
[ Upstream commit 65bd2b8bdb3bddc37bea695789713916327e1c1f ]
ROCK Pi 4 boards have the codec connected to i2s0 and it is accessible
via i2c1 address 0x11.
Add an audio-graph-card for it.
Signed-off-by: Alex Bee <knaerzche@gmail.com>
Link: https://lore.kernel.org/r/20210618181256.27992-5-knaerzche@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 28 +++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
index 203460d46f182..0af694540c1eb 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
@@ -36,6 +36,12 @@ sdio_pwrseq: sdio-pwrseq {
reset-gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_LOW>;
};
+ sound {
+ compatible = "audio-graph-card";
+ label = "Analog";
+ dais = <&i2s0_p0>;
+ };
+
vcc12v_dcin: dc-12v {
compatible = "regulator-fixed";
regulator-name = "vcc12v_dcin";
@@ -423,6 +429,20 @@ &i2c1 {
i2c-scl-rising-time-ns = <300>;
i2c-scl-falling-time-ns = <15>;
status = "okay";
+
+ es8316: codec@11 {
+ compatible = "everest,es8316";
+ reg = <0x11>;
+ clocks = <&cru SCLK_I2S_8CH_OUT>;
+ clock-names = "mclk";
+ #sound-dai-cells = <0>;
+
+ port {
+ es8316_p0_0: endpoint {
+ remote-endpoint = <&i2s0_p0_0>;
+ };
+ };
+ };
};
&i2c3 {
@@ -442,6 +462,14 @@ &i2s0 {
rockchip,capture-channels = <2>;
rockchip,playback-channels = <2>;
status = "okay";
+
+ i2s0_p0: port {
+ i2s0_p0_0: endpoint {
+ dai-format = "i2s";
+ mclk-fs = <256>;
+ remote-endpoint = <&es8316_p0_0>;
+ };
+ };
};
&i2s1 {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 186/245] arm64: dts: rockchip: add SPDIF node for ROCK Pi 4
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 185/245] arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4 Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 187/245] ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch Greg Kroah-Hartman
` (69 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Bee, Heiko Stuebner,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Bee <knaerzche@gmail.com>
[ Upstream commit 697dd494cb1cf56acfb764214a1e4788e4d1a983 ]
Add a SPDIF audio-graph-card to ROCK Pi 4 device tree.
It's not enabled by default since all dma channels are used by
the (already) enabled i2s0/1/2 and the pin is muxed with GPIO4_C5
which might be in use already.
If enabled SPDIF_TX will be available at pin #15.
Signed-off-by: Alex Bee <knaerzche@gmail.com>
Link: https://lore.kernel.org/r/20210618181256.27992-6-knaerzche@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 26 +++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
index 0af694540c1eb..382bb0734cb74 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
@@ -42,6 +42,23 @@ sound {
dais = <&i2s0_p0>;
};
+ sound-dit {
+ compatible = "audio-graph-card";
+ label = "SPDIF";
+ dais = <&spdif_p0>;
+ };
+
+ spdif-dit {
+ compatible = "linux,spdif-dit";
+ #sound-dai-cells = <0>;
+
+ port {
+ dit_p0_0: endpoint {
+ remote-endpoint = <&spdif_p0_0>;
+ };
+ };
+ };
+
vcc12v_dcin: dc-12v {
compatible = "regulator-fixed";
regulator-name = "vcc12v_dcin";
@@ -631,6 +648,15 @@ &sdhci {
status = "okay";
};
+&spdif {
+
+ spdif_p0: port {
+ spdif_p0_0: endpoint {
+ remote-endpoint = <&dit_p0_0>;
+ };
+ };
+};
+
&tcphy0 {
status = "okay";
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 187/245] ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 186/245] arm64: dts: rockchip: add SPDIF node " Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 188/245] ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2 Greg Kroah-Hartman
` (68 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafał Miłecki,
Florian Fainelli, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <rafal@milecki.pl>
[ Upstream commit 9fb90ae6cae7f8fe4fbf626945f32cd9da2c3892 ]
BCM53573 family SoC have Ethernet switch connected to the first Ethernet
controller (accessible over MDIO).
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm53573.dtsi | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
index 85a23dc52423c..eed1a6147f0bf 100644
--- a/arch/arm/boot/dts/bcm53573.dtsi
+++ b/arch/arm/boot/dts/bcm53573.dtsi
@@ -181,6 +181,24 @@ ohci_port2: port@2 {
gmac0: ethernet@5000 {
reg = <0x5000 0x1000>;
+
+ mdio {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ switch: switch@1e {
+ compatible = "brcm,bcm53125";
+ reg = <0x1e>;
+
+ status = "disabled";
+
+ /* ports are defined in board DTS */
+ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ };
+ };
+ };
};
gmac1: ethernet@b000 {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 188/245] ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 187/245] ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 189/245] ACPI: resource: Add ASUS model S5402ZA to quirks Greg Kroah-Hartman
` (67 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 8cf04bb321f036dd2e523e993897e0789bd5265c ]
Linux defaults to picking the non-working ACPI video backlight interface
on the Apple iMac12,1 and iMac12,2.
Add a DMI quirk to pick the working native radeon_bl0 interface instead.
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1838
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2753
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/video_detect.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 28e816be4753e..a5cb9e1d48bcc 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -357,6 +357,24 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "iMac11,3"),
},
},
+ {
+ /* https://gitlab.freedesktop.org/drm/amd/-/issues/1838 */
+ .callback = video_detect_force_native,
+ /* Apple iMac12,1 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac12,1"),
+ },
+ },
+ {
+ /* https://gitlab.freedesktop.org/drm/amd/-/issues/2753 */
+ .callback = video_detect_force_native,
+ /* Apple iMac12,2 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac12,2"),
+ },
+ },
{
/* https://bugzilla.redhat.com/show_bug.cgi?id=1217249 */
.callback = video_detect_force_native,
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 189/245] ACPI: resource: Add ASUS model S5402ZA to quirks
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 188/245] ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2 Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 190/245] ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA Greg Kroah-Hartman
` (66 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kellen Renshaw, Rafael J. Wysocki,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kellen Renshaw <kellen.renshaw@canonical.com>
[ Upstream commit 6e5cbe7c4b41824e500acbb42411da692d1435f1 ]
The Asus Vivobook S5402ZA has the same keyboard issue as Asus Vivobook
K3402ZA/K3502ZA. The kernel overrides IRQ 1 to Edge_High when it
should be Active_Low.
This patch adds the S5402ZA model to the quirk list.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216158
Tested-by: Kellen Renshaw <kellen.renshaw@canonical.com>
Signed-off-by: Kellen Renshaw <kellen.renshaw@canonical.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 91628fb41ef85..4d1db2def7ae4 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
DMI_MATCH(DMI_BOARD_NAME, "K3502ZA"),
},
},
+ {
+ .ident = "Asus Vivobook S5402ZA",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "S5402ZA"),
+ },
+ },
{ }
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 190/245] ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 189/245] ACPI: resource: Add ASUS model S5402ZA to quirks Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 191/245] ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks Greg Kroah-Hartman
` (65 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dzmitry, Tamim Khan,
Rafael J. Wysocki, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamim Khan <tamim@fusetak.com>
[ Upstream commit b5f9223a105d9b56954ad1ca3eace4eaf26c99ed ]
Like the Asus Vivobook K3402ZA/K3502ZA/S5402ZA Asus Vivobook S5602ZA
has an ACPI DSDT table the describes IRQ 1 as ActiveLow while the kernel
overrides it to Edge_High. This prevents the keyboard on this laptop
from working. To fix this add this laptop to the skip_override_table so
that the kernel does not override IRQ 1.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216579
Tested-by: Dzmitry <wrkedm@gmail.com>
Signed-off-by: Tamim Khan <tamim@fusetak.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 4d1db2def7ae4..5f56839ed71df 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -428,6 +428,13 @@ static const struct dmi_system_id asus_laptop[] = {
DMI_MATCH(DMI_BOARD_NAME, "S5402ZA"),
},
},
+ {
+ .ident = "Asus Vivobook S5602ZA",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
+ },
+ },
{ }
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 191/245] ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 190/245] ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 192/245] ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA Greg Kroah-Hartman
` (64 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 7203481fd12b1257938519efb2460ea02b9236ee ]
The Asus ExpertBook B2502 has the same keyboard issue as Asus Vivobook
K3402ZA/K3502ZA. The kernel overrides IRQ 1 to Edge_High when it
should be Active_Low.
This patch adds the ExpertBook B2502 model to the existing
quirk list of Asus laptops with this issue.
Fixes: b5f9223a105d ("ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA")
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2142574
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 77c724888238 ("ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 5f56839ed71df..a5d2a81902038 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -435,6 +435,13 @@ static const struct dmi_system_id asus_laptop[] = {
DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
},
},
+ {
+ .ident = "Asus ExpertBook B2502",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "B2502CBA"),
+ },
+ },
{ }
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 192/245] ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 191/245] ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 193/245] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA Greg Kroah-Hartman
` (63 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, zelenat, Tamim Khan,
Rafael J. Wysocki, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamim Khan <tamim@fusetak.com>
[ Upstream commit 77c7248882385397cd7dffe9e1437f59f32ce2de ]
Like the Asus Expertbook B2502CBA and various Asus Vivobook laptops,
the Asus Expertbook B2402CBA has an ACPI DSDT table that describes IRQ 1
as ActiveLow while the kernel overrides it to Edge_High. This prevents the
keyboard from working. To fix this issue, add this laptop to the
skip_override_table so that the kernel does not override IRQ 1.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216864
Tested-by: zelenat <zelenat@gmail.com>
Signed-off-by: Tamim Khan <tamim@fusetak.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index a5d2a81902038..6c5873f552e5e 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -435,6 +435,13 @@ static const struct dmi_system_id asus_laptop[] = {
DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
},
},
+ {
+ .ident = "Asus ExpertBook B2402CBA",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "B2402CBA"),
+ },
+ },
{
.ident = "Asus ExpertBook B2502",
.matches = {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 193/245] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 192/245] ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 194/245] xhci: cleanup xhci_hub_control port references Greg Kroah-Hartman
` (62 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Rafael J. Wysocki,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Menzel <pmenzel@molgen.mpg.de>
[ Upstream commit 05cda427126f30ce3fc8ffd82fd6f5196398d502 ]
Like the ASUS ExpertBook B2502CBA and various ASUS Vivobook laptops, the
ASUS ExpertBook B1502CBA has an ACPI DSDT table that describes IRQ 1 as
ActiveLow while the kernel overrides it to Edge_High.
$ sudo dmesg | grep DMI
DMI: ASUSTeK COMPUTER INC. ASUS EXPERTBOOK B1502CBA_B1502CBA/B1502CBA, BIOS B1502CBA.300 01/18/2023
$ grep -A 40 PS2K dsdt.dsl | grep IRQ -A 1
IRQ (Level, ActiveLow, Exclusive, )
{1}
This prevents the keyboard from working. To fix this issue, add this laptop
to the skip_override_table so that the kernel does not override IRQ 1.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217323
Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 6c5873f552e5e..a364cb07c5578 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -435,6 +435,13 @@ static const struct dmi_system_id asus_laptop[] = {
DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
},
},
+ {
+ .ident = "Asus ExpertBook B1502CBA",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "B1502CBA"),
+ },
+ },
{
.ident = "Asus ExpertBook B2402CBA",
.matches = {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 194/245] xhci: cleanup xhci_hub_control port references
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 193/245] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 195/245] xhci: move port specific items such as state completions to port structure Greg Kroah-Hartman
` (61 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit faaae0190dcd1e230616c85bbc3b339f27ba5b81 ]
Both port number and port structure of a port are referred to several
times when handing hub requests in xhci.
Use more suitable data types and readable names for these.
Cleanup only, no functional changes
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-6-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 123 ++++++++++++++++++------------------
1 file changed, 63 insertions(+), 60 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index b9754784161d7..3526665575af2 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1194,11 +1194,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
u16 test_mode = 0;
struct xhci_hub *rhub;
struct xhci_port **ports;
+ struct xhci_port *port;
+ int portnum1;
rhub = xhci_get_rhub(hcd);
ports = rhub->ports;
max_ports = rhub->num_ports;
bus_state = &rhub->bus_state;
+ portnum1 = wIndex & 0xff;
spin_lock_irqsave(&xhci->lock, flags);
switch (typeReq) {
@@ -1232,10 +1235,12 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
spin_unlock_irqrestore(&xhci->lock, flags);
return retval;
case GetPortStatus:
- if (!wIndex || wIndex > max_ports)
+ if (!portnum1 || portnum1 > max_ports)
goto error;
+
wIndex--;
- temp = readl(ports[wIndex]->addr);
+ port = ports[portnum1 - 1];
+ temp = readl(port->addr);
if (temp == ~(u32)0) {
xhci_hc_died(xhci);
retval = -ENODEV;
@@ -1248,7 +1253,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
goto error;
xhci_dbg(xhci, "Get port status %d-%d read: 0x%x, return 0x%x",
- hcd->self.busnum, wIndex + 1, temp, status);
+ hcd->self.busnum, portnum1, temp, status);
put_unaligned(cpu_to_le32(status), (__le32 *) buf);
/* if USB 3.1 extended port status return additional 4 bytes */
@@ -1260,7 +1265,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
retval = -EINVAL;
break;
}
- port_li = readl(ports[wIndex]->addr + PORTLI);
+ port_li = readl(port->addr + PORTLI);
status = xhci_get_ext_port_status(temp, port_li);
put_unaligned_le32(status, &buf[4]);
}
@@ -1274,11 +1279,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
test_mode = (wIndex & 0xff00) >> 8;
/* The MSB of wIndex is the U1/U2 timeout */
timeout = (wIndex & 0xff00) >> 8;
+
wIndex &= 0xff;
- if (!wIndex || wIndex > max_ports)
+ if (!portnum1 || portnum1 > max_ports)
goto error;
+
+ port = ports[portnum1 - 1];
wIndex--;
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
if (temp == ~(u32)0) {
xhci_hc_died(xhci);
retval = -ENODEV;
@@ -1288,11 +1296,10 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
/* FIXME: What new port features do we need to support? */
switch (wValue) {
case USB_PORT_FEAT_SUSPEND:
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
if ((temp & PORT_PLS_MASK) != XDEV_U0) {
/* Resume the port to U0 first */
- xhci_set_link_state(xhci, ports[wIndex],
- XDEV_U0);
+ xhci_set_link_state(xhci, port, XDEV_U0);
spin_unlock_irqrestore(&xhci->lock, flags);
msleep(10);
spin_lock_irqsave(&xhci->lock, flags);
@@ -1301,16 +1308,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
* a port unless the port reports that it is in the
* enabled (PED = ‘1’,PLS < ‘3’) state.
*/
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
if ((temp & PORT_PE) == 0 || (temp & PORT_RESET)
|| (temp & PORT_PLS_MASK) >= XDEV_U3) {
xhci_warn(xhci, "USB core suspending port %d-%d not in U0/U1/U2\n",
- hcd->self.busnum, wIndex + 1);
+ hcd->self.busnum, portnum1);
goto error;
}
slot_id = xhci_find_slot_id_by_port(hcd, xhci,
- wIndex + 1);
+ portnum1);
if (!slot_id) {
xhci_warn(xhci, "slot_id is zero\n");
goto error;
@@ -1320,21 +1327,21 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
xhci_stop_device(xhci, slot_id, 1);
spin_lock_irqsave(&xhci->lock, flags);
- xhci_set_link_state(xhci, ports[wIndex], XDEV_U3);
+ xhci_set_link_state(xhci, port, XDEV_U3);
spin_unlock_irqrestore(&xhci->lock, flags);
msleep(10); /* wait device to enter */
spin_lock_irqsave(&xhci->lock, flags);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
bus_state->suspended_ports |= 1 << wIndex;
break;
case USB_PORT_FEAT_LINK_STATE:
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
/* Disable port */
if (link_state == USB_SS_PORT_LS_SS_DISABLED) {
xhci_dbg(xhci, "Disable port %d-%d\n",
- hcd->self.busnum, wIndex + 1);
+ hcd->self.busnum, portnum1);
temp = xhci_port_state_to_neutral(temp);
/*
* Clear all change bits, so that we get a new
@@ -1343,18 +1350,17 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
temp |= PORT_CSC | PORT_PEC | PORT_WRC |
PORT_OCC | PORT_RC | PORT_PLC |
PORT_CEC;
- writel(temp | PORT_PE, ports[wIndex]->addr);
- temp = readl(ports[wIndex]->addr);
+ writel(temp | PORT_PE, port->addr);
+ temp = readl(port->addr);
break;
}
/* Put link in RxDetect (enable port) */
if (link_state == USB_SS_PORT_LS_RX_DETECT) {
xhci_dbg(xhci, "Enable port %d-%d\n",
- hcd->self.busnum, wIndex + 1);
- xhci_set_link_state(xhci, ports[wIndex],
- link_state);
- temp = readl(ports[wIndex]->addr);
+ hcd->self.busnum, portnum1);
+ xhci_set_link_state(xhci, port, link_state);
+ temp = readl(port->addr);
break;
}
@@ -1384,11 +1390,10 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
}
xhci_dbg(xhci, "Enable compliance mode transition for port %d-%d\n",
- hcd->self.busnum, wIndex + 1);
- xhci_set_link_state(xhci, ports[wIndex],
- link_state);
+ hcd->self.busnum, portnum1);
+ xhci_set_link_state(xhci, port, link_state);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
break;
}
/* Port must be enabled */
@@ -1399,8 +1404,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
/* Can't set port link state above '3' (U3) */
if (link_state > USB_SS_PORT_LS_U3) {
xhci_warn(xhci, "Cannot set port %d-%d link state %d\n",
- hcd->self.busnum, wIndex + 1,
- link_state);
+ hcd->self.busnum, portnum1, link_state);
goto error;
}
@@ -1425,8 +1429,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
reinit_completion(&bus_state->u3exit_done[wIndex]);
}
if (pls <= XDEV_U3) /* U1, U2, U3 */
- xhci_set_link_state(xhci, ports[wIndex],
- USB_SS_PORT_LS_U0);
+ xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U0);
if (!wait_u0) {
if (pls > XDEV_U3)
goto error;
@@ -1436,16 +1439,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
if (!wait_for_completion_timeout(&bus_state->u3exit_done[wIndex],
msecs_to_jiffies(500)))
xhci_dbg(xhci, "missing U0 port change event for port %d-%d\n",
- hcd->self.busnum, wIndex + 1);
+ hcd->self.busnum, portnum1);
spin_lock_irqsave(&xhci->lock, flags);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
break;
}
if (link_state == USB_SS_PORT_LS_U3) {
int retries = 16;
slot_id = xhci_find_slot_id_by_port(hcd, xhci,
- wIndex + 1);
+ portnum1);
if (slot_id) {
/* unlock to execute stop endpoint
* commands */
@@ -1454,16 +1457,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
xhci_stop_device(xhci, slot_id, 1);
spin_lock_irqsave(&xhci->lock, flags);
}
- xhci_set_link_state(xhci, ports[wIndex], USB_SS_PORT_LS_U3);
+ xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U3);
spin_unlock_irqrestore(&xhci->lock, flags);
while (retries--) {
usleep_range(4000, 8000);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
if ((temp & PORT_PLS_MASK) == XDEV_U3)
break;
}
spin_lock_irqsave(&xhci->lock, flags);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
bus_state->suspended_ports |= 1 << wIndex;
}
break;
@@ -1478,39 +1481,38 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
break;
case USB_PORT_FEAT_RESET:
temp = (temp | PORT_RESET);
- writel(temp, ports[wIndex]->addr);
+ writel(temp, port->addr);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
xhci_dbg(xhci, "set port reset, actual port %d-%d status = 0x%x\n",
- hcd->self.busnum, wIndex + 1, temp);
+ hcd->self.busnum, portnum1, temp);
break;
case USB_PORT_FEAT_REMOTE_WAKE_MASK:
- xhci_set_remote_wake_mask(xhci, ports[wIndex],
- wake_mask);
- temp = readl(ports[wIndex]->addr);
+ xhci_set_remote_wake_mask(xhci, port, wake_mask);
+ temp = readl(port->addr);
xhci_dbg(xhci, "set port remote wake mask, actual port %d-%d status = 0x%x\n",
- hcd->self.busnum, wIndex + 1, temp);
+ hcd->self.busnum, portnum1, temp);
break;
case USB_PORT_FEAT_BH_PORT_RESET:
temp |= PORT_WR;
- writel(temp, ports[wIndex]->addr);
- temp = readl(ports[wIndex]->addr);
+ writel(temp, port->addr);
+ temp = readl(port->addr);
break;
case USB_PORT_FEAT_U1_TIMEOUT:
if (hcd->speed < HCD_USB3)
goto error;
- temp = readl(ports[wIndex]->addr + PORTPMSC);
+ temp = readl(port->addr + PORTPMSC);
temp &= ~PORT_U1_TIMEOUT_MASK;
temp |= PORT_U1_TIMEOUT(timeout);
- writel(temp, ports[wIndex]->addr + PORTPMSC);
+ writel(temp, port->addr + PORTPMSC);
break;
case USB_PORT_FEAT_U2_TIMEOUT:
if (hcd->speed < HCD_USB3)
goto error;
- temp = readl(ports[wIndex]->addr + PORTPMSC);
+ temp = readl(port->addr + PORTPMSC);
temp &= ~PORT_U2_TIMEOUT_MASK;
temp |= PORT_U2_TIMEOUT(timeout);
- writel(temp, ports[wIndex]->addr + PORTPMSC);
+ writel(temp, port->addr + PORTPMSC);
break;
case USB_PORT_FEAT_TEST:
/* 4.19.6 Port Test Modes (USB2 Test Mode) */
@@ -1526,13 +1528,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
goto error;
}
/* unblock any posted writes */
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
break;
case ClearPortFeature:
- if (!wIndex || wIndex > max_ports)
+ if (!portnum1 || portnum1 > max_ports)
goto error;
+
+ port = ports[portnum1 - 1];
+
wIndex--;
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
if (temp == ~(u32)0) {
xhci_hc_died(xhci);
retval = -ENODEV;
@@ -1542,7 +1547,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
temp = xhci_port_state_to_neutral(temp);
switch (wValue) {
case USB_PORT_FEAT_SUSPEND:
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
xhci_dbg(xhci, "clear USB_PORT_FEAT_SUSPEND\n");
xhci_dbg(xhci, "PORTSC %04x\n", temp);
if (temp & PORT_RESET)
@@ -1553,20 +1558,18 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
set_bit(wIndex, &bus_state->resuming_ports);
usb_hcd_start_port_resume(&hcd->self, wIndex);
- xhci_set_link_state(xhci, ports[wIndex],
- XDEV_RESUME);
+ xhci_set_link_state(xhci, port, XDEV_RESUME);
spin_unlock_irqrestore(&xhci->lock, flags);
msleep(USB_RESUME_TIMEOUT);
spin_lock_irqsave(&xhci->lock, flags);
- xhci_set_link_state(xhci, ports[wIndex],
- XDEV_U0);
+ xhci_set_link_state(xhci, port, XDEV_U0);
clear_bit(wIndex, &bus_state->resuming_ports);
usb_hcd_end_port_resume(&hcd->self, wIndex);
}
bus_state->port_c_suspend |= 1 << wIndex;
slot_id = xhci_find_slot_id_by_port(hcd, xhci,
- wIndex + 1);
+ portnum1);
if (!slot_id) {
xhci_dbg(xhci, "slot_id is zero\n");
goto error;
@@ -1584,11 +1587,11 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
case USB_PORT_FEAT_C_PORT_LINK_STATE:
case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
xhci_clear_port_change_bit(xhci, wValue, wIndex,
- ports[wIndex]->addr, temp);
+ port->addr, temp);
break;
case USB_PORT_FEAT_ENABLE:
xhci_disable_port(hcd, xhci, wIndex,
- ports[wIndex]->addr, temp);
+ port->addr, temp);
break;
case USB_PORT_FEAT_POWER:
xhci_set_port_power(xhci, hcd, wIndex, false, &flags);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 195/245] xhci: move port specific items such as state completions to port structure
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 194/245] xhci: cleanup xhci_hub_control port references Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 196/245] xhci: rename resume_done to resume_timestamp Greg Kroah-Hartman
` (60 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit 2996e9fc00c378987c18ecbafe5624581b18c0d6 ]
Now that we have a port structure for each port it makes sense to
move per port variables, timestamps and completions there.
Get rid of storing bitfileds and arrays of port specific items per bus.
Move
unsigned long resume_done;
insigned long rexit_ports
struct completion rexit_done;
struct completion u3exit_done;
Rename rexit_ports to rexit_active, and remove a redundant hcd
speed check while checking if rexit_active is set.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-8-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 31 +++++++++++++++----------------
drivers/usb/host/xhci-mem.c | 10 +++-------
drivers/usb/host/xhci-ring.c | 13 ++++++-------
drivers/usb/host/xhci.h | 9 ++++-----
4 files changed, 28 insertions(+), 35 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 3526665575af2..7f0c9176b4951 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -924,7 +924,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
return -EINVAL;
}
/* did port event handler already start resume timing? */
- if (!bus_state->resume_done[wIndex]) {
+ if (!port->resume_done) {
/* If not, maybe we are in a host initated resume? */
if (test_bit(wIndex, &bus_state->resuming_ports)) {
/* Host initated resume doesn't time the resume
@@ -941,28 +941,27 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
msecs_to_jiffies(USB_RESUME_TIMEOUT);
set_bit(wIndex, &bus_state->resuming_ports);
- bus_state->resume_done[wIndex] = timeout;
+ port->resume_done = timeout;
mod_timer(&hcd->rh_timer, timeout);
usb_hcd_start_port_resume(&hcd->self, wIndex);
}
/* Has resume been signalled for USB_RESUME_TIME yet? */
- } else if (time_after_eq(jiffies, bus_state->resume_done[wIndex])) {
+ } else if (time_after_eq(jiffies, port->resume_done)) {
int time_left;
xhci_dbg(xhci, "resume USB2 port %d-%d\n",
hcd->self.busnum, wIndex + 1);
- bus_state->resume_done[wIndex] = 0;
+ port->resume_done = 0;
clear_bit(wIndex, &bus_state->resuming_ports);
-
- set_bit(wIndex, &bus_state->rexit_ports);
+ port->rexit_active = true;
xhci_test_and_clear_bit(xhci, port, PORT_PLC);
xhci_set_link_state(xhci, port, XDEV_U0);
spin_unlock_irqrestore(&xhci->lock, *flags);
time_left = wait_for_completion_timeout(
- &bus_state->rexit_done[wIndex],
+ &port->rexit_done,
msecs_to_jiffies(XHCI_MAX_REXIT_TIMEOUT_MS));
spin_lock_irqsave(&xhci->lock, *flags);
@@ -981,7 +980,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
xhci_warn(xhci, "Port resume timed out, port %d-%d: 0x%x\n",
hcd->self.busnum, wIndex + 1, port_status);
*status |= USB_PORT_STAT_SUSPEND;
- clear_bit(wIndex, &bus_state->rexit_ports);
+ port->rexit_active = false;
}
usb_hcd_end_port_resume(&hcd->self, wIndex);
@@ -1088,10 +1087,10 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
if (link_state == XDEV_U2)
*status |= USB_PORT_STAT_L1;
if (link_state == XDEV_U0) {
- if (bus_state->resume_done[portnum])
+ if (port->resume_done)
usb_hcd_end_port_resume(&port->rhub->hcd->self,
portnum);
- bus_state->resume_done[portnum] = 0;
+ port->resume_done = 0;
clear_bit(portnum, &bus_state->resuming_ports);
if (bus_state->suspended_ports & (1 << portnum)) {
bus_state->suspended_ports &= ~(1 << portnum);
@@ -1163,11 +1162,11 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
* Clear stale usb2 resume signalling variables in case port changed
* state during resume signalling. For example on error
*/
- if ((bus_state->resume_done[wIndex] ||
+ if ((port->resume_done ||
test_bit(wIndex, &bus_state->resuming_ports)) &&
(raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
(raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
- bus_state->resume_done[wIndex] = 0;
+ port->resume_done = 0;
clear_bit(wIndex, &bus_state->resuming_ports);
usb_hcd_end_port_resume(&hcd->self, wIndex);
}
@@ -1426,7 +1425,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
pls == XDEV_RESUME ||
pls == XDEV_RECOVERY) {
wait_u0 = true;
- reinit_completion(&bus_state->u3exit_done[wIndex]);
+ reinit_completion(&port->u3exit_done);
}
if (pls <= XDEV_U3) /* U1, U2, U3 */
xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U0);
@@ -1436,7 +1435,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
break;
}
spin_unlock_irqrestore(&xhci->lock, flags);
- if (!wait_for_completion_timeout(&bus_state->u3exit_done[wIndex],
+ if (!wait_for_completion_timeout(&port->u3exit_done,
msecs_to_jiffies(500)))
xhci_dbg(xhci, "missing U0 port change event for port %d-%d\n",
hcd->self.busnum, portnum1);
@@ -1675,8 +1674,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
if ((temp & mask) != 0 ||
(bus_state->port_c_suspend & 1 << i) ||
- (bus_state->resume_done[i] && time_after_eq(
- jiffies, bus_state->resume_done[i]))) {
+ (ports[i]->resume_done && time_after_eq(
+ jiffies, ports[i]->resume_done))) {
buf[(i + 1) / 8] |= 1 << (i + 1) % 8;
status = 1;
}
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 6444aef33cf08..f9e3aed40984b 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2318,6 +2318,9 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
xhci->hw_ports[i].addr = &xhci->op_regs->port_status_base +
NUM_PORT_REGS * i;
xhci->hw_ports[i].hw_portnum = i;
+
+ init_completion(&xhci->hw_ports[i].rexit_done);
+ init_completion(&xhci->hw_ports[i].u3exit_done);
}
xhci->rh_bw = kcalloc_node(num_ports, sizeof(*xhci->rh_bw), flags,
@@ -2587,13 +2590,6 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
*/
for (i = 0; i < MAX_HC_SLOTS; i++)
xhci->devs[i] = NULL;
- for (i = 0; i < USB_MAXCHILDREN; i++) {
- xhci->usb2_rhub.bus_state.resume_done[i] = 0;
- xhci->usb3_rhub.bus_state.resume_done[i] = 0;
- /* Only the USB 2.0 completions will ever be used. */
- init_completion(&xhci->usb2_rhub.bus_state.rexit_done[i]);
- init_completion(&xhci->usb3_rhub.bus_state.u3exit_done[i]);
- }
if (scratchpad_alloc(xhci, flags))
goto fail;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 945ed5f3e8588..8038dced215c7 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1987,7 +1987,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
goto cleanup;
} else if (!test_bit(hcd_portnum, &bus_state->resuming_ports)) {
xhci_dbg(xhci, "resume HS port %d\n", port_id);
- bus_state->resume_done[hcd_portnum] = jiffies +
+ port->resume_done = jiffies +
msecs_to_jiffies(USB_RESUME_TIMEOUT);
set_bit(hcd_portnum, &bus_state->resuming_ports);
/* Do the rest in GetPortStatus after resume time delay.
@@ -1996,7 +1996,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
*/
set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
mod_timer(&hcd->rh_timer,
- bus_state->resume_done[hcd_portnum]);
+ port->resume_done);
usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
bogus_port_status = true;
}
@@ -2008,7 +2008,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
(portsc & PORT_PLS_MASK) == XDEV_U1 ||
(portsc & PORT_PLS_MASK) == XDEV_U2)) {
xhci_dbg(xhci, "resume SS port %d finished\n", port_id);
- complete(&bus_state->u3exit_done[hcd_portnum]);
+ complete(&port->u3exit_done);
/* We've just brought the device into U0/1/2 through either the
* Resume state after a device remote wakeup, or through the
* U3Exit state after a host-initiated resume. If it's a device
@@ -2033,10 +2033,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
* RExit to a disconnect state). If so, let the the driver know it's
* out of the RExit state.
*/
- if (!DEV_SUPERSPEED_ANY(portsc) && hcd->speed < HCD_USB3 &&
- test_and_clear_bit(hcd_portnum,
- &bus_state->rexit_ports)) {
- complete(&bus_state->rexit_done[hcd_portnum]);
+ if (hcd->speed < HCD_USB3 && port->rexit_active) {
+ complete(&port->rexit_done);
+ port->rexit_active = false;
bogus_port_status = true;
goto cleanup;
}
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 64278cd77f988..22ffbeaa51eb6 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1708,13 +1708,8 @@ struct xhci_bus_state {
u32 port_c_suspend;
u32 suspended_ports;
u32 port_remote_wakeup;
- unsigned long resume_done[USB_MAXCHILDREN];
/* which ports have started to resume */
unsigned long resuming_ports;
- /* Which ports are waiting on RExit to U0 transition. */
- unsigned long rexit_ports;
- struct completion rexit_done[USB_MAXCHILDREN];
- struct completion u3exit_done[USB_MAXCHILDREN];
};
@@ -1738,6 +1733,10 @@ struct xhci_port {
struct xhci_hub *rhub;
struct xhci_port_cap *port_cap;
unsigned int lpm_incapable:1;
+ unsigned long resume_done;
+ bool rexit_active;
+ struct completion rexit_done;
+ struct completion u3exit_done;
};
struct xhci_hub {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 196/245] xhci: rename resume_done to resume_timestamp
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 195/245] xhci: move port specific items such as state completions to port structure Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 197/245] xhci: clear usb2 resume related variables in one place Greg Kroah-Hartman
` (59 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit a909d629ae77b97b6288bc3cfe68560454bf79c6 ]
resume_done is just a timestamp, avoid confusing it with completions
related to port state transitions that are named *_done
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-10-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 20 ++++++++++----------
drivers/usb/host/xhci-ring.c | 4 ++--
drivers/usb/host/xhci.h | 2 +-
3 files changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 7f0c9176b4951..d3d3dadaca10b 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -924,7 +924,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
return -EINVAL;
}
/* did port event handler already start resume timing? */
- if (!port->resume_done) {
+ if (!port->resume_timestamp) {
/* If not, maybe we are in a host initated resume? */
if (test_bit(wIndex, &bus_state->resuming_ports)) {
/* Host initated resume doesn't time the resume
@@ -941,18 +941,18 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
msecs_to_jiffies(USB_RESUME_TIMEOUT);
set_bit(wIndex, &bus_state->resuming_ports);
- port->resume_done = timeout;
+ port->resume_timestamp = timeout;
mod_timer(&hcd->rh_timer, timeout);
usb_hcd_start_port_resume(&hcd->self, wIndex);
}
/* Has resume been signalled for USB_RESUME_TIME yet? */
- } else if (time_after_eq(jiffies, port->resume_done)) {
+ } else if (time_after_eq(jiffies, port->resume_timestamp)) {
int time_left;
xhci_dbg(xhci, "resume USB2 port %d-%d\n",
hcd->self.busnum, wIndex + 1);
- port->resume_done = 0;
+ port->resume_timestamp = 0;
clear_bit(wIndex, &bus_state->resuming_ports);
port->rexit_active = true;
@@ -1087,10 +1087,10 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
if (link_state == XDEV_U2)
*status |= USB_PORT_STAT_L1;
if (link_state == XDEV_U0) {
- if (port->resume_done)
+ if (port->resume_timestamp)
usb_hcd_end_port_resume(&port->rhub->hcd->self,
portnum);
- port->resume_done = 0;
+ port->resume_timestamp = 0;
clear_bit(portnum, &bus_state->resuming_ports);
if (bus_state->suspended_ports & (1 << portnum)) {
bus_state->suspended_ports &= ~(1 << portnum);
@@ -1162,11 +1162,11 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
* Clear stale usb2 resume signalling variables in case port changed
* state during resume signalling. For example on error
*/
- if ((port->resume_done ||
+ if ((port->resume_timestamp ||
test_bit(wIndex, &bus_state->resuming_ports)) &&
(raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
(raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
- port->resume_done = 0;
+ port->resume_timestamp = 0;
clear_bit(wIndex, &bus_state->resuming_ports);
usb_hcd_end_port_resume(&hcd->self, wIndex);
}
@@ -1674,8 +1674,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
if ((temp & mask) != 0 ||
(bus_state->port_c_suspend & 1 << i) ||
- (ports[i]->resume_done && time_after_eq(
- jiffies, ports[i]->resume_done))) {
+ (ports[i]->resume_timestamp && time_after_eq(
+ jiffies, ports[i]->resume_timestamp))) {
buf[(i + 1) / 8] |= 1 << (i + 1) % 8;
status = 1;
}
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 8038dced215c7..aa12da0796d2d 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1987,7 +1987,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
goto cleanup;
} else if (!test_bit(hcd_portnum, &bus_state->resuming_ports)) {
xhci_dbg(xhci, "resume HS port %d\n", port_id);
- port->resume_done = jiffies +
+ port->resume_timestamp = jiffies +
msecs_to_jiffies(USB_RESUME_TIMEOUT);
set_bit(hcd_portnum, &bus_state->resuming_ports);
/* Do the rest in GetPortStatus after resume time delay.
@@ -1996,7 +1996,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
*/
set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
mod_timer(&hcd->rh_timer,
- port->resume_done);
+ port->resume_timestamp);
usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
bogus_port_status = true;
}
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 22ffbeaa51eb6..8ae33db1e4bcc 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1733,7 +1733,7 @@ struct xhci_port {
struct xhci_hub *rhub;
struct xhci_port_cap *port_cap;
unsigned int lpm_incapable:1;
- unsigned long resume_done;
+ unsigned long resume_timestamp;
bool rexit_active;
struct completion rexit_done;
struct completion u3exit_done;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 197/245] xhci: clear usb2 resume related variables in one place.
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 196/245] xhci: rename resume_done to resume_timestamp Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 198/245] xhci: decouple usb2 port resume and get_port_status request handling Greg Kroah-Hartman
` (58 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit 0e6275452ce26d7ff274a5c1b15ed581a26f7986 ]
Initially resume related USB2 variables were cleared once port
successfully resumed to U0. Later code was added to clean up
stale resume variables in case of port failed to resume to U0.
Clear the variables in one place after port is no longer resuming
or in suspended U3 state.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-11-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 38 ++++++++++++++++---------------------
1 file changed, 16 insertions(+), 22 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index d3d3dadaca10b..660a7d0f79a42 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1071,7 +1071,6 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
struct xhci_bus_state *bus_state;
u32 link_state;
u32 portnum;
- int ret;
bus_state = &port->rhub->bus_state;
link_state = portsc & PORT_PLS_MASK;
@@ -1087,23 +1086,30 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
if (link_state == XDEV_U2)
*status |= USB_PORT_STAT_L1;
if (link_state == XDEV_U0) {
- if (port->resume_timestamp)
- usb_hcd_end_port_resume(&port->rhub->hcd->self,
- portnum);
- port->resume_timestamp = 0;
- clear_bit(portnum, &bus_state->resuming_ports);
if (bus_state->suspended_ports & (1 << portnum)) {
bus_state->suspended_ports &= ~(1 << portnum);
bus_state->port_c_suspend |= 1 << portnum;
}
}
if (link_state == XDEV_RESUME) {
- ret = xhci_handle_usb2_port_link_resume(port, status,
- portsc, flags);
- if (ret)
- return;
+ xhci_handle_usb2_port_link_resume(port, status, portsc,
+ flags);
}
}
+
+ /*
+ * Clear usb2 resume signalling variables if port is no longer suspended
+ * or resuming. Port either resumed to U0/U1/U2, disconnected, or in a
+ * error state. Resume related variables should be cleared in all those cases.
+ */
+ if ((link_state != XDEV_U3 &&
+ link_state != XDEV_RESUME) &&
+ (port->resume_timestamp ||
+ test_bit(portnum, &bus_state->resuming_ports))) {
+ port->resume_timestamp = 0;
+ clear_bit(portnum, &bus_state->resuming_ports);
+ usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
+ }
}
/*
@@ -1158,18 +1164,6 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
else
xhci_get_usb2_port_status(port, &status, raw_port_status,
flags);
- /*
- * Clear stale usb2 resume signalling variables in case port changed
- * state during resume signalling. For example on error
- */
- if ((port->resume_timestamp ||
- test_bit(wIndex, &bus_state->resuming_ports)) &&
- (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
- (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
- port->resume_timestamp = 0;
- clear_bit(wIndex, &bus_state->resuming_ports);
- usb_hcd_end_port_resume(&hcd->self, wIndex);
- }
if (bus_state->port_c_suspend & (1 << wIndex))
status |= USB_PORT_STAT_C_SUSPEND << 16;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 198/245] xhci: decouple usb2 port resume and get_port_status request handling
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 197/245] xhci: clear usb2 resume related variables in one place Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 199/245] xhci: track port suspend state correctly in unsuccessful resume cases Greg Kroah-Hartman
` (57 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit b0425784b942fffbbdb804896197f1dbccda37c5 ]
The get port status hub request code in xhci-hub.c will complete usb2
port resume signalling if signalling has been going on for long enough.
The code that completes the resume signalling, and the code that returns
the port status have gotten too intertwined, so separate them a bit.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-12-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 47 ++++++++++++++++++++-----------------
1 file changed, 25 insertions(+), 22 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 660a7d0f79a42..56c600be272a6 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -905,7 +905,7 @@ static void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status,
}
static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
- u32 *status, u32 portsc,
+ u32 portsc,
unsigned long *flags)
{
struct xhci_bus_state *bus_state;
@@ -920,7 +920,6 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
wIndex = port->hcd_portnum;
if ((portsc & PORT_RESET) || !(portsc & PORT_PE)) {
- *status = 0xffffffff;
return -EINVAL;
}
/* did port event handler already start resume timing? */
@@ -954,6 +953,8 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
port->resume_timestamp = 0;
clear_bit(wIndex, &bus_state->resuming_ports);
+
+ reinit_completion(&port->rexit_done);
port->rexit_active = true;
xhci_test_and_clear_bit(xhci, port, PORT_PLC);
@@ -970,7 +971,6 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
wIndex + 1);
if (!slot_id) {
xhci_dbg(xhci, "slot_id is zero\n");
- *status = 0xffffffff;
return -ENODEV;
}
xhci_ring_device(xhci, slot_id);
@@ -979,22 +979,19 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
xhci_warn(xhci, "Port resume timed out, port %d-%d: 0x%x\n",
hcd->self.busnum, wIndex + 1, port_status);
- *status |= USB_PORT_STAT_SUSPEND;
- port->rexit_active = false;
+ /*
+ * keep rexit_active set if U0 transition failed so we
+ * know to report PORT_STAT_SUSPEND status back to
+ * usbcore. It will be cleared later once the port is
+ * out of RESUME/U3 state
+ */
}
usb_hcd_end_port_resume(&hcd->self, wIndex);
bus_state->port_c_suspend |= 1 << wIndex;
bus_state->suspended_ports &= ~(1 << wIndex);
- } else {
- /*
- * The resume has been signaling for less than
- * USB_RESUME_TIME. Report the port status as SUSPEND,
- * let the usbcore check port status again and clear
- * resume signaling later.
- */
- *status |= USB_PORT_STAT_SUSPEND;
}
+
return 0;
}
@@ -1071,6 +1068,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
struct xhci_bus_state *bus_state;
u32 link_state;
u32 portnum;
+ int err;
bus_state = &port->rhub->bus_state;
link_state = portsc & PORT_PLS_MASK;
@@ -1092,8 +1090,12 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
}
}
if (link_state == XDEV_RESUME) {
- xhci_handle_usb2_port_link_resume(port, status, portsc,
- flags);
+ err = xhci_handle_usb2_port_link_resume(port, portsc,
+ flags);
+ if (err < 0)
+ *status = 0xffffffff;
+ else if (port->resume_timestamp || port->rexit_active)
+ *status |= USB_PORT_STAT_SUSPEND;
}
}
@@ -1102,13 +1104,14 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
* or resuming. Port either resumed to U0/U1/U2, disconnected, or in a
* error state. Resume related variables should be cleared in all those cases.
*/
- if ((link_state != XDEV_U3 &&
- link_state != XDEV_RESUME) &&
- (port->resume_timestamp ||
- test_bit(portnum, &bus_state->resuming_ports))) {
- port->resume_timestamp = 0;
- clear_bit(portnum, &bus_state->resuming_ports);
- usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
+ if (link_state != XDEV_U3 && link_state != XDEV_RESUME) {
+ if (port->resume_timestamp ||
+ test_bit(portnum, &bus_state->resuming_ports)) {
+ port->resume_timestamp = 0;
+ clear_bit(portnum, &bus_state->resuming_ports);
+ usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
+ }
+ port->rexit_active = 0;
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 199/245] xhci: track port suspend state correctly in unsuccessful resume cases
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 198/245] xhci: decouple usb2 port resume and get_port_status request handling Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 200/245] cifs: add a warning when the in-flight count goes negative Greg Kroah-Hartman
` (56 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wesley Cheng, Mathias Nyman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit d7cdfc319b2bcf6899ab0a05eec0958bc802a9a1 ]
xhci-hub.c tracks suspended ports in a suspended_port bitfield.
This is checked when responding to a Get_Status(PORT) request to see if a
port in running U0 state was recently resumed, and adds the required
USB_PORT_STAT_C_SUSPEND change bit in those cases.
The suspended_port bit was left uncleared if a device is disconnected
during suspend. The bit remained set even when a new device was connected
and enumerated. The set bit resulted in a incorrect Get_Status(PORT)
response with a bogus USB_PORT_STAT_C_SUSPEND change
bit set once the new device reached U0 link state.
USB_PORT_STAT_C_SUSPEND change bit is only used for USB2 ports, but
xhci-hub keeps track of both USB2 and USB3 suspended ports.
Cc: stable@vger.kernel.org
Reported-by: Wesley Cheng <quic_wcheng@quicinc.com>
Closes: https://lore.kernel.org/linux-usb/d68aa806-b26a-0e43-42fb-b8067325e967@quicinc.com/
Fixes: 1d5810b6923c ("xhci: Rework port suspend structures for limited ports.")
Tested-by: Wesley Cheng <quic_wcheng@quicinc.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230915143108.1532163-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 56c600be272a6..723201394eaa8 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1043,19 +1043,19 @@ static void xhci_get_usb3_port_status(struct xhci_port *port, u32 *status,
*status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
/* USB3 specific wPortStatus bits */
- if (portsc & PORT_POWER) {
+ if (portsc & PORT_POWER)
*status |= USB_SS_PORT_STAT_POWER;
- /* link state handling */
- if (link_state == XDEV_U0)
- bus_state->suspended_ports &= ~(1 << portnum);
- }
- /* remote wake resume signaling complete */
- if (bus_state->port_remote_wakeup & (1 << portnum) &&
+ /* no longer suspended or resuming */
+ if (link_state != XDEV_U3 &&
link_state != XDEV_RESUME &&
link_state != XDEV_RECOVERY) {
- bus_state->port_remote_wakeup &= ~(1 << portnum);
- usb_hcd_end_port_resume(&hcd->self, portnum);
+ /* remote wake resume signaling complete */
+ if (bus_state->port_remote_wakeup & (1 << portnum)) {
+ bus_state->port_remote_wakeup &= ~(1 << portnum);
+ usb_hcd_end_port_resume(&hcd->self, portnum);
+ }
+ bus_state->suspended_ports &= ~(1 << portnum);
}
xhci_hub_report_usb3_link_state(xhci, status, portsc);
@@ -1112,6 +1112,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
}
port->rexit_active = 0;
+ bus_state->suspended_ports &= ~(1 << portnum);
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 200/245] cifs: add a warning when the in-flight count goes negative
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 199/245] xhci: track port suspend state correctly in unsuccessful resume cases Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 201/245] IB/hfi1: Fix a memleak in init_credit_return Greg Kroah-Hartman
` (55 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shyam Prasad N, Bharath SM,
Steve French, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <sprasad@microsoft.com>
[ Upstream commit e4645cc2f1e2d6f268bb8dcfac40997c52432aed ]
We've seen the in-flight count go into negative with some
internal stress testing in Microsoft.
Adding a WARN when this happens, in hope of understanding
why this happens when it happens.
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Reviewed-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/smb2ops.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index a8f33e8261344..b725bd3144fb7 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -85,6 +85,7 @@ smb2_add_credits(struct TCP_Server_Info *server,
*val = 65000; /* Don't get near 64K credits, avoid srv bugs */
pr_warn_once("server overflowed SMB3 credits\n");
}
+ WARN_ON_ONCE(server->in_flight == 0);
server->in_flight--;
if (server->in_flight == 0 &&
((optype & CIFS_OP_MASK) != CIFS_NEG_OP) &&
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 201/245] IB/hfi1: Fix a memleak in init_credit_return
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 200/245] cifs: add a warning when the in-flight count goes negative Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 202/245] RDMA/bnxt_re: Return error for SRQ resize Greg Kroah-Hartman
` (54 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhipeng Lu, Dennis Dalessandro,
Leon Romanovsky, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <alexious@zju.edu.cn>
[ Upstream commit 809aa64ebff51eb170ee31a95f83b2d21efa32e2 ]
When dma_alloc_coherent fails to allocate dd->cr_base[i].va,
init_credit_return should deallocate dd->cr_base and
dd->cr_base[i] that allocated before. Or those resources
would be never freed and a memleak is triggered.
Fixes: 7724105686e7 ("IB/hfi1: add driver files")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Link: https://lore.kernel.org/r/20240112085523.3731720-1-alexious@zju.edu.cn
Acked-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/pio.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
index 51ae58c02b15c..802b0e5801a7d 100644
--- a/drivers/infiniband/hw/hfi1/pio.c
+++ b/drivers/infiniband/hw/hfi1/pio.c
@@ -2089,7 +2089,7 @@ int init_credit_return(struct hfi1_devdata *dd)
"Unable to allocate credit return DMA range for NUMA %d\n",
i);
ret = -ENOMEM;
- goto done;
+ goto free_cr_base;
}
}
set_dev_node(&dd->pcidev->dev, dd->node);
@@ -2097,6 +2097,10 @@ int init_credit_return(struct hfi1_devdata *dd)
ret = 0;
done:
return ret;
+
+free_cr_base:
+ free_credit_return(dd);
+ goto done;
}
void free_credit_return(struct hfi1_devdata *dd)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 202/245] RDMA/bnxt_re: Return error for SRQ resize
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 201/245] IB/hfi1: Fix a memleak in init_credit_return Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 203/245] RDMA/irdma: Fix KASAN issue with tasklet Greg Kroah-Hartman
` (53 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kalesh AP, Selvin Xavier,
Leon Romanovsky, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
[ Upstream commit 3687b450c5f32e80f179ce4b09e0454da1449eac ]
SRQ resize is not supported in the driver. But driver is not
returning error from bnxt_re_modify_srq() for SRQ resize.
Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters")
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Link: https://lore.kernel.org/r/1705985677-15551-5-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 87ee616e69384..91b71fa3c1216 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -1705,7 +1705,7 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,
switch (srq_attr_mask) {
case IB_SRQ_MAX_WR:
/* SRQ resize is not supported */
- break;
+ return -EINVAL;
case IB_SRQ_LIMIT:
/* Change the SRQ threshold */
if (srq_attr->srq_limit > srq->qplib_srq.max_wqe)
@@ -1720,13 +1720,12 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,
/* On success, update the shadow */
srq->srq_limit = srq_attr->srq_limit;
/* No need to Build and send response back to udata */
- break;
+ return 0;
default:
ibdev_err(&rdev->ibdev,
"Unsupported srq_attr_mask 0x%x", srq_attr_mask);
return -EINVAL;
}
- return 0;
}
int bnxt_re_query_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 203/245] RDMA/irdma: Fix KASAN issue with tasklet
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 202/245] RDMA/bnxt_re: Return error for SRQ resize Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 204/245] RDMA/irdma: Validate max_send_wr and max_recv_wr Greg Kroah-Hartman
` (52 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Marciniszyn, Shiraz Saleem,
Sindhu Devale, Leon Romanovsky, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <mike.marciniszyn@intel.com>
[ Upstream commit bd97cea7b18a0a553773af806dfbfac27a7c4acb ]
KASAN testing revealed the following issue assocated with freeing an IRQ.
[50006.466686] Call Trace:
[50006.466691] <IRQ>
[50006.489538] dump_stack+0x5c/0x80
[50006.493475] print_address_description.constprop.6+0x1a/0x150
[50006.499872] ? irdma_sc_process_ceq+0x483/0x790 [irdma]
[50006.505742] ? irdma_sc_process_ceq+0x483/0x790 [irdma]
[50006.511644] kasan_report.cold.11+0x7f/0x118
[50006.516572] ? irdma_sc_process_ceq+0x483/0x790 [irdma]
[50006.522473] irdma_sc_process_ceq+0x483/0x790 [irdma]
[50006.528232] irdma_process_ceq+0xb2/0x400 [irdma]
[50006.533601] ? irdma_hw_flush_wqes_callback+0x370/0x370 [irdma]
[50006.540298] irdma_ceq_dpc+0x44/0x100 [irdma]
[50006.545306] tasklet_action_common.isra.14+0x148/0x2c0
[50006.551096] __do_softirq+0x1d0/0xaf8
[50006.555396] irq_exit_rcu+0x219/0x260
[50006.559670] irq_exit+0xa/0x20
[50006.563320] smp_apic_timer_interrupt+0x1bf/0x690
[50006.568645] apic_timer_interrupt+0xf/0x20
[50006.573341] </IRQ>
The issue is that a tasklet could be pending on another core racing
the delete of the irq.
Fix by insuring any scheduled tasklet is killed after deleting the
irq.
Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions")
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Sindhu Devale <sindhu.devale@intel.com>
Link: https://lore.kernel.org/r/20240131233849.400285-2-sindhu.devale@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/hw.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c
index 0359f415280c8..21d55a12ebd9f 100644
--- a/drivers/infiniband/hw/irdma/hw.c
+++ b/drivers/infiniband/hw/irdma/hw.c
@@ -562,6 +562,13 @@ static void irdma_destroy_irq(struct irdma_pci_f *rf,
dev->irq_ops->irdma_dis_irq(dev, msix_vec->idx);
irq_set_affinity_hint(msix_vec->irq, NULL);
free_irq(msix_vec->irq, dev_id);
+ if (rf == dev_id) {
+ tasklet_kill(&rf->dpc_tasklet);
+ } else {
+ struct irdma_ceq *iwceq = (struct irdma_ceq *)dev_id;
+
+ tasklet_kill(&iwceq->dpc_tasklet);
+ }
}
/**
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 204/245] RDMA/irdma: Validate max_send_wr and max_recv_wr
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 203/245] RDMA/irdma: Fix KASAN issue with tasklet Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 205/245] RDMA/irdma: Set the CQ read threshold for GEN 1 Greg Kroah-Hartman
` (51 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shiraz Saleem, Sindhu Devale,
Leon Romanovsky, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiraz Saleem <shiraz.saleem@intel.com>
[ Upstream commit ee107186bcfd25d7873258f3f75440e20f5e6416 ]
Validate that max_send_wr and max_recv_wr is within the
supported range.
Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Change-Id: I2fc8b10292b641fddd20b36986a9dae90a93f4be
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Sindhu Devale <sindhu.devale@intel.com>
Link: https://lore.kernel.org/r/20240131233849.400285-3-sindhu.devale@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/verbs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index 8981bf834a581..c15af65cba333 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -749,7 +749,9 @@ static int irdma_validate_qp_attrs(struct ib_qp_init_attr *init_attr,
if (init_attr->cap.max_inline_data > uk_attrs->max_hw_inline ||
init_attr->cap.max_send_sge > uk_attrs->max_hw_wq_frags ||
- init_attr->cap.max_recv_sge > uk_attrs->max_hw_wq_frags)
+ init_attr->cap.max_recv_sge > uk_attrs->max_hw_wq_frags ||
+ init_attr->cap.max_send_wr > uk_attrs->max_hw_wq_quanta ||
+ init_attr->cap.max_recv_wr > uk_attrs->max_hw_rq_quanta)
return -EINVAL;
if (rdma_protocol_roce(&iwdev->ibdev, 1)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 205/245] RDMA/irdma: Set the CQ read threshold for GEN 1
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 204/245] RDMA/irdma: Validate max_send_wr and max_recv_wr Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 206/245] RDMA/irdma: Add AE for too many RNRS Greg Kroah-Hartman
` (50 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mustafa Ismail, Shiraz Saleem,
Sindhu Devale, Leon Romanovsky, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mustafa Ismail <mustafa.ismail@intel.com>
[ Upstream commit 666047f3ece9f991774c1fe9b223139a9ef8908d ]
The CQ shadow read threshold is currently not set for GEN 2. This could
cause an invalid CQ overflow condition, so remove the GEN check that
exclused GEN 1.
Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Sindhu Devale <sindhu.devale@intel.com>
Link: https://lore.kernel.org/r/20240131233849.400285-4-sindhu.devale@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/verbs.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index c15af65cba333..d43833e141a02 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -2076,9 +2076,8 @@ static int irdma_create_cq(struct ib_cq *ibcq,
info.cq_base_pa = iwcq->kmem.pa;
}
- if (dev->hw_attrs.uk_attrs.hw_rev >= IRDMA_GEN_2)
- info.shadow_read_threshold = min(info.cq_uk_init_info.cq_size / 2,
- (u32)IRDMA_MAX_CQ_READ_THRESH);
+ info.shadow_read_threshold = min(info.cq_uk_init_info.cq_size / 2,
+ (u32)IRDMA_MAX_CQ_READ_THRESH);
if (irdma_sc_cq_init(cq, &info)) {
ibdev_dbg(&iwdev->ibdev, "VERBS: init cq fail\n");
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 206/245] RDMA/irdma: Add AE for too many RNRS
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 205/245] RDMA/irdma: Set the CQ read threshold for GEN 1 Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 207/245] RDMA/srpt: Support specifying the srpt_service_guid parameter Greg Kroah-Hartman
` (49 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mustafa Ismail, Shiraz Saleem,
Sindhu Devale, Leon Romanovsky, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mustafa Ismail <mustafa.ismail@intel.com>
[ Upstream commit 630bdb6f28ca9e5ff79e244030170ac788478332 ]
Add IRDMA_AE_LLP_TOO_MANY_RNRS to the list of AE's processed as an
abnormal asyncronous event.
Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Sindhu Devale <sindhu.devale@gmail.com>
Link: https://lore.kernel.org/r/20240131233849.400285-5-sindhu.devale@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/defs.h | 1 +
drivers/infiniband/hw/irdma/hw.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/infiniband/hw/irdma/defs.h b/drivers/infiniband/hw/irdma/defs.h
index afd16a93ac69c..504449fc36c28 100644
--- a/drivers/infiniband/hw/irdma/defs.h
+++ b/drivers/infiniband/hw/irdma/defs.h
@@ -345,6 +345,7 @@ enum irdma_cqp_op_type {
#define IRDMA_AE_LLP_TOO_MANY_KEEPALIVE_RETRIES 0x050b
#define IRDMA_AE_LLP_DOUBT_REACHABILITY 0x050c
#define IRDMA_AE_LLP_CONNECTION_ESTABLISHED 0x050e
+#define IRDMA_AE_LLP_TOO_MANY_RNRS 0x050f
#define IRDMA_AE_RESOURCE_EXHAUSTION 0x0520
#define IRDMA_AE_RESET_SENT 0x0601
#define IRDMA_AE_TERMINATE_SENT 0x0602
diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c
index 21d55a12ebd9f..8781638d74272 100644
--- a/drivers/infiniband/hw/irdma/hw.c
+++ b/drivers/infiniband/hw/irdma/hw.c
@@ -379,6 +379,7 @@ static void irdma_process_aeq(struct irdma_pci_f *rf)
case IRDMA_AE_LLP_TOO_MANY_RETRIES:
case IRDMA_AE_LCE_QP_CATASTROPHIC:
case IRDMA_AE_LCE_FUNCTION_CATASTROPHIC:
+ case IRDMA_AE_LLP_TOO_MANY_RNRS:
case IRDMA_AE_LCE_CQ_CATASTROPHIC:
case IRDMA_AE_UDA_XMIT_DGRAM_TOO_LONG:
default:
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 207/245] RDMA/srpt: Support specifying the srpt_service_guid parameter
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 206/245] RDMA/irdma: Add AE for too many RNRS Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 208/245] RDMA/qedr: Fix qedr_create_user_qp error flow Greg Kroah-Hartman
` (48 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, LiHonggang, Bart Van Assche,
Leon Romanovsky, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit fdfa083549de5d50ebf7f6811f33757781e838c0 ]
Make loading ib_srpt with this parameter set work. The current behavior is
that setting that parameter while loading the ib_srpt kernel module
triggers the following kernel crash:
BUG: kernel NULL pointer dereference, address: 0000000000000000
Call Trace:
<TASK>
parse_one+0x18c/0x1d0
parse_args+0xe1/0x230
load_module+0x8de/0xa60
init_module_from_file+0x8b/0xd0
idempotent_init_module+0x181/0x240
__x64_sys_finit_module+0x5a/0xb0
do_syscall_64+0x5f/0xe0
entry_SYSCALL_64_after_hwframe+0x6e/0x76
Cc: LiHonggang <honggangli@163.com>
Reported-by: LiHonggang <honggangli@163.com>
Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20240205004207.17031-1-bvanassche@acm.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/srpt/ib_srpt.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 38494943bd748..deb834a7d75cd 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -79,12 +79,16 @@ module_param(srpt_srq_size, int, 0444);
MODULE_PARM_DESC(srpt_srq_size,
"Shared receive queue (SRQ) size.");
+static int srpt_set_u64_x(const char *buffer, const struct kernel_param *kp)
+{
+ return kstrtou64(buffer, 16, (u64 *)kp->arg);
+}
static int srpt_get_u64_x(char *buffer, const struct kernel_param *kp)
{
return sprintf(buffer, "0x%016llx\n", *(u64 *)kp->arg);
}
-module_param_call(srpt_service_guid, NULL, srpt_get_u64_x, &srpt_service_guid,
- 0444);
+module_param_call(srpt_service_guid, srpt_set_u64_x, srpt_get_u64_x,
+ &srpt_service_guid, 0444);
MODULE_PARM_DESC(srpt_service_guid,
"Using this value for ioc_guid, id_ext, and cm_listen_id instead of using the node_guid of the first HCA.");
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 208/245] RDMA/qedr: Fix qedr_create_user_qp error flow
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 207/245] RDMA/srpt: Support specifying the srpt_service_guid parameter Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 209/245] arm64: dts: rockchip: set num-cs property for spi on px30 Greg Kroah-Hartman
` (47 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kamal Heib, Leon Romanovsky,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Heib <kheib@redhat.com>
[ Upstream commit 5ba4e6d5863c53e937f49932dee0ecb004c65928 ]
Avoid the following warning by making sure to free the allocated
resources in case that qedr_init_user_queue() fail.
-----------[ cut here ]-----------
WARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]
Modules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3
ghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt]
CPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1
Hardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022
RIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]
Code: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 <0f> 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff
RSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286
RAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016
RDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80
R13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0
Call Trace:
<TASK>
? show_trace_log_lvl+0x1c4/0x2df
? show_trace_log_lvl+0x1c4/0x2df
? ib_uverbs_close+0x1f/0xb0 [ib_uverbs]
? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]
? __warn+0x81/0x110
? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]
? report_bug+0x10a/0x140
? handle_bug+0x3c/0x70
? exc_invalid_op+0x14/0x70
? asm_exc_invalid_op+0x16/0x20
? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]
ib_uverbs_close+0x1f/0xb0 [ib_uverbs]
__fput+0x94/0x250
task_work_run+0x5c/0x90
do_exit+0x270/0x4a0
do_group_exit+0x2d/0x90
get_signal+0x87c/0x8c0
arch_do_signal_or_restart+0x25/0x100
? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs]
exit_to_user_mode_loop+0x9c/0x130
exit_to_user_mode_prepare+0xb6/0x100
syscall_exit_to_user_mode+0x12/0x40
do_syscall_64+0x69/0x90
? syscall_exit_work+0x103/0x130
? syscall_exit_to_user_mode+0x22/0x40
? do_syscall_64+0x69/0x90
? syscall_exit_work+0x103/0x130
? syscall_exit_to_user_mode+0x22/0x40
? do_syscall_64+0x69/0x90
? do_syscall_64+0x69/0x90
? common_interrupt+0x43/0xa0
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x1470abe3ec6b
Code: Unable to access opcode bytes at RIP 0x1470abe3ec41.
RSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b
RDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004
RBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00
R10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358
R13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470
</TASK>
--[ end trace 888a9b92e04c5c97 ]--
Fixes: df15856132bc ("RDMA/qedr: restructure functions that create/destroy QPs")
Signed-off-by: Kamal Heib <kheib@redhat.com>
Link: https://lore.kernel.org/r/20240208223628.2040841-1-kheib@redhat.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/qedr/verbs.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index bb0c2b93a34d8..c0993e3bad12d 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -1888,8 +1888,17 @@ static int qedr_create_user_qp(struct qedr_dev *dev,
/* RQ - read access only (0) */
rc = qedr_init_user_queue(udata, dev, &qp->urq, ureq.rq_addr,
ureq.rq_len, true, 0, alloc_and_init);
- if (rc)
+ if (rc) {
+ ib_umem_release(qp->usq.umem);
+ qp->usq.umem = NULL;
+ if (rdma_protocol_roce(&dev->ibdev, 1)) {
+ qedr_free_pbl(dev, &qp->usq.pbl_info,
+ qp->usq.pbl_tbl);
+ } else {
+ kfree(qp->usq.pbl_tbl);
+ }
return rc;
+ }
}
memset(&in_params, 0, sizeof(in_params));
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 209/245] arm64: dts: rockchip: set num-cs property for spi on px30
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 208/245] RDMA/qedr: Fix qedr_create_user_qp error flow Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 210/245] RDMA/srpt: fix function pointer cast warnings Greg Kroah-Hartman
` (46 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiko Stuebner, Quentin Schulz,
Heiko Stuebner, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Stuebner <heiko.stuebner@cherry.de>
[ Upstream commit 334bf0710c98d391f4067b72f535d6c4c84dfb6f ]
The px30 has two spi controllers with two chip-selects each.
The num-cs property is specified as the total number of chip
selects a controllers has and is used since 2020 to find uses
of chipselects outside that range in the Rockchip spi driver.
Without the property set, the default is 1, so spi devices
using the second chipselect will not be created.
Fixes: eb1262e3cc8b ("spi: spi-rockchip: use num-cs property and ctlr->enable_gpiods")
Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
Reviewed-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Link: https://lore.kernel.org/r/20240119101656.965744-1-heiko@sntech.de
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/px30.dtsi | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/rockchip/px30.dtsi b/arch/arm64/boot/dts/rockchip/px30.dtsi
index 5200d0bbd9e9c..b2dae28a98502 100644
--- a/arch/arm64/boot/dts/rockchip/px30.dtsi
+++ b/arch/arm64/boot/dts/rockchip/px30.dtsi
@@ -585,6 +585,7 @@
clock-names = "spiclk", "apb_pclk";
dmas = <&dmac 12>, <&dmac 13>;
dma-names = "tx", "rx";
+ num-cs = <2>;
pinctrl-names = "default";
pinctrl-0 = <&spi0_clk &spi0_csn &spi0_miso &spi0_mosi>;
#address-cells = <1>;
@@ -600,6 +601,7 @@
clock-names = "spiclk", "apb_pclk";
dmas = <&dmac 14>, <&dmac 15>;
dma-names = "tx", "rx";
+ num-cs = <2>;
pinctrl-names = "default";
pinctrl-0 = <&spi1_clk &spi1_csn0 &spi1_csn1 &spi1_miso &spi1_mosi>;
#address-cells = <1>;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 210/245] RDMA/srpt: fix function pointer cast warnings
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 209/245] arm64: dts: rockchip: set num-cs property for spi on px30 Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 211/245] bpf, scripts: Correct GPL license name Greg Kroah-Hartman
` (45 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Bart Van Assche,
Leon Romanovsky, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit eb5c7465c3240151cd42a55c7ace9da0026308a1 ]
clang-16 notices that srpt_qp_event() gets called through an incompatible
pointer here:
drivers/infiniband/ulp/srpt/ib_srpt.c:1815:5: error: cast from 'void (*)(struct ib_event *, struct srpt_rdma_ch *)' to 'void (*)(struct ib_event *, void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
1815 | = (void(*)(struct ib_event *, void*))srpt_qp_event;
Change srpt_qp_event() to use the correct prototype and adjust the
argument inside of it.
Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20240213100728.458348-1-arnd@kernel.org
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index deb834a7d75cd..60f9c612eb3c3 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -214,10 +214,12 @@ static const char *get_ch_state_name(enum rdma_ch_state s)
/**
* srpt_qp_event - QP event callback function
* @event: Description of the event that occurred.
- * @ch: SRPT RDMA channel.
+ * @ptr: SRPT RDMA channel.
*/
-static void srpt_qp_event(struct ib_event *event, struct srpt_rdma_ch *ch)
+static void srpt_qp_event(struct ib_event *event, void *ptr)
{
+ struct srpt_rdma_ch *ch = ptr;
+
pr_debug("QP event %d on ch=%p sess_name=%s-%d state=%s\n",
event->event, ch, ch->sess_name, ch->qp->qp_num,
get_ch_state_name(ch->state));
@@ -1811,8 +1813,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
ch->cq_size = ch->rq_size + sq_size;
qp_init->qp_context = (void *)ch;
- qp_init->event_handler
- = (void(*)(struct ib_event *, void*))srpt_qp_event;
+ qp_init->event_handler = srpt_qp_event;
qp_init->send_cq = ch->cq;
qp_init->recv_cq = ch->cq;
qp_init->sq_sig_type = IB_SIGNAL_REQ_WR;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 211/245] bpf, scripts: Correct GPL license name
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 210/245] RDMA/srpt: fix function pointer cast warnings Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 212/245] scsi: jazz_esp: Only build if SCSI core is builtin Greg Kroah-Hartman
` (44 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gianmarco Lusvardi, Daniel Borkmann,
Quentin Monnet, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gianmarco Lusvardi <glusvardi@posteo.net>
[ Upstream commit e37243b65d528a8a9f8b9a57a43885f8e8dfc15c ]
The bpf_doc script refers to the GPL as the "GNU Privacy License".
I strongly suspect that the author wanted to refer to the GNU General
Public License, under which the Linux kernel is released, as, to the
best of my knowledge, there is no license named "GNU Privacy License".
This patch corrects the license name in the script accordingly.
Fixes: 56a092c89505 ("bpf: add script and prepare bpf.h for new helpers documentation")
Signed-off-by: Gianmarco Lusvardi <glusvardi@posteo.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Quentin Monnet <quentin@isovalent.com>
Link: https://lore.kernel.org/bpf/20240213230544.930018-3-glusvardi@posteo.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/bpf_doc.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/bpf_doc.py b/scripts/bpf_doc.py
index 00ac7b79cddb4..7772c6424089e 100755
--- a/scripts/bpf_doc.py
+++ b/scripts/bpf_doc.py
@@ -369,7 +369,7 @@ eBPF programs can have an associated license, passed along with the bytecode
instructions to the kernel when the programs are loaded. The format for that
string is identical to the one in use for kernel modules (Dual licenses, such
as "Dual BSD/GPL", may be used). Some helper functions are only accessible to
-programs that are compatible with the GNU Privacy License (GPL).
+programs that are compatible with the GNU General Public License (GNU GPL).
In order to use such helpers, the eBPF program must be loaded with the correct
license string passed (via **attr**) to the **bpf**\ () system call, and this
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 212/245] scsi: jazz_esp: Only build if SCSI core is builtin
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 211/245] bpf, scripts: Correct GPL license name Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 213/245] nouveau: fix function cast warnings Greg Kroah-Hartman
` (43 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Thomas Bogendoerfer,
linux-mips, Arnd Bergmann, Masahiro Yamada, Nicolas Schier,
James E.J. Bottomley, Martin K. Petersen, linux-scsi,
Geert Uytterhoeven, kernel test robot, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 9ddf190a7df77b77817f955fdb9c2ae9d1c9c9a3 ]
JAZZ_ESP is a bool kconfig symbol that selects SCSI_SPI_ATTRS. When
CONFIG_SCSI=m, this results in SCSI_SPI_ATTRS=m while JAZZ_ESP=y, which
causes many undefined symbol linker errors.
Fix this by only offering to build this driver when CONFIG_SCSI=y.
[mkp: JAZZ_ESP is unique in that it does not support being compiled as a
module unlike the remaining SPI SCSI HBA drivers]
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20240214055953.9612-1-rdunlap@infradead.org
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: linux-mips@vger.kernel.org
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Cc: Nicolas Schier <nicolas@fjasle.eu>
Cc: James E.J. Bottomley <jejb@linux.ibm.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202402112222.Gl0udKyU-lkp@intel.com/
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index eea574e89b872..43e6f86e08c33 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1296,7 +1296,7 @@ source "drivers/scsi/arm/Kconfig"
config JAZZ_ESP
bool "MIPS JAZZ FAS216 SCSI support"
- depends on MACH_JAZZ && SCSI
+ depends on MACH_JAZZ && SCSI=y
select SCSI_SPI_ATTRS
help
This is the driver for the onboard SCSI host adapter of MIPS Magnum
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 213/245] nouveau: fix function cast warnings
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 212/245] scsi: jazz_esp: Only build if SCSI core is builtin Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 214/245] net: stmmac: Fix incorrect dereference in interrupt handlers Greg Kroah-Hartman
` (42 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Danilo Krummrich,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 0affdba22aca5573f9d989bcb1d71d32a6a03efe ]
clang-16 warns about casting between incompatible function types:
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c:161:10: error: cast from 'void (*)(const struct firmware *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
161 | .fini = (void(*)(void *))release_firmware,
This one was done to use the generic shadow_fw_release() function as a
callback for struct nvbios_source. Change it to use the same prototype
as the other five instances, with a trivial helper function that actually
calls release_firmware.
Fixes: 70c0f263cc2e ("drm/nouveau/bios: pull in basic vbios subdev, more to come later")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Danilo Krummrich <dakr@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240213095753.455062-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
index 4b571cc6bc70f..6597def18627e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
@@ -154,11 +154,17 @@ shadow_fw_init(struct nvkm_bios *bios, const char *name)
return (void *)fw;
}
+static void
+shadow_fw_release(void *fw)
+{
+ release_firmware(fw);
+}
+
static const struct nvbios_source
shadow_fw = {
.name = "firmware",
.init = shadow_fw_init,
- .fini = (void(*)(void *))release_firmware,
+ .fini = shadow_fw_release,
.read = shadow_fw_read,
.rw = false,
};
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 214/245] net: stmmac: Fix incorrect dereference in interrupt handlers
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 213/245] nouveau: fix function cast warnings Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 215/245] ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid Greg Kroah-Hartman
` (41 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Sakharov, Serge Semin,
David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Sakharov <p.sakharov@ispras.ru>
[ Upstream commit 97dde84026339e4b4af9a6301f825d1828d7874b ]
If 'dev' or 'data' is NULL, the 'priv' variable has an incorrect address
when dereferencing calling netdev_err().
Since we get as 'dev_id' or 'data' what was passed as the 'dev' argument
to request_irq() during interrupt initialization (that is, the net_device
and rx/tx queue pointers initialized at the time of the call) and since
there are usually no checks for the 'dev_id' argument in such handlers
in other drivers, remove these checks from the handlers in stmmac driver.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 8532f613bc78 ("net: stmmac: introduce MSI Interrupt routines for mac, safety, RX & TX")
Signed-off-by: Pavel Sakharov <p.sakharov@ispras.ru>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/stmicro/stmmac/stmmac_main.c | 20 -------------------
1 file changed, 20 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index ab3ded6e0e6a3..a1c1e353ca072 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5737,11 +5737,6 @@ static irqreturn_t stmmac_mac_interrupt(int irq, void *dev_id)
struct net_device *dev = (struct net_device *)dev_id;
struct stmmac_priv *priv = netdev_priv(dev);
- if (unlikely(!dev)) {
- netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__);
- return IRQ_NONE;
- }
-
/* Check if adapter is up */
if (test_bit(STMMAC_DOWN, &priv->state))
return IRQ_HANDLED;
@@ -5757,11 +5752,6 @@ static irqreturn_t stmmac_safety_interrupt(int irq, void *dev_id)
struct net_device *dev = (struct net_device *)dev_id;
struct stmmac_priv *priv = netdev_priv(dev);
- if (unlikely(!dev)) {
- netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__);
- return IRQ_NONE;
- }
-
/* Check if adapter is up */
if (test_bit(STMMAC_DOWN, &priv->state))
return IRQ_HANDLED;
@@ -5781,11 +5771,6 @@ static irqreturn_t stmmac_msi_intr_tx(int irq, void *data)
priv = container_of(tx_q, struct stmmac_priv, tx_queue[chan]);
- if (unlikely(!data)) {
- netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__);
- return IRQ_NONE;
- }
-
/* Check if adapter is up */
if (test_bit(STMMAC_DOWN, &priv->state))
return IRQ_HANDLED;
@@ -5824,11 +5809,6 @@ static irqreturn_t stmmac_msi_intr_rx(int irq, void *data)
priv = container_of(rx_q, struct stmmac_priv, rx_queue[chan]);
- if (unlikely(!data)) {
- netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__);
- return IRQ_NONE;
- }
-
/* Check if adapter is up */
if (test_bit(STMMAC_DOWN, &priv->state))
return IRQ_HANDLED;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 215/245] ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 214/245] net: stmmac: Fix incorrect dereference in interrupt handlers Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 216/245] ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid Greg Kroah-Hartman
` (40 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Nicolas Dichtel,
David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 081a0e3b0d4c061419d3f4679dec9f68725b17e4 ]
net->dev_base_seq and ipv4.dev_addr_genid are monotonically increasing.
If we XOR their values, we could miss to detect if both values
were changed with the same amount.
Fixes: 0465277f6b3f ("ipv4: provide addr and netconf dump consistency info")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/devinet.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index c511751c2f41a..425dfa8e4fd0a 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1797,6 +1797,21 @@ static int in_dev_dump_addr(struct in_device *in_dev, struct sk_buff *skb,
return err;
}
+/* Combine dev_addr_genid and dev_base_seq to detect changes.
+ */
+static u32 inet_base_seq(const struct net *net)
+{
+ u32 res = atomic_read(&net->ipv4.dev_addr_genid) +
+ net->dev_base_seq;
+
+ /* Must not return 0 (see nl_dump_check_consistent()).
+ * Chose a value far away from 0.
+ */
+ if (!res)
+ res = 0x80000000;
+ return res;
+}
+
static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
{
const struct nlmsghdr *nlh = cb->nlh;
@@ -1848,8 +1863,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
idx = 0;
head = &tgt_net->dev_index_head[h];
rcu_read_lock();
- cb->seq = atomic_read(&tgt_net->ipv4.dev_addr_genid) ^
- tgt_net->dev_base_seq;
+ cb->seq = inet_base_seq(tgt_net);
hlist_for_each_entry_rcu(dev, head, index_hlist) {
if (idx < s_idx)
goto cont;
@@ -2250,8 +2264,7 @@ static int inet_netconf_dump_devconf(struct sk_buff *skb,
idx = 0;
head = &net->dev_index_head[h];
rcu_read_lock();
- cb->seq = atomic_read(&net->ipv4.dev_addr_genid) ^
- net->dev_base_seq;
+ cb->seq = inet_base_seq(net);
hlist_for_each_entry_rcu(dev, head, index_hlist) {
if (idx < s_idx)
goto cont;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 216/245] ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 215/245] ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 217/245] ata: libahci_platform: Convert to using devm bulk clocks API Greg Kroah-Hartman
` (39 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Nicolas Dichtel,
David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e898e4cd1aab271ca414f9ac6e08e4c761f6913c ]
net->dev_base_seq and ipv6.dev_addr_genid are monotonically increasing.
If we XOR their values, we could miss to detect if both values
were changed with the same amount.
Fixes: 63998ac24f83 ("ipv6: provide addr and netconf dump consistency info")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 1e4eedf7f2129..c52317184e3e2 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -707,6 +707,22 @@ static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
return err;
}
+/* Combine dev_addr_genid and dev_base_seq to detect changes.
+ */
+static u32 inet6_base_seq(const struct net *net)
+{
+ u32 res = atomic_read(&net->ipv6.dev_addr_genid) +
+ net->dev_base_seq;
+
+ /* Must not return 0 (see nl_dump_check_consistent()).
+ * Chose a value far away from 0.
+ */
+ if (!res)
+ res = 0x80000000;
+ return res;
+}
+
+
static int inet6_netconf_dump_devconf(struct sk_buff *skb,
struct netlink_callback *cb)
{
@@ -740,8 +756,7 @@ static int inet6_netconf_dump_devconf(struct sk_buff *skb,
idx = 0;
head = &net->dev_index_head[h];
rcu_read_lock();
- cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^
- net->dev_base_seq;
+ cb->seq = inet6_base_seq(net);
hlist_for_each_entry_rcu(dev, head, index_hlist) {
if (idx < s_idx)
goto cont;
@@ -5316,7 +5331,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
}
rcu_read_lock();
- cb->seq = atomic_read(&tgt_net->ipv6.dev_addr_genid) ^ tgt_net->dev_base_seq;
+ cb->seq = inet6_base_seq(tgt_net);
for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
idx = 0;
head = &tgt_net->dev_index_head[h];
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 217/245] ata: libahci_platform: Convert to using devm bulk clocks API
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 216/245] ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 218/245] ata: libahci_platform: Introduce reset assertion/deassertion methods Greg Kroah-Hartman
` (38 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Serge Semin, Hannes Reinecke,
Damien Le Moal, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
[ Upstream commit e28b3abf8020a884bd3b7758ea8915365af8fadf ]
In order to simplify the clock-related code there is a way to convert the
current fixed clocks array into using the common bulk clocks kernel API
with dynamic set of the clock handlers and device-managed clock-resource
tracking. It's a bit tricky due to the complication coming from the
requirement to support the platforms (da850, spear13xx) with the
non-OF-based clock source, but still doable.
Before this modification there are two methods have been used to get the
clocks connected to an AHCI device: clk_get() - to get the very first
clock in the list and of_clk_get() - to get the rest of them. Basically
the platforms with non-OF-based clocks definition could specify only a
single reference clock source. The platforms with OF-hw clocks have been
luckier and could setup up to AHCI_MAX_CLKS clocks. Such semantic can be
retained with using devm_clk_bulk_get_all() to retrieve the clocks defined
via the DT firmware and devm_clk_get_optional() otherwise. In both cases
using the device-managed version of the methods will cause the automatic
resources deallocation on the AHCI device removal event. The only
complicated part in the suggested approach is the explicit allocation and
initialization of the clk_bulk_data structure instance for the non-OF
reference clocks. It's required in order to use the Bulk Clocks API for
the both denoted cases of the clocks definition.
Note aside with the clock-related code reduction and natural
simplification, there are several bonuses the suggested modification
provides. First of all the limitation of having no greater than
AHCI_MAX_CLKS clocks is now removed, since the devm_clk_bulk_get_all()
method will allocate as many reference clocks data descriptors as there
are clocks specified for the device. Secondly the clock names are
auto-detected. So the LLDD (glue) drivers can make sure that the required
clocks are specified just by checking the clock IDs in the clk_bulk_data
array. Thirdly using the handy Bulk Clocks kernel API improves the
clocks-handling code readability. And the last but not least this
modification implements a true optional clocks support to the
ahci_platform_get_resources() method. Indeed the previous clocks getting
procedure just stopped getting the clocks on any errors (aside from
non-critical -EPROBE_DEFER) in a way so the callee wasn't even informed
about abnormal loop termination. The new implementation lacks of such
problem. The ahci_platform_get_resources() will return an error code if
the corresponding clocks getting method ends execution abnormally.
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Stable-dep-of: 26c8404e162b ("ata: ahci_ceva: fix error handling for Xilinx GT PHY support")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/ahci.h | 4 +-
drivers/ata/ahci_da850.c | 47 ++++++++-----------
drivers/ata/ahci_dm816.c | 4 +-
drivers/ata/libahci_platform.c | 83 ++++++++++++++++------------------
4 files changed, 61 insertions(+), 77 deletions(-)
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 69557e602e2ea..54e79f966444c 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -39,7 +39,6 @@
enum {
AHCI_MAX_PORTS = 32,
- AHCI_MAX_CLKS = 5,
AHCI_MAX_SG = 168, /* hardware max is 64K */
AHCI_DMA_BOUNDARY = 0xffffffff,
AHCI_MAX_CMDS = 32,
@@ -343,7 +342,8 @@ struct ahci_host_priv {
u32 em_msg_type; /* EM message type */
u32 remapped_nvme; /* NVMe remapped device count */
bool got_runtime_pm; /* Did we do pm_runtime_get? */
- struct clk *clks[AHCI_MAX_CLKS]; /* Optional */
+ unsigned int n_clks;
+ struct clk_bulk_data *clks; /* Optional */
struct reset_control *rsts; /* Optional */
struct regulator **target_pwrs; /* Optional */
struct regulator *ahci_regulator;/* Optional */
diff --git a/drivers/ata/ahci_da850.c b/drivers/ata/ahci_da850.c
index 0e82766007128..389268c1ef456 100644
--- a/drivers/ata/ahci_da850.c
+++ b/drivers/ata/ahci_da850.c
@@ -163,7 +163,6 @@ static int ahci_da850_probe(struct platform_device *pdev)
struct ahci_host_priv *hpriv;
void __iomem *pwrdn_reg;
struct resource *res;
- struct clk *clk;
u32 mpy;
int rc;
@@ -172,36 +171,28 @@ static int ahci_da850_probe(struct platform_device *pdev)
return PTR_ERR(hpriv);
/*
- * Internally ahci_platform_get_resources() calls clk_get(dev, NULL)
- * when trying to obtain the functional clock. This SATA controller
- * uses two clocks for which we specify two connection ids. If we don't
- * have the functional clock at this point - call clk_get() again with
- * con_id = "fck".
+ * Internally ahci_platform_get_resources() calls the bulk clocks
+ * get method or falls back to using a single clk_get_optional().
+ * This AHCI SATA controller uses two clocks: functional clock
+ * with "fck" connection id and external reference clock with
+ * "refclk" id. If we haven't got all of them re-try the clocks
+ * getting procedure with the explicitly specified ids.
*/
- if (!hpriv->clks[0]) {
- clk = clk_get(dev, "fck");
- if (IS_ERR(clk))
- return PTR_ERR(clk);
-
- hpriv->clks[0] = clk;
- }
-
- /*
- * The second clock used by ahci-da850 is the external REFCLK. If we
- * didn't get it from ahci_platform_get_resources(), let's try to
- * specify the con_id in clk_get().
- */
- if (!hpriv->clks[1]) {
- clk = clk_get(dev, "refclk");
- if (IS_ERR(clk)) {
- dev_err(dev, "unable to obtain the reference clock");
- return -ENODEV;
- }
-
- hpriv->clks[1] = clk;
+ if (hpriv->n_clks < 2) {
+ hpriv->clks = devm_kcalloc(dev, 2, sizeof(*hpriv->clks), GFP_KERNEL);
+ if (!hpriv->clks)
+ return -ENOMEM;
+
+ hpriv->clks[0].id = "fck";
+ hpriv->clks[1].id = "refclk";
+ hpriv->n_clks = 2;
+
+ rc = devm_clk_bulk_get(dev, hpriv->n_clks, hpriv->clks);
+ if (rc)
+ return rc;
}
- mpy = ahci_da850_calculate_mpy(clk_get_rate(hpriv->clks[1]));
+ mpy = ahci_da850_calculate_mpy(clk_get_rate(hpriv->clks[1].clk));
if (mpy == 0) {
dev_err(dev, "invalid REFCLK multiplier value: 0x%x", mpy);
return -EINVAL;
diff --git a/drivers/ata/ahci_dm816.c b/drivers/ata/ahci_dm816.c
index 8bec410416714..ec83ba8858060 100644
--- a/drivers/ata/ahci_dm816.c
+++ b/drivers/ata/ahci_dm816.c
@@ -69,12 +69,12 @@ static int ahci_dm816_phy_init(struct ahci_host_priv *hpriv, struct device *dev)
* keep-alive clock and the external reference clock. We need the
* rate of the latter to calculate the correct value of MPY bits.
*/
- if (!hpriv->clks[1]) {
+ if (hpriv->n_clks < 2) {
dev_err(dev, "reference clock not supplied\n");
return -EINVAL;
}
- refclk_rate = clk_get_rate(hpriv->clks[1]);
+ refclk_rate = clk_get_rate(hpriv->clks[1].clk);
if ((refclk_rate % 100) != 0) {
dev_err(dev, "reference clock rate must be divisible by 100\n");
return -EINVAL;
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 64d6da0a53035..6ae1d8b870a2d 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -97,28 +97,14 @@ EXPORT_SYMBOL_GPL(ahci_platform_disable_phys);
* ahci_platform_enable_clks - Enable platform clocks
* @hpriv: host private area to store config values
*
- * This function enables all the clks found in hpriv->clks, starting at
- * index 0. If any clk fails to enable it disables all the clks already
- * enabled in reverse order, and then returns an error.
+ * This function enables all the clks found for the AHCI device.
*
* RETURNS:
* 0 on success otherwise a negative error code
*/
int ahci_platform_enable_clks(struct ahci_host_priv *hpriv)
{
- int c, rc;
-
- for (c = 0; c < AHCI_MAX_CLKS && hpriv->clks[c]; c++) {
- rc = clk_prepare_enable(hpriv->clks[c]);
- if (rc)
- goto disable_unprepare_clk;
- }
- return 0;
-
-disable_unprepare_clk:
- while (--c >= 0)
- clk_disable_unprepare(hpriv->clks[c]);
- return rc;
+ return clk_bulk_prepare_enable(hpriv->n_clks, hpriv->clks);
}
EXPORT_SYMBOL_GPL(ahci_platform_enable_clks);
@@ -126,16 +112,13 @@ EXPORT_SYMBOL_GPL(ahci_platform_enable_clks);
* ahci_platform_disable_clks - Disable platform clocks
* @hpriv: host private area to store config values
*
- * This function disables all the clks found in hpriv->clks, in reverse
- * order of ahci_platform_enable_clks (starting at the end of the array).
+ * This function disables all the clocks enabled before
+ * (bulk-clocks-disable function is supposed to do that in reverse
+ * from the enabling procedure order).
*/
void ahci_platform_disable_clks(struct ahci_host_priv *hpriv)
{
- int c;
-
- for (c = AHCI_MAX_CLKS - 1; c >= 0; c--)
- if (hpriv->clks[c])
- clk_disable_unprepare(hpriv->clks[c]);
+ clk_bulk_disable_unprepare(hpriv->n_clks, hpriv->clks);
}
EXPORT_SYMBOL_GPL(ahci_platform_disable_clks);
@@ -292,8 +275,6 @@ static void ahci_platform_put_resources(struct device *dev, void *res)
pm_runtime_disable(dev);
}
- for (c = 0; c < AHCI_MAX_CLKS && hpriv->clks[c]; c++)
- clk_put(hpriv->clks[c]);
/*
* The regulators are tied to child node device and not to the
* SATA device itself. So we can't use devm for automatically
@@ -374,8 +355,8 @@ static int ahci_platform_get_regulator(struct ahci_host_priv *hpriv, u32 port,
* 1) mmio registers (IORESOURCE_MEM 0, mandatory)
* 2) regulator for controlling the targets power (optional)
* regulator for controlling the AHCI controller (optional)
- * 3) 0 - AHCI_MAX_CLKS clocks, as specified in the devs devicetree node,
- * or for non devicetree enabled platforms a single clock
+ * 3) all clocks specified in the devicetree node, or a single
+ * clock for non-OF platforms (optional)
* 4) resets, if flags has AHCI_PLATFORM_GET_RESETS (optional)
* 5) phys (optional)
*
@@ -385,11 +366,10 @@ static int ahci_platform_get_regulator(struct ahci_host_priv *hpriv, u32 port,
struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev,
unsigned int flags)
{
+ int child_nodes, rc = -ENOMEM, enabled_ports = 0;
struct device *dev = &pdev->dev;
struct ahci_host_priv *hpriv;
- struct clk *clk;
struct device_node *child;
- int i, enabled_ports = 0, rc = -ENOMEM, child_nodes;
u32 mask_port_map = 0;
if (!devres_open_group(dev, NULL, GFP_KERNEL))
@@ -409,25 +389,38 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev,
goto err_out;
}
- for (i = 0; i < AHCI_MAX_CLKS; i++) {
+ /*
+ * Bulk clocks getting procedure can fail to find any clock due to
+ * running on a non-OF platform or due to the clocks being defined in
+ * bypass of the DT firmware (like da850, spear13xx). In that case we
+ * fallback to getting a single clock source right from the dev clocks
+ * list.
+ */
+ rc = devm_clk_bulk_get_all(dev, &hpriv->clks);
+ if (rc < 0)
+ goto err_out;
+
+ if (rc > 0) {
+ /* Got clocks in bulk */
+ hpriv->n_clks = rc;
+ } else {
/*
- * For now we must use clk_get(dev, NULL) for the first clock,
- * because some platforms (da850, spear13xx) are not yet
- * converted to use devicetree for clocks. For new platforms
- * this is equivalent to of_clk_get(dev->of_node, 0).
+ * No clock bulk found: fallback to manually getting
+ * the optional clock.
*/
- if (i == 0)
- clk = clk_get(dev, NULL);
- else
- clk = of_clk_get(dev->of_node, i);
-
- if (IS_ERR(clk)) {
- rc = PTR_ERR(clk);
- if (rc == -EPROBE_DEFER)
- goto err_out;
- break;
+ hpriv->clks = devm_kzalloc(dev, sizeof(*hpriv->clks), GFP_KERNEL);
+ if (!hpriv->clks) {
+ rc = -ENOMEM;
+ goto err_out;
+ }
+ hpriv->clks->clk = devm_clk_get_optional(dev, NULL);
+ if (IS_ERR(hpriv->clks->clk)) {
+ rc = PTR_ERR(hpriv->clks->clk);
+ goto err_out;
+ } else if (hpriv->clks->clk) {
+ hpriv->clks->id = "ahci";
+ hpriv->n_clks = 1;
}
- hpriv->clks[i] = clk;
}
hpriv->ahci_regulator = devm_regulator_get(dev, "ahci");
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 218/245] ata: libahci_platform: Introduce reset assertion/deassertion methods
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 217/245] ata: libahci_platform: Convert to using devm bulk clocks API Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 219/245] ata: ahci_ceva: fix error handling for Xilinx GT PHY support Greg Kroah-Hartman
` (37 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Serge Semin, Hannes Reinecke,
Damien Le Moal, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
[ Upstream commit f67f12ff57bcfcd7d64280f748787793217faeaf ]
Currently the ACHI-platform library supports only the assert and deassert
reset signals and ignores the platforms with self-deasserting reset lines.
That prone to having the platforms with self-deasserting reset method
misbehaviour when it comes to resuming from sleep state after the clocks
have been fully disabled. For such cases the controller needs to be fully
reset all over after the reference clocks are enabled and stable,
otherwise the controller state machine might be in an undetermined state.
The best solution would be to auto-detect which reset method is supported
by the particular platform and use it implicitly in the framework of the
ahci_platform_enable_resources()/ahci_platform_disable_resources()
methods. Alas it can't be implemented due to the AHCI-platform library
already supporting the shared reset control lines. As [1] says in such
case we have to use only one of the next methods:
+ reset_control_assert()/reset_control_deassert();
+ reset_control_reset()/reset_control_rearm().
If the driver had an exclusive control over the reset lines we could have
been able to manipulate the lines with no much limitation and just used
the combination of the methods above to cover all the possible
reset-control cases. Since the shared reset control has already been
advertised and couldn't be changed with no risk to breaking the platforms
relying on it, we have no choice but to make the platform drivers to
determine which reset methods the platform reset system supports.
In order to implement both types of reset control support we suggest to
introduce the new AHCI-platform flag: AHCI_PLATFORM_RST_TRIGGER, which
when passed to the ahci_platform_get_resources() method together with the
AHCI_PLATFORM_GET_RESETS flag will indicate that the reset lines are
self-deasserting thus the reset_control_reset()/reset_control_rearm() will
be used to control the reset state. Otherwise the
reset_control_deassert()/reset_control_assert() methods will be utilized.
[1] Documentation/driver-api/reset.rst
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Stable-dep-of: 26c8404e162b ("ata: ahci_ceva: fix error handling for Xilinx GT PHY support")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/ahci.h | 1 +
drivers/ata/libahci_platform.c | 50 ++++++++++++++++++++++++++++++----
include/linux/ahci_platform.h | 5 +++-
3 files changed, 50 insertions(+), 6 deletions(-)
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 54e79f966444c..b4c59fe2db60a 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -344,6 +344,7 @@ struct ahci_host_priv {
bool got_runtime_pm; /* Did we do pm_runtime_get? */
unsigned int n_clks;
struct clk_bulk_data *clks; /* Optional */
+ unsigned int f_rsts;
struct reset_control *rsts; /* Optional */
struct regulator **target_pwrs; /* Optional */
struct regulator *ahci_regulator;/* Optional */
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 6ae1d8b870a2d..43380d1a410e2 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -122,6 +122,44 @@ void ahci_platform_disable_clks(struct ahci_host_priv *hpriv)
}
EXPORT_SYMBOL_GPL(ahci_platform_disable_clks);
+/**
+ * ahci_platform_deassert_rsts - Deassert/trigger platform resets
+ * @hpriv: host private area to store config values
+ *
+ * This function deasserts or triggers all the reset lines found for
+ * the AHCI device.
+ *
+ * RETURNS:
+ * 0 on success otherwise a negative error code
+ */
+int ahci_platform_deassert_rsts(struct ahci_host_priv *hpriv)
+{
+ if (hpriv->f_rsts & AHCI_PLATFORM_RST_TRIGGER)
+ return reset_control_reset(hpriv->rsts);
+
+ return reset_control_deassert(hpriv->rsts);
+}
+EXPORT_SYMBOL_GPL(ahci_platform_deassert_rsts);
+
+/**
+ * ahci_platform_assert_rsts - Assert/rearm platform resets
+ * @hpriv: host private area to store config values
+ *
+ * This function asserts or rearms (for self-deasserting resets) all
+ * the reset controls found for the AHCI device.
+ *
+ * RETURNS:
+ * 0 on success otherwise a negative error code
+ */
+int ahci_platform_assert_rsts(struct ahci_host_priv *hpriv)
+{
+ if (hpriv->f_rsts & AHCI_PLATFORM_RST_TRIGGER)
+ return reset_control_rearm(hpriv->rsts);
+
+ return reset_control_assert(hpriv->rsts);
+}
+EXPORT_SYMBOL_GPL(ahci_platform_assert_rsts);
+
/**
* ahci_platform_enable_regulators - Enable regulators
* @hpriv: host private area to store config values
@@ -219,18 +257,18 @@ int ahci_platform_enable_resources(struct ahci_host_priv *hpriv)
if (rc)
goto disable_regulator;
- rc = reset_control_deassert(hpriv->rsts);
+ rc = ahci_platform_deassert_rsts(hpriv);
if (rc)
goto disable_clks;
rc = ahci_platform_enable_phys(hpriv);
if (rc)
- goto disable_resets;
+ goto disable_rsts;
return 0;
-disable_resets:
- reset_control_assert(hpriv->rsts);
+disable_rsts:
+ ahci_platform_assert_rsts(hpriv);
disable_clks:
ahci_platform_disable_clks(hpriv);
@@ -257,7 +295,7 @@ void ahci_platform_disable_resources(struct ahci_host_priv *hpriv)
{
ahci_platform_disable_phys(hpriv);
- reset_control_assert(hpriv->rsts);
+ ahci_platform_assert_rsts(hpriv);
ahci_platform_disable_clks(hpriv);
@@ -442,6 +480,8 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev,
rc = PTR_ERR(hpriv->rsts);
goto err_out;
}
+
+ hpriv->f_rsts = flags & AHCI_PLATFORM_RST_TRIGGER;
}
/*
diff --git a/include/linux/ahci_platform.h b/include/linux/ahci_platform.h
index 49e5383d42222..6d7dd472d3703 100644
--- a/include/linux/ahci_platform.h
+++ b/include/linux/ahci_platform.h
@@ -23,6 +23,8 @@ int ahci_platform_enable_phys(struct ahci_host_priv *hpriv);
void ahci_platform_disable_phys(struct ahci_host_priv *hpriv);
int ahci_platform_enable_clks(struct ahci_host_priv *hpriv);
void ahci_platform_disable_clks(struct ahci_host_priv *hpriv);
+int ahci_platform_deassert_rsts(struct ahci_host_priv *hpriv);
+int ahci_platform_assert_rsts(struct ahci_host_priv *hpriv);
int ahci_platform_enable_regulators(struct ahci_host_priv *hpriv);
void ahci_platform_disable_regulators(struct ahci_host_priv *hpriv);
int ahci_platform_enable_resources(struct ahci_host_priv *hpriv);
@@ -41,6 +43,7 @@ int ahci_platform_resume_host(struct device *dev);
int ahci_platform_suspend(struct device *dev);
int ahci_platform_resume(struct device *dev);
-#define AHCI_PLATFORM_GET_RESETS 0x01
+#define AHCI_PLATFORM_GET_RESETS BIT(0)
+#define AHCI_PLATFORM_RST_TRIGGER BIT(1)
#endif /* _AHCI_PLATFORM_H */
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 219/245] ata: ahci_ceva: fix error handling for Xilinx GT PHY support
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 218/245] ata: libahci_platform: Introduce reset assertion/deassertion methods Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 220/245] bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel Greg Kroah-Hartman
` (36 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Radhey Shyam Pandey, Damien Le Moal,
Niklas Cassel, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
[ Upstream commit 26c8404e162b43dddcb037ba2d0cb58c0ed60aab ]
Platform clock and phy error resources are not cleaned up in Xilinx GT PHY
error path.
To fix introduce the function ceva_ahci_platform_enable_resources() which
is a customized version of ahci_platform_enable_resources() and inline with
SATA IP programming sequence it does:
- Assert SATA reset
- Program PS GTR phy
- Bring SATA by de-asserting the reset
- Wait for GT lane PLL to be locked
ceva_ahci_platform_enable_resources() is also used in the resume path
as the same SATA programming sequence (as in probe) should be followed.
Also cleanup the mixed usage of ahci_platform_enable_resources() and custom
implementation in the probe function as both are not required.
Fixes: 9a9d3abe24bb ("ata: ahci: ceva: Update the driver to support xilinx GT phy")
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/ahci_ceva.c | 125 +++++++++++++++++++++++++---------------
1 file changed, 79 insertions(+), 46 deletions(-)
diff --git a/drivers/ata/ahci_ceva.c b/drivers/ata/ahci_ceva.c
index 50b56cd0039d2..3a32710820046 100644
--- a/drivers/ata/ahci_ceva.c
+++ b/drivers/ata/ahci_ceva.c
@@ -88,7 +88,6 @@ struct ceva_ahci_priv {
u32 axicc;
bool is_cci_enabled;
int flags;
- struct reset_control *rst;
};
static unsigned int ceva_ahci_read_id(struct ata_device *dev,
@@ -189,6 +188,60 @@ static struct scsi_host_template ahci_platform_sht = {
AHCI_SHT(DRV_NAME),
};
+static int ceva_ahci_platform_enable_resources(struct ahci_host_priv *hpriv)
+{
+ int rc, i;
+
+ rc = ahci_platform_enable_regulators(hpriv);
+ if (rc)
+ return rc;
+
+ rc = ahci_platform_enable_clks(hpriv);
+ if (rc)
+ goto disable_regulator;
+
+ /* Assert the controller reset */
+ rc = ahci_platform_assert_rsts(hpriv);
+ if (rc)
+ goto disable_clks;
+
+ for (i = 0; i < hpriv->nports; i++) {
+ rc = phy_init(hpriv->phys[i]);
+ if (rc)
+ goto disable_rsts;
+ }
+
+ /* De-assert the controller reset */
+ ahci_platform_deassert_rsts(hpriv);
+
+ for (i = 0; i < hpriv->nports; i++) {
+ rc = phy_power_on(hpriv->phys[i]);
+ if (rc) {
+ phy_exit(hpriv->phys[i]);
+ goto disable_phys;
+ }
+ }
+
+ return 0;
+
+disable_rsts:
+ ahci_platform_deassert_rsts(hpriv);
+
+disable_phys:
+ while (--i >= 0) {
+ phy_power_off(hpriv->phys[i]);
+ phy_exit(hpriv->phys[i]);
+ }
+
+disable_clks:
+ ahci_platform_disable_clks(hpriv);
+
+disable_regulator:
+ ahci_platform_disable_regulators(hpriv);
+
+ return rc;
+}
+
static int ceva_ahci_probe(struct platform_device *pdev)
{
struct device_node *np = pdev->dev.of_node;
@@ -203,47 +256,19 @@ static int ceva_ahci_probe(struct platform_device *pdev)
return -ENOMEM;
cevapriv->ahci_pdev = pdev;
-
- cevapriv->rst = devm_reset_control_get_optional_exclusive(&pdev->dev,
- NULL);
- if (IS_ERR(cevapriv->rst))
- dev_err_probe(&pdev->dev, PTR_ERR(cevapriv->rst),
- "failed to get reset\n");
-
hpriv = ahci_platform_get_resources(pdev, 0);
if (IS_ERR(hpriv))
return PTR_ERR(hpriv);
- if (!cevapriv->rst) {
- rc = ahci_platform_enable_resources(hpriv);
- if (rc)
- return rc;
- } else {
- int i;
+ hpriv->rsts = devm_reset_control_get_optional_exclusive(&pdev->dev,
+ NULL);
+ if (IS_ERR(hpriv->rsts))
+ return dev_err_probe(&pdev->dev, PTR_ERR(hpriv->rsts),
+ "failed to get reset\n");
- rc = ahci_platform_enable_clks(hpriv);
- if (rc)
- return rc;
- /* Assert the controller reset */
- reset_control_assert(cevapriv->rst);
-
- for (i = 0; i < hpriv->nports; i++) {
- rc = phy_init(hpriv->phys[i]);
- if (rc)
- return rc;
- }
-
- /* De-assert the controller reset */
- reset_control_deassert(cevapriv->rst);
-
- for (i = 0; i < hpriv->nports; i++) {
- rc = phy_power_on(hpriv->phys[i]);
- if (rc) {
- phy_exit(hpriv->phys[i]);
- return rc;
- }
- }
- }
+ rc = ceva_ahci_platform_enable_resources(hpriv);
+ if (rc)
+ return rc;
if (of_property_read_bool(np, "ceva,broken-gen2"))
cevapriv->flags = CEVA_FLAG_BROKEN_GEN2;
@@ -252,52 +277,60 @@ static int ceva_ahci_probe(struct platform_device *pdev)
if (of_property_read_u8_array(np, "ceva,p0-cominit-params",
(u8 *)&cevapriv->pp2c[0], 4) < 0) {
dev_warn(dev, "ceva,p0-cominit-params property not defined\n");
- return -EINVAL;
+ rc = -EINVAL;
+ goto disable_resources;
}
if (of_property_read_u8_array(np, "ceva,p1-cominit-params",
(u8 *)&cevapriv->pp2c[1], 4) < 0) {
dev_warn(dev, "ceva,p1-cominit-params property not defined\n");
- return -EINVAL;
+ rc = -EINVAL;
+ goto disable_resources;
}
/* Read OOB timing value for COMWAKE from device-tree*/
if (of_property_read_u8_array(np, "ceva,p0-comwake-params",
(u8 *)&cevapriv->pp3c[0], 4) < 0) {
dev_warn(dev, "ceva,p0-comwake-params property not defined\n");
- return -EINVAL;
+ rc = -EINVAL;
+ goto disable_resources;
}
if (of_property_read_u8_array(np, "ceva,p1-comwake-params",
(u8 *)&cevapriv->pp3c[1], 4) < 0) {
dev_warn(dev, "ceva,p1-comwake-params property not defined\n");
- return -EINVAL;
+ rc = -EINVAL;
+ goto disable_resources;
}
/* Read phy BURST timing value from device-tree */
if (of_property_read_u8_array(np, "ceva,p0-burst-params",
(u8 *)&cevapriv->pp4c[0], 4) < 0) {
dev_warn(dev, "ceva,p0-burst-params property not defined\n");
- return -EINVAL;
+ rc = -EINVAL;
+ goto disable_resources;
}
if (of_property_read_u8_array(np, "ceva,p1-burst-params",
(u8 *)&cevapriv->pp4c[1], 4) < 0) {
dev_warn(dev, "ceva,p1-burst-params property not defined\n");
- return -EINVAL;
+ rc = -EINVAL;
+ goto disable_resources;
}
/* Read phy RETRY interval timing value from device-tree */
if (of_property_read_u16_array(np, "ceva,p0-retry-params",
(u16 *)&cevapriv->pp5c[0], 2) < 0) {
dev_warn(dev, "ceva,p0-retry-params property not defined\n");
- return -EINVAL;
+ rc = -EINVAL;
+ goto disable_resources;
}
if (of_property_read_u16_array(np, "ceva,p1-retry-params",
(u16 *)&cevapriv->pp5c[1], 2) < 0) {
dev_warn(dev, "ceva,p1-retry-params property not defined\n");
- return -EINVAL;
+ rc = -EINVAL;
+ goto disable_resources;
}
/*
@@ -335,7 +368,7 @@ static int __maybe_unused ceva_ahci_resume(struct device *dev)
struct ahci_host_priv *hpriv = host->private_data;
int rc;
- rc = ahci_platform_enable_resources(hpriv);
+ rc = ceva_ahci_platform_enable_resources(hpriv);
if (rc)
return rc;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 220/245] bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 219/245] ata: ahci_ceva: fix error handling for Xilinx GT PHY support Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 221/245] afs: Increase buffer size in afs_update_volume_status() Greg Kroah-Hartman
` (35 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexei Starovoitov, Martin KaFai Lau,
Daniel Borkmann, Hou Tao, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <martin.lau@kernel.org>
[ Upstream commit 0281b919e175bb9c3128bd3872ac2903e9436e3f ]
The following race is possible between bpf_timer_cancel_and_free
and bpf_timer_cancel. It will lead a UAF on the timer->timer.
bpf_timer_cancel();
spin_lock();
t = timer->time;
spin_unlock();
bpf_timer_cancel_and_free();
spin_lock();
t = timer->timer;
timer->timer = NULL;
spin_unlock();
hrtimer_cancel(&t->timer);
kfree(t);
/* UAF on t */
hrtimer_cancel(&t->timer);
In bpf_timer_cancel_and_free, this patch frees the timer->timer
after a rcu grace period. This requires a rcu_head addition
to the "struct bpf_hrtimer". Another kfree(t) happens in bpf_timer_init,
this does not need a kfree_rcu because it is still under the
spin_lock and timer->timer has not been visible by others yet.
In bpf_timer_cancel, rcu_read_lock() is added because this helper
can be used in a non rcu critical section context (e.g. from
a sleepable bpf prog). Other timer->timer usages in helpers.c
have been audited, bpf_timer_cancel() is the only place where
timer->timer is used outside of the spin_lock.
Another solution considered is to mark a t->flag in bpf_timer_cancel
and clear it after hrtimer_cancel() is done. In bpf_timer_cancel_and_free,
it busy waits for the flag to be cleared before kfree(t). This patch
goes with a straight forward solution and frees timer->timer after
a rcu grace period.
Fixes: b00628b1c7d5 ("bpf: Introduce bpf timers.")
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/bpf/20240215211218.990808-1-martin.lau@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/helpers.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index c8827d1ff3c59..870127c895c49 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -1048,6 +1048,7 @@ struct bpf_hrtimer {
struct bpf_prog *prog;
void __rcu *callback_fn;
void *value;
+ struct rcu_head rcu;
};
/* the actual struct hidden inside uapi struct bpf_timer */
@@ -1269,6 +1270,7 @@ BPF_CALL_1(bpf_timer_cancel, struct bpf_timer_kern *, timer)
if (in_nmi())
return -EOPNOTSUPP;
+ rcu_read_lock();
__bpf_spin_lock_irqsave(&timer->lock);
t = timer->timer;
if (!t) {
@@ -1290,6 +1292,7 @@ BPF_CALL_1(bpf_timer_cancel, struct bpf_timer_kern *, timer)
* if it was running.
*/
ret = ret ?: hrtimer_cancel(&t->timer);
+ rcu_read_unlock();
return ret;
}
@@ -1344,7 +1347,7 @@ void bpf_timer_cancel_and_free(void *val)
*/
if (this_cpu_read(hrtimer_running) != t)
hrtimer_cancel(&t->timer);
- kfree(t);
+ kfree_rcu(t, rcu);
}
const struct bpf_func_proto bpf_get_current_task_proto __weak;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 221/245] afs: Increase buffer size in afs_update_volume_status()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 220/245] bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 222/245] ipv6: sr: fix possible use-after-free and null-ptr-deref Greg Kroah-Hartman
` (34 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniil Dulov, David Howells,
Christian Brauner, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <d.dulov@aladdin.ru>
[ Upstream commit 6ea38e2aeb72349cad50e38899b0ba6fbcb2af3d ]
The max length of volume->vid value is 20 characters.
So increase idbuf[] size up to 24 to avoid overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[DH: Actually, it's 20 + NUL, so increase it to 24 and use snprintf()]
Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation")
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/20240211150442.3416-1-d.dulov@aladdin.ru/ # v1
Link: https://lore.kernel.org/r/20240212083347.10742-1-d.dulov@aladdin.ru/ # v2
Link: https://lore.kernel.org/r/20240219143906.138346-3-dhowells@redhat.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/volume.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/afs/volume.c b/fs/afs/volume.c
index 137a970c19fb3..3d39ce5a23f22 100644
--- a/fs/afs/volume.c
+++ b/fs/afs/volume.c
@@ -327,7 +327,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key)
{
struct afs_server_list *new, *old, *discard;
struct afs_vldb_entry *vldb;
- char idbuf[16];
+ char idbuf[24];
int ret, idsz;
_enter("");
@@ -335,7 +335,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key)
/* We look up an ID by passing it as a decimal string in the
* operation's name parameter.
*/
- idsz = sprintf(idbuf, "%llu", volume->vid);
+ idsz = snprintf(idbuf, sizeof(idbuf), "%llu", volume->vid);
vldb = afs_vl_lookup_vldb(volume->cell, key, idbuf, idsz);
if (IS_ERR(vldb)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 222/245] ipv6: sr: fix possible use-after-free and null-ptr-deref
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 221/245] afs: Increase buffer size in afs_update_volume_status() Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 223/245] packet: move from strlcpy with unused retval to strscpy Greg Kroah-Hartman
` (33 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vasiliy Kovalev, Paolo Abeni,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <kovalev@altlinux.org>
[ Upstream commit 5559cea2d5aa3018a5f00dd2aca3427ba09b386b ]
The pernet operations structure for the subsystem must be registered
before registering the generic netlink family.
Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Link: https://lore.kernel.org/r/20240215202717.29815-1-kovalev@altlinux.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/seg6.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 0c7c6fc16c3c3..dc434e4ee6d66 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -507,22 +507,24 @@ int __init seg6_init(void)
{
int err;
- err = genl_register_family(&seg6_genl_family);
+ err = register_pernet_subsys(&ip6_segments_ops);
if (err)
goto out;
- err = register_pernet_subsys(&ip6_segments_ops);
+ err = genl_register_family(&seg6_genl_family);
if (err)
- goto out_unregister_genl;
+ goto out_unregister_pernet;
#ifdef CONFIG_IPV6_SEG6_LWTUNNEL
err = seg6_iptunnel_init();
if (err)
- goto out_unregister_pernet;
+ goto out_unregister_genl;
err = seg6_local_init();
- if (err)
- goto out_unregister_pernet;
+ if (err) {
+ seg6_iptunnel_exit();
+ goto out_unregister_genl;
+ }
#endif
#ifdef CONFIG_IPV6_SEG6_HMAC
@@ -543,11 +545,11 @@ int __init seg6_init(void)
#endif
#endif
#ifdef CONFIG_IPV6_SEG6_LWTUNNEL
-out_unregister_pernet:
- unregister_pernet_subsys(&ip6_segments_ops);
-#endif
out_unregister_genl:
genl_unregister_family(&seg6_genl_family);
+#endif
+out_unregister_pernet:
+ unregister_pernet_subsys(&ip6_segments_ops);
goto out;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 223/245] packet: move from strlcpy with unused retval to strscpy
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 222/245] ipv6: sr: fix possible use-after-free and null-ptr-deref Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 224/245] net: dev: Convert sa_data to flexible array in struct sockaddr Greg Kroah-Hartman
` (32 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Jakub Kicinski,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit 8fc9d51ea2d32a05f7d7cf86a25cc86ecc57eb45 ]
Follow the advice of the below link and prefer 'strscpy' in this
subsystem. Conversion is 1:1 because the return value is not used.
Generated by a coccinelle script.
Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20220818210227.8611-1-wsa+renesas@sang-engineering.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: a7d6027790ac ("arp: Prevent overflow in arp_req_get().")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/packet/af_packet.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e7b54f7214110..d62f79cf873dd 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1874,7 +1874,7 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,
*/
spkt->spkt_family = dev->type;
- strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
+ strscpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
spkt->spkt_protocol = skb->protocol;
/*
@@ -3540,7 +3540,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
rcu_read_lock();
dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex));
if (dev)
- strlcpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
+ strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
rcu_read_unlock();
return sizeof(*uaddr);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 224/245] net: dev: Convert sa_data to flexible array in struct sockaddr
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 223/245] packet: move from strlcpy with unused retval to strscpy Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 225/245] drm/nouveau/instmem: fix uninitialized_var.cocci warning Greg Kroah-Hartman
` (31 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jens Axboe, Pavel Begunkov,
David Ahern, Dylan Yudaken, Yajun Deng, Petr Machata, Hangbin Liu,
Leon Romanovsky, syzbot, Willem de Bruijn, Pablo Neira Ayuso,
Kees Cook, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
[ Upstream commit b5f0de6df6dce8d641ef58ef7012f3304dffb9a1 ]
One of the worst offenders of "fake flexible arrays" is struct sockaddr,
as it is the classic example of why GCC and Clang have been traditionally
forced to treat all trailing arrays as fake flexible arrays: in the
distant misty past, sa_data became too small, and code started just
treating it as a flexible array, even though it was fixed-size. The
special case by the compiler is specifically that sizeof(sa->sa_data)
and FORTIFY_SOURCE (which uses __builtin_object_size(sa->sa_data, 1))
do not agree (14 and -1 respectively), which makes FORTIFY_SOURCE treat
it as a flexible array.
However, the coming -fstrict-flex-arrays compiler flag will remove
these special cases so that FORTIFY_SOURCE can gain coverage over all
the trailing arrays in the kernel that are _not_ supposed to be treated
as a flexible array. To deal with this change, convert sa_data to a true
flexible array. To keep the structure size the same, move sa_data into
a union with a newly introduced sa_data_min with the original size. The
result is that FORTIFY_SOURCE can continue to have no idea how large
sa_data may actually be, but anything using sizeof(sa->sa_data) must
switch to sizeof(sa->sa_data_min).
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Pavel Begunkov <asml.silence@gmail.com>
Cc: David Ahern <dsahern@kernel.org>
Cc: Dylan Yudaken <dylany@fb.com>
Cc: Yajun Deng <yajun.deng@linux.dev>
Cc: Petr Machata <petrm@nvidia.com>
Cc: Hangbin Liu <liuhangbin@gmail.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: syzbot <syzkaller@googlegroups.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20221018095503.never.671-kees@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: a7d6027790ac ("arp: Prevent overflow in arp_req_get().")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/socket.h | 5 ++++-
net/core/dev.c | 2 +-
net/core/dev_ioctl.c | 2 +-
net/packet/af_packet.c | 10 +++++-----
4 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 041d6032a3489..4c5ce8124f8e7 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -31,7 +31,10 @@ typedef __kernel_sa_family_t sa_family_t;
struct sockaddr {
sa_family_t sa_family; /* address family, AF_xxx */
- char sa_data[14]; /* 14 bytes of protocol address */
+ union {
+ char sa_data_min[14]; /* Minimum 14 bytes of protocol address */
+ DECLARE_FLEX_ARRAY(char, sa_data);
+ };
};
struct linger {
diff --git a/net/core/dev.c b/net/core/dev.c
index 8501645ff67dd..af77dc77eb9c8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -9090,7 +9090,7 @@ EXPORT_SYMBOL(dev_set_mac_address_user);
int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name)
{
- size_t size = sizeof(sa->sa_data);
+ size_t size = sizeof(sa->sa_data_min);
struct net_device *dev;
int ret = 0;
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 0e87237fd8712..6ddfd7bfc5127 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -339,7 +339,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data,
if (ifr->ifr_hwaddr.sa_family != dev->type)
return -EINVAL;
memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data,
- min(sizeof(ifr->ifr_hwaddr.sa_data),
+ min(sizeof(ifr->ifr_hwaddr.sa_data_min),
(size_t)dev->addr_len));
call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
return 0;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d62f79cf873dd..75fb80717e489 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3252,7 +3252,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
int addr_len)
{
struct sock *sk = sock->sk;
- char name[sizeof(uaddr->sa_data) + 1];
+ char name[sizeof(uaddr->sa_data_min) + 1];
/*
* Check legality
@@ -3263,8 +3263,8 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
/* uaddr->sa_data comes from the userspace, it's not guaranteed to be
* zero-terminated.
*/
- memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data));
- name[sizeof(uaddr->sa_data)] = 0;
+ memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data_min));
+ name[sizeof(uaddr->sa_data_min)] = 0;
return packet_do_bind(sk, name, 0, 0);
}
@@ -3536,11 +3536,11 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
return -EOPNOTSUPP;
uaddr->sa_family = AF_PACKET;
- memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data));
+ memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data_min));
rcu_read_lock();
dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex));
if (dev)
- strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
+ strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data_min));
rcu_read_unlock();
return sizeof(*uaddr);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 225/245] drm/nouveau/instmem: fix uninitialized_var.cocci warning
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 224/245] net: dev: Convert sa_data to flexible array in struct sockaddr Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 226/245] octeontx2-af: Consider the action set by PF Greg Kroah-Hartman
` (30 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guo Zhengkui, Lyude Paul,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guo Zhengkui <guozhengkui@vivo.com>
[ Upstream commit 2046e733e125fa58ed997f3d26d43543faf82c95 ]
Fix following coccicheck warning:
drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c:316:11-12:
WARNING this kind of initialization is deprecated.
`void *map = map` has the same form of
uninitialized_var() macro. I remove the redundant assignement. It has
been tested with gcc (Debian 8.3.0-6) 8.3.0.
The patch which removed uninitialized_var() is:
https://lore.kernel.org/all/20121028102007.GA7547@gmail.com/
And there is very few "/* GCC */" comments in the Linux kernel code now.
Signed-off-by: Guo Zhengkui <guozhengkui@vivo.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220228142352.18006-1-guozhengkui@vivo.com
Stable-dep-of: 3b1ae9b71c2a ("octeontx2-af: Consider the action set by PF")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c
index 96aca0edfa3c0..c51bac76174c1 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c
@@ -313,7 +313,7 @@ nv50_instobj_dtor(struct nvkm_memory *memory)
struct nv50_instobj *iobj = nv50_instobj(memory);
struct nvkm_instmem *imem = &iobj->imem->base;
struct nvkm_vma *bar;
- void *map = map;
+ void *map;
mutex_lock(&imem->mutex);
if (likely(iobj->lru.next))
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 226/245] octeontx2-af: Consider the action set by PF
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 225/245] drm/nouveau/instmem: fix uninitialized_var.cocci warning Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 227/245] s390: use the correct count for __iowrite64_copy() Greg Kroah-Hartman
` (29 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Subbaraya Sundeep, David S. Miller,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <sbhatta@marvell.com>
[ Upstream commit 3b1ae9b71c2a97f848b00fb085a2bd29bddbe8d9 ]
AF reserves MCAM entries for each PF, VF present in the
system and populates the entry with DMAC and action with
default RSS so that basic packet I/O works. Since PF/VF is
not aware of the RSS action installed by AF, AF only fixup
the actions of the rules installed by PF/VF with corresponding
default RSS action. This worked well for rules installed by
PF/VF for features like RX VLAN offload and DMAC filters but
rules involving action like drop/forward to queue are also
getting modified by AF. Hence fix it by setting the default
RSS action only if requested by PF/VF.
Fixes: 967db3529eca ("octeontx2-af: add support for multicast/promisc packet replication feature")
Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
index 70b4f2a3b02fd..604aaa9b960e9 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
@@ -436,6 +436,10 @@ static void npc_fixup_vf_rule(struct rvu *rvu, struct npc_mcam *mcam,
return;
}
+ /* AF modifies given action iff PF/VF has requested for it */
+ if ((entry->action & 0xFULL) != NIX_RX_ACTION_DEFAULT)
+ return;
+
/* copy VF default entry action to the VF mcam entry */
rx_action = npc_get_default_entry_action(rvu, mcam, blkaddr,
target_func);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 227/245] s390: use the correct count for __iowrite64_copy()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 226/245] octeontx2-af: Consider the action set by PF Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 228/245] tls: rx: jump to a more appropriate label Greg Kroah-Hartman
` (28 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Schnelle, Jason Gunthorpe,
Heiko Carstens, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 723a2cc8d69d4342b47dfddbfe6c19f1b135f09b ]
The signature for __iowrite64_copy() requires the number of 64 bit
quantities, not bytes. Multiple by 8 to get to a byte length before
invoking zpci_memcpy_toio()
Fixes: 87bc359b9822 ("s390/pci: speed up __iowrite64_copy by using pci store block insn")
Acked-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/0-v1-9223d11a7662+1d7785-s390_iowrite64_jgg@nvidia.com
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/pci/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index 56c4cecdbbf9e..8764f0ae6d345 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -228,7 +228,7 @@ resource_size_t pcibios_align_resource(void *data, const struct resource *res,
/* combine single writes by using store-block insn */
void __iowrite64_copy(void __iomem *to, const void *from, size_t count)
{
- zpci_memcpy_toio(to, from, count);
+ zpci_memcpy_toio(to, from, count * 8);
}
static void __iomem *__ioremap(phys_addr_t addr, size_t size, pgprot_t prot)
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 228/245] tls: rx: jump to a more appropriate label
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 227/245] s390: use the correct count for __iowrite64_copy() Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 229/245] tls: rx: drop pointless else after goto Greg Kroah-Hartman
` (27 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, David S. Miller,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit bfc06e1aaa130b86a81ce3c41ec71a2f5e191690 ]
'recv_end:' checks num_async and decrypted, and is then followed
by the 'end' label. Since we know that decrypted and num_async
are 0 at the start we can jump to 'end'.
Move the init of decrypted and num_async to let the compiler
catch if I'm wrong.
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tls/tls_sw.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 9ff3e4df2d6c5..c8285c596b5f4 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1755,6 +1755,7 @@ int tls_sw_recvmsg(struct sock *sk,
struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
struct tls_prot_info *prot = &tls_ctx->prot_info;
struct sk_psock *psock;
+ int num_async, pending;
unsigned char control = 0;
ssize_t decrypted = 0;
struct strp_msg *rxm;
@@ -1767,8 +1768,6 @@ int tls_sw_recvmsg(struct sock *sk,
bool is_kvec = iov_iter_is_kvec(&msg->msg_iter);
bool is_peek = flags & MSG_PEEK;
bool bpf_strp_enabled;
- int num_async = 0;
- int pending;
flags |= nonblock;
@@ -1790,12 +1789,14 @@ int tls_sw_recvmsg(struct sock *sk,
}
if (len <= copied)
- goto recv_end;
+ goto end;
target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
len = len - copied;
timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+ decrypted = 0;
+ num_async = 0;
while (len && (decrypted + copied < target || ctx->recv_pkt)) {
bool retain_skb = false;
bool zc = false;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 229/245] tls: rx: drop pointless else after goto
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 228/245] tls: rx: jump to a more appropriate label Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 230/245] tls: stop recv() if initial process_rx_list gave us non-DATA Greg Kroah-Hartman
` (26 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, David S. Miller,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit d5123edd10cf9d324fcb88e276bdc7375f3c5321 ]
Pointless else branch after goto makes the code harder to refactor
down the line.
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tls/tls_sw.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index c8285c596b5f4..92eab4a7a80b5 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1784,10 +1784,9 @@ int tls_sw_recvmsg(struct sock *sk,
if (err < 0) {
tls_err_abort(sk, err);
goto end;
- } else {
- copied = err;
}
+ copied = err;
if (len <= copied)
goto end;
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 230/245] tls: stop recv() if initial process_rx_list gave us non-DATA
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 229/245] tls: rx: drop pointless else after goto Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 231/245] netfilter: nf_tables: set dormant flag on hook register failure Greg Kroah-Hartman
` (25 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sabrina Dubroca, Jakub Kicinski,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
[ Upstream commit fdfbaec5923d9359698cbb286bc0deadbb717504 ]
If we have a non-DATA record on the rx_list and another record of the
same type still on the queue, we will end up merging them:
- process_rx_list copies the non-DATA record
- we start the loop and process the first available record since it's
of the same type
- we break out of the loop since the record was not DATA
Just check the record type and jump to the end in case process_rx_list
did some work.
Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://lore.kernel.org/r/bd31449e43bd4b6ff546f5c51cf958c31c511deb.1708007371.git.sd@queasysnail.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tls/tls_sw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 92eab4a7a80b5..e6f700f67c010 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1787,7 +1787,7 @@ int tls_sw_recvmsg(struct sock *sk,
}
copied = err;
- if (len <= copied)
+ if (len <= copied || (copied && control != TLS_RECORD_TYPE_DATA))
goto end;
target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 231/245] netfilter: nf_tables: set dormant flag on hook register failure
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 230/245] tls: stop recv() if initial process_rx_list gave us non-DATA Greg Kroah-Hartman
@ 2024-02-27 13:26 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 232/245] netfilter: flowtable: simplify route logic Greg Kroah-Hartman
` (24 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin, syzbot+de4025c006ec68ac56fc
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit bccebf64701735533c8db37773eeacc6566cc8ec ]
We need to set the dormant flag again if we fail to register
the hooks.
During memory pressure hook registration can fail and we end up
with a table marked as active but no registered hooks.
On table/base chain deletion, nf_tables will attempt to unregister
the hook again which yields a warn splat from the nftables core.
Reported-and-tested-by: syzbot+de4025c006ec68ac56fc@syzkaller.appspotmail.com
Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 361fbbd430ad8..1a7bfd4be61d5 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1193,6 +1193,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
return 0;
err_register_hooks:
+ ctx->table->flags |= NFT_TABLE_F_DORMANT;
nft_trans_destroy(trans);
return ret;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 232/245] netfilter: flowtable: simplify route logic
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2024-02-27 13:26 ` [PATCH 5.15 231/245] netfilter: nf_tables: set dormant flag on hook register failure Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 233/245] netfilter: nft_flow_offload: reset dst in route object after setting up flow Greg Kroah-Hartman
` (23 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Florian Westphal,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit fa502c86566680ac62bc28ec883a069bf7a2aa5e ]
Grab reference to dst from skbuff earlier to simplify route caching.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Stable-dep-of: 9e0f0430389b ("netfilter: nft_flow_offload: reset dst in route object after setting up flow")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/netfilter/nf_flow_table.h | 4 ++--
net/netfilter/nf_flow_table_core.c | 24 +++---------------------
net/netfilter/nft_flow_offload.c | 12 ++++++++----
3 files changed, 13 insertions(+), 27 deletions(-)
diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index aaa518e777e9e..7677aacf72002 100644
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -257,8 +257,8 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table,
up_write(&flow_table->flow_block_lock);
}
-int flow_offload_route_init(struct flow_offload *flow,
- const struct nf_flow_route *route);
+void flow_offload_route_init(struct flow_offload *flow,
+ const struct nf_flow_route *route);
int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow);
void flow_offload_refresh(struct nf_flowtable *flow_table,
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 4f61eb1282834..4e0a2d47f6a6b 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -124,9 +124,6 @@ static int flow_offload_fill_route(struct flow_offload *flow,
break;
case FLOW_OFFLOAD_XMIT_XFRM:
case FLOW_OFFLOAD_XMIT_NEIGH:
- if (!dst_hold_safe(route->tuple[dir].dst))
- return -1;
-
flow_tuple->dst_cache = dst;
flow_tuple->dst_cookie = flow_offload_dst_cookie(flow_tuple);
break;
@@ -147,27 +144,12 @@ static void nft_flow_dst_release(struct flow_offload *flow,
dst_release(flow->tuplehash[dir].tuple.dst_cache);
}
-int flow_offload_route_init(struct flow_offload *flow,
+void flow_offload_route_init(struct flow_offload *flow,
const struct nf_flow_route *route)
{
- int err;
-
- err = flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL);
- if (err < 0)
- return err;
-
- err = flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY);
- if (err < 0)
- goto err_route_reply;
-
+ flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL);
+ flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY);
flow->type = NF_FLOW_OFFLOAD_ROUTE;
-
- return 0;
-
-err_route_reply:
- nft_flow_dst_release(flow, FLOW_OFFLOAD_DIR_ORIGINAL);
-
- return err;
}
EXPORT_SYMBOL_GPL(flow_offload_route_init);
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index f8346497c9b49..fbb9f3a6c8444 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -240,9 +240,14 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
break;
}
+ if (!dst_hold_safe(this_dst))
+ return -ENOENT;
+
nf_route(nft_net(pkt), &other_dst, &fl, false, nft_pf(pkt));
- if (!other_dst)
+ if (!other_dst) {
+ dst_release(this_dst);
return -ENOENT;
+ }
nft_default_forward_path(route, this_dst, dir);
nft_default_forward_path(route, other_dst, !dir);
@@ -326,8 +331,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
if (!flow)
goto err_flow_alloc;
- if (flow_offload_route_init(flow, &route) < 0)
- goto err_flow_add;
+ flow_offload_route_init(flow, &route);
if (tcph) {
ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
@@ -338,12 +342,12 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
if (ret < 0)
goto err_flow_add;
- dst_release(route.tuple[!dir].dst);
return;
err_flow_add:
flow_offload_free(flow);
err_flow_alloc:
+ dst_release(route.tuple[dir].dst);
dst_release(route.tuple[!dir].dst);
err_flow_route:
clear_bit(IPS_OFFLOAD_BIT, &ct->status);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 233/245] netfilter: nft_flow_offload: reset dst in route object after setting up flow
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 232/245] netfilter: flowtable: simplify route logic Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 234/245] netfilter: nft_flow_offload: release dst in case direct xmit path is used Greg Kroah-Hartman
` (22 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 9e0f0430389be7696396c62f037be4bf72cf93e3 ]
dst is transferred to the flow object, route object does not own it
anymore. Reset dst in route object, otherwise if flow_offload_add()
fails, error path releases dst twice, leading to a refcount underflow.
Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/netfilter/nf_flow_table.h | 2 +-
net/netfilter/nf_flow_table_core.c | 16 +++++++++++++---
2 files changed, 14 insertions(+), 4 deletions(-)
diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index 7677aacf72002..dabd84fa3fd36 100644
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -258,7 +258,7 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table,
}
void flow_offload_route_init(struct flow_offload *flow,
- const struct nf_flow_route *route);
+ struct nf_flow_route *route);
int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow);
void flow_offload_refresh(struct nf_flowtable *flow_table,
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 4e0a2d47f6a6b..a213a7cb80435 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -86,12 +86,22 @@ static u32 flow_offload_dst_cookie(struct flow_offload_tuple *flow_tuple)
return 0;
}
+static struct dst_entry *nft_route_dst_fetch(struct nf_flow_route *route,
+ enum flow_offload_tuple_dir dir)
+{
+ struct dst_entry *dst = route->tuple[dir].dst;
+
+ route->tuple[dir].dst = NULL;
+
+ return dst;
+}
+
static int flow_offload_fill_route(struct flow_offload *flow,
- const struct nf_flow_route *route,
+ struct nf_flow_route *route,
enum flow_offload_tuple_dir dir)
{
struct flow_offload_tuple *flow_tuple = &flow->tuplehash[dir].tuple;
- struct dst_entry *dst = route->tuple[dir].dst;
+ struct dst_entry *dst = nft_route_dst_fetch(route, dir);
int i, j = 0;
switch (flow_tuple->l3proto) {
@@ -145,7 +155,7 @@ static void nft_flow_dst_release(struct flow_offload *flow,
}
void flow_offload_route_init(struct flow_offload *flow,
- const struct nf_flow_route *route)
+ struct nf_flow_route *route)
{
flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL);
flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 234/245] netfilter: nft_flow_offload: release dst in case direct xmit path is used
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 233/245] netfilter: nft_flow_offload: reset dst in route object after setting up flow Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 235/245] drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set Greg Kroah-Hartman
` (21 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 8762785f459be1cfe6fcf7285c123aad6a3703f0 ]
Direct xmit does not use it since it calls dev_queue_xmit() to send
packets, hence it calls dst_release().
kmemleak reports:
unreferenced object 0xffff88814f440900 (size 184):
comm "softirq", pid 0, jiffies 4294951896
hex dump (first 32 bytes):
00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[.............
21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P.............
backtrace (crc cb2bf5d6):
[<000000003ee17107>] kmem_cache_alloc+0x286/0x340
[<0000000021a5de2c>] dst_alloc+0x43/0xb0
[<00000000f0671159>] rt_dst_alloc+0x2e/0x190
[<00000000fe5092c9>] __mkroute_output+0x244/0x980
[<000000005fb96fb0>] ip_route_output_flow+0xc0/0x160
[<0000000045367433>] nf_ip_route+0xf/0x30
[<0000000085da1d8e>] nf_route+0x2d/0x60
[<00000000d1ecd1cb>] nft_flow_route+0x171/0x6a0 [nft_flow_offload]
[<00000000d9b2fb60>] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload]
[<000000009f447dbb>] expr_call_ops_eval+0x53/0x330 [nf_tables]
[<00000000072e1be6>] nft_do_chain+0x17c/0x840 [nf_tables]
[<00000000d0551029>] nft_do_chain_inet+0xa1/0x210 [nf_tables]
[<0000000097c9d5c6>] nf_hook_slow+0x5b/0x160
[<0000000005eccab1>] ip_forward+0x8b6/0x9b0
[<00000000553a269b>] ip_rcv+0x221/0x230
[<00000000412872e5>] __netif_receive_skb_one_core+0xfe/0x110
Fixes: fa502c865666 ("netfilter: flowtable: simplify route logic")
Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_flow_table_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index a213a7cb80435..e78cdd73ef628 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -131,6 +131,7 @@ static int flow_offload_fill_route(struct flow_offload *flow,
ETH_ALEN);
flow_tuple->out.ifidx = route->tuple[dir].out.ifindex;
flow_tuple->out.hw_ifidx = route->tuple[dir].out.hw_ifindex;
+ dst_release(dst);
break;
case FLOW_OFFLOAD_XMIT_XFRM:
case FLOW_OFFLOAD_XMIT_NEIGH:
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 235/245] drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 234/245] netfilter: nft_flow_offload: release dst in case direct xmit path is used Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 236/245] drm/amd/display: Fix memory leak in dm_sw_fini() Greg Kroah-Hartman
` (20 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Erik Kurzinger, Simon Ser,
Daniel Vetter, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erik Kurzinger <ekurzinger@nvidia.com>
[ Upstream commit 3c43177ffb54ea5be97505eb8e2690e99ac96bc9 ]
When waiting for a syncobj timeline point whose fence has not yet been
submitted with the WAIT_FOR_SUBMIT flag, a callback is registered using
drm_syncobj_fence_add_wait and the thread is put to sleep until the
timeout expires. If the fence is submitted before then,
drm_syncobj_add_point will wake up the sleeping thread immediately which
will proceed to wait for the fence to be signaled.
However, if the WAIT_AVAILABLE flag is used instead,
drm_syncobj_fence_add_wait won't get called, meaning the waiting thread
will always sleep for the full timeout duration, even if the fence gets
submitted earlier. If it turns out that the fence *has* been submitted
by the time it eventually wakes up, it will still indicate to userspace
that the wait completed successfully (it won't return -ETIME), but it
will have taken much longer than it should have.
To fix this, we must call drm_syncobj_fence_add_wait if *either* the
WAIT_FOR_SUBMIT flag or the WAIT_AVAILABLE flag is set. The only
difference being that with WAIT_FOR_SUBMIT we will also wait for the
fence to be signaled after it has been submitted while with
WAIT_AVAILABLE we will return immediately.
IGT test patch: https://lists.freedesktop.org/archives/igt-dev/2024-January/067537.html
v1 -> v2: adjust lockdep_assert_none_held_once condition
(cherry picked from commit 8c44ea81634a4a337df70a32621a5f3791be23df)
Fixes: 01d6c3578379 ("drm/syncobj: add support for timeline point wait v8")
Signed-off-by: Erik Kurzinger <ekurzinger@nvidia.com>
Signed-off-by: Simon Ser <contact@emersion.fr>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Simon Ser <contact@emersion.fr>
Link: https://patchwork.freedesktop.org/patch/msgid/20240119163208.3723457-1-ekurzinger@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_syncobj.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index c26f916996352..2de679ffd88de 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -1021,7 +1021,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
uint64_t *points;
uint32_t signaled_count, i;
- if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)
+ if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
+ DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE))
lockdep_assert_none_held_once();
points = kmalloc_array(count, sizeof(*points), GFP_KERNEL);
@@ -1090,7 +1091,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
* fallthough and try a 0 timeout wait!
*/
- if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
+ if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
+ DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) {
for (i = 0; i < count; ++i)
drm_syncobj_fence_add_wait(syncobjs[i], &entries[i]);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 236/245] drm/amd/display: Fix memory leak in dm_sw_fini()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 235/245] drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 237/245] i2c: imx: Add timer for handling the stop condition Greg Kroah-Hartman
` (19 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Armin Wolf, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit bae67893578d608e35691dcdfa90c4957debf1d3 ]
After destroying dmub_srv, the memory associated with it is
not freed, causing a memory leak:
unreferenced object 0xffff896302b45800 (size 1024):
comm "(udev-worker)", pid 222, jiffies 4294894636
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 6265fd77):
[<ffffffff993495ed>] kmalloc_trace+0x29d/0x340
[<ffffffffc0ea4a94>] dm_dmub_sw_init+0xb4/0x450 [amdgpu]
[<ffffffffc0ea4e55>] dm_sw_init+0x15/0x2b0 [amdgpu]
[<ffffffffc0ba8557>] amdgpu_device_init+0x1417/0x24e0 [amdgpu]
[<ffffffffc0bab285>] amdgpu_driver_load_kms+0x15/0x190 [amdgpu]
[<ffffffffc0ba09c7>] amdgpu_pci_probe+0x187/0x4e0 [amdgpu]
[<ffffffff9968fd1e>] local_pci_probe+0x3e/0x90
[<ffffffff996918a3>] pci_device_probe+0xc3/0x230
[<ffffffff99805872>] really_probe+0xe2/0x480
[<ffffffff99805c98>] __driver_probe_device+0x78/0x160
[<ffffffff99805daf>] driver_probe_device+0x1f/0x90
[<ffffffff9980601e>] __driver_attach+0xce/0x1c0
[<ffffffff99803170>] bus_for_each_dev+0x70/0xc0
[<ffffffff99804822>] bus_add_driver+0x112/0x210
[<ffffffff99807245>] driver_register+0x55/0x100
[<ffffffff990012d1>] do_one_initcall+0x41/0x300
Fix this by freeing dmub_srv after destroying it.
Fixes: 743b9786b14a ("drm/amd/display: Hook up the DMUB service in DM")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index f5b257cb32cbd..7385efe699f88 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2088,6 +2088,7 @@ static int dm_sw_fini(void *handle)
if (adev->dm.dmub_srv) {
dmub_srv_destroy(adev->dm.dmub_srv);
+ kfree(adev->dm.dmub_srv);
adev->dm.dmub_srv = NULL;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 237/245] i2c: imx: Add timer for handling the stop condition
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 236/245] drm/amd/display: Fix memory leak in dm_sw_fini() Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 238/245] i2c: imx: when being a target, mark the last read as processed Greg Kroah-Hartman
` (18 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Corey Minyard, Andrew Manley,
Oleksij Rempel, Wolfram Sang, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <minyard@acm.org>
[ Upstream commit f89bf95632b41695402996d96476c44c641d23d7 ]
Most IMX I2C interfaces don't generate an interrupt on a stop condition,
so it won't generate a timely stop event on a slave mode transfer.
Some users, like IPMB, need a timely stop event to work properly.
So, add a timer and add the proper handling to generate a stop event in
slave mode if the interface goes idle.
Signed-off-by: Corey Minyard <minyard@acm.org>
Tested-by: Andrew Manley <andrew.manley@sealingtech.com>
Reviewed-by: Andrew Manley <andrew.manley@sealingtech.com>
Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Stable-dep-of: 87aec499368d ("i2c: imx: when being a target, mark the last read as processed")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-imx.c | 92 ++++++++++++++++++++++++++++--------
1 file changed, 73 insertions(+), 19 deletions(-)
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 5e8853d3f8da7..d545547c89ca7 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -37,6 +37,8 @@
#include <linux/io.h>
#include <linux/iopoll.h>
#include <linux/kernel.h>
+#include <linux/spinlock.h>
+#include <linux/hrtimer.h>
#include <linux/module.h>
#include <linux/of.h>
#include <linux/of_device.h>
@@ -51,6 +53,8 @@
/* This will be the driver name the kernel reports */
#define DRIVER_NAME "imx-i2c"
+#define I2C_IMX_CHECK_DELAY 30000 /* Time to check for bus idle, in NS */
+
/*
* Enable DMA if transfer byte size is bigger than this threshold.
* As the hardware request, it must bigger than 4 bytes.\
@@ -210,6 +214,10 @@ struct imx_i2c_struct {
struct imx_i2c_dma *dma;
struct i2c_client *slave;
enum i2c_slave_event last_slave_event;
+
+ /* For checking slave events. */
+ spinlock_t slave_lock;
+ struct hrtimer slave_timer;
};
static const struct imx_i2c_hwdata imx1_i2c_hwdata = {
@@ -680,7 +688,7 @@ static void i2c_imx_slave_event(struct imx_i2c_struct *i2c_imx,
static void i2c_imx_slave_finish_op(struct imx_i2c_struct *i2c_imx)
{
- u8 val;
+ u8 val = 0;
while (i2c_imx->last_slave_event != I2C_SLAVE_STOP) {
switch (i2c_imx->last_slave_event) {
@@ -701,10 +709,11 @@ static void i2c_imx_slave_finish_op(struct imx_i2c_struct *i2c_imx)
}
}
-static irqreturn_t i2c_imx_slave_isr(struct imx_i2c_struct *i2c_imx,
- unsigned int status, unsigned int ctl)
+/* Returns true if the timer should be restarted, false if not. */
+static irqreturn_t i2c_imx_slave_handle(struct imx_i2c_struct *i2c_imx,
+ unsigned int status, unsigned int ctl)
{
- u8 value;
+ u8 value = 0;
if (status & I2SR_IAL) { /* Arbitration lost */
i2c_imx_clear_irq(i2c_imx, I2SR_IAL);
@@ -712,6 +721,16 @@ static irqreturn_t i2c_imx_slave_isr(struct imx_i2c_struct *i2c_imx,
return IRQ_HANDLED;
}
+ if (!(status & I2SR_IBB)) {
+ /* No master on the bus, that could mean a stop condition. */
+ i2c_imx_slave_finish_op(i2c_imx);
+ return IRQ_HANDLED;
+ }
+
+ if (!(status & I2SR_ICF))
+ /* Data transfer still in progress, ignore this. */
+ goto out;
+
if (status & I2SR_IAAS) { /* Addressed as a slave */
i2c_imx_slave_finish_op(i2c_imx);
if (status & I2SR_SRW) { /* Master wants to read from us*/
@@ -737,16 +756,9 @@ static irqreturn_t i2c_imx_slave_isr(struct imx_i2c_struct *i2c_imx,
imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR);
}
} else if (!(ctl & I2CR_MTX)) { /* Receive mode */
- if (status & I2SR_IBB) { /* No STOP signal detected */
- value = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR);
- i2c_imx_slave_event(i2c_imx,
- I2C_SLAVE_WRITE_RECEIVED, &value);
- } else { /* STOP signal is detected */
- dev_dbg(&i2c_imx->adapter.dev,
- "STOP signal detected");
- i2c_imx_slave_event(i2c_imx,
- I2C_SLAVE_STOP, &value);
- }
+ value = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR);
+ i2c_imx_slave_event(i2c_imx,
+ I2C_SLAVE_WRITE_RECEIVED, &value);
} else if (!(status & I2SR_RXAK)) { /* Transmit mode received ACK */
ctl |= I2CR_MTX;
imx_i2c_write_reg(ctl, i2c_imx, IMX_I2C_I2CR);
@@ -755,15 +767,43 @@ static irqreturn_t i2c_imx_slave_isr(struct imx_i2c_struct *i2c_imx,
I2C_SLAVE_READ_PROCESSED, &value);
imx_i2c_write_reg(value, i2c_imx, IMX_I2C_I2DR);
- } else { /* Transmit mode received NAK */
+ } else { /* Transmit mode received NAK, operation is done */
ctl &= ~I2CR_MTX;
imx_i2c_write_reg(ctl, i2c_imx, IMX_I2C_I2CR);
imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR);
+ i2c_imx_slave_finish_op(i2c_imx);
+ return IRQ_HANDLED;
}
+out:
+ /*
+ * No need to check the return value here. If it returns 0 or
+ * 1, then everything is fine. If it returns -1, then the
+ * timer is running in the handler. This will still work,
+ * though it may be redone (or already have been done) by the
+ * timer function.
+ */
+ hrtimer_try_to_cancel(&i2c_imx->slave_timer);
+ hrtimer_forward_now(&i2c_imx->slave_timer, I2C_IMX_CHECK_DELAY);
+ hrtimer_restart(&i2c_imx->slave_timer);
return IRQ_HANDLED;
}
+static enum hrtimer_restart i2c_imx_slave_timeout(struct hrtimer *t)
+{
+ struct imx_i2c_struct *i2c_imx = container_of(t, struct imx_i2c_struct,
+ slave_timer);
+ unsigned int ctl, status;
+ unsigned long flags;
+
+ spin_lock_irqsave(&i2c_imx->slave_lock, flags);
+ status = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2SR);
+ ctl = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
+ i2c_imx_slave_handle(i2c_imx, status, ctl);
+ spin_unlock_irqrestore(&i2c_imx->slave_lock, flags);
+ return HRTIMER_NORESTART;
+}
+
static void i2c_imx_slave_init(struct imx_i2c_struct *i2c_imx)
{
int temp;
@@ -843,7 +883,9 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id)
{
struct imx_i2c_struct *i2c_imx = dev_id;
unsigned int ctl, status;
+ unsigned long flags;
+ spin_lock_irqsave(&i2c_imx->slave_lock, flags);
status = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2SR);
ctl = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
@@ -851,14 +893,20 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id)
i2c_imx_clear_irq(i2c_imx, I2SR_IIF);
if (i2c_imx->slave) {
if (!(ctl & I2CR_MSTA)) {
- return i2c_imx_slave_isr(i2c_imx, status, ctl);
- } else if (i2c_imx->last_slave_event !=
- I2C_SLAVE_STOP) {
- i2c_imx_slave_finish_op(i2c_imx);
+ irqreturn_t ret;
+
+ ret = i2c_imx_slave_handle(i2c_imx,
+ status, ctl);
+ spin_unlock_irqrestore(&i2c_imx->slave_lock,
+ flags);
+ return ret;
}
+ i2c_imx_slave_finish_op(i2c_imx);
}
+ spin_unlock_irqrestore(&i2c_imx->slave_lock, flags);
return i2c_imx_master_isr(i2c_imx, status);
}
+ spin_unlock_irqrestore(&i2c_imx->slave_lock, flags);
return IRQ_NONE;
}
@@ -1380,6 +1428,10 @@ static int i2c_imx_probe(struct platform_device *pdev)
if (!i2c_imx)
return -ENOMEM;
+ spin_lock_init(&i2c_imx->slave_lock);
+ hrtimer_init(&i2c_imx->slave_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+ i2c_imx->slave_timer.function = i2c_imx_slave_timeout;
+
match = device_get_match_data(&pdev->dev);
if (match)
i2c_imx->hwdata = match;
@@ -1491,6 +1543,8 @@ static int i2c_imx_remove(struct platform_device *pdev)
ret = pm_runtime_get_sync(&pdev->dev);
+ hrtimer_cancel(&i2c_imx->slave_timer);
+
/* remove adapter */
dev_dbg(&i2c_imx->adapter.dev, "adapter removed\n");
i2c_del_adapter(&i2c_imx->adapter);
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 238/245] i2c: imx: when being a target, mark the last read as processed
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 237/245] i2c: imx: Add timer for handling the stop condition Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 239/245] cifs: fix mid leak during reconnection after timeout threshold Greg Kroah-Hartman
` (17 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Corey Minyard, Andrew Manley,
Oleksij Rempel, Wolfram Sang, Andi Shyti, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <minyard@acm.org>
[ Upstream commit 87aec499368d488c20292952d6d4be7cb9e49c5e ]
When being a target, NAK from the controller means that all bytes have
been transferred. So, the last byte needs also to be marked as
'processed'. Otherwise index registers of backends may not increase.
Fixes: f7414cd6923f ("i2c: imx: support slave mode for imx I2C driver")
Signed-off-by: Corey Minyard <minyard@acm.org>
Tested-by: Andrew Manley <andrew.manley@sealingtech.com>
Reviewed-by: Andrew Manley <andrew.manley@sealingtech.com>
Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de>
[wsa: fixed comment and commit message to properly describe the case]
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-imx.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index d545547c89ca7..fae674969628b 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -771,6 +771,11 @@ static irqreturn_t i2c_imx_slave_handle(struct imx_i2c_struct *i2c_imx,
ctl &= ~I2CR_MTX;
imx_i2c_write_reg(ctl, i2c_imx, IMX_I2C_I2CR);
imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR);
+
+ /* flag the last byte as processed */
+ i2c_imx_slave_event(i2c_imx,
+ I2C_SLAVE_READ_PROCESSED, &value);
+
i2c_imx_slave_finish_op(i2c_imx);
return IRQ_HANDLED;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 262+ messages in thread
* [PATCH 5.15 239/245] cifs: fix mid leak during reconnection after timeout threshold
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 238/245] i2c: imx: when being a target, mark the last read as processed Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 240/245] fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio Greg Kroah-Hartman
` (16 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shyam Prasad N, Steve French,
Harshit Mogalapalli
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <nspmangalore@gmail.com>
commit 69cba9d3c1284e0838ae408830a02c4a063104bc upstream.
When the number of responses with status of STATUS_IO_TIMEOUT
exceeds a specified threshold (NUM_STATUS_IO_TIMEOUT), we reconnect
the connection. But we do not return the mid, or the credits
returned for the mid, or reduce the number of in-flight requests.
This bug could result in the server->in_flight count to go bad,
and also cause a leak in the mids.
This change moves the check to a few lines below where the
response is decrypted, even of the response is read from the
transform header. This way, the code for returning the mids
can be reused.
Also, the cifs_reconnect was reconnecting just the transport
connection before. In case of multi-channel, this may not be
what we want to do after several timeouts. Changed that to
reconnect the session and the tree too.
Also renamed NUM_STATUS_IO_TIMEOUT to a more appropriate name
MAX_STATUS_IO_TIMEOUT.
Fixes: 8e670f77c4a5 ("Handle STATUS_IO_TIMEOUT gracefully")
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[Harshit: Backport to 5.15.y]
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/connect.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -59,7 +59,7 @@ extern bool disable_legacy_dialects;
#define TLINK_IDLE_EXPIRE (600 * HZ)
/* Drop the connection to not overload the server */
-#define NUM_STATUS_IO_TIMEOUT 5
+#define MAX_STATUS_IO_TIMEOUT 5
struct mount_ctx {
struct cifs_sb_info *cifs_sb;
@@ -965,6 +965,7 @@ cifs_demultiplex_thread(void *p)
struct mid_q_entry *mids[MAX_COMPOUND];
char *bufs[MAX_COMPOUND];
unsigned int noreclaim_flag, num_io_timeout = 0;
+ bool pending_reconnect = false;
noreclaim_flag = memalloc_noreclaim_save();
cifs_dbg(FYI, "Demultiplex PID: %d\n", task_pid_nr(current));
@@ -1004,6 +1005,8 @@ cifs_demultiplex_thread(void *p)
cifs_dbg(FYI, "RFC1002 header 0x%x\n", pdu_length);
if (!is_smb_response(server, buf[0]))
continue;
+
+ pending_reconnect = false;
next_pdu:
server->pdu_size = pdu_length;
@@ -1063,10 +1066,13 @@ next_pdu:
if (server->ops->is_status_io_timeout &&
server->ops->is_status_io_timeout(buf)) {
num_io_timeout++;
- if (num_io_timeout > NUM_STATUS_IO_TIMEOUT) {
- cifs_reconnect(server);
+ if (num_io_timeout > MAX_STATUS_IO_TIMEOUT) {
+ cifs_server_dbg(VFS,
+ "Number of request timeouts exceeded %d. Reconnecting",
+ MAX_STATUS_IO_TIMEOUT);
+
+ pending_reconnect = true;
num_io_timeout = 0;
- continue;
}
}
@@ -1113,6 +1119,11 @@ next_pdu:
buf = server->smallbuf;
goto next_pdu;
}
+
+ /* do this reconnect at the very end after processing all MIDs */
+ if (pending_reconnect)
+ cifs_reconnect(server);
+
} /* end while !EXITING */
/* buffer usually freed in free_mid - need to free it here on exit */
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 240/245] fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 239/245] cifs: fix mid leak during reconnection after timeout threshold Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 241/245] arp: Prevent overflow in arp_req_get() Greg Kroah-Hartman
` (15 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jens Axboe, Christoph Hellwig,
Avi Kivity, Sandeep Dhavale, Kent Overstreet, Bart Van Assche,
Christian Brauner
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
commit b820de741ae48ccf50dd95e297889c286ff4f760 upstream.
If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the
following kernel warning appears:
WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8
Call trace:
kiocb_set_cancel_fn+0x9c/0xa8
ffs_epfile_read_iter+0x144/0x1d0
io_read+0x19c/0x498
io_issue_sqe+0x118/0x27c
io_submit_sqes+0x25c/0x5fc
__arm64_sys_io_uring_enter+0x104/0xab0
invoke_syscall+0x58/0x11c
el0_svc_common+0xb4/0xf4
do_el0_svc+0x2c/0xb0
el0_svc+0x2c/0xa4
el0t_64_sync_handler+0x68/0xb4
el0t_64_sync+0x1a4/0x1a8
Fix this by setting the IOCB_AIO_RW flag for read and write I/O that is
submitted by libaio.
Suggested-by: Jens Axboe <axboe@kernel.dk>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Avi Kivity <avi@scylladb.com>
Cc: Sandeep Dhavale <dhavale@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: stable@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20240215204739.2677806-2-bvanassche@acm.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/aio.c | 9 ++++++++-
include/linux/fs.h | 2 ++
2 files changed, 10 insertions(+), 1 deletion(-)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -568,6 +568,13 @@ void kiocb_set_cancel_fn(struct kiocb *i
struct kioctx *ctx = req->ki_ctx;
unsigned long flags;
+ /*
+ * kiocb didn't come from aio or is neither a read nor a write, hence
+ * ignore it.
+ */
+ if (!(iocb->ki_flags & IOCB_AIO_RW))
+ return;
+
if (WARN_ON_ONCE(!list_empty(&req->ki_list)))
return;
@@ -1453,7 +1460,7 @@ static int aio_prep_rw(struct kiocb *req
req->ki_complete = aio_complete_rw;
req->private = NULL;
req->ki_pos = iocb->aio_offset;
- req->ki_flags = iocb_flags(req->ki_filp);
+ req->ki_flags = iocb_flags(req->ki_filp) | IOCB_AIO_RW;
if (iocb->aio_flags & IOCB_FLAG_RESFD)
req->ki_flags |= IOCB_EVENTFD;
req->ki_hint = ki_hint_validate(file_write_hint(req->ki_filp));
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -322,6 +322,8 @@ enum rw_hint {
#define IOCB_NOIO (1 << 20)
/* can use bio alloc cache */
#define IOCB_ALLOC_CACHE (1 << 21)
+/* kiocb is a read or write operation submitted by fs/aio.c. */
+#define IOCB_AIO_RW (1 << 23)
struct kiocb {
struct file *ki_filp;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 241/245] arp: Prevent overflow in arp_req_get().
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 240/245] fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 242/245] netfilter: nf_tables: fix scheduling-while-atomic splat Greg Kroah-Hartman
` (14 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzkaller, Bjoern Doebel,
Kuniyuki Iwashima, Paolo Abeni
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@amazon.com>
commit a7d6027790acea24446ddd6632d394096c0f4667 upstream.
syzkaller reported an overflown write in arp_req_get(). [0]
When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour
entry and copies neigh->ha to struct arpreq.arp_ha.sa_data.
The arp_ha here is struct sockaddr, not struct sockaddr_storage, so
the sa_data buffer is just 14 bytes.
In the splat below, 2 bytes are overflown to the next int field,
arp_flags. We initialise the field just after the memcpy(), so it's
not a problem.
However, when dev->addr_len is greater than 22 (e.g. MAX_ADDR_LEN),
arp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)
in arp_ioctl() before calling arp_req_get().
To avoid the overflow, let's limit the max length of memcpy().
Note that commit b5f0de6df6dc ("net: dev: Convert sa_data to flexible
array in struct sockaddr") just silenced syzkaller.
[0]:
memcpy: detected field-spanning write (size 16) of single field "r->arp_ha.sa_data" at net/ipv4/arp.c:1128 (size 14)
WARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128
Modules linked in:
CPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014
RIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128
Code: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb <0f> 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6
RSP: 0018:ffffc900050b7998 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001
RBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000
R13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010
FS: 00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261
inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981
sock_do_ioctl+0xdf/0x260 net/socket.c:1204
sock_ioctl+0x3ef/0x650 net/socket.c:1321
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x64/0xce
RIP: 0033:0x7f172b262b8d
Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d
RDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003
RBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000
</TASK>
Reported-by: syzkaller <syzkaller@googlegroups.com>
Reported-by: Bjoern Doebel <doebel@amazon.de>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20240215230516.31330-1-kuniyu@amazon.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/arp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1104,7 +1104,8 @@ static int arp_req_get(struct arpreq *r,
if (neigh) {
if (!(neigh->nud_state & NUD_NOARP)) {
read_lock_bh(&neigh->lock);
- memcpy(r->arp_ha.sa_data, neigh->ha, dev->addr_len);
+ memcpy(r->arp_ha.sa_data, neigh->ha,
+ min(dev->addr_len, (unsigned char)sizeof(r->arp_ha.sa_data_min)));
r->arp_flags = arp_state_to_flags(neigh);
read_unlock_bh(&neigh->lock);
r->arp_ha.sa_family = dev->type;
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 242/245] netfilter: nf_tables: fix scheduling-while-atomic splat
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 241/245] arp: Prevent overflow in arp_req_get() Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 243/245] ext4: regenerate buddy after block freeing failed if under fc replay Greg Kroah-Hartman
` (13 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 2024439bd5ceb145eeeb428b2a59e9b905153ac3 upstream.
nf_tables_check_loops() can be called from rhashtable list
walk so cond_resched() cannot be used here.
Fixes: 81ea01066741 ("netfilter: nf_tables: add rescheduling points during loop detection walks")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_tables_api.c | 4 ----
1 file changed, 4 deletions(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -10044,13 +10044,9 @@ static int nf_tables_check_loops(const s
break;
}
}
-
- cond_resched();
}
list_for_each_entry(set, &ctx->table->sets, list) {
- cond_resched();
-
if (!nft_is_active_next(ctx->net, set))
continue;
if (!(set->flags & NFT_SET_MAP) ||
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 243/245] ext4: regenerate buddy after block freeing failed if under fc replay
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 242/245] netfilter: nf_tables: fix scheduling-while-atomic splat Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 244/245] ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks() Greg Kroah-Hartman
` (12 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara, Baokun Li, Theodore Tso
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun1@huawei.com>
commit c9b528c35795b711331ed36dc3dbee90d5812d4e upstream.
This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant
mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on
code in mb_free_blocks(), fast commit replay can end up marking as free
blocks that are already marked as such. This causes corruption of the
buddy bitmap so we need to regenerate it in that case.
Reported-by: Jan Kara <jack@suse.cz>
Fixes: 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()")
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20240104142040.2835097-4-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/mballoc.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1168,6 +1168,24 @@ void ext4_mb_generate_buddy(struct super
mb_update_avg_fragment_size(sb, grp);
}
+static void mb_regenerate_buddy(struct ext4_buddy *e4b)
+{
+ int count;
+ int order = 1;
+ void *buddy;
+
+ while ((buddy = mb_find_buddy(e4b, order++, &count)))
+ ext4_set_bits(buddy, 0, count);
+
+ e4b->bd_info->bb_fragments = 0;
+ memset(e4b->bd_info->bb_counters, 0,
+ sizeof(*e4b->bd_info->bb_counters) *
+ (e4b->bd_sb->s_blocksize_bits + 2));
+
+ ext4_mb_generate_buddy(e4b->bd_sb, e4b->bd_buddy,
+ e4b->bd_bitmap, e4b->bd_group, e4b->bd_info);
+}
+
/* The buddy information is attached the buddy cache inode
* for convenience. The information regarding each group
* is loaded via ext4_mb_load_buddy. The information involve
@@ -1846,6 +1864,8 @@ static void mb_free_blocks(struct inode
ext4_mark_group_bitmap_corrupted(
sb, e4b->bd_group,
EXT4_GROUP_INFO_BBITMAP_CORRUPT);
+ } else {
+ mb_regenerate_buddy(e4b);
}
goto done;
}
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 244/245] ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks()
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 243/245] ext4: regenerate buddy after block freeing failed if under fc replay Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 245/245] netfilter: nf_tables: cant schedule in nft_chain_validate Greg Kroah-Hartman
` (11 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara, Baokun Li, Theodore Tso
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun1@huawei.com>
commit 2331fd4a49864e1571b4f50aa3aa1536ed6220d0 upstream.
After updating bb_free in mb_free_blocks, it is possible to return without
updating bb_fragments because the block being freed is found to have
already been freed, which leads to inconsistency between bb_free and
bb_fragments.
Since the group may be unlocked in ext4_grp_locked_error(), this can lead
to problems such as dividing by zero when calculating the average fragment
length. Hence move the update of bb_free to after the block double-free
check guarantees that the corresponding statistics are updated only after
the core block bitmap is modified.
Fixes: eabe0444df90 ("ext4: speed-up releasing blocks on commit")
CC: <stable@vger.kernel.org> # 3.10
Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20240104142040.2835097-5-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/mballoc.c | 39 +++++++++++++++++++++------------------
1 file changed, 21 insertions(+), 18 deletions(-)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1835,11 +1835,6 @@ static void mb_free_blocks(struct inode
mb_check_buddy(e4b);
mb_free_blocks_double(inode, e4b, first, count);
- this_cpu_inc(discard_pa_seq);
- e4b->bd_info->bb_free += count;
- if (first < e4b->bd_info->bb_first_free)
- e4b->bd_info->bb_first_free = first;
-
/* access memory sequentially: check left neighbour,
* clear range and then check right neighbour
*/
@@ -1853,23 +1848,31 @@ static void mb_free_blocks(struct inode
struct ext4_sb_info *sbi = EXT4_SB(sb);
ext4_fsblk_t blocknr;
+ /*
+ * Fastcommit replay can free already freed blocks which
+ * corrupts allocation info. Regenerate it.
+ */
+ if (sbi->s_mount_state & EXT4_FC_REPLAY) {
+ mb_regenerate_buddy(e4b);
+ goto check;
+ }
+
blocknr = ext4_group_first_block_no(sb, e4b->bd_group);
blocknr += EXT4_C2B(sbi, block);
- if (!(sbi->s_mount_state & EXT4_FC_REPLAY)) {
- ext4_grp_locked_error(sb, e4b->bd_group,
- inode ? inode->i_ino : 0,
- blocknr,
- "freeing already freed block (bit %u); block bitmap corrupt.",
- block);
- ext4_mark_group_bitmap_corrupted(
- sb, e4b->bd_group,
+ ext4_grp_locked_error(sb, e4b->bd_group,
+ inode ? inode->i_ino : 0, blocknr,
+ "freeing already freed block (bit %u); block bitmap corrupt.",
+ block);
+ ext4_mark_group_bitmap_corrupted(sb, e4b->bd_group,
EXT4_GROUP_INFO_BBITMAP_CORRUPT);
- } else {
- mb_regenerate_buddy(e4b);
- }
- goto done;
+ return;
}
+ this_cpu_inc(discard_pa_seq);
+ e4b->bd_info->bb_free += count;
+ if (first < e4b->bd_info->bb_first_free)
+ e4b->bd_info->bb_first_free = first;
+
/* let's maintain fragments counter */
if (left_is_free && right_is_free)
e4b->bd_info->bb_fragments--;
@@ -1894,9 +1897,9 @@ static void mb_free_blocks(struct inode
if (first <= last)
mb_buddy_mark_free(e4b, first >> 1, last >> 1);
-done:
mb_set_largest_free_order(sb, e4b->bd_info);
mb_update_avg_fragment_size(sb, e4b->bd_info);
+check:
mb_check_buddy(e4b);
}
^ permalink raw reply [flat|nested] 262+ messages in thread
* [PATCH 5.15 245/245] netfilter: nf_tables: cant schedule in nft_chain_validate
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 244/245] ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks() Greg Kroah-Hartman
@ 2024-02-27 13:27 ` Greg Kroah-Hartman
2024-02-27 17:47 ` [PATCH 5.15 000/245] 5.15.150-rc1 review SeongJae Park
` (10 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-27 13:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 314c82841602a111c04a7210c21dc77e0d560242 upstream.
Can be called via nft set element list iteration, which may acquire
rcu and/or bh read lock (depends on set type).
BUG: sleeping function called from invalid context at net/netfilter/nf_tables_api.c:3353
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1232, name: nft
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
2 locks held by nft/1232:
#0: ffff8881180e3ea8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid
#1: ffffffff83f5f540 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire
Call Trace:
nft_chain_validate
nft_lookup_validate_setelem
nft_pipapo_walk
nft_lookup_validate
nft_chain_validate
nft_immediate_validate
nft_chain_validate
nf_tables_validate
nf_tables_abort
No choice but to move it to nf_tables_validate().
Fixes: 81ea01066741 ("netfilter: nf_tables: add rescheduling points during loop detection walks")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_tables_api.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3443,8 +3443,6 @@ int nft_chain_validate(const struct nft_
if (err < 0)
return err;
}
-
- cond_resched();
}
return 0;
@@ -3468,6 +3466,8 @@ static int nft_table_validate(struct net
err = nft_chain_validate(&ctx, chain);
if (err < 0)
return err;
+
+ cond_resched();
}
return 0;
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2024-02-27 13:27 ` [PATCH 5.15 245/245] netfilter: nf_tables: cant schedule in nft_chain_validate Greg Kroah-Hartman
@ 2024-02-27 17:47 ` SeongJae Park
2024-02-27 18:00 ` Pavel Machek
` (9 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: SeongJae Park @ 2024-02-27 17:47 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml, damon,
SeongJae Park
Hello,
On Tue, 27 Feb 2024 14:23:08 +0100 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 5.15.150 release.
> There are 245 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
This rc kernel passes DAMON functionality test[1] on my test machine.
Attaching the test results summary below. Please note that I retrieved the
kernel from linux-stable-rc tree[2].
Tested-by: SeongJae Park <sj@kernel.org>
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] 3ab4d9c9e190 ("Linux 5.15.150-rc1")
Thanks,
SJ
[...]
---
ok 1 selftests: damon: debugfs_attrs.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh
ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh
ok 12 selftests: damon-tests: build_m68k.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2024-02-27 17:47 ` [PATCH 5.15 000/245] 5.15.150-rc1 review SeongJae Park
@ 2024-02-27 18:00 ` Pavel Machek
2024-02-27 18:56 ` Daniel Díaz
` (8 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Pavel Machek @ 2024-02-27 18:00 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml
[-- Attachment #1: Type: text/plain, Size: 1950 bytes --]
Hi!
> This is the start of the stable review cycle for the 5.15.150 release.
> There are 245 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> Anything received after that time might be too late.
We get build errors on risc-v:
CC drivers/clocksource/dummy_timer.o
2773 CC net/sunrpc/timer.o
2774 CC drivers/firmware/efi/libstub/lib-fdt_rw.o
2775In file included from ./include/linux/list.h:9,
2776 from ./include/linux/module.h:12,
2777 from drivers/net/ethernet/realtek/r8169_main.c:12:
2778drivers/net/ethernet/realtek/r8169_main.c:5512:23: error: 'rtl8169_pm_ops' undeclared here (not in a function); did you mean 'rtl8169_poll'?
2779 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
2780 | ^~~~~~~~~~~~~~
2781./include/linux/kernel.h:46:38: note: in definition of macro 'PTR_IF'
2782 46 | #define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL)
2783 | ^~~
2784drivers/net/ethernet/realtek/r8169_main.c:5512:15: note: in expansion of macro 'pm_ptr'
2785 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
2786 | ^~~~~~
2787 CC net/sunrpc/xdr.o
2788 CC drivers/clocksource/timer-riscv.o
2789make[4]: *** [scripts/Makefile.build:289: drivers/net/ethernet/realtek/r8169_main.o] Error 1
2790make[4]: *** Waiting for unfinished jobs....
2791 CC drivers/mmc/core/sdio_bus.o
2792 CC net/sunrpc/sunrpc_syms.o
2793 CC fs/fhandle.o
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1192614164
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2024-02-27 18:00 ` Pavel Machek
@ 2024-02-27 18:56 ` Daniel Díaz
2024-02-29 19:54 ` Greg Kroah-Hartman
2024-02-27 19:13 ` Florian Fainelli
` (7 subsequent siblings)
255 siblings, 1 reply; 262+ messages in thread
From: Daniel Díaz @ 2024-02-27 18:56 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml, paul
Hello!
On 27/02/24 7:23 a. m., Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.150 release.
> There are 245 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
We're seeing build regressions here with RISC-V, with GCC 8, GCC 12, and Clang 17:
-----8<-----
In file included from /builds/linux/include/linux/list.h:9,
from /builds/linux/include/linux/module.h:12,
from /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:12:
/builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:35: error: 'rtl8169_pm_ops' undeclared here (not in a function); did you mean 'rtl8169_poll'?
5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
| ^~~~~~~~~~~~~~
/builds/linux/include/linux/kernel.h:46:44: note: in definition of macro 'PTR_IF'
46 | #define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL)
| ^~~
/builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:27: note: in expansion of macro 'pm_ptr'
5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
| ^~~~~~
make[5]: *** [/builds/linux/scripts/Makefile.build:289: drivers/net/ethernet/realtek/r8169_main.o] Error 1
----->8-----
Bisection points to:
commit ac2871f646a8f556203f5b6be875ce406d855ddb
Author: Paul Cercueil <paul@crapouillou.net>
Date: Tue Dec 7 00:20:59 2021 +0000
PM: core: Redefine pm_ptr() macro
[ Upstream commit c06ef740d401d0f4ab188882bf6f8d9cf0f75eaf ]
A revert could not be done cleanly.
Tuxmake reproducer:
tuxmake --runtime podman --target-arch riscv --toolchain gcc-12 --kconfig defconfig
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Greetings!
Daniel Díaz
daniel.diaz@linaro.org
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2024-02-27 18:56 ` Daniel Díaz
@ 2024-02-27 19:13 ` Florian Fainelli
2024-02-27 19:20 ` Shreeya Patel
` (6 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Florian Fainelli @ 2024-02-27 19:13 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, srw, rwarsow,
conor, allen.lkml
On 2/27/24 05:23, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.150 release.
> There are 245 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2024-02-27 19:13 ` Florian Fainelli
@ 2024-02-27 19:20 ` Shreeya Patel
2024-02-28 0:30 ` Kelsey Steele
` (5 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Shreeya Patel @ 2024-02-27 19:20 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml,
Gustavo Padovan, kernelci-regressions mailing list
On Tuesday, February 27, 2024 18:53 IST, Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 5.15.150 release.
> There are 245 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
KernelCI report for stable-rc/linux-5.15.y for this week.
## stable-rc HEAD for linux-5.15.y:
Date: 2024-02-27
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/log/?h=3ab4d9c9e190217ee7e974c70b96795cd2f74611
## Build failures:
riscv:
- defconfig (gcc-10) and rv32_defconfig (gcc-10)
- Build details :- https://linux.kernelci.org/build/stable-rc/branch/linux-5.15.y/kernel/v5.15.149-246-g3ab4d9c9e190/
- Errors :-
drivers/net/ethernet/realtek/r8169_main.c:5512:23: error: ‘rtl8169_pm_ops’ undeclared here (not in a function); did you mean ‘rtl8169_poll’?
## Boot failures:
No **new** boot failures seen for the stable-rc/linux-5.15.y commit head \o/
Tested-by: kernelci.org bot <bot@kernelci.org>
Thanks,
Shreeya Patel
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2024-02-27 19:20 ` Shreeya Patel
@ 2024-02-28 0:30 ` Kelsey Steele
2024-02-28 13:38 ` Jon Hunter
` (4 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Kelsey Steele @ 2024-02-28 0:30 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml
On Tue, Feb 27, 2024 at 02:23:08PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.150 release.
> There are 245 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> Anything received after that time might be too late.
>
No regressions found on WSL (x86 and arm64).
Built, booted, and reviewed dmesg.
Thank you. :)
Tested-by: Kelsey Steele <kelseysteele@linux.microsoft.com>
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2024-02-28 0:30 ` Kelsey Steele
@ 2024-02-28 13:38 ` Jon Hunter
2024-02-28 16:47 ` Shuah Khan
` (3 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Jon Hunter @ 2024-02-28 13:38 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml, linux-tegra,
stable
On Tue, 27 Feb 2024 14:23:08 +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.150 release.
> There are 245 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests passing for Tegra ...
Test results for stable-v5.15:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
102 tests: 102 pass, 0 fail
Linux version: 5.15.150-rc1-g3ab4d9c9e190
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Jon
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2024-02-28 13:38 ` Jon Hunter
@ 2024-02-28 16:47 ` Shuah Khan
2024-02-28 17:40 ` Allen
` (2 subsequent siblings)
255 siblings, 0 replies; 262+ messages in thread
From: Shuah Khan @ 2024-02-28 16:47 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml, Shuah Khan
On 2/27/24 06:23, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.150 release.
> There are 245 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2024-02-28 16:47 ` Shuah Khan
@ 2024-02-28 17:40 ` Allen
2024-02-28 18:19 ` Harshit Mogalapalli
2024-02-29 18:15 ` Guenter Roeck
255 siblings, 0 replies; 262+ messages in thread
From: Allen @ 2024-02-28 17:40 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
> This is the start of the stable review cycle for the 5.15.150 release.
> There are 245 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my x86_64 and ARM64 test systems. No errors or
regressions.
Tested-by: Allen Pais <apais@linux.microsoft.com>
Thanks.
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2024-02-28 17:40 ` Allen
@ 2024-02-28 18:19 ` Harshit Mogalapalli
2024-02-29 18:15 ` Guenter Roeck
255 siblings, 0 replies; 262+ messages in thread
From: Harshit Mogalapalli @ 2024-02-28 18:19 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml, Vegard Nossum, Darren Kenny
Hi Greg,
On 27/02/24 18:53, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.150 release.
> There are 245 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> Anything received after that time might be too late.
>
No problems seen on x86_64 and aarch64 with our testing.
Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Thanks,
Harshit
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2024-02-28 18:19 ` Harshit Mogalapalli
@ 2024-02-29 18:15 ` Guenter Roeck
2024-02-29 18:42 ` Greg Kroah-Hartman
255 siblings, 1 reply; 262+ messages in thread
From: Guenter Roeck @ 2024-02-29 18:15 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml
On 2/27/24 05:23, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.150 release.
> There are 245 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> Anything received after that time might be too late.
>
$ git grep dma_fence_allocate_private_stub
drivers/dma-buf/dma-fence-unwrap.c: return dma_fence_allocate_private_stub(timestamp);
^^^^^^^^^
drivers/dma-buf/dma-fence-unwrap.c: tmp = dma_fence_allocate_private_stub(ktime_get());
^^^^^^^^^^^
drivers/dma-buf/dma-fence.c: * dma_fence_allocate_private_stub - return a private, signaled fence
drivers/dma-buf/dma-fence.c:struct dma_fence *dma_fence_allocate_private_stub(void)
^^^^
drivers/dma-buf/dma-fence.c:EXPORT_SYMBOL(dma_fence_allocate_private_stub);
drivers/gpu/drm/drm_syncobj.c: struct dma_fence *fence = dma_fence_allocate_private_stub();
include/linux/dma-fence.h:struct dma_fence *dma_fence_allocate_private_stub(void);
^^^^
This was introduced with commit 4e82b9c11d3cd ("dma-buf: add dma_fence_timestamp helper") in
v5.15.149. The additional parameter to dma_fence_allocate_private_stub() was introduced in the
upstream kernel with commit f781f661e8c99 ("dma-buf: keep the signaling time of merged fences
v3") which is missing in v5.15.y.
Guenter
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-29 18:15 ` Guenter Roeck
@ 2024-02-29 18:42 ` Greg Kroah-Hartman
2024-02-29 18:56 ` Guenter Roeck
0 siblings, 1 reply; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-29 18:42 UTC (permalink / raw)
To: Guenter Roeck
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml
On Thu, Feb 29, 2024 at 10:15:49AM -0800, Guenter Roeck wrote:
> On 2/27/24 05:23, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 5.15.150 release.
> > There are 245 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> > Anything received after that time might be too late.
> >
>
> $ git grep dma_fence_allocate_private_stub
> drivers/dma-buf/dma-fence-unwrap.c: return dma_fence_allocate_private_stub(timestamp);
> ^^^^^^^^^
> drivers/dma-buf/dma-fence-unwrap.c: tmp = dma_fence_allocate_private_stub(ktime_get());
> ^^^^^^^^^^^
> drivers/dma-buf/dma-fence.c: * dma_fence_allocate_private_stub - return a private, signaled fence
> drivers/dma-buf/dma-fence.c:struct dma_fence *dma_fence_allocate_private_stub(void)
> ^^^^
> drivers/dma-buf/dma-fence.c:EXPORT_SYMBOL(dma_fence_allocate_private_stub);
> drivers/gpu/drm/drm_syncobj.c: struct dma_fence *fence = dma_fence_allocate_private_stub();
> include/linux/dma-fence.h:struct dma_fence *dma_fence_allocate_private_stub(void);
> ^^^^
How is any of this building then? Does no one actually use
dma-fence-unwrap.c?
> This was introduced with commit 4e82b9c11d3cd ("dma-buf: add dma_fence_timestamp helper") in
> v5.15.149. The additional parameter to dma_fence_allocate_private_stub() was introduced in the
> upstream kernel with commit f781f661e8c99 ("dma-buf: keep the signaling time of merged fences
> v3") which is missing in v5.15.y.
f781f661e8c99 still uses an option to dma_fence_allocate_private_stub():
- return dma_fence_get_stub();
+ return dma_fence_allocate_private_stub(timestamp);
So backporting that will continue the breakage, right?
confused,
greg k-h
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-29 18:42 ` Greg Kroah-Hartman
@ 2024-02-29 18:56 ` Guenter Roeck
0 siblings, 0 replies; 262+ messages in thread
From: Guenter Roeck @ 2024-02-29 18:56 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml
On 2/29/24 10:42, Greg Kroah-Hartman wrote:
> On Thu, Feb 29, 2024 at 10:15:49AM -0800, Guenter Roeck wrote:
>> On 2/27/24 05:23, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 5.15.150 release.
>>> There are 245 patches in this series, all will be posted as a response
>>> to this one. If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
>>> Anything received after that time might be too late.
>>>
>>
>> $ git grep dma_fence_allocate_private_stub
>> drivers/dma-buf/dma-fence-unwrap.c: return dma_fence_allocate_private_stub(timestamp);
>> ^^^^^^^^^
>> drivers/dma-buf/dma-fence-unwrap.c: tmp = dma_fence_allocate_private_stub(ktime_get());
>> ^^^^^^^^^^^
>> drivers/dma-buf/dma-fence.c: * dma_fence_allocate_private_stub - return a private, signaled fence
>> drivers/dma-buf/dma-fence.c:struct dma_fence *dma_fence_allocate_private_stub(void)
>> ^^^^
>> drivers/dma-buf/dma-fence.c:EXPORT_SYMBOL(dma_fence_allocate_private_stub);
>> drivers/gpu/drm/drm_syncobj.c: struct dma_fence *fence = dma_fence_allocate_private_stub();
>> include/linux/dma-fence.h:struct dma_fence *dma_fence_allocate_private_stub(void);
>> ^^^^
>
> How is any of this building then? Does no one actually use
> dma-fence-unwrap.c?
>
It was found as part of the merge of v5.15.149 into ChromeOS. I did not check the
detailed circumstances and/or why ChromeOS stumbled over the problem. The merge introduces
other problems for us. We are busy tracking those down, so I don't have much time to look
into this further (not blaming v5.15.y, more likely it is the result of conflicts between
deviating code bases).
>> This was introduced with commit 4e82b9c11d3cd ("dma-buf: add dma_fence_timestamp helper") in
>> v5.15.149. The additional parameter to dma_fence_allocate_private_stub() was introduced in the
>> upstream kernel with commit f781f661e8c99 ("dma-buf: keep the signaling time of merged fences
>> v3") which is missing in v5.15.y.
>
> f781f661e8c99 still uses an option to dma_fence_allocate_private_stub():
> - return dma_fence_get_stub();
> + return dma_fence_allocate_private_stub(timestamp);
>
> So backporting that will continue the breakage, right?
>
> confused,
>
Most likely I missed some other commit when running "git blame". Never mind, though.
We'll deal with the problem internally. It was just a note to let people know
that there is some inconsistency in v5.15.y.
Thanks,
Guenter
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-27 18:56 ` Daniel Díaz
@ 2024-02-29 19:54 ` Greg Kroah-Hartman
2024-02-29 20:19 ` Guenter Roeck
0 siblings, 1 reply; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-29 19:54 UTC (permalink / raw)
To: Daniel Díaz
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml, paul
On Tue, Feb 27, 2024 at 12:56:32PM -0600, Daniel Díaz wrote:
> Hello!
>
> On 27/02/24 7:23 a. m., Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 5.15.150 release.
> > There are 245 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
> We're seeing build regressions here with RISC-V, with GCC 8, GCC 12, and Clang 17:
>
> -----8<-----
> In file included from /builds/linux/include/linux/list.h:9,
> from /builds/linux/include/linux/module.h:12,
> from /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:12:
> /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:35: error: 'rtl8169_pm_ops' undeclared here (not in a function); did you mean 'rtl8169_poll'?
> 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
> | ^~~~~~~~~~~~~~
> /builds/linux/include/linux/kernel.h:46:44: note: in definition of macro 'PTR_IF'
> 46 | #define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL)
> | ^~~
> /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:27: note: in expansion of macro 'pm_ptr'
> 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
> | ^~~~~~
> make[5]: *** [/builds/linux/scripts/Makefile.build:289: drivers/net/ethernet/realtek/r8169_main.o] Error 1
> ----->8-----
>
> Bisection points to:
>
> commit ac2871f646a8f556203f5b6be875ce406d855ddb
> Author: Paul Cercueil <paul@crapouillou.net>
> Date: Tue Dec 7 00:20:59 2021 +0000
> PM: core: Redefine pm_ptr() macro
> [ Upstream commit c06ef740d401d0f4ab188882bf6f8d9cf0f75eaf ]
>
> A revert could not be done cleanly.
>
> Tuxmake reproducer:
>
> tuxmake --runtime podman --target-arch riscv --toolchain gcc-12 --kconfig defconfig
>
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
I've been beating on this for a while and I really don't know what is
happening, sorry. The driver looks fine, something is "odd" with riscv
here that is not "odd" with other arches.
I'll leave this as-is for now and hopefully someone who relies on riscv
can help track it down.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-29 19:54 ` Greg Kroah-Hartman
@ 2024-02-29 20:19 ` Guenter Roeck
2024-02-29 20:31 ` Greg Kroah-Hartman
0 siblings, 1 reply; 262+ messages in thread
From: Guenter Roeck @ 2024-02-29 20:19 UTC (permalink / raw)
To: Greg Kroah-Hartman, Daniel Díaz
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml, paul
On 2/29/24 11:54, Greg Kroah-Hartman wrote:
> On Tue, Feb 27, 2024 at 12:56:32PM -0600, Daniel Díaz wrote:
>> Hello!
>>
>> On 27/02/24 7:23 a. m., Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 5.15.150 release.
>>> There are 245 patches in this series, all will be posted as a response
>>> to this one. If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
>>> Anything received after that time might be too late.
>>>
>>> The whole patch series can be found in one patch at:
>>> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
>>> or in the git tree and branch at:
>>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
>>> and the diffstat can be found below.
>>>
>>> thanks,
>>>
>>> greg k-h
>>
>> We're seeing build regressions here with RISC-V, with GCC 8, GCC 12, and Clang 17:
>>
>> -----8<-----
>> In file included from /builds/linux/include/linux/list.h:9,
>> from /builds/linux/include/linux/module.h:12,
>> from /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:12:
>> /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:35: error: 'rtl8169_pm_ops' undeclared here (not in a function); did you mean 'rtl8169_poll'?
>> 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
>> | ^~~~~~~~~~~~~~
>> /builds/linux/include/linux/kernel.h:46:44: note: in definition of macro 'PTR_IF'
>> 46 | #define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL)
>> | ^~~
>> /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:27: note: in expansion of macro 'pm_ptr'
>> 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
>> | ^~~~~~
>> make[5]: *** [/builds/linux/scripts/Makefile.build:289: drivers/net/ethernet/realtek/r8169_main.o] Error 1
>> ----->8-----
>>
>> Bisection points to:
>>
>> commit ac2871f646a8f556203f5b6be875ce406d855ddb
>> Author: Paul Cercueil <paul@crapouillou.net>
>> Date: Tue Dec 7 00:20:59 2021 +0000
>> PM: core: Redefine pm_ptr() macro
>> [ Upstream commit c06ef740d401d0f4ab188882bf6f8d9cf0f75eaf ]
>>
>> A revert could not be done cleanly.
>>
>> Tuxmake reproducer:
>>
>> tuxmake --runtime podman --target-arch riscv --toolchain gcc-12 --kconfig defconfig
>>
>> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
>
> I've been beating on this for a while and I really don't know what is
> happening, sorry. The driver looks fine, something is "odd" with riscv
No, the driver is not fine. Upstream has commit 8fe6e670640e ("r8169: use new
PM macros") which makes rtl8169_pm_ops unconditional. That commit is missing
in v5.15.y. Applying it makes the problem disappear.
In other words, the problem is not riscv specific, but will be seen if the
realtek driver is built with CONFIG_PM=n (which happens to be the case with
riscv:defconfig).
Guenter
^ permalink raw reply [flat|nested] 262+ messages in thread
* Re: [PATCH 5.15 000/245] 5.15.150-rc1 review
2024-02-29 20:19 ` Guenter Roeck
@ 2024-02-29 20:31 ` Greg Kroah-Hartman
0 siblings, 0 replies; 262+ messages in thread
From: Greg Kroah-Hartman @ 2024-02-29 20:31 UTC (permalink / raw)
To: Guenter Roeck
Cc: Daniel Díaz, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml, paul
On Thu, Feb 29, 2024 at 12:19:40PM -0800, Guenter Roeck wrote:
> On 2/29/24 11:54, Greg Kroah-Hartman wrote:
> > On Tue, Feb 27, 2024 at 12:56:32PM -0600, Daniel Díaz wrote:
> > > Hello!
> > >
> > > On 27/02/24 7:23 a. m., Greg Kroah-Hartman wrote:
> > > > This is the start of the stable review cycle for the 5.15.150 release.
> > > > There are 245 patches in this series, all will be posted as a response
> > > > to this one. If anyone has any issues with these being applied, please
> > > > let me know.
> > > >
> > > > Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000.
> > > > Anything received after that time might be too late.
> > > >
> > > > The whole patch series can be found in one patch at:
> > > > https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gz
> > > > or in the git tree and branch at:
> > > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> > > > and the diffstat can be found below.
> > > >
> > > > thanks,
> > > >
> > > > greg k-h
> > >
> > > We're seeing build regressions here with RISC-V, with GCC 8, GCC 12, and Clang 17:
> > >
> > > -----8<-----
> > > In file included from /builds/linux/include/linux/list.h:9,
> > > from /builds/linux/include/linux/module.h:12,
> > > from /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:12:
> > > /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:35: error: 'rtl8169_pm_ops' undeclared here (not in a function); did you mean 'rtl8169_poll'?
> > > 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
> > > | ^~~~~~~~~~~~~~
> > > /builds/linux/include/linux/kernel.h:46:44: note: in definition of macro 'PTR_IF'
> > > 46 | #define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL)
> > > | ^~~
> > > /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:27: note: in expansion of macro 'pm_ptr'
> > > 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
> > > | ^~~~~~
> > > make[5]: *** [/builds/linux/scripts/Makefile.build:289: drivers/net/ethernet/realtek/r8169_main.o] Error 1
> > > ----->8-----
> > >
> > > Bisection points to:
> > >
> > > commit ac2871f646a8f556203f5b6be875ce406d855ddb
> > > Author: Paul Cercueil <paul@crapouillou.net>
> > > Date: Tue Dec 7 00:20:59 2021 +0000
> > > PM: core: Redefine pm_ptr() macro
> > > [ Upstream commit c06ef740d401d0f4ab188882bf6f8d9cf0f75eaf ]
> > >
> > > A revert could not be done cleanly.
> > >
> > > Tuxmake reproducer:
> > >
> > > tuxmake --runtime podman --target-arch riscv --toolchain gcc-12 --kconfig defconfig
> > >
> > > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> >
> > I've been beating on this for a while and I really don't know what is
> > happening, sorry. The driver looks fine, something is "odd" with riscv
>
> No, the driver is not fine. Upstream has commit 8fe6e670640e ("r8169: use new
> PM macros") which makes rtl8169_pm_ops unconditional. That commit is missing
> in v5.15.y. Applying it makes the problem disappear.
>
> In other words, the problem is not riscv specific, but will be seen if the
> realtek driver is built with CONFIG_PM=n (which happens to be the case with
> riscv:defconfig).
Ugh, that wasn't obvious, I was thinking that the CONFIG_PM thing would
have worked properly there and was digging in riscv code all over the
place...
Thanks for this, now queued up.
greg k-h
^ permalink raw reply [flat|nested] 262+ messages in thread
end of thread, other threads:[~2024-02-29 20:31 UTC | newest]
Thread overview: 262+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-02-27 13:23 [PATCH 5.15 000/245] 5.15.150-rc1 review Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 001/245] net/sched: Retire CBQ qdisc Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 002/245] net/sched: Retire ATM qdisc Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 003/245] net/sched: Retire dsmark qdisc Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 004/245] smb: client: fix OOB in receive_encrypted_standard() Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 005/245] smb: client: fix potential OOBs in smb2_parse_contexts() Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 006/245] smb: client: fix parsing of SMB3.1.1 POSIX create context Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 007/245] sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 008/245] PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq() Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 009/245] bpf: Merge printk and seq_printf VARARG max macros Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 010/245] bpf: Add struct for bin_args arg in bpf_bprintf_prepare Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 011/245] bpf: Do cleanup in bpf_bprintf_cleanup only when needed Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 012/245] bpf: Remove trace_printk_lock Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 013/245] userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 014/245] zonefs: Improve error handling Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 015/245] x86/fpu: Stop relying on userspace for info to fault in xsave buffer Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 016/245] sched/rt: Fix sysctl_sched_rr_timeslice intial value Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 017/245] sched/rt: Disallow writing invalid values to sched_rt_period_us Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 018/245] scsi: target: core: Add TMF to tmr_list handling Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 019/245] dmaengine: shdma: increase size of dev_id Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 020/245] dmaengine: fsl-qdma: increase size of irq_name Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 021/245] wifi: cfg80211: fix missing interfaces when dumping Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 022/245] wifi: mac80211: fix race condition on enabling fast-xmit Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 023/245] fbdev: savage: Error out if pixclock equals zero Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 024/245] fbdev: sis: " Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 025/245] spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 026/245] ahci: asm1166: correct count of reported ports Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 027/245] ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 028/245] MIPS: reserve exception vector space ONLY ONCE Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 029/245] platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 030/245] ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 031/245] ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 032/245] ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 033/245] dmaengine: ti: edma: Add some null pointer checks to the edma_probe Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 034/245] regulator: pwm-regulator: Add validity checks in continuous .get_voltage Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 035/245] nvmet-tcp: fix nvme tcp ida memory leak Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 036/245] ALSA: usb-audio: Check presence of valid altsetting control Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 037/245] ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 038/245] spi: sh-msiof: avoid integer overflow in constants Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 039/245] Input: xpad - add Lenovo Legion Go controllers Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 040/245] netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 041/245] ALSA: usb-audio: Ignore clock selector errors for single connection Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 042/245] nvme-fc: do not wait in vain when unloading module Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 043/245] nvmet-fcloop: swap the list_add_tail arguments Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 044/245] nvmet-fc: release reference on target port Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 045/245] nvmet-fc: defer cleanup using RCU properly Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 046/245] nvmet-fc: hold reference on hostport match Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 047/245] nvmet-fc: abort command when there is no binding Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 048/245] nvmet-fc: avoid deadlock on delete association path Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 049/245] nvmet-fc: take ref count on tgtport before delete assoc Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 050/245] ext4: correct the hole length returned by ext4_map_blocks() Greg Kroah-Hartman
2024-02-27 13:23 ` [PATCH 5.15 051/245] Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 052/245] fs/ntfs3: Modified fix directory element type detection Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 053/245] fs/ntfs3: Improve ntfs_dir_count Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 054/245] fs/ntfs3: Correct hard links updating when dealing with DOS names Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 055/245] fs/ntfs3: Print warning while fixing hard links count Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 056/245] fs/ntfs3: Fix detected field-spanning write (size 8) of single field "le->name" Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 057/245] fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 058/245] fs/ntfs3: Disable ATTR_LIST_ENTRY size check Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 059/245] fs/ntfs3: use non-movable memory for ntfs3 MFT buffer cache Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 060/245] fs/ntfs3: Prevent generic message "attempt to access beyond end of device" Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 061/245] fs/ntfs3: Correct function is_rst_area_valid Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 062/245] fs/ntfs3: Update inode->i_size after success write into compressed file Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 063/245] fs/ntfs3: Fix oob in ntfs_listxattr Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 064/245] wifi: mac80211: adding missing drv_mgd_complete_tx() call Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 065/245] efi: runtime: Fix potential overflow of soft-reserved region size Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 066/245] efi: Dont add memblocks for soft-reserved memory Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 067/245] hwmon: (coretemp) Enlarge per package core count limit Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 068/245] scsi: lpfc: Use unsigned type for num_sge Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 069/245] firewire: core: send bus reset promptly on gap count error Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 070/245] drm/amdgpu: skip to program GFXDEC registers for suspend abort Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 071/245] drm/amdgpu: reset gpu for s3 suspend abort case Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 072/245] virtio-blk: Ensure no requests in virtqueues before deleting vqs Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 073/245] pmdomain: mediatek: fix race conditions with genpd Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 074/245] ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 075/245] pmdomain: renesas: r8a77980-sysc: CR7 must be always on Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 076/245] erofs: fix lz4 inplace decompression Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 077/245] IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 078/245] drm/ttm: Fix an invalid freeing on already freed page in error path Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 079/245] dm-crypt: dont modify the data when using authenticated encryption Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 080/245] platform/x86: intel-vbtn: Stop calling "VBDL" from notify_handler Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 081/245] platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 082/245] KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 083/245] KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 084/245] gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 085/245] PCI/MSI: Prevent MSI hardware interrupt number truncation Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 086/245] l2tp: pass correct message length to ip6_append_data Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 087/245] ARM: ep93xx: Add terminator to gpiod_lookup_table Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 088/245] Revert "x86/ftrace: Use alternative RET encoding" Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 089/245] x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 090/245] x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 091/245] x86/ftrace: Use alternative RET encoding Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 092/245] x86/returnthunk: Allow different return thunks Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 093/245] Revert "x86/alternative: Make custom return thunk unconditional" Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 094/245] x86/alternative: Make custom return thunk unconditional Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 095/245] serial: amba-pl011: Fix DMA transmission in RS485 mode Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 096/245] usb: dwc3: gadget: Dont disconnect if not started Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 097/245] usb: cdnsp: blocked some cdns3 specific code Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 098/245] usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 099/245] usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 100/245] usb: cdns3: fix memory double free when handle zero packet Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 101/245] usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 102/245] usb: roles: fix NULL pointer issue when put modules reference Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 103/245] usb: roles: dont get/set_role() when usb_role_switch is unregistered Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 104/245] mptcp: fix lockless access in subflow ULP diag Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 105/245] clk: imx: imx8mp: add shared clk gate for usb suspend clk Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 106/245] clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 107/245] clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 108/245] mtd: rawnand: sunxi: Fix the size of the last OOB region Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 109/245] RISC-V: fix funct4 definition for c.jalr in parse_asm.h Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 110/245] Input: iqs269a - drop unused device node references Greg Kroah-Hartman
2024-02-27 13:24 ` [PATCH 5.15 111/245] Input: iqs269a - configure device with a single block write Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 112/245] Input: iqs269a - increase interrupt handler return delay Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 113/245] clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 114/245] Input: ads7846 - dont report pressure for ads7845 Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 115/245] clk: renesas: cpg-mssr: Remove superfluous check in resume code Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 116/245] clk: imx: avoid memory leak Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 117/245] Input: ads7846 - always set last command to PWRDOWN Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 118/245] Input: ads7846 - dont check penirq immediately for 7845 Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 119/245] powerpc/powernv/ioda: Skip unallocated resources when mapping to PE Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 120/245] clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 121/245] clk: qcom: gpucc-sdm845: " Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 122/245] clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 123/245] powerpc/pseries/lparcfg: add missing RTAS retry status handling Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 124/245] powerpc/perf/hv-24x7: " Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 125/245] powerpc/pseries/lpar: " Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 126/245] MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 127/245] MIPS: vpe-mt: drop physical_memsize Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 128/245] vdpa/mlx5: Dont clear mr struct on destroy MR Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 129/245] selftests: net: vrf-xfrm-tests: change authentication and encryption algos Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 130/245] ARM: dts: BCM53573: Drop nonexistent #usb-cells Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 131/245] RDMA/siw: Balance the reference of cep->kref in the error path Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 132/245] RDMA/siw: Correct wrong debug message Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 133/245] clk: linux/clk-provider.h: fix kernel-doc warnings and typos Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 134/245] platform/x86: asus-wmi: Document the dgpu_disable sysfs attribute Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 135/245] acpi: property: Let args be NULL in __acpi_node_get_property_reference Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 136/245] ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 137/245] tools headers UAPI: Sync linux/fscrypt.h with the kernel sources Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 138/245] perf beauty: Update copy of linux/socket.h " Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 139/245] tools/virtio: fix build Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 140/245] drm/amdgpu: init iommu after amdkfd device init Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 141/245] f2fs: dont set GC_FAILURE_PIN for background GC Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 142/245] f2fs: write checkpoint during FG_GC Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 143/245] drm/i915/dg1: Update DMC_DEBUG3 register Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 144/245] kernel/sched: Remove dl_boosted flag comment Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 145/245] cifs: remove useless parameter is_fsctl from SMB2_ioctl() Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 146/245] serial: 8250: Remove serial_rs485 sanitization from em485 Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 147/245] clk: imx8mp: Add DISP2 pixel clock Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 148/245] clk: imx8mp: add clkout1/2 support Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 149/245] dt-bindings: clocks: imx8mp: Add ID for usb suspend clock Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 150/245] net: ethernet: ti: add missing of_node_put before return Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 151/245] powerpc/rtas: make all exports GPL Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 152/245] powerpc/rtas: ensure 4KB alignment for rtas_data_buf Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 153/245] powerpc/eeh: Small refactor of eeh_handle_normal_event() Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 154/245] powerpc/eeh: Set channel state after notifying the drivers Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 155/245] PM: core: Redefine pm_ptr() macro Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 156/245] PM: core: Add new *_PM_OPS macros, deprecate old ones Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 157/245] mmc: jz4740: Use the new PM macros Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 158/245] mmc: mxc: " Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 159/245] PM: core: Remove static qualifier in DEFINE_SIMPLE_DEV_PM_OPS macro Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 160/245] Input: iqs269a - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 161/245] Input: iqs269a - do not poll during suspend or resume Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 162/245] Input: iqs269a - do not poll during ATI Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 163/245] net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 164/245] netfilter: nf_tables: add rescheduling points during loop detection walks Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 165/245] debugobjects: Recheck debug_objects_enabled before reporting Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 166/245] nbd: Add the maximum limit of allocated index in nbd_dev_add Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 167/245] md: fix data corruption for raid456 when reshape restart while grow up Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 168/245] md/raid10: prevent soft lockup while flush writes Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 169/245] posix-timers: Ensure timer ID search-loop limit is valid Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 170/245] btrfs: add xxhash to fast checksum implementations Greg Kroah-Hartman
2024-02-27 13:25 ` [PATCH 5.15 171/245] ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 172/245] ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3 Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 173/245] ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version) Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 174/245] arm64: set __exception_irq_entry with __irq_entry as a default Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 175/245] arm64: mm: fix VA-range sanity check Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 176/245] sched/fair: Dont balance task to its current running CPU Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 177/245] wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 178/245] bpf: Address KCSAN report on bpf_lru_list Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 179/245] devlink: report devlink_port_type_warn source device Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 180/245] wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 181/245] igb: Fix igb_down hung on surprise removal Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 182/245] wifi: iwlwifi: mvm: avoid baid size integer overflow Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 183/245] exfat: support dynamic allocate bh for exfat_entry_set_cache Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 184/245] arm64: dts: rockchip: fix regulator name on rk3399-rock-4 Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 185/245] arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4 Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 186/245] arm64: dts: rockchip: add SPDIF node " Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 187/245] ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 188/245] ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2 Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 189/245] ACPI: resource: Add ASUS model S5402ZA to quirks Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 190/245] ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 191/245] ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 192/245] ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 193/245] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 194/245] xhci: cleanup xhci_hub_control port references Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 195/245] xhci: move port specific items such as state completions to port structure Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 196/245] xhci: rename resume_done to resume_timestamp Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 197/245] xhci: clear usb2 resume related variables in one place Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 198/245] xhci: decouple usb2 port resume and get_port_status request handling Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 199/245] xhci: track port suspend state correctly in unsuccessful resume cases Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 200/245] cifs: add a warning when the in-flight count goes negative Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 201/245] IB/hfi1: Fix a memleak in init_credit_return Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 202/245] RDMA/bnxt_re: Return error for SRQ resize Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 203/245] RDMA/irdma: Fix KASAN issue with tasklet Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 204/245] RDMA/irdma: Validate max_send_wr and max_recv_wr Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 205/245] RDMA/irdma: Set the CQ read threshold for GEN 1 Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 206/245] RDMA/irdma: Add AE for too many RNRS Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 207/245] RDMA/srpt: Support specifying the srpt_service_guid parameter Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 208/245] RDMA/qedr: Fix qedr_create_user_qp error flow Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 209/245] arm64: dts: rockchip: set num-cs property for spi on px30 Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 210/245] RDMA/srpt: fix function pointer cast warnings Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 211/245] bpf, scripts: Correct GPL license name Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 212/245] scsi: jazz_esp: Only build if SCSI core is builtin Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 213/245] nouveau: fix function cast warnings Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 214/245] net: stmmac: Fix incorrect dereference in interrupt handlers Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 215/245] ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 216/245] ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 217/245] ata: libahci_platform: Convert to using devm bulk clocks API Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 218/245] ata: libahci_platform: Introduce reset assertion/deassertion methods Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 219/245] ata: ahci_ceva: fix error handling for Xilinx GT PHY support Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 220/245] bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 221/245] afs: Increase buffer size in afs_update_volume_status() Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 222/245] ipv6: sr: fix possible use-after-free and null-ptr-deref Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 223/245] packet: move from strlcpy with unused retval to strscpy Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 224/245] net: dev: Convert sa_data to flexible array in struct sockaddr Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 225/245] drm/nouveau/instmem: fix uninitialized_var.cocci warning Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 226/245] octeontx2-af: Consider the action set by PF Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 227/245] s390: use the correct count for __iowrite64_copy() Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 228/245] tls: rx: jump to a more appropriate label Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 229/245] tls: rx: drop pointless else after goto Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 230/245] tls: stop recv() if initial process_rx_list gave us non-DATA Greg Kroah-Hartman
2024-02-27 13:26 ` [PATCH 5.15 231/245] netfilter: nf_tables: set dormant flag on hook register failure Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 232/245] netfilter: flowtable: simplify route logic Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 233/245] netfilter: nft_flow_offload: reset dst in route object after setting up flow Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 234/245] netfilter: nft_flow_offload: release dst in case direct xmit path is used Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 235/245] drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 236/245] drm/amd/display: Fix memory leak in dm_sw_fini() Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 237/245] i2c: imx: Add timer for handling the stop condition Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 238/245] i2c: imx: when being a target, mark the last read as processed Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 239/245] cifs: fix mid leak during reconnection after timeout threshold Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 240/245] fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 241/245] arp: Prevent overflow in arp_req_get() Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 242/245] netfilter: nf_tables: fix scheduling-while-atomic splat Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 243/245] ext4: regenerate buddy after block freeing failed if under fc replay Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 244/245] ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks() Greg Kroah-Hartman
2024-02-27 13:27 ` [PATCH 5.15 245/245] netfilter: nf_tables: cant schedule in nft_chain_validate Greg Kroah-Hartman
2024-02-27 17:47 ` [PATCH 5.15 000/245] 5.15.150-rc1 review SeongJae Park
2024-02-27 18:00 ` Pavel Machek
2024-02-27 18:56 ` Daniel Díaz
2024-02-29 19:54 ` Greg Kroah-Hartman
2024-02-29 20:19 ` Guenter Roeck
2024-02-29 20:31 ` Greg Kroah-Hartman
2024-02-27 19:13 ` Florian Fainelli
2024-02-27 19:20 ` Shreeya Patel
2024-02-28 0:30 ` Kelsey Steele
2024-02-28 13:38 ` Jon Hunter
2024-02-28 16:47 ` Shuah Khan
2024-02-28 17:40 ` Allen
2024-02-28 18:19 ` Harshit Mogalapalli
2024-02-29 18:15 ` Guenter Roeck
2024-02-29 18:42 ` Greg Kroah-Hartman
2024-02-29 18:56 ` Guenter Roeck
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox