* [PATCH 5.7 001/244] bridge: mcast: Fix MLD2 Report IPv6 payload length check
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 002/244] genetlink: remove genl_bind Greg Kroah-Hartman
` (243 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nikolay Aleksandrov,
Linus Lüssing, David S. Miller
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 1338 bytes --]
From: "Linus Lüssing" <linus.luessing@c0d3.blue>
[ Upstream commit 5fc6266af7b427243da24f3443a50cd4584aac06 ]
Commit e57f61858b7c ("net: bridge: mcast: fix stale nsrcs pointer in
igmp3/mld2 report handling") introduced a bug in the IPv6 header payload
length check which would potentially lead to rejecting a valid MLD2 Report:
The check needs to take into account the 2 bytes for the "Number of
Sources" field in the "Multicast Address Record" before reading it.
And not the size of a pointer to this field.
Fixes: e57f61858b7c ("net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling")
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/br_multicast.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1007,7 +1007,7 @@ static int br_ip6_multicast_mld2_report(
nsrcs_offset = len + offsetof(struct mld2_grec, grec_nsrcs);
if (skb_transport_offset(skb) + ipv6_transport_len(skb) <
- nsrcs_offset + sizeof(_nsrcs))
+ nsrcs_offset + sizeof(__nsrcs))
return -EINVAL;
_nsrcs = skb_header_pointer(skb, nsrcs_offset,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 002/244] genetlink: remove genl_bind
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 001/244] bridge: mcast: Fix MLD2 Report IPv6 payload length check Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 003/244] ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg Greg Kroah-Hartman
` (242 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cong Wang, Johannes Berg,
kernel test robot, Sean Tranchetti, David S. Miller
From: Sean Tranchetti <stranche@codeaurora.org>
[ Upstream commit 1e82a62fec613844da9e558f3493540a5b7a7b67 ]
A potential deadlock can occur during registering or unregistering a
new generic netlink family between the main nl_table_lock and the
cb_lock where each thread wants the lock held by the other, as
demonstrated below.
1) Thread 1 is performing a netlink_bind() operation on a socket. As part
of this call, it will call netlink_lock_table(), incrementing the
nl_table_users count to 1.
2) Thread 2 is registering (or unregistering) a genl_family via the
genl_(un)register_family() API. The cb_lock semaphore will be taken for
writing.
3) Thread 1 will call genl_bind() as part of the bind operation to handle
subscribing to GENL multicast groups at the request of the user. It will
attempt to take the cb_lock semaphore for reading, but it will fail and
be scheduled away, waiting for Thread 2 to finish the write.
4) Thread 2 will call netlink_table_grab() during the (un)registration
call. However, as Thread 1 has incremented nl_table_users, it will not
be able to proceed, and both threads will be stuck waiting for the
other.
genl_bind() is a noop, unless a genl_family implements the mcast_bind()
function to handle setting up family-specific multicast operations. Since
no one in-tree uses this functionality as Cong pointed out, simply removing
the genl_bind() function will remove the possibility for deadlock, as there
is no attempt by Thread 1 above to take the cb_lock semaphore.
Fixes: c380d9a7afff ("genetlink: pass multicast bind/unbind to families")
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Johannes Berg <johannes.berg@intel.com>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/genetlink.h | 8 -------
net/netlink/genetlink.c | 49 ------------------------------------------------
2 files changed, 57 deletions(-)
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -35,12 +35,6 @@ struct genl_info;
* do additional, common, filtering and return an error
* @post_doit: called after an operation's doit callback, it may
* undo operations done by pre_doit, for example release locks
- * @mcast_bind: a socket bound to the given multicast group (which
- * is given as the offset into the groups array)
- * @mcast_unbind: a socket was unbound from the given multicast group.
- * Note that unbind() will not be called symmetrically if the
- * generic netlink family is removed while there are still open
- * sockets.
* @attrbuf: buffer to store parsed attributes (private)
* @mcgrps: multicast groups used by this family
* @n_mcgrps: number of multicast groups
@@ -64,8 +58,6 @@ struct genl_family {
void (*post_doit)(const struct genl_ops *ops,
struct sk_buff *skb,
struct genl_info *info);
- int (*mcast_bind)(struct net *net, int group);
- void (*mcast_unbind)(struct net *net, int group);
struct nlattr ** attrbuf; /* private */
const struct genl_ops * ops;
const struct genl_multicast_group *mcgrps;
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1088,60 +1088,11 @@ static struct genl_family genl_ctrl __ro
.netnsok = true,
};
-static int genl_bind(struct net *net, int group)
-{
- struct genl_family *f;
- int err = -ENOENT;
- unsigned int id;
-
- down_read(&cb_lock);
-
- idr_for_each_entry(&genl_fam_idr, f, id) {
- if (group >= f->mcgrp_offset &&
- group < f->mcgrp_offset + f->n_mcgrps) {
- int fam_grp = group - f->mcgrp_offset;
-
- if (!f->netnsok && net != &init_net)
- err = -ENOENT;
- else if (f->mcast_bind)
- err = f->mcast_bind(net, fam_grp);
- else
- err = 0;
- break;
- }
- }
- up_read(&cb_lock);
-
- return err;
-}
-
-static void genl_unbind(struct net *net, int group)
-{
- struct genl_family *f;
- unsigned int id;
-
- down_read(&cb_lock);
-
- idr_for_each_entry(&genl_fam_idr, f, id) {
- if (group >= f->mcgrp_offset &&
- group < f->mcgrp_offset + f->n_mcgrps) {
- int fam_grp = group - f->mcgrp_offset;
-
- if (f->mcast_unbind)
- f->mcast_unbind(net, fam_grp);
- break;
- }
- }
- up_read(&cb_lock);
-}
-
static int __net_init genl_pernet_init(struct net *net)
{
struct netlink_kernel_cfg cfg = {
.input = genl_rcv,
.flags = NL_CFG_F_NONROOT_RECV,
- .bind = genl_bind,
- .unbind = genl_unbind,
};
/* we'll bump the group number right afterwards */
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 003/244] ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 001/244] bridge: mcast: Fix MLD2 Report IPv6 payload length check Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 002/244] genetlink: remove genl_bind Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 004/244] ipv6: fib6_select_path can not use out path for nexthop objects Greg Kroah-Hartman
` (241 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Wouters, Sabrina Dubroca,
David S. Miller
From: Sabrina Dubroca <sd@queasysnail.net>
[ Upstream commit 5eff06902394425c722f0a44d9545909a8800f79 ]
IPv4 ping sockets don't set fl4.fl4_icmp_{type,code}, which leads to
incomplete IPsec ACQUIRE messages being sent to userspace. Currently,
both raw sockets and IPv6 ping sockets set those fields.
Expected output of "ip xfrm monitor":
acquire proto esp
sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 8 code 0 dev ens4
policy src 10.0.2.15/32 dst 8.8.8.8/32
<snip>
Currently with ping sockets:
acquire proto esp
sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 0 code 0 dev ens4
policy src 10.0.2.15/32 dst 8.8.8.8/32
<snip>
The Libreswan test suite found this problem after Fedora changed the
value for the sysctl net.ipv4.ping_group_range.
Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
Reported-by: Paul Wouters <pwouters@redhat.com>
Tested-by: Paul Wouters <pwouters@redhat.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ping.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -786,6 +786,9 @@ static int ping_v4_sendmsg(struct sock *
inet_sk_flowi_flags(sk), faddr, saddr, 0, 0,
sk->sk_uid);
+ fl4.fl4_icmp_type = user_icmph.type;
+ fl4.fl4_icmp_code = user_icmph.code;
+
security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
rt = ip_route_output_flow(net, &fl4, sk);
if (IS_ERR(rt)) {
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 004/244] ipv6: fib6_select_path can not use out path for nexthop objects
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 003/244] ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 005/244] ipv6: Fix use of anycast address with loopback Greg Kroah-Hartman
` (240 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Rak, David Ahern, David S. Miller
From: David Ahern <dsahern@kernel.org>
[ Upstream commit 34fe5a1cf95c3f114068fc16d919c9cf4b00e428 ]
Brian reported a crash in IPv6 code when using rpfilter with a setup
running FRR and external nexthop objects. The root cause of the crash
is fib6_select_path setting fib6_nh in the result to NULL because of
an improper check for nexthop objects.
More specifically, rpfilter invokes ip6_route_lookup with flowi6_oif
set causing fib6_select_path to be called with have_oif_match set.
fib6_select_path has early check on have_oif_match and jumps to the
out label which presumes a builtin fib6_nh. This path is invalid for
nexthop objects; for external nexthops fib6_select_path needs to just
return if the fib6_nh has already been set in the result otherwise it
returns after the call to nexthop_path_fib6_result. Update the check
on have_oif_match to not bail on external nexthops.
Update selftests for this problem.
Fixes: f88d8ea67fbd ("ipv6: Plumb support for nexthop object in a fib6_info")
Reported-by: Brian Rak <brak@choopa.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/route.c | 5 ++++-
tools/testing/selftests/net/fib_nexthops.sh | 13 +++++++++++++
2 files changed, 17 insertions(+), 1 deletion(-)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -431,9 +431,12 @@ void fib6_select_path(const struct net *
struct fib6_info *sibling, *next_sibling;
struct fib6_info *match = res->f6i;
- if ((!match->fib6_nsiblings && !match->nh) || have_oif_match)
+ if (!match->nh && (!match->fib6_nsiblings || have_oif_match))
goto out;
+ if (match->nh && have_oif_match && res->nh)
+ return;
+
/* We might have already computed the hash for ICMPv6 errors. In such
* case it will always be non-zero. Otherwise now is the time to do it.
*/
--- a/tools/testing/selftests/net/fib_nexthops.sh
+++ b/tools/testing/selftests/net/fib_nexthops.sh
@@ -512,6 +512,19 @@ ipv6_fcnal_runtime()
run_cmd "$IP nexthop add id 86 via 2001:db8:91::2 dev veth1"
run_cmd "$IP ro add 2001:db8:101::1/128 nhid 81"
+ # rpfilter and default route
+ $IP nexthop flush >/dev/null 2>&1
+ run_cmd "ip netns exec me ip6tables -t mangle -I PREROUTING 1 -m rpfilter --invert -j DROP"
+ run_cmd "$IP nexthop add id 91 via 2001:db8:91::2 dev veth1"
+ run_cmd "$IP nexthop add id 92 via 2001:db8:92::2 dev veth3"
+ run_cmd "$IP nexthop add id 93 group 91/92"
+ run_cmd "$IP -6 ro add default nhid 91"
+ run_cmd "ip netns exec me ping -c1 -w1 2001:db8:101::1"
+ log_test $? 0 "Nexthop with default route and rpfilter"
+ run_cmd "$IP -6 ro replace default nhid 93"
+ run_cmd "ip netns exec me ping -c1 -w1 2001:db8:101::1"
+ log_test $? 0 "Nexthop with multipath default route and rpfilter"
+
# TO-DO:
# existing route with old nexthop; append route with new nexthop
# existing route with old nexthop; replace route with new
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 005/244] ipv6: Fix use of anycast address with loopback
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 004/244] ipv6: fib6_select_path can not use out path for nexthop objects Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 006/244] l2tp: remove skb_dst_set() from l2tp_xmit_skb() Greg Kroah-Hartman
` (239 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, thomas.gambier, David Ahern, David S. Miller
From: David Ahern <dsahern@kernel.org>
[ Upstream commit aea23c323d89836bcdcee67e49def997ffca043b ]
Thomas reported a regression with IPv6 and anycast using the following
reproducer:
echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
ip -6 a add fc12::1/16 dev lo
sleep 2
echo "pinging lo"
ping6 -c 2 fc12::
The conversion of addrconf_f6i_alloc to use ip6_route_info_create missed
the use of fib6_is_reject which checks addresses added to the loopback
interface and sets the REJECT flag as needed. Update fib6_is_reject for
loopback checks to handle RTF_ANYCAST addresses.
Fixes: c7a1ce397ada ("ipv6: Change addrconf_f6i_alloc to use ip6_route_info_create")
Reported-by: thomas.gambier@nexedi.com
Signed-off-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/route.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3402,7 +3402,7 @@ static bool fib6_is_reject(u32 flags, st
if ((flags & RTF_REJECT) ||
(dev && (dev->flags & IFF_LOOPBACK) &&
!(addr_type & IPV6_ADDR_LOOPBACK) &&
- !(flags & RTF_LOCAL)))
+ !(flags & (RTF_ANYCAST | RTF_LOCAL))))
return true;
return false;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 006/244] l2tp: remove skb_dst_set() from l2tp_xmit_skb()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 005/244] ipv6: Fix use of anycast address with loopback Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 007/244] llc: make sure applications use ARPHRD_ETHER Greg Kroah-Hartman
` (238 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hangbin Liu, Xin Long, James Chapman,
David S. Miller
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit 27d53323664c549b5bb2dfaaf6f7ad6e0376a64e ]
In the tx path of l2tp, l2tp_xmit_skb() calls skb_dst_set() to set
skb's dst. However, it will eventually call inet6_csk_xmit() or
ip_queue_xmit() where skb's dst will be overwritten by:
skb_dst_set_noref(skb, dst);
without releasing the old dst in skb. Then it causes dst/dev refcnt leak:
unregister_netdevice: waiting for eth0 to become free. Usage count = 1
This can be reproduced by simply running:
# modprobe l2tp_eth && modprobe l2tp_ip
# sh ./tools/testing/selftests/net/l2tp.sh
So before going to inet6_csk_xmit() or ip_queue_xmit(), skb's dst
should be dropped. This patch is to fix it by removing skb_dst_set()
from l2tp_xmit_skb() and moving skb_dst_drop() into l2tp_xmit_core().
Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core")
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: James Chapman <jchapman@katalix.com>
Tested-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_core.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1028,6 +1028,7 @@ static void l2tp_xmit_core(struct l2tp_s
/* Queue the packet to IP for output */
skb->ignore_df = 1;
+ skb_dst_drop(skb);
#if IS_ENABLED(CONFIG_IPV6)
if (l2tp_sk_is_v6(tunnel->sock))
error = inet6_csk_xmit(tunnel->sock, skb, NULL);
@@ -1099,10 +1100,6 @@ int l2tp_xmit_skb(struct l2tp_session *s
goto out_unlock;
}
- /* Get routing info from the tunnel socket */
- skb_dst_drop(skb);
- skb_dst_set(skb, sk_dst_check(sk, 0));
-
inet = inet_sk(sk);
fl = &inet->cork.fl;
switch (tunnel->encap) {
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 007/244] llc: make sure applications use ARPHRD_ETHER
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 006/244] l2tp: remove skb_dst_set() from l2tp_xmit_skb() Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 008/244] net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb Greg Kroah-Hartman
` (237 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David S. Miller
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit a9b1110162357689a34992d5c925852948e5b9fd ]
syzbot was to trigger a bug by tricking AF_LLC with
non sensible addr->sllc_arphrd
It seems clear LLC requires an Ethernet device.
Back in commit abf9d537fea2 ("llc: add support for SO_BINDTODEVICE")
Octavian Purdila added possibility for application to use a zero
value for sllc_arphrd, convert it to ARPHRD_ETHER to not cause
regressions on existing applications.
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:199 [inline]
BUG: KASAN: use-after-free in list_empty include/linux/list.h:268 [inline]
BUG: KASAN: use-after-free in waitqueue_active include/linux/wait.h:126 [inline]
BUG: KASAN: use-after-free in wq_has_sleeper include/linux/wait.h:160 [inline]
BUG: KASAN: use-after-free in skwq_has_sleeper include/net/sock.h:2092 [inline]
BUG: KASAN: use-after-free in sock_def_write_space+0x642/0x670 net/core/sock.c:2813
Read of size 8 at addr ffff88801e0b4078 by task ksoftirqd/3/27
CPU: 3 PID: 27 Comm: ksoftirqd/3 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
__kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
kasan_report+0x12/0x20 mm/kasan/common.c:639
__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
__read_once_size include/linux/compiler.h:199 [inline]
list_empty include/linux/list.h:268 [inline]
waitqueue_active include/linux/wait.h:126 [inline]
wq_has_sleeper include/linux/wait.h:160 [inline]
skwq_has_sleeper include/net/sock.h:2092 [inline]
sock_def_write_space+0x642/0x670 net/core/sock.c:2813
sock_wfree+0x1e1/0x260 net/core/sock.c:1958
skb_release_head_state+0xeb/0x260 net/core/skbuff.c:652
skb_release_all+0x16/0x60 net/core/skbuff.c:663
__kfree_skb net/core/skbuff.c:679 [inline]
consume_skb net/core/skbuff.c:838 [inline]
consume_skb+0xfb/0x410 net/core/skbuff.c:832
__dev_kfree_skb_any+0xa4/0xd0 net/core/dev.c:2967
dev_kfree_skb_any include/linux/netdevice.h:3650 [inline]
e1000_unmap_and_free_tx_resource.isra.0+0x21b/0x3a0 drivers/net/ethernet/intel/e1000/e1000_main.c:1963
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3854 [inline]
e1000_clean+0x4cc/0x1d10 drivers/net/ethernet/intel/e1000/e1000_main.c:3796
napi_poll net/core/dev.c:6532 [inline]
net_rx_action+0x508/0x1120 net/core/dev.c:6600
__do_softirq+0x262/0x98c kernel/softirq.c:292
run_ksoftirqd kernel/softirq.c:603 [inline]
run_ksoftirqd+0x8e/0x110 kernel/softirq.c:595
smpboot_thread_fn+0x6a3/0xa40 kernel/smpboot.c:165
kthread+0x361/0x430 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 8247:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
__kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486
kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:521
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc mm/slab.c:3320 [inline]
kmem_cache_alloc+0x121/0x710 mm/slab.c:3484
sock_alloc_inode+0x1c/0x1d0 net/socket.c:240
alloc_inode+0x68/0x1e0 fs/inode.c:230
new_inode_pseudo+0x19/0xf0 fs/inode.c:919
sock_alloc+0x41/0x270 net/socket.c:560
__sock_create+0xc2/0x730 net/socket.c:1384
sock_create net/socket.c:1471 [inline]
__sys_socket+0x103/0x220 net/socket.c:1513
__do_sys_socket net/socket.c:1522 [inline]
__se_sys_socket net/socket.c:1520 [inline]
__ia32_sys_socket+0x73/0xb0 net/socket.c:1520
do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline]
do_fast_syscall_32+0x27b/0xe16 arch/x86/entry/common.c:408
entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
Freed by task 17:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:335 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:474
kasan_slab_free+0xe/0x10 mm/kasan/common.c:483
__cache_free mm/slab.c:3426 [inline]
kmem_cache_free+0x86/0x320 mm/slab.c:3694
sock_free_inode+0x20/0x30 net/socket.c:261
i_callback+0x44/0x80 fs/inode.c:219
__rcu_reclaim kernel/rcu/rcu.h:222 [inline]
rcu_do_batch kernel/rcu/tree.c:2183 [inline]
rcu_core+0x570/0x1540 kernel/rcu/tree.c:2408
rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2417
__do_softirq+0x262/0x98c kernel/softirq.c:292
The buggy address belongs to the object at ffff88801e0b4000
which belongs to the cache sock_inode_cache of size 1152
The buggy address is located 120 bytes inside of
1152-byte region [ffff88801e0b4000, ffff88801e0b4480)
The buggy address belongs to the page:
page:ffffea0000782d00 refcount:1 mapcount:0 mapping:ffff88807aa59c40 index:0xffff88801e0b4ffd
raw: 00fffe0000000200 ffffea00008e6c88 ffffea0000782d48 ffff88807aa59c40
raw: ffff88801e0b4ffd ffff88801e0b4000 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88801e0b3f00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff88801e0b3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801e0b4000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801e0b4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801e0b4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Fixes: abf9d537fea2 ("llc: add support for SO_BINDTODEVICE")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/llc/af_llc.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -273,6 +273,10 @@ static int llc_ui_autobind(struct socket
if (!sock_flag(sk, SOCK_ZAPPED))
goto out;
+ if (!addr->sllc_arphrd)
+ addr->sllc_arphrd = ARPHRD_ETHER;
+ if (addr->sllc_arphrd != ARPHRD_ETHER)
+ goto out;
rc = -ENODEV;
if (sk->sk_bound_dev_if) {
llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
@@ -328,7 +332,9 @@ static int llc_ui_bind(struct socket *so
if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
goto out;
rc = -EAFNOSUPPORT;
- if (unlikely(addr->sllc_family != AF_LLC))
+ if (!addr->sllc_arphrd)
+ addr->sllc_arphrd = ARPHRD_ETHER;
+ if (unlikely(addr->sllc_family != AF_LLC || addr->sllc_arphrd != ARPHRD_ETHER))
goto out;
dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
rc = -ENODEV;
@@ -336,8 +342,6 @@ static int llc_ui_bind(struct socket *so
if (sk->sk_bound_dev_if) {
llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
if (llc->dev) {
- if (!addr->sllc_arphrd)
- addr->sllc_arphrd = llc->dev->type;
if (is_zero_ether_addr(addr->sllc_mac))
memcpy(addr->sllc_mac, llc->dev->dev_addr,
IFHWADDRLEN);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 008/244] net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 007/244] llc: make sure applications use ARPHRD_ETHER Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 009/244] net: dsa: microchip: set the correct number of ports Greg Kroah-Hartman
` (236 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Varghese, David S. Miller
From: Martin Varghese <martin.varghese@nokia.com>
[ Upstream commit 394de110a73395de2ca4516b0de435e91b11b604 ]
The packets from tunnel devices (eg bareudp) may have only
metadata in the dst pointer of skb. Hence a pointer check of
neigh_lookup is needed in dst_neigh_lookup_skb
Kernel crashes when packets from bareudp device is processed in
the kernel neighbour subsytem.
[ 133.384484] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 133.385240] #PF: supervisor instruction fetch in kernel mode
[ 133.385828] #PF: error_code(0x0010) - not-present page
[ 133.386603] PGD 0 P4D 0
[ 133.386875] Oops: 0010 [#1] SMP PTI
[ 133.387275] CPU: 0 PID: 5045 Comm: ping Tainted: G W 5.8.0-rc2+ #15
[ 133.388052] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[ 133.391076] RIP: 0010:0x0
[ 133.392401] Code: Bad RIP value.
[ 133.394029] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246
[ 133.396656] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00
[ 133.399018] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400
[ 133.399685] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000
[ 133.400350] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400
[ 133.401010] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003
[ 133.401667] FS: 00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000
[ 133.402412] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 133.402948] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0
[ 133.403611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 133.404270] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 133.404933] Call Trace:
[ 133.405169] <IRQ>
[ 133.405367] __neigh_update+0x5a4/0x8f0
[ 133.405734] arp_process+0x294/0x820
[ 133.406076] ? __netif_receive_skb_core+0x866/0xe70
[ 133.406557] arp_rcv+0x129/0x1c0
[ 133.406882] __netif_receive_skb_one_core+0x95/0xb0
[ 133.407340] process_backlog+0xa7/0x150
[ 133.407705] net_rx_action+0x2af/0x420
[ 133.408457] __do_softirq+0xda/0x2a8
[ 133.408813] asm_call_on_stack+0x12/0x20
[ 133.409290] </IRQ>
[ 133.409519] do_softirq_own_stack+0x39/0x50
[ 133.410036] do_softirq+0x50/0x60
[ 133.410401] __local_bh_enable_ip+0x50/0x60
[ 133.410871] ip_finish_output2+0x195/0x530
[ 133.411288] ip_output+0x72/0xf0
[ 133.411673] ? __ip_finish_output+0x1f0/0x1f0
[ 133.412122] ip_send_skb+0x15/0x40
[ 133.412471] raw_sendmsg+0x853/0xab0
[ 133.412855] ? insert_pfn+0xfe/0x270
[ 133.413827] ? vvar_fault+0xec/0x190
[ 133.414772] sock_sendmsg+0x57/0x80
[ 133.415685] __sys_sendto+0xdc/0x160
[ 133.416605] ? syscall_trace_enter+0x1d4/0x2b0
[ 133.417679] ? __audit_syscall_exit+0x1d9/0x280
[ 133.418753] ? __prepare_exit_to_usermode+0x5d/0x1a0
[ 133.419819] __x64_sys_sendto+0x24/0x30
[ 133.420848] do_syscall_64+0x4d/0x90
[ 133.421768] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 133.422833] RIP: 0033:0x7fe013689c03
[ 133.423749] Code: Bad RIP value.
[ 133.424624] RSP: 002b:00007ffc7288f418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 133.425940] RAX: ffffffffffffffda RBX: 000056151fc63720 RCX: 00007fe013689c03
[ 133.427225] RDX: 0000000000000040 RSI: 000056151fc63720 RDI: 0000000000000003
[ 133.428481] RBP: 00007ffc72890b30 R08: 000056151fc60500 R09: 0000000000000010
[ 133.429757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
[ 133.431041] R13: 000056151fc636e0 R14: 000056151fc616bc R15: 0000000000000080
[ 133.432481] Modules linked in: mpls_iptunnel act_mirred act_tunnel_key cls_flower sch_ingress veth mpls_router ip_tunnel bareudp ip6_udp_tunnel udp_tunnel macsec udp_diag inet_diag unix_diag af_packet_diag netlink_diag binfmt_misc xt_MASQUERADE iptable_nat xt_addrtype xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc ebtable_filter ebtables overlay ip6table_filter ip6_tables iptable_filter sunrpc ext4 mbcache jbd2 pcspkr i2c_piix4 virtio_balloon joydev ip_tables xfs libcrc32c ata_generic qxl pata_acpi drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm ata_piix libata virtio_net net_failover virtio_console failover virtio_blk i2c_core virtio_pci virtio_ring serio_raw floppy virtio dm_mirror dm_region_hash dm_log dm_mod
[ 133.444045] CR2: 0000000000000000
[ 133.445082] ---[ end trace f4aeee1958fd1638 ]---
[ 133.446236] RIP: 0010:0x0
[ 133.447180] Code: Bad RIP value.
[ 133.448152] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246
[ 133.449363] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00
[ 133.450835] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400
[ 133.452237] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000
[ 133.453722] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400
[ 133.455149] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003
[ 133.456520] FS: 00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000
[ 133.458046] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 133.459342] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0
[ 133.460782] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 133.462240] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 133.463697] Kernel panic - not syncing: Fatal exception in interrupt
[ 133.465226] Kernel Offset: 0xfa00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 133.467025] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
Fixes: aaa0c23cb901 ("Fix dst_neigh_lookup/dst_neigh_lookup_skb return value handling bug")
Signed-off-by: Martin Varghese <martin.varghese@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/dst.h | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -400,7 +400,15 @@ static inline struct neighbour *dst_neig
static inline struct neighbour *dst_neigh_lookup_skb(const struct dst_entry *dst,
struct sk_buff *skb)
{
- struct neighbour *n = dst->ops->neigh_lookup(dst, skb, NULL);
+ struct neighbour *n = NULL;
+
+ /* The packets from tunnel devices (eg bareudp) may have only
+ * metadata in the dst pointer of skb. Hence a pointer check of
+ * neigh_lookup is needed.
+ */
+ if (dst->ops->neigh_lookup)
+ n = dst->ops->neigh_lookup(dst, skb, NULL);
+
return IS_ERR(n) ? NULL : n;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 009/244] net: dsa: microchip: set the correct number of ports
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 008/244] net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 010/244] net: qrtr: free flow in __qrtr_node_release Greg Kroah-Hartman
` (235 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Codrin Ciubotariu, Andrew Lunn,
David S. Miller
From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
[ Upstream commit af199a1a9cb02ec0194804bd46c174b6db262075 ]
The number of ports is incorrectly set to the maximum available for a DSA
switch. Even if the extra ports are not used, this causes some functions
to be called later, like port_disable() and port_stp_state_set(). If the
driver doesn't check the port index, it will end up modifying unknown
registers.
Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477")
Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/dsa/microchip/ksz8795.c | 3 +++
drivers/net/dsa/microchip/ksz9477.c | 3 +++
2 files changed, 6 insertions(+)
--- a/drivers/net/dsa/microchip/ksz8795.c
+++ b/drivers/net/dsa/microchip/ksz8795.c
@@ -1271,6 +1271,9 @@ static int ksz8795_switch_init(struct ks
/* set the real number of ports */
dev->ds->num_ports = dev->port_cnt;
+ /* set the real number of ports */
+ dev->ds->num_ports = dev->port_cnt;
+
return 0;
}
--- a/drivers/net/dsa/microchip/ksz9477.c
+++ b/drivers/net/dsa/microchip/ksz9477.c
@@ -516,6 +516,9 @@ static int ksz9477_port_vlan_filtering(s
PORT_VLAN_LOOKUP_VID_0, false);
}
+ /* set the real number of ports */
+ dev->ds->num_ports = dev->port_cnt;
+
return 0;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 010/244] net: qrtr: free flow in __qrtr_node_release
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 009/244] net: dsa: microchip: set the correct number of ports Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 011/244] net_sched: fix a memory leak in atm_tc_init() Greg Kroah-Hartman
` (234 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Carl Huang, David S. Miller
From: Carl Huang <cjhuang@codeaurora.org>
[ Upstream commit 28541f3d324f6de1e545e2875283b6cef95c5d36 ]
The flow is allocated in qrtr_tx_wait, but not freed when qrtr node
is released. (*slot) becomes NULL after radix_tree_iter_delete is
called in __qrtr_node_release. The fix is to save (*slot) to a
vairable and then free it.
This memory leak is catched when kmemleak is enabled in kernel,
the report looks like below:
unreferenced object 0xffffa0de69e08420 (size 32):
comm "kworker/u16:3", pid 176, jiffies 4294918275 (age 82858.876s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 28 84 e0 69 de a0 ff ff ........(..i....
28 84 e0 69 de a0 ff ff 03 00 00 00 00 00 00 00 (..i............
backtrace:
[<00000000e252af0a>] qrtr_node_enqueue+0x38e/0x400 [qrtr]
[<000000009cea437f>] qrtr_sendmsg+0x1e0/0x2a0 [qrtr]
[<000000008bddbba4>] sock_sendmsg+0x5b/0x60
[<0000000003beb43a>] qmi_send_message.isra.3+0xbe/0x110 [qmi_helpers]
[<000000009c9ae7de>] qmi_send_request+0x1c/0x20 [qmi_helpers]
Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/qrtr/qrtr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -166,6 +166,7 @@ static void __qrtr_node_release(struct k
{
struct qrtr_node *node = container_of(kref, struct qrtr_node, ref);
struct radix_tree_iter iter;
+ struct qrtr_tx_flow *flow;
unsigned long flags;
void __rcu **slot;
@@ -181,8 +182,9 @@ static void __qrtr_node_release(struct k
/* Free tx flow counters */
radix_tree_for_each_slot(slot, &node->qrtr_tx_flow, &iter, 0) {
+ flow = *slot;
radix_tree_iter_delete(&node->qrtr_tx_flow, &iter, slot);
- kfree(*slot);
+ kfree(flow);
}
kfree(node);
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 011/244] net_sched: fix a memory leak in atm_tc_init()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 010/244] net: qrtr: free flow in __qrtr_node_release Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 012/244] net: usb: qmi_wwan: add support for Quectel EG95 LTE modem Greg Kroah-Hartman
` (233 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jamal Hadi Salim, Jiri Pirko,
Cong Wang, David S. Miller, syzbot+d411cff6ab29cc2c311b
From: Cong Wang <xiyou.wangcong@gmail.com>
[ Upstream commit 306381aec7c2b5a658eebca008c8a1b666536cba ]
When tcf_block_get() fails inside atm_tc_init(),
atm_tc_put() is called to release the qdisc p->link.q.
But the flow->ref prevents it to do so, as the flow->ref
is still zero.
Fix this by moving the p->link.ref initialization before
tcf_block_get().
Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure")
Reported-and-tested-by: syzbot+d411cff6ab29cc2c311b@syzkaller.appspotmail.com
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_atm.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -553,16 +553,16 @@ static int atm_tc_init(struct Qdisc *sch
if (!p->link.q)
p->link.q = &noop_qdisc;
pr_debug("atm_tc_init: link (%p) qdisc %p\n", &p->link, p->link.q);
+ p->link.vcc = NULL;
+ p->link.sock = NULL;
+ p->link.common.classid = sch->handle;
+ p->link.ref = 1;
err = tcf_block_get(&p->link.block, &p->link.filter_list, sch,
extack);
if (err)
return err;
- p->link.vcc = NULL;
- p->link.sock = NULL;
- p->link.common.classid = sch->handle;
- p->link.ref = 1;
tasklet_init(&p->task, sch_atm_dequeue, (unsigned long)sch);
return 0;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 012/244] net: usb: qmi_wwan: add support for Quectel EG95 LTE modem
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 011/244] net_sched: fix a memory leak in atm_tc_init() Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 013/244] sched: consistently handle layer3 header accesses in the presence of VLANs Greg Kroah-Hartman
` (232 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, AceLan Kao, Bjørn Mork, David S. Miller
From: AceLan Kao <acelan.kao@canonical.com>
[ Upstream commit f815dd5cf48b905eeecf0a2b990e9b7ab048b4f1 ]
Add support for Quectel Wireless Solutions Co., Ltd. EG95 LTE modem
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 5 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0195 Rev=03.18
S: Manufacturer=Android
S: Product=Android
C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/qmi_wwan.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1370,6 +1370,7 @@ static const struct usb_device_id produc
{QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */
{QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
{QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */
{QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */
{QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */
{QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 013/244] sched: consistently handle layer3 header accesses in the presence of VLANs
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 012/244] net: usb: qmi_wwan: add support for Quectel EG95 LTE modem Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 014/244] tcp: fix SO_RCVLOWAT possible hangs under high mem pressure Greg Kroah-Hartman
` (231 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ilya Ponetayev,
Toke Høiland-Jørgensen, David S. Miller
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 15166 bytes --]
From: "Toke Høiland-Jørgensen" <toke@redhat.com>
[ Upstream commit d7bf2ebebc2bd61ab95e2a8e33541ef282f303d4 ]
There are a couple of places in net/sched/ that check skb->protocol and act
on the value there. However, in the presence of VLAN tags, the value stored
in skb->protocol can be inconsistent based on whether VLAN acceleration is
enabled. The commit quoted in the Fixes tag below fixed the users of
skb->protocol to use a helper that will always see the VLAN ethertype.
However, most of the callers don't actually handle the VLAN ethertype, but
expect to find the IP header type in the protocol field. This means that
things like changing the ECN field, or parsing diffserv values, stops
working if there's a VLAN tag, or if there are multiple nested VLAN
tags (QinQ).
To fix this, change the helper to take an argument that indicates whether
the caller wants to skip the VLAN tags or not. When skipping VLAN tags, we
make sure to skip all of them, so behaviour is consistent even in QinQ
mode.
To make the helper usable from the ECN code, move it to if_vlan.h instead
of pkt_sched.h.
v3:
- Remove empty lines
- Move vlan variable definitions inside loop in skb_protocol()
- Also use skb_protocol() helper in IP{,6}_ECN_decapsulate() and
bpf_skb_ecn_set_ce()
v2:
- Use eth_type_vlan() helper in skb_protocol()
- Also fix code that reads skb->protocol directly
- Change a couple of 'if/else if' statements to switch constructs to avoid
calling the helper twice
Reported-by: Ilya Ponetayev <i.ponetaev@ndmsystems.com>
Fixes: d8b9605d2697 ("net: sched: fix skb->protocol use in case of accelerated vlan path")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/if_vlan.h | 28 ++++++++++++++++++++++++++++
include/net/inet_ecn.h | 25 +++++++++++++++++--------
include/net/pkt_sched.h | 11 -----------
net/core/filter.c | 10 +++++++---
net/sched/act_connmark.c | 9 ++++++---
net/sched/act_csum.c | 2 +-
net/sched/act_ct.c | 9 ++++-----
net/sched/act_ctinfo.c | 9 ++++++---
net/sched/act_mpls.c | 2 +-
net/sched/act_skbedit.c | 2 +-
net/sched/cls_api.c | 2 +-
net/sched/cls_flow.c | 8 ++++----
net/sched/cls_flower.c | 2 +-
net/sched/em_ipset.c | 2 +-
net/sched/em_ipt.c | 2 +-
net/sched/em_meta.c | 2 +-
net/sched/sch_cake.c | 4 ++--
net/sched/sch_dsmark.c | 6 +++---
net/sched/sch_teql.c | 2 +-
19 files changed, 86 insertions(+), 51 deletions(-)
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -308,6 +308,34 @@ static inline bool eth_type_vlan(__be16
}
}
+/* A getter for the SKB protocol field which will handle VLAN tags consistently
+ * whether VLAN acceleration is enabled or not.
+ */
+static inline __be16 skb_protocol(const struct sk_buff *skb, bool skip_vlan)
+{
+ unsigned int offset = skb_mac_offset(skb) + sizeof(struct ethhdr);
+ __be16 proto = skb->protocol;
+
+ if (!skip_vlan)
+ /* VLAN acceleration strips the VLAN header from the skb and
+ * moves it to skb->vlan_proto
+ */
+ return skb_vlan_tag_present(skb) ? skb->vlan_proto : proto;
+
+ while (eth_type_vlan(proto)) {
+ struct vlan_hdr vhdr, *vh;
+
+ vh = skb_header_pointer(skb, offset, sizeof(vhdr), &vhdr);
+ if (!vh)
+ break;
+
+ proto = vh->h_vlan_encapsulated_proto;
+ offset += sizeof(vhdr);
+ }
+
+ return proto;
+}
+
static inline bool vlan_hw_offload_capable(netdev_features_t features,
__be16 proto)
{
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -4,6 +4,7 @@
#include <linux/ip.h>
#include <linux/skbuff.h>
+#include <linux/if_vlan.h>
#include <net/inet_sock.h>
#include <net/dsfield.h>
@@ -172,7 +173,7 @@ static inline void ipv6_copy_dscp(unsign
static inline int INET_ECN_set_ce(struct sk_buff *skb)
{
- switch (skb->protocol) {
+ switch (skb_protocol(skb, true)) {
case cpu_to_be16(ETH_P_IP):
if (skb_network_header(skb) + sizeof(struct iphdr) <=
skb_tail_pointer(skb))
@@ -191,7 +192,7 @@ static inline int INET_ECN_set_ce(struct
static inline int INET_ECN_set_ect1(struct sk_buff *skb)
{
- switch (skb->protocol) {
+ switch (skb_protocol(skb, true)) {
case cpu_to_be16(ETH_P_IP):
if (skb_network_header(skb) + sizeof(struct iphdr) <=
skb_tail_pointer(skb))
@@ -272,12 +273,16 @@ static inline int IP_ECN_decapsulate(con
{
__u8 inner;
- if (skb->protocol == htons(ETH_P_IP))
+ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
inner = ip_hdr(skb)->tos;
- else if (skb->protocol == htons(ETH_P_IPV6))
+ break;
+ case htons(ETH_P_IPV6):
inner = ipv6_get_dsfield(ipv6_hdr(skb));
- else
+ break;
+ default:
return 0;
+ }
return INET_ECN_decapsulate(skb, oiph->tos, inner);
}
@@ -287,12 +292,16 @@ static inline int IP6_ECN_decapsulate(co
{
__u8 inner;
- if (skb->protocol == htons(ETH_P_IP))
+ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
inner = ip_hdr(skb)->tos;
- else if (skb->protocol == htons(ETH_P_IPV6))
+ break;
+ case htons(ETH_P_IPV6):
inner = ipv6_get_dsfield(ipv6_hdr(skb));
- else
+ break;
+ default:
return 0;
+ }
return INET_ECN_decapsulate(skb, ipv6_get_dsfield(oipv6h), inner);
}
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -136,17 +136,6 @@ static inline void qdisc_run(struct Qdis
}
}
-static inline __be16 tc_skb_protocol(const struct sk_buff *skb)
-{
- /* We need to take extra care in case the skb came via
- * vlan accelerated path. In that case, use skb->vlan_proto
- * as the original vlan header was already stripped.
- */
- if (skb_vlan_tag_present(skb))
- return skb->vlan_proto;
- return skb->protocol;
-}
-
/* Calculate maximal size of packet seen by hard_start_xmit
routine of this device.
*/
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5724,12 +5724,16 @@ BPF_CALL_1(bpf_skb_ecn_set_ce, struct sk
{
unsigned int iphdr_len;
- if (skb->protocol == cpu_to_be16(ETH_P_IP))
+ switch (skb_protocol(skb, true)) {
+ case cpu_to_be16(ETH_P_IP):
iphdr_len = sizeof(struct iphdr);
- else if (skb->protocol == cpu_to_be16(ETH_P_IPV6))
+ break;
+ case cpu_to_be16(ETH_P_IPV6):
iphdr_len = sizeof(struct ipv6hdr);
- else
+ break;
+ default:
return 0;
+ }
if (skb_headlen(skb) < iphdr_len)
return 0;
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -43,17 +43,20 @@ static int tcf_connmark_act(struct sk_bu
tcf_lastuse_update(&ca->tcf_tm);
bstats_update(&ca->tcf_bstats, skb);
- if (skb->protocol == htons(ETH_P_IP)) {
+ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
if (skb->len < sizeof(struct iphdr))
goto out;
proto = NFPROTO_IPV4;
- } else if (skb->protocol == htons(ETH_P_IPV6)) {
+ break;
+ case htons(ETH_P_IPV6):
if (skb->len < sizeof(struct ipv6hdr))
goto out;
proto = NFPROTO_IPV6;
- } else {
+ break;
+ default:
goto out;
}
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -587,7 +587,7 @@ static int tcf_csum_act(struct sk_buff *
goto drop;
update_flags = params->update_flags;
- protocol = tc_skb_protocol(skb);
+ protocol = skb_protocol(skb, false);
again:
switch (protocol) {
case cpu_to_be16(ETH_P_IP):
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -622,7 +622,7 @@ static u8 tcf_ct_skb_nf_family(struct sk
{
u8 family = NFPROTO_UNSPEC;
- switch (skb->protocol) {
+ switch (skb_protocol(skb, true)) {
case htons(ETH_P_IP):
family = NFPROTO_IPV4;
break;
@@ -746,6 +746,7 @@ static int ct_nat_execute(struct sk_buff
const struct nf_nat_range2 *range,
enum nf_nat_manip_type maniptype)
{
+ __be16 proto = skb_protocol(skb, true);
int hooknum, err = NF_ACCEPT;
/* See HOOK2MANIP(). */
@@ -757,14 +758,13 @@ static int ct_nat_execute(struct sk_buff
switch (ctinfo) {
case IP_CT_RELATED:
case IP_CT_RELATED_REPLY:
- if (skb->protocol == htons(ETH_P_IP) &&
+ if (proto == htons(ETH_P_IP) &&
ip_hdr(skb)->protocol == IPPROTO_ICMP) {
if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
hooknum))
err = NF_DROP;
goto out;
- } else if (IS_ENABLED(CONFIG_IPV6) &&
- skb->protocol == htons(ETH_P_IPV6)) {
+ } else if (IS_ENABLED(CONFIG_IPV6) && proto == htons(ETH_P_IPV6)) {
__be16 frag_off;
u8 nexthdr = ipv6_hdr(skb)->nexthdr;
int hdrlen = ipv6_skip_exthdr(skb,
@@ -1559,4 +1559,3 @@ MODULE_AUTHOR("Yossi Kuperman <yossiku@m
MODULE_AUTHOR("Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>");
MODULE_DESCRIPTION("Connection tracking action");
MODULE_LICENSE("GPL v2");
-
--- a/net/sched/act_ctinfo.c
+++ b/net/sched/act_ctinfo.c
@@ -96,19 +96,22 @@ static int tcf_ctinfo_act(struct sk_buff
action = READ_ONCE(ca->tcf_action);
wlen = skb_network_offset(skb);
- if (tc_skb_protocol(skb) == htons(ETH_P_IP)) {
+ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
wlen += sizeof(struct iphdr);
if (!pskb_may_pull(skb, wlen))
goto out;
proto = NFPROTO_IPV4;
- } else if (tc_skb_protocol(skb) == htons(ETH_P_IPV6)) {
+ break;
+ case htons(ETH_P_IPV6):
wlen += sizeof(struct ipv6hdr);
if (!pskb_may_pull(skb, wlen))
goto out;
proto = NFPROTO_IPV6;
- } else {
+ break;
+ default:
goto out;
}
--- a/net/sched/act_mpls.c
+++ b/net/sched/act_mpls.c
@@ -82,7 +82,7 @@ static int tcf_mpls_act(struct sk_buff *
goto drop;
break;
case TCA_MPLS_ACT_PUSH:
- new_lse = tcf_mpls_get_lse(NULL, p, !eth_p_mpls(skb->protocol));
+ new_lse = tcf_mpls_get_lse(NULL, p, !eth_p_mpls(skb_protocol(skb, true)));
if (skb_mpls_push(skb, new_lse, p->tcfm_proto, mac_len,
skb->dev && skb->dev->type == ARPHRD_ETHER))
goto drop;
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -41,7 +41,7 @@ static int tcf_skbedit_act(struct sk_buf
if (params->flags & SKBEDIT_F_INHERITDSFIELD) {
int wlen = skb_network_offset(skb);
- switch (tc_skb_protocol(skb)) {
+ switch (skb_protocol(skb, true)) {
case htons(ETH_P_IP):
wlen += sizeof(struct iphdr);
if (!pskb_may_pull(skb, wlen))
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1589,7 +1589,7 @@ static inline int __tcf_classify(struct
reclassify:
#endif
for (; tp; tp = rcu_dereference_bh(tp->next)) {
- __be16 protocol = tc_skb_protocol(skb);
+ __be16 protocol = skb_protocol(skb, false);
int err;
if (tp->protocol != protocol &&
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -80,7 +80,7 @@ static u32 flow_get_dst(const struct sk_
if (dst)
return ntohl(dst);
- return addr_fold(skb_dst(skb)) ^ (__force u16) tc_skb_protocol(skb);
+ return addr_fold(skb_dst(skb)) ^ (__force u16)skb_protocol(skb, true);
}
static u32 flow_get_proto(const struct sk_buff *skb,
@@ -104,7 +104,7 @@ static u32 flow_get_proto_dst(const stru
if (flow->ports.ports)
return ntohs(flow->ports.dst);
- return addr_fold(skb_dst(skb)) ^ (__force u16) tc_skb_protocol(skb);
+ return addr_fold(skb_dst(skb)) ^ (__force u16)skb_protocol(skb, true);
}
static u32 flow_get_iif(const struct sk_buff *skb)
@@ -151,7 +151,7 @@ static u32 flow_get_nfct(const struct sk
static u32 flow_get_nfct_src(const struct sk_buff *skb,
const struct flow_keys *flow)
{
- switch (tc_skb_protocol(skb)) {
+ switch (skb_protocol(skb, true)) {
case htons(ETH_P_IP):
return ntohl(CTTUPLE(skb, src.u3.ip));
case htons(ETH_P_IPV6):
@@ -164,7 +164,7 @@ fallback:
static u32 flow_get_nfct_dst(const struct sk_buff *skb,
const struct flow_keys *flow)
{
- switch (tc_skb_protocol(skb)) {
+ switch (skb_protocol(skb, true)) {
case htons(ETH_P_IP):
return ntohl(CTTUPLE(skb, dst.u3.ip));
case htons(ETH_P_IPV6):
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -312,7 +312,7 @@ static int fl_classify(struct sk_buff *s
/* skb_flow_dissect() does not set n_proto in case an unknown
* protocol, so do it rather here.
*/
- skb_key.basic.n_proto = skb->protocol;
+ skb_key.basic.n_proto = skb_protocol(skb, false);
skb_flow_dissect_tunnel_info(skb, &mask->dissector, &skb_key);
skb_flow_dissect_ct(skb, &mask->dissector, &skb_key,
fl_ct_info_to_flower_map,
--- a/net/sched/em_ipset.c
+++ b/net/sched/em_ipset.c
@@ -59,7 +59,7 @@ static int em_ipset_match(struct sk_buff
};
int ret, network_offset;
- switch (tc_skb_protocol(skb)) {
+ switch (skb_protocol(skb, true)) {
case htons(ETH_P_IP):
state.pf = NFPROTO_IPV4;
if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
--- a/net/sched/em_ipt.c
+++ b/net/sched/em_ipt.c
@@ -212,7 +212,7 @@ static int em_ipt_match(struct sk_buff *
struct nf_hook_state state;
int ret;
- switch (tc_skb_protocol(skb)) {
+ switch (skb_protocol(skb, true)) {
case htons(ETH_P_IP):
if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
return 0;
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -195,7 +195,7 @@ META_COLLECTOR(int_priority)
META_COLLECTOR(int_protocol)
{
/* Let userspace take care of the byte ordering */
- dst->value = tc_skb_protocol(skb);
+ dst->value = skb_protocol(skb, false);
}
META_COLLECTOR(int_pkttype)
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -591,7 +591,7 @@ static void cake_update_flowkeys(struct
struct nf_conntrack_tuple tuple = {};
bool rev = !skb->_nfct;
- if (tc_skb_protocol(skb) != htons(ETH_P_IP))
+ if (skb_protocol(skb, true) != htons(ETH_P_IP))
return;
if (!nf_ct_get_tuple_skb(&tuple, skb))
@@ -1520,7 +1520,7 @@ static u8 cake_handle_diffserv(struct sk
u16 *buf, buf_;
u8 dscp;
- switch (tc_skb_protocol(skb)) {
+ switch (skb_protocol(skb, true)) {
case htons(ETH_P_IP):
buf = skb_header_pointer(skb, offset, sizeof(buf_), &buf_);
if (unlikely(!buf))
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -210,7 +210,7 @@ static int dsmark_enqueue(struct sk_buff
if (p->set_tc_index) {
int wlen = skb_network_offset(skb);
- switch (tc_skb_protocol(skb)) {
+ switch (skb_protocol(skb, true)) {
case htons(ETH_P_IP):
wlen += sizeof(struct iphdr);
if (!pskb_may_pull(skb, wlen) ||
@@ -303,7 +303,7 @@ static struct sk_buff *dsmark_dequeue(st
index = skb->tc_index & (p->indices - 1);
pr_debug("index %d->%d\n", skb->tc_index, index);
- switch (tc_skb_protocol(skb)) {
+ switch (skb_protocol(skb, true)) {
case htons(ETH_P_IP):
ipv4_change_dsfield(ip_hdr(skb), p->mv[index].mask,
p->mv[index].value);
@@ -320,7 +320,7 @@ static struct sk_buff *dsmark_dequeue(st
*/
if (p->mv[index].mask != 0xff || p->mv[index].value)
pr_warn("%s: unsupported protocol %d\n",
- __func__, ntohs(tc_skb_protocol(skb)));
+ __func__, ntohs(skb_protocol(skb, true)));
break;
}
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -239,7 +239,7 @@ __teql_resolve(struct sk_buff *skb, stru
char haddr[MAX_ADDR_LEN];
neigh_ha_snapshot(haddr, n, dev);
- err = dev_hard_header(skb, dev, ntohs(tc_skb_protocol(skb)),
+ err = dev_hard_header(skb, dev, ntohs(skb_protocol(skb, false)),
haddr, NULL, skb->len);
if (err < 0)
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 014/244] tcp: fix SO_RCVLOWAT possible hangs under high mem pressure
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 013/244] sched: consistently handle layer3 header accesses in the presence of VLANs Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 015/244] tcp: make sure listeners dont initialize congestion-control state Greg Kroah-Hartman
` (230 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David S. Miller
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit ba3bb0e76ccd464bb66665a1941fabe55dadb3ba ]
Whenever tcp_try_rmem_schedule() returns an error, we are under
trouble and should make sure to wakeup readers so that they
can drain socket queues and eventually make room.
Fixes: 03f45c883c6f ("tcp: avoid extra wakeups for SO_RCVLOWAT users")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_input.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4570,6 +4570,7 @@ static void tcp_data_queue_ofo(struct so
if (unlikely(tcp_try_rmem_schedule(sk, skb, skb->truesize))) {
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPOFODROP);
+ sk->sk_data_ready(sk);
tcp_drop(sk, skb);
return;
}
@@ -4816,6 +4817,7 @@ queue_and_out:
sk_forced_mem_schedule(sk, skb->truesize);
else if (tcp_try_rmem_schedule(sk, skb, skb->truesize)) {
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRCVQDROP);
+ sk->sk_data_ready(sk);
goto drop;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 015/244] tcp: make sure listeners dont initialize congestion-control state
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 014/244] tcp: fix SO_RCVLOWAT possible hangs under high mem pressure Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 016/244] tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key() Greg Kroah-Hartman
` (229 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wei Wang, Eric Dumazet,
Christoph Paasch, David S. Miller
From: Christoph Paasch <cpaasch@apple.com>
[ Upstream commit ce69e563b325f620863830c246a8698ccea52048 ]
syzkaller found its way into setsockopt with TCP_CONGESTION "cdg".
tcp_cdg_init() does a kcalloc to store the gradients. As sk_clone_lock
just copies all the memory, the allocated pointer will be copied as
well, if the app called setsockopt(..., TCP_CONGESTION) on the listener.
If now the socket will be destroyed before the congestion-control
has properly been initialized (through a call to tcp_init_transfer), we
will end up freeing memory that does not belong to that particular
socket, opening the door to a double-free:
[ 11.413102] ==================================================================
[ 11.414181] BUG: KASAN: double-free or invalid-free in tcp_cleanup_congestion_control+0x58/0xd0
[ 11.415329]
[ 11.415560] CPU: 3 PID: 4884 Comm: syz-executor.5 Not tainted 5.8.0-rc2 #80
[ 11.416544] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[ 11.418148] Call Trace:
[ 11.418534] <IRQ>
[ 11.418834] dump_stack+0x7d/0xb0
[ 11.419297] print_address_description.constprop.0+0x1a/0x210
[ 11.422079] kasan_report_invalid_free+0x51/0x80
[ 11.423433] __kasan_slab_free+0x15e/0x170
[ 11.424761] kfree+0x8c/0x230
[ 11.425157] tcp_cleanup_congestion_control+0x58/0xd0
[ 11.425872] tcp_v4_destroy_sock+0x57/0x5a0
[ 11.426493] inet_csk_destroy_sock+0x153/0x2c0
[ 11.427093] tcp_v4_syn_recv_sock+0xb29/0x1100
[ 11.427731] tcp_get_cookie_sock+0xc3/0x4a0
[ 11.429457] cookie_v4_check+0x13d0/0x2500
[ 11.433189] tcp_v4_do_rcv+0x60e/0x780
[ 11.433727] tcp_v4_rcv+0x2869/0x2e10
[ 11.437143] ip_protocol_deliver_rcu+0x23/0x190
[ 11.437810] ip_local_deliver+0x294/0x350
[ 11.439566] __netif_receive_skb_one_core+0x15d/0x1a0
[ 11.441995] process_backlog+0x1b1/0x6b0
[ 11.443148] net_rx_action+0x37e/0xc40
[ 11.445361] __do_softirq+0x18c/0x61a
[ 11.445881] asm_call_on_stack+0x12/0x20
[ 11.446409] </IRQ>
[ 11.446716] do_softirq_own_stack+0x34/0x40
[ 11.447259] do_softirq.part.0+0x26/0x30
[ 11.447827] __local_bh_enable_ip+0x46/0x50
[ 11.448406] ip_finish_output2+0x60f/0x1bc0
[ 11.450109] __ip_queue_xmit+0x71c/0x1b60
[ 11.451861] __tcp_transmit_skb+0x1727/0x3bb0
[ 11.453789] tcp_rcv_state_process+0x3070/0x4d3a
[ 11.456810] tcp_v4_do_rcv+0x2ad/0x780
[ 11.457995] __release_sock+0x14b/0x2c0
[ 11.458529] release_sock+0x4a/0x170
[ 11.459005] __inet_stream_connect+0x467/0xc80
[ 11.461435] inet_stream_connect+0x4e/0xa0
[ 11.462043] __sys_connect+0x204/0x270
[ 11.465515] __x64_sys_connect+0x6a/0xb0
[ 11.466088] do_syscall_64+0x3e/0x70
[ 11.466617] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 11.467341] RIP: 0033:0x7f56046dc469
[ 11.467844] Code: Bad RIP value.
[ 11.468282] RSP: 002b:00007f5604dccdd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
[ 11.469326] RAX: ffffffffffffffda RBX: 000000000068bf00 RCX: 00007f56046dc469
[ 11.470379] RDX: 0000000000000010 RSI: 0000000020000000 RDI: 0000000000000004
[ 11.471311] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000
[ 11.472286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 11.473341] R13: 000000000041427c R14: 00007f5604dcd5c0 R15: 0000000000000003
[ 11.474321]
[ 11.474527] Allocated by task 4884:
[ 11.475031] save_stack+0x1b/0x40
[ 11.475548] __kasan_kmalloc.constprop.0+0xc2/0xd0
[ 11.476182] tcp_cdg_init+0xf0/0x150
[ 11.476744] tcp_init_congestion_control+0x9b/0x3a0
[ 11.477435] tcp_set_congestion_control+0x270/0x32f
[ 11.478088] do_tcp_setsockopt.isra.0+0x521/0x1a00
[ 11.478744] __sys_setsockopt+0xff/0x1e0
[ 11.479259] __x64_sys_setsockopt+0xb5/0x150
[ 11.479895] do_syscall_64+0x3e/0x70
[ 11.480395] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 11.481097]
[ 11.481321] Freed by task 4872:
[ 11.481783] save_stack+0x1b/0x40
[ 11.482230] __kasan_slab_free+0x12c/0x170
[ 11.482839] kfree+0x8c/0x230
[ 11.483240] tcp_cleanup_congestion_control+0x58/0xd0
[ 11.483948] tcp_v4_destroy_sock+0x57/0x5a0
[ 11.484502] inet_csk_destroy_sock+0x153/0x2c0
[ 11.485144] tcp_close+0x932/0xfe0
[ 11.485642] inet_release+0xc1/0x1c0
[ 11.486131] __sock_release+0xc0/0x270
[ 11.486697] sock_close+0xc/0x10
[ 11.487145] __fput+0x277/0x780
[ 11.487632] task_work_run+0xeb/0x180
[ 11.488118] __prepare_exit_to_usermode+0x15a/0x160
[ 11.488834] do_syscall_64+0x4a/0x70
[ 11.489326] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Wei Wang fixed a part of these CDG-malloc issues with commit c12014440750
("tcp: memset ca_priv data to 0 properly").
This patch here fixes the listener-scenario: We make sure that listeners
setting the congestion-control through setsockopt won't initialize it
(thus CDG never allocates on listeners). For those who use AF_UNSPEC to
reuse a socket, tcp_disconnect() is changed to cleanup afterwards.
(The issue can be reproduced at least down to v4.4.x.)
Cc: Wei Wang <weiwan@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Fixes: 2b0a8c9eee81 ("tcp: add CDG congestion control")
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp.c | 3 +++
net/ipv4/tcp_cong.c | 2 +-
2 files changed, 4 insertions(+), 1 deletion(-)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2635,6 +2635,9 @@ int tcp_disconnect(struct sock *sk, int
tp->window_clamp = 0;
tp->delivered = 0;
tp->delivered_ce = 0;
+ if (icsk->icsk_ca_ops->release)
+ icsk->icsk_ca_ops->release(sk);
+ memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
tcp_set_ca_state(sk, TCP_CA_Open);
tp->is_sack_reneg = 0;
tcp_clear_retrans(tp);
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -197,7 +197,7 @@ static void tcp_reinit_congestion_contro
icsk->icsk_ca_setsockopt = 1;
memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
- if (sk->sk_state != TCP_CLOSE)
+ if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
tcp_init_congestion_control(sk);
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 016/244] tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 015/244] tcp: make sure listeners dont initialize congestion-control state Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 017/244] tcp: md5: do not send silly options in SYNCOOKIES Greg Kroah-Hartman
` (228 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Mathieu Desnoyers,
David S. Miller
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 6a2febec338df7e7699a52d00b2e1207dcf65b28 ]
MD5 keys are read with RCU protection, and tcp_md5_do_add()
might update in-place a prior key.
Normally, typical RCU updates would allocate a new piece
of memory. In this case only key->key and key->keylen might
be updated, and we do not care if an incoming packet could
see the old key, the new one, or some intermediate value,
since changing the key on a live flow is known to be problematic
anyway.
We only want to make sure that in the case key->keylen
is changed, cpus in tcp_md5_hash_key() wont try to use
uninitialized data, or crash because key->keylen was
read twice to feed sg_init_one() and ahash_request_set_crypt()
Fixes: 9ea88a153001 ("tcp: md5: check md5 signature without socket lock")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp.c | 7 +++++--
net/ipv4/tcp_ipv4.c | 3 +++
2 files changed, 8 insertions(+), 2 deletions(-)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3880,10 +3880,13 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data);
int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *key)
{
+ u8 keylen = key->keylen;
struct scatterlist sg;
- sg_init_one(&sg, key->key, key->keylen);
- ahash_request_set_crypt(hp->md5_req, &sg, NULL, key->keylen);
+ smp_rmb(); /* paired with smp_wmb() in tcp_md5_do_add() */
+
+ sg_init_one(&sg, key->key, keylen);
+ ahash_request_set_crypt(hp->md5_req, &sg, NULL, keylen);
return crypto_ahash_update(hp->md5_req);
}
EXPORT_SYMBOL(tcp_md5_hash_key);
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1105,6 +1105,9 @@ int tcp_md5_do_add(struct sock *sk, cons
if (key) {
/* Pre-existing entry - just update that one. */
memcpy(key->key, newkey, newkeylen);
+
+ smp_wmb(); /* pairs with smp_rmb() in tcp_md5_hash_key() */
+
key->keylen = newkeylen;
return 0;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 017/244] tcp: md5: do not send silly options in SYNCOOKIES
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 016/244] tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key() Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 018/244] vlan: consolidate VLAN parsing code and limit max parsing depth Greg Kroah-Hartman
` (227 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Florian Westphal,
Mathieu Desnoyers, David S. Miller
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e114e1e8ac9d31f25b9dd873bab5d80c1fc482ca ]
Whenever cookie_init_timestamp() has been used to encode
ECN,SACK,WSCALE options, we can not remove the TS option in the SYNACK.
Otherwise, tcp_synack_options() will still advertize options like WSCALE
that we can not deduce later when receiving the packet from the client
to complete 3WHS.
Note that modern linux TCP stacks wont use MD5+TS+SACK in a SYN packet,
but we can not know for sure that all TCP stacks have the same logic.
Before the fix a tcpdump would exhibit this wrong exchange :
10:12:15.464591 IP C > S: Flags [S], seq 4202415601, win 65535, options [nop,nop,md5 valid,mss 1400,sackOK,TS val 456965269 ecr 0,nop,wscale 8], length 0
10:12:15.464602 IP S > C: Flags [S.], seq 253516766, ack 4202415602, win 65535, options [nop,nop,md5 valid,mss 1400,nop,nop,sackOK,nop,wscale 8], length 0
10:12:15.464611 IP C > S: Flags [.], ack 1, win 256, options [nop,nop,md5 valid], length 0
10:12:15.464678 IP C > S: Flags [P.], seq 1:13, ack 1, win 256, options [nop,nop,md5 valid], length 12
10:12:15.464685 IP S > C: Flags [.], ack 13, win 65535, options [nop,nop,md5 valid], length 0
After this patch the exchange looks saner :
11:59:59.882990 IP C > S: Flags [S], seq 517075944, win 65535, options [nop,nop,md5 valid,mss 1400,sackOK,TS val 1751508483 ecr 0,nop,wscale 8], length 0
11:59:59.883002 IP S > C: Flags [S.], seq 1902939253, ack 517075945, win 65535, options [nop,nop,md5 valid,mss 1400,sackOK,TS val 1751508479 ecr 1751508483,nop,wscale 8], length 0
11:59:59.883012 IP C > S: Flags [.], ack 1, win 256, options [nop,nop,md5 valid,nop,nop,TS val 1751508483 ecr 1751508479], length 0
11:59:59.883114 IP C > S: Flags [P.], seq 1:13, ack 1, win 256, options [nop,nop,md5 valid,nop,nop,TS val 1751508483 ecr 1751508479], length 12
11:59:59.883122 IP S > C: Flags [.], ack 13, win 256, options [nop,nop,md5 valid,nop,nop,TS val 1751508483 ecr 1751508483], length 0
11:59:59.883152 IP S > C: Flags [P.], seq 1:13, ack 13, win 256, options [nop,nop,md5 valid,nop,nop,TS val 1751508484 ecr 1751508483], length 12
11:59:59.883170 IP C > S: Flags [.], ack 13, win 256, options [nop,nop,md5 valid,nop,nop,TS val 1751508484 ecr 1751508484], length 0
Of course, no SACK block will ever be added later, but nothing should break.
Technically, we could remove the 4 nops included in MD5+TS options,
but again some stacks could break seeing not conventional alignment.
Fixes: 4957faade11b ("TCPCT part 1g: Responder Cookie => Initiator")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_output.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -700,7 +700,8 @@ static unsigned int tcp_synack_options(c
unsigned int mss, struct sk_buff *skb,
struct tcp_out_options *opts,
const struct tcp_md5sig_key *md5,
- struct tcp_fastopen_cookie *foc)
+ struct tcp_fastopen_cookie *foc,
+ enum tcp_synack_type synack_type)
{
struct inet_request_sock *ireq = inet_rsk(req);
unsigned int remaining = MAX_TCP_OPTION_SPACE;
@@ -715,7 +716,8 @@ static unsigned int tcp_synack_options(c
* rather than TS in order to fit in better with old,
* buggy kernels, but that was deemed to be unnecessary.
*/
- ireq->tstamp_ok &= !ireq->sack_ok;
+ if (synack_type != TCP_SYNACK_COOKIE)
+ ireq->tstamp_ok &= !ireq->sack_ok;
}
#endif
@@ -3388,7 +3390,7 @@ struct sk_buff *tcp_make_synack(const st
#endif
skb_set_hash(skb, tcp_rsk(req)->txhash, PKT_HASH_TYPE_L4);
tcp_header_size = tcp_synack_options(sk, req, mss, skb, &opts, md5,
- foc) + sizeof(*th);
+ foc, synack_type) + sizeof(*th);
skb_push(skb, tcp_header_size);
skb_reset_transport_header(skb);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 018/244] vlan: consolidate VLAN parsing code and limit max parsing depth
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 017/244] tcp: md5: do not send silly options in SYNCOOKIES Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 019/244] tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers Greg Kroah-Hartman
` (226 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Toshiaki Makita, Daniel Borkmann,
Toke Høiland-Jørgensen, David S. Miller
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 4698 bytes --]
From: "Toke Høiland-Jørgensen" <toke@redhat.com>
[ Upstream commit 469aceddfa3ed16e17ee30533fae45e90f62efd8 ]
Toshiaki pointed out that we now have two very similar functions to extract
the L3 protocol number in the presence of VLAN tags. And Daniel pointed out
that the unbounded parsing loop makes it possible for maliciously crafted
packets to loop through potentially hundreds of tags.
Fix both of these issues by consolidating the two parsing functions and
limiting the VLAN tag parsing to a max depth of 8 tags. As part of this,
switch over __vlan_get_protocol() to use skb_header_pointer() instead of
pskb_may_pull(), to avoid the possible side effects of the latter and keep
the skb pointer 'const' through all the parsing functions.
v2:
- Use limit of 8 tags instead of 32 (matching XMIT_RECURSION_LIMIT)
Reported-by: Toshiaki Makita <toshiaki.makita1@gmail.com>
Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Fixes: d7bf2ebebc2b ("sched: consistently handle layer3 header accesses in the presence of VLANs")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/if_vlan.h | 57 ++++++++++++++++++------------------------------
1 file changed, 22 insertions(+), 35 deletions(-)
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -25,6 +25,8 @@
#define VLAN_ETH_DATA_LEN 1500 /* Max. octets in payload */
#define VLAN_ETH_FRAME_LEN 1518 /* Max. octets in frame sans FCS */
+#define VLAN_MAX_DEPTH 8 /* Max. number of nested VLAN tags parsed */
+
/*
* struct vlan_hdr - vlan header
* @h_vlan_TCI: priority and VLAN ID
@@ -308,34 +310,6 @@ static inline bool eth_type_vlan(__be16
}
}
-/* A getter for the SKB protocol field which will handle VLAN tags consistently
- * whether VLAN acceleration is enabled or not.
- */
-static inline __be16 skb_protocol(const struct sk_buff *skb, bool skip_vlan)
-{
- unsigned int offset = skb_mac_offset(skb) + sizeof(struct ethhdr);
- __be16 proto = skb->protocol;
-
- if (!skip_vlan)
- /* VLAN acceleration strips the VLAN header from the skb and
- * moves it to skb->vlan_proto
- */
- return skb_vlan_tag_present(skb) ? skb->vlan_proto : proto;
-
- while (eth_type_vlan(proto)) {
- struct vlan_hdr vhdr, *vh;
-
- vh = skb_header_pointer(skb, offset, sizeof(vhdr), &vhdr);
- if (!vh)
- break;
-
- proto = vh->h_vlan_encapsulated_proto;
- offset += sizeof(vhdr);
- }
-
- return proto;
-}
-
static inline bool vlan_hw_offload_capable(netdev_features_t features,
__be16 proto)
{
@@ -605,10 +579,10 @@ static inline int vlan_get_tag(const str
* Returns the EtherType of the packet, regardless of whether it is
* vlan encapsulated (normal or hardware accelerated) or not.
*/
-static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
+static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type,
int *depth)
{
- unsigned int vlan_depth = skb->mac_len;
+ unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH;
/* if type is 802.1Q/AD then the header should already be
* present at mac_len - VLAN_HLEN (if mac_len > 0), or at
@@ -623,13 +597,12 @@ static inline __be16 __vlan_get_protocol
vlan_depth = ETH_HLEN;
}
do {
- struct vlan_hdr *vh;
+ struct vlan_hdr vhdr, *vh;
- if (unlikely(!pskb_may_pull(skb,
- vlan_depth + VLAN_HLEN)))
+ vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), &vhdr);
+ if (unlikely(!vh || !--parse_depth))
return 0;
- vh = (struct vlan_hdr *)(skb->data + vlan_depth);
type = vh->h_vlan_encapsulated_proto;
vlan_depth += VLAN_HLEN;
} while (eth_type_vlan(type));
@@ -648,11 +621,25 @@ static inline __be16 __vlan_get_protocol
* Returns the EtherType of the packet, regardless of whether it is
* vlan encapsulated (normal or hardware accelerated) or not.
*/
-static inline __be16 vlan_get_protocol(struct sk_buff *skb)
+static inline __be16 vlan_get_protocol(const struct sk_buff *skb)
{
return __vlan_get_protocol(skb, skb->protocol, NULL);
}
+/* A getter for the SKB protocol field which will handle VLAN tags consistently
+ * whether VLAN acceleration is enabled or not.
+ */
+static inline __be16 skb_protocol(const struct sk_buff *skb, bool skip_vlan)
+{
+ if (!skip_vlan)
+ /* VLAN acceleration strips the VLAN header from the skb and
+ * moves it to skb->vlan_proto
+ */
+ return skb_vlan_tag_present(skb) ? skb->vlan_proto : skb->protocol;
+
+ return vlan_get_protocol(skb);
+}
+
static inline void vlan_set_encap_proto(struct sk_buff *skb,
struct vlan_hdr *vhdr)
{
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 019/244] tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 018/244] vlan: consolidate VLAN parsing code and limit max parsing depth Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 020/244] tcp: md5: allow changing MD5 keys in all socket states Greg Kroah-Hartman
` (225 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Mathieu Desnoyers,
Herbert Xu, Marco Elver, David S. Miller
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e6ced831ef11a2a06e8d00aad9d4fc05b610bf38 ]
My prior fix went a bit too far, according to Herbert and Mathieu.
Since we accept that concurrent TCP MD5 lookups might see inconsistent
keys, we can use READ_ONCE()/WRITE_ONCE() instead of smp_rmb()/smp_wmb()
Clearing all key->key[] is needed to avoid possible KMSAN reports,
if key->keylen is increased. Since tcp_md5_do_add() is not fast path,
using __GFP_ZERO to clear all struct tcp_md5sig_key is simpler.
data_race() was added in linux-5.8 and will prevent KCSAN reports,
this can safely be removed in stable backports, if data_race() is
not yet backported.
v2: use data_race() both in tcp_md5_hash_key() and tcp_md5_do_add()
Fixes: 6a2febec338d ("tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Marco Elver <elver@google.com>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp.c | 6 +++---
net/ipv4/tcp_ipv4.c | 14 ++++++++++----
2 files changed, 13 insertions(+), 7 deletions(-)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3880,13 +3880,13 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data);
int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *key)
{
- u8 keylen = key->keylen;
+ u8 keylen = READ_ONCE(key->keylen); /* paired with WRITE_ONCE() in tcp_md5_do_add */
struct scatterlist sg;
- smp_rmb(); /* paired with smp_wmb() in tcp_md5_do_add() */
-
sg_init_one(&sg, key->key, keylen);
ahash_request_set_crypt(hp->md5_req, &sg, NULL, keylen);
+
+ /* tcp_md5_do_add() might change key->key under us */
return crypto_ahash_update(hp->md5_req);
}
EXPORT_SYMBOL(tcp_md5_hash_key);
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1103,12 +1103,18 @@ int tcp_md5_do_add(struct sock *sk, cons
key = tcp_md5_do_lookup_exact(sk, addr, family, prefixlen, l3index);
if (key) {
- /* Pre-existing entry - just update that one. */
+ /* Pre-existing entry - just update that one.
+ * Note that the key might be used concurrently.
+ */
memcpy(key->key, newkey, newkeylen);
- smp_wmb(); /* pairs with smp_rmb() in tcp_md5_hash_key() */
+ /* Pairs with READ_ONCE() in tcp_md5_hash_key().
+ * Also note that a reader could catch new key->keylen value
+ * but old key->key[], this is the reason we use __GFP_ZERO
+ * at sock_kmalloc() time below these lines.
+ */
+ WRITE_ONCE(key->keylen, newkeylen);
- key->keylen = newkeylen;
return 0;
}
@@ -1124,7 +1130,7 @@ int tcp_md5_do_add(struct sock *sk, cons
rcu_assign_pointer(tp->md5sig_info, md5sig);
}
- key = sock_kmalloc(sk, sizeof(*key), gfp);
+ key = sock_kmalloc(sk, sizeof(*key), gfp | __GFP_ZERO);
if (!key)
return -ENOMEM;
if (!tcp_alloc_md5sig_pool()) {
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 020/244] tcp: md5: allow changing MD5 keys in all socket states
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 019/244] tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 021/244] cgroup: fix cgroup_sk_alloc() for sk_clone_lock() Greg Kroah-Hartman
` (224 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Mathieu Desnoyers,
David S. Miller
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 1ca0fafd73c5268e8fc4b997094b8bb2bfe8deea ]
This essentially reverts commit 721230326891 ("tcp: md5: reject TCP_MD5SIG
or TCP_MD5SIG_EXT on established sockets")
Mathieu reported that many vendors BGP implementations can
actually switch TCP MD5 on established flows.
Quoting Mathieu :
Here is a list of a few network vendors along with their behavior
with respect to TCP MD5:
- Cisco: Allows for password to be changed, but within the hold-down
timer (~180 seconds).
- Juniper: When password is initially set on active connection it will
reset, but after that any subsequent password changes no network
resets.
- Nokia: No notes on if they flap the tcp connection or not.
- Ericsson/RedBack: Allows for 2 password (old/new) to co-exist until
both sides are ok with new passwords.
- Meta-Switch: Expects the password to be set before a connection is
attempted, but no further info on whether they reset the TCP
connection on a change.
- Avaya: Disable the neighbor, then set password, then re-enable.
- Zebos: Would normally allow the change when socket connected.
We can revert my prior change because commit 9424e2e7ad93 ("tcp: md5: fix potential
overestimation of TCP option space") removed the leak of 4 kernel bytes to
the wire that was the main reason for my patch.
While doing my investigations, I found a bug when a MD5 key is changed, leading
to these commits that stable teams want to consider before backporting this revert :
Commit 6a2febec338d ("tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()")
Commit e6ced831ef11 ("tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers")
Fixes: 721230326891 "tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets"
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3093,10 +3093,7 @@ static int do_tcp_setsockopt(struct sock
#ifdef CONFIG_TCP_MD5SIG
case TCP_MD5SIG:
case TCP_MD5SIG_EXT:
- if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
- err = tp->af_specific->md5_parse(sk, optname, optval, optlen);
- else
- err = -EINVAL;
+ err = tp->af_specific->md5_parse(sk, optname, optval, optlen);
break;
#endif
case TCP_USER_TIMEOUT:
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 021/244] cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 020/244] tcp: md5: allow changing MD5 keys in all socket states Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 16:46 ` Roman Gushchin
2020-07-20 15:34 ` [PATCH 5.7 022/244] cgroup: Fix sock_cgroup_data on big-endian Greg Kroah-Hartman
` (223 subsequent siblings)
244 siblings, 1 reply; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cameron Berkenpas, Peter Geis,
Lu Fengqi, Daniël Sonck, Zhang Qiang, Thomas Lamprecht,
Daniel Borkmann, Zefan Li, Tejun Heo, Roman Gushchin, Cong Wang,
David S. Miller
From: Cong Wang <xiyou.wangcong@gmail.com>
[ Upstream commit ad0f75e5f57ccbceec13274e1e242f2b5a6397ed ]
When we clone a socket in sk_clone_lock(), its sk_cgrp_data is
copied, so the cgroup refcnt must be taken too. And, unlike the
sk_alloc() path, sock_update_netprioidx() is not called here.
Therefore, it is safe and necessary to grab the cgroup refcnt
even when cgroup_sk_alloc is disabled.
sk_clone_lock() is in BH context anyway, the in_interrupt()
would terminate this function if called there. And for sk_alloc()
skcd->val is always zero. So it's safe to factor out the code
to make it more readable.
The global variable 'cgroup_sk_alloc_disabled' is used to determine
whether to take these reference counts. It is impossible to make
the reference counting correct unless we save this bit of information
in skcd->val. So, add a new bit there to record whether the socket
has already taken the reference counts. This obviously relies on
kmalloc() to align cgroup pointers to at least 4 bytes,
ARCH_KMALLOC_MINALIGN is certainly larger than that.
This bug seems to be introduced since the beginning, commit
d979a39d7242 ("cgroup: duplicate cgroup reference when cloning sockets")
tried to fix it but not compeletely. It seems not easy to trigger until
the recent commit 090e28b229af
("netprio_cgroup: Fix unlimited memory leak of v2 cgroups") was merged.
Fixes: bd1060a1d671 ("sock, cgroup: add sock->sk_cgroup")
Reported-by: Cameron Berkenpas <cam@neo-zeon.de>
Reported-by: Peter Geis <pgwipeout@gmail.com>
Reported-by: Lu Fengqi <lufq.fnst@cn.fujitsu.com>
Reported-by: Daniël Sonck <dsonck92@gmail.com>
Reported-by: Zhang Qiang <qiang.zhang@windriver.com>
Tested-by: Cameron Berkenpas <cam@neo-zeon.de>
Tested-by: Peter Geis <pgwipeout@gmail.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Zefan Li <lizefan@huawei.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Roman Gushchin <guro@fb.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/cgroup-defs.h | 6 ++++--
include/linux/cgroup.h | 4 +++-
kernel/cgroup/cgroup.c | 31 +++++++++++++++++++------------
net/core/sock.c | 2 +-
4 files changed, 27 insertions(+), 16 deletions(-)
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -790,7 +790,8 @@ struct sock_cgroup_data {
union {
#ifdef __LITTLE_ENDIAN
struct {
- u8 is_data;
+ u8 is_data : 1;
+ u8 no_refcnt : 1;
u8 padding;
u16 prioidx;
u32 classid;
@@ -800,7 +801,8 @@ struct sock_cgroup_data {
u32 classid;
u16 prioidx;
u8 padding;
- u8 is_data;
+ u8 no_refcnt : 1;
+ u8 is_data : 1;
} __packed;
#endif
u64 val;
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -822,6 +822,7 @@ extern spinlock_t cgroup_sk_update_lock;
void cgroup_sk_alloc_disable(void);
void cgroup_sk_alloc(struct sock_cgroup_data *skcd);
+void cgroup_sk_clone(struct sock_cgroup_data *skcd);
void cgroup_sk_free(struct sock_cgroup_data *skcd);
static inline struct cgroup *sock_cgroup_ptr(struct sock_cgroup_data *skcd)
@@ -835,7 +836,7 @@ static inline struct cgroup *sock_cgroup
*/
v = READ_ONCE(skcd->val);
- if (v & 1)
+ if (v & 3)
return &cgrp_dfl_root.cgrp;
return (struct cgroup *)(unsigned long)v ?: &cgrp_dfl_root.cgrp;
@@ -847,6 +848,7 @@ static inline struct cgroup *sock_cgroup
#else /* CONFIG_CGROUP_DATA */
static inline void cgroup_sk_alloc(struct sock_cgroup_data *skcd) {}
+static inline void cgroup_sk_clone(struct sock_cgroup_data *skcd) {}
static inline void cgroup_sk_free(struct sock_cgroup_data *skcd) {}
#endif /* CONFIG_CGROUP_DATA */
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -6447,18 +6447,8 @@ void cgroup_sk_alloc_disable(void)
void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
{
- if (cgroup_sk_alloc_disabled)
- return;
-
- /* Socket clone path */
- if (skcd->val) {
- /*
- * We might be cloning a socket which is left in an empty
- * cgroup and the cgroup might have already been rmdir'd.
- * Don't use cgroup_get_live().
- */
- cgroup_get(sock_cgroup_ptr(skcd));
- cgroup_bpf_get(sock_cgroup_ptr(skcd));
+ if (cgroup_sk_alloc_disabled) {
+ skcd->no_refcnt = 1;
return;
}
@@ -6483,10 +6473,27 @@ void cgroup_sk_alloc(struct sock_cgroup_
rcu_read_unlock();
}
+void cgroup_sk_clone(struct sock_cgroup_data *skcd)
+{
+ if (skcd->val) {
+ if (skcd->no_refcnt)
+ return;
+ /*
+ * We might be cloning a socket which is left in an empty
+ * cgroup and the cgroup might have already been rmdir'd.
+ * Don't use cgroup_get_live().
+ */
+ cgroup_get(sock_cgroup_ptr(skcd));
+ cgroup_bpf_get(sock_cgroup_ptr(skcd));
+ }
+}
+
void cgroup_sk_free(struct sock_cgroup_data *skcd)
{
struct cgroup *cgrp = sock_cgroup_ptr(skcd);
+ if (skcd->no_refcnt)
+ return;
cgroup_bpf_put(cgrp);
cgroup_put(cgrp);
}
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1837,7 +1837,7 @@ struct sock *sk_clone_lock(const struct
/* sk->sk_memcg will be populated at accept() time */
newsk->sk_memcg = NULL;
- cgroup_sk_alloc(&newsk->sk_cgrp_data);
+ cgroup_sk_clone(&newsk->sk_cgrp_data);
rcu_read_lock();
filter = rcu_dereference(sk->sk_filter);
^ permalink raw reply [flat|nested] 256+ messages in thread* Re: [PATCH 5.7 021/244] cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
2020-07-20 15:34 ` [PATCH 5.7 021/244] cgroup: fix cgroup_sk_alloc() for sk_clone_lock() Greg Kroah-Hartman
@ 2020-07-20 16:46 ` Roman Gushchin
2020-07-20 19:15 ` Greg Kroah-Hartman
0 siblings, 1 reply; 256+ messages in thread
From: Roman Gushchin @ 2020-07-20 16:46 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Cameron Berkenpas, Peter Geis, Lu Fengqi,
Daniël Sonck, Zhang Qiang, Thomas Lamprecht,
Daniel Borkmann, Zefan Li, Tejun Heo, Cong Wang, David S. Miller
On Mon, Jul 20, 2020 at 05:34:52PM +0200, Greg Kroah-Hartman wrote:
> From: Cong Wang <xiyou.wangcong@gmail.com>
>
> [ Upstream commit ad0f75e5f57ccbceec13274e1e242f2b5a6397ed ]
Hi Greg!
There is a fix for this commit:
14b032b8f8fc ("cgroup: Fix sock_cgroup_data on big-endian.")
Can you, please, grab it too?
Thanks!
>
> When we clone a socket in sk_clone_lock(), its sk_cgrp_data is
> copied, so the cgroup refcnt must be taken too. And, unlike the
> sk_alloc() path, sock_update_netprioidx() is not called here.
> Therefore, it is safe and necessary to grab the cgroup refcnt
> even when cgroup_sk_alloc is disabled.
>
> sk_clone_lock() is in BH context anyway, the in_interrupt()
> would terminate this function if called there. And for sk_alloc()
> skcd->val is always zero. So it's safe to factor out the code
> to make it more readable.
>
> The global variable 'cgroup_sk_alloc_disabled' is used to determine
> whether to take these reference counts. It is impossible to make
> the reference counting correct unless we save this bit of information
> in skcd->val. So, add a new bit there to record whether the socket
> has already taken the reference counts. This obviously relies on
> kmalloc() to align cgroup pointers to at least 4 bytes,
> ARCH_KMALLOC_MINALIGN is certainly larger than that.
>
> This bug seems to be introduced since the beginning, commit
> d979a39d7242 ("cgroup: duplicate cgroup reference when cloning sockets")
> tried to fix it but not compeletely. It seems not easy to trigger until
> the recent commit 090e28b229af
> ("netprio_cgroup: Fix unlimited memory leak of v2 cgroups") was merged.
>
> Fixes: bd1060a1d671 ("sock, cgroup: add sock->sk_cgroup")
> Reported-by: Cameron Berkenpas <cam@neo-zeon.de>
> Reported-by: Peter Geis <pgwipeout@gmail.com>
> Reported-by: Lu Fengqi <lufq.fnst@cn.fujitsu.com>
> Reported-by: Daniël Sonck <dsonck92@gmail.com>
> Reported-by: Zhang Qiang <qiang.zhang@windriver.com>
> Tested-by: Cameron Berkenpas <cam@neo-zeon.de>
> Tested-by: Peter Geis <pgwipeout@gmail.com>
> Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
> Cc: Daniel Borkmann <daniel@iogearbox.net>
> Cc: Zefan Li <lizefan@huawei.com>
> Cc: Tejun Heo <tj@kernel.org>
> Cc: Roman Gushchin <guro@fb.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> include/linux/cgroup-defs.h | 6 ++++--
> include/linux/cgroup.h | 4 +++-
> kernel/cgroup/cgroup.c | 31 +++++++++++++++++++------------
> net/core/sock.c | 2 +-
> 4 files changed, 27 insertions(+), 16 deletions(-)
>
> --- a/include/linux/cgroup-defs.h
> +++ b/include/linux/cgroup-defs.h
> @@ -790,7 +790,8 @@ struct sock_cgroup_data {
> union {
> #ifdef __LITTLE_ENDIAN
> struct {
> - u8 is_data;
> + u8 is_data : 1;
> + u8 no_refcnt : 1;
> u8 padding;
> u16 prioidx;
> u32 classid;
> @@ -800,7 +801,8 @@ struct sock_cgroup_data {
> u32 classid;
> u16 prioidx;
> u8 padding;
> - u8 is_data;
> + u8 no_refcnt : 1;
> + u8 is_data : 1;
> } __packed;
> #endif
> u64 val;
> --- a/include/linux/cgroup.h
> +++ b/include/linux/cgroup.h
> @@ -822,6 +822,7 @@ extern spinlock_t cgroup_sk_update_lock;
>
> void cgroup_sk_alloc_disable(void);
> void cgroup_sk_alloc(struct sock_cgroup_data *skcd);
> +void cgroup_sk_clone(struct sock_cgroup_data *skcd);
> void cgroup_sk_free(struct sock_cgroup_data *skcd);
>
> static inline struct cgroup *sock_cgroup_ptr(struct sock_cgroup_data *skcd)
> @@ -835,7 +836,7 @@ static inline struct cgroup *sock_cgroup
> */
> v = READ_ONCE(skcd->val);
>
> - if (v & 1)
> + if (v & 3)
> return &cgrp_dfl_root.cgrp;
>
> return (struct cgroup *)(unsigned long)v ?: &cgrp_dfl_root.cgrp;
> @@ -847,6 +848,7 @@ static inline struct cgroup *sock_cgroup
> #else /* CONFIG_CGROUP_DATA */
>
> static inline void cgroup_sk_alloc(struct sock_cgroup_data *skcd) {}
> +static inline void cgroup_sk_clone(struct sock_cgroup_data *skcd) {}
> static inline void cgroup_sk_free(struct sock_cgroup_data *skcd) {}
>
> #endif /* CONFIG_CGROUP_DATA */
> --- a/kernel/cgroup/cgroup.c
> +++ b/kernel/cgroup/cgroup.c
> @@ -6447,18 +6447,8 @@ void cgroup_sk_alloc_disable(void)
>
> void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
> {
> - if (cgroup_sk_alloc_disabled)
> - return;
> -
> - /* Socket clone path */
> - if (skcd->val) {
> - /*
> - * We might be cloning a socket which is left in an empty
> - * cgroup and the cgroup might have already been rmdir'd.
> - * Don't use cgroup_get_live().
> - */
> - cgroup_get(sock_cgroup_ptr(skcd));
> - cgroup_bpf_get(sock_cgroup_ptr(skcd));
> + if (cgroup_sk_alloc_disabled) {
> + skcd->no_refcnt = 1;
> return;
> }
>
> @@ -6483,10 +6473,27 @@ void cgroup_sk_alloc(struct sock_cgroup_
> rcu_read_unlock();
> }
>
> +void cgroup_sk_clone(struct sock_cgroup_data *skcd)
> +{
> + if (skcd->val) {
> + if (skcd->no_refcnt)
> + return;
> + /*
> + * We might be cloning a socket which is left in an empty
> + * cgroup and the cgroup might have already been rmdir'd.
> + * Don't use cgroup_get_live().
> + */
> + cgroup_get(sock_cgroup_ptr(skcd));
> + cgroup_bpf_get(sock_cgroup_ptr(skcd));
> + }
> +}
> +
> void cgroup_sk_free(struct sock_cgroup_data *skcd)
> {
> struct cgroup *cgrp = sock_cgroup_ptr(skcd);
>
> + if (skcd->no_refcnt)
> + return;
> cgroup_bpf_put(cgrp);
> cgroup_put(cgrp);
> }
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -1837,7 +1837,7 @@ struct sock *sk_clone_lock(const struct
> /* sk->sk_memcg will be populated at accept() time */
> newsk->sk_memcg = NULL;
>
> - cgroup_sk_alloc(&newsk->sk_cgrp_data);
> + cgroup_sk_clone(&newsk->sk_cgrp_data);
>
> rcu_read_lock();
> filter = rcu_dereference(sk->sk_filter);
>
>
^ permalink raw reply [flat|nested] 256+ messages in thread* Re: [PATCH 5.7 021/244] cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
2020-07-20 16:46 ` Roman Gushchin
@ 2020-07-20 19:15 ` Greg Kroah-Hartman
0 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 19:15 UTC (permalink / raw)
To: Roman Gushchin
Cc: linux-kernel, stable, Cameron Berkenpas, Peter Geis, Lu Fengqi,
Daniël Sonck, Zhang Qiang, Thomas Lamprecht,
Daniel Borkmann, Zefan Li, Tejun Heo, Cong Wang, David S. Miller
On Mon, Jul 20, 2020 at 09:46:10AM -0700, Roman Gushchin wrote:
> On Mon, Jul 20, 2020 at 05:34:52PM +0200, Greg Kroah-Hartman wrote:
> > From: Cong Wang <xiyou.wangcong@gmail.com>
> >
> > [ Upstream commit ad0f75e5f57ccbceec13274e1e242f2b5a6397ed ]
>
> Hi Greg!
>
> There is a fix for this commit:
> 14b032b8f8fc ("cgroup: Fix sock_cgroup_data on big-endian.")
>
> Can you, please, grab it too?
It is already queued up in this series :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 256+ messages in thread
* [PATCH 5.7 022/244] cgroup: Fix sock_cgroup_data on big-endian.
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 021/244] cgroup: fix cgroup_sk_alloc() for sk_clone_lock() Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 023/244] net: ipa: always check for stopped channel Greg Kroah-Hartman
` (222 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Guenter Roeck, David S. Miller
From: Cong Wang <xiyou.wangcong@gmail.com>
[ Upstream commit 14b032b8f8fce03a546dcf365454bec8c4a58d7d ]
In order for no_refcnt and is_data to be the lowest order two
bits in the 'val' we have to pad out the bitfield of the u8.
Fixes: ad0f75e5f57c ("cgroup: fix cgroup_sk_alloc() for sk_clone_lock()")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/cgroup-defs.h | 2 ++
1 file changed, 2 insertions(+)
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -792,6 +792,7 @@ struct sock_cgroup_data {
struct {
u8 is_data : 1;
u8 no_refcnt : 1;
+ u8 unused : 6;
u8 padding;
u16 prioidx;
u32 classid;
@@ -801,6 +802,7 @@ struct sock_cgroup_data {
u32 classid;
u16 prioidx;
u8 padding;
+ u8 unused : 6;
u8 no_refcnt : 1;
u8 is_data : 1;
} __packed;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 023/244] net: ipa: always check for stopped channel
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 022/244] cgroup: Fix sock_cgroup_data on big-endian Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 024/244] net: ipa: introduce ipa_cmd_tag_process() Greg Kroah-Hartman
` (221 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Elder, David S. Miller
From: Alex Elder <elder@linaro.org>
[ Upstream commit 5468cbcddf47f674829c6ada190283108a63d7b5 ]
In gsi_channel_stop(), there's a check to see if the channel might
have entered STOPPED state since a previous call, which might have
timed out before stopping completed.
That check actually belongs in gsi_channel_stop_command(), which is
called repeatedly by gsi_channel_stop() for RX channels.
Fixes: 650d1603825d ("soc: qcom: ipa: the generic software interface")
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ipa/gsi.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/drivers/net/ipa/gsi.c
+++ b/drivers/net/ipa/gsi.c
@@ -490,6 +490,12 @@ static int gsi_channel_stop_command(stru
enum gsi_channel_state state = channel->state;
int ret;
+ /* Channel could have entered STOPPED state since last call
+ * if it timed out. If so, we're done.
+ */
+ if (state == GSI_CHANNEL_STATE_STOPPED)
+ return 0;
+
if (state != GSI_CHANNEL_STATE_STARTED &&
state != GSI_CHANNEL_STATE_STOP_IN_PROC)
return -EINVAL;
@@ -773,13 +779,6 @@ int gsi_channel_stop(struct gsi *gsi, u3
gsi_channel_freeze(channel);
- /* Channel could have entered STOPPED state since last call if the
- * STOP command timed out. We won't stop a channel if stopping it
- * was successful previously (so we still want the freeze above).
- */
- if (channel->state == GSI_CHANNEL_STATE_STOPPED)
- return 0;
-
/* RX channels might require a little time to enter STOPPED state */
retries = channel->toward_ipa ? 0 : GSI_CHANNEL_STOP_RX_RETRIES;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 024/244] net: ipa: introduce ipa_cmd_tag_process()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 023/244] net: ipa: always check for stopped channel Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 025/244] ip: Fix SO_MARK in RST, ACK and ICMP packets Greg Kroah-Hartman
` (220 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Elder, David S. Miller
From: Alex Elder <elder@linaro.org>
[ Upstream commit 6cb63ea6a39eac9640d109f274a237b34350c183 ]
Create a new function ipa_cmd_tag_process() that simply allocates a
transaction, adds a tag process command to it to clear the hardware
pipeline, and commits the transaction.
Call it in from ipa_endpoint_suspend(), after suspending the modem
endpoints but before suspending the AP command TX and AP LAN RX
endpoints (which are used by the tag sequence).
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ipa/ipa_cmd.c | 15 +++++++++++++++
drivers/net/ipa/ipa_cmd.h | 8 ++++++++
drivers/net/ipa/ipa_endpoint.c | 2 ++
3 files changed, 25 insertions(+)
--- a/drivers/net/ipa/ipa_cmd.c
+++ b/drivers/net/ipa/ipa_cmd.c
@@ -645,6 +645,21 @@ u32 ipa_cmd_tag_process_count(void)
return 4;
}
+void ipa_cmd_tag_process(struct ipa *ipa)
+{
+ u32 count = ipa_cmd_tag_process_count();
+ struct gsi_trans *trans;
+
+ trans = ipa_cmd_trans_alloc(ipa, count);
+ if (trans) {
+ ipa_cmd_tag_process_add(trans);
+ gsi_trans_commit_wait(trans);
+ } else {
+ dev_err(&ipa->pdev->dev,
+ "error allocating %u entry tag transaction\n", count);
+ }
+}
+
static struct ipa_cmd_info *
ipa_cmd_info_alloc(struct ipa_endpoint *endpoint, u32 tre_count)
{
--- a/drivers/net/ipa/ipa_cmd.h
+++ b/drivers/net/ipa/ipa_cmd.h
@@ -183,6 +183,14 @@ void ipa_cmd_tag_process_add(struct gsi_
u32 ipa_cmd_tag_process_count(void);
/**
+ * ipa_cmd_tag_process() - Perform a tag process
+ *
+ * @Return: The number of elements to allocate in a transaction
+ * to hold tag process commands
+ */
+void ipa_cmd_tag_process(struct ipa *ipa);
+
+/**
* ipa_cmd_trans_alloc() - Allocate a transaction for the command TX endpoint
* @ipa: IPA pointer
* @tre_count: Number of elements in the transaction
--- a/drivers/net/ipa/ipa_endpoint.c
+++ b/drivers/net/ipa/ipa_endpoint.c
@@ -1485,6 +1485,8 @@ void ipa_endpoint_suspend(struct ipa *ip
if (ipa->modem_netdev)
ipa_modem_suspend(ipa->modem_netdev);
+ ipa_cmd_tag_process(ipa);
+
ipa_endpoint_suspend_one(ipa->name_map[IPA_ENDPOINT_AP_LAN_RX]);
ipa_endpoint_suspend_one(ipa->name_map[IPA_ENDPOINT_AP_COMMAND_TX]);
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 025/244] ip: Fix SO_MARK in RST, ACK and ICMP packets
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 024/244] net: ipa: introduce ipa_cmd_tag_process() Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 026/244] genetlink: get rid of family->attrbuf Greg Kroah-Hartman
` (219 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Willem de Bruijn, Martin KaFai Lau,
David S. Miller
From: Willem de Bruijn <willemb@google.com>
[ Upstream commit 0da7536fb47f51df89ccfcb1fa09f249d9accec5 ]
When no full socket is available, skbs are sent over a per-netns
control socket. Its sk_mark is temporarily adjusted to match that
of the real (request or timewait) socket or to reflect an incoming
skb, so that the outgoing skb inherits this in __ip_make_skb.
Introduction of the socket cookie mark field broke this. Now the
skb is set through the cookie and cork:
<caller> # init sockc.mark from sk_mark or cmsg
ip_append_data
ip_setup_cork # convert sockc.mark to cork mark
ip_push_pending_frames
ip_finish_skb
__ip_make_skb # set skb->mark to cork mark
But I missed these special control sockets. Update all callers of
__ip(6)_make_skb that were originally missed.
For IPv6, the same two icmp(v6) paths are affected. The third
case is not, as commit 92e55f412cff ("tcp: don't annotate
mark on control socket from tcp_v6_send_response()") replaced
the ctl_sk->sk_mark with passing the mark field directly as a
function argument. That commit predates the commit that
introduced the bug.
Fixes: c6af0c227a22 ("ip: support SO_MARK cmsg")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Reported-by: Martin KaFai Lau <kafai@fb.com>
Reviewed-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/icmp.c | 4 ++--
net/ipv4/ip_output.c | 2 +-
net/ipv6/icmp.c | 4 ++--
3 files changed, 5 insertions(+), 5 deletions(-)
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -427,7 +427,7 @@ static void icmp_reply(struct icmp_bxm *
ipcm_init(&ipc);
inet->tos = ip_hdr(skb)->tos;
- sk->sk_mark = mark;
+ ipc.sockc.mark = mark;
daddr = ipc.addr = ip_hdr(skb)->saddr;
saddr = fib_compute_spec_dst(skb);
@@ -710,10 +710,10 @@ void __icmp_send(struct sk_buff *skb_in,
icmp_param.skb = skb_in;
icmp_param.offset = skb_network_offset(skb_in);
inet_sk(sk)->tos = tos;
- sk->sk_mark = mark;
ipcm_init(&ipc);
ipc.addr = iph->saddr;
ipc.opt = &icmp_param.replyopts.opt;
+ ipc.sockc.mark = mark;
rt = icmp_route_lookup(net, &fl4, skb_in, iph, saddr, tos, mark,
type, code, &icmp_param);
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1702,7 +1702,7 @@ void ip_send_unicast_reply(struct sock *
sk->sk_protocol = ip_hdr(skb)->protocol;
sk->sk_bound_dev_if = arg->bound_dev_if;
sk->sk_sndbuf = sysctl_wmem_default;
- sk->sk_mark = fl4.flowi4_mark;
+ ipc.sockc.mark = fl4.flowi4_mark;
err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,
len, 0, &ipc, &rt, MSG_DONTWAIT);
if (unlikely(err)) {
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -566,7 +566,6 @@ static void icmp6_send(struct sk_buff *s
fl6.mp_hash = rt6_multipath_hash(net, &fl6, skb, NULL);
security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
- sk->sk_mark = mark;
np = inet6_sk(sk);
if (!icmpv6_xrlim_allow(sk, type, &fl6))
@@ -583,6 +582,7 @@ static void icmp6_send(struct sk_buff *s
fl6.flowi6_oif = np->ucast_oif;
ipcm6_init_sk(&ipc6, np);
+ ipc6.sockc.mark = mark;
fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
dst = icmpv6_route_lookup(net, skb, sk, &fl6);
@@ -751,7 +751,6 @@ static void icmpv6_echo_reply(struct sk_
sk = icmpv6_xmit_lock(net);
if (!sk)
goto out_bh_enable;
- sk->sk_mark = mark;
np = inet6_sk(sk);
if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
@@ -779,6 +778,7 @@ static void icmpv6_echo_reply(struct sk_
ipcm6_init_sk(&ipc6, np);
ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
ipc6.tclass = ipv6_get_dsfield(ipv6_hdr(skb));
+ ipc6.sockc.mark = mark;
if (ip6_append_data(sk, icmpv6_getfrag, &msg,
skb->len + sizeof(struct icmp6hdr),
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 026/244] genetlink: get rid of family->attrbuf
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 025/244] ip: Fix SO_MARK in RST, ACK and ICMP packets Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 027/244] net: ipv4: Fix wrong type conversion from hint to rt in ip_route_use_hint() Greg Kroah-Hartman
` (218 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiri Pirko, Cong Wang,
David S. Miller, syzbot+3039ddf6d7b13daf3787,
syzbot+80cad1e3cb4c41cde6ff, syzbot+736bcbcb11b60d0c0792,
syzbot+520f8704db2b68091d44, syzbot+c96e4dfb32f8987fdeed
From: Cong Wang <xiyou.wangcong@gmail.com>
[ Upstream commit bf64ff4c2aac65d680dc639a511c781cf6b6ec08 ]
genl_family_rcv_msg_attrs_parse() reuses the global family->attrbuf
when family->parallel_ops is false. However, family->attrbuf is not
protected by any lock on the genl_family_rcv_msg_doit() code path.
This leads to several different consequences, one of them is UAF,
like the following:
genl_family_rcv_msg_doit(): genl_start():
genl_family_rcv_msg_attrs_parse()
attrbuf = family->attrbuf
__nlmsg_parse(attrbuf);
genl_family_rcv_msg_attrs_parse()
attrbuf = family->attrbuf
__nlmsg_parse(attrbuf);
info->attrs = attrs;
cb->data = info;
netlink_unicast_kernel():
consume_skb()
genl_lock_dumpit():
genl_dumpit_info(cb)->attrs
Note family->attrbuf is an array of pointers to the skb data, once
the skb is freed, any dereference of family->attrbuf will be a UAF.
Maybe we could serialize the family->attrbuf with genl_mutex too, but
that would make the locking more complicated. Instead, we can just get
rid of family->attrbuf and always allocate attrbuf from heap like the
family->parallel_ops==true code path. This may add some performance
overhead but comparing with taking the global genl_mutex, it still
looks better.
Fixes: 75cdbdd08900 ("net: ieee802154: have genetlink code to parse the attrs during dumpit")
Fixes: 057af7071344 ("net: tipc: have genetlink code to parse the attrs during dumpit")
Reported-and-tested-by: syzbot+3039ddf6d7b13daf3787@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+80cad1e3cb4c41cde6ff@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+736bcbcb11b60d0c0792@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+520f8704db2b68091d44@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+c96e4dfb32f8987fdeed@syzkaller.appspotmail.com
Cc: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/genetlink.h | 2 --
net/netlink/genetlink.c | 48 +++++++++++++-----------------------------------
2 files changed, 13 insertions(+), 37 deletions(-)
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -35,7 +35,6 @@ struct genl_info;
* do additional, common, filtering and return an error
* @post_doit: called after an operation's doit callback, it may
* undo operations done by pre_doit, for example release locks
- * @attrbuf: buffer to store parsed attributes (private)
* @mcgrps: multicast groups used by this family
* @n_mcgrps: number of multicast groups
* @mcgrp_offset: starting number of multicast group IDs in this family
@@ -58,7 +57,6 @@ struct genl_family {
void (*post_doit)(const struct genl_ops *ops,
struct sk_buff *skb,
struct genl_info *info);
- struct nlattr ** attrbuf; /* private */
const struct genl_ops * ops;
const struct genl_multicast_group *mcgrps;
unsigned int n_ops;
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -351,22 +351,11 @@ int genl_register_family(struct genl_fam
start = end = GENL_ID_VFS_DQUOT;
}
- if (family->maxattr && !family->parallel_ops) {
- family->attrbuf = kmalloc_array(family->maxattr + 1,
- sizeof(struct nlattr *),
- GFP_KERNEL);
- if (family->attrbuf == NULL) {
- err = -ENOMEM;
- goto errout_locked;
- }
- } else
- family->attrbuf = NULL;
-
family->id = idr_alloc_cyclic(&genl_fam_idr, family,
start, end + 1, GFP_KERNEL);
if (family->id < 0) {
err = family->id;
- goto errout_free;
+ goto errout_locked;
}
err = genl_validate_assign_mc_groups(family);
@@ -385,8 +374,6 @@ int genl_register_family(struct genl_fam
errout_remove:
idr_remove(&genl_fam_idr, family->id);
-errout_free:
- kfree(family->attrbuf);
errout_locked:
genl_unlock_all();
return err;
@@ -419,8 +406,6 @@ int genl_unregister_family(const struct
atomic_read(&genl_sk_destructing_cnt) == 0);
genl_unlock();
- kfree(family->attrbuf);
-
genl_ctrl_event(CTRL_CMD_DELFAMILY, family, NULL, 0);
return 0;
@@ -485,30 +470,23 @@ genl_family_rcv_msg_attrs_parse(const st
if (!family->maxattr)
return NULL;
- if (family->parallel_ops) {
- attrbuf = kmalloc_array(family->maxattr + 1,
- sizeof(struct nlattr *), GFP_KERNEL);
- if (!attrbuf)
- return ERR_PTR(-ENOMEM);
- } else {
- attrbuf = family->attrbuf;
- }
+ attrbuf = kmalloc_array(family->maxattr + 1,
+ sizeof(struct nlattr *), GFP_KERNEL);
+ if (!attrbuf)
+ return ERR_PTR(-ENOMEM);
err = __nlmsg_parse(nlh, hdrlen, attrbuf, family->maxattr,
family->policy, validate, extack);
if (err) {
- if (family->parallel_ops)
- kfree(attrbuf);
+ kfree(attrbuf);
return ERR_PTR(err);
}
return attrbuf;
}
-static void genl_family_rcv_msg_attrs_free(const struct genl_family *family,
- struct nlattr **attrbuf)
+static void genl_family_rcv_msg_attrs_free(struct nlattr **attrbuf)
{
- if (family->parallel_ops)
- kfree(attrbuf);
+ kfree(attrbuf);
}
struct genl_start_context {
@@ -542,7 +520,7 @@ static int genl_start(struct netlink_cal
no_attrs:
info = genl_dumpit_info_alloc();
if (!info) {
- genl_family_rcv_msg_attrs_free(ctx->family, attrs);
+ genl_family_rcv_msg_attrs_free(attrs);
return -ENOMEM;
}
info->family = ctx->family;
@@ -559,7 +537,7 @@ no_attrs:
}
if (rc) {
- genl_family_rcv_msg_attrs_free(info->family, info->attrs);
+ genl_family_rcv_msg_attrs_free(info->attrs);
genl_dumpit_info_free(info);
cb->data = NULL;
}
@@ -588,7 +566,7 @@ static int genl_lock_done(struct netlink
rc = ops->done(cb);
genl_unlock();
}
- genl_family_rcv_msg_attrs_free(info->family, info->attrs);
+ genl_family_rcv_msg_attrs_free(info->attrs);
genl_dumpit_info_free(info);
return rc;
}
@@ -601,7 +579,7 @@ static int genl_parallel_done(struct net
if (ops->done)
rc = ops->done(cb);
- genl_family_rcv_msg_attrs_free(info->family, info->attrs);
+ genl_family_rcv_msg_attrs_free(info->attrs);
genl_dumpit_info_free(info);
return rc;
}
@@ -694,7 +672,7 @@ static int genl_family_rcv_msg_doit(cons
family->post_doit(ops, skb, &info);
out:
- genl_family_rcv_msg_attrs_free(family, attrbuf);
+ genl_family_rcv_msg_attrs_free(attrbuf);
return err;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 027/244] net: ipv4: Fix wrong type conversion from hint to rt in ip_route_use_hint()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 026/244] genetlink: get rid of family->attrbuf Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:34 ` [PATCH 5.7 028/244] ethtool: fix genlmsg_put() failure handling in ethnl_default_dumpit() Greg Kroah-Hartman
` (217 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miaohe Lin, David S. Miller
From: Miaohe Lin <linmiaohe@huawei.com>
[ Upstream commit 2ce578ca9444bb44da66b9a494f56e7ec12e6466 ]
We can't cast sk_buff to rtable by (struct rtable *)hint. Use skb_rtable().
Fixes: 02b24941619f ("ipv4: use dst hint for ipv4 list receive")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/route.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2027,7 +2027,7 @@ int ip_route_use_hint(struct sk_buff *sk
const struct sk_buff *hint)
{
struct in_device *in_dev = __in_dev_get_rcu(dev);
- struct rtable *rt = (struct rtable *)hint;
+ struct rtable *rt = skb_rtable(hint);
struct net *net = dev_net(dev);
int err = -EINVAL;
u32 tag = 0;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 028/244] ethtool: fix genlmsg_put() failure handling in ethnl_default_dumpit()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 027/244] net: ipv4: Fix wrong type conversion from hint to rt in ip_route_use_hint() Greg Kroah-Hartman
@ 2020-07-20 15:34 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 029/244] mptcp: fix DSS map generation on fin retransmission Greg Kroah-Hartman
` (216 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Michal Kubecek,
David S. Miller
From: Michal Kubecek <mkubecek@suse.cz>
[ Upstream commit 365f9ae4ee36037e2a9268fe7296065356840b4c ]
If the genlmsg_put() call in ethnl_default_dumpit() fails, we bail out
without checking if we already have some messages in current skb like we do
with ethnl_default_dump_one() failure later. Therefore if existing messages
almost fill up the buffer so that there is not enough space even for
netlink and genetlink header, we lose all prepared messages and return and
error.
Rather than duplicating the skb->len check, move the genlmsg_put(),
genlmsg_cancel() and genlmsg_end() calls into ethnl_default_dump_one().
This is also more logical as all message composition will be in
ethnl_default_dump_one() and only iteration logic will be left in
ethnl_default_dumpit().
Fixes: 728480f12442 ("ethtool: default handlers for GET requests")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ethtool/netlink.c | 27 +++++++++++++--------------
1 file changed, 13 insertions(+), 14 deletions(-)
--- a/net/ethtool/netlink.c
+++ b/net/ethtool/netlink.c
@@ -376,10 +376,17 @@ err_dev:
}
static int ethnl_default_dump_one(struct sk_buff *skb, struct net_device *dev,
- const struct ethnl_dump_ctx *ctx)
+ const struct ethnl_dump_ctx *ctx,
+ struct netlink_callback *cb)
{
+ void *ehdr;
int ret;
+ ehdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
+ ðtool_genl_family, 0, ctx->ops->reply_cmd);
+ if (!ehdr)
+ return -EMSGSIZE;
+
ethnl_init_reply_data(ctx->reply_data, ctx->ops, dev);
rtnl_lock();
ret = ctx->ops->prepare_data(ctx->req_info, ctx->reply_data, NULL);
@@ -395,6 +402,10 @@ out:
if (ctx->ops->cleanup_data)
ctx->ops->cleanup_data(ctx->reply_data);
ctx->reply_data->dev = NULL;
+ if (ret < 0)
+ genlmsg_cancel(skb, ehdr);
+ else
+ genlmsg_end(skb, ehdr);
return ret;
}
@@ -411,7 +422,6 @@ static int ethnl_default_dumpit(struct s
int s_idx = ctx->pos_idx;
int h, idx = 0;
int ret = 0;
- void *ehdr;
rtnl_lock();
for (h = ctx->pos_hash; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
@@ -431,26 +441,15 @@ restart_chain:
dev_hold(dev);
rtnl_unlock();
- ehdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
- cb->nlh->nlmsg_seq,
- ðtool_genl_family, 0,
- ctx->ops->reply_cmd);
- if (!ehdr) {
- dev_put(dev);
- ret = -EMSGSIZE;
- goto out;
- }
- ret = ethnl_default_dump_one(skb, dev, ctx);
+ ret = ethnl_default_dump_one(skb, dev, ctx, cb);
dev_put(dev);
if (ret < 0) {
- genlmsg_cancel(skb, ehdr);
if (ret == -EOPNOTSUPP)
goto lock_and_cont;
if (likely(skb->len))
ret = skb->len;
goto out;
}
- genlmsg_end(skb, ehdr);
lock_and_cont:
rtnl_lock();
if (net->dev_base_seq != seq) {
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 029/244] mptcp: fix DSS map generation on fin retransmission
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2020-07-20 15:34 ` [PATCH 5.7 028/244] ethtool: fix genlmsg_put() failure handling in ethnl_default_dumpit() Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 030/244] net: rmnet: do not allow to add multiple bridge interfaces Greg Kroah-Hartman
` (215 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+42a07faa5923cfaeb9c9,
Christoph Paasch, Mat Martineau, Paolo Abeni, David S. Miller
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 9c29e36152748fd623fcff6cc8f538550f9eeafc ]
The RFC 8684 mandates that no-data DATA FIN packets should carry
a DSS with 0 sequence number and data len equal to 1. Currently,
on FIN retransmission we re-use the existing mapping; if the previous
fin transmission was part of a partially acked data packet, we could
end-up writing in the egress packet a non-compliant DSS.
The above will be detected by a "Bad mapping" warning on the receiver
side.
This change addresses the issue explicitly checking for 0 len packet
when adding the DATA_FIN option.
Fixes: 6d0060f600ad ("mptcp: Write MPTCP DSS headers to outgoing data packets")
Reported-by: syzbot+42a07faa5923cfaeb9c9@syzkaller.appspotmail.com
Tested-by: Christoph Paasch <cpaasch@apple.com>
Reviewed-by: Christoph Paasch <cpaasch@apple.com>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/options.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -449,9 +449,9 @@ static bool mptcp_established_options_mp
}
static void mptcp_write_data_fin(struct mptcp_subflow_context *subflow,
- struct mptcp_ext *ext)
+ struct sk_buff *skb, struct mptcp_ext *ext)
{
- if (!ext->use_map) {
+ if (!ext->use_map || !skb->len) {
/* RFC6824 requires a DSS mapping with specific values
* if DATA_FIN is set but no data payload is mapped
*/
@@ -503,7 +503,7 @@ static bool mptcp_established_options_ds
opts->ext_copy = *mpext;
if (skb && tcp_fin && subflow->data_fin_tx_enable)
- mptcp_write_data_fin(subflow, &opts->ext_copy);
+ mptcp_write_data_fin(subflow, skb, &opts->ext_copy);
ret = true;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 030/244] net: rmnet: do not allow to add multiple bridge interfaces
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 029/244] mptcp: fix DSS map generation on fin retransmission Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 031/244] hsr: fix interface leak in error path of hsr_dev_finalize() Greg Kroah-Hartman
` (214 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Taehee Yoo, David S. Miller
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 2fb2799a2abb39d7dbb48abb3baa1133bf5e921a ]
rmnet can have only two bridge interface.
One of them is a link interface and another one is added by
the master operation.
rmnet interface shouldn't allow adding additional
bridge interfaces by mater operation.
But, there is no code to deny additional interfaces.
So, interface leak occurs.
Test commands:
ip link add dummy0 type dummy
ip link add dummy1 type dummy
ip link add dummy2 type dummy
ip link add rmnet0 link dummy0 type rmnet mux_id 1
ip link set dummy1 master rmnet0
ip link set dummy2 master rmnet0
ip link del rmnet0
In the above test command, the dummy0 was attached to rmnet as VND mode.
Then, dummy1 was attached to rmnet0 as BRIDGE mode.
At this point, dummy0 mode is switched from VND to BRIDGE automatically.
Then, dummy2 is attached to rmnet as BRIDGE mode.
At this point, rmnet0 should deny this operation.
But, rmnet0 doesn't deny this.
So that below splat occurs when the rmnet0 interface is deleted.
Splat looks like:
[ 186.684787][ C2] WARNING: CPU: 2 PID: 1009 at net/core/dev.c:8992 rollback_registered_many+0x986/0xcf0
[ 186.684788][ C2] Modules linked in: rmnet dummy openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_x
[ 186.684805][ C2] CPU: 2 PID: 1009 Comm: ip Not tainted 5.8.0-rc1+ #621
[ 186.684807][ C2] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[ 186.684808][ C2] RIP: 0010:rollback_registered_many+0x986/0xcf0
[ 186.684811][ C2] Code: 41 8b 4e cc 45 31 c0 31 d2 4c 89 ee 48 89 df e8 e0 47 ff ff 85 c0 0f 84 cd fc ff ff 5
[ 186.684812][ C2] RSP: 0018:ffff8880cd9472e0 EFLAGS: 00010287
[ 186.684815][ C2] RAX: ffff8880cc56da58 RBX: ffff8880ab21c000 RCX: ffffffff9329d323
[ 186.684816][ C2] RDX: 1ffffffff2be6410 RSI: 0000000000000008 RDI: ffffffff95f32080
[ 186.684818][ C2] RBP: dffffc0000000000 R08: fffffbfff2be6411 R09: fffffbfff2be6411
[ 186.684819][ C2] R10: ffffffff95f32087 R11: 0000000000000001 R12: ffff8880cd947480
[ 186.684820][ C2] R13: ffff8880ab21c0b8 R14: ffff8880cd947400 R15: ffff8880cdf10640
[ 186.684822][ C2] FS: 00007f00843890c0(0000) GS:ffff8880d4e00000(0000) knlGS:0000000000000000
[ 186.684823][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 186.684825][ C2] CR2: 000055b8ab1077b8 CR3: 00000000ab612006 CR4: 00000000000606e0
[ 186.684826][ C2] Call Trace:
[ 186.684827][ C2] ? lockdep_hardirqs_on_prepare+0x379/0x540
[ 186.684829][ C2] ? netif_set_real_num_tx_queues+0x780/0x780
[ 186.684830][ C2] ? rmnet_unregister_real_device+0x56/0x90 [rmnet]
[ 186.684831][ C2] ? __kasan_slab_free+0x126/0x150
[ 186.684832][ C2] ? kfree+0xdc/0x320
[ 186.684834][ C2] ? rmnet_unregister_real_device+0x56/0x90 [rmnet]
[ 186.684835][ C2] unregister_netdevice_many.part.135+0x13/0x1b0
[ 186.684836][ C2] rtnl_delete_link+0xbc/0x100
[ ... ]
[ 238.440071][ T1009] unregister_netdevice: waiting for rmnet0 to become free. Usage count = 1
Fixes: 037f9cdf72fb ("net: rmnet: use upper/lower device infrastructure")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -434,6 +434,11 @@ int rmnet_add_bridge(struct net_device *
return -EINVAL;
}
+ if (port->rmnet_mode != RMNET_EPMODE_VND) {
+ NL_SET_ERR_MSG_MOD(extack, "more than one bridge dev attached");
+ return -EINVAL;
+ }
+
if (rmnet_is_real_dev_registered(slave_dev)) {
NL_SET_ERR_MSG_MOD(extack,
"slave cannot be another rmnet dev");
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 031/244] hsr: fix interface leak in error path of hsr_dev_finalize()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 030/244] net: rmnet: do not allow to add multiple bridge interfaces Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 032/244] drm/msm: fix potential memleak in error branch Greg Kroah-Hartman
` (213 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+7f1c020f68dab95aab59,
Taehee Yoo, David S. Miller
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit ccfc9df1352be5b2f391091e18c4b2395d30ce78 ]
To release hsr(upper) interface, it should release
its own lower interfaces first.
Then, hsr(upper) interface can be released safely.
In the current code of error path of hsr_dev_finalize(), it releases hsr
interface before releasing a lower interface.
So, a warning occurs, which warns about the leak of lower interfaces.
In order to fix this problem, changing the ordering of the error path of
hsr_dev_finalize() is needed.
Test commands:
ip link add dummy0 type dummy
ip link add dummy1 type dummy
ip link add dummy2 type dummy
ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1
ip link add hsr1 type hsr slave1 dummy2 slave2 dummy0
Splat looks like:
[ 214.923127][ C2] WARNING: CPU: 2 PID: 1093 at net/core/dev.c:8992 rollback_registered_many+0x986/0xcf0
[ 214.923129][ C2] Modules linked in: hsr dummy openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipx
[ 214.923154][ C2] CPU: 2 PID: 1093 Comm: ip Not tainted 5.8.0-rc2+ #623
[ 214.923156][ C2] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[ 214.923157][ C2] RIP: 0010:rollback_registered_many+0x986/0xcf0
[ 214.923160][ C2] Code: 41 8b 4e cc 45 31 c0 31 d2 4c 89 ee 48 89 df e8 e0 47 ff ff 85 c0 0f 84 cd fc ff ff 5
[ 214.923162][ C2] RSP: 0018:ffff8880c5156f28 EFLAGS: 00010287
[ 214.923165][ C2] RAX: ffff8880d1dad458 RBX: ffff8880bd1b9000 RCX: ffffffffb929d243
[ 214.923167][ C2] RDX: 1ffffffff77e63f0 RSI: 0000000000000008 RDI: ffffffffbbf31f80
[ 214.923168][ C2] RBP: dffffc0000000000 R08: fffffbfff77e63f1 R09: fffffbfff77e63f1
[ 214.923170][ C2] R10: ffffffffbbf31f87 R11: 0000000000000001 R12: ffff8880c51570a0
[ 214.923172][ C2] R13: ffff8880bd1b90b8 R14: ffff8880c5157048 R15: ffff8880d1dacc40
[ 214.923174][ C2] FS: 00007fdd257a20c0(0000) GS:ffff8880da200000(0000) knlGS:0000000000000000
[ 214.923175][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 214.923177][ C2] CR2: 00007ffd78beb038 CR3: 00000000be544005 CR4: 00000000000606e0
[ 214.923179][ C2] Call Trace:
[ 214.923180][ C2] ? netif_set_real_num_tx_queues+0x780/0x780
[ 214.923182][ C2] ? dev_validate_mtu+0x140/0x140
[ 214.923183][ C2] ? synchronize_rcu.part.79+0x85/0xd0
[ 214.923185][ C2] ? synchronize_rcu_expedited+0xbb0/0xbb0
[ 214.923187][ C2] rollback_registered+0xc8/0x170
[ 214.923188][ C2] ? rollback_registered_many+0xcf0/0xcf0
[ 214.923190][ C2] unregister_netdevice_queue+0x18b/0x240
[ 214.923191][ C2] hsr_dev_finalize+0x56e/0x6e0 [hsr]
[ 214.923192][ C2] hsr_newlink+0x36b/0x450 [hsr]
[ 214.923194][ C2] ? hsr_dellink+0x70/0x70 [hsr]
[ 214.923195][ C2] ? rtnl_create_link+0x2e4/0xb00
[ 214.923197][ C2] ? __netlink_ns_capable+0xc3/0xf0
[ 214.923198][ C2] __rtnl_newlink+0xbdb/0x1270
[ ... ]
Fixes: e0a4b99773d3 ("hsr: use upper/lower device infrastructure")
Reported-by: syzbot+7f1c020f68dab95aab59@syzkaller.appspotmail.com
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/hsr/hsr_device.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -417,6 +417,7 @@ int hsr_dev_finalize(struct net_device *
unsigned char multicast_spec, u8 protocol_version,
struct netlink_ext_ack *extack)
{
+ bool unregister = false;
struct hsr_priv *hsr;
int res;
@@ -468,25 +469,27 @@ int hsr_dev_finalize(struct net_device *
if (res)
goto err_unregister;
+ unregister = true;
+
res = hsr_add_port(hsr, slave[0], HSR_PT_SLAVE_A, extack);
if (res)
- goto err_add_slaves;
+ goto err_unregister;
res = hsr_add_port(hsr, slave[1], HSR_PT_SLAVE_B, extack);
if (res)
- goto err_add_slaves;
+ goto err_unregister;
hsr_debugfs_init(hsr, hsr_dev);
mod_timer(&hsr->prune_timer, jiffies + msecs_to_jiffies(PRUNE_PERIOD));
return 0;
-err_add_slaves:
- unregister_netdevice(hsr_dev);
err_unregister:
hsr_del_ports(hsr);
err_add_master:
hsr_del_self_node(hsr);
+ if (unregister)
+ unregister_netdevice(hsr_dev);
return res;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 032/244] drm/msm: fix potential memleak in error branch
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 031/244] hsr: fix interface leak in error path of hsr_dev_finalize() Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 033/244] drm/msm/dpu: allow initialization of encoder locks during encoder init Greg Kroah-Hartman
` (212 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bernard Zhao, Rob Clark, Sasha Levin
From: Bernard Zhao <bernard@vivo.com>
[ Upstream commit 177d3819633cd520e3f95df541a04644aab4c657 ]
In function msm_submitqueue_create, the queue is a local
variable, in return -EINVAL branch, queue didn`t add to ctx`s
list yet, and also didn`t kfree, this maybe bring in potential
memleak.
Signed-off-by: Bernard Zhao <bernard@vivo.com>
[trivial commit msg fixup]
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_submitqueue.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_submitqueue.c b/drivers/gpu/drm/msm/msm_submitqueue.c
index 001fbf537440a..a1d94be7883a0 100644
--- a/drivers/gpu/drm/msm/msm_submitqueue.c
+++ b/drivers/gpu/drm/msm/msm_submitqueue.c
@@ -71,8 +71,10 @@ int msm_submitqueue_create(struct drm_device *drm, struct msm_file_private *ctx,
queue->flags = flags;
if (priv->gpu) {
- if (prio >= priv->gpu->nr_rings)
+ if (prio >= priv->gpu->nr_rings) {
+ kfree(queue);
return -EINVAL;
+ }
queue->prio = prio;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 033/244] drm/msm/dpu: allow initialization of encoder locks during encoder init
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 032/244] drm/msm: fix potential memleak in error branch Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 034/244] drm/exynos: Properly propagate return value in drm_iommu_attach_device() Greg Kroah-Hartman
` (211 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krishna Manikandan, Rob Clark, Sasha Levin
From: Krishna Manikandan <mkrishn@codeaurora.org>
[ Upstream commit 2e7ec6b5297157efabb50e5f82adc628cf90296c ]
In the current implementation, mutex initialization
for encoder mutex locks are done during encoder
setup. This can lead to scenarios where the lock
is used before it is initialized. Move mutex_init
to dpu_encoder_init to avoid this.
Signed-off-by: Krishna Manikandan <mkrishn@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
index a2f6b688a9768..932dd8c3c4118 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
@@ -2126,7 +2126,6 @@ int dpu_encoder_setup(struct drm_device *dev, struct drm_encoder *enc,
dpu_enc = to_dpu_encoder_virt(enc);
- mutex_init(&dpu_enc->enc_lock);
ret = dpu_encoder_setup_display(dpu_enc, dpu_kms, disp_info);
if (ret)
goto fail;
@@ -2141,7 +2140,6 @@ int dpu_encoder_setup(struct drm_device *dev, struct drm_encoder *enc,
0);
- mutex_init(&dpu_enc->rc_lock);
INIT_DELAYED_WORK(&dpu_enc->delayed_off_work,
dpu_encoder_off_work);
dpu_enc->idle_timeout = IDLE_TIMEOUT;
@@ -2186,6 +2184,8 @@ struct drm_encoder *dpu_encoder_init(struct drm_device *dev,
spin_lock_init(&dpu_enc->enc_spinlock);
dpu_enc->enabled = false;
+ mutex_init(&dpu_enc->enc_lock);
+ mutex_init(&dpu_enc->rc_lock);
return &dpu_enc->base;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 034/244] drm/exynos: Properly propagate return value in drm_iommu_attach_device()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 033/244] drm/msm/dpu: allow initialization of encoder locks during encoder init Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 035/244] drm/exynos: fix ref count leak in mic_pre_enable Greg Kroah-Hartman
` (210 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kbuild test robot, Marek Szyprowski,
Inki Dae, Sasha Levin
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit b9c633882de4601015625f9136f248e9abca8a7a ]
Propagate the proper error codes from the called functions instead of
unconditionally returning 0.
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Merge conflict so merged it manually.
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/exynos/exynos_drm_dma.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c b/drivers/gpu/drm/exynos/exynos_drm_dma.c
index 619f81435c1b2..58b89ec11b0eb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dma.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c
@@ -61,7 +61,7 @@ static int drm_iommu_attach_device(struct drm_device *drm_dev,
struct device *subdrv_dev, void **dma_priv)
{
struct exynos_drm_private *priv = drm_dev->dev_private;
- int ret;
+ int ret = 0;
if (get_dma_ops(priv->dma_dev) != get_dma_ops(subdrv_dev)) {
DRM_DEV_ERROR(subdrv_dev, "Device %s lacks support for IOMMU\n",
@@ -92,7 +92,7 @@ static int drm_iommu_attach_device(struct drm_device *drm_dev,
if (ret)
clear_dma_max_seg_size(subdrv_dev);
- return 0;
+ return ret;
}
/*
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 035/244] drm/exynos: fix ref count leak in mic_pre_enable
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 034/244] drm/exynos: Properly propagate return value in drm_iommu_attach_device() Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 036/244] x86/fpu: Reset MXCSR to default in kernel_fpu_begin() Greg Kroah-Hartman
` (209 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Inki Dae, Sasha Levin
From: Navid Emamdoost <navid.emamdoost@gmail.com>
[ Upstream commit d4f5a095daf0d25f0b385e1ef26338608433a4c5 ]
in mic_pre_enable, pm_runtime_get_sync is called which
increments the counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/exynos/exynos_drm_mic.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_mic.c b/drivers/gpu/drm/exynos/exynos_drm_mic.c
index f41d75923557a..004110c5ded42 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_mic.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_mic.c
@@ -269,8 +269,10 @@ static void mic_pre_enable(struct drm_bridge *bridge)
goto unlock;
ret = pm_runtime_get_sync(mic->dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put_noidle(mic->dev);
goto unlock;
+ }
mic_set_path(mic, 1);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 036/244] x86/fpu: Reset MXCSR to default in kernel_fpu_begin()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 035/244] drm/exynos: fix ref count leak in mic_pre_enable Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 037/244] thermal/drivers: imx: Fix missing of_node_put() at probe time Greg Kroah-Hartman
` (208 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Petteri Aimonen, Borislav Petkov,
Sasha Levin
From: Petteri Aimonen <jpa@git.mail.kapsi.fi>
[ Upstream commit 7ad816762f9bf89e940e618ea40c43138b479e10 ]
Previously, kernel floating point code would run with the MXCSR control
register value last set by userland code by the thread that was active
on the CPU core just before kernel call. This could affect calculation
results if rounding mode was changed, or a crash if a FPU/SIMD exception
was unmasked.
Restore MXCSR to the kernel's default value.
[ bp: Carve out from a bigger patch by Petteri, add feature check, add
FNINIT call too (amluto). ]
Signed-off-by: Petteri Aimonen <jpa@git.mail.kapsi.fi>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=207979
Link: https://lkml.kernel.org/r/20200624114646.28953-2-bp@alien8.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/fpu/internal.h | 5 +++++
arch/x86/kernel/fpu/core.c | 6 ++++++
2 files changed, 11 insertions(+)
diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
index 44c48e34d7994..00eac7f1529b0 100644
--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -619,6 +619,11 @@ static inline void switch_fpu_finish(struct fpu *new_fpu)
* MXCSR and XCR definitions:
*/
+static inline void ldmxcsr(u32 mxcsr)
+{
+ asm volatile("ldmxcsr %0" :: "m" (mxcsr));
+}
+
extern unsigned int mxcsr_feature_mask;
#define XCR_XFEATURE_ENABLED_MASK 0x00000000
diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
index 12c70840980e4..cd8839027f66d 100644
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -101,6 +101,12 @@ void kernel_fpu_begin(void)
copy_fpregs_to_fpstate(¤t->thread.fpu);
}
__cpu_invalidate_fpregs_state();
+
+ if (boot_cpu_has(X86_FEATURE_XMM))
+ ldmxcsr(MXCSR_DEFAULT);
+
+ if (boot_cpu_has(X86_FEATURE_FPU))
+ asm volatile ("fninit");
}
EXPORT_SYMBOL_GPL(kernel_fpu_begin);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 037/244] thermal/drivers: imx: Fix missing of_node_put() at probe time
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 036/244] x86/fpu: Reset MXCSR to default in kernel_fpu_begin() Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 038/244] ACPI: DPTF: Add battery participant for TigerLake Greg Kroah-Hartman
` (207 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anson Huang, Daniel Lezcano, Sasha Levin
From: Anson Huang <Anson.Huang@nxp.com>
[ Upstream commit b45fd13be340e4ed0a2a9673ba299eb2a71ba829 ]
After finishing using cpu node got from of_get_cpu_node(), of_node_put()
needs to be called.
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/1585232945-23368-1-git-send-email-Anson.Huang@nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/imx_thermal.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index e761c9b422179..1b84ea674edb7 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -649,7 +649,7 @@ MODULE_DEVICE_TABLE(of, of_imx_thermal_match);
static int imx_thermal_register_legacy_cooling(struct imx_thermal_data *data)
{
struct device_node *np;
- int ret;
+ int ret = 0;
data->policy = cpufreq_cpu_get(0);
if (!data->policy) {
@@ -664,11 +664,12 @@ static int imx_thermal_register_legacy_cooling(struct imx_thermal_data *data)
if (IS_ERR(data->cdev)) {
ret = PTR_ERR(data->cdev);
cpufreq_cpu_put(data->policy);
- return ret;
}
}
- return 0;
+ of_node_put(np);
+
+ return ret;
}
static void imx_thermal_unregister_legacy_cooling(struct imx_thermal_data *data)
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 038/244] ACPI: DPTF: Add battery participant for TigerLake
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 037/244] thermal/drivers: imx: Fix missing of_node_put() at probe time Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 039/244] blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags Greg Kroah-Hartman
` (206 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Srinivas Pandruvada,
Rafael J. Wysocki, Sasha Levin
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
[ Upstream commit 1e05daca83bb42cde569f75f3bd7c8828b1ef30f ]
Add DPTF battery participant ACPI ID for platforms based on the Intel
TigerLake SoC.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
[ rjw: Changelog ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/dptf/dptf_power.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/acpi/dptf/dptf_power.c b/drivers/acpi/dptf/dptf_power.c
index e4e8b75d39f09..8b42f529047e9 100644
--- a/drivers/acpi/dptf/dptf_power.c
+++ b/drivers/acpi/dptf/dptf_power.c
@@ -99,6 +99,7 @@ static int dptf_power_remove(struct platform_device *pdev)
static const struct acpi_device_id int3407_device_ids[] = {
{"INT3407", 0},
{"INTC1047", 0},
+ {"INTC1050", 0},
{"", 0},
};
MODULE_DEVICE_TABLE(acpi, int3407_device_ids);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 039/244] blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 038/244] ACPI: DPTF: Add battery participant for TigerLake Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 040/244] m68k: nommu: register start of the memory with memblock Greg Kroah-Hartman
` (205 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hou Tao, Bart Van Assche, Jens Axboe,
Sasha Levin
From: Hou Tao <houtao1@huawei.com>
[ Upstream commit bfe373f608cf81b7626dfeb904001b0e867c5110 ]
Else there may be magic numbers in /sys/kernel/debug/block/*/state.
Signed-off-by: Hou Tao <houtao1@huawei.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq-debugfs.c | 3 +++
include/linux/blkdev.h | 1 +
2 files changed, 4 insertions(+)
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index b3f2ba483992d..121f4c1e0697b 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -125,6 +125,9 @@ static const char *const blk_queue_flag_name[] = {
QUEUE_FLAG_NAME(REGISTERED),
QUEUE_FLAG_NAME(SCSI_PASSTHROUGH),
QUEUE_FLAG_NAME(QUIESCED),
+ QUEUE_FLAG_NAME(PCI_P2PDMA),
+ QUEUE_FLAG_NAME(ZONE_RESETALL),
+ QUEUE_FLAG_NAME(RQ_ALLOC_TIME),
};
#undef QUEUE_FLAG_NAME
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 32868fbedc9e9..02809e4dd661e 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -585,6 +585,7 @@ struct request_queue {
u64 write_hints[BLK_MAX_WRITE_HINTS];
};
+/* Keep blk_queue_flag_name[] in sync with the definitions below */
#define QUEUE_FLAG_STOPPED 0 /* queue is stopped */
#define QUEUE_FLAG_DYING 1 /* queue being torn down */
#define QUEUE_FLAG_NOMERGES 3 /* disable merge attempts */
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 040/244] m68k: nommu: register start of the memory with memblock
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 039/244] blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 041/244] m68k: mm: fix node memblock init Greg Kroah-Hartman
` (204 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Rapoport, Greg Ungerer, Sasha Levin
From: Mike Rapoport <rppt@linux.ibm.com>
[ Upstream commit d63bd8c81d8ab64db506ffde569cc8ff197516e2 ]
The m68k nommu setup code didn't register the beginning of the physical
memory with memblock because it was anyway occupied by the kernel. However,
commit fa3354e4ea39 ("mm: free_area_init: use maximal zone PFNs rather than
zone sizes") changed zones initialization to use memblock.memory to detect
the zone extents and this caused inconsistency between zone PFNs and the
actual PFNs:
BUG: Bad page state in process swapper pfn:20165
page:41fe0ca0 refcount:0 mapcount:1 mapping:00000000 index:0x0 flags: 0x0()
raw: 00000000 00000100 00000122 00000000 00000000 00000000 00000000 00000000
page dumped because: nonzero mapcount
CPU: 0 PID: 1 Comm: swapper Not tainted 5.8.0-rc1-00001-g3a38f8a60c65-dirty #1
Stack from 404c9ebc:
404c9ebc 4029ab28 4029ab28 40088470 41fe0ca0 40299e21 40299df1 404ba2a4
00020165 00000000 41fd2c10 402c7ba0 41fd2c04 40088504 41fe0ca0 40299e21
00000000 40088a12 41fe0ca0 41fe0ca4 0000020a 00000000 00000001 402ca000
00000000 41fe0ca0 41fd2c10 41fd2c10 00000000 00000000 402b2388 00000001
400a0934 40091056 404c9f44 404c9f44 40088db4 402c7ba0 00000001 41fd2c04
41fe0ca0 41fd2000 41fe0ca0 40089e02 4026ecf4 40089e4e 41fe0ca0 ffffffff
Call Trace:
[<40088470>] 0x40088470
[<40088504>] 0x40088504
[<40088a12>] 0x40088a12
[<402ca000>] 0x402ca000
[<400a0934>] 0x400a0934
Adjust the memory registration with memblock to include the beginning of
the physical memory and make sure that the area occupied by the kernel is
marked as reserved.
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/m68k/kernel/setup_no.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/m68k/kernel/setup_no.c b/arch/m68k/kernel/setup_no.c
index a63483de7a422..5dacba392c74e 100644
--- a/arch/m68k/kernel/setup_no.c
+++ b/arch/m68k/kernel/setup_no.c
@@ -139,7 +139,8 @@ void __init setup_arch(char **cmdline_p)
pr_debug("MEMORY -> ROMFS=0x%p-0x%06lx MEM=0x%06lx-0x%06lx\n ",
__bss_stop, memory_start, memory_start, memory_end);
- memblock_add(memory_start, memory_end - memory_start);
+ memblock_add(_rambase, memory_end - _rambase);
+ memblock_reserve(_rambase, memory_start - _rambase);
/* Keep a copy of command line */
*cmdline_p = &command_line[0];
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 041/244] m68k: mm: fix node memblock init
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 040/244] m68k: nommu: register start of the memory with memblock Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 042/244] dt-bindings: bus: uniphier-system-bus: fix warning in example Greg Kroah-Hartman
` (203 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Angelo Dureghello, Mike Rapoport,
Greg Ungerer, Sasha Levin
From: Angelo Dureghello <angelo.dureghello@timesys.com>
[ Upstream commit c43e55796dd4d13f4855971a4d7970ce2cd94db4 ]
After pulling 5.7.0 (linux-next merge), mcf5441x mmu boot was
hanging silently.
memblock_add() seems not appropriate, since using MAX_NUMNODES
as node id, while memblock_add_node() sets up memory for node id 0.
Signed-off-by: Angelo Dureghello <angelo.dureghello@timesys.com>
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/m68k/mm/mcfmmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/m68k/mm/mcfmmu.c b/arch/m68k/mm/mcfmmu.c
index 0ea375607767c..2c57f46facc0e 100644
--- a/arch/m68k/mm/mcfmmu.c
+++ b/arch/m68k/mm/mcfmmu.c
@@ -178,7 +178,7 @@ void __init cf_bootmem_alloc(void)
m68k_memory[0].addr = _rambase;
m68k_memory[0].size = _ramend - _rambase;
- memblock_add(m68k_memory[0].addr, m68k_memory[0].size);
+ memblock_add_node(m68k_memory[0].addr, m68k_memory[0].size, 0);
/* compute total pages in system */
num_pages = PFN_DOWN(_ramend - _rambase);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 042/244] dt-bindings: bus: uniphier-system-bus: fix warning in example
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 041/244] m68k: mm: fix node memblock init Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 043/244] dt-bindings: mailbox: zynqmp_ipi: fix unit address Greg Kroah-Hartman
` (202 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masahiro Yamada, Rob Herring, Sasha Levin
From: Masahiro Yamada <yamada.masahiro@socionext.com>
[ Upstream commit 0fb24d1e5a6cf3b7ca0df325fbfb10895df41bec ]
Since commit e69f5dc623f9 ("dt-bindings: serial: Convert 8250 to
json-schema"), the schema for "ns16550a" is checked.
'make dt_binding_check' emits the following warning:
uart@5,00200000: $nodename:0: 'uart@5,00200000' does not match '^serial(@[0-9a-f,]+)*$'
Rename the node to follow the pattern defined in
Documentation/devicetree/bindings/serial/serial.yaml
While I was here, I removed leading zeros from unit names.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Link: https://lore.kernel.org/r/20200623113242.779241-1-yamada.masahiro@socionext.com
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../bindings/bus/socionext,uniphier-system-bus.yaml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/Documentation/devicetree/bindings/bus/socionext,uniphier-system-bus.yaml b/Documentation/devicetree/bindings/bus/socionext,uniphier-system-bus.yaml
index c4c9119e4a206..a0c6c5d2b70fb 100644
--- a/Documentation/devicetree/bindings/bus/socionext,uniphier-system-bus.yaml
+++ b/Documentation/devicetree/bindings/bus/socionext,uniphier-system-bus.yaml
@@ -80,14 +80,14 @@ examples:
ranges = <1 0x00000000 0x42000000 0x02000000>,
<5 0x00000000 0x46000000 0x01000000>;
- ethernet@1,01f00000 {
+ ethernet@1,1f00000 {
compatible = "smsc,lan9115";
reg = <1 0x01f00000 0x1000>;
interrupts = <0 48 4>;
phy-mode = "mii";
};
- uart@5,00200000 {
+ serial@5,200000 {
compatible = "ns16550a";
reg = <5 0x00200000 0x20>;
interrupts = <0 49 4>;
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 043/244] dt-bindings: mailbox: zynqmp_ipi: fix unit address
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 042/244] dt-bindings: bus: uniphier-system-bus: fix warning in example Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 044/244] dt-bindings: fix error in make clean after make dt_binding_check Greg Kroah-Hartman
` (201 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kangmin Park, Rob Herring, Sasha Levin
From: Kangmin Park <l4stpr0gr4m@gmail.com>
[ Upstream commit 35b9c0fdb9f666628ecda02b1fc44306933a2d97 ]
Fix unit address to match the first address specified in the reg
property of the node in example.
Signed-off-by: Kangmin Park <l4stpr0gr4m@gmail.com>
Link: https://lore.kernel.org/r/20200625135158.5861-1-l4stpr0gr4m@gmail.com
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../devicetree/bindings/mailbox/xlnx,zynqmp-ipi-mailbox.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/devicetree/bindings/mailbox/xlnx,zynqmp-ipi-mailbox.txt b/Documentation/devicetree/bindings/mailbox/xlnx,zynqmp-ipi-mailbox.txt
index 4438432bfe9b3..ad76edccf8816 100644
--- a/Documentation/devicetree/bindings/mailbox/xlnx,zynqmp-ipi-mailbox.txt
+++ b/Documentation/devicetree/bindings/mailbox/xlnx,zynqmp-ipi-mailbox.txt
@@ -87,7 +87,7 @@ Example:
ranges;
/* APU<->RPU0 IPI mailbox controller */
- ipi_mailbox_rpu0: mailbox@ff90400 {
+ ipi_mailbox_rpu0: mailbox@ff990400 {
reg = <0xff990400 0x20>,
<0xff990420 0x20>,
<0xff990080 0x20>,
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 044/244] dt-bindings: fix error in make clean after make dt_binding_check
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 043/244] dt-bindings: mailbox: zynqmp_ipi: fix unit address Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 045/244] cifs: prevent truncation from long to int in wait_for_free_credits Greg Kroah-Hartman
` (200 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masahiro Yamada, Rob Herring, Sasha Levin
From: Masahiro Yamada <masahiroy@kernel.org>
[ Upstream commit fa714cf58c7c09a454ff9fda2ee8318591128eb6 ]
We are having more and more schema files.
Commit 8b6b80218b01 ("dt-bindings: Fix command line length limit
calling dt-mk-schema") fixed the 'Argument list too long' error of
the schema checks, but the same error happens while cleaning too.
'make clean' after 'make dt_binding_check' fails as follows:
$ make dt_binding_check
[ snip ]
$ make clean
make[2]: execvp: /bin/sh: Argument list too long
make[2]: *** [scripts/Makefile.clean:52: __clean] Error 127
make[1]: *** [scripts/Makefile.clean:66: Documentation/devicetree/bindings] Error 2
make: *** [Makefile:1763: _clean_Documentation] Error 2
'make dt_binding_check' generates so many .example.dts, .dt.yaml files,
which are passed to the 'rm' command when you run 'make clean'.
I added a small hack to use the 'find' command to clean up most of the
build artifacts before they are processed by scripts/Makefile.clean
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Link: https://lore.kernel.org/r/20200625170434.635114-2-masahiroy@kernel.org
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/devicetree/bindings/Makefile | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/Documentation/devicetree/bindings/Makefile b/Documentation/devicetree/bindings/Makefile
index 7782d99850823..b03d58c6b072f 100644
--- a/Documentation/devicetree/bindings/Makefile
+++ b/Documentation/devicetree/bindings/Makefile
@@ -45,3 +45,8 @@ $(obj)/processed-schema.yaml: $(DT_SCHEMA_FILES) FORCE
$(call if_changed,mk_schema)
extra-y += processed-schema.yaml
+
+# Hack: avoid 'Argument list too long' error for 'make clean'. Remove most of
+# build artifacts here before they are processed by scripts/Makefile.clean
+clean-files = $(shell find $(obj) \( -name '*.example.dts' -o \
+ -name '*.example.dt.yaml' \) -delete 2>/dev/null)
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 045/244] cifs: prevent truncation from long to int in wait_for_free_credits
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 044/244] dt-bindings: fix error in make clean after make dt_binding_check Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 046/244] arm64/alternatives: use subsections for replacement sequences Greg Kroah-Hartman
` (199 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marshall Midden, Ronnie Sahlberg,
Steve French, Sasha Levin
From: Ronnie Sahlberg <lsahlber@redhat.com>
[ Upstream commit 19e888678bac8c82206eb915eaf72741b2a2615c ]
The wait_event_... defines evaluate to long so we should not assign it an int as this may truncate
the value.
Reported-by: Marshall Midden <marshallmidden@gmail.com>
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/transport.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index c97570eb2c180..7fefd2bd111c4 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -528,7 +528,7 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits,
const int timeout, const int flags,
unsigned int *instance)
{
- int rc;
+ long rc;
int *credits;
int optype;
long int t;
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 046/244] arm64/alternatives: use subsections for replacement sequences
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 045/244] cifs: prevent truncation from long to int in wait_for_free_credits Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 047/244] tpm_tis: extra chip->ops check on error path in tpm_tis_core_init Greg Kroah-Hartman
` (198 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Suzuki K Poulose,
James Morse, Andre Przywara, Dave P Martin, Will Deacon,
Sasha Levin
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit f7b93d42945cc71e1346dd5ae07c59061d56745e ]
When building very large kernels, the logic that emits replacement
sequences for alternatives fails when relative branches are present
in the code that is emitted into the .altinstr_replacement section
and patched in at the original site and fixed up. The reason is that
the linker will insert veneers if relative branches go out of range,
and due to the relative distance of the .altinstr_replacement from
the .text section where its branch targets usually live, veneers
may be emitted at the end of the .altinstr_replacement section, with
the relative branches in the sequence pointed at the veneers instead
of the actual target.
The alternatives patching logic will attempt to fix up the branch to
point to its original target, which will be the veneer in this case,
but given that the patch site is likely to be far away as well, it
will be out of range and so patching will fail. There are other cases
where these veneers are problematic, e.g., when the target of the
branch is in .text while the patch site is in .init.text, in which
case putting the replacement sequence inside .text may not help either.
So let's use subsections to emit the replacement code as closely as
possible to the patch site, to ensure that veneers are only likely to
be emitted if they are required at the patch site as well, in which
case they will be in range for the replacement sequence both before
and after it is transported to the patch site.
This will prevent alternative sequences in non-init code from being
released from memory after boot, but this is tolerable given that the
entire section is only 512 KB on an allyesconfig build (which weighs in
at 500+ MB for the entire Image). Also, note that modules today carry
the replacement sequences in non-init sections as well, and any of
those that target init code will be emitted into init sections after
this change.
This fixes an early crash when booting an allyesconfig kernel on a
system where any of the alternatives sequences containing relative
branches are activated at boot (e.g., ARM64_HAS_PAN on TX2)
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Andre Przywara <andre.przywara@arm.com>
Cc: Dave P Martin <dave.martin@arm.com>
Link: https://lore.kernel.org/r/20200630081921.13443-1-ardb@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/alternative.h | 16 ++++++++--------
arch/arm64/kernel/vmlinux.lds.S | 3 ---
2 files changed, 8 insertions(+), 11 deletions(-)
diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
index 5e5dc05d63a06..12f0eb56a1cc3 100644
--- a/arch/arm64/include/asm/alternative.h
+++ b/arch/arm64/include/asm/alternative.h
@@ -73,11 +73,11 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
".pushsection .altinstructions,\"a\"\n" \
ALTINSTR_ENTRY(feature) \
".popsection\n" \
- ".pushsection .altinstr_replacement, \"a\"\n" \
+ ".subsection 1\n" \
"663:\n\t" \
newinstr "\n" \
"664:\n\t" \
- ".popsection\n\t" \
+ ".previous\n\t" \
".org . - (664b-663b) + (662b-661b)\n\t" \
".org . - (662b-661b) + (664b-663b)\n" \
".endif\n"
@@ -117,9 +117,9 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
662: .pushsection .altinstructions, "a"
altinstruction_entry 661b, 663f, \cap, 662b-661b, 664f-663f
.popsection
- .pushsection .altinstr_replacement, "ax"
+ .subsection 1
663: \insn2
-664: .popsection
+664: .previous
.org . - (664b-663b) + (662b-661b)
.org . - (662b-661b) + (664b-663b)
.endif
@@ -160,7 +160,7 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
.pushsection .altinstructions, "a"
altinstruction_entry 663f, 661f, \cap, 664f-663f, 662f-661f
.popsection
- .pushsection .altinstr_replacement, "ax"
+ .subsection 1
.align 2 /* So GAS knows label 661 is suitably aligned */
661:
.endm
@@ -179,9 +179,9 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
.macro alternative_else
662:
.if .Lasm_alt_mode==0
- .pushsection .altinstr_replacement, "ax"
+ .subsection 1
.else
- .popsection
+ .previous
.endif
663:
.endm
@@ -192,7 +192,7 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
.macro alternative_endif
664:
.if .Lasm_alt_mode==0
- .popsection
+ .previous
.endif
.org . - (664b-663b) + (662b-661b)
.org . - (662b-661b) + (664b-663b)
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 94402aaf5f5c7..9869412ac156d 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -172,9 +172,6 @@ SECTIONS
*(.altinstructions)
__alt_instructions_end = .;
}
- .altinstr_replacement : {
- *(.altinstr_replacement)
- }
. = ALIGN(PAGE_SIZE);
__inittext_end = .;
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 047/244] tpm_tis: extra chip->ops check on error path in tpm_tis_core_init
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 046/244] arm64/alternatives: use subsections for replacement sequences Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 048/244] xen/xenbus: avoid large structs and arrays on the stack Greg Kroah-Hartman
` (197 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vasily Averin, Jerry Snitselaar,
Jarkko Sakkinen, Sasha Levin
From: Vasily Averin <vvs@virtuozzo.com>
[ Upstream commit ccf6fb858e17a8f8a914a1c6444d277cfedfeae6 ]
Found by smatch:
drivers/char/tpm/tpm_tis_core.c:1088 tpm_tis_core_init() warn:
variable dereferenced before check 'chip->ops' (see line 979)
'chip->ops' is assigned in the beginning of function
in tpmm_chip_alloc->tpm_chip_alloc
and is used before first possible goto to error path.
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/tpm/tpm_tis_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
index 2435216bd10aa..65ab1b027949c 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -1085,7 +1085,7 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
return 0;
out_err:
- if ((chip->ops != NULL) && (chip->ops->clk_enable != NULL))
+ if (chip->ops->clk_enable != NULL)
chip->ops->clk_enable(chip, false);
tpm_tis_remove(chip);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 048/244] xen/xenbus: avoid large structs and arrays on the stack
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 047/244] tpm_tis: extra chip->ops check on error path in tpm_tis_core_init Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 049/244] xen/xenbus: let xenbus_map_ring_valloc() return errno values only Greg Kroah-Hartman
` (196 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Juergen Gross,
Boris Ostrovsky, Sasha Levin
From: Juergen Gross <jgross@suse.com>
[ Upstream commit 3848e4e0a32afb96dc3b84e1358c3b9d103c6a2c ]
xenbus_map_ring_valloc() and its sub-functions are putting quite large
structs and arrays on the stack. This is problematic at runtime, but
might also result in build failures (e.g. with clang due to the option
-Werror,-Wframe-larger-than=... used).
Fix that by moving most of the data from the stack into a dynamically
allocated struct. Performance is no issue here, as
xenbus_map_ring_valloc() is used only when adding a new PV device to
a backend driver.
While at it move some duplicated code from pv/hvm specific mapping
functions to the single caller.
Reported-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Link: https://lore.kernel.org/r/20200701121638.19840-2-jgross@suse.com
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/xenbus/xenbus_client.c | 161 +++++++++++++++--------------
1 file changed, 83 insertions(+), 78 deletions(-)
diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 040d2a43e8e35..9f8372079ecfa 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -69,11 +69,27 @@ struct xenbus_map_node {
unsigned int nr_handles;
};
+struct map_ring_valloc {
+ struct xenbus_map_node *node;
+
+ /* Why do we need two arrays? See comment of __xenbus_map_ring */
+ union {
+ unsigned long addrs[XENBUS_MAX_RING_GRANTS];
+ pte_t *ptes[XENBUS_MAX_RING_GRANTS];
+ };
+ phys_addr_t phys_addrs[XENBUS_MAX_RING_GRANTS];
+
+ struct gnttab_map_grant_ref map[XENBUS_MAX_RING_GRANTS];
+ struct gnttab_unmap_grant_ref unmap[XENBUS_MAX_RING_GRANTS];
+
+ unsigned int idx; /* HVM only. */
+};
+
static DEFINE_SPINLOCK(xenbus_valloc_lock);
static LIST_HEAD(xenbus_valloc_pages);
struct xenbus_ring_ops {
- int (*map)(struct xenbus_device *dev,
+ int (*map)(struct xenbus_device *dev, struct map_ring_valloc *info,
grant_ref_t *gnt_refs, unsigned int nr_grefs,
void **vaddr);
int (*unmap)(struct xenbus_device *dev, void *vaddr);
@@ -449,12 +465,32 @@ int xenbus_map_ring_valloc(struct xenbus_device *dev, grant_ref_t *gnt_refs,
unsigned int nr_grefs, void **vaddr)
{
int err;
+ struct map_ring_valloc *info;
+
+ *vaddr = NULL;
+
+ if (nr_grefs > XENBUS_MAX_RING_GRANTS)
+ return -EINVAL;
+
+ info = kzalloc(sizeof(*info), GFP_KERNEL);
+ if (!info)
+ return -ENOMEM;
+
+ info->node = kzalloc(sizeof(*info->node), GFP_KERNEL);
+ if (!info->node) {
+ err = -ENOMEM;
+ goto out;
+ }
+
+ err = ring_ops->map(dev, info, gnt_refs, nr_grefs, vaddr);
- err = ring_ops->map(dev, gnt_refs, nr_grefs, vaddr);
/* Some hypervisors are buggy and can return 1. */
if (err > 0)
err = GNTST_general_error;
+ out:
+ kfree(info->node);
+ kfree(info);
return err;
}
EXPORT_SYMBOL_GPL(xenbus_map_ring_valloc);
@@ -466,12 +502,10 @@ static int __xenbus_map_ring(struct xenbus_device *dev,
grant_ref_t *gnt_refs,
unsigned int nr_grefs,
grant_handle_t *handles,
- phys_addr_t *addrs,
+ struct map_ring_valloc *info,
unsigned int flags,
bool *leaked)
{
- struct gnttab_map_grant_ref map[XENBUS_MAX_RING_GRANTS];
- struct gnttab_unmap_grant_ref unmap[XENBUS_MAX_RING_GRANTS];
int i, j;
int err = GNTST_okay;
@@ -479,23 +513,22 @@ static int __xenbus_map_ring(struct xenbus_device *dev,
return -EINVAL;
for (i = 0; i < nr_grefs; i++) {
- memset(&map[i], 0, sizeof(map[i]));
- gnttab_set_map_op(&map[i], addrs[i], flags, gnt_refs[i],
- dev->otherend_id);
+ gnttab_set_map_op(&info->map[i], info->phys_addrs[i], flags,
+ gnt_refs[i], dev->otherend_id);
handles[i] = INVALID_GRANT_HANDLE;
}
- gnttab_batch_map(map, i);
+ gnttab_batch_map(info->map, i);
for (i = 0; i < nr_grefs; i++) {
- if (map[i].status != GNTST_okay) {
- err = map[i].status;
- xenbus_dev_fatal(dev, map[i].status,
+ if (info->map[i].status != GNTST_okay) {
+ err = info->map[i].status;
+ xenbus_dev_fatal(dev, info->map[i].status,
"mapping in shared page %d from domain %d",
gnt_refs[i], dev->otherend_id);
goto fail;
} else
- handles[i] = map[i].handle;
+ handles[i] = info->map[i].handle;
}
return GNTST_okay;
@@ -503,19 +536,19 @@ static int __xenbus_map_ring(struct xenbus_device *dev,
fail:
for (i = j = 0; i < nr_grefs; i++) {
if (handles[i] != INVALID_GRANT_HANDLE) {
- memset(&unmap[j], 0, sizeof(unmap[j]));
- gnttab_set_unmap_op(&unmap[j], (phys_addr_t)addrs[i],
+ gnttab_set_unmap_op(&info->unmap[j],
+ info->phys_addrs[i],
GNTMAP_host_map, handles[i]);
j++;
}
}
- if (HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref, unmap, j))
+ if (HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref, info->unmap, j))
BUG();
*leaked = false;
for (i = 0; i < j; i++) {
- if (unmap[i].status != GNTST_okay) {
+ if (info->unmap[i].status != GNTST_okay) {
*leaked = true;
break;
}
@@ -566,21 +599,12 @@ static int xenbus_unmap_ring(struct xenbus_device *dev, grant_handle_t *handles,
return err;
}
-struct map_ring_valloc_hvm
-{
- unsigned int idx;
-
- /* Why do we need two arrays? See comment of __xenbus_map_ring */
- phys_addr_t phys_addrs[XENBUS_MAX_RING_GRANTS];
- unsigned long addrs[XENBUS_MAX_RING_GRANTS];
-};
-
static void xenbus_map_ring_setup_grant_hvm(unsigned long gfn,
unsigned int goffset,
unsigned int len,
void *data)
{
- struct map_ring_valloc_hvm *info = data;
+ struct map_ring_valloc *info = data;
unsigned long vaddr = (unsigned long)gfn_to_virt(gfn);
info->phys_addrs[info->idx] = vaddr;
@@ -589,39 +613,28 @@ static void xenbus_map_ring_setup_grant_hvm(unsigned long gfn,
info->idx++;
}
-static int xenbus_map_ring_valloc_hvm(struct xenbus_device *dev,
- grant_ref_t *gnt_ref,
- unsigned int nr_grefs,
- void **vaddr)
+static int xenbus_map_ring_hvm(struct xenbus_device *dev,
+ struct map_ring_valloc *info,
+ grant_ref_t *gnt_ref,
+ unsigned int nr_grefs,
+ void **vaddr)
{
- struct xenbus_map_node *node;
+ struct xenbus_map_node *node = info->node;
int err;
void *addr;
bool leaked = false;
- struct map_ring_valloc_hvm info = {
- .idx = 0,
- };
unsigned int nr_pages = XENBUS_PAGES(nr_grefs);
- if (nr_grefs > XENBUS_MAX_RING_GRANTS)
- return -EINVAL;
-
- *vaddr = NULL;
-
- node = kzalloc(sizeof(*node), GFP_KERNEL);
- if (!node)
- return -ENOMEM;
-
err = alloc_xenballooned_pages(nr_pages, node->hvm.pages);
if (err)
goto out_err;
gnttab_foreach_grant(node->hvm.pages, nr_grefs,
xenbus_map_ring_setup_grant_hvm,
- &info);
+ info);
err = __xenbus_map_ring(dev, gnt_ref, nr_grefs, node->handles,
- info.phys_addrs, GNTMAP_host_map, &leaked);
+ info, GNTMAP_host_map, &leaked);
node->nr_handles = nr_grefs;
if (err)
@@ -641,11 +654,13 @@ static int xenbus_map_ring_valloc_hvm(struct xenbus_device *dev,
spin_unlock(&xenbus_valloc_lock);
*vaddr = addr;
+ info->node = NULL;
+
return 0;
out_xenbus_unmap_ring:
if (!leaked)
- xenbus_unmap_ring(dev, node->handles, nr_grefs, info.addrs);
+ xenbus_unmap_ring(dev, node->handles, nr_grefs, info->addrs);
else
pr_alert("leaking %p size %u page(s)",
addr, nr_pages);
@@ -653,7 +668,6 @@ static int xenbus_map_ring_valloc_hvm(struct xenbus_device *dev,
if (!leaked)
free_xenballooned_pages(nr_pages, node->hvm.pages);
out_err:
- kfree(node);
return err;
}
@@ -676,40 +690,30 @@ int xenbus_unmap_ring_vfree(struct xenbus_device *dev, void *vaddr)
EXPORT_SYMBOL_GPL(xenbus_unmap_ring_vfree);
#ifdef CONFIG_XEN_PV
-static int xenbus_map_ring_valloc_pv(struct xenbus_device *dev,
- grant_ref_t *gnt_refs,
- unsigned int nr_grefs,
- void **vaddr)
+static int xenbus_map_ring_pv(struct xenbus_device *dev,
+ struct map_ring_valloc *info,
+ grant_ref_t *gnt_refs,
+ unsigned int nr_grefs,
+ void **vaddr)
{
- struct xenbus_map_node *node;
+ struct xenbus_map_node *node = info->node;
struct vm_struct *area;
- pte_t *ptes[XENBUS_MAX_RING_GRANTS];
- phys_addr_t phys_addrs[XENBUS_MAX_RING_GRANTS];
int err = GNTST_okay;
int i;
bool leaked;
- *vaddr = NULL;
-
- if (nr_grefs > XENBUS_MAX_RING_GRANTS)
- return -EINVAL;
-
- node = kzalloc(sizeof(*node), GFP_KERNEL);
- if (!node)
- return -ENOMEM;
-
- area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, ptes);
+ area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, info->ptes);
if (!area) {
kfree(node);
return -ENOMEM;
}
for (i = 0; i < nr_grefs; i++)
- phys_addrs[i] = arbitrary_virt_to_machine(ptes[i]).maddr;
+ info->phys_addrs[i] =
+ arbitrary_virt_to_machine(info->ptes[i]).maddr;
err = __xenbus_map_ring(dev, gnt_refs, nr_grefs, node->handles,
- phys_addrs,
- GNTMAP_host_map | GNTMAP_contains_pte,
+ info, GNTMAP_host_map | GNTMAP_contains_pte,
&leaked);
if (err)
goto failed;
@@ -722,6 +726,8 @@ static int xenbus_map_ring_valloc_pv(struct xenbus_device *dev,
spin_unlock(&xenbus_valloc_lock);
*vaddr = area->addr;
+ info->node = NULL;
+
return 0;
failed:
@@ -730,11 +736,10 @@ failed:
else
pr_alert("leaking VM area %p size %u page(s)", area, nr_grefs);
- kfree(node);
return err;
}
-static int xenbus_unmap_ring_vfree_pv(struct xenbus_device *dev, void *vaddr)
+static int xenbus_unmap_ring_pv(struct xenbus_device *dev, void *vaddr)
{
struct xenbus_map_node *node;
struct gnttab_unmap_grant_ref unmap[XENBUS_MAX_RING_GRANTS];
@@ -798,12 +803,12 @@ static int xenbus_unmap_ring_vfree_pv(struct xenbus_device *dev, void *vaddr)
}
static const struct xenbus_ring_ops ring_ops_pv = {
- .map = xenbus_map_ring_valloc_pv,
- .unmap = xenbus_unmap_ring_vfree_pv,
+ .map = xenbus_map_ring_pv,
+ .unmap = xenbus_unmap_ring_pv,
};
#endif
-struct unmap_ring_vfree_hvm
+struct unmap_ring_hvm
{
unsigned int idx;
unsigned long addrs[XENBUS_MAX_RING_GRANTS];
@@ -814,19 +819,19 @@ static void xenbus_unmap_ring_setup_grant_hvm(unsigned long gfn,
unsigned int len,
void *data)
{
- struct unmap_ring_vfree_hvm *info = data;
+ struct unmap_ring_hvm *info = data;
info->addrs[info->idx] = (unsigned long)gfn_to_virt(gfn);
info->idx++;
}
-static int xenbus_unmap_ring_vfree_hvm(struct xenbus_device *dev, void *vaddr)
+static int xenbus_unmap_ring_hvm(struct xenbus_device *dev, void *vaddr)
{
int rv;
struct xenbus_map_node *node;
void *addr;
- struct unmap_ring_vfree_hvm info = {
+ struct unmap_ring_hvm info = {
.idx = 0,
};
unsigned int nr_pages;
@@ -887,8 +892,8 @@ enum xenbus_state xenbus_read_driver_state(const char *path)
EXPORT_SYMBOL_GPL(xenbus_read_driver_state);
static const struct xenbus_ring_ops ring_ops_hvm = {
- .map = xenbus_map_ring_valloc_hvm,
- .unmap = xenbus_unmap_ring_vfree_hvm,
+ .map = xenbus_map_ring_hvm,
+ .unmap = xenbus_unmap_ring_hvm,
};
void __init xenbus_ring_ops_init(void)
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 049/244] xen/xenbus: let xenbus_map_ring_valloc() return errno values only
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 048/244] xen/xenbus: avoid large structs and arrays on the stack Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 050/244] gfs2: eliminate GIF_ORDERED in favor of list_empty Greg Kroah-Hartman
` (195 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Juergen Gross, Boris Ostrovsky, Sasha Levin
From: Juergen Gross <jgross@suse.com>
[ Upstream commit 578c1bb9056263ad3c9e09746b3d6e4daf63bdb0 ]
Today xenbus_map_ring_valloc() can return either a negative errno
value (-ENOMEM or -EINVAL) or a grant status value. This is a mess as
e.g -ENOMEM and GNTST_eagain have the same numeric value.
Fix that by turning all grant mapping errors into -ENOENT. This is
no problem as all callers of xenbus_map_ring_valloc() only use the
return value to print an error message, and in case of mapping errors
the grant status value has already been printed by __xenbus_map_ring()
before.
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Link: https://lore.kernel.org/r/20200701121638.19840-3-jgross@suse.com
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/xenbus/xenbus_client.c | 22 ++++++----------------
1 file changed, 6 insertions(+), 16 deletions(-)
diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 9f8372079ecfa..4f168b46fbca5 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -456,8 +456,7 @@ EXPORT_SYMBOL_GPL(xenbus_free_evtchn);
* Map @nr_grefs pages of memory into this domain from another
* domain's grant table. xenbus_map_ring_valloc allocates @nr_grefs
* pages of virtual address space, maps the pages to that address, and
- * sets *vaddr to that address. Returns 0 on success, and GNTST_*
- * (see xen/include/interface/grant_table.h) or -ENOMEM / -EINVAL on
+ * sets *vaddr to that address. Returns 0 on success, and -errno on
* error. If an error is returned, device will switch to
* XenbusStateClosing and the error message will be saved in XenStore.
*/
@@ -477,18 +476,11 @@ int xenbus_map_ring_valloc(struct xenbus_device *dev, grant_ref_t *gnt_refs,
return -ENOMEM;
info->node = kzalloc(sizeof(*info->node), GFP_KERNEL);
- if (!info->node) {
+ if (!info->node)
err = -ENOMEM;
- goto out;
- }
-
- err = ring_ops->map(dev, info, gnt_refs, nr_grefs, vaddr);
-
- /* Some hypervisors are buggy and can return 1. */
- if (err > 0)
- err = GNTST_general_error;
+ else
+ err = ring_ops->map(dev, info, gnt_refs, nr_grefs, vaddr);
- out:
kfree(info->node);
kfree(info);
return err;
@@ -507,7 +499,6 @@ static int __xenbus_map_ring(struct xenbus_device *dev,
bool *leaked)
{
int i, j;
- int err = GNTST_okay;
if (nr_grefs > XENBUS_MAX_RING_GRANTS)
return -EINVAL;
@@ -522,7 +513,6 @@ static int __xenbus_map_ring(struct xenbus_device *dev,
for (i = 0; i < nr_grefs; i++) {
if (info->map[i].status != GNTST_okay) {
- err = info->map[i].status;
xenbus_dev_fatal(dev, info->map[i].status,
"mapping in shared page %d from domain %d",
gnt_refs[i], dev->otherend_id);
@@ -531,7 +521,7 @@ static int __xenbus_map_ring(struct xenbus_device *dev,
handles[i] = info->map[i].handle;
}
- return GNTST_okay;
+ return 0;
fail:
for (i = j = 0; i < nr_grefs; i++) {
@@ -554,7 +544,7 @@ static int __xenbus_map_ring(struct xenbus_device *dev,
}
}
- return err;
+ return -ENOENT;
}
/**
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 050/244] gfs2: eliminate GIF_ORDERED in favor of list_empty
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 049/244] xen/xenbus: let xenbus_map_ring_valloc() return errno values only Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 051/244] gfs2: freeze should work on read-only mounts Greg Kroah-Hartman
` (194 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bob Peterson, Sasha Levin
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit 7542486b89b2e321ffe0de82163b425d6a38bc72 ]
In several places, we used the GIF_ORDERED inode flag to determine
if an inode was on the ordered writes list. However, since we always
held the sd_ordered_lock spin_lock during the manipulation, we can
just as easily check list_empty(&ip->i_ordered) instead.
This allows us to keep more than one ordered writes list to make
journal writing improvements.
This patch eliminates GIF_ORDERED in favor of checking list_empty.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/incore.h | 1 -
fs/gfs2/log.c | 15 +++++++++------
fs/gfs2/log.h | 4 ++--
fs/gfs2/main.c | 1 +
4 files changed, 12 insertions(+), 9 deletions(-)
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index 84a824293a78b..013c029dd16b8 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -395,7 +395,6 @@ enum {
GIF_QD_LOCKED = 1,
GIF_ALLOC_FAILED = 2,
GIF_SW_PAGED = 3,
- GIF_ORDERED = 4,
GIF_FREE_VFS_INODE = 5,
GIF_GLOP_PENDING = 6,
};
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 04882712cd661..62a73bd6575cb 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -613,6 +613,12 @@ static int ip_cmp(void *priv, struct list_head *a, struct list_head *b)
return 0;
}
+static void __ordered_del_inode(struct gfs2_inode *ip)
+{
+ if (!list_empty(&ip->i_ordered))
+ list_del_init(&ip->i_ordered);
+}
+
static void gfs2_ordered_write(struct gfs2_sbd *sdp)
{
struct gfs2_inode *ip;
@@ -623,8 +629,7 @@ static void gfs2_ordered_write(struct gfs2_sbd *sdp)
while (!list_empty(&sdp->sd_log_ordered)) {
ip = list_first_entry(&sdp->sd_log_ordered, struct gfs2_inode, i_ordered);
if (ip->i_inode.i_mapping->nrpages == 0) {
- test_and_clear_bit(GIF_ORDERED, &ip->i_flags);
- list_del(&ip->i_ordered);
+ __ordered_del_inode(ip);
continue;
}
list_move(&ip->i_ordered, &written);
@@ -643,8 +648,7 @@ static void gfs2_ordered_wait(struct gfs2_sbd *sdp)
spin_lock(&sdp->sd_ordered_lock);
while (!list_empty(&sdp->sd_log_ordered)) {
ip = list_first_entry(&sdp->sd_log_ordered, struct gfs2_inode, i_ordered);
- list_del(&ip->i_ordered);
- WARN_ON(!test_and_clear_bit(GIF_ORDERED, &ip->i_flags));
+ __ordered_del_inode(ip);
if (ip->i_inode.i_mapping->nrpages == 0)
continue;
spin_unlock(&sdp->sd_ordered_lock);
@@ -659,8 +663,7 @@ void gfs2_ordered_del_inode(struct gfs2_inode *ip)
struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
spin_lock(&sdp->sd_ordered_lock);
- if (test_and_clear_bit(GIF_ORDERED, &ip->i_flags))
- list_del(&ip->i_ordered);
+ __ordered_del_inode(ip);
spin_unlock(&sdp->sd_ordered_lock);
}
diff --git a/fs/gfs2/log.h b/fs/gfs2/log.h
index c1cd6ae176597..8965c751a3039 100644
--- a/fs/gfs2/log.h
+++ b/fs/gfs2/log.h
@@ -53,9 +53,9 @@ static inline void gfs2_ordered_add_inode(struct gfs2_inode *ip)
if (gfs2_is_jdata(ip) || !gfs2_is_ordered(sdp))
return;
- if (!test_bit(GIF_ORDERED, &ip->i_flags)) {
+ if (list_empty(&ip->i_ordered)) {
spin_lock(&sdp->sd_ordered_lock);
- if (!test_and_set_bit(GIF_ORDERED, &ip->i_flags))
+ if (list_empty(&ip->i_ordered))
list_add(&ip->i_ordered, &sdp->sd_log_ordered);
spin_unlock(&sdp->sd_ordered_lock);
}
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index a1a295b739fb8..4f2edb777a721 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -39,6 +39,7 @@ static void gfs2_init_inode_once(void *foo)
atomic_set(&ip->i_sizehint, 0);
init_rwsem(&ip->i_rw_mutex);
INIT_LIST_HEAD(&ip->i_trunc_list);
+ INIT_LIST_HEAD(&ip->i_ordered);
ip->i_qadata = NULL;
gfs2_holder_mark_uninitialized(&ip->i_rgd_gh);
memset(&ip->i_res, 0, sizeof(ip->i_res));
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 051/244] gfs2: freeze should work on read-only mounts
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 050/244] gfs2: eliminate GIF_ORDERED in favor of list_empty Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 052/244] gfs2: read-only mounts should grab the sd_freeze_gl glock Greg Kroah-Hartman
` (193 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bob Peterson, Sasha Levin
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit 541656d3a5136ae830d604e237f29f406d42c592 ]
Before this patch, function freeze_go_sync, called when promoting
the freeze glock, was testing for the SDF_JOURNAL_LIVE superblock flag.
That's only set for read-write mounts. Read-only mounts don't use a
journal, so the bit is never set, so the freeze never happened.
This patch removes the check for SDF_JOURNAL_LIVE for freeze requests
but still checks it when deciding whether to flush a journal.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/glops.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 9e9c7a4b8c663..fc97c4d24dc58 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -527,8 +527,7 @@ static int freeze_go_sync(struct gfs2_glock *gl)
int error = 0;
struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
- if (gl->gl_state == LM_ST_SHARED && !gfs2_withdrawn(sdp) &&
- test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)) {
+ if (gl->gl_req == LM_ST_EXCLUSIVE && !gfs2_withdrawn(sdp)) {
atomic_set(&sdp->sd_freeze_state, SFS_STARTING_FREEZE);
error = freeze_super(sdp->sd_vfs);
if (error) {
@@ -541,8 +540,11 @@ static int freeze_go_sync(struct gfs2_glock *gl)
gfs2_assert_withdraw(sdp, 0);
}
queue_work(gfs2_freeze_wq, &sdp->sd_freeze_work);
- gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_FREEZE |
- GFS2_LFC_FREEZE_GO_SYNC);
+ if (test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags))
+ gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_FREEZE |
+ GFS2_LFC_FREEZE_GO_SYNC);
+ else /* read-only mounts */
+ atomic_set(&sdp->sd_freeze_state, SFS_FROZEN);
}
return 0;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 052/244] gfs2: read-only mounts should grab the sd_freeze_gl glock
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 051/244] gfs2: freeze should work on read-only mounts Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 053/244] gfs2: When freezing gfs2, use GL_EXACT and not GL_NOCACHE Greg Kroah-Hartman
` (192 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bob Peterson, Sasha Levin
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit b780cc615ba4795a7ef0e93b19424828a5ad456a ]
Before this patch, only read-write mounts would grab the freeze
glock in read-only mode, as part of gfs2_make_fs_rw. So the freeze
glock was never initialized. That meant requests to freeze, which
request the glock in EX, were granted without any state transition.
That meant you could mount a gfs2 file system, which is currently
frozen on a different cluster node, in read-only mode.
This patch makes read-only mounts lock the freeze glock in SH mode,
which will block for file systems that are frozen on another node.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/ops_fstype.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 094f5fe7c0090..a2c0554a18901 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1136,7 +1136,17 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
goto fail_per_node;
}
- if (!sb_rdonly(sb)) {
+ if (sb_rdonly(sb)) {
+ struct gfs2_holder freeze_gh;
+
+ error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED,
+ GL_EXACT, &freeze_gh);
+ if (error) {
+ fs_err(sdp, "can't make FS RO: %d\n", error);
+ goto fail_per_node;
+ }
+ gfs2_glock_dq_uninit(&freeze_gh);
+ } else {
error = gfs2_make_fs_rw(sdp);
if (error) {
fs_err(sdp, "can't make FS RW: %d\n", error);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 053/244] gfs2: When freezing gfs2, use GL_EXACT and not GL_NOCACHE
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 052/244] gfs2: read-only mounts should grab the sd_freeze_gl glock Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 054/244] gfs2: The freeze glock should never be frozen Greg Kroah-Hartman
` (191 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bob Peterson, Sasha Levin
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit 623ba664b74a20f22a2ef7ebd71e171d2d7c626f ]
Before this patch, the freeze code in gfs2 specified GL_NOCACHE in
several places. That's wrong because we always want to know the state
of whether the file system is frozen.
There was also a problem with freeze/thaw transitioning the glock from
frozen (EX) to thawed (SH) because gfs2 will normally grant glocks in EX
to processes that request it in SH mode, unless GL_EXACT is specified.
Therefore, the freeze/thaw code, which tried to reacquire the glock in
SH mode would get the glock in EX mode, and miss the transition from EX
to SH. That made it think the thaw had completed normally, but since the
glock was still cached in EX, other nodes could not freeze again.
This patch removes the GL_NOCACHE flag to allow the freeze glock to be
cached. It also adds the GL_EXACT flag so the glock is fully transitioned
from EX to SH, thereby allowing future freeze operations.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/recovery.c | 4 ++--
fs/gfs2/super.c | 16 +++++++---------
2 files changed, 9 insertions(+), 11 deletions(-)
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index 96c345f492738..390ea79d682c2 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -364,8 +364,8 @@ void gfs2_recover_func(struct work_struct *work)
/* Acquire a shared hold on the freeze lock */
error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED,
- LM_FLAG_NOEXP | LM_FLAG_PRIORITY,
- &thaw_gh);
+ LM_FLAG_NOEXP | LM_FLAG_PRIORITY |
+ GL_EXACT, &thaw_gh);
if (error)
goto fail_gunlock_ji;
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 956fced0a8ec2..3bc76cf382fb9 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -167,7 +167,7 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp)
if (error)
return error;
- error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, 0,
+ error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, GL_EXACT,
&freeze_gh);
if (error)
goto fail_threads;
@@ -203,7 +203,6 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp)
return 0;
fail:
- freeze_gh.gh_flags |= GL_NOCACHE;
gfs2_glock_dq_uninit(&freeze_gh);
fail_threads:
if (sdp->sd_quotad_process)
@@ -430,7 +429,7 @@ static int gfs2_lock_fs_check_clean(struct gfs2_sbd *sdp)
}
error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_EXCLUSIVE,
- GL_NOCACHE, &sdp->sd_freeze_gh);
+ 0, &sdp->sd_freeze_gh);
if (error)
goto out;
@@ -613,13 +612,14 @@ int gfs2_make_fs_ro(struct gfs2_sbd *sdp)
!gfs2_glock_is_locked_by_me(sdp->sd_freeze_gl)) {
if (!log_write_allowed) {
error = gfs2_glock_nq_init(sdp->sd_freeze_gl,
- LM_ST_SHARED, GL_NOCACHE |
- LM_FLAG_TRY, &freeze_gh);
+ LM_ST_SHARED,
+ LM_FLAG_TRY | GL_EXACT,
+ &freeze_gh);
if (error == GLR_TRYFAILED)
error = 0;
} else {
error = gfs2_glock_nq_init(sdp->sd_freeze_gl,
- LM_ST_SHARED, GL_NOCACHE,
+ LM_ST_SHARED, GL_EXACT,
&freeze_gh);
if (error && !gfs2_withdrawn(sdp))
return error;
@@ -761,7 +761,7 @@ void gfs2_freeze_func(struct work_struct *work)
struct super_block *sb = sdp->sd_vfs;
atomic_inc(&sb->s_active);
- error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, 0,
+ error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, GL_EXACT,
&freeze_gh);
if (error) {
fs_info(sdp, "GFS2: couldn't get freeze lock : %d\n", error);
@@ -774,8 +774,6 @@ void gfs2_freeze_func(struct work_struct *work)
error);
gfs2_assert_withdraw(sdp, 0);
}
- if (!test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags))
- freeze_gh.gh_flags |= GL_NOCACHE;
gfs2_glock_dq_uninit(&freeze_gh);
}
deactivate_super(sb);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 054/244] gfs2: The freeze glock should never be frozen
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 053/244] gfs2: When freezing gfs2, use GL_EXACT and not GL_NOCACHE Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 055/244] arm64: Add MIDR value for KRYO4XX gold CPU cores Greg Kroah-Hartman
` (190 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bob Peterson, Sasha Levin
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit c860f8ffbea8924de05a281b937128773d30a77c ]
Before this patch, some gfs2 code locked the freeze glock with LM_FLAG_NOEXP
(Do not freeze) flag, and some did not. We never want to freeze the freeze
glock, so this patch makes it consistently use LM_FLAG_NOEXP always.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/ops_fstype.c | 3 ++-
fs/gfs2/super.c | 16 +++++++++-------
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index a2c0554a18901..6d18d2c91add2 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1140,7 +1140,8 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
struct gfs2_holder freeze_gh;
error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED,
- GL_EXACT, &freeze_gh);
+ LM_FLAG_NOEXP | GL_EXACT,
+ &freeze_gh);
if (error) {
fs_err(sdp, "can't make FS RO: %d\n", error);
goto fail_per_node;
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 3bc76cf382fb9..160bb4598b48b 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -167,7 +167,8 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp)
if (error)
return error;
- error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, GL_EXACT,
+ error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED,
+ LM_FLAG_NOEXP | GL_EXACT,
&freeze_gh);
if (error)
goto fail_threads;
@@ -429,7 +430,7 @@ static int gfs2_lock_fs_check_clean(struct gfs2_sbd *sdp)
}
error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_EXCLUSIVE,
- 0, &sdp->sd_freeze_gh);
+ LM_FLAG_NOEXP, &sdp->sd_freeze_gh);
if (error)
goto out;
@@ -612,14 +613,15 @@ int gfs2_make_fs_ro(struct gfs2_sbd *sdp)
!gfs2_glock_is_locked_by_me(sdp->sd_freeze_gl)) {
if (!log_write_allowed) {
error = gfs2_glock_nq_init(sdp->sd_freeze_gl,
- LM_ST_SHARED,
- LM_FLAG_TRY | GL_EXACT,
+ LM_ST_SHARED, LM_FLAG_TRY |
+ LM_FLAG_NOEXP | GL_EXACT,
&freeze_gh);
if (error == GLR_TRYFAILED)
error = 0;
} else {
error = gfs2_glock_nq_init(sdp->sd_freeze_gl,
- LM_ST_SHARED, GL_EXACT,
+ LM_ST_SHARED,
+ LM_FLAG_NOEXP | GL_EXACT,
&freeze_gh);
if (error && !gfs2_withdrawn(sdp))
return error;
@@ -761,8 +763,8 @@ void gfs2_freeze_func(struct work_struct *work)
struct super_block *sb = sdp->sd_vfs;
atomic_inc(&sb->s_active);
- error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, GL_EXACT,
- &freeze_gh);
+ error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED,
+ LM_FLAG_NOEXP | GL_EXACT, &freeze_gh);
if (error) {
fs_info(sdp, "GFS2: couldn't get freeze lock : %d\n", error);
gfs2_assert_withdraw(sdp, 0);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 055/244] arm64: Add MIDR value for KRYO4XX gold CPU cores
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 054/244] gfs2: The freeze glock should never be frozen Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 056/244] arm64: Add KRYO4XX gold CPU cores to erratum list 1463225 and 1418040 Greg Kroah-Hartman
` (189 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sai Prakash Ranjan, Will Deacon, Sasha Levin
From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
[ Upstream commit dce4f2807f6920bb907eb4cd4f95e7f42d918bc6 ]
Add MIDR value for KRYO4XX gold/big CPU cores which are
used in Qualcomm Technologies, Inc. SoCs. This will be
used to identify and apply erratum which are applicable
for these CPU cores.
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Link: https://lore.kernel.org/r/9093fb82e22441076280ca1b729242ffde80c432.1593539394.git.saiprakash.ranjan@codeaurora.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/cputype.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index a87a93f67671d..7219cddeba669 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -86,6 +86,7 @@
#define QCOM_CPU_PART_FALKOR 0xC00
#define QCOM_CPU_PART_KRYO 0x200
#define QCOM_CPU_PART_KRYO_3XX_SILVER 0x803
+#define QCOM_CPU_PART_KRYO_4XX_GOLD 0x804
#define QCOM_CPU_PART_KRYO_4XX_SILVER 0x805
#define NVIDIA_CPU_PART_DENVER 0x003
@@ -114,6 +115,7 @@
#define MIDR_QCOM_FALKOR MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR)
#define MIDR_QCOM_KRYO MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO)
#define MIDR_QCOM_KRYO_3XX_SILVER MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_3XX_SILVER)
+#define MIDR_QCOM_KRYO_4XX_GOLD MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_4XX_GOLD)
#define MIDR_QCOM_KRYO_4XX_SILVER MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_4XX_SILVER)
#define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER)
#define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL)
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 056/244] arm64: Add KRYO4XX gold CPU cores to erratum list 1463225 and 1418040
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 055/244] arm64: Add MIDR value for KRYO4XX gold CPU cores Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 057/244] arm64: Add KRYO4XX silver CPU cores to erratum list 1530923 and 1024718 Greg Kroah-Hartman
` (188 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sai Prakash Ranjan, Will Deacon, Sasha Levin
From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
[ Upstream commit a9e821b89daa55cc940c546b124101939d3f0451 ]
KRYO4XX gold/big CPU core revisions r0p0 to r3p1 are affected by
erratum 1463225 and 1418040, so add them to the respective list.
The variant and revision bits are implementation defined and are
different from the their Cortex CPU counterparts on which they are
based on, i.e., (r0p0 to r3p1) is equivalent to (rcpe to rfpf).
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Link: https://lore.kernel.org/r/83780e80c6377c12ca51b5d53186b61241685e49.1593539394.git.saiprakash.ranjan@codeaurora.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/arm64/silicon-errata.rst | 4 ++++
arch/arm64/kernel/cpu_errata.c | 19 +++++++++++++------
2 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst
index 2c08c628febdf..6902feba6b412 100644
--- a/Documentation/arm64/silicon-errata.rst
+++ b/Documentation/arm64/silicon-errata.rst
@@ -147,6 +147,10 @@ stable kernels.
+----------------+-----------------+-----------------+-----------------------------+
| Qualcomm Tech. | Falkor v{1,2} | E1041 | QCOM_FALKOR_ERRATUM_1041 |
+----------------+-----------------+-----------------+-----------------------------+
+| Qualcomm Tech. | Kryo4xx Gold | N/A | ARM64_ERRATUM_1463225 |
++----------------+-----------------+-----------------+-----------------------------+
+| Qualcomm Tech. | Kryo4xx Gold | N/A | ARM64_ERRATUM_1418040 |
++----------------+-----------------+-----------------+-----------------------------+
+----------------+-----------------+-----------------+-----------------------------+
| Fujitsu | A64FX | E#010001 | FUJITSU_ERRATUM_010001 |
+----------------+-----------------+-----------------+-----------------------------+
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 0f37045fafab3..e0f8474979b19 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -472,12 +472,7 @@ static bool
has_cortex_a76_erratum_1463225(const struct arm64_cpu_capabilities *entry,
int scope)
{
- u32 midr = read_cpuid_id();
- /* Cortex-A76 r0p0 - r3p1 */
- struct midr_range range = MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 1);
-
- WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible());
- return is_midr_in_range(midr, &range) && is_kernel_in_hyp_mode();
+ return is_affected_midr_range_list(entry, scope) && is_kernel_in_hyp_mode();
}
#endif
@@ -728,6 +723,8 @@ static const struct midr_range erratum_1418040_list[] = {
MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 1),
/* Neoverse-N1 r0p0 to r3p1 */
MIDR_RANGE(MIDR_NEOVERSE_N1, 0, 0, 3, 1),
+ /* Kryo4xx Gold (rcpe to rfpf) => (r0p0 to r3p1) */
+ MIDR_RANGE(MIDR_QCOM_KRYO_4XX_GOLD, 0xc, 0xe, 0xf, 0xf),
{},
};
#endif
@@ -773,6 +770,15 @@ static const struct midr_range erratum_speculative_at_vhe_list[] = {
};
#endif
+#ifdef CONFIG_ARM64_ERRATUM_1463225
+static const struct midr_range erratum_1463225[] = {
+ /* Cortex-A76 r0p0 - r3p1 */
+ MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 1),
+ /* Kryo4xx Gold (rcpe to rfpf) => (r0p0 to r3p1) */
+ MIDR_RANGE(MIDR_QCOM_KRYO_4XX_GOLD, 0xc, 0xe, 0xf, 0xf),
+};
+#endif
+
const struct arm64_cpu_capabilities arm64_errata[] = {
#ifdef CONFIG_ARM64_WORKAROUND_CLEAN_CACHE
{
@@ -912,6 +918,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
.capability = ARM64_WORKAROUND_1463225,
.type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
.matches = has_cortex_a76_erratum_1463225,
+ .midr_range_list = erratum_1463225,
},
#endif
#ifdef CONFIG_CAVIUM_TX2_ERRATUM_219
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 057/244] arm64: Add KRYO4XX silver CPU cores to erratum list 1530923 and 1024718
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 056/244] arm64: Add KRYO4XX gold CPU cores to erratum list 1463225 and 1418040 Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 058/244] i2c: eg20t: Load module automatically if ID matches Greg Kroah-Hartman
` (187 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sai Prakash Ranjan, Will Deacon, Sasha Levin
From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
[ Upstream commit 9b23d95c539ebc5d6d6b5d6f20d2d7922384e76e ]
KRYO4XX silver/LITTLE CPU cores with revision r1p0 are affected by
erratum 1530923 and 1024718, so add them to the respective list.
The variant and revision bits are implementation defined and are
different from the their Cortex CPU counterparts on which they are
based on, i.e., r1p0 is equivalent to rdpe.
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Link: https://lore.kernel.org/r/7013e8a3f857ca7e82863cc9e34a614293d7f80c.1593539394.git.saiprakash.ranjan@codeaurora.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/arm64/silicon-errata.rst | 4 ++++
arch/arm64/kernel/cpu_errata.c | 2 ++
arch/arm64/kernel/cpufeature.c | 2 ++
3 files changed, 8 insertions(+)
diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst
index 6902feba6b412..7dc8f8ac69eea 100644
--- a/Documentation/arm64/silicon-errata.rst
+++ b/Documentation/arm64/silicon-errata.rst
@@ -151,6 +151,10 @@ stable kernels.
+----------------+-----------------+-----------------+-----------------------------+
| Qualcomm Tech. | Kryo4xx Gold | N/A | ARM64_ERRATUM_1418040 |
+----------------+-----------------+-----------------+-----------------------------+
+| Qualcomm Tech. | Kryo4xx Silver | N/A | ARM64_ERRATUM_1530923 |
++----------------+-----------------+-----------------+-----------------------------+
+| Qualcomm Tech. | Kryo4xx Silver | N/A | ARM64_ERRATUM_1024718 |
++----------------+-----------------+-----------------+-----------------------------+
+----------------+-----------------+-----------------+-----------------------------+
| Fujitsu | A64FX | E#010001 | FUJITSU_ERRATUM_010001 |
+----------------+-----------------+-----------------+-----------------------------+
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index e0f8474979b19..dbf266212808e 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -765,6 +765,8 @@ static const struct midr_range erratum_speculative_at_vhe_list[] = {
#ifdef CONFIG_ARM64_ERRATUM_1530923
/* Cortex A55 r0p0 to r2p0 */
MIDR_RANGE(MIDR_CORTEX_A55, 0, 0, 2, 0),
+ /* Kryo4xx Silver (rdpe => r1p0) */
+ MIDR_REV(MIDR_QCOM_KRYO_4XX_SILVER, 0xd, 0xe),
#endif
{},
};
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index b0fb1d5bf2235..cadc9d9a7477b 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1177,6 +1177,8 @@ static bool cpu_has_broken_dbm(void)
static const struct midr_range cpus[] = {
#ifdef CONFIG_ARM64_ERRATUM_1024718
MIDR_RANGE(MIDR_CORTEX_A55, 0, 0, 1, 0), // A55 r0p0 -r1p0
+ /* Kryo4xx Silver (rdpe => r1p0) */
+ MIDR_REV(MIDR_QCOM_KRYO_4XX_SILVER, 0xd, 0xe),
#endif
{},
};
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 058/244] i2c: eg20t: Load module automatically if ID matches
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 057/244] arm64: Add KRYO4XX silver CPU cores to erratum list 1530923 and 1024718 Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 059/244] arm64/alternatives: dont patch up internal branches Greg Kroah-Hartman
` (186 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Wolfram Sang, Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 5f90786b31fb7d1e199a8999d46c4e3aea672e11 ]
The driver can't be loaded automatically because it misses
module alias to be provided. Add corresponding MODULE_DEVICE_TABLE()
call to the driver.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-eg20t.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index bb810dee8fb5e..73f139690e4e5 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -180,6 +180,7 @@ static const struct pci_device_id pch_pcidev_id[] = {
{ PCI_VDEVICE(ROHM, PCI_DEVICE_ID_ML7831_I2C), 1, },
{0,}
};
+MODULE_DEVICE_TABLE(pci, pch_pcidev_id);
static irqreturn_t pch_i2c_handler(int irq, void *pData);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 059/244] arm64/alternatives: dont patch up internal branches
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 058/244] i2c: eg20t: Load module automatically if ID matches Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 060/244] iio:magnetometer:ak8974: Fix alignment and data leak issues Greg Kroah-Hartman
` (185 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexandru Elisei, Ard Biesheuvel,
Will Deacon, Sasha Levin
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit 5679b28142193a62f6af93249c0477be9f0c669b ]
Commit f7b93d42945c ("arm64/alternatives: use subsections for replacement
sequences") moved the alternatives replacement sequences into subsections,
in order to keep the as close as possible to the code that they replace.
Unfortunately, this broke the logic in branch_insn_requires_update,
which assumed that any branch into kernel executable code was a branch
that required updating, which is no longer the case now that the code
sequences that are patched in are in the same section as the patch site
itself.
So the only way to discriminate branches that require updating and ones
that don't is to check whether the branch targets the replacement sequence
itself, and so we can drop the call to kernel_text_address() entirely.
Fixes: f7b93d42945c ("arm64/alternatives: use subsections for replacement sequences")
Reported-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Alexandru Elisei <alexandru.elisei@arm.com>
Link: https://lore.kernel.org/r/20200709125953.30918-1-ardb@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/alternative.c | 16 ++--------------
1 file changed, 2 insertions(+), 14 deletions(-)
diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c
index d1757ef1b1e74..73039949b5ce2 100644
--- a/arch/arm64/kernel/alternative.c
+++ b/arch/arm64/kernel/alternative.c
@@ -43,20 +43,8 @@ bool alternative_is_applied(u16 cpufeature)
*/
static bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc)
{
- unsigned long replptr;
-
- if (kernel_text_address(pc))
- return true;
-
- replptr = (unsigned long)ALT_REPL_PTR(alt);
- if (pc >= replptr && pc <= (replptr + alt->alt_len))
- return false;
-
- /*
- * Branching into *another* alternate sequence is doomed, and
- * we're not even trying to fix it up.
- */
- BUG();
+ unsigned long replptr = (unsigned long)ALT_REPL_PTR(alt);
+ return !(pc >= replptr && pc <= (replptr + alt->alt_len));
}
#define align_down(x, a) ((unsigned long)(x) & ~(((unsigned long)(a)) - 1))
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 060/244] iio:magnetometer:ak8974: Fix alignment and data leak issues
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 059/244] arm64/alternatives: dont patch up internal branches Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 061/244] iio:humidity:hdc100x " Greg Kroah-Hartman
` (184 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Linus Walleij,
Jonathan Cameron, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit 838e00b13bfd4cac8b24df25bfc58e2eb99bcc70 upstream.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc so no data can leak appart from
previous readings.
Fixes: 7c94a8b2ee8cf ("iio: magn: add a driver for AK8974")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/magnetometer/ak8974.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/iio/magnetometer/ak8974.c
+++ b/drivers/iio/magnetometer/ak8974.c
@@ -185,6 +185,11 @@ struct ak8974 {
bool drdy_irq;
struct completion drdy_complete;
bool drdy_active_low;
+ /* Ensure timestamp is naturally aligned */
+ struct {
+ __le16 channels[3];
+ s64 ts __aligned(8);
+ } scan;
};
static const char ak8974_reg_avdd[] = "avdd";
@@ -581,7 +586,6 @@ static void ak8974_fill_buffer(struct ii
{
struct ak8974 *ak8974 = iio_priv(indio_dev);
int ret;
- __le16 hw_values[8]; /* Three axes + 64bit padding */
pm_runtime_get_sync(&ak8974->i2c->dev);
mutex_lock(&ak8974->lock);
@@ -591,13 +595,13 @@ static void ak8974_fill_buffer(struct ii
dev_err(&ak8974->i2c->dev, "error triggering measure\n");
goto out_unlock;
}
- ret = ak8974_getresult(ak8974, hw_values);
+ ret = ak8974_getresult(ak8974, ak8974->scan.channels);
if (ret) {
dev_err(&ak8974->i2c->dev, "error getting measures\n");
goto out_unlock;
}
- iio_push_to_buffers_with_timestamp(indio_dev, hw_values,
+ iio_push_to_buffers_with_timestamp(indio_dev, &ak8974->scan,
iio_get_time_ns(indio_dev));
out_unlock:
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 061/244] iio:humidity:hdc100x Fix alignment and data leak issues
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 060/244] iio:magnetometer:ak8974: Fix alignment and data leak issues Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 062/244] iio: magnetometer: ak8974: Fix runtime PM imbalance on error Greg Kroah-Hartman
` (183 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Matt Ranostay,
Alison Schofield, Jonathan Cameron, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit ea5e7a7bb6205d24371373cd80325db1bc15eded upstream.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc so no data can leak apart
from previous readings.
Fixes: 16bf793f86b2 ("iio: humidity: hdc100x: add triggered buffer support for HDC100X")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
Cc: Alison Schofield <amsfield22@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/humidity/hdc100x.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/iio/humidity/hdc100x.c
+++ b/drivers/iio/humidity/hdc100x.c
@@ -38,6 +38,11 @@ struct hdc100x_data {
/* integration time of the sensor */
int adc_int_us[2];
+ /* Ensure natural alignment of timestamp */
+ struct {
+ __be16 channels[2];
+ s64 ts __aligned(8);
+ } scan;
};
/* integration time in us */
@@ -322,7 +327,6 @@ static irqreturn_t hdc100x_trigger_handl
struct i2c_client *client = data->client;
int delay = data->adc_int_us[0] + data->adc_int_us[1];
int ret;
- s16 buf[8]; /* 2x s16 + padding + 8 byte timestamp */
/* dual read starts at temp register */
mutex_lock(&data->lock);
@@ -333,13 +337,13 @@ static irqreturn_t hdc100x_trigger_handl
}
usleep_range(delay, delay + 1000);
- ret = i2c_master_recv(client, (u8 *)buf, 4);
+ ret = i2c_master_recv(client, (u8 *)data->scan.channels, 4);
if (ret < 0) {
dev_err(&client->dev, "cannot read sensor data\n");
goto err;
}
- iio_push_to_buffers_with_timestamp(indio_dev, buf,
+ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
iio_get_time_ns(indio_dev));
err:
mutex_unlock(&data->lock);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 062/244] iio: magnetometer: ak8974: Fix runtime PM imbalance on error
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 061/244] iio:humidity:hdc100x " Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 063/244] iio: core: add missing IIO_MOD_H2/ETHANOL string identifiers Greg Kroah-Hartman
` (182 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Linus Walleij, Stable,
Jonathan Cameron
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
commit 0187294d227dfc42889e1da8f8ce1e44fc25f147 upstream.
When devm_regmap_init_i2c() returns an error code, a pairing
runtime PM usage counter decrement is needed to keep the
counter balanced. For error paths after ak8974_set_power(),
ak8974_detect() and ak8974_reset(), things are the same.
However, When iio_triggered_buffer_setup() returns an error
code, there will be two PM usgae counter decrements.
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Fixes: 7c94a8b2ee8c ("iio: magn: add a driver for AK8974")
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/magnetometer/ak8974.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
--- a/drivers/iio/magnetometer/ak8974.c
+++ b/drivers/iio/magnetometer/ak8974.c
@@ -768,19 +768,21 @@ static int ak8974_probe(struct i2c_clien
ak8974->map = devm_regmap_init_i2c(i2c, &ak8974_regmap_config);
if (IS_ERR(ak8974->map)) {
dev_err(&i2c->dev, "failed to allocate register map\n");
+ pm_runtime_put_noidle(&i2c->dev);
+ pm_runtime_disable(&i2c->dev);
return PTR_ERR(ak8974->map);
}
ret = ak8974_set_power(ak8974, AK8974_PWR_ON);
if (ret) {
dev_err(&i2c->dev, "could not power on\n");
- goto power_off;
+ goto disable_pm;
}
ret = ak8974_detect(ak8974);
if (ret) {
dev_err(&i2c->dev, "neither AK8974 nor AMI30x found\n");
- goto power_off;
+ goto disable_pm;
}
ret = ak8974_selftest(ak8974);
@@ -790,14 +792,9 @@ static int ak8974_probe(struct i2c_clien
ret = ak8974_reset(ak8974);
if (ret) {
dev_err(&i2c->dev, "AK8974 reset failed\n");
- goto power_off;
+ goto disable_pm;
}
- pm_runtime_set_autosuspend_delay(&i2c->dev,
- AK8974_AUTOSUSPEND_DELAY);
- pm_runtime_use_autosuspend(&i2c->dev);
- pm_runtime_put(&i2c->dev);
-
indio_dev->dev.parent = &i2c->dev;
indio_dev->channels = ak8974_channels;
indio_dev->num_channels = ARRAY_SIZE(ak8974_channels);
@@ -850,6 +847,11 @@ no_irq:
goto cleanup_buffer;
}
+ pm_runtime_set_autosuspend_delay(&i2c->dev,
+ AK8974_AUTOSUSPEND_DELAY);
+ pm_runtime_use_autosuspend(&i2c->dev);
+ pm_runtime_put(&i2c->dev);
+
return 0;
cleanup_buffer:
@@ -858,7 +860,6 @@ disable_pm:
pm_runtime_put_noidle(&i2c->dev);
pm_runtime_disable(&i2c->dev);
ak8974_set_power(ak8974, AK8974_PWR_OFF);
-power_off:
regulator_bulk_disable(ARRAY_SIZE(ak8974->regs), ak8974->regs);
return ret;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 063/244] iio: core: add missing IIO_MOD_H2/ETHANOL string identifiers
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 062/244] iio: magnetometer: ak8974: Fix runtime PM imbalance on error Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 064/244] iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe() Greg Kroah-Hartman
` (181 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Matt Ranostay, Stable, Jonathan Cameron
From: Matt Ranostay <matt.ranostay@konsulko.com>
commit 25f02d3242ab4d16d0cee2dec0d89cedb3747fa9 upstream.
Add missing strings to iio_modifier_names[] for proper modification
of channels.
Fixes: b170f7d48443d (iio: Add modifiers for ethanol and H2 gases)
Signed-off-by: Matt Ranostay <matt.ranostay@konsulko.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -130,6 +130,8 @@ static const char * const iio_modifier_n
[IIO_MOD_PM2P5] = "pm2p5",
[IIO_MOD_PM4] = "pm4",
[IIO_MOD_PM10] = "pm10",
+ [IIO_MOD_ETHANOL] = "ethanol",
+ [IIO_MOD_H2] = "h2",
};
/* relies on pairs of these shared then separate */
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 064/244] iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 063/244] iio: core: add missing IIO_MOD_H2/ETHANOL string identifiers Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 065/244] iio: pressure: zpa2326: handle pm_runtime_get_sync failure Greg Kroah-Hartman
` (180 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Stable, Jonathan Cameron
From: Chuhong Yuan <hslester96@gmail.com>
commit d7369ae1f4d7cffa7574d15e1f787dcca184c49d upstream.
The function iio_device_register() was called in mma8452_probe().
But the function iio_device_unregister() was not called after
a call of the function mma8452_set_freefall_mode() failed.
Thus add the missed function call for one error case.
Fixes: 1a965d405fc6 ("drivers:iio:accel:mma8452: added cleanup provision in case of failure.")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/mma8452.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -1685,10 +1685,13 @@ static int mma8452_probe(struct i2c_clie
ret = mma8452_set_freefall_mode(data, false);
if (ret < 0)
- goto buffer_cleanup;
+ goto unregister_device;
return 0;
+unregister_device:
+ iio_device_unregister(indio_dev);
+
buffer_cleanup:
iio_triggered_buffer_cleanup(indio_dev);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 065/244] iio: pressure: zpa2326: handle pm_runtime_get_sync failure
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 064/244] iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe() Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 066/244] iio:humidity:hts221 Fix alignment and data leak issues Greg Kroah-Hartman
` (179 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Stable, Jonathan Cameron
From: Navid Emamdoost <navid.emamdoost@gmail.com>
commit d88de040e1df38414fc1e4380be9d0e997ab4d58 upstream.
Calling pm_runtime_get_sync increments the counter even in case of
failure, causing incorrect ref count. Call pm_runtime_put if
pm_runtime_get_sync fails.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Fixes: 03b262f2bbf4 ("iio:pressure: initial zpa2326 barometer support")
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/zpa2326.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/iio/pressure/zpa2326.c
+++ b/drivers/iio/pressure/zpa2326.c
@@ -664,8 +664,10 @@ static int zpa2326_resume(const struct i
int err;
err = pm_runtime_get_sync(indio_dev->dev.parent);
- if (err < 0)
+ if (err < 0) {
+ pm_runtime_put(indio_dev->dev.parent);
return err;
+ }
if (err > 0) {
/*
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 066/244] iio:humidity:hts221 Fix alignment and data leak issues
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 065/244] iio: pressure: zpa2326: handle pm_runtime_get_sync failure Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 067/244] iio:pressure:ms5611 Fix buffer element alignment Greg Kroah-Hartman
` (178 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Lorenzo Bianconi,
Jonathan Cameron, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit 5c49056ad9f3c786f7716da2dd47e4488fc6bd25 upstream.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc so no data can leak
apart from previous readings.
Explicit alignment of ts needed to ensure consistent padding
on all architectures (particularly x86_32 with it's 4 byte alignment
of s64)
Fixes: e4a70e3e7d84 ("iio: humidity: add support to hts221 rh/temp combo device")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/humidity/hts221.h | 7 +++++--
drivers/iio/humidity/hts221_buffer.c | 9 +++++----
2 files changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/iio/humidity/hts221.h
+++ b/drivers/iio/humidity/hts221.h
@@ -14,8 +14,6 @@
#include <linux/iio/iio.h>
-#define HTS221_DATA_SIZE 2
-
enum hts221_sensor_type {
HTS221_SENSOR_H,
HTS221_SENSOR_T,
@@ -39,6 +37,11 @@ struct hts221_hw {
bool enabled;
u8 odr;
+ /* Ensure natural alignment of timestamp */
+ struct {
+ __le16 channels[2];
+ s64 ts __aligned(8);
+ } scan;
};
extern const struct dev_pm_ops hts221_pm_ops;
--- a/drivers/iio/humidity/hts221_buffer.c
+++ b/drivers/iio/humidity/hts221_buffer.c
@@ -162,7 +162,6 @@ static const struct iio_buffer_setup_ops
static irqreturn_t hts221_buffer_handler_thread(int irq, void *p)
{
- u8 buffer[ALIGN(2 * HTS221_DATA_SIZE, sizeof(s64)) + sizeof(s64)];
struct iio_poll_func *pf = p;
struct iio_dev *iio_dev = pf->indio_dev;
struct hts221_hw *hw = iio_priv(iio_dev);
@@ -172,18 +171,20 @@ static irqreturn_t hts221_buffer_handler
/* humidity data */
ch = &iio_dev->channels[HTS221_SENSOR_H];
err = regmap_bulk_read(hw->regmap, ch->address,
- buffer, HTS221_DATA_SIZE);
+ &hw->scan.channels[0],
+ sizeof(hw->scan.channels[0]));
if (err < 0)
goto out;
/* temperature data */
ch = &iio_dev->channels[HTS221_SENSOR_T];
err = regmap_bulk_read(hw->regmap, ch->address,
- buffer + HTS221_DATA_SIZE, HTS221_DATA_SIZE);
+ &hw->scan.channels[1],
+ sizeof(hw->scan.channels[1]));
if (err < 0)
goto out;
- iio_push_to_buffers_with_timestamp(iio_dev, buffer,
+ iio_push_to_buffers_with_timestamp(iio_dev, &hw->scan,
iio_get_time_ns(iio_dev));
out:
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 067/244] iio:pressure:ms5611 Fix buffer element alignment
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 066/244] iio:humidity:hts221 Fix alignment and data leak issues Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 068/244] iio:health:afe4403 Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
` (177 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
Tomasz Duszynski, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit 8db4afe163bbdd93dca6fcefbb831ef12ecc6b4d upstream.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
Here there is no data leak possibility so use an explicit structure
on the stack to ensure alignment and nice readable fashion.
The forced alignment of ts isn't strictly necessary in this driver
as the padding will be correct anyway (there isn't any). However
it is probably less fragile to have it there and it acts as
documentation of the requirement.
Fixes: 713bbb4efb9dc ("iio: pressure: ms5611: Add triggered buffer support")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Tomasz Duszynski <tomasz.duszynski@octakon.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/ms5611_core.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/iio/pressure/ms5611_core.c
+++ b/drivers/iio/pressure/ms5611_core.c
@@ -212,16 +212,21 @@ static irqreturn_t ms5611_trigger_handle
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct ms5611_state *st = iio_priv(indio_dev);
- s32 buf[4]; /* s32 (pressure) + s32 (temp) + 2 * s32 (timestamp) */
+ /* Ensure buffer elements are naturally aligned */
+ struct {
+ s32 channels[2];
+ s64 ts __aligned(8);
+ } scan;
int ret;
mutex_lock(&st->lock);
- ret = ms5611_read_temp_and_pressure(indio_dev, &buf[1], &buf[0]);
+ ret = ms5611_read_temp_and_pressure(indio_dev, &scan.channels[1],
+ &scan.channels[0]);
mutex_unlock(&st->lock);
if (ret < 0)
goto err;
- iio_push_to_buffers_with_timestamp(indio_dev, buf,
+ iio_push_to_buffers_with_timestamp(indio_dev, &scan,
iio_get_time_ns(indio_dev));
err:
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 068/244] iio:health:afe4403 Fix timestamp alignment and prevent data leak.
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 067/244] iio:pressure:ms5611 Fix buffer element alignment Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 069/244] arm64: Add missing sentinel to erratum_1463225 Greg Kroah-Hartman
` (176 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
Andrew F. Davis, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit 3f9c6d38797e9903937b007a341dad0c251765d6 upstream.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses a 32 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested. This data is allocated with kzalloc so no
data can leak appart from previous readings.
Fixes: eec96d1e2d31 ("iio: health: Add driver for the TI AFE4403 heart monitor")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Andrew F. Davis <afd@ti.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/health/afe4403.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/drivers/iio/health/afe4403.c
+++ b/drivers/iio/health/afe4403.c
@@ -63,6 +63,7 @@ static const struct reg_field afe4403_re
* @regulator: Pointer to the regulator for the IC
* @trig: IIO trigger for this device
* @irq: ADC_RDY line interrupt number
+ * @buffer: Used to construct data layout to push into IIO buffer.
*/
struct afe4403_data {
struct device *dev;
@@ -72,6 +73,8 @@ struct afe4403_data {
struct regulator *regulator;
struct iio_trigger *trig;
int irq;
+ /* Ensure suitable alignment for timestamp */
+ s32 buffer[8] __aligned(8);
};
enum afe4403_chan_id {
@@ -309,7 +312,6 @@ static irqreturn_t afe4403_trigger_handl
struct iio_dev *indio_dev = pf->indio_dev;
struct afe4403_data *afe = iio_priv(indio_dev);
int ret, bit, i = 0;
- s32 buffer[8];
u8 tx[4] = {AFE440X_CONTROL0, 0x0, 0x0, AFE440X_CONTROL0_READ};
u8 rx[3];
@@ -326,9 +328,9 @@ static irqreturn_t afe4403_trigger_handl
if (ret)
goto err;
- buffer[i++] = (rx[0] << 16) |
- (rx[1] << 8) |
- (rx[2]);
+ afe->buffer[i++] = (rx[0] << 16) |
+ (rx[1] << 8) |
+ (rx[2]);
}
/* Disable reading from the device */
@@ -337,7 +339,8 @@ static irqreturn_t afe4403_trigger_handl
if (ret)
goto err;
- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp);
+ iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer,
+ pf->timestamp);
err:
iio_trigger_notify_done(indio_dev->trig);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 069/244] arm64: Add missing sentinel to erratum_1463225
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 068/244] iio:health:afe4403 Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 070/244] xen/xenbus: Fix a double free in xenbus_map_ring_pv() Greg Kroah-Hartman
` (175 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Sai Prakash Ranjan,
Will Deacon, Sasha Levin
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit 09c717c92b52df54918e12cbfe6a4658233fda69 ]
When the erratum_1463225 array was introduced a sentinel at the end was
missing thus causing a KASAN: global-out-of-bounds in
is_affected_midr_range_list on arm64 error.
Fixes: a9e821b89daa ("arm64: Add KRYO4XX gold CPU cores to erratum list 1463225 and 1418040")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Link: https://lore.kernel.org/linux-arm-kernel/CA+G9fYs3EavpU89-rTQfqQ9GgxAMgMAk7jiiVrfP0yxj5s+Q6g@mail.gmail.com/
Link: https://lore.kernel.org/r/20200709051345.14544-1-f.fainelli@gmail.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/cpu_errata.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index dbf266212808e..f9387c1252325 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -778,6 +778,7 @@ static const struct midr_range erratum_1463225[] = {
MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 1),
/* Kryo4xx Gold (rcpe to rfpf) => (r0p0 to r3p1) */
MIDR_RANGE(MIDR_QCOM_KRYO_4XX_GOLD, 0xc, 0xe, 0xf, 0xf),
+ {},
};
#endif
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 070/244] xen/xenbus: Fix a double free in xenbus_map_ring_pv()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 069/244] arm64: Add missing sentinel to erratum_1463225 Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 071/244] net: ethernet: mvneta: Do not error out in non serdes modes Greg Kroah-Hartman
` (174 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Juergen Gross,
Boris Ostrovsky, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit ba8c423488974f02b538e9dc1730f0334f9b85aa ]
When there is an error the caller frees "info->node" so the free here
will result in a double free. We should just delete first kfree().
Fixes: 3848e4e0a32a ("xen/xenbus: avoid large structs and arrays on the stack")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200710113610.GA92345@mwanda
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/xenbus/xenbus_client.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 4f168b46fbca5..786fbb7d8be06 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -693,10 +693,8 @@ static int xenbus_map_ring_pv(struct xenbus_device *dev,
bool leaked;
area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, info->ptes);
- if (!area) {
- kfree(node);
+ if (!area)
return -ENOMEM;
- }
for (i = 0; i < nr_grefs; i++)
info->phys_addrs[i] =
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 071/244] net: ethernet: mvneta: Do not error out in non serdes modes
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 070/244] xen/xenbus: Fix a double free in xenbus_map_ring_pv() Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 072/244] net: ethernet: mvneta: Add back interface mode validation Greg Kroah-Hartman
` (173 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sascha Hauer, Russell King,
David S. Miller, Sasha Levin
From: Sascha Hauer <s.hauer@pengutronix.de>
[ Upstream commit d3d239dcb8aae6d7b10642d292b404e57604f7ea ]
In mvneta_config_interface() the RGMII modes are catched by the default
case which is an error return. The RGMII modes are valid modes for the
driver, so instead of returning an error add a break statement to return
successfully.
This avoids this warning for non comphy SoCs which use RGMII, like
SolidRun Clearfog:
WARNING: CPU: 0 PID: 268 at drivers/net/ethernet/marvell/mvneta.c:3512 mvneta_start_dev+0x220/0x23c
Fixes: b4748553f53f ("net: ethernet: mvneta: Fix Serdes configuration for SoCs without comphy")
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Reviewed-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/mvneta.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index cf26cf4e47aa8..7faeb4bfc282e 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -3565,7 +3565,7 @@ static int mvneta_config_interface(struct mvneta_port *pp,
MVNETA_HSGMII_SERDES_PROTO);
break;
default:
- return -EINVAL;
+ break;
}
}
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 072/244] net: ethernet: mvneta: Add back interface mode validation
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 071/244] net: ethernet: mvneta: Do not error out in non serdes modes Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 073/244] scsi: qla2xxx: make 1-bit bit-fields unsigned int Greg Kroah-Hartman
` (172 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sascha Hauer, Russell King,
David S. Miller, Sasha Levin
From: Sascha Hauer <s.hauer@pengutronix.de>
[ Upstream commit 41c2b6b4f0f807803bb49f65835d136941a70f85 ]
When writing the serdes configuration register was moved to
mvneta_config_interface() the whole code block was removed from
mvneta_port_power_up() in the assumption that its only purpose was to
write the serdes configuration register. As mentioned by Russell King
its purpose was also to check for valid interface modes early so that
later in the driver we do not have to care for unexpected interface
modes.
Add back the test to let the driver bail out early on unhandled
interface modes.
Fixes: b4748553f53f ("net: ethernet: mvneta: Fix Serdes configuration for SoCs without comphy")
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Reviewed-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/mvneta.c | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 7faeb4bfc282e..b2da295e2fc01 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -5003,10 +5003,18 @@ static void mvneta_conf_mbus_windows(struct mvneta_port *pp,
}
/* Power up the port */
-static void mvneta_port_power_up(struct mvneta_port *pp, int phy_mode)
+static int mvneta_port_power_up(struct mvneta_port *pp, int phy_mode)
{
/* MAC Cause register should be cleared */
mvreg_write(pp, MVNETA_UNIT_INTR_CAUSE, 0);
+
+ if (phy_mode != PHY_INTERFACE_MODE_QSGMII &&
+ phy_mode != PHY_INTERFACE_MODE_SGMII &&
+ !phy_interface_mode_is_8023z(phy_mode) &&
+ !phy_interface_mode_is_rgmii(phy_mode))
+ return -EINVAL;
+
+ return 0;
}
/* Device initialization routine */
@@ -5192,7 +5200,11 @@ static int mvneta_probe(struct platform_device *pdev)
if (err < 0)
goto err_netdev;
- mvneta_port_power_up(pp, phy_mode);
+ err = mvneta_port_power_up(pp, pp->phy_interface);
+ if (err < 0) {
+ dev_err(&pdev->dev, "can't power up port\n");
+ return err;
+ }
/* Armada3700 network controller does not support per-cpu
* operation, so only single NAPI should be initialized.
@@ -5346,7 +5358,11 @@ static int mvneta_resume(struct device *device)
}
}
mvneta_defaults_set(pp);
- mvneta_port_power_up(pp, pp->phy_interface);
+ err = mvneta_port_power_up(pp, pp->phy_interface);
+ if (err < 0) {
+ dev_err(device, "can't power up port\n");
+ return err;
+ }
netif_device_attach(dev);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 073/244] scsi: qla2xxx: make 1-bit bit-fields unsigned int
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 072/244] net: ethernet: mvneta: Add back interface mode validation Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 074/244] spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI transfer Greg Kroah-Hartman
` (171 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Himanshu Madhani,
Colin Ian King, Martin K. Petersen, Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 78b874b7cbf09fbfadfa5f18a347ebef7bbb49fe ]
The bitfields mpi_fw_dump_reading and mpi_fw_dumped are currently signed
which is not recommended as the representation is an implementation defined
behaviour. Fix this by making the bit-fields unsigned ints.
Link: https://lore.kernel.org/r/20200428102013.1040598-1-colin.king@canonical.com
Fixes: cbb01c2f2f63 ("scsi: qla2xxx: Fix MPI failure AEN (8200) handling")
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_def.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index daa9e936887bb..172ea4e5887d9 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -4248,8 +4248,8 @@ struct qla_hw_data {
int fw_dump_reading;
void *mpi_fw_dump;
u32 mpi_fw_dump_len;
- int mpi_fw_dump_reading:1;
- int mpi_fw_dumped:1;
+ unsigned int mpi_fw_dump_reading:1;
+ unsigned int mpi_fw_dumped:1;
int prev_minidump_failed;
dma_addr_t eft_dma;
void *eft;
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 074/244] spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI transfer
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 073/244] scsi: qla2xxx: make 1-bit bit-fields unsigned int Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 075/244] io_uring: fix recvmsg memory leak with buffer selection Greg Kroah-Hartman
` (170 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, Krzysztof Kozlowski,
Vladimir Oltean, Mark Brown, Sasha Levin
From: Krzysztof Kozlowski <krzk@kernel.org>
[ Upstream commit 3c525b69e8c1a9a6944e976603c7a1a713e728f9 ]
During shutdown, the driver should unregister the SPI controller
and stop the hardware. Otherwise the dspi_transfer_one_message() could
wait on completion infinitely.
Additionally, calling spi_unregister_controller() first in device
shutdown reverse-matches the probe function, where SPI controller is
registered at the end.
Fixes: dc234825997e ("spi: spi-fsl-dspi: Adding shutdown hook")
Reported-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200622110543.5035-2-krzk@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-fsl-dspi.c | 15 +--------------
1 file changed, 1 insertion(+), 14 deletions(-)
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 38d337f0967db..e0b30e4b1b695 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -1461,20 +1461,7 @@ static int dspi_remove(struct platform_device *pdev)
static void dspi_shutdown(struct platform_device *pdev)
{
- struct spi_controller *ctlr = platform_get_drvdata(pdev);
- struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr);
-
- /* Disable RX and TX */
- regmap_update_bits(dspi->regmap, SPI_MCR,
- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF,
- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF);
-
- /* Stop Running */
- regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, SPI_MCR_HALT);
-
- dspi_release_dma(dspi);
- clk_disable_unprepare(dspi->clk);
- spi_unregister_controller(dspi->ctlr);
+ dspi_remove(pdev);
}
static struct platform_driver fsl_dspi_driver = {
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 075/244] io_uring: fix recvmsg memory leak with buffer selection
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 074/244] spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI transfer Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 076/244] Input: mms114 - add extra compatible for mms345l Greg Kroah-Hartman
` (169 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Begunkov, Jens Axboe
From: Pavel Begunkov <asml.silence@gmail.com>
commit 681fda8d27a66f7e65ff7f2d200d7635e64a8d05 upstream.
io_recvmsg() doesn't free memory allocated for struct io_buffer. This can
causes a leak when used with automatic buffer selection.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/io_uring.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3884,10 +3884,16 @@ static int io_recvmsg(struct io_kiocb *r
ret = __sys_recvmsg_sock(sock, &kmsg->msg, req->sr_msg.msg,
kmsg->uaddr, flags);
- if (force_nonblock && ret == -EAGAIN)
- return io_setup_async_msg(req, kmsg);
+ if (force_nonblock && ret == -EAGAIN) {
+ ret = io_setup_async_msg(req, kmsg);
+ if (ret != -EAGAIN)
+ kfree(kbuf);
+ return ret;
+ }
if (ret == -ERESTARTSYS)
ret = -EINTR;
+ if (kbuf)
+ kfree(kbuf);
}
if (kmsg && kmsg->iov != kmsg->fast_iov)
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 076/244] Input: mms114 - add extra compatible for mms345l
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 075/244] io_uring: fix recvmsg memory leak with buffer selection Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 077/244] iio:health:afe4404 Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
` (168 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stephan Gerhold, Andi Shyti,
Dmitry Torokhov, Sasha Levin
From: Stephan Gerhold <stephan@gerhold.net>
[ Upstream commit 7842087b0196d674ed877d768de8f2a34d7fdc53 ]
MMS345L is another first generation touch screen from Melfas,
which uses mostly the same registers as MMS152.
However, there is some garbage printed during initialization.
Apparently MMS345L does not have the MMS152_COMPAT_GROUP register
that is read+printed during initialization.
TSP FW Rev: bootloader 0x6 / core 0x26 / config 0x26, Compat group: \x06
On earlier kernel versions the compat group was actually printed as
an ASCII control character, seems like it gets escaped now.
But we probably shouldn't print something from a random register.
Add a separate "melfas,mms345l" compatible that avoids reading
from the MMS152_COMPAT_GROUP register. This might also help in case
there is some other device-specific quirk in the future.
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Reviewed-by: Andi Shyti <andi@etezian.org>
Link: https://lore.kernel.org/r/20200423102431.2715-1-stephan@gerhold.net
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/touchscreen/mms114.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
index 2ef1adaed9afb..5bdf4ac1a3033 100644
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -54,6 +54,7 @@
enum mms_type {
TYPE_MMS114 = 114,
TYPE_MMS152 = 152,
+ TYPE_MMS345L = 345,
};
struct mms114_data {
@@ -250,6 +251,15 @@ static int mms114_get_version(struct mms114_data *data)
int error;
switch (data->type) {
+ case TYPE_MMS345L:
+ error = __mms114_read_reg(data, MMS152_FW_REV, 3, buf);
+ if (error)
+ return error;
+
+ dev_info(dev, "TSP FW Rev: bootloader 0x%x / core 0x%x / config 0x%x\n",
+ buf[0], buf[1], buf[2]);
+ break;
+
case TYPE_MMS152:
error = __mms114_read_reg(data, MMS152_FW_REV, 3, buf);
if (error)
@@ -287,8 +297,8 @@ static int mms114_setup_regs(struct mms114_data *data)
if (error < 0)
return error;
- /* MMS152 has no configuration or power on registers */
- if (data->type == TYPE_MMS152)
+ /* Only MMS114 has configuration and power on registers */
+ if (data->type != TYPE_MMS114)
return 0;
error = mms114_set_active(data, true);
@@ -597,6 +607,9 @@ static const struct of_device_id mms114_dt_match[] = {
}, {
.compatible = "melfas,mms152",
.data = (void *)TYPE_MMS152,
+ }, {
+ .compatible = "melfas,mms345l",
+ .data = (void *)TYPE_MMS345L,
},
{ }
};
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 077/244] iio:health:afe4404 Fix timestamp alignment and prevent data leak.
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 076/244] Input: mms114 - add extra compatible for mms345l Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 078/244] counter: 104-quad-8: Add lock guards - differential encoder Greg Kroah-Hartman
` (167 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
Andrew F. Davis, Sasha Levin
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[ Upstream commit f88ecccac4be348bbcc6d056bdbc622a8955c04d ]
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses a 40 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested. This data is allocated with kzalloc so no
data can leak appart from previous readings.
Fixes: 87aec56e27ef ("iio: health: Add driver for the TI AFE4404 heart monitor")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/health/afe4404.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c
index e728bbb21ca88..cebb1fd4d0b15 100644
--- a/drivers/iio/health/afe4404.c
+++ b/drivers/iio/health/afe4404.c
@@ -83,6 +83,7 @@ static const struct reg_field afe4404_reg_fields[] = {
* @regulator: Pointer to the regulator for the IC
* @trig: IIO trigger for this device
* @irq: ADC_RDY line interrupt number
+ * @buffer: Used to construct a scan to push to the iio buffer.
*/
struct afe4404_data {
struct device *dev;
@@ -91,6 +92,7 @@ struct afe4404_data {
struct regulator *regulator;
struct iio_trigger *trig;
int irq;
+ s32 buffer[10] __aligned(8);
};
enum afe4404_chan_id {
@@ -328,17 +330,17 @@ static irqreturn_t afe4404_trigger_handler(int irq, void *private)
struct iio_dev *indio_dev = pf->indio_dev;
struct afe4404_data *afe = iio_priv(indio_dev);
int ret, bit, i = 0;
- s32 buffer[10];
for_each_set_bit(bit, indio_dev->active_scan_mask,
indio_dev->masklength) {
ret = regmap_read(afe->regmap, afe4404_channel_values[bit],
- &buffer[i++]);
+ &afe->buffer[i++]);
if (ret)
goto err;
}
- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp);
+ iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer,
+ pf->timestamp);
err:
iio_trigger_notify_done(indio_dev->trig);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 078/244] counter: 104-quad-8: Add lock guards - differential encoder
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 077/244] iio:health:afe4404 Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 079/244] counter: 104-quad-8: Add lock guards - filter clock prescaler Greg Kroah-Hartman
` (166 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Syed Nayyar Waris, Jonathan Cameron,
Sasha Levin
From: Syed Nayyar Waris <syednwaris@gmail.com>
[ Upstream commit 708d98932893cea609386cefdfd190f757f5a61c ]
Add lock protection from race conditions to 104-quad-8 counter driver
for differential encoder status code changes. Mutex lock calls used for
protection.
Signed-off-by: Syed Nayyar Waris <syednwaris@gmail.com>
Fixes: 954ab5cc5f3e ("counter: 104-quad-8: Support Differential Encoder Cable Status")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/counter/104-quad-8.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/counter/104-quad-8.c b/drivers/counter/104-quad-8.c
index aa13708c2bc30..9364dc188f8ff 100644
--- a/drivers/counter/104-quad-8.c
+++ b/drivers/counter/104-quad-8.c
@@ -1274,18 +1274,26 @@ static ssize_t quad8_signal_cable_fault_read(struct counter_device *counter,
struct counter_signal *signal,
void *private, char *buf)
{
- const struct quad8_iio *const priv = counter->priv;
+ struct quad8_iio *const priv = counter->priv;
const size_t channel_id = signal->id / 2;
- const bool disabled = !(priv->cable_fault_enable & BIT(channel_id));
+ bool disabled;
unsigned int status;
unsigned int fault;
- if (disabled)
+ mutex_lock(&priv->lock);
+
+ disabled = !(priv->cable_fault_enable & BIT(channel_id));
+
+ if (disabled) {
+ mutex_unlock(&priv->lock);
return -EINVAL;
+ }
/* Logic 0 = cable fault */
status = inb(priv->base + QUAD8_DIFF_ENCODER_CABLE_STATUS);
+ mutex_unlock(&priv->lock);
+
/* Mask respective channel and invert logic */
fault = !(status & BIT(channel_id));
@@ -1317,6 +1325,8 @@ static ssize_t quad8_signal_cable_fault_enable_write(
if (ret)
return ret;
+ mutex_lock(&priv->lock);
+
if (enable)
priv->cable_fault_enable |= BIT(channel_id);
else
@@ -1327,6 +1337,8 @@ static ssize_t quad8_signal_cable_fault_enable_write(
outb(cable_fault_enable, priv->base + QUAD8_DIFF_ENCODER_CABLE_STATUS);
+ mutex_unlock(&priv->lock);
+
return len;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 079/244] counter: 104-quad-8: Add lock guards - filter clock prescaler
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 078/244] counter: 104-quad-8: Add lock guards - differential encoder Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 080/244] dmaengine: ti: k3-udma: Use correct node to read "ti,udma-atype" Greg Kroah-Hartman
` (165 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Syed Nayyar Waris, Jonathan Cameron,
Sasha Levin
From: Syed Nayyar Waris <syednwaris@gmail.com>
[ Upstream commit d5ed76adb926a90fada98f518abc1ab6ef07d28f ]
Add lock protection from race conditions to the 104-quad-8 counter
driver for filter clock prescaler code changes. Mutex calls used for
protection.
Signed-off-by: Syed Nayyar Waris <syednwaris@gmail.com>
Fixes: de65d0556343 ("counter: 104-quad-8: Support Filter Clock Prescaler")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/counter/104-quad-8.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/counter/104-quad-8.c b/drivers/counter/104-quad-8.c
index 9364dc188f8ff..d22cfae1b0198 100644
--- a/drivers/counter/104-quad-8.c
+++ b/drivers/counter/104-quad-8.c
@@ -1365,6 +1365,8 @@ static ssize_t quad8_signal_fck_prescaler_write(struct counter_device *counter,
if (ret)
return ret;
+ mutex_lock(&priv->lock);
+
priv->fck_prescaler[channel_id] = prescaler;
/* Reset Byte Pointer */
@@ -1375,6 +1377,8 @@ static ssize_t quad8_signal_fck_prescaler_write(struct counter_device *counter,
outb(QUAD8_CTR_RLD | QUAD8_RLD_RESET_BP | QUAD8_RLD_PRESET_PSC,
base_offset + 1);
+ mutex_unlock(&priv->lock);
+
return len;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 080/244] dmaengine: ti: k3-udma: Use correct node to read "ti,udma-atype"
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 079/244] counter: 104-quad-8: Add lock guards - filter clock prescaler Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 081/244] soundwire: intel: fix memory leak with devm_kasprintf Greg Kroah-Hartman
` (164 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Vinod Koul, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
[ Upstream commit 9f2f3ce3daed229eecf647acac44defbdee1f7c0 ]
The "ti,udma-atype" property is expected in the UDMA node and not in the
parent navss node.
Fixes: 0ebcf1a274c5 ("dmaengine: ti: k3-udma: Implement support for atype (for virtualization)")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Link: https://lore.kernel.org/r/20200527065357.30791-1-peter.ujfalusi@ti.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/ti/k3-udma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index a90e154b0ae0d..baf7ab64f1d7d 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -3609,7 +3609,7 @@ static int udma_probe(struct platform_device *pdev)
return ret;
}
- ret = of_property_read_u32(navss_node, "ti,udma-atype", &ud->atype);
+ ret = of_property_read_u32(dev->of_node, "ti,udma-atype", &ud->atype);
if (!ret && ud->atype > 2) {
dev_err(dev, "Invalid atype: %u\n", ud->atype);
return -EINVAL;
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 081/244] soundwire: intel: fix memory leak with devm_kasprintf
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 080/244] dmaengine: ti: k3-udma: Use correct node to read "ti,udma-atype" Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 082/244] dmaengine: idxd: fix cdev locking for open and release Greg Kroah-Hartman
` (163 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pierre-Louis Bossart, Daniel Baluta,
Kai Vehmanen, Rander Wang, Guennadi Liakhovetski, Bard Liao,
Vinod Koul, Sasha Levin
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
[ Upstream commit bf6d6e68d2028a2d82f4c106f50ec75cc1e6ef89 ]
The dais are allocated with devm_kcalloc() but their name isn't
resourced managed and never freed. Fix by also using devm_ for the dai
names as well.
Fixes: c46302ec554c5 ('soundwire: intel: Add audio DAI ops')
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Daniel Baluta <daniel.baluta@gmail.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@linux.intel.com>
Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20200617163536.17401-1-pierre-louis.bossart@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soundwire/intel.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
index 3c83e76c6bf90..cab425070e641 100644
--- a/drivers/soundwire/intel.c
+++ b/drivers/soundwire/intel.c
@@ -930,8 +930,9 @@ static int intel_create_dai(struct sdw_cdns *cdns,
/* TODO: Read supported rates/formats from hardware */
for (i = off; i < (off + num); i++) {
- dais[i].name = kasprintf(GFP_KERNEL, "SDW%d Pin%d",
- cdns->instance, i);
+ dais[i].name = devm_kasprintf(cdns->dev, GFP_KERNEL,
+ "SDW%d Pin%d",
+ cdns->instance, i);
if (!dais[i].name)
return -ENOMEM;
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 082/244] dmaengine: idxd: fix cdev locking for open and release
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 081/244] soundwire: intel: fix memory leak with devm_kasprintf Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 083/244] dmaengine: ti: k3-udma: Fix delayed_work usage for tx drain workaround Greg Kroah-Hartman
` (162 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nikhil Rao, Dave Jiang, Vinod Koul,
Sasha Levin
From: Nikhil Rao <nikhil.rao@intel.com>
[ Upstream commit 66983bc18fad17d10766650b3685045f6f092d73 ]
add the wq lock in cdev open and release call. This fixes
race conditions observed in the open and close routines.
Fixes: 42d279f9137a ("dmaengine: idxd: add char driver to expose submission portal to userland")
Signed-off-by: Nikhil Rao <nikhil.rao@intel.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/159285824892.64944.2905413694915141834.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/idxd/cdev.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
index ff49847e37a86..cb376cf6a2d2c 100644
--- a/drivers/dma/idxd/cdev.c
+++ b/drivers/dma/idxd/cdev.c
@@ -74,6 +74,7 @@ static int idxd_cdev_open(struct inode *inode, struct file *filp)
struct idxd_device *idxd;
struct idxd_wq *wq;
struct device *dev;
+ int rc = 0;
wq = inode_wq(inode);
idxd = wq->idxd;
@@ -81,17 +82,27 @@ static int idxd_cdev_open(struct inode *inode, struct file *filp)
dev_dbg(dev, "%s called: %d\n", __func__, idxd_wq_refcount(wq));
- if (idxd_wq_refcount(wq) > 0 && wq_dedicated(wq))
- return -EBUSY;
-
ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
if (!ctx)
return -ENOMEM;
+ mutex_lock(&wq->wq_lock);
+
+ if (idxd_wq_refcount(wq) > 0 && wq_dedicated(wq)) {
+ rc = -EBUSY;
+ goto failed;
+ }
+
ctx->wq = wq;
filp->private_data = ctx;
idxd_wq_get(wq);
+ mutex_unlock(&wq->wq_lock);
return 0;
+
+ failed:
+ mutex_unlock(&wq->wq_lock);
+ kfree(ctx);
+ return rc;
}
static int idxd_cdev_release(struct inode *node, struct file *filep)
@@ -105,7 +116,9 @@ static int idxd_cdev_release(struct inode *node, struct file *filep)
filep->private_data = NULL;
kfree(ctx);
+ mutex_lock(&wq->wq_lock);
idxd_wq_put(wq);
+ mutex_unlock(&wq->wq_lock);
return 0;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 083/244] dmaengine: ti: k3-udma: Fix delayed_work usage for tx drain workaround
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 082/244] dmaengine: idxd: fix cdev locking for open and release Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 084/244] dmaengine: sh: usb-dmac: set tx_result parameters Greg Kroah-Hartman
` (161 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tomi Valkeinen, Peter Ujfalusi,
Vinod Koul, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
[ Upstream commit d964d5ff68dba21b53368656adec3fb5f50426bb ]
INIT_DELAYED_WORK_ONSTACK() must be used with on-stack delayed work, which
is not the case here.
Use normal delayed_work for the channels instead.
Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA")
Reported-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Link: https://lore.kernel.org/r/20200618114004.6268-1-peter.ujfalusi@ti.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/ti/k3-udma.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index baf7ab64f1d7d..9760d67aa612a 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -1925,8 +1925,6 @@ static int udma_alloc_chan_resources(struct dma_chan *chan)
udma_reset_rings(uc);
- INIT_DELAYED_WORK_ONSTACK(&uc->tx_drain.work,
- udma_check_tx_completion);
return 0;
err_irq_free:
@@ -3038,7 +3036,6 @@ static void udma_free_chan_resources(struct dma_chan *chan)
}
cancel_delayed_work_sync(&uc->tx_drain.work);
- destroy_delayed_work_on_stack(&uc->tx_drain.work);
if (uc->irq_num_ring > 0) {
free_irq(uc->irq_num_ring, uc);
@@ -3727,6 +3724,7 @@ static int udma_probe(struct platform_device *pdev)
tasklet_init(&uc->vc.task, udma_vchan_complete,
(unsigned long)&uc->vc);
init_completion(&uc->teardown_completed);
+ INIT_DELAYED_WORK(&uc->tx_drain.work, udma_check_tx_completion);
}
ret = dma_async_device_register(&ud->ddev);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 084/244] dmaengine: sh: usb-dmac: set tx_result parameters
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 083/244] dmaengine: ti: k3-udma: Fix delayed_work usage for tx drain workaround Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 085/244] phy: rockchip: Fix return value of inno_dsidphy_probe() Greg Kroah-Hartman
` (160 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hien Dang, Yoshihiro Shimoda,
Vinod Koul, Sasha Levin
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
[ Upstream commit 466257d9968ac79575831250b039dc07566c7b13 ]
A client driver (renesas_usbhs) assumed that
dmaengine_tx_status() could return the residue even if
the transfer was completed. However, this was not correct
usage [1] and this caused to break getting the residue after
the commit 24461d9792c2 ("dmaengine: virt-dma: Fix access after
free in vchan_complete()") actually. So, this is possible to get
wrong received size if the usb controller gets a short packet.
For example, g_zero driver causes "bad OUT byte" errors.
To use the tx_result from the renesas_usbhs driver when
the transfer is completed, set the tx_result parameters.
Notes that the renesas_usbhs driver needs to update for it.
[1]
https://lore.kernel.org/dmaengine/20200616165550.GP2324254@vkoul-mobl/
Reported-by: Hien Dang <hien.dang.eb@renesas.com>
Fixes: 24461d9792c2 ("dmaengine: virt-dma: Fix access after free in vchan_complete()")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1592482053-19433-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/sh/usb-dmac.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index b218a013c2600..8f7ceb698226c 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -586,6 +586,8 @@ static void usb_dmac_isr_transfer_end(struct usb_dmac_chan *chan)
desc->residue = usb_dmac_get_current_residue(chan, desc,
desc->sg_index - 1);
desc->done_cookie = desc->vd.tx.cookie;
+ desc->vd.tx_result.result = DMA_TRANS_NOERROR;
+ desc->vd.tx_result.residue = desc->residue;
vchan_cookie_complete(&desc->vd);
/* Restart the next transfer if this driver has a next desc */
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 085/244] phy: rockchip: Fix return value of inno_dsidphy_probe()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 084/244] dmaengine: sh: usb-dmac: set tx_result parameters Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 086/244] phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked Greg Kroah-Hartman
` (159 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tiezhu Yang, Heiko Stuebner,
Vinod Koul, Sasha Levin
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit fdc355a03df537bc8d8909b86d1688fe07c7032b ]
When call function devm_platform_ioremap_resource(), we should use IS_ERR()
to check the return value and return PTR_ERR() if failed.
Fixes: b7535a3bc0ba ("phy/rockchip: Add support for Innosilicon MIPI/LVDS/TTL PHY")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Link: https://lore.kernel.org/r/1590412138-13903-1-git-send-email-yangtiezhu@loongson.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-inno-dsidphy.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/rockchip/phy-rockchip-inno-dsidphy.c b/drivers/phy/rockchip/phy-rockchip-inno-dsidphy.c
index a7c6c940a3a8c..8af8c6c5cc028 100644
--- a/drivers/phy/rockchip/phy-rockchip-inno-dsidphy.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-dsidphy.c
@@ -607,8 +607,8 @@ static int inno_dsidphy_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, inno);
inno->phy_base = devm_platform_ioremap_resource(pdev, 0);
- if (!inno->phy_base)
- return -ENOMEM;
+ if (IS_ERR(inno->phy_base))
+ return PTR_ERR(inno->phy_base);
inno->ref_clk = devm_clk_get(dev, "ref");
if (IS_ERR(inno->ref_clk)) {
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 086/244] phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 085/244] phy: rockchip: Fix return value of inno_dsidphy_probe() Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 087/244] arm64: dts: meson: add missing gxl rng clock Greg Kroah-Hartman
` (158 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Vinod Koul, Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 38b1927e5bf9bcad4a2e33189ef1c5569f9599ba ]
Currently pointer phy0 is being dereferenced via the assignment of
phy on the call to phy_get_drvdata before phy0 is null checked, this
can lead to a null pointer dereference. Fix this by performing the
null check on phy0 before the call to phy_get_drvdata. Also replace
the phy0 == NULL check with the more usual !phy0 idiom.
Addresses-Coverity: ("Dereference before null check")
Fixes: e6f32efb1b12 ("phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20200625124428.83564-1-colin.king@canonical.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/allwinner/phy-sun4i-usb.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
index 8569273822487..e5842e48a5e07 100644
--- a/drivers/phy/allwinner/phy-sun4i-usb.c
+++ b/drivers/phy/allwinner/phy-sun4i-usb.c
@@ -545,13 +545,14 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
struct sun4i_usb_phy_data *data =
container_of(work, struct sun4i_usb_phy_data, detect.work);
struct phy *phy0 = data->phys[0].phy;
- struct sun4i_usb_phy *phy = phy_get_drvdata(phy0);
+ struct sun4i_usb_phy *phy;
bool force_session_end, id_notify = false, vbus_notify = false;
int id_det, vbus_det;
- if (phy0 == NULL)
+ if (!phy0)
return;
+ phy = phy_get_drvdata(phy0);
id_det = sun4i_usb_phy0_get_id_det(data);
vbus_det = sun4i_usb_phy0_get_vbus_det(data);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 087/244] arm64: dts: meson: add missing gxl rng clock
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 086/244] phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:35 ` [PATCH 5.7 088/244] arm64: dts: meson-gxl-s805x: reduce initial Mali450 core frequency Greg Kroah-Hartman
` (157 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jerome Brunet, Kevin Hilman,
Neil Armstrong, Sasha Levin
From: Jerome Brunet <jbrunet@baylibre.com>
[ Upstream commit 95ca6f06dd4827ff63be5154120c7a8511cd9a41 ]
The peripheral clock of the RNG is missing for gxl while it is present
for gxbb.
Fixes: 1b3f6d148692 ("ARM64: dts: meson-gx: add clock CLKID_RNG0 to hwrng node")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20200617125346.1163527-1-jbrunet@baylibre.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
index 259d863993905..887c43119e632 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -298,6 +298,11 @@ clkc: clock-controller {
};
};
+&hwrng {
+ clocks = <&clkc CLKID_RNG0>;
+ clock-names = "core";
+};
+
&i2c_A {
clocks = <&clkc CLKID_I2C>;
};
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 088/244] arm64: dts: meson-gxl-s805x: reduce initial Mali450 core frequency
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 087/244] arm64: dts: meson: add missing gxl rng clock Greg Kroah-Hartman
@ 2020-07-20 15:35 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 089/244] dmaengine: idxd: cleanup workqueue config after disabling Greg Kroah-Hartman
` (156 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Neil Armstrong, Kevin Hilman, Sasha Levin
From: Neil Armstrong <narmstrong@baylibre.com>
[ Upstream commit b2037dafcf082cd24b88ae9283af628235df36e1 ]
When starting at 744MHz, the Mali 450 core crashes on S805X based boards:
lima d00c0000.gpu: IRQ ppmmu3 not found
lima d00c0000.gpu: IRQ ppmmu4 not found
lima d00c0000.gpu: IRQ ppmmu5 not found
lima d00c0000.gpu: IRQ ppmmu6 not found
lima d00c0000.gpu: IRQ ppmmu7 not found
Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.7.2+ #492
Hardware name: Libre Computer AML-S805X-AC (DT)
pstate: 40000005 (nZcv daif -PAN -UAO)
pc : lima_gp_init+0x28/0x188
...
Call trace:
lima_gp_init+0x28/0x188
lima_device_init+0x334/0x534
lima_pdev_probe+0xa4/0xe4
...
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
Reverting to a safer 666Mhz frequency on the S805X that doesn't use the
GP0 PLL makes it more stable.
Fixes: fd47716479f5 ("ARM64: dts: add S805X based P241 board")
Fixes: 0449b8e371ac ("arm64: dts: meson: add libretech aml-s805x-ac board")
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/20200618132737.14243-1-narmstrong@baylibre.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amlogic/meson-gxl-s805x-libretech-ac.dts | 2 +-
.../boot/dts/amlogic/meson-gxl-s805x-p241.dts | 2 +-
.../boot/dts/amlogic/meson-gxl-s805x.dtsi | 24 +++++++++++++++++++
3 files changed, 26 insertions(+), 2 deletions(-)
create mode 100644 arch/arm64/boot/dts/amlogic/meson-gxl-s805x.dtsi
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-libretech-ac.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-libretech-ac.dts
index 4d59494965966..c6ae5622a532e 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-libretech-ac.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-libretech-ac.dts
@@ -9,7 +9,7 @@
#include <dt-bindings/input/input.h>
-#include "meson-gxl-s905x.dtsi"
+#include "meson-gxl-s805x.dtsi"
/ {
compatible = "libretech,aml-s805x-ac", "amlogic,s805x",
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-p241.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-p241.dts
index a1119cfb0280c..85f78a9454074 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-p241.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-p241.dts
@@ -9,7 +9,7 @@
#include <dt-bindings/input/input.h>
-#include "meson-gxl-s905x.dtsi"
+#include "meson-gxl-s805x.dtsi"
/ {
compatible = "amlogic,p241", "amlogic,s805x", "amlogic,meson-gxl";
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s805x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x.dtsi
new file mode 100644
index 0000000000000..f9d705648426e
--- /dev/null
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x.dtsi
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * Copyright (c) 2020 BayLibre SAS
+ * Author: Neil Armstrong <narmstrong@baylibre.com>
+ */
+
+#include "meson-gxl-s905x.dtsi"
+
+/ {
+ compatible = "amlogic,s805x", "amlogic,meson-gxl";
+};
+
+/* The S805X Package doesn't seem to handle the 744MHz OPP correctly */
+&mali {
+ assigned-clocks = <&clkc CLKID_MALI_0_SEL>,
+ <&clkc CLKID_MALI_0>,
+ <&clkc CLKID_MALI>; /* Glitch free mux */
+ assigned-clock-parents = <&clkc CLKID_FCLK_DIV3>,
+ <0>, /* Do Nothing */
+ <&clkc CLKID_MALI_0>;
+ assigned-clock-rates = <0>, /* Do Nothing */
+ <666666666>,
+ <0>; /* Do Nothing */
+};
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 089/244] dmaengine: idxd: cleanup workqueue config after disabling
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2020-07-20 15:35 ` [PATCH 5.7 088/244] arm64: dts: meson-gxl-s805x: reduce initial Mali450 core frequency Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 090/244] dmaengine: idxd: fix misc interrupt handler thread unmasking Greg Kroah-Hartman
` (155 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yixin Zhang, Dave Jiang, Vinod Koul,
Sasha Levin
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit da32b28c95a79e399e18c03f8178f41aec9c66e4 ]
After disabling a device, we should clean up the internal state for
the wqs and zero out the configuration registers. Without doing so can cause
issues when the user reprogram the wqs.
Fixes: c52ca478233c ("dmaengine: idxd: add configuration component of driver")
Reported-by: Yixin Zhang <yixin.zhang@intel.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Tested-by: Yixin Zhang <yixin.zhang@intel.com>
Link: https://lore.kernel.org/r/159311264246.1198.11955791213681679428.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/idxd/device.c | 25 +++++++++++++++++++++++++
drivers/dma/idxd/idxd.h | 1 +
drivers/dma/idxd/sysfs.c | 5 +++++
3 files changed, 31 insertions(+)
diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
index 8d79a8787104d..8d2718c585dc6 100644
--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -320,6 +320,31 @@ void idxd_wq_unmap_portal(struct idxd_wq *wq)
devm_iounmap(dev, wq->dportal);
}
+void idxd_wq_disable_cleanup(struct idxd_wq *wq)
+{
+ struct idxd_device *idxd = wq->idxd;
+ struct device *dev = &idxd->pdev->dev;
+ int i, wq_offset;
+
+ lockdep_assert_held(&idxd->dev_lock);
+ memset(&wq->wqcfg, 0, sizeof(wq->wqcfg));
+ wq->type = IDXD_WQT_NONE;
+ wq->size = 0;
+ wq->group = NULL;
+ wq->threshold = 0;
+ wq->priority = 0;
+ clear_bit(WQ_FLAG_DEDICATED, &wq->flags);
+ memset(wq->name, 0, WQ_NAME_SIZE);
+
+ for (i = 0; i < 8; i++) {
+ wq_offset = idxd->wqcfg_offset + wq->id * 32 + i * sizeof(u32);
+ iowrite32(0, idxd->reg_base + wq_offset);
+ dev_dbg(dev, "WQ[%d][%d][%#x]: %#x\n",
+ wq->id, i, wq_offset,
+ ioread32(idxd->reg_base + wq_offset));
+ }
+}
+
/* Device control bits */
static inline bool idxd_is_enabled(struct idxd_device *idxd)
{
diff --git a/drivers/dma/idxd/idxd.h b/drivers/dma/idxd/idxd.h
index b8f8a363b4a71..908c8d0ef3ab6 100644
--- a/drivers/dma/idxd/idxd.h
+++ b/drivers/dma/idxd/idxd.h
@@ -290,6 +290,7 @@ int idxd_wq_enable(struct idxd_wq *wq);
int idxd_wq_disable(struct idxd_wq *wq);
int idxd_wq_map_portal(struct idxd_wq *wq);
void idxd_wq_unmap_portal(struct idxd_wq *wq);
+void idxd_wq_disable_cleanup(struct idxd_wq *wq);
/* submission */
int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc);
diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
index 3999827970aba..fbb455ece81e8 100644
--- a/drivers/dma/idxd/sysfs.c
+++ b/drivers/dma/idxd/sysfs.c
@@ -315,6 +315,11 @@ static int idxd_config_bus_remove(struct device *dev)
idxd_unregister_dma_device(idxd);
spin_lock_irqsave(&idxd->dev_lock, flags);
rc = idxd_device_disable(idxd);
+ for (i = 0; i < idxd->max_wqs; i++) {
+ struct idxd_wq *wq = &idxd->wqs[i];
+
+ idxd_wq_disable_cleanup(wq);
+ }
spin_unlock_irqrestore(&idxd->dev_lock, flags);
module_put(THIS_MODULE);
if (rc < 0)
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 090/244] dmaengine: idxd: fix misc interrupt handler thread unmasking
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 089/244] dmaengine: idxd: cleanup workqueue config after disabling Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 091/244] bus: ti-sysc: Fix wakeirq sleeping function called from invalid context Greg Kroah-Hartman
` (154 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Jiang, Vinod Koul, Sasha Levin
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit e3122822a74033ba8d6d9af855078f9ab741e33f ]
Fix unmasking of misc interrupt handler when completing normal. It exits
early and skips the unmasking with the current implementation. Fix to
unmask interrupt when exiting normally.
Fixes: bfe1d56091c1 ("dmaengine: idxd: Init and probe for Intel data accelerators")
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/159311256528.855.11527922406329728512.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/idxd/irq.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c
index 6510791b9921b..8a35f58da6890 100644
--- a/drivers/dma/idxd/irq.c
+++ b/drivers/dma/idxd/irq.c
@@ -141,7 +141,7 @@ irqreturn_t idxd_misc_thread(int vec, void *data)
iowrite32(cause, idxd->reg_base + IDXD_INTCAUSE_OFFSET);
if (!err)
- return IRQ_HANDLED;
+ goto out;
gensts.bits = ioread32(idxd->reg_base + IDXD_GENSTATS_OFFSET);
if (gensts.state == IDXD_DEVICE_STATE_HALT) {
@@ -162,6 +162,7 @@ irqreturn_t idxd_misc_thread(int vec, void *data)
spin_unlock_bh(&idxd->dev_lock);
}
+ out:
idxd_unmask_msix_vector(idxd, irq_entry->id);
return IRQ_HANDLED;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 091/244] bus: ti-sysc: Fix wakeirq sleeping function called from invalid context
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 090/244] dmaengine: idxd: fix misc interrupt handler thread unmasking Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 092/244] bus: ti-sysc: Fix sleeping function called from invalid context for RTC quirk Greg Kroah-Hartman
` (153 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 9f9113925018d500a95df539014d9ff11ac2c02d ]
With CONFIG_DEBUG_ATOMIC_SLEEP enabled we can see the following with
wakeirqs and serial console idled:
BUG: sleeping function called from invalid context at drivers/bus/ti-sysc.c:242
...
(sysc_wait_softreset) from [<c0606894>] (sysc_enable_module+0x48/0x274)
(sysc_enable_module) from [<c0606c5c>] (sysc_runtime_resume+0x19c/0x1d8)
(sysc_runtime_resume) from [<c0606cf0>] (sysc_child_runtime_resume+0x58/0x84)
(sysc_child_runtime_resume) from [<c06eb7bc>] (__rpm_callback+0x30/0x12c)
(__rpm_callback) from [<c06eb8d8>] (rpm_callback+0x20/0x80)
(rpm_callback) from [<c06eb434>] (rpm_resume+0x638/0x7fc)
(rpm_resume) from [<c06eb658>] (__pm_runtime_resume+0x60/0x9c)
(__pm_runtime_resume) from [<c06edc08>] (handle_threaded_wake_irq+0x24/0x60)
(handle_threaded_wake_irq) from [<c01befec>] (irq_thread_fn+0x1c/0x78)
(irq_thread_fn) from [<c01bf30c>] (irq_thread+0x140/0x26c)
We have __pm_runtime_resume() call the sysc_runtime_resume() with spinlock
held and interrupts disabled.
Fixes: d46f9fbec719 ("bus: ti-sysc: Use optional clocks on for enable and wait for softreset bit")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/ti-sysc.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index db9541f385055..a160c3a1f09a3 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -236,15 +236,14 @@ static int sysc_wait_softreset(struct sysc *ddata)
syss_done = ddata->cfg.syss_mask;
if (syss_offset >= 0) {
- error = readx_poll_timeout(sysc_read_sysstatus, ddata, rstval,
- (rstval & ddata->cfg.syss_mask) ==
- syss_done,
- 100, MAX_MODULE_SOFTRESET_WAIT);
+ error = readx_poll_timeout_atomic(sysc_read_sysstatus, ddata,
+ rstval, (rstval & ddata->cfg.syss_mask) ==
+ syss_done, 100, MAX_MODULE_SOFTRESET_WAIT);
} else if (ddata->cfg.quirks & SYSC_QUIRK_RESET_STATUS) {
- error = readx_poll_timeout(sysc_read_sysconfig, ddata, rstval,
- !(rstval & sysc_mask),
- 100, MAX_MODULE_SOFTRESET_WAIT);
+ error = readx_poll_timeout_atomic(sysc_read_sysconfig, ddata,
+ rstval, !(rstval & sysc_mask),
+ 100, MAX_MODULE_SOFTRESET_WAIT);
}
return error;
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 092/244] bus: ti-sysc: Fix sleeping function called from invalid context for RTC quirk
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 091/244] bus: ti-sysc: Fix wakeirq sleeping function called from invalid context Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 093/244] bus: ti-sysc: Do not disable on suspend for no-idle Greg Kroah-Hartman
` (152 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit afe6f1eeb08f85e57f0a02b71efb5a0839606aac ]
With CONFIG_DEBUG_ATOMIC_SLEEP enabled we can see the following with RTC probe:
BUG: sleeping function called from invalid context at drivers/bus/ti-sysc.c:1736
...
(sysc_quirk_rtc) from [<c060d01c>] (sysc_write_sysconfig+0x1c/0x60)
(sysc_write_sysconfig) from [<c060d9f4>] (sysc_enable_module+0x11c/0x274)
(sysc_enable_module) from [<c060f37c>] (sysc_probe+0xe9c/0x1380)
(sysc_probe) from [<c06e9384>] (platform_drv_probe+0x48/0x98)
Fixes: e8639e1c986a ("bus: ti-sysc: Handle module unlock quirk needed for some RTC")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/ti-sysc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index a160c3a1f09a3..a3a279f30177c 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -1727,8 +1727,8 @@ static void sysc_quirk_rtc(struct sysc *ddata, bool lock)
local_irq_save(flags);
/* RTC_STATUS BUSY bit may stay active for 1/32768 seconds (~30 usec) */
- error = readl_poll_timeout(ddata->module_va + 0x44, val,
- !(val & BIT(0)), 100, 50);
+ error = readl_poll_timeout_atomic(ddata->module_va + 0x44, val,
+ !(val & BIT(0)), 100, 50);
if (error)
dev_warn(ddata->dev, "rtc busy timeout\n");
/* Now we have ~15 microseconds to read/write various registers */
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 093/244] bus: ti-sysc: Do not disable on suspend for no-idle
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 092/244] bus: ti-sysc: Fix sleeping function called from invalid context for RTC quirk Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 094/244] iio: adc: ad7780: Fix a resource handling path in ad7780_probe() Greg Kroah-Hartman
` (151 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Grygorii Strashko, Tony Lindgren,
Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit a55de412228cc5a2b4bf8d2a09849898102633e2 ]
If we have "ti,no-idle" specified for a module we must not disable
the the module on suspend to keep things backwards compatible.
Fixes: 386cb76681ca ("bus: ti-sysc: Handle missed no-idle property in addition to no-idle-on-init")
Reported-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/ti-sysc.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index a3a279f30177c..3b0417a014946 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -1278,7 +1278,8 @@ static int __maybe_unused sysc_noirq_suspend(struct device *dev)
ddata = dev_get_drvdata(dev);
- if (ddata->cfg.quirks & SYSC_QUIRK_LEGACY_IDLE)
+ if (ddata->cfg.quirks &
+ (SYSC_QUIRK_LEGACY_IDLE | SYSC_QUIRK_NO_IDLE))
return 0;
return pm_runtime_force_suspend(dev);
@@ -1290,7 +1291,8 @@ static int __maybe_unused sysc_noirq_resume(struct device *dev)
ddata = dev_get_drvdata(dev);
- if (ddata->cfg.quirks & SYSC_QUIRK_LEGACY_IDLE)
+ if (ddata->cfg.quirks &
+ (SYSC_QUIRK_LEGACY_IDLE | SYSC_QUIRK_NO_IDLE))
return 0;
return pm_runtime_force_resume(dev);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 094/244] iio: adc: ad7780: Fix a resource handling path in ad7780_probe()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 093/244] bus: ti-sysc: Do not disable on suspend for no-idle Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 095/244] dmaengine: dw: Initialize channel before each transfer Greg Kroah-Hartman
` (150 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Renato Lui Geh,
Jonathan Cameron, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit b0536f9826a5ed3328d527b4fc1686867a9f3041 ]
If 'ad7780_init_gpios()' fails, we must not release some resources that
have not been allocated yet. Return directly instead.
Fixes: 5bb30e7daf00 ("staging: iio: ad7780: move regulator to after GPIO init")
Fixes: 9085daa4abcc ("staging: iio: ad7780: add gain & filter gpio support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Renato Lui Geh <renatogeh@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ad7780.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/adc/ad7780.c b/drivers/iio/adc/ad7780.c
index 291c1a898129d..643771ed3f835 100644
--- a/drivers/iio/adc/ad7780.c
+++ b/drivers/iio/adc/ad7780.c
@@ -310,7 +310,7 @@ static int ad7780_probe(struct spi_device *spi)
ret = ad7780_init_gpios(&spi->dev, st);
if (ret)
- goto error_cleanup_buffer_and_trigger;
+ return ret;
st->reg = devm_regulator_get(&spi->dev, "avdd");
if (IS_ERR(st->reg))
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 095/244] dmaengine: dw: Initialize channel before each transfer
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 094/244] iio: adc: ad7780: Fix a resource handling path in ad7780_probe() Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 096/244] dmaengine: dmatest: stop completed threads when running without set channel Greg Kroah-Hartman
` (149 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Andy Shevchenko,
Viresh Kumar, Vinod Koul, Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 99ba8b9b0d9780e9937eb1d488d120e9e5c2533d ]
In some cases DMA can be used only with a consumer which does runtime power
management and on the platforms, that have DMA auto power gating logic
(see comments in the drivers/acpi/acpi_lpss.c), may result in DMA losing
its context. Simple mitigation of this issue is to initialize channel
each time the consumer initiates a transfer.
Fixes: cfdf5b6cc598 ("dw_dmac: add support for Lynxpoint DMA controllers")
Reported-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206403
Link: https://lore.kernel.org/r/20200705115620.51929-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw/core.c | 12 ------------
1 file changed, 12 deletions(-)
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index 21cb2a58dbd29..a1b56f52db2f2 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -118,16 +118,11 @@ static void dwc_initialize(struct dw_dma_chan *dwc)
{
struct dw_dma *dw = to_dw_dma(dwc->chan.device);
- if (test_bit(DW_DMA_IS_INITIALIZED, &dwc->flags))
- return;
-
dw->initialize_chan(dwc);
/* Enable interrupts */
channel_set_bit(dw, MASK.XFER, dwc->mask);
channel_set_bit(dw, MASK.ERROR, dwc->mask);
-
- set_bit(DW_DMA_IS_INITIALIZED, &dwc->flags);
}
/*----------------------------------------------------------------------*/
@@ -954,8 +949,6 @@ static void dwc_issue_pending(struct dma_chan *chan)
void do_dw_dma_off(struct dw_dma *dw)
{
- unsigned int i;
-
dma_writel(dw, CFG, 0);
channel_clear_bit(dw, MASK.XFER, dw->all_chan_mask);
@@ -966,9 +959,6 @@ void do_dw_dma_off(struct dw_dma *dw)
while (dma_readl(dw, CFG) & DW_CFG_DMA_EN)
cpu_relax();
-
- for (i = 0; i < dw->dma.chancnt; i++)
- clear_bit(DW_DMA_IS_INITIALIZED, &dw->chan[i].flags);
}
void do_dw_dma_on(struct dw_dma *dw)
@@ -1032,8 +1022,6 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
/* Clear custom channel configuration */
memset(&dwc->dws, 0, sizeof(struct dw_dma_slave));
- clear_bit(DW_DMA_IS_INITIALIZED, &dwc->flags);
-
/* Disable interrupts */
channel_clear_bit(dw, MASK.XFER, dwc->mask);
channel_clear_bit(dw, MASK.BLOCK, dwc->mask);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 096/244] dmaengine: dmatest: stop completed threads when running without set channel
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 095/244] dmaengine: dw: Initialize channel before each transfer Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 097/244] spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate Greg Kroah-Hartman
` (148 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Grygorii Strashko, Peter Ujfalusi,
Vinod Koul, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
[ Upstream commit fd17d1abce426b4224a916a242b57be94272771b ]
The completed threads were not cleared and consequent run would result
threads accumulating:
echo 800000 > /sys/module/dmatest/parameters/test_buf_size
echo 2000 > /sys/module/dmatest/parameters/timeout
echo 50 > /sys/module/dmatest/parameters/iterations
echo 1 > /sys/module/dmatest/parameters/max_channels
echo "" > /sys/module/dmatest/parameters/channel
[ 237.507265] dmatest: Added 1 threads using dma1chan2
echo 1 > /sys/module/dmatest/parameters/run
[ 244.713360] dmatest: Started 1 threads using dma1chan2
[ 246.117680] dmatest: dma1chan2-copy0: summary 50 tests, 0 failures 2437.47 iops 977623 KB/s (0)
echo 1 > /sys/module/dmatest/parameters/run
[ 292.381471] dmatest: No channels configured, continue with any
[ 292.389307] dmatest: Added 1 threads using dma1chan3
[ 292.394302] dmatest: Started 1 threads using dma1chan2
[ 292.399454] dmatest: Started 1 threads using dma1chan3
[ 293.800835] dmatest: dma1chan3-copy0: summary 50 tests, 0 failures 2624.53 iops 975014 KB/s (0)
echo 1 > /sys/module/dmatest/parameters/run
[ 307.301429] dmatest: No channels configured, continue with any
[ 307.309212] dmatest: Added 1 threads using dma1chan4
[ 307.314197] dmatest: Started 1 threads using dma1chan2
[ 307.319343] dmatest: Started 1 threads using dma1chan3
[ 307.324492] dmatest: Started 1 threads using dma1chan4
[ 308.730773] dmatest: dma1chan4-copy0: summary 50 tests, 0 failures 2390.28 iops 965436 KB/s (0)
Fixes: 6b41030fdc79 ("dmaengine: dmatest: Restore default for channel")
Reported-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Link: https://lore.kernel.org/r/20200701101225.8607-1-peter.ujfalusi@ti.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dmatest.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 0425984db118a..62d9825a49e9d 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -1168,6 +1168,8 @@ static int dmatest_run_set(const char *val, const struct kernel_param *kp)
} else if (dmatest_run) {
if (!is_threaded_test_pending(info)) {
pr_info("No channels configured, continue with any\n");
+ if (!is_threaded_test_run(info))
+ stop_threaded_test(info);
add_threaded_test(info);
}
start_threaded_tests(info);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 097/244] spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 096/244] dmaengine: dmatest: stop completed threads when running without set channel Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 098/244] usb: gadget: udc: atmel: fix uninitialized read in debug printk Greg Kroah-Hartman
` (147 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marc Kleine-Budde, Maxime Ripard,
Mark Brown, Sasha Levin
From: Marc Kleine-Budde <mkl@pengutronix.de>
[ Upstream commit ed7815db70d17b1741883f2da8e1d80bc2efe517 ]
A SPI transfer defines the _maximum_ speed of the SPI transfer. However the
driver doesn't take into account that the clock divider is always rounded down
(due to integer arithmetics). This results in a too high clock rate for the SPI
transfer.
E.g.: with a mclk_rate of 24 MHz and a SPI transfer speed of 10 MHz, the
original code calculates a reg of "0", which results in a effective divider of
"2" and a 12 MHz clock for the SPI transfer.
This patch fixes the issue by using DIV_ROUND_UP() instead of a plain
integer division.
While there simplify the divider calculation for the CDR1 case, use
order_base_2() instead of two ilog2() calculations.
Fixes: 3558fe900e8a ("spi: sunxi: Add Allwinner A31 SPI controller driver")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Acked-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20200706143443.9855-2-mkl@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sun6i.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
index ec7967be9e2f5..956df79035d56 100644
--- a/drivers/spi/spi-sun6i.c
+++ b/drivers/spi/spi-sun6i.c
@@ -198,7 +198,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
struct spi_transfer *tfr)
{
struct sun6i_spi *sspi = spi_master_get_devdata(master);
- unsigned int mclk_rate, div, timeout;
+ unsigned int mclk_rate, div, div_cdr1, div_cdr2, timeout;
unsigned int start, end, tx_time;
unsigned int trig_level;
unsigned int tx_len = 0;
@@ -287,14 +287,12 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
* First try CDR2, and if we can't reach the expected
* frequency, fall back to CDR1.
*/
- div = mclk_rate / (2 * tfr->speed_hz);
- if (div <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) {
- if (div > 0)
- div--;
-
- reg = SUN6I_CLK_CTL_CDR2(div) | SUN6I_CLK_CTL_DRS;
+ div_cdr1 = DIV_ROUND_UP(mclk_rate, tfr->speed_hz);
+ div_cdr2 = DIV_ROUND_UP(div_cdr1, 2);
+ if (div_cdr2 <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) {
+ reg = SUN6I_CLK_CTL_CDR2(div_cdr2 - 1) | SUN6I_CLK_CTL_DRS;
} else {
- div = ilog2(mclk_rate) - ilog2(tfr->speed_hz);
+ div = min(SUN6I_CLK_CTL_CDR1_MASK, order_base_2(div_cdr1));
reg = SUN6I_CLK_CTL_CDR1(div);
}
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 098/244] usb: gadget: udc: atmel: fix uninitialized read in debug printk
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 097/244] spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 099/244] staging: comedi: verify array index is correct before using it Greg Kroah-Hartman
` (146 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michał Mirosław,
Felipe Balbi, Sasha Levin
From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
[ Upstream commit 30517ffeb3bff842e1355cbc32f1959d9dbb5414 ]
Fixed commit moved the assignment of 'req', but did not update a
reference in the DBG() call. Use the argument as it was renamed.
Fixes: 5fb694f96e7c ("usb: gadget: udc: atmel: fix possible oops when unloading module")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index b771a854e29c3..cfdc66e118717 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -871,7 +871,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
u32 status;
DBG(DBG_GADGET | DBG_QUEUE, "ep_dequeue: %s, req %p\n",
- ep->ep.name, req);
+ ep->ep.name, _req);
spin_lock_irqsave(&udc->lock, flags);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 099/244] staging: comedi: verify array index is correct before using it
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 098/244] usb: gadget: udc: atmel: fix uninitialized read in debug printk Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 100/244] serial: core: Initialise spin lock before use in uart_configure_port() Greg Kroah-Hartman
` (145 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Ian Abbott, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit ef75e14a6c935eec82abac07ab68e388514e39bc ]
This code reads from the array before verifying that "trig" is a valid
index. If the index is wildly out of bounds then reading from an
invalid address could lead to an Oops.
Fixes: a8c66b684efa ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20200709102936.GA20875@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/comedi/drivers/addi_apci_1500.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
index 45ad4ba92f94f..689acd69a1b9c 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
@@ -456,9 +456,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
unsigned int lo_mask = data[5] << shift;
unsigned int chan_mask = hi_mask | lo_mask;
unsigned int old_mask = (1 << shift) - 1;
- unsigned int pm = devpriv->pm[trig] & old_mask;
- unsigned int pt = devpriv->pt[trig] & old_mask;
- unsigned int pp = devpriv->pp[trig] & old_mask;
+ unsigned int pm;
+ unsigned int pt;
+ unsigned int pp;
if (trig > 1) {
dev_dbg(dev->class_dev,
@@ -471,6 +471,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
return -EINVAL;
}
+ pm = devpriv->pm[trig] & old_mask;
+ pt = devpriv->pt[trig] & old_mask;
+ pp = devpriv->pp[trig] & old_mask;
+
switch (data[2]) {
case COMEDI_DIGITAL_TRIG_DISABLE:
/* clear trigger configuration */
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 100/244] serial: core: Initialise spin lock before use in uart_configure_port()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 099/244] staging: comedi: verify array index is correct before using it Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 101/244] clk: mvebu: ARMADA_AP_CPU_CLK needs to select ARMADA_AP_CP_HELPER Greg Kroah-Hartman
` (144 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Lad Prabhakar,
Guenter Roeck, Anatoly Pugachev, Tony Lindgren,
Geert Uytterhoeven, Andy Shevchenko, Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit f743061a85f5e9989df22ccbf07c80c98fc90e08 ]
The comment near to uart_port_spin_lock_init() says:
Ensure that the serial console lock is initialised early.
If this port is a console, then the spinlock is already initialised.
and there is nothing about enabled or disabled consoles. The commit
a3cb39d258ef ("serial: core: Allow detach and attach serial device
for console") made a change, which follows the comment, and also to
prevent reinitialisation of the lock in use, when user detaches and
attaches back the same console device. But this change discovers
another issue, that uart_add_one_port() tries to access a spin lock
that now may be uninitialised. This happens when a driver expects
the serial core to register a console on its behalf. In this case
we must initialise a spin lock before use.
Fixes: a3cb39d258ef ("serial: core: Allow detach and attach serial device for console")
Reported-by: Marc Zyngier <maz@kernel.org>
Reported-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reported-by: Guenter Roeck <linux@roeck-us.net>
Reported-by: Anatoly Pugachev <matorola@gmail.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Tested-by: Tony Lindgren <tony@atomide.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://lore.kernel.org/r/20200706214903.56148-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/serial_core.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 66a5e2faf57ea..ca5e6212bf1ce 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1916,6 +1916,12 @@ static inline bool uart_console_enabled(struct uart_port *port)
return uart_console(port) && (port->cons->flags & CON_ENABLED);
}
+static void __uart_port_spin_lock_init(struct uart_port *port)
+{
+ spin_lock_init(&port->lock);
+ lockdep_set_class(&port->lock, &port_lock_key);
+}
+
/*
* Ensure that the serial console lock is initialised early.
* If this port is a console, then the spinlock is already initialised.
@@ -1925,8 +1931,7 @@ static inline void uart_port_spin_lock_init(struct uart_port *port)
if (uart_console(port))
return;
- spin_lock_init(&port->lock);
- lockdep_set_class(&port->lock, &port_lock_key);
+ __uart_port_spin_lock_init(port);
}
#if defined(CONFIG_SERIAL_CORE_CONSOLE) || defined(CONFIG_CONSOLE_POLL)
@@ -2372,6 +2377,13 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state,
/* Power up port for set_mctrl() */
uart_change_pm(state, UART_PM_STATE_ON);
+ /*
+ * If this driver supports console, and it hasn't been
+ * successfully registered yet, initialise spin lock for it.
+ */
+ if (port->cons && !(port->cons->flags & CON_ENABLED))
+ __uart_port_spin_lock_init(port);
+
/*
* Ensure that the modem control lines are de-activated.
* keep the DTR setting that is set in uart_set_options()
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 101/244] clk: mvebu: ARMADA_AP_CPU_CLK needs to select ARMADA_AP_CP_HELPER
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 100/244] serial: core: Initialise spin lock before use in uart_configure_port() Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 102/244] clk: AST2600: Add mux for EMMC clock Greg Kroah-Hartman
` (143 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Stephen Boyd, Sasha Levin
From: Nathan Chancellor <natechancellor@gmail.com>
[ Upstream commit 8e3709d7e3a67e2d3f42bd1fc2052353a5678944 ]
When building arm32 allmodconfig:
ld.lld: error: undefined symbol: ap_cp_unique_name
>>> referenced by ap-cpu-clk.c
>>> clk/mvebu/ap-cpu-clk.o:(ap_cpu_clock_probe) in archive drivers/built-in.a
ap_cp_unique_name is only compiled into the kernel image when
CONFIG_ARMADA_AP_CP_HELPER is selected (as it is not user selectable).
However, CONFIG_ARMADA_AP_CPU_CLK does not select it.
This has been a problem since the driver was added to the kernel but it
was not built before commit c318ea261749 ("cpufreq: ap806: fix cpufreq
driver needs ap cpu clk") so it was never noticed.
Fixes: f756e362d938 ("clk: mvebu: add CPU clock driver for Armada 7K/8K")
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Link: https://lore.kernel.org/r/20200701201128.2448427-1-natechancellor@gmail.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/mvebu/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/mvebu/Kconfig b/drivers/clk/mvebu/Kconfig
index ded07b0bd0d5e..557d6213783c7 100644
--- a/drivers/clk/mvebu/Kconfig
+++ b/drivers/clk/mvebu/Kconfig
@@ -42,6 +42,7 @@ config ARMADA_AP806_SYSCON
config ARMADA_AP_CPU_CLK
bool
+ select ARMADA_AP_CP_HELPER
config ARMADA_CP110_SYSCON
bool
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 102/244] clk: AST2600: Add mux for EMMC clock
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 101/244] clk: mvebu: ARMADA_AP_CPU_CLK needs to select ARMADA_AP_CP_HELPER Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 103/244] xprtrdma: Fix double-free in rpcrdma_ep_create() Greg Kroah-Hartman
` (142 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eddie James, Andrew Jeffery,
Joel Stanley, Stephen Boyd, Sasha Levin
From: Eddie James <eajames@linux.ibm.com>
[ Upstream commit c2407ab3bd55064d459bc822efd1c134e852798c ]
The EMMC clock can be derived from either the HPLL or the MPLL. Register
a clock mux so that the rate is calculated correctly based upon the
parent.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Link: https://lore.kernel.org/r/20200709195706.12741-2-eajames@linux.ibm.com
Acked-by: Joel Stanley <joel@jms.id.au>
Fixes: d3d04f6c330a ("clk: Add support for AST2600 SoC")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-ast2600.c | 49 ++++++++++++++++++++++++++++++++-------
1 file changed, 41 insertions(+), 8 deletions(-)
diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c
index 99afc949925f0..177368cac6dd6 100644
--- a/drivers/clk/clk-ast2600.c
+++ b/drivers/clk/clk-ast2600.c
@@ -131,6 +131,18 @@ static const struct clk_div_table ast2600_eclk_div_table[] = {
{ 0 }
};
+static const struct clk_div_table ast2600_emmc_extclk_div_table[] = {
+ { 0x0, 2 },
+ { 0x1, 4 },
+ { 0x2, 6 },
+ { 0x3, 8 },
+ { 0x4, 10 },
+ { 0x5, 12 },
+ { 0x6, 14 },
+ { 0x7, 16 },
+ { 0 }
+};
+
static const struct clk_div_table ast2600_mac_div_table[] = {
{ 0x0, 4 },
{ 0x1, 4 },
@@ -390,6 +402,11 @@ static struct clk_hw *aspeed_g6_clk_hw_register_gate(struct device *dev,
return hw;
}
+static const char *const emmc_extclk_parent_names[] = {
+ "emmc_extclk_hpll_in",
+ "mpll",
+};
+
static const char * const vclk_parent_names[] = {
"dpll",
"d1pll",
@@ -459,16 +476,32 @@ static int aspeed_g6_clk_probe(struct platform_device *pdev)
return PTR_ERR(hw);
aspeed_g6_clk_data->hws[ASPEED_CLK_UARTX] = hw;
- /* EMMC ext clock divider */
- hw = clk_hw_register_gate(dev, "emmc_extclk_gate", "hpll", 0,
- scu_g6_base + ASPEED_G6_CLK_SELECTION1, 15, 0,
- &aspeed_g6_clk_lock);
+ /* EMMC ext clock */
+ hw = clk_hw_register_fixed_factor(dev, "emmc_extclk_hpll_in", "hpll",
+ 0, 1, 2);
if (IS_ERR(hw))
return PTR_ERR(hw);
- hw = clk_hw_register_divider_table(dev, "emmc_extclk", "emmc_extclk_gate", 0,
- scu_g6_base + ASPEED_G6_CLK_SELECTION1, 12, 3, 0,
- ast2600_div_table,
- &aspeed_g6_clk_lock);
+
+ hw = clk_hw_register_mux(dev, "emmc_extclk_mux",
+ emmc_extclk_parent_names,
+ ARRAY_SIZE(emmc_extclk_parent_names), 0,
+ scu_g6_base + ASPEED_G6_CLK_SELECTION1, 11, 1,
+ 0, &aspeed_g6_clk_lock);
+ if (IS_ERR(hw))
+ return PTR_ERR(hw);
+
+ hw = clk_hw_register_gate(dev, "emmc_extclk_gate", "emmc_extclk_mux",
+ 0, scu_g6_base + ASPEED_G6_CLK_SELECTION1,
+ 15, 0, &aspeed_g6_clk_lock);
+ if (IS_ERR(hw))
+ return PTR_ERR(hw);
+
+ hw = clk_hw_register_divider_table(dev, "emmc_extclk",
+ "emmc_extclk_gate", 0,
+ scu_g6_base +
+ ASPEED_G6_CLK_SELECTION1, 12,
+ 3, 0, ast2600_emmc_extclk_div_table,
+ &aspeed_g6_clk_lock);
if (IS_ERR(hw))
return PTR_ERR(hw);
aspeed_g6_clk_data->hws[ASPEED_CLK_EMMC] = hw;
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 103/244] xprtrdma: Fix double-free in rpcrdma_ep_create()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 102/244] clk: AST2600: Add mux for EMMC clock Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 104/244] xprtrdma: Fix recursion into rpcrdma_xprt_disconnect() Greg Kroah-Hartman
` (141 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chuck Lever, Anna Schumaker, Sasha Levin
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 85bfd71bc34e20d9fadb745131f6314c36d0f75b ]
In the error paths, there's no need to call kfree(ep) after calling
rpcrdma_ep_put(ep).
Fixes: e28ce90083f0 ("xprtrdma: kmalloc rpcrdma_ep separate from rpcrdma_xprt")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/verbs.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index db0259c6467ef..4cb91dde849b9 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -404,8 +404,8 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
id = rpcrdma_create_id(r_xprt, ep);
if (IS_ERR(id)) {
- rc = PTR_ERR(id);
- goto out_free;
+ kfree(ep);
+ return PTR_ERR(id);
}
__module_get(THIS_MODULE);
device = id->device;
@@ -504,9 +504,6 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
out_destroy:
rpcrdma_ep_put(ep);
rdma_destroy_id(id);
-out_free:
- kfree(ep);
- r_xprt->rx_ep = NULL;
return rc;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 104/244] xprtrdma: Fix recursion into rpcrdma_xprt_disconnect()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 103/244] xprtrdma: Fix double-free in rpcrdma_ep_create() Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 105/244] xprtrdma: Fix return code from rpcrdma_xprt_connect() Greg Kroah-Hartman
` (140 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Aloni, Chuck Lever,
Anna Schumaker, Sasha Levin
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 4cf44be6f1e86da302085bf3e1dc2c86f3cdaaaa ]
Both Dan and I have observed two processes invoking
rpcrdma_xprt_disconnect() concurrently. In my case:
1. The connect worker invokes rpcrdma_xprt_disconnect(), which
drains the QP and waits for the final completion
2. This causes the newly posted Receive to flush and invoke
xprt_force_disconnect()
3. xprt_force_disconnect() sets CLOSE_WAIT and wakes up the RPC task
that is holding the transport lock
4. The RPC task invokes xprt_connect(), which calls ->ops->close
5. xprt_rdma_close() invokes rpcrdma_xprt_disconnect(), which tries
to destroy the QP.
Deadlock.
To prevent xprt_force_disconnect() from waking anything, handle the
clean up after a failed connection attempt in the xprt's sndtask.
The retry loop is removed from rpcrdma_xprt_connect() to ensure
that the newly allocated ep and id are properly released before
a REJECTED connection attempt can be retried.
Reported-by: Dan Aloni <dan@kernelim.com>
Fixes: e28ce90083f0 ("xprtrdma: kmalloc rpcrdma_ep separate from rpcrdma_xprt")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/transport.c | 5 +++++
net/sunrpc/xprtrdma/verbs.c | 10 ++--------
2 files changed, 7 insertions(+), 8 deletions(-)
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 659da37020a46..3b5fb1f57aeb7 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -249,6 +249,11 @@ xprt_rdma_connect_worker(struct work_struct *work)
xprt->stat.connect_start;
xprt_set_connected(xprt);
rc = -EAGAIN;
+ } else {
+ /* Force a call to xprt_rdma_close to clean up */
+ spin_lock(&xprt->transport_lock);
+ set_bit(XPRT_CLOSE_WAIT, &xprt->state);
+ spin_unlock(&xprt->transport_lock);
}
xprt_wake_pending_tasks(xprt, rc);
}
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 4cb91dde849b9..00ee62579137b 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -288,7 +288,7 @@ rpcrdma_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event)
sap, rdma_reject_msg(id, event->status));
ep->re_connect_status = -ECONNREFUSED;
if (event->status == IB_CM_REJ_STALE_CONN)
- ep->re_connect_status = -EAGAIN;
+ ep->re_connect_status = -ENOTCONN;
goto disconnected;
case RDMA_CM_EVENT_DISCONNECTED:
ep->re_connect_status = -ECONNABORTED;
@@ -519,8 +519,6 @@ int rpcrdma_xprt_connect(struct rpcrdma_xprt *r_xprt)
struct rpcrdma_ep *ep;
int rc;
-retry:
- rpcrdma_xprt_disconnect(r_xprt);
rc = rpcrdma_ep_create(r_xprt);
if (rc)
return rc;
@@ -549,17 +547,13 @@ int rpcrdma_xprt_connect(struct rpcrdma_xprt *r_xprt)
wait_event_interruptible(ep->re_connect_wait,
ep->re_connect_status != 0);
if (ep->re_connect_status <= 0) {
- if (ep->re_connect_status == -EAGAIN)
- goto retry;
rc = ep->re_connect_status;
goto out;
}
rc = rpcrdma_reqs_setup(r_xprt);
- if (rc) {
- rpcrdma_xprt_disconnect(r_xprt);
+ if (rc)
goto out;
- }
rpcrdma_mrs_create(r_xprt);
out:
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 105/244] xprtrdma: Fix return code from rpcrdma_xprt_connect()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 104/244] xprtrdma: Fix recursion into rpcrdma_xprt_disconnect() Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 106/244] xprtrdma: Fix handling of connect errors Greg Kroah-Hartman
` (139 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chuck Lever, Anna Schumaker, Sasha Levin
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit dda9a951dd6dd6073bbaf2c8d3119da2f8fe2d5b ]
I noticed that when rpcrdma_xprt_connect() returns -ENOMEM,
instead of retrying the connect, the RPC client kills the
RPC task that requested the connection. We want a retry
here.
Fixes: cb586decbb88 ("xprtrdma: Make sendctx queue lifetime the same as connection lifetime")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/verbs.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 00ee62579137b..220c2d2eeb3e5 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -398,7 +398,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
ep = kzalloc(sizeof(*ep), GFP_NOFS);
if (!ep)
- return -EAGAIN;
+ return -ENOTCONN;
ep->re_xprt = &r_xprt->rx_xprt;
kref_init(&ep->re_kref);
@@ -534,10 +534,6 @@ int rpcrdma_xprt_connect(struct rpcrdma_xprt *r_xprt)
rpcrdma_ep_get(ep);
rpcrdma_post_recvs(r_xprt, true);
- rc = rpcrdma_sendctxs_create(r_xprt);
- if (rc)
- goto out;
-
rc = rdma_connect(ep->re_id, &ep->re_remote_cma);
if (rc)
goto out;
@@ -551,9 +547,17 @@ int rpcrdma_xprt_connect(struct rpcrdma_xprt *r_xprt)
goto out;
}
+ rc = rpcrdma_sendctxs_create(r_xprt);
+ if (rc) {
+ rc = -ENOTCONN;
+ goto out;
+ }
+
rc = rpcrdma_reqs_setup(r_xprt);
- if (rc)
+ if (rc) {
+ rc = -ENOTCONN;
goto out;
+ }
rpcrdma_mrs_create(r_xprt);
out:
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 106/244] xprtrdma: Fix handling of connect errors
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 105/244] xprtrdma: Fix return code from rpcrdma_xprt_connect() Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 107/244] NFS: Fix interrupted slots by sending a solo SEQUENCE operation Greg Kroah-Hartman
` (138 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Aloni, Chuck Lever,
Anna Schumaker, Sasha Levin
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit af667527b0e34912d2cb3586d585f66db4e4f486 ]
Ensure that the connect worker is awoken if an attempt to establish
a connection is unsuccessful. Otherwise the worker waits forever
and the transport workload hangs.
Connect errors should not attempt to destroy the ep, since the
connect worker continues to use it after the handler runs, so these
errors are now handled independently of DISCONNECTED events.
Reported-by: Dan Aloni <dan@kernelim.com>
Fixes: e28ce90083f0 ("xprtrdma: kmalloc rpcrdma_ep separate from rpcrdma_xprt")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/verbs.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 220c2d2eeb3e5..26e89c65ba564 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -279,17 +279,19 @@ rpcrdma_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event)
break;
case RDMA_CM_EVENT_CONNECT_ERROR:
ep->re_connect_status = -ENOTCONN;
- goto disconnected;
+ goto wake_connect_worker;
case RDMA_CM_EVENT_UNREACHABLE:
ep->re_connect_status = -ENETUNREACH;
- goto disconnected;
+ goto wake_connect_worker;
case RDMA_CM_EVENT_REJECTED:
dprintk("rpcrdma: connection to %pISpc rejected: %s\n",
sap, rdma_reject_msg(id, event->status));
ep->re_connect_status = -ECONNREFUSED;
if (event->status == IB_CM_REJ_STALE_CONN)
ep->re_connect_status = -ENOTCONN;
- goto disconnected;
+wake_connect_worker:
+ wake_up_all(&ep->re_connect_wait);
+ return 0;
case RDMA_CM_EVENT_DISCONNECTED:
ep->re_connect_status = -ECONNABORTED;
disconnected:
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 107/244] NFS: Fix interrupted slots by sending a solo SEQUENCE operation
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 106/244] xprtrdma: Fix handling of connect errors Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 108/244] fuse: dont ignore errors from fuse_writepages_fill() Greg Kroah-Hartman
` (137 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Anna Schumaker, Sasha Levin
From: Anna Schumaker <Anna.Schumaker@Netapp.com>
[ Upstream commit 913fadc5b105c3619d9e8d0fe8899ff1593cc737 ]
We used to do this before 3453d5708b33, but this was changed to better
handle the NFS4ERR_SEQ_MISORDERED error code. This commit fixed the slot
re-use case when the server doesn't receive the interrupted operation,
but if the server does receive the operation then it could still end up
replying to the client with mis-matched operations from the reply cache.
We can fix this by sending a SEQUENCE to the server while recovering from
a SEQ_MISORDERED error when we detect that we are in an interrupted slot
situation.
Fixes: 3453d5708b33 (NFSv4.1: Avoid false retries when RPC calls are interrupted)
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index e32717fd1169a..2e2dac29a9e91 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -774,6 +774,14 @@ static void nfs4_slot_sequence_acked(struct nfs4_slot *slot,
slot->seq_nr_last_acked = seqnr;
}
+static void nfs4_probe_sequence(struct nfs_client *client, const struct cred *cred,
+ struct nfs4_slot *slot)
+{
+ struct rpc_task *task = _nfs41_proc_sequence(client, cred, slot, true);
+ if (!IS_ERR(task))
+ rpc_put_task_async(task);
+}
+
static int nfs41_sequence_process(struct rpc_task *task,
struct nfs4_sequence_res *res)
{
@@ -790,6 +798,7 @@ static int nfs41_sequence_process(struct rpc_task *task,
goto out;
session = slot->table->session;
+ clp = session->clp;
trace_nfs4_sequence_done(session, res);
@@ -804,7 +813,6 @@ static int nfs41_sequence_process(struct rpc_task *task,
nfs4_slot_sequence_acked(slot, slot->seq_nr);
/* Update the slot's sequence and clientid lease timer */
slot->seq_done = 1;
- clp = session->clp;
do_renew_lease(clp, res->sr_timestamp);
/* Check sequence flags */
nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags,
@@ -852,10 +860,18 @@ static int nfs41_sequence_process(struct rpc_task *task,
/*
* Were one or more calls using this slot interrupted?
* If the server never received the request, then our
- * transmitted slot sequence number may be too high.
+ * transmitted slot sequence number may be too high. However,
+ * if the server did receive the request then it might
+ * accidentally give us a reply with a mismatched operation.
+ * We can sort this out by sending a lone sequence operation
+ * to the server on the same slot.
*/
if ((s32)(slot->seq_nr - slot->seq_nr_last_acked) > 1) {
slot->seq_nr--;
+ if (task->tk_msg.rpc_proc != &nfs4_procedures[NFSPROC4_CLNT_SEQUENCE]) {
+ nfs4_probe_sequence(clp, task->tk_msg.rpc_cred, slot);
+ res->sr_slot = NULL;
+ }
goto retry_nowait;
}
/*
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 108/244] fuse: dont ignore errors from fuse_writepages_fill()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 107/244] NFS: Fix interrupted slots by sending a solo SEQUENCE operation Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 109/244] ARM: dts: Fix dcan driver probe failed on am437x platform Greg Kroah-Hartman
` (136 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vasily Averin, Miklos Szeredi, Sasha Levin
From: Vasily Averin <vvs@virtuozzo.com>
[ Upstream commit 7779b047a57f6824a43d0e1f70de2741b7426b9d ]
fuse_writepages() ignores some errors taken from fuse_writepages_fill() I
believe it is a bug: if .writepages is called with WB_SYNC_ALL it should
either guarantee that all data was successfully saved or return error.
Fixes: 26d614df1da9 ("fuse: Implement writepages callback")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/file.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index e3afceecaa6b1..93763e844cd42 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2148,10 +2148,8 @@ static int fuse_writepages(struct address_space *mapping,
err = write_cache_pages(mapping, wbc, fuse_writepages_fill, &data);
if (data.wpa) {
- /* Ignore errors if we can write at least one page */
WARN_ON(!data.wpa->ia.ap.num_pages);
fuse_writepages_send(&data);
- err = 0;
}
if (data.ff)
fuse_file_put(data.ff, false, false);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 109/244] ARM: dts: Fix dcan driver probe failed on am437x platform
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 108/244] fuse: dont ignore errors from fuse_writepages_fill() Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 110/244] Revert "thermal: mediatek: fix register index error" Greg Kroah-Hartman
` (135 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, dillon min, Tony Lindgren, Sasha Levin
From: dillon min <dillon.minfei@gmail.com>
[ Upstream commit 2a4117df9b436a0e4c79d211284ab2097bcd00dc ]
Got following d_can probe errors with kernel 5.8-rc1 on am437x
[ 10.730822] CAN device driver interface
Starting Wait for Network to be Configured...
[ OK ] Reached target Network.
[ 10.787363] c_can_platform 481cc000.can: probe failed
[ 10.792484] c_can_platform: probe of 481cc000.can failed with error -2
[ 10.799457] c_can_platform 481d0000.can: probe failed
[ 10.804617] c_can_platform: probe of 481d0000.can failed with error -2
actually, Tony has fixed this issue on am335x with the patch [3]
Since am437x has the same clock structure with am335x
[1][2], so reuse the code from Tony Lindgren's patch [3] to fix it.
[1]: https://www.ti.com/lit/pdf/spruh73 Chapter-23, Figure 23-1. DCAN
Integration
[2]: https://www.ti.com/lit/pdf/spruhl7 Chapter-25, Figure 25-1. DCAN
Integration
[3]: commit 516f1117d0fb ("ARM: dts: Configure osc clock for d_can on
am335x")
Fixes: 1a5cd7c23cc5 ("bus: ti-sysc: Enable all clocks directly during init to read revision")
Signed-off-by: dillon min <dillon.minfei@gmail.com>
[tony@atomide.com: aligned commit message a bit for readability]
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/am437x-l4.dtsi | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/arch/arm/boot/dts/am437x-l4.dtsi b/arch/arm/boot/dts/am437x-l4.dtsi
index 49c6a872052e4..e30089e96263a 100644
--- a/arch/arm/boot/dts/am437x-l4.dtsi
+++ b/arch/arm/boot/dts/am437x-l4.dtsi
@@ -1544,8 +1544,9 @@ target-module@cc000 { /* 0x481cc000, ap 50 46.0 */
reg = <0xcc020 0x4>;
reg-names = "rev";
/* Domains (P, C): per_pwrdm, l4ls_clkdm */
- clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN0_CLKCTRL 0>;
- clock-names = "fck";
+ clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN0_CLKCTRL 0>,
+ <&dcan0_fck>;
+ clock-names = "fck", "osc";
#address-cells = <1>;
#size-cells = <1>;
ranges = <0x0 0xcc000 0x2000>;
@@ -1553,6 +1554,8 @@ target-module@cc000 { /* 0x481cc000, ap 50 46.0 */
dcan0: can@0 {
compatible = "ti,am4372-d_can", "ti,am3352-d_can";
reg = <0x0 0x2000>;
+ clocks = <&dcan0_fck>;
+ clock-names = "fck";
syscon-raminit = <&scm_conf 0x644 0>;
interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
status = "disabled";
@@ -1564,8 +1567,9 @@ target-module@d0000 { /* 0x481d0000, ap 52 3a.0 */
reg = <0xd0020 0x4>;
reg-names = "rev";
/* Domains (P, C): per_pwrdm, l4ls_clkdm */
- clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN1_CLKCTRL 0>;
- clock-names = "fck";
+ clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN1_CLKCTRL 0>,
+ <&dcan1_fck>;
+ clock-names = "fck", "osc";
#address-cells = <1>;
#size-cells = <1>;
ranges = <0x0 0xd0000 0x2000>;
@@ -1573,6 +1577,8 @@ target-module@d0000 { /* 0x481d0000, ap 52 3a.0 */
dcan1: can@0 {
compatible = "ti,am4372-d_can", "ti,am3352-d_can";
reg = <0x0 0x2000>;
+ clocks = <&dcan1_fck>;
+ clock-name = "fck";
syscon-raminit = <&scm_conf 0x644 1>;
interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
status = "disabled";
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 110/244] Revert "thermal: mediatek: fix register index error"
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 109/244] ARM: dts: Fix dcan driver probe failed on am437x platform Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 111/244] xprtrdma: fix incorrect header size calculations Greg Kroah-Hartman
` (134 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Kao, Enric Balletbo i Serra,
Matthias Brugger, Daniel Lezcano, Sasha Levin
From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
[ Upstream commit a8f62f183021be389561570ab5f8c701a5e70298 ]
This reverts commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6
The above patch is supposed to fix a register index error on mt2701. It
is not clear if the problem solved is a hang or just an invalid value
returned, my guess is the second. The patch introduces, though, a new
hang on MT8173 device making them unusable. So, seems reasonable, revert
the patch because introduces a worst issue.
The reason I send a revert instead of trying to fix the issue for MT8173
is because the information needed to fix the issue is in the datasheet
and is not public. So I am not really able to fix it.
Fixes the following bug when CONFIG_MTK_THERMAL is set on MT8173
devices.
[ 2.222488] Unable to handle kernel paging request at virtual address ffff8000125f5001
[ 2.230421] Mem abort info:
[ 2.233207] ESR = 0x96000021
[ 2.236261] EC = 0x25: DABT (current EL), IL = 32 bits
[ 2.241571] SET = 0, FnV = 0
[ 2.244623] EA = 0, S1PTW = 0
[ 2.247762] Data abort info:
[ 2.250640] ISV = 0, ISS = 0x00000021
[ 2.254473] CM = 0, WnR = 0
[ 2.257544] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041850000
[ 2.264251] [ffff8000125f5001] pgd=000000013ffff003, pud=000000013fffe003, pmd=000000013fff9003, pte=006800001100b707
[ 2.274867] Internal error: Oops: 96000021 [#1] PREEMPT SMP
[ 2.280432] Modules linked in:
[ 2.283483] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.7.0-rc6+ #162
[ 2.289914] Hardware name: Google Elm (DT)
[ 2.294003] pstate: 20000005 (nzCv daif -PAN -UAO)
[ 2.298792] pc : mtk_read_temp+0xb8/0x1c8
[ 2.302793] lr : mtk_read_temp+0x7c/0x1c8
[ 2.306794] sp : ffff80001003b930
[ 2.310100] x29: ffff80001003b930 x28: 0000000000000000
[ 2.315404] x27: 0000000000000002 x26: ffff0000f9550b10
[ 2.320709] x25: ffff0000f9550a80 x24: 0000000000000090
[ 2.326014] x23: ffff80001003ba24 x22: 00000000610344c0
[ 2.331318] x21: 0000000000002710 x20: 00000000000001f4
[ 2.336622] x19: 0000000000030d40 x18: ffff800011742ec0
[ 2.341926] x17: 0000000000000001 x16: 0000000000000001
[ 2.347230] x15: ffffffffffffffff x14: ffffff0000000000
[ 2.352535] x13: ffffffffffffffff x12: 0000000000000028
[ 2.357839] x11: 0000000000000003 x10: ffff800011295ec8
[ 2.363143] x9 : 000000000000291b x8 : 0000000000000002
[ 2.368447] x7 : 00000000000000a8 x6 : 0000000000000004
[ 2.373751] x5 : 0000000000000000 x4 : ffff800011295cb0
[ 2.379055] x3 : 0000000000000002 x2 : ffff8000125f5001
[ 2.384359] x1 : 0000000000000001 x0 : ffff0000f9550a80
[ 2.389665] Call trace:
[ 2.392105] mtk_read_temp+0xb8/0x1c8
[ 2.395760] of_thermal_get_temp+0x2c/0x40
[ 2.399849] thermal_zone_get_temp+0x78/0x160
[ 2.404198] thermal_zone_device_update.part.0+0x3c/0x1f8
[ 2.409589] thermal_zone_device_update+0x34/0x48
[ 2.414286] of_thermal_set_mode+0x58/0x88
[ 2.418375] thermal_zone_of_sensor_register+0x1a8/0x1d8
[ 2.423679] devm_thermal_zone_of_sensor_register+0x64/0xb0
[ 2.429242] mtk_thermal_probe+0x690/0x7d0
[ 2.433333] platform_drv_probe+0x5c/0xb0
[ 2.437335] really_probe+0xe4/0x448
[ 2.440901] driver_probe_device+0xe8/0x140
[ 2.445077] device_driver_attach+0x7c/0x88
[ 2.449252] __driver_attach+0xac/0x178
[ 2.453082] bus_for_each_dev+0x78/0xc8
[ 2.456909] driver_attach+0x2c/0x38
[ 2.460476] bus_add_driver+0x14c/0x230
[ 2.464304] driver_register+0x6c/0x128
[ 2.468131] __platform_driver_register+0x50/0x60
[ 2.472831] mtk_thermal_driver_init+0x24/0x30
[ 2.477268] do_one_initcall+0x50/0x298
[ 2.481098] kernel_init_freeable+0x1ec/0x264
[ 2.485450] kernel_init+0x1c/0x110
[ 2.488931] ret_from_fork+0x10/0x1c
[ 2.492502] Code: f9401081 f9400402 b8a67821 8b010042 (b9400042)
[ 2.498599] ---[ end trace e43e3105ed27dc99 ]---
[ 2.503367] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[ 2.511020] SMP: stopping secondary CPUs
[ 2.514941] Kernel Offset: disabled
[ 2.518421] CPU features: 0x090002,25006005
[ 2.522595] Memory Limit: none
[ 2.525644] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--
Cc: Michael Kao <michael.kao@mediatek.com>
Fixes: eb9aecd90d1a ("thermal: mediatek: fix register index error")
Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20200707103412.1010823-1-enric.balletbo@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/mtk_thermal.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
index 6b7ef1993d7e2..42c9cd0e5f775 100644
--- a/drivers/thermal/mtk_thermal.c
+++ b/drivers/thermal/mtk_thermal.c
@@ -594,8 +594,7 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank)
u32 raw;
for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) {
- raw = readl(mt->thermal_base +
- conf->msr[conf->bank_data[bank->id].sensors[i]]);
+ raw = readl(mt->thermal_base + conf->msr[i]);
temp = raw_to_mcelsius(mt,
conf->bank_data[bank->id].sensors[i],
@@ -736,8 +735,7 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num,
for (i = 0; i < conf->bank_data[num].num_sensors; i++)
writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]],
- mt->thermal_base +
- conf->adcpnp[conf->bank_data[num].sensors[i]]);
+ mt->thermal_base + conf->adcpnp[i]);
writel((1 << conf->bank_data[num].num_sensors) - 1,
controller_base + TEMP_MONCTL0);
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 111/244] xprtrdma: fix incorrect header size calculations
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 110/244] Revert "thermal: mediatek: fix register index error" Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 112/244] ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema Greg Kroah-Hartman
` (133 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Chuck Lever,
Anna Schumaker, Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 912288442cb2f431bf3c8cb097a5de83bc6dbac1 ]
Currently the header size calculations are using an assignment
operator instead of a += operator when accumulating the header
size leading to incorrect sizes. Fix this by using the correct
operator.
Addresses-Coverity: ("Unused value")
Fixes: 302d3deb2068 ("xprtrdma: Prevent inline overflow")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/rpc_rdma.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 57118e342c8eb..06a8268edf3b4 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -71,7 +71,7 @@ static unsigned int rpcrdma_max_call_header_size(unsigned int maxsegs)
size = RPCRDMA_HDRLEN_MIN;
/* Maximum Read list size */
- size = maxsegs * rpcrdma_readchunk_maxsz * sizeof(__be32);
+ size += maxsegs * rpcrdma_readchunk_maxsz * sizeof(__be32);
/* Minimal Read chunk size */
size += sizeof(__be32); /* segment count */
@@ -94,7 +94,7 @@ static unsigned int rpcrdma_max_reply_header_size(unsigned int maxsegs)
size = RPCRDMA_HDRLEN_MIN;
/* Maximum Write list size */
- size = sizeof(__be32); /* segment count */
+ size += sizeof(__be32); /* segment count */
size += maxsegs * rpcrdma_segment_maxsz * sizeof(__be32);
size += sizeof(__be32); /* list discriminator */
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 112/244] ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 111/244] xprtrdma: fix incorrect header size calculations Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 113/244] arm64: dts: spcfpga: Align GIC, NAND and UART nodenames " Greg Kroah-Hartman
` (132 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Dinh Nguyen,
Sasha Levin
From: Krzysztof Kozlowski <krzk@kernel.org>
[ Upstream commit d7adfe5ffed9faa05f8926223086b101e14f700d ]
Fix dtschema validator warnings like:
l2-cache@fffff000: $nodename:0:
'l2-cache@fffff000' does not match '^(cache-controller|cpu)(@[0-9a-f,]+)*$'
Fixes: 475dc86d08de ("arm: dts: socfpga: Add a base DTSI for Altera's Arria10 SOC")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/socfpga.dtsi | 2 +-
arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
index 4f3993cc02279..4510308972209 100644
--- a/arch/arm/boot/dts/socfpga.dtsi
+++ b/arch/arm/boot/dts/socfpga.dtsi
@@ -710,7 +710,7 @@ ocram-ecc@ffd08144 {
};
};
- L2: l2-cache@fffef000 {
+ L2: cache-controller@fffef000 {
compatible = "arm,pl310-cache";
reg = <0xfffef000 0x1000>;
interrupts = <0 38 0x04>;
diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
index 3b8571b8b4129..8f614c4b0e3eb 100644
--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
+++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
@@ -636,7 +636,7 @@ sdr: sdr@ffcfb100 {
reg = <0xffcfb100 0x80>;
};
- L2: l2-cache@fffff000 {
+ L2: cache-controller@fffff000 {
compatible = "arm,pl310-cache";
reg = <0xfffff000 0x1000>;
interrupts = <0 18 IRQ_TYPE_LEVEL_HIGH>;
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 113/244] arm64: dts: spcfpga: Align GIC, NAND and UART nodenames with dtschema
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 112/244] ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 114/244] keys: asymmetric: fix error return code in software_key_query() Greg Kroah-Hartman
` (131 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Dinh Nguyen,
Sasha Levin
From: Krzysztof Kozlowski <krzk@kernel.org>
[ Upstream commit 681a5c71fb829fc2193e3bb524af41525477f5c3 ]
Fix dtschema validator warnings like:
intc@fffc1000: $nodename:0:
'intc@fffc1000' does not match '^interrupt-controller(@[0-9a-f,]+)*$'
Fixes: 78cd6a9d8e15 ("arm64: dts: Add base stratix 10 dtsi")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
index d1fc9c2055f49..9498d1de730ce 100644
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
@@ -77,7 +77,7 @@ psci {
method = "smc";
};
- intc: intc@fffc1000 {
+ intc: interrupt-controller@fffc1000 {
compatible = "arm,gic-400", "arm,cortex-a15-gic";
#interrupt-cells = <3>;
interrupt-controller;
@@ -302,7 +302,7 @@ mmc: dwmmc0@ff808000 {
status = "disabled";
};
- nand: nand@ffb90000 {
+ nand: nand-controller@ffb90000 {
#address-cells = <1>;
#size-cells = <0>;
compatible = "altr,socfpga-denali-nand";
@@ -445,7 +445,7 @@ timer3: timer3@ffd00100 {
clock-names = "timer";
};
- uart0: serial0@ffc02000 {
+ uart0: serial@ffc02000 {
compatible = "snps,dw-apb-uart";
reg = <0xffc02000 0x100>;
interrupts = <0 108 4>;
@@ -456,7 +456,7 @@ uart0: serial0@ffc02000 {
status = "disabled";
};
- uart1: serial1@ffc02100 {
+ uart1: serial@ffc02100 {
compatible = "snps,dw-apb-uart";
reg = <0xffc02100 0x100>;
interrupts = <0 109 4>;
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 114/244] keys: asymmetric: fix error return code in software_key_query()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 113/244] arm64: dts: spcfpga: Align GIC, NAND and UART nodenames " Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 115/244] nvme: explicitly update mpath disk capacity on revalidation Greg Kroah-Hartman
` (130 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wei Yongjun, David Howells,
Linus Torvalds, Sasha Levin
From: Wei Yongjun <weiyongjun1@huawei.com>
[ Upstream commit 6cbba1f9114a8134cff9138c79add15012fd52b9 ]
Fix to return negative error code -ENOMEM from kmalloc() error handling
case instead of 0, as done elsewhere in this function.
Fixes: f1774cb8956a ("X.509: parse public key parameters from x509 for akcipher")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/asymmetric_keys/public_key.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index d7f43d4ea925a..e5fae4e838c06 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -119,6 +119,7 @@ static int software_key_query(const struct kernel_pkey_params *params,
if (IS_ERR(tfm))
return PTR_ERR(tfm);
+ ret = -ENOMEM;
key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
GFP_KERNEL);
if (!key)
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 115/244] nvme: explicitly update mpath disk capacity on revalidation
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 114/244] keys: asymmetric: fix error return code in software_key_query() Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 116/244] regmap: debugfs: Dont sleep while atomic for fast_io regmaps Greg Kroah-Hartman
` (129 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anthony Iliopoulos,
Christoph Hellwig, Sasha Levin
From: Anthony Iliopoulos <ailiop@suse.com>
[ Upstream commit 05b29021fba5e725dd385151ef00b6340229b500 ]
Commit 3b4b19721ec652 ("nvme: fix possible deadlock when I/O is
blocked") reverted multipath head disk revalidation due to deadlocks
caused by holding the bd_mutex during revalidate.
Updating the multipath disk blockdev size is still required though for
userspace to be able to observe any resizing while the device is
mounted. Directly update the bdev inode size to avoid unnecessarily
holding the bdev->bd_mutex.
Fixes: 3b4b19721ec652 ("nvme: fix possible deadlock when I/O is
blocked")
Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 1 +
drivers/nvme/host/nvme.h | 13 +++++++++++++
2 files changed, 14 insertions(+)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 71d63ed62071e..137d7bcc13585 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1916,6 +1916,7 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
if (ns->head->disk) {
nvme_update_disk_info(ns->head->disk, ns, id);
blk_queue_stack_limits(ns->head->disk->queue, ns->queue);
+ nvme_mpath_update_disk_size(ns->head->disk);
}
#endif
}
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 719342600be62..46f965f8c9bcd 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -583,6 +583,16 @@ static inline void nvme_trace_bio_complete(struct request *req,
req->bio, status);
}
+static inline void nvme_mpath_update_disk_size(struct gendisk *disk)
+{
+ struct block_device *bdev = bdget_disk(disk, 0);
+
+ if (bdev) {
+ bd_set_size(bdev, get_capacity(disk) << SECTOR_SHIFT);
+ bdput(bdev);
+ }
+}
+
extern struct device_attribute dev_attr_ana_grpid;
extern struct device_attribute dev_attr_ana_state;
extern struct device_attribute subsys_attr_iopolicy;
@@ -658,6 +668,9 @@ static inline void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
static inline void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
{
}
+static inline void nvme_mpath_update_disk_size(struct gendisk *disk)
+{
+}
#endif /* CONFIG_NVME_MULTIPATH */
#ifdef CONFIG_NVM
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 116/244] regmap: debugfs: Dont sleep while atomic for fast_io regmaps
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 115/244] nvme: explicitly update mpath disk capacity on revalidation Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 117/244] copy_xstate_to_kernel: Fix typo which caused GDB regression Greg Kroah-Hartman
` (128 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Mark Brown, Sasha Levin
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 299632e54b2e692d2830af84be51172480dc1e26 ]
If a regmap has "fast_io" set then its lock function uses a spinlock.
That doesn't work so well with the functions:
* regmap_cache_only_write_file()
* regmap_cache_bypass_write_file()
Both of the above functions have the pattern:
1. Lock the regmap.
2. Call:
debugfs_write_file_bool()
copy_from_user()
__might_fault()
__might_sleep()
Let's reorder things a bit so that we do all of our sleepable
functions before we grab the lock.
Fixes: d3dc5430d68f ("regmap: debugfs: Allow writes to cache state settings")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20200715164611.1.I35b3533e8a80efde0cec1cc70f71e1e74b2fa0da@changeid
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/regmap/regmap-debugfs.c | 52 ++++++++++++++++------------
1 file changed, 29 insertions(+), 23 deletions(-)
diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index e72843fe41dfe..e16afa27700db 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -457,29 +457,31 @@ static ssize_t regmap_cache_only_write_file(struct file *file,
{
struct regmap *map = container_of(file->private_data,
struct regmap, cache_only);
- ssize_t result;
- bool was_enabled, require_sync = false;
+ bool new_val, require_sync = false;
int err;
- map->lock(map->lock_arg);
+ err = kstrtobool_from_user(user_buf, count, &new_val);
+ /* Ignore malforned data like debugfs_write_file_bool() */
+ if (err)
+ return count;
- was_enabled = map->cache_only;
+ err = debugfs_file_get(file->f_path.dentry);
+ if (err)
+ return err;
- result = debugfs_write_file_bool(file, user_buf, count, ppos);
- if (result < 0) {
- map->unlock(map->lock_arg);
- return result;
- }
+ map->lock(map->lock_arg);
- if (map->cache_only && !was_enabled) {
+ if (new_val && !map->cache_only) {
dev_warn(map->dev, "debugfs cache_only=Y forced\n");
add_taint(TAINT_USER, LOCKDEP_STILL_OK);
- } else if (!map->cache_only && was_enabled) {
+ } else if (!new_val && map->cache_only) {
dev_warn(map->dev, "debugfs cache_only=N forced: syncing cache\n");
require_sync = true;
}
+ map->cache_only = new_val;
map->unlock(map->lock_arg);
+ debugfs_file_put(file->f_path.dentry);
if (require_sync) {
err = regcache_sync(map);
@@ -487,7 +489,7 @@ static ssize_t regmap_cache_only_write_file(struct file *file,
dev_err(map->dev, "Failed to sync cache %d\n", err);
}
- return result;
+ return count;
}
static const struct file_operations regmap_cache_only_fops = {
@@ -502,28 +504,32 @@ static ssize_t regmap_cache_bypass_write_file(struct file *file,
{
struct regmap *map = container_of(file->private_data,
struct regmap, cache_bypass);
- ssize_t result;
- bool was_enabled;
+ bool new_val;
+ int err;
- map->lock(map->lock_arg);
+ err = kstrtobool_from_user(user_buf, count, &new_val);
+ /* Ignore malforned data like debugfs_write_file_bool() */
+ if (err)
+ return count;
- was_enabled = map->cache_bypass;
+ err = debugfs_file_get(file->f_path.dentry);
+ if (err)
+ return err;
- result = debugfs_write_file_bool(file, user_buf, count, ppos);
- if (result < 0)
- goto out;
+ map->lock(map->lock_arg);
- if (map->cache_bypass && !was_enabled) {
+ if (new_val && !map->cache_bypass) {
dev_warn(map->dev, "debugfs cache_bypass=Y forced\n");
add_taint(TAINT_USER, LOCKDEP_STILL_OK);
- } else if (!map->cache_bypass && was_enabled) {
+ } else if (!new_val && map->cache_bypass) {
dev_warn(map->dev, "debugfs cache_bypass=N forced\n");
}
+ map->cache_bypass = new_val;
-out:
map->unlock(map->lock_arg);
+ debugfs_file_put(file->f_path.dentry);
- return result;
+ return count;
}
static const struct file_operations regmap_cache_bypass_fops = {
--
2.25.1
^ permalink raw reply related [flat|nested] 256+ messages in thread* [PATCH 5.7 117/244] copy_xstate_to_kernel: Fix typo which caused GDB regression
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 116/244] regmap: debugfs: Dont sleep while atomic for fast_io regmaps Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 118/244] arm: dts: mt7623: add phy-mode property for gmac2 Greg Kroah-Hartman
` (127 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kevin Buettner, Al Viro, Dave Airlie,
Linus Torvalds
From: Kevin Buettner <kevinb@redhat.com>
commit 5714ee50bb4375bd586858ad800b1d9772847452 upstream.
This fixes a regression encountered while running the
gdb.base/corefile.exp test in GDB's test suite.
In my testing, the typo prevented the sw_reserved field of struct
fxregs_state from being output to the kernel XSAVES area. Thus the
correct mask corresponding to XCR0 was not present in the core file for
GDB to interrogate, resulting in the following behavior:
[kev@f32-1 gdb]$ ./gdb -q testsuite/outputs/gdb.base/corefile/corefile testsuite/outputs/gdb.base/corefile/corefile.core
Reading symbols from testsuite/outputs/gdb.base/corefile/corefile...
[New LWP 232880]
warning: Unexpected size of section `.reg-xstate/232880' in core file.
With the typo fixed, the test works again as expected.
Signed-off-by: Kevin Buettner <kevinb@redhat.com>
Fixes: 9e4636545933 ("copy_xstate_to_kernel(): don't leave parts of destination uninitialized")
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Dave Airlie <airlied@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/fpu/xstate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1022,7 +1022,7 @@ int copy_xstate_to_kernel(void *kbuf, st
copy_part(offsetof(struct fxregs_state, st_space), 128,
&xsave->i387.st_space, &kbuf, &offset_start, &count);
if (header.xfeatures & XFEATURE_MASK_SSE)
- copy_part(xstate_offsets[XFEATURE_MASK_SSE], 256,
+ copy_part(xstate_offsets[XFEATURE_SSE], 256,
&xsave->i387.xmm_space, &kbuf, &offset_start, &count);
/*
* Fill xsave->i387.sw_reserved value for ptrace frame:
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 118/244] arm: dts: mt7623: add phy-mode property for gmac2
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 117/244] copy_xstate_to_kernel: Fix typo which caused GDB regression Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 119/244] soc: qcom: socinfo: add missing soc_id sysfs entry Greg Kroah-Hartman
` (126 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sean Wang, Matthias Brugger
From: Sean Wang <sean.wang@mediatek.com>
commit ff5b89c2858f28006f9f9c0a88c55a679488192c upstream.
Add phy-mode property required by phylink on gmac2
Fixes: b8fc9f30821e ("net: ethernet: mediatek: Add basic PHYLINK support")
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Link: https://lore.kernel.org/r/70e3eff31ecd500ed4862d9de28325a4dbd15105.1583648927.git.sean.wang@mediatek.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/mt7623n-rfb-emmc.dts | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/boot/dts/mt7623n-rfb-emmc.dts
+++ b/arch/arm/boot/dts/mt7623n-rfb-emmc.dts
@@ -138,6 +138,7 @@
mac@1 {
compatible = "mediatek,eth-mac";
reg = <1>;
+ phy-mode = "rgmii";
phy-handle = <&phy5>;
};
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 119/244] soc: qcom: socinfo: add missing soc_id sysfs entry
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 118/244] arm: dts: mt7623: add phy-mode property for gmac2 Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 120/244] dmaengine: ti: k3-udma: Disable memcopy via MCU NAVSS on am654 Greg Kroah-Hartman
` (125 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stephen Boyd, Srinivas Kandagatla,
Bjorn Andersson
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
commit 27a344139c186889d742764d3c2a62b395949cef upstream.
Looks like SoC ID is not exported to sysfs for some reason.
This patch adds it!
This is mostly used by userspace libraries like Snapdragon
Neural Processing Engine (SNPE) SDK for checking supported SoC info.
Fixes: efb448d0a3fc ("soc: qcom: Add socinfo driver")
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20200319121418.5180-1-srinivas.kandagatla@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/qcom/socinfo.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/soc/qcom/socinfo.c
+++ b/drivers/soc/qcom/socinfo.c
@@ -430,6 +430,8 @@ static int qcom_socinfo_probe(struct pla
qs->attr.family = "Snapdragon";
qs->attr.machine = socinfo_machine(&pdev->dev,
le32_to_cpu(info->id));
+ qs->attr.soc_id = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%u",
+ le32_to_cpu(info->id));
qs->attr.revision = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%u.%u",
SOCINFO_MAJOR(le32_to_cpu(info->ver)),
SOCINFO_MINOR(le32_to_cpu(info->ver)));
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 120/244] dmaengine: ti: k3-udma: Disable memcopy via MCU NAVSS on am654
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 119/244] soc: qcom: socinfo: add missing soc_id sysfs entry Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 121/244] apparmor: ensure that dfa state tables have entries Greg Kroah-Hartman
` (124 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Vinod Koul
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
commit a4e688535a0829980d5ef1516c0713777a874c62 upstream.
Trace of a test for DMA memcpy domains slipped into the glue layer commit.
The memcpy support should be disabled on the MCU UDMAP.
Fixes: d702419134133 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Link: https://lore.kernel.org/r/20200327144228.11101-1-peter.ujfalusi@ti.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/ti/k3-udma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -3186,7 +3186,7 @@ static struct udma_match_data am654_main
static struct udma_match_data am654_mcu_data = {
.psil_base = 0x6000,
- .enable_memcpy_support = true, /* TEST: DMA domains */
+ .enable_memcpy_support = false,
.statictr_z_mask = GENMASK(11, 0),
.rchan_oes_offset = 0x2000,
.tpl_levels = 2,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 121/244] apparmor: ensure that dfa state tables have entries
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 120/244] dmaengine: ti: k3-udma: Disable memcopy via MCU NAVSS on am654 Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 122/244] habanalabs: Align protection bits configuration of all TPCs Greg Kroah-Hartman
` (123 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mike Salvatore, John Johansen
From: John Johansen <john.johansen@canonical.com>
commit c27c6bd2c4d6b6bb779f9b722d5607993e1d5e5c upstream.
Currently it is possible to specify a state machine table with 0 length,
this is not valid as optional tables are specified by not defining
the table as present. Further this allows by-passing the base tables
range check against the next/check tables.
Fixes: d901d6a298dc ("apparmor: dfa split verification of table headers")
Reported-by: Mike Salvatore <mike.salvatore@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/match.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -97,6 +97,9 @@ static struct table_header *unpack_table
th.td_flags == YYTD_DATA8))
goto out;
+ /* if we have a table it must have some entries */
+ if (th.td_lolen == 0)
+ goto out;
tsize = table_size(th.td_lolen, th.td_flags);
if (bsize < tsize)
goto out;
@@ -198,6 +201,8 @@ static int verify_dfa(struct aa_dfa *dfa
state_count = dfa->tables[YYTD_ID_BASE]->td_lolen;
trans_count = dfa->tables[YYTD_ID_NXT]->td_lolen;
+ if (state_count == 0)
+ goto out;
for (i = 0; i < state_count; i++) {
if (!(BASE_TABLE(dfa)[i] & MATCH_FLAG_DIFF_ENCODE) &&
(DEFAULT_TABLE(dfa)[i] >= state_count))
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 122/244] habanalabs: Align protection bits configuration of all TPCs
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 121/244] apparmor: ensure that dfa state tables have entries Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 123/244] RDMA/rxe: Set default vendor ID Greg Kroah-Hartman
` (122 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tomer Tayar, Oded Gabbay
From: Tomer Tayar <ttayar@habana.ai>
commit 79c823c57e69d9e584a5ee4ee6406eb3854393ae upstream.
Align the protection bits configuration of all TPC cores to be as of TPC
core 0.
Fixes: a513f9a7eca5 ("habanalabs: make tpc registers secured")
Signed-off-by: Tomer Tayar <ttayar@habana.ai>
Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/habanalabs/goya/goya_security.c | 99 ++++++++++++++++++++++++++-
1 file changed, 98 insertions(+), 1 deletion(-)
--- a/drivers/misc/habanalabs/goya/goya_security.c
+++ b/drivers/misc/habanalabs/goya/goya_security.c
@@ -695,7 +695,6 @@ static void goya_init_tpc_protection_bit
mask |= 1 << ((mmTPC0_CFG_CFG_SUBTRACT_VALUE & 0x7F) >> 2);
mask |= 1 << ((mmTPC0_CFG_SM_BASE_ADDRESS_LOW & 0x7F) >> 2);
mask |= 1 << ((mmTPC0_CFG_SM_BASE_ADDRESS_HIGH & 0x7F) >> 2);
- mask |= 1 << ((mmTPC0_CFG_CFG_SUBTRACT_VALUE & 0x7F) >> 2);
mask |= 1 << ((mmTPC0_CFG_TPC_STALL & 0x7F) >> 2);
mask |= 1 << ((mmTPC0_CFG_MSS_CONFIG & 0x7F) >> 2);
mask |= 1 << ((mmTPC0_CFG_TPC_INTR_CAUSE & 0x7F) >> 2);
@@ -875,6 +874,16 @@ static void goya_init_tpc_protection_bit
goya_pb_set_block(hdev, mmTPC1_RD_REGULATOR_BASE);
goya_pb_set_block(hdev, mmTPC1_WR_REGULATOR_BASE);
+ pb_addr = (mmTPC1_CFG_SEMAPHORE & ~0xFFF) + PROT_BITS_OFFS;
+ word_offset = ((mmTPC1_CFG_SEMAPHORE & PROT_BITS_OFFS) >> 7) << 2;
+
+ mask = 1 << ((mmTPC1_CFG_SEMAPHORE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC1_CFG_VFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC1_CFG_SFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC1_CFG_STATUS & 0x7F) >> 2);
+
+ WREG32(pb_addr + word_offset, ~mask);
+
pb_addr = (mmTPC1_CFG_CFG_BASE_ADDRESS_HIGH & ~0xFFF) + PROT_BITS_OFFS;
word_offset = ((mmTPC1_CFG_CFG_BASE_ADDRESS_HIGH &
PROT_BITS_OFFS) >> 7) << 2;
@@ -882,6 +891,10 @@ static void goya_init_tpc_protection_bit
mask |= 1 << ((mmTPC1_CFG_CFG_SUBTRACT_VALUE & 0x7F) >> 2);
mask |= 1 << ((mmTPC1_CFG_SM_BASE_ADDRESS_LOW & 0x7F) >> 2);
mask |= 1 << ((mmTPC1_CFG_SM_BASE_ADDRESS_HIGH & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC1_CFG_TPC_STALL & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC1_CFG_MSS_CONFIG & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC1_CFG_TPC_INTR_CAUSE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC1_CFG_TPC_INTR_MASK & 0x7F) >> 2);
WREG32(pb_addr + word_offset, ~mask);
@@ -1057,6 +1070,16 @@ static void goya_init_tpc_protection_bit
goya_pb_set_block(hdev, mmTPC2_RD_REGULATOR_BASE);
goya_pb_set_block(hdev, mmTPC2_WR_REGULATOR_BASE);
+ pb_addr = (mmTPC2_CFG_SEMAPHORE & ~0xFFF) + PROT_BITS_OFFS;
+ word_offset = ((mmTPC2_CFG_SEMAPHORE & PROT_BITS_OFFS) >> 7) << 2;
+
+ mask = 1 << ((mmTPC2_CFG_SEMAPHORE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC2_CFG_VFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC2_CFG_SFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC2_CFG_STATUS & 0x7F) >> 2);
+
+ WREG32(pb_addr + word_offset, ~mask);
+
pb_addr = (mmTPC2_CFG_CFG_BASE_ADDRESS_HIGH & ~0xFFF) + PROT_BITS_OFFS;
word_offset = ((mmTPC2_CFG_CFG_BASE_ADDRESS_HIGH &
PROT_BITS_OFFS) >> 7) << 2;
@@ -1064,6 +1087,10 @@ static void goya_init_tpc_protection_bit
mask |= 1 << ((mmTPC2_CFG_CFG_SUBTRACT_VALUE & 0x7F) >> 2);
mask |= 1 << ((mmTPC2_CFG_SM_BASE_ADDRESS_LOW & 0x7F) >> 2);
mask |= 1 << ((mmTPC2_CFG_SM_BASE_ADDRESS_HIGH & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC2_CFG_TPC_STALL & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC2_CFG_MSS_CONFIG & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC2_CFG_TPC_INTR_CAUSE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC2_CFG_TPC_INTR_MASK & 0x7F) >> 2);
WREG32(pb_addr + word_offset, ~mask);
@@ -1239,6 +1266,16 @@ static void goya_init_tpc_protection_bit
goya_pb_set_block(hdev, mmTPC3_RD_REGULATOR_BASE);
goya_pb_set_block(hdev, mmTPC3_WR_REGULATOR_BASE);
+ pb_addr = (mmTPC3_CFG_SEMAPHORE & ~0xFFF) + PROT_BITS_OFFS;
+ word_offset = ((mmTPC3_CFG_SEMAPHORE & PROT_BITS_OFFS) >> 7) << 2;
+
+ mask = 1 << ((mmTPC3_CFG_SEMAPHORE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC3_CFG_VFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC3_CFG_SFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC3_CFG_STATUS & 0x7F) >> 2);
+
+ WREG32(pb_addr + word_offset, ~mask);
+
pb_addr = (mmTPC3_CFG_CFG_BASE_ADDRESS_HIGH & ~0xFFF) + PROT_BITS_OFFS;
word_offset = ((mmTPC3_CFG_CFG_BASE_ADDRESS_HIGH
& PROT_BITS_OFFS) >> 7) << 2;
@@ -1246,6 +1283,10 @@ static void goya_init_tpc_protection_bit
mask |= 1 << ((mmTPC3_CFG_CFG_SUBTRACT_VALUE & 0x7F) >> 2);
mask |= 1 << ((mmTPC3_CFG_SM_BASE_ADDRESS_LOW & 0x7F) >> 2);
mask |= 1 << ((mmTPC3_CFG_SM_BASE_ADDRESS_HIGH & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC3_CFG_TPC_STALL & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC3_CFG_MSS_CONFIG & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC3_CFG_TPC_INTR_CAUSE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC3_CFG_TPC_INTR_MASK & 0x7F) >> 2);
WREG32(pb_addr + word_offset, ~mask);
@@ -1421,6 +1462,16 @@ static void goya_init_tpc_protection_bit
goya_pb_set_block(hdev, mmTPC4_RD_REGULATOR_BASE);
goya_pb_set_block(hdev, mmTPC4_WR_REGULATOR_BASE);
+ pb_addr = (mmTPC4_CFG_SEMAPHORE & ~0xFFF) + PROT_BITS_OFFS;
+ word_offset = ((mmTPC4_CFG_SEMAPHORE & PROT_BITS_OFFS) >> 7) << 2;
+
+ mask = 1 << ((mmTPC4_CFG_SEMAPHORE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC4_CFG_VFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC4_CFG_SFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC4_CFG_STATUS & 0x7F) >> 2);
+
+ WREG32(pb_addr + word_offset, ~mask);
+
pb_addr = (mmTPC4_CFG_CFG_BASE_ADDRESS_HIGH & ~0xFFF) + PROT_BITS_OFFS;
word_offset = ((mmTPC4_CFG_CFG_BASE_ADDRESS_HIGH &
PROT_BITS_OFFS) >> 7) << 2;
@@ -1428,6 +1479,10 @@ static void goya_init_tpc_protection_bit
mask |= 1 << ((mmTPC4_CFG_CFG_SUBTRACT_VALUE & 0x7F) >> 2);
mask |= 1 << ((mmTPC4_CFG_SM_BASE_ADDRESS_LOW & 0x7F) >> 2);
mask |= 1 << ((mmTPC4_CFG_SM_BASE_ADDRESS_HIGH & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC4_CFG_TPC_STALL & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC4_CFG_MSS_CONFIG & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC4_CFG_TPC_INTR_CAUSE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC4_CFG_TPC_INTR_MASK & 0x7F) >> 2);
WREG32(pb_addr + word_offset, ~mask);
@@ -1603,6 +1658,16 @@ static void goya_init_tpc_protection_bit
goya_pb_set_block(hdev, mmTPC5_RD_REGULATOR_BASE);
goya_pb_set_block(hdev, mmTPC5_WR_REGULATOR_BASE);
+ pb_addr = (mmTPC5_CFG_SEMAPHORE & ~0xFFF) + PROT_BITS_OFFS;
+ word_offset = ((mmTPC5_CFG_SEMAPHORE & PROT_BITS_OFFS) >> 7) << 2;
+
+ mask = 1 << ((mmTPC5_CFG_SEMAPHORE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC5_CFG_VFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC5_CFG_SFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC5_CFG_STATUS & 0x7F) >> 2);
+
+ WREG32(pb_addr + word_offset, ~mask);
+
pb_addr = (mmTPC5_CFG_CFG_BASE_ADDRESS_HIGH & ~0xFFF) + PROT_BITS_OFFS;
word_offset = ((mmTPC5_CFG_CFG_BASE_ADDRESS_HIGH &
PROT_BITS_OFFS) >> 7) << 2;
@@ -1610,6 +1675,10 @@ static void goya_init_tpc_protection_bit
mask |= 1 << ((mmTPC5_CFG_CFG_SUBTRACT_VALUE & 0x7F) >> 2);
mask |= 1 << ((mmTPC5_CFG_SM_BASE_ADDRESS_LOW & 0x7F) >> 2);
mask |= 1 << ((mmTPC5_CFG_SM_BASE_ADDRESS_HIGH & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC5_CFG_TPC_STALL & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC5_CFG_MSS_CONFIG & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC5_CFG_TPC_INTR_CAUSE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC5_CFG_TPC_INTR_MASK & 0x7F) >> 2);
WREG32(pb_addr + word_offset, ~mask);
@@ -1785,6 +1854,16 @@ static void goya_init_tpc_protection_bit
goya_pb_set_block(hdev, mmTPC6_RD_REGULATOR_BASE);
goya_pb_set_block(hdev, mmTPC6_WR_REGULATOR_BASE);
+ pb_addr = (mmTPC6_CFG_SEMAPHORE & ~0xFFF) + PROT_BITS_OFFS;
+ word_offset = ((mmTPC6_CFG_SEMAPHORE & PROT_BITS_OFFS) >> 7) << 2;
+
+ mask = 1 << ((mmTPC6_CFG_SEMAPHORE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC6_CFG_VFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC6_CFG_SFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC6_CFG_STATUS & 0x7F) >> 2);
+
+ WREG32(pb_addr + word_offset, ~mask);
+
pb_addr = (mmTPC6_CFG_CFG_BASE_ADDRESS_HIGH & ~0xFFF) + PROT_BITS_OFFS;
word_offset = ((mmTPC6_CFG_CFG_BASE_ADDRESS_HIGH &
PROT_BITS_OFFS) >> 7) << 2;
@@ -1792,6 +1871,10 @@ static void goya_init_tpc_protection_bit
mask |= 1 << ((mmTPC6_CFG_CFG_SUBTRACT_VALUE & 0x7F) >> 2);
mask |= 1 << ((mmTPC6_CFG_SM_BASE_ADDRESS_LOW & 0x7F) >> 2);
mask |= 1 << ((mmTPC6_CFG_SM_BASE_ADDRESS_HIGH & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC6_CFG_TPC_STALL & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC6_CFG_MSS_CONFIG & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC6_CFG_TPC_INTR_CAUSE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC6_CFG_TPC_INTR_MASK & 0x7F) >> 2);
WREG32(pb_addr + word_offset, ~mask);
@@ -1967,6 +2050,16 @@ static void goya_init_tpc_protection_bit
goya_pb_set_block(hdev, mmTPC7_RD_REGULATOR_BASE);
goya_pb_set_block(hdev, mmTPC7_WR_REGULATOR_BASE);
+ pb_addr = (mmTPC7_CFG_SEMAPHORE & ~0xFFF) + PROT_BITS_OFFS;
+ word_offset = ((mmTPC7_CFG_SEMAPHORE & PROT_BITS_OFFS) >> 7) << 2;
+
+ mask = 1 << ((mmTPC7_CFG_SEMAPHORE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC7_CFG_VFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC7_CFG_SFLAGS & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC7_CFG_STATUS & 0x7F) >> 2);
+
+ WREG32(pb_addr + word_offset, ~mask);
+
pb_addr = (mmTPC7_CFG_CFG_BASE_ADDRESS_HIGH & ~0xFFF) + PROT_BITS_OFFS;
word_offset = ((mmTPC7_CFG_CFG_BASE_ADDRESS_HIGH &
PROT_BITS_OFFS) >> 7) << 2;
@@ -1974,6 +2067,10 @@ static void goya_init_tpc_protection_bit
mask |= 1 << ((mmTPC7_CFG_CFG_SUBTRACT_VALUE & 0x7F) >> 2);
mask |= 1 << ((mmTPC7_CFG_SM_BASE_ADDRESS_LOW & 0x7F) >> 2);
mask |= 1 << ((mmTPC7_CFG_SM_BASE_ADDRESS_HIGH & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC7_CFG_TPC_STALL & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC7_CFG_MSS_CONFIG & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC7_CFG_TPC_INTR_CAUSE & 0x7F) >> 2);
+ mask |= 1 << ((mmTPC7_CFG_TPC_INTR_MASK & 0x7F) >> 2);
WREG32(pb_addr + word_offset, ~mask);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 123/244] RDMA/rxe: Set default vendor ID
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 122/244] habanalabs: Align protection bits configuration of all TPCs Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 124/244] PCI/PM: Call .bridge_d3() hook only if non-NULL Greg Kroah-Hartman
` (121 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhu Yanjun, Leon Romanovsky, Jason Gunthorpe
From: Zhu Yanjun <yanjunz@mellanox.com>
commit 0184afd15a141d7ce24c32c0d86a1e3ba6bc0eb3 upstream.
The RXE driver doesn't set vendor_id and user space applications see
zeros. This causes to pyverbs tests to fail with the following traceback,
because the expectation is to have valid vendor_id.
Traceback (most recent call last):
File "tests/test_device.py", line 51, in test_query_device
self.verify_device_attr(attr)
File "tests/test_device.py", line 77, in verify_device_attr
assert attr.vendor_id != 0
In order to fix it, we will set vendor_id 0XFFFFFF, according to the IBTA
v1.4 A3.3.1 VENDOR INFORMATION section.
"""
A vendor that produces a generic controller (i.e., one that supports a
standard I/O protocol such as SRP), which does not have vendor specific
device drivers, may use the value of 0xFFFFFF in the VendorID field.
"""
Before:
hca_id: rxe0
transport: InfiniBand (0)
fw_ver: 0.0.0
node_guid: 5054:00ff:feaa:5363
sys_image_guid: 5054:00ff:feaa:5363
vendor_id: 0x0000
After:
hca_id: rxe0
transport: InfiniBand (0)
fw_ver: 0.0.0
node_guid: 5054:00ff:feaa:5363
sys_image_guid: 5054:00ff:feaa:5363
vendor_id: 0xffffff
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20200406173501.1466273-1-leon@kernel.org
Signed-off-by: Zhu Yanjun <yanjunz@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/sw/rxe/rxe.c | 1 +
drivers/infiniband/sw/rxe/rxe_param.h | 3 +++
2 files changed, 4 insertions(+)
--- a/drivers/infiniband/sw/rxe/rxe.c
+++ b/drivers/infiniband/sw/rxe/rxe.c
@@ -77,6 +77,7 @@ static void rxe_init_device_param(struct
{
rxe->max_inline_data = RXE_MAX_INLINE_DATA;
+ rxe->attr.vendor_id = RXE_VENDOR_ID;
rxe->attr.max_mr_size = RXE_MAX_MR_SIZE;
rxe->attr.page_size_cap = RXE_PAGE_SIZE_CAP;
rxe->attr.max_qp = RXE_MAX_QP;
--- a/drivers/infiniband/sw/rxe/rxe_param.h
+++ b/drivers/infiniband/sw/rxe/rxe_param.h
@@ -127,6 +127,9 @@ enum rxe_device_param {
/* Delay before calling arbiter timer */
RXE_NSEC_ARB_TIMER_DELAY = 200,
+
+ /* IBTA v1.4 A3.3.1 VENDOR INFORMATION section */
+ RXE_VENDOR_ID = 0XFFFFFF,
};
/* default/initial rxe port parameters */
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 124/244] PCI/PM: Call .bridge_d3() hook only if non-NULL
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 123/244] RDMA/rxe: Set default vendor ID Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 125/244] perf stat: Zero all the ena and run array slot stats for interval mode Greg Kroah-Hartman
` (120 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bjorn Helgaas, Mika Westerberg
From: Bjorn Helgaas <bhelgaas@google.com>
commit c3aaf086701d05a82c8156ee8620af41e5a7d6fe upstream.
26ad34d510a8 ("PCI / ACPI: Whitelist D3 for more PCIe hotplug ports") added
the struct pci_platform_pm_ops.bridge_d3() function pointer and
platform_pci_bridge_d3() to use it.
The .bridge_d3() op is implemented by acpi_pci_platform_pm, but not by
mid_pci_platform_pm. We don't expect platform_pci_bridge_d3() to be called
on Intel MID platforms, but nothing in the code itself would prevent that.
Check the .bridge_d3() pointer for NULL before calling it.
Fixes: 26ad34d510a8 ("PCI / ACPI: Whitelist D3 for more PCIe hotplug ports")
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -868,7 +868,9 @@ static inline bool platform_pci_need_res
static inline bool platform_pci_bridge_d3(struct pci_dev *dev)
{
- return pci_platform_pm ? pci_platform_pm->bridge_d3(dev) : false;
+ if (pci_platform_pm && pci_platform_pm->bridge_d3)
+ return pci_platform_pm->bridge_d3(dev);
+ return false;
}
/**
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 125/244] perf stat: Zero all the ena and run array slot stats for interval mode
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 124/244] PCI/PM: Call .bridge_d3() hook only if non-NULL Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 126/244] soc: qcom: rpmh: Update dirty flag only when data changes Greg Kroah-Hartman
` (119 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jin Yao, Alexander Shishkin,
Andi Kleen, Jin Yao, Jiri Olsa, Kan Liang, Peter Zijlstra,
Arnaldo Carvalho de Melo
From: Jin Yao <yao.jin@linux.intel.com>
commit 0e0bf1ea1147fcf74eab19c2d3c853cc3740a72f upstream.
As the code comments in perf_stat_process_counter() say, we calculate
counter's data every interval, and the display code shows ps->res_stats
avg value. We need to zero the stats for interval mode.
But the current code only zeros the res_stats[0], it doesn't zero the
res_stats[1] and res_stats[2], which are for ena and run of counter.
This patch zeros the whole res_stats[] for interval mode.
Fixes: 51fd2df1e882 ("perf stat: Fix interval output values")
Signed-off-by: Jin Yao <yao.jin@linux.intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Jin Yao <yao.jin@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lore.kernel.org/lkml/20200409070755.17261-1-yao.jin@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/stat.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/tools/perf/util/stat.c
+++ b/tools/perf/util/stat.c
@@ -368,8 +368,10 @@ int perf_stat_process_counter(struct per
* interval mode, otherwise overall avg running
* averages will be shown for each interval.
*/
- if (config->interval)
- init_stats(ps->res_stats);
+ if (config->interval) {
+ for (i = 0; i < 3; i++)
+ init_stats(&ps->res_stats[i]);
+ }
if (counter->per_pkg)
zero_per_pkg(counter);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 126/244] soc: qcom: rpmh: Update dirty flag only when data changes
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 125/244] perf stat: Zero all the ena and run array slot stats for interval mode Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 127/244] soc: qcom: rpmh: Invalidate SLEEP and WAKE TCSes before flushing new data Greg Kroah-Hartman
` (118 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maulik Shah, Srinivas Rao L,
Evan Green, Douglas Anderson, Stephen Boyd, Bjorn Andersson
From: Maulik Shah <mkshah@codeaurora.org>
commit bb7000677a1b287206c8d4327c62442fa3050a8f upstream.
Currently rpmh ctrlr dirty flag is set for all cases regardless of data
is really changed or not. Add changes to update dirty flag when data is
changed to newer values. Update dirty flag everytime when data in batch
cache is updated since rpmh_flush() may get invoked from any CPU instead
of only last CPU going to low power mode.
Also move dirty flag updates to happen from within cache_lock and remove
unnecessary INIT_LIST_HEAD() call and a default case from switch.
Fixes: 600513dfeef3 ("drivers: qcom: rpmh: cache sleep/wake state requests")
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
Reviewed-by: Srinivas Rao L <lsrao@codeaurora.org>
Reviewed-by: Evan Green <evgreen@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/1586703004-13674-3-git-send-email-mkshah@codeaurora.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/qcom/rpmh.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
--- a/drivers/soc/qcom/rpmh.c
+++ b/drivers/soc/qcom/rpmh.c
@@ -119,6 +119,7 @@ static struct cache_req *cache_rpm_reque
{
struct cache_req *req;
unsigned long flags;
+ u32 old_sleep_val, old_wake_val;
spin_lock_irqsave(&ctrlr->cache_lock, flags);
req = __find_req(ctrlr, cmd->addr);
@@ -133,26 +134,27 @@ static struct cache_req *cache_rpm_reque
req->addr = cmd->addr;
req->sleep_val = req->wake_val = UINT_MAX;
- INIT_LIST_HEAD(&req->list);
list_add_tail(&req->list, &ctrlr->cache);
existing:
+ old_sleep_val = req->sleep_val;
+ old_wake_val = req->wake_val;
+
switch (state) {
case RPMH_ACTIVE_ONLY_STATE:
- if (req->sleep_val != UINT_MAX)
- req->wake_val = cmd->data;
- break;
case RPMH_WAKE_ONLY_STATE:
req->wake_val = cmd->data;
break;
case RPMH_SLEEP_STATE:
req->sleep_val = cmd->data;
break;
- default:
- break;
}
- ctrlr->dirty = true;
+ ctrlr->dirty = (req->sleep_val != old_sleep_val ||
+ req->wake_val != old_wake_val) &&
+ req->sleep_val != UINT_MAX &&
+ req->wake_val != UINT_MAX;
+
unlock:
spin_unlock_irqrestore(&ctrlr->cache_lock, flags);
@@ -287,6 +289,7 @@ static void cache_batch(struct rpmh_ctrl
spin_lock_irqsave(&ctrlr->cache_lock, flags);
list_add_tail(&req->list, &ctrlr->batch_cache);
+ ctrlr->dirty = true;
spin_unlock_irqrestore(&ctrlr->cache_lock, flags);
}
@@ -323,6 +326,7 @@ static void invalidate_batch(struct rpmh
list_for_each_entry_safe(req, tmp, &ctrlr->batch_cache, list)
kfree(req);
INIT_LIST_HEAD(&ctrlr->batch_cache);
+ ctrlr->dirty = true;
spin_unlock_irqrestore(&ctrlr->cache_lock, flags);
}
@@ -507,7 +511,6 @@ int rpmh_invalidate(const struct device
int ret;
invalidate_batch(ctrlr);
- ctrlr->dirty = true;
do {
ret = rpmh_rsc_invalidate(ctrlr_to_drv(ctrlr));
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 127/244] soc: qcom: rpmh: Invalidate SLEEP and WAKE TCSes before flushing new data
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 126/244] soc: qcom: rpmh: Update dirty flag only when data changes Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 128/244] soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS Greg Kroah-Hartman
` (117 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maulik Shah, Douglas Anderson,
Stephen Boyd, Bjorn Andersson
From: Maulik Shah <mkshah@codeaurora.org>
commit f5ac95f9ca2f439179a5baf48e1c0f22f83d936e upstream.
TCSes have previously programmed data when rpmh_flush() is called.
This can cause old data to trigger along with newly flushed.
Fix this by cleaning SLEEP and WAKE TCSes before new data is flushed.
With this there is no need to invoke rpmh_rsc_invalidate() call from
rpmh_invalidate().
Simplify rpmh_invalidate() by moving invalidate_batch() inside.
Fixes: 600513dfeef3 ("drivers: qcom: rpmh: cache sleep/wake state requests")
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/1586703004-13674-4-git-send-email-mkshah@codeaurora.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/qcom/rpmh.c | 41 ++++++++++++++++++-----------------------
1 file changed, 18 insertions(+), 23 deletions(-)
--- a/drivers/soc/qcom/rpmh.c
+++ b/drivers/soc/qcom/rpmh.c
@@ -317,19 +317,6 @@ static int flush_batch(struct rpmh_ctrlr
return ret;
}
-static void invalidate_batch(struct rpmh_ctrlr *ctrlr)
-{
- struct batch_cache_req *req, *tmp;
- unsigned long flags;
-
- spin_lock_irqsave(&ctrlr->cache_lock, flags);
- list_for_each_entry_safe(req, tmp, &ctrlr->batch_cache, list)
- kfree(req);
- INIT_LIST_HEAD(&ctrlr->batch_cache);
- ctrlr->dirty = true;
- spin_unlock_irqrestore(&ctrlr->cache_lock, flags);
-}
-
/**
* rpmh_write_batch: Write multiple sets of RPMH commands and wait for the
* batch to finish.
@@ -467,6 +454,13 @@ int rpmh_flush(struct rpmh_ctrlr *ctrlr)
return 0;
}
+ /* Invalidate the TCSes first to avoid stale data */
+ do {
+ ret = rpmh_rsc_invalidate(ctrlr_to_drv(ctrlr));
+ } while (ret == -EAGAIN);
+ if (ret)
+ return ret;
+
/* First flush the cached batch requests */
ret = flush_batch(ctrlr);
if (ret)
@@ -498,24 +492,25 @@ int rpmh_flush(struct rpmh_ctrlr *ctrlr)
}
/**
- * rpmh_invalidate: Invalidate all sleep and active sets
- * sets.
+ * rpmh_invalidate: Invalidate sleep and wake sets in batch_cache
*
* @dev: The device making the request
*
- * Invalidate the sleep and active values in the TCS blocks.
+ * Invalidate the sleep and wake values in batch_cache.
*/
int rpmh_invalidate(const struct device *dev)
{
struct rpmh_ctrlr *ctrlr = get_rpmh_ctrlr(dev);
- int ret;
-
- invalidate_batch(ctrlr);
+ struct batch_cache_req *req, *tmp;
+ unsigned long flags;
- do {
- ret = rpmh_rsc_invalidate(ctrlr_to_drv(ctrlr));
- } while (ret == -EAGAIN);
+ spin_lock_irqsave(&ctrlr->cache_lock, flags);
+ list_for_each_entry_safe(req, tmp, &ctrlr->batch_cache, list)
+ kfree(req);
+ INIT_LIST_HEAD(&ctrlr->batch_cache);
+ ctrlr->dirty = true;
+ spin_unlock_irqrestore(&ctrlr->cache_lock, flags);
- return ret;
+ return 0;
}
EXPORT_SYMBOL(rpmh_invalidate);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 128/244] soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 127/244] soc: qcom: rpmh: Invalidate SLEEP and WAKE TCSes before flushing new data Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 129/244] soc: qcom: rpmh-rsc: Allow using free WAKE TCS for active request Greg Kroah-Hartman
` (116 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Raju P.L.S.S.S.N, Maulik Shah,
Douglas Anderson, Stephen Boyd, Bjorn Andersson
From: Raju P.L.S.S.S.N <rplsssn@codeaurora.org>
commit 15b3bf61b8d48f8e0ccd9d7f1bcb468b543da396 upstream.
For RSCs that have sleep & wake TCS but no dedicated active TCS, wake
TCS can be re-purposed to send active requests. Once the active requests
are sent and response is received, the active mode configuration needs
to be cleared so that controller can use wake TCS for sending wake
requests.
Introduce enable_tcs_irq() to enable completion IRQ for repurposed TCSes.
Fixes: 2de4b8d33eab (drivers: qcom: rpmh-rsc: allow active requests from wake TCS)
Signed-off-by: Raju P.L.S.S.S.N <rplsssn@codeaurora.org>
[mkshah: call enable_tcs_irq() within drv->lock, update commit message]
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/1586703004-13674-6-git-send-email-mkshah@codeaurora.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/qcom/rpmh-rsc.c | 77 ++++++++++++++++++++++++++++++--------------
1 file changed, 54 insertions(+), 23 deletions(-)
--- a/drivers/soc/qcom/rpmh-rsc.c
+++ b/drivers/soc/qcom/rpmh-rsc.c
@@ -201,6 +201,42 @@ static const struct tcs_request *get_req
return NULL;
}
+static void __tcs_set_trigger(struct rsc_drv *drv, int tcs_id, bool trigger)
+{
+ u32 enable;
+
+ /*
+ * HW req: Clear the DRV_CONTROL and enable TCS again
+ * While clearing ensure that the AMC mode trigger is cleared
+ * and then the mode enable is cleared.
+ */
+ enable = read_tcs_reg(drv, RSC_DRV_CONTROL, tcs_id, 0);
+ enable &= ~TCS_AMC_MODE_TRIGGER;
+ write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
+ enable &= ~TCS_AMC_MODE_ENABLE;
+ write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
+
+ if (trigger) {
+ /* Enable the AMC mode on the TCS and then trigger the TCS */
+ enable = TCS_AMC_MODE_ENABLE;
+ write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
+ enable |= TCS_AMC_MODE_TRIGGER;
+ write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
+ }
+}
+
+static void enable_tcs_irq(struct rsc_drv *drv, int tcs_id, bool enable)
+{
+ u32 data;
+
+ data = read_tcs_reg(drv, RSC_DRV_IRQ_ENABLE, 0, 0);
+ if (enable)
+ data |= BIT(tcs_id);
+ else
+ data &= ~BIT(tcs_id);
+ write_tcs_reg(drv, RSC_DRV_IRQ_ENABLE, 0, data);
+}
+
/**
* tcs_tx_done: TX Done interrupt handler
*/
@@ -237,6 +273,14 @@ static irqreturn_t tcs_tx_done(int irq,
}
trace_rpmh_tx_done(drv, i, req, err);
+
+ /*
+ * If wake tcs was re-purposed for sending active
+ * votes, clear AMC trigger & enable modes and
+ * disable interrupt for this TCS
+ */
+ if (!drv->tcs[ACTIVE_TCS].num_tcs)
+ __tcs_set_trigger(drv, i, false);
skip:
/* Reclaim the TCS */
write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0);
@@ -244,6 +288,13 @@ skip:
write_tcs_reg(drv, RSC_DRV_IRQ_CLEAR, 0, BIT(i));
spin_lock(&drv->lock);
clear_bit(i, drv->tcs_in_use);
+ /*
+ * Disable interrupt for WAKE TCS to avoid being
+ * spammed with interrupts coming when the solver
+ * sends its wake votes.
+ */
+ if (!drv->tcs[ACTIVE_TCS].num_tcs)
+ enable_tcs_irq(drv, i, false);
spin_unlock(&drv->lock);
if (req)
rpmh_tx_done(req, err);
@@ -285,28 +336,6 @@ static void __tcs_buffer_write(struct rs
write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, tcs_id, cmd_enable);
}
-static void __tcs_trigger(struct rsc_drv *drv, int tcs_id)
-{
- u32 enable;
-
- /*
- * HW req: Clear the DRV_CONTROL and enable TCS again
- * While clearing ensure that the AMC mode trigger is cleared
- * and then the mode enable is cleared.
- */
- enable = read_tcs_reg(drv, RSC_DRV_CONTROL, tcs_id, 0);
- enable &= ~TCS_AMC_MODE_TRIGGER;
- write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
- enable &= ~TCS_AMC_MODE_ENABLE;
- write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
-
- /* Enable the AMC mode on the TCS and then trigger the TCS */
- enable = TCS_AMC_MODE_ENABLE;
- write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
- enable |= TCS_AMC_MODE_TRIGGER;
- write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
-}
-
static int check_for_req_inflight(struct rsc_drv *drv, struct tcs_group *tcs,
const struct tcs_request *msg)
{
@@ -377,10 +406,12 @@ static int tcs_write(struct rsc_drv *drv
tcs->req[tcs_id - tcs->offset] = msg;
set_bit(tcs_id, drv->tcs_in_use);
+ if (msg->state == RPMH_ACTIVE_ONLY_STATE && tcs->type != ACTIVE_TCS)
+ enable_tcs_irq(drv, tcs_id, true);
spin_unlock(&drv->lock);
__tcs_buffer_write(drv, tcs_id, 0, msg);
- __tcs_trigger(drv, tcs_id);
+ __tcs_set_trigger(drv, tcs_id, true);
done_write:
spin_unlock_irqrestore(&tcs->lock, flags);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 129/244] soc: qcom: rpmh-rsc: Allow using free WAKE TCS for active request
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 128/244] soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 130/244] RDMA/mlx5: Verify that QP is created with RQ or SQ Greg Kroah-Hartman
` (115 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maulik Shah, Douglas Anderson,
Stephen Boyd, Bjorn Andersson
From: Maulik Shah <mkshah@codeaurora.org>
commit 38427e5a47bf83299da930bd474c6cb2632ad810 upstream.
When there are more than one WAKE TCS available and there is no dedicated
ACTIVE TCS available, invalidating all WAKE TCSes and waiting for current
transfer to complete in first WAKE TCS blocks using another free WAKE TCS
to complete current request.
Remove rpmh_rsc_invalidate() to happen from tcs_write() when WAKE TCSes
is re-purposed to be used for Active mode. Clear only currently used
WAKE TCS's register configuration.
Fixes: 2de4b8d33eab (drivers: qcom: rpmh-rsc: allow active requests from wake TCS)
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/1586703004-13674-7-git-send-email-mkshah@codeaurora.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/qcom/rpmh-rsc.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
--- a/drivers/soc/qcom/rpmh-rsc.c
+++ b/drivers/soc/qcom/rpmh-rsc.c
@@ -148,7 +148,7 @@ int rpmh_rsc_invalidate(struct rsc_drv *
static struct tcs_group *get_tcs_for_msg(struct rsc_drv *drv,
const struct tcs_request *msg)
{
- int type, ret;
+ int type;
struct tcs_group *tcs;
switch (msg->state) {
@@ -169,19 +169,10 @@ static struct tcs_group *get_tcs_for_msg
* If we are making an active request on a RSC that does not have a
* dedicated TCS for active state use, then re-purpose a wake TCS to
* send active votes.
- * NOTE: The driver must be aware that this RSC does not have a
- * dedicated AMC, and therefore would invalidate the sleep and wake
- * TCSes before making an active state request.
*/
tcs = get_tcs_of_type(drv, type);
- if (msg->state == RPMH_ACTIVE_ONLY_STATE && !tcs->num_tcs) {
+ if (msg->state == RPMH_ACTIVE_ONLY_STATE && !tcs->num_tcs)
tcs = get_tcs_of_type(drv, WAKE_TCS);
- if (tcs->num_tcs) {
- ret = rpmh_rsc_invalidate(drv);
- if (ret)
- return ERR_PTR(ret);
- }
- }
return tcs;
}
@@ -406,8 +397,16 @@ static int tcs_write(struct rsc_drv *drv
tcs->req[tcs_id - tcs->offset] = msg;
set_bit(tcs_id, drv->tcs_in_use);
- if (msg->state == RPMH_ACTIVE_ONLY_STATE && tcs->type != ACTIVE_TCS)
+ if (msg->state == RPMH_ACTIVE_ONLY_STATE && tcs->type != ACTIVE_TCS) {
+ /*
+ * Clear previously programmed WAKE commands in selected
+ * repurposed TCS to avoid triggering them. tcs->slots will be
+ * cleaned from rpmh_flush() by invoking rpmh_rsc_invalidate()
+ */
+ write_tcs_reg_sync(drv, RSC_DRV_CMD_ENABLE, tcs_id, 0);
+ write_tcs_reg_sync(drv, RSC_DRV_CMD_WAIT_FOR_CMPL, tcs_id, 0);
enable_tcs_irq(drv, tcs_id, true);
+ }
spin_unlock(&drv->lock);
__tcs_buffer_write(drv, tcs_id, 0, msg);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 130/244] RDMA/mlx5: Verify that QP is created with RQ or SQ
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 129/244] soc: qcom: rpmh-rsc: Allow using free WAKE TCS for active request Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 131/244] clk: qcom: Add missing msm8998 ufs_unipro_core_clk_src Greg Kroah-Hartman
` (114 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aharon Landau, Maor Gottlieb,
Leon Romanovsky, Jason Gunthorpe
From: Aharon Landau <aharonl@mellanox.com>
commit 0eacc574aae7300bf46c10c7116c3ba5825505b7 upstream.
RAW packet QP and underlay QP must be created with either
RQ or SQ, check that.
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Link: https://lore.kernel.org/r/20200427154636.381474-37-leon@kernel.org
Signed-off-by: Aharon Landau <aharonl@mellanox.com>
Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx5/qp.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1525,6 +1525,8 @@ static int create_raw_packet_qp(struct m
u16 uid = to_mpd(pd)->uid;
u32 out[MLX5_ST_SZ_DW(create_tir_out)] = {};
+ if (!qp->sq.wqe_cnt && !qp->rq.wqe_cnt)
+ return -EINVAL;
if (qp->sq.wqe_cnt) {
err = create_raw_packet_qp_tis(dev, qp, sq, tdn, pd);
if (err)
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 131/244] clk: qcom: Add missing msm8998 ufs_unipro_core_clk_src
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 130/244] RDMA/mlx5: Verify that QP is created with RQ or SQ Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 132/244] mtd: spi-nor: winbond: Fix 4-byte opcode support for w25q256 Greg Kroah-Hartman
` (113 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeffrey Hugo, Stephen Boyd
From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
commit b1e8d713e6b2d59ee3a7b57c0dab88a19ec0cf33 upstream.
ufs_unipro_core_clk_src is required to allow UFS to clock scale for power
savings.
Fixes: b5f5f525c547 ("clk: qcom: Add MSM8998 Global Clock Control (GCC) driver")
Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Link: https://lkml.kernel.org/r/20200528142205.44003-1-jeffrey.l.hugo@gmail.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-msm8998.c | 27 +++++++++++++++++++++++++++
include/dt-bindings/clock/qcom,gcc-msm8998.h | 1 +
2 files changed, 28 insertions(+)
--- a/drivers/clk/qcom/gcc-msm8998.c
+++ b/drivers/clk/qcom/gcc-msm8998.c
@@ -1110,6 +1110,27 @@ static struct clk_rcg2 ufs_axi_clk_src =
},
};
+static const struct freq_tbl ftbl_ufs_unipro_core_clk_src[] = {
+ F(37500000, P_GPLL0_OUT_MAIN, 16, 0, 0),
+ F(75000000, P_GPLL0_OUT_MAIN, 8, 0, 0),
+ F(150000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
+ { }
+};
+
+static struct clk_rcg2 ufs_unipro_core_clk_src = {
+ .cmd_rcgr = 0x76028,
+ .mnd_width = 8,
+ .hid_width = 5,
+ .parent_map = gcc_parent_map_0,
+ .freq_tbl = ftbl_ufs_unipro_core_clk_src,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "ufs_unipro_core_clk_src",
+ .parent_names = gcc_parent_names_0,
+ .num_parents = 4,
+ .ops = &clk_rcg2_ops,
+ },
+};
+
static const struct freq_tbl ftbl_usb30_master_clk_src[] = {
F(19200000, P_XO, 1, 0, 0),
F(60000000, P_GPLL0_OUT_MAIN, 10, 0, 0),
@@ -2549,6 +2570,11 @@ static struct clk_branch gcc_ufs_unipro_
.enable_mask = BIT(0),
.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_unipro_core_clk",
+ .parent_names = (const char *[]){
+ "ufs_unipro_core_clk_src",
+ },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -2904,6 +2930,7 @@ static struct clk_regmap *gcc_msm8998_cl
[SDCC4_APPS_CLK_SRC] = &sdcc4_apps_clk_src.clkr,
[TSIF_REF_CLK_SRC] = &tsif_ref_clk_src.clkr,
[UFS_AXI_CLK_SRC] = &ufs_axi_clk_src.clkr,
+ [UFS_UNIPRO_CORE_CLK_SRC] = &ufs_unipro_core_clk_src.clkr,
[USB30_MASTER_CLK_SRC] = &usb30_master_clk_src.clkr,
[USB30_MOCK_UTMI_CLK_SRC] = &usb30_mock_utmi_clk_src.clkr,
[USB3_PHY_AUX_CLK_SRC] = &usb3_phy_aux_clk_src.clkr,
--- a/include/dt-bindings/clock/qcom,gcc-msm8998.h
+++ b/include/dt-bindings/clock/qcom,gcc-msm8998.h
@@ -183,6 +183,7 @@
#define GCC_MSS_SNOC_AXI_CLK 174
#define GCC_MSS_MNOC_BIMC_AXI_CLK 175
#define GCC_BIMC_GFX_CLK 176
+#define UFS_UNIPRO_CORE_CLK_SRC 177
#define PCIE_0_GDSC 0
#define UFS_GDSC 1
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 132/244] mtd: spi-nor: winbond: Fix 4-byte opcode support for w25q256
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 131/244] clk: qcom: Add missing msm8998 ufs_unipro_core_clk_src Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 133/244] mtd: spi-nor: spansion: fix writes on S25FS512S Greg Kroah-Hartman
` (112 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mantas Pucka, Tudor Ambarus
From: Mantas Pucka <mantas@8devices.com>
commit e8aec15dd5842b5b11b0e621a2293348d3574a61 upstream.
There are 2 different chips (w25q256fv and w25q256jv) that share
the same JEDEC ID. Only w25q256jv fully supports 4-byte opcodes.
Use SFDP header version to differentiate between them.
Fixes: 10050a02f7d5 ("mtd: spi-nor: Add 4B_OPCODES flag to w25q256")
Signed-off-by: Mantas Pucka <mantas@8devices.com>
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/spi-nor/sfdp.c | 4 ----
drivers/mtd/spi-nor/sfdp.h | 6 ++++++
drivers/mtd/spi-nor/winbond.c | 29 +++++++++++++++++++++++++++--
3 files changed, 33 insertions(+), 6 deletions(-)
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -21,10 +21,6 @@
#define SFDP_4BAIT_ID 0xff84 /* 4-byte Address Instruction Table */
#define SFDP_SIGNATURE 0x50444653U
-#define SFDP_JESD216_MAJOR 1
-#define SFDP_JESD216_MINOR 0
-#define SFDP_JESD216A_MINOR 5
-#define SFDP_JESD216B_MINOR 6
struct sfdp_header {
u32 signature; /* Ox50444653U <=> "SFDP" */
--- a/drivers/mtd/spi-nor/sfdp.h
+++ b/drivers/mtd/spi-nor/sfdp.h
@@ -7,6 +7,12 @@
#ifndef __LINUX_MTD_SFDP_H
#define __LINUX_MTD_SFDP_H
+/* SFDP revisions */
+#define SFDP_JESD216_MAJOR 1
+#define SFDP_JESD216_MINOR 0
+#define SFDP_JESD216A_MINOR 5
+#define SFDP_JESD216B_MINOR 6
+
/* Basic Flash Parameter Table */
/*
--- a/drivers/mtd/spi-nor/winbond.c
+++ b/drivers/mtd/spi-nor/winbond.c
@@ -8,6 +8,31 @@
#include "core.h"
+static int
+w25q256_post_bfpt_fixups(struct spi_nor *nor,
+ const struct sfdp_parameter_header *bfpt_header,
+ const struct sfdp_bfpt *bfpt,
+ struct spi_nor_flash_parameter *params)
+{
+ /*
+ * W25Q256JV supports 4B opcodes but W25Q256FV does not.
+ * Unfortunately, Winbond has re-used the same JEDEC ID for both
+ * variants which prevents us from defining a new entry in the parts
+ * table.
+ * To differentiate between W25Q256JV and W25Q256FV check SFDP header
+ * version: only JV has JESD216A compliant structure (version 5).
+ */
+ if (bfpt_header->major == SFDP_JESD216_MAJOR &&
+ bfpt_header->minor == SFDP_JESD216A_MINOR)
+ nor->flags |= SNOR_F_4B_OPCODES;
+
+ return 0;
+}
+
+static struct spi_nor_fixups w25q256_fixups = {
+ .post_bfpt = w25q256_post_bfpt_fixups,
+};
+
static const struct flash_info winbond_parts[] = {
/* Winbond -- w25x "blocks" are 64K, "sectors" are 4KiB */
{ "w25x05", INFO(0xef3010, 0, 64 * 1024, 1, SECT_4K) },
@@ -53,8 +78,8 @@ static const struct flash_info winbond_p
{ "w25q80bl", INFO(0xef4014, 0, 64 * 1024, 16, SECT_4K) },
{ "w25q128", INFO(0xef4018, 0, 64 * 1024, 256, SECT_4K) },
{ "w25q256", INFO(0xef4019, 0, 64 * 1024, 512,
- SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ |
- SPI_NOR_4B_OPCODES) },
+ SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ)
+ .fixups = &w25q256_fixups },
{ "w25q256jvm", INFO(0xef7019, 0, 64 * 1024, 512,
SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
{ "w25q256jw", INFO(0xef6019, 0, 64 * 1024, 512,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 133/244] mtd: spi-nor: spansion: fix writes on S25FS512S
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 132/244] mtd: spi-nor: winbond: Fix 4-byte opcode support for w25q256 Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 134/244] mtd: rawnand: marvell: Fix the condition on a return code Greg Kroah-Hartman
` (111 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergei Shtylyov, Alexander Sverdlin,
Kuldeep Singh, Tudor Ambarus
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
commit 5587fa489747a8e6cbd0558890458c862b797485 upstream.
Spansion S25FS-S family has an issue in the Basic Flash Parameter Table
(BFPT): Dword-11 bits 7:4 specify a page size of 512 bytes. Actually
this is configurable in the vendor unique register (CR3V) and even the
factory default setting is to "wrap at 256 bytes", so blindly relying
on BFPT breaks the page writes on these chips. Add the post-BFPT fixup
which restores the default page size of 256 bytes -- to properly read
CR3V this early is quite intrusive and should better be done as a new
feature; Alexander Sverdlin had the patch doing that:
https://patchwork.ozlabs.org/project/linux-mtd/patch/20200227123657.26030-1-alexander.sverdlin@nokia.com/
Fixes: dfd2b74530e ("mtd: spi-nor: add Spansion S25FS512S ID")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Tested-by: Kuldeep Singh <kuldeep.singh@nxp.com>
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/spi-nor/spansion.c | 25 +++++++++++++++++++++++--
1 file changed, 23 insertions(+), 2 deletions(-)
--- a/drivers/mtd/spi-nor/spansion.c
+++ b/drivers/mtd/spi-nor/spansion.c
@@ -8,6 +8,27 @@
#include "core.h"
+static int
+s25fs_s_post_bfpt_fixups(struct spi_nor *nor,
+ const struct sfdp_parameter_header *bfpt_header,
+ const struct sfdp_bfpt *bfpt,
+ struct spi_nor_flash_parameter *params)
+{
+ /*
+ * The S25FS-S chip family reports 512-byte pages in BFPT but
+ * in reality the write buffer still wraps at the safe default
+ * of 256 bytes. Overwrite the page size advertised by BFPT
+ * to get the writes working.
+ */
+ params->page_size = 256;
+
+ return 0;
+}
+
+static struct spi_nor_fixups s25fs_s_fixups = {
+ .post_bfpt = s25fs_s_post_bfpt_fixups,
+};
+
static const struct flash_info spansion_parts[] = {
/* Spansion/Cypress -- single (large) sector size only, at least
* for the chips listed here (without boot sectors).
@@ -30,8 +51,8 @@ static const struct flash_info spansion_
SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ |
SPI_NOR_HAS_LOCK | USE_CLSR) },
{ "s25fs512s", INFO6(0x010220, 0x4d0081, 256 * 1024, 256,
- SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ |
- USE_CLSR) },
+ SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | USE_CLSR)
+ .fixups = &s25fs_s_fixups, },
{ "s70fl01gs", INFO(0x010221, 0x4d00, 256 * 1024, 256, 0) },
{ "s25sl12800", INFO(0x012018, 0x0300, 256 * 1024, 64, 0) },
{ "s25sl12801", INFO(0x012018, 0x0301, 64 * 1024, 256, 0) },
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 134/244] mtd: rawnand: marvell: Fix the condition on a return code
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 133/244] mtd: spi-nor: spansion: fix writes on S25FS512S Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 135/244] mtd: rawnand: marvell: Use nand_cleanup() when the device is not yet registered Greg Kroah-Hartman
` (110 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miquel Raynal, Boris Brezillon
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit c27075772d1f1c8aaf276db9943b35adda8a8b65 upstream.
In a previous fix, I changed the condition on which the timeout of an
IRQ is reached from:
if (!ret)
into:
if (ret && !pending)
While having a non-zero return code is usual in the Linux kernel, here
ret comes from a wait_for_completion_timeout() which returns 0 when
the waiting period is too long.
Hence, the revised condition should be:
if (!ret && !pending)
The faulty patch did not produce any error because of the !pending
condition so this change is finally purely cosmetic and does not
change the actual driver behavior.
Fixes: cafb56dd741e ("mtd: rawnand: marvell: prevent timeouts on a loaded machine")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://lore.kernel.org/linux-mtd/20200424164501.26719-2-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/marvell_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -707,7 +707,7 @@ static int marvell_nfc_wait_op(struct na
* In case the interrupt was not served in the required time frame,
* check if the ISR was not served or if something went actually wrong.
*/
- if (ret && !pending) {
+ if (!ret && !pending) {
dev_err(nfc->dev, "Timeout waiting for RB signal\n");
return -ETIMEDOUT;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 135/244] mtd: rawnand: marvell: Use nand_cleanup() when the device is not yet registered
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 134/244] mtd: rawnand: marvell: Fix the condition on a return code Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 136/244] mtd: rawnand: marvell: Fix probe error path Greg Kroah-Hartman
` (109 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miquel Raynal, Boris Brezillon
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit 7a0c18fb5c71c6ac7d4662a145e4227dcd4a36a3 upstream.
Do not call nand_release() while the MTD device has not been
registered, use nand_cleanup() instead.
Fixes: 02f26ecf8c77 ("mtd: nand: add reworked Marvell NAND controller driver")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://lore.kernel.org/linux-mtd/20200424164501.26719-4-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/marvell_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -2664,7 +2664,7 @@ static int marvell_nand_chip_init(struct
ret = mtd_device_register(mtd, NULL, 0);
if (ret) {
dev_err(dev, "failed to register mtd device: %d\n", ret);
- nand_release(chip);
+ nand_cleanup(chip);
return ret;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 136/244] mtd: rawnand: marvell: Fix probe error path
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 135/244] mtd: rawnand: marvell: Use nand_cleanup() when the device is not yet registered Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 137/244] mtd: rawnand: timings: Fix default tR_max and tCCS_min timings Greg Kroah-Hartman
` (108 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miquel Raynal, Boris Brezillon
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit c525b7af96714f72e316c70781570a4a3e1c2856 upstream.
Ensure all chips are deregistered and cleaned in case of error during
the probe.
Fixes: 02f26ecf8c77 ("mtd: nand: add reworked Marvell NAND controller driver")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://lore.kernel.org/linux-mtd/20200424164501.26719-5-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/marvell_nand.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -2673,6 +2673,16 @@ static int marvell_nand_chip_init(struct
return 0;
}
+static void marvell_nand_chips_cleanup(struct marvell_nfc *nfc)
+{
+ struct marvell_nand_chip *entry, *temp;
+
+ list_for_each_entry_safe(entry, temp, &nfc->chips, node) {
+ nand_release(&entry->chip);
+ list_del(&entry->node);
+ }
+}
+
static int marvell_nand_chips_init(struct device *dev, struct marvell_nfc *nfc)
{
struct device_node *np = dev->of_node;
@@ -2707,21 +2717,16 @@ static int marvell_nand_chips_init(struc
ret = marvell_nand_chip_init(dev, nfc, nand_np);
if (ret) {
of_node_put(nand_np);
- return ret;
+ goto cleanup_chips;
}
}
return 0;
-}
-static void marvell_nand_chips_cleanup(struct marvell_nfc *nfc)
-{
- struct marvell_nand_chip *entry, *temp;
+cleanup_chips:
+ marvell_nand_chips_cleanup(nfc);
- list_for_each_entry_safe(entry, temp, &nfc->chips, node) {
- nand_release(&entry->chip);
- list_del(&entry->node);
- }
+ return ret;
}
static int marvell_nfc_init_dma(struct marvell_nfc *nfc)
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 137/244] mtd: rawnand: timings: Fix default tR_max and tCCS_min timings
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 136/244] mtd: rawnand: marvell: Fix probe error path Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 138/244] mtd: rawnand: brcmnand: correctly verify erased pages Greg Kroah-Hartman
` (107 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miquel Raynal, Boris Brezillon
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit 4d8ec041d9c454029f6cd90622f6d81eb61e781c upstream.
tR and tCCS are currently wrongly expressed in femtoseconds, while we
expect these values to be expressed in picoseconds. Set right
hardcoded values.
Fixes: 6a943386ee36 mtd: rawnand: add default values for dynamic timings
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://lore.kernel.org/linux-mtd/20200428094302.14624-3-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/nand_timings.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/mtd/nand/raw/nand_timings.c
+++ b/drivers/mtd/nand/raw/nand_timings.c
@@ -314,10 +314,9 @@ int onfi_fill_data_interface(struct nand
/* microseconds -> picoseconds */
timings->tPROG_max = 1000000ULL * ONFI_DYN_TIMING_MAX;
timings->tBERS_max = 1000000ULL * ONFI_DYN_TIMING_MAX;
- timings->tR_max = 1000000ULL * 200000000ULL;
- /* nanoseconds -> picoseconds */
- timings->tCCS_min = 1000UL * 500000;
+ timings->tR_max = 200000000;
+ timings->tCCS_min = 500000;
}
return 0;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 138/244] mtd: rawnand: brcmnand: correctly verify erased pages
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 137/244] mtd: rawnand: timings: Fix default tR_max and tCCS_min timings Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 139/244] mtd: rawnand: brcmnand: fix CS0 layout Greg Kroah-Hartman
` (106 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Álvaro Fernández Rojas,
Miquel Raynal
From: Álvaro Fernández Rojas <noltari@gmail.com>
commit dcb351c03f2fa6a599de1061b174167e03ee312b upstream.
The current code checks that the whole OOB area is erased.
This is a problem when JFFS2 cleanmarkers are added to the OOB, since it will
fail due to the usable OOB bytes not being 0xff.
Correct this by only checking that data and ECC bytes aren't 0xff.
Fixes: 02b88eea9f9c ("mtd: brcmnand: Add check for erased page bitflips")
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20200512082451.771212-1-noltari@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -2021,28 +2021,31 @@ static int brcmnand_read_by_pio(struct m
static int brcmstb_nand_verify_erased_page(struct mtd_info *mtd,
struct nand_chip *chip, void *buf, u64 addr)
{
- int i, sas;
- void *oob = chip->oob_poi;
+ struct mtd_oob_region ecc;
+ int i;
int bitflips = 0;
int page = addr >> chip->page_shift;
int ret;
+ void *ecc_bytes;
void *ecc_chunk;
if (!buf)
buf = nand_get_data_buf(chip);
- sas = mtd->oobsize / chip->ecc.steps;
-
/* read without ecc for verification */
ret = chip->ecc.read_page_raw(chip, buf, true, page);
if (ret)
return ret;
- for (i = 0; i < chip->ecc.steps; i++, oob += sas) {
+ for (i = 0; i < chip->ecc.steps; i++) {
ecc_chunk = buf + chip->ecc.size * i;
- ret = nand_check_erased_ecc_chunk(ecc_chunk,
- chip->ecc.size,
- oob, sas, NULL, 0,
+
+ mtd_ooblayout_ecc(mtd, i, &ecc);
+ ecc_bytes = chip->oob_poi + ecc.offset;
+
+ ret = nand_check_erased_ecc_chunk(ecc_chunk, chip->ecc.size,
+ ecc_bytes, ecc.length,
+ NULL, 0,
chip->ecc.strength);
if (ret < 0)
return ret;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 139/244] mtd: rawnand: brcmnand: fix CS0 layout
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 138/244] mtd: rawnand: brcmnand: correctly verify erased pages Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 140/244] mtd: rawnand: oxnas: Keep track of registered devices Greg Kroah-Hartman
` (105 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Álvaro Fernández Rojas,
Florian Fainelli, Miquel Raynal
From: Álvaro Fernández Rojas <noltari@gmail.com>
commit 3d3fb3c5be9ce07fa85d8f67fb3922e4613b955b upstream.
Only v3.3-v5.0 have a different CS0 layout.
Controllers before v3.3 use the same layout for every CS.
Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller")
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20200522121524.4161539-3-noltari@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -606,8 +606,9 @@ static int brcmnand_revision_init(struct
} else {
ctrl->cs_offsets = brcmnand_cs_offsets;
- /* v5.0 and earlier has a different CS0 offset layout */
- if (ctrl->nand_version <= 0x0500)
+ /* v3.3-5.0 have a different CS0 offset layout */
+ if (ctrl->nand_version >= 0x0303 &&
+ ctrl->nand_version <= 0x0500)
ctrl->cs0_offsets = brcmnand_cs_offsets_cs0;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 140/244] mtd: rawnand: oxnas: Keep track of registered devices
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 139/244] mtd: rawnand: brcmnand: fix CS0 layout Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 141/244] mtd: rawnand: oxnas: Unregister all devices on error Greg Kroah-Hartman
` (104 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miquel Raynal
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit 383fc3f613e7eac9f2e3c13b6f9fb8c1f39cb9d5 upstream.
All initialized and registered devices should be listed somewhere so
that we can unregister/free them in the _remove() path.
This patch is not a fix per-se but is needed to apply three other
fixes coming right after, explaining the Fixes/Cc: stable tags.
Fixes: 668592492409 ("mtd: nand: Add OX820 NAND Support")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-36-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/oxnas_nand.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/mtd/nand/raw/oxnas_nand.c
+++ b/drivers/mtd/nand/raw/oxnas_nand.c
@@ -32,6 +32,7 @@ struct oxnas_nand_ctrl {
void __iomem *io_base;
struct clk *clk;
struct nand_chip *chips[OXNAS_NAND_MAX_CHIPS];
+ unsigned int nchips;
};
static uint8_t oxnas_nand_read_byte(struct nand_chip *chip)
@@ -79,7 +80,6 @@ static int oxnas_nand_probe(struct platf
struct nand_chip *chip;
struct mtd_info *mtd;
struct resource *res;
- int nchips = 0;
int count = 0;
int err = 0;
@@ -143,12 +143,12 @@ static int oxnas_nand_probe(struct platf
if (err)
goto err_cleanup_nand;
- oxnas->chips[nchips] = chip;
- ++nchips;
+ oxnas->chips[oxnas->nchips] = chip;
+ ++oxnas->nchips;
}
/* Exit if no chips found */
- if (!nchips) {
+ if (!oxnas->nchips) {
err = -ENODEV;
goto err_clk_unprepare;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 141/244] mtd: rawnand: oxnas: Unregister all devices on error
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 140/244] mtd: rawnand: oxnas: Keep track of registered devices Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 142/244] mtd: rawnand: oxnas: Release all devices in the _remove() path Greg Kroah-Hartman
` (103 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miquel Raynal
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit b60391eb17b2956ff2fc4c348e5a464da21ff9cb upstream.
On error, the oxnas probe path just frees the device which failed and
aborts the probe, leaving unreleased resources.
Fix this situation by calling mtd_device_unregister()/nand_cleanup()
on these.
Fixes: 668592492409 ("mtd: nand: Add OX820 NAND Support")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-38-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/oxnas_nand.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/mtd/nand/raw/oxnas_nand.c
+++ b/drivers/mtd/nand/raw/oxnas_nand.c
@@ -82,6 +82,7 @@ static int oxnas_nand_probe(struct platf
struct resource *res;
int count = 0;
int err = 0;
+ int i;
/* Allocate memory for the device structure (and zero it) */
oxnas = devm_kzalloc(&pdev->dev, sizeof(*oxnas),
@@ -161,6 +162,13 @@ err_cleanup_nand:
nand_cleanup(chip);
err_release_child:
of_node_put(nand_np);
+
+ for (i = 0; i < oxnas->nchips; i++) {
+ chip = oxnas->chips[i];
+ WARN_ON(mtd_device_unregister(nand_to_mtd(chip)));
+ nand_cleanup(chip);
+ }
+
err_clk_unprepare:
clk_disable_unprepare(oxnas->clk);
return err;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 142/244] mtd: rawnand: oxnas: Release all devices in the _remove() path
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 141/244] mtd: rawnand: oxnas: Unregister all devices on error Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 143/244] clk: qcom: gcc: Add GPU and NPU clocks for SM8150 Greg Kroah-Hartman
` (102 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miquel Raynal
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit 0a5f45e57e35d0840bedb816974ce2e63406cd8b upstream.
oxnans_nand_remove() should release all MTD devices and clean all NAND
devices, not only the first one registered.
Fixes: 668592492409 ("mtd: nand: Add OX820 NAND Support")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-39-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/oxnas_nand.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/mtd/nand/raw/oxnas_nand.c
+++ b/drivers/mtd/nand/raw/oxnas_nand.c
@@ -177,9 +177,13 @@ err_clk_unprepare:
static int oxnas_nand_remove(struct platform_device *pdev)
{
struct oxnas_nand_ctrl *oxnas = platform_get_drvdata(pdev);
+ struct nand_chip *chip;
+ int i;
- if (oxnas->chips[0])
- nand_release(oxnas->chips[0]);
+ for (i = 0; i < oxnas->nchips; i++) {
+ chip = oxnas->chips[i];
+ nand_release(chip);
+ }
clk_disable_unprepare(oxnas->clk);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 143/244] clk: qcom: gcc: Add GPU and NPU clocks for SM8150
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 142/244] mtd: rawnand: oxnas: Release all devices in the _remove() path Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 144/244] clk: qcom: gcc: Add missing UFS " Greg Kroah-Hartman
` (101 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vinod Koul, Stephen Boyd
From: Vinod Koul <vkoul@kernel.org>
commit f73a4230d5bbc8fc7e1a2479ac997f786111c7bb upstream.
Add the GPU and NPU clocks for SM8150. They were missed in earlier
addition of clock driver.
Fixes: 2a1d7eb854bb ("clk: qcom: gcc: Add global clock controller driver for SM8150")
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lkml.kernel.org/r/20200513065420.32735-1-vkoul@kernel.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-sm8150.c | 64 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 64 insertions(+)
--- a/drivers/clk/qcom/gcc-sm8150.c
+++ b/drivers/clk/qcom/gcc-sm8150.c
@@ -1616,6 +1616,36 @@ static struct clk_branch gcc_gpu_cfg_ahb
},
};
+static struct clk_branch gcc_gpu_gpll0_clk_src = {
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(15),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_gpu_gpll0_clk_src",
+ .parent_hws = (const struct clk_hw *[]){
+ &gpll0.clkr.hw },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+};
+
+static struct clk_branch gcc_gpu_gpll0_div_clk_src = {
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(16),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_gpu_gpll0_div_clk_src",
+ .parent_hws = (const struct clk_hw *[]){
+ &gcc_gpu_gpll0_clk_src.clkr.hw },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+};
+
static struct clk_branch gcc_gpu_iref_clk = {
.halt_reg = 0x8c010,
.halt_check = BRANCH_HALT,
@@ -1698,6 +1728,36 @@ static struct clk_branch gcc_npu_cfg_ahb
},
};
+static struct clk_branch gcc_npu_gpll0_clk_src = {
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(18),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_npu_gpll0_clk_src",
+ .parent_hws = (const struct clk_hw *[]){
+ &gpll0.clkr.hw },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+};
+
+static struct clk_branch gcc_npu_gpll0_div_clk_src = {
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(19),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_npu_gpll0_div_clk_src",
+ .parent_hws = (const struct clk_hw *[]){
+ &gcc_npu_gpll0_clk_src.clkr.hw },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+};
+
static struct clk_branch gcc_npu_trig_clk = {
.halt_reg = 0x4d00c,
.halt_check = BRANCH_VOTED,
@@ -3374,12 +3434,16 @@ static struct clk_regmap *gcc_sm8150_clo
[GCC_GP3_CLK] = &gcc_gp3_clk.clkr,
[GCC_GP3_CLK_SRC] = &gcc_gp3_clk_src.clkr,
[GCC_GPU_CFG_AHB_CLK] = &gcc_gpu_cfg_ahb_clk.clkr,
+ [GCC_GPU_GPLL0_CLK_SRC] = &gcc_gpu_gpll0_clk_src.clkr,
+ [GCC_GPU_GPLL0_DIV_CLK_SRC] = &gcc_gpu_gpll0_div_clk_src.clkr,
[GCC_GPU_IREF_CLK] = &gcc_gpu_iref_clk.clkr,
[GCC_GPU_MEMNOC_GFX_CLK] = &gcc_gpu_memnoc_gfx_clk.clkr,
[GCC_GPU_SNOC_DVM_GFX_CLK] = &gcc_gpu_snoc_dvm_gfx_clk.clkr,
[GCC_NPU_AT_CLK] = &gcc_npu_at_clk.clkr,
[GCC_NPU_AXI_CLK] = &gcc_npu_axi_clk.clkr,
[GCC_NPU_CFG_AHB_CLK] = &gcc_npu_cfg_ahb_clk.clkr,
+ [GCC_NPU_GPLL0_CLK_SRC] = &gcc_npu_gpll0_clk_src.clkr,
+ [GCC_NPU_GPLL0_DIV_CLK_SRC] = &gcc_npu_gpll0_div_clk_src.clkr,
[GCC_NPU_TRIG_CLK] = &gcc_npu_trig_clk.clkr,
[GCC_PCIE0_PHY_REFGEN_CLK] = &gcc_pcie0_phy_refgen_clk.clkr,
[GCC_PCIE1_PHY_REFGEN_CLK] = &gcc_pcie1_phy_refgen_clk.clkr,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 144/244] clk: qcom: gcc: Add missing UFS clocks for SM8150
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 143/244] clk: qcom: gcc: Add GPU and NPU clocks for SM8150 Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 145/244] clk: qcom: gcc: Add support for a new frequency for SC7180 Greg Kroah-Hartman
` (100 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vinod Koul, Stephen Boyd
From: Vinod Koul <vkoul@kernel.org>
commit 37c72e4cae37f0dace1abb3711ede7fbc6d0862a upstream.
Add the missing ufs card and ufs phy clocks for SM8150. They were missed
in earlier addition of clock driver.
Fixes: 2a1d7eb854bb ("clk: qcom: gcc: Add global clock controller driver for SM8150")
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lkml.kernel.org/r/20200513065420.32735-2-vkoul@kernel.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-sm8150.c | 84 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 84 insertions(+)
--- a/drivers/clk/qcom/gcc-sm8150.c
+++ b/drivers/clk/qcom/gcc-sm8150.c
@@ -2872,6 +2872,45 @@ static struct clk_branch gcc_ufs_card_ph
},
};
+/* external clocks so add BRANCH_HALT_SKIP */
+static struct clk_branch gcc_ufs_card_rx_symbol_0_clk = {
+ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x7501c,
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_card_rx_symbol_0_clk",
+ .ops = &clk_branch2_ops,
+ },
+ },
+};
+
+/* external clocks so add BRANCH_HALT_SKIP */
+static struct clk_branch gcc_ufs_card_rx_symbol_1_clk = {
+ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x750ac,
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_card_rx_symbol_1_clk",
+ .ops = &clk_branch2_ops,
+ },
+ },
+};
+
+/* external clocks so add BRANCH_HALT_SKIP */
+static struct clk_branch gcc_ufs_card_tx_symbol_0_clk = {
+ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x75018,
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_card_tx_symbol_0_clk",
+ .ops = &clk_branch2_ops,
+ },
+ },
+};
+
static struct clk_branch gcc_ufs_card_unipro_core_clk = {
.halt_reg = 0x75058,
.halt_check = BRANCH_HALT,
@@ -3052,6 +3091,45 @@ static struct clk_branch gcc_ufs_phy_phy
},
};
+/* external clocks so add BRANCH_HALT_SKIP */
+static struct clk_branch gcc_ufs_phy_rx_symbol_0_clk = {
+ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x7701c,
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_phy_rx_symbol_0_clk",
+ .ops = &clk_branch2_ops,
+ },
+ },
+};
+
+/* external clocks so add BRANCH_HALT_SKIP */
+static struct clk_branch gcc_ufs_phy_rx_symbol_1_clk = {
+ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x770ac,
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_phy_rx_symbol_1_clk",
+ .ops = &clk_branch2_ops,
+ },
+ },
+};
+
+/* external clocks so add BRANCH_HALT_SKIP */
+static struct clk_branch gcc_ufs_phy_tx_symbol_0_clk = {
+ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x77018,
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_phy_tx_symbol_0_clk",
+ .ops = &clk_branch2_ops,
+ },
+ },
+};
+
static struct clk_branch gcc_ufs_phy_unipro_core_clk = {
.halt_reg = 0x77058,
.halt_check = BRANCH_HALT,
@@ -3548,6 +3626,9 @@ static struct clk_regmap *gcc_sm8150_clo
[GCC_UFS_CARD_PHY_AUX_CLK_SRC] = &gcc_ufs_card_phy_aux_clk_src.clkr,
[GCC_UFS_CARD_PHY_AUX_HW_CTL_CLK] =
&gcc_ufs_card_phy_aux_hw_ctl_clk.clkr,
+ [GCC_UFS_CARD_RX_SYMBOL_0_CLK] = &gcc_ufs_card_rx_symbol_0_clk.clkr,
+ [GCC_UFS_CARD_RX_SYMBOL_1_CLK] = &gcc_ufs_card_rx_symbol_1_clk.clkr,
+ [GCC_UFS_CARD_TX_SYMBOL_0_CLK] = &gcc_ufs_card_tx_symbol_0_clk.clkr,
[GCC_UFS_CARD_UNIPRO_CORE_CLK] = &gcc_ufs_card_unipro_core_clk.clkr,
[GCC_UFS_CARD_UNIPRO_CORE_CLK_SRC] =
&gcc_ufs_card_unipro_core_clk_src.clkr,
@@ -3565,6 +3646,9 @@ static struct clk_regmap *gcc_sm8150_clo
[GCC_UFS_PHY_PHY_AUX_CLK] = &gcc_ufs_phy_phy_aux_clk.clkr,
[GCC_UFS_PHY_PHY_AUX_CLK_SRC] = &gcc_ufs_phy_phy_aux_clk_src.clkr,
[GCC_UFS_PHY_PHY_AUX_HW_CTL_CLK] = &gcc_ufs_phy_phy_aux_hw_ctl_clk.clkr,
+ [GCC_UFS_PHY_RX_SYMBOL_0_CLK] = &gcc_ufs_phy_rx_symbol_0_clk.clkr,
+ [GCC_UFS_PHY_RX_SYMBOL_1_CLK] = &gcc_ufs_phy_rx_symbol_1_clk.clkr,
+ [GCC_UFS_PHY_TX_SYMBOL_0_CLK] = &gcc_ufs_phy_tx_symbol_0_clk.clkr,
[GCC_UFS_PHY_UNIPRO_CORE_CLK] = &gcc_ufs_phy_unipro_core_clk.clkr,
[GCC_UFS_PHY_UNIPRO_CORE_CLK_SRC] =
&gcc_ufs_phy_unipro_core_clk_src.clkr,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 145/244] clk: qcom: gcc: Add support for a new frequency for SC7180
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 144/244] clk: qcom: gcc: Add missing UFS " Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 146/244] slimbus: core: Fix mismatch in of_node_get/put Greg Kroah-Hartman
` (99 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Taniya Das, Stephen Boyd
From: Taniya Das <tdas@codeaurora.org>
commit 1b70061f5939ff1cacd728821b4f378cb0fb7961 upstream.
There is a requirement to support 51.2MHz from GPLL6 for qup clocks,
thus update the frequency table and parent data/map to use the GPLL6
source PLL.
Fixes: 17269568f7267 ("clk: qcom: Add Global Clock controller (GCC) driver for SC7180")
Signed-off-by: Taniya Das <tdas@codeaurora.org>
Link: https://lkml.kernel.org/r/1589709861-27580-2-git-send-email-tdas@codeaurora.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-sc7180.c | 73 +++++++++++++++++++++---------------------
1 file changed, 37 insertions(+), 36 deletions(-)
--- a/drivers/clk/qcom/gcc-sc7180.c
+++ b/drivers/clk/qcom/gcc-sc7180.c
@@ -390,6 +390,7 @@ static const struct freq_tbl ftbl_gcc_qu
F(29491200, P_GPLL0_OUT_EVEN, 1, 1536, 15625),
F(32000000, P_GPLL0_OUT_EVEN, 1, 8, 75),
F(48000000, P_GPLL0_OUT_EVEN, 1, 4, 25),
+ F(51200000, P_GPLL6_OUT_MAIN, 7.5, 0, 0),
F(64000000, P_GPLL0_OUT_EVEN, 1, 16, 75),
F(75000000, P_GPLL0_OUT_EVEN, 4, 0, 0),
F(80000000, P_GPLL0_OUT_EVEN, 1, 4, 15),
@@ -405,8 +406,8 @@ static const struct freq_tbl ftbl_gcc_qu
static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = {
.name = "gcc_qupv3_wrap0_s0_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -414,15 +415,15 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s
.cmd_rcgr = 0x17034,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap0_s0_clk_src_init,
};
static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = {
.name = "gcc_qupv3_wrap0_s1_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -430,15 +431,15 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s
.cmd_rcgr = 0x17164,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap0_s1_clk_src_init,
};
static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = {
.name = "gcc_qupv3_wrap0_s2_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -446,15 +447,15 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s
.cmd_rcgr = 0x17294,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap0_s2_clk_src_init,
};
static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = {
.name = "gcc_qupv3_wrap0_s3_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -462,15 +463,15 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s
.cmd_rcgr = 0x173c4,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap0_s3_clk_src_init,
};
static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = {
.name = "gcc_qupv3_wrap0_s4_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -478,15 +479,15 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s
.cmd_rcgr = 0x174f4,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap0_s4_clk_src_init,
};
static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = {
.name = "gcc_qupv3_wrap0_s5_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -494,15 +495,15 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s
.cmd_rcgr = 0x17624,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap0_s5_clk_src_init,
};
static struct clk_init_data gcc_qupv3_wrap1_s0_clk_src_init = {
.name = "gcc_qupv3_wrap1_s0_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -510,15 +511,15 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s
.cmd_rcgr = 0x18018,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap1_s0_clk_src_init,
};
static struct clk_init_data gcc_qupv3_wrap1_s1_clk_src_init = {
.name = "gcc_qupv3_wrap1_s1_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -526,15 +527,15 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s
.cmd_rcgr = 0x18148,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap1_s1_clk_src_init,
};
static struct clk_init_data gcc_qupv3_wrap1_s2_clk_src_init = {
.name = "gcc_qupv3_wrap1_s2_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -542,15 +543,15 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s
.cmd_rcgr = 0x18278,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap1_s2_clk_src_init,
};
static struct clk_init_data gcc_qupv3_wrap1_s3_clk_src_init = {
.name = "gcc_qupv3_wrap1_s3_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -558,15 +559,15 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s
.cmd_rcgr = 0x183a8,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap1_s3_clk_src_init,
};
static struct clk_init_data gcc_qupv3_wrap1_s4_clk_src_init = {
.name = "gcc_qupv3_wrap1_s4_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -574,15 +575,15 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s
.cmd_rcgr = 0x184d8,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap1_s4_clk_src_init,
};
static struct clk_init_data gcc_qupv3_wrap1_s5_clk_src_init = {
.name = "gcc_qupv3_wrap1_s5_clk_src",
- .parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .parent_data = gcc_parent_data_1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
};
@@ -590,7 +591,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s
.cmd_rcgr = 0x18608,
.mnd_width = 16,
.hid_width = 5,
- .parent_map = gcc_parent_map_0,
+ .parent_map = gcc_parent_map_1,
.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
.clkr.hw.init = &gcc_qupv3_wrap1_s5_clk_src_init,
};
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 146/244] slimbus: core: Fix mismatch in of_node_get/put
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 145/244] clk: qcom: gcc: Add support for a new frequency for SC7180 Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 147/244] HID: logitech-hidpp: avoid repeated "multiplier = " log messages Greg Kroah-Hartman
` (98 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Saravana Kannan, Srinivas Kandagatla
From: Saravana Kannan <saravanak@google.com>
commit 01360857486c0e4435dea3aa2f78b47213b7cf6a upstream.
Adding missing corresponding of_node_put
Fixes: 7588a511bdb4 ("slimbus: core: add support to device tree helper")
Signed-off-by: Saravana Kannan <saravanak@google.com>
[Srini: added fixes tag, removed NULL check and updated log]
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20200511151334.362-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/slimbus/core.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/slimbus/core.c
+++ b/drivers/slimbus/core.c
@@ -283,6 +283,7 @@ EXPORT_SYMBOL_GPL(slim_register_controll
/* slim_remove_device: Remove the effect of slim_add_device() */
static void slim_remove_device(struct slim_device *sbdev)
{
+ of_node_put(sbdev->dev.of_node);
device_unregister(&sbdev->dev);
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 147/244] HID: logitech-hidpp: avoid repeated "multiplier = " log messages
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 146/244] slimbus: core: Fix mismatch in of_node_get/put Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:36 ` [PATCH 5.7 148/244] HID: magicmouse: do not set up autorepeat Greg Kroah-Hartman
` (97 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maciej S. Szmigiero, Harry Cutts,
Jiri Kosina
From: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
commit e13762abf38ead29071407f32b9dcec38f21dc34 upstream.
These messages appear each time the mouse wakes from sleep, in my case
(Logitech M705), every minute or so.
Let's downgrade them to the "debug" level so they don't fill the kernel log
by default.
While we are at it, let's make clear that this is a wheel multiplier (and
not, for example, XY movement multiplier).
Fixes: 4435ff2f09a2 ("HID: logitech: Enable high-resolution scrolling on Logitech mice")
Cc: stable@vger.kernel.org
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Reviewed-by: Harry Cutts <hcutts@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-logitech-hidpp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3146,7 +3146,7 @@ static int hi_res_scroll_enable(struct h
multiplier = 1;
hidpp->vertical_wheel_counter.wheel_multiplier = multiplier;
- hid_info(hidpp->hid_dev, "multiplier = %d\n", multiplier);
+ hid_dbg(hidpp->hid_dev, "wheel multiplier = %d\n", multiplier);
return 0;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 148/244] HID: magicmouse: do not set up autorepeat
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 147/244] HID: logitech-hidpp: avoid repeated "multiplier = " log messages Greg Kroah-Hartman
@ 2020-07-20 15:36 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 149/244] HID: quirks: Always poll Obins Anne Pro 2 keyboard Greg Kroah-Hartman
` (96 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yariv, Dmitry Torokhov, Jiri Kosina
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 6363d2065cd399cf9d6dc9d08c437f8658831100 upstream.
Neither the trackpad, nor the mouse want input core to generate autorepeat
events for their buttons, so let's reset the bit (as hid-input sets it for
these devices based on the usage vendor code).
Cc: stable@vger.kernel.org
Reported-by: Yariv <oigevald+kernel@gmail.com>
Tested-by: Yariv <oigevald+kernel@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-magicmouse.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -535,6 +535,12 @@ static int magicmouse_setup_input(struct
__set_bit(MSC_RAW, input->mscbit);
}
+ /*
+ * hid-input may mark device as using autorepeat, but neither
+ * the trackpad, nor the mouse actually want it.
+ */
+ __clear_bit(EV_REP, input->evbit);
+
return 0;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 149/244] HID: quirks: Always poll Obins Anne Pro 2 keyboard
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2020-07-20 15:36 ` [PATCH 5.7 148/244] HID: magicmouse: do not set up autorepeat Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 150/244] HID: quirks: Ignore Simply Automated UPB PIM Greg Kroah-Hartman
` (95 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Parschauer, Jiri Kosina
From: Sebastian Parschauer <s.parschauer@gmx.de>
commit ca28aff0e1dc7dce9e12a7fd9276b7118ce5e73a upstream.
The Obins Anne Pro 2 keyboard (04d9:a293) disconnects after a few
minutes of inactivity when using it wired and typing does not result
in any input events any more. This is a common firmware flaw. So add
the ALWAYS_POLL quirk for this device.
GitHub user Dietrich Moerman (dietrichm) tested the quirk and
requested my help in my project
https://github.com/sriemer/fix-linux-mouse issue 22 to provide
this patch.
Link: https://www.reddit.com/r/AnnePro/comments/gruzcb/anne_pro_2_linux_cant_type_after_inactivity/
Signed-off-by: Sebastian Parschauer <s.parschauer@gmx.de>
Cc: stable@vger.kernel.org # v4.16+
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -624,6 +624,7 @@
#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081 0xa081
#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2 0xa0c2
#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096 0xa096
+#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293 0xa293
#define USB_VENDOR_ID_IMATION 0x0718
#define USB_DEVICE_ID_DISC_STAKKA 0xd000
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -88,6 +88,7 @@ static const struct hid_device_id hid_qu
{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 150/244] HID: quirks: Ignore Simply Automated UPB PIM
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 149/244] HID: quirks: Always poll Obins Anne Pro 2 keyboard Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 151/244] ALSA: line6: Perform sanity check for each URB creation Greg Kroah-Hartman
` (94 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, James Hilliard, Jiri Kosina
From: James Hilliard <james.hilliard1@gmail.com>
commit 1ee1369b46de1083238fced60ff718f59de4b8aa upstream.
As this is a cypress HID->COM RS232 style device that is handled
by the cypress_M8 driver we also need to add it to the ignore list
in hid-quirks.
Cc: stable <stable@vger.kernel.org>
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-ids.h | 2 ++
drivers/hid/hid-quirks.c | 1 +
2 files changed, 3 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -1006,6 +1006,8 @@
#define USB_DEVICE_ID_ROCCAT_RYOS_MK_PRO 0x3232
#define USB_DEVICE_ID_ROCCAT_SAVU 0x2d5a
+#define USB_VENDOR_ID_SAI 0x17dd
+
#define USB_VENDOR_ID_SAITEK 0x06a3
#define USB_DEVICE_ID_SAITEK_RUMBLEPAD 0xff17
#define USB_DEVICE_ID_SAITEK_PS1000 0x0621
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -833,6 +833,7 @@ static const struct hid_device_id hid_ig
{ HID_USB_DEVICE(USB_VENDOR_ID_PETZL, USB_DEVICE_ID_PETZL_HEADLAMP) },
{ HID_USB_DEVICE(USB_VENDOR_ID_PHILIPS, USB_DEVICE_ID_PHILIPS_IEEE802154_DONGLE) },
{ HID_USB_DEVICE(USB_VENDOR_ID_POWERCOM, USB_DEVICE_ID_POWERCOM_UPS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAI, USB_DEVICE_ID_CYPRESS_HIDCOM) },
#if IS_ENABLED(CONFIG_MOUSE_SYNAPTICS_USB)
{ HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP) },
{ HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_INT_TP) },
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 151/244] ALSA: line6: Perform sanity check for each URB creation
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 150/244] HID: quirks: Ignore Simply Automated UPB PIM Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 152/244] ALSA: line6: Sync the pending work cancel at disconnection Greg Kroah-Hartman
` (93 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+c190f6858a04ea7fbc52, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit 6e8a914ad619042c5f25a4feb663357c4170fd8d upstream.
LINE6 drivers create stream URBs with a fixed pipe without checking
its validity, and this may lead to a kernel WARNING at the submission
when a malformed USB descriptor is passed.
For avoiding the kernel warning, perform the similar sanity checks for
each pipe type at creating a URB.
Reported-by: syzbot+c190f6858a04ea7fbc52@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/s5hv9iv4hq8.wl-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/line6/capture.c | 2 ++
sound/usb/line6/playback.c | 2 ++
2 files changed, 4 insertions(+)
--- a/sound/usb/line6/capture.c
+++ b/sound/usb/line6/capture.c
@@ -286,6 +286,8 @@ int line6_create_audio_in_urbs(struct sn
urb->interval = LINE6_ISO_INTERVAL;
urb->error_count = 0;
urb->complete = audio_in_callback;
+ if (usb_urb_ep_type_check(urb))
+ return -EINVAL;
}
return 0;
--- a/sound/usb/line6/playback.c
+++ b/sound/usb/line6/playback.c
@@ -431,6 +431,8 @@ int line6_create_audio_out_urbs(struct s
urb->interval = LINE6_ISO_INTERVAL;
urb->error_count = 0;
urb->complete = audio_out_callback;
+ if (usb_urb_ep_type_check(urb))
+ return -EINVAL;
}
return 0;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 152/244] ALSA: line6: Sync the pending work cancel at disconnection
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 151/244] ALSA: line6: Perform sanity check for each URB creation Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 153/244] ALSA: usb-audio: Fix race against the error recovery URB submission Greg Kroah-Hartman
` (92 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+145012a46658ac00fc9e,
Alan Stern, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit 68359a1ad8447c99732ebeab8c169bfed543667a upstream.
Recently syzkaller reported a UAF in LINE6 driver, and it's likely
because we call cancel_delayed_work() at the disconnect callback
instead of cancel_delayed_work_sync(). Let's use the correct one
instead.
Reported-by: syzbot+145012a46658ac00fc9e@syzkaller.appspotmail.com
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/s5hlfjr4gio.wl-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/line6/driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/usb/line6/driver.c
+++ b/sound/usb/line6/driver.c
@@ -820,7 +820,7 @@ void line6_disconnect(struct usb_interfa
if (WARN_ON(usbdev != line6->usbdev))
return;
- cancel_delayed_work(&line6->startup_work);
+ cancel_delayed_work_sync(&line6->startup_work);
if (line6->urb_listen != NULL)
line6_stop_listen(line6);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 153/244] ALSA: usb-audio: Fix race against the error recovery URB submission
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 152/244] ALSA: line6: Sync the pending work cancel at disconnection Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 154/244] ALSA: hda/realtek - change to suitable link model for ASUS platform Greg Kroah-Hartman
` (91 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+0f4ecfe6a2c322c81728,
syzbot+5f1d24c49c1d2c427497, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit 9b7e5208a941e2e491a83eb5fa83d889e888fa2f upstream.
USB MIDI driver has an error recovery mechanism to resubmit the URB in
the delayed timer handler, and this may race with the standard start /
stop operations. Although both start and stop operations themselves
don't race with each other due to the umidi->mutex protection, but
this isn't applied to the timer handler.
For fixing this potential race, the following changes are applied:
- Since the timer handler can't use the mutex, we apply the
umidi->disc_lock protection at each input stream URB submission;
this also needs to change the GFP flag to GFP_ATOMIC
- Add a check of the URB refcount and skip if already submitted
- Move the timer cancel call at disconnection to the beginning of the
procedure; this assures the in-flight timer handler is gone properly
before killing all pending URBs
Reported-by: syzbot+0f4ecfe6a2c322c81728@syzkaller.appspotmail.com
Reported-by: syzbot+5f1d24c49c1d2c427497@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200710160656.16819-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/midi.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1499,6 +1499,8 @@ void snd_usbmidi_disconnect(struct list_
spin_unlock_irq(&umidi->disc_lock);
up_write(&umidi->disc_rwsem);
+ del_timer_sync(&umidi->error_timer);
+
for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) {
struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i];
if (ep->out)
@@ -1525,7 +1527,6 @@ void snd_usbmidi_disconnect(struct list_
ep->in = NULL;
}
}
- del_timer_sync(&umidi->error_timer);
}
EXPORT_SYMBOL(snd_usbmidi_disconnect);
@@ -2301,16 +2302,22 @@ void snd_usbmidi_input_stop(struct list_
}
EXPORT_SYMBOL(snd_usbmidi_input_stop);
-static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint *ep)
+static void snd_usbmidi_input_start_ep(struct snd_usb_midi *umidi,
+ struct snd_usb_midi_in_endpoint *ep)
{
unsigned int i;
+ unsigned long flags;
if (!ep)
return;
for (i = 0; i < INPUT_URBS; ++i) {
struct urb *urb = ep->urbs[i];
- urb->dev = ep->umidi->dev;
- snd_usbmidi_submit_urb(urb, GFP_KERNEL);
+ spin_lock_irqsave(&umidi->disc_lock, flags);
+ if (!atomic_read(&urb->use_count)) {
+ urb->dev = ep->umidi->dev;
+ snd_usbmidi_submit_urb(urb, GFP_ATOMIC);
+ }
+ spin_unlock_irqrestore(&umidi->disc_lock, flags);
}
}
@@ -2326,7 +2333,7 @@ void snd_usbmidi_input_start(struct list
if (umidi->input_running || !umidi->opened[1])
return;
for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i)
- snd_usbmidi_input_start_ep(umidi->endpoints[i].in);
+ snd_usbmidi_input_start_ep(umidi, umidi->endpoints[i].in);
umidi->input_running = 1;
}
EXPORT_SYMBOL(snd_usbmidi_input_start);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 154/244] ALSA: hda/realtek - change to suitable link model for ASUS platform
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 153/244] ALSA: usb-audio: Fix race against the error recovery URB submission Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 155/244] ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289 Greg Kroah-Hartman
` (90 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
From: Kailang Yang <kailang@realtek.com>
commit ef9ddb9dc4f8b1da3b975918cd1fd98ec055b918 upstream.
ASUS platform couldn't need to use Headset Mode model.
It changes to the suitable model.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/d05bcff170784ec7bb35023407148161@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7082,7 +7082,7 @@ static const struct hda_fixup alc269_fix
{ }
},
.chained = true,
- .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+ .chain_id = ALC269_FIXUP_HEADSET_MIC
},
[ALC294_FIXUP_ASUS_HEADSET_MIC] = {
.type = HDA_FIXUP_PINS,
@@ -7091,7 +7091,7 @@ static const struct hda_fixup alc269_fix
{ }
},
.chained = true,
- .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+ .chain_id = ALC269_FIXUP_HEADSET_MIC
},
[ALC294_FIXUP_ASUS_SPK] = {
.type = HDA_FIXUP_VERBS,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 155/244] ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 154/244] ALSA: hda/realtek - change to suitable link model for ASUS platform Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 156/244] ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256 Greg Kroah-Hartman
` (89 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Armas Spann, Takashi Iwai
From: Armas Spann <zappel@retarded.farm>
commit ff53664daff2a65f4bf2479ac56dfb3e908deff0 upstream.
This patch adds support for headset mic to the ASUS ROG Zephyrus
G14(GA401) notebook series by adding the corresponding
vendor/pci_device id, as well as adding a new fixup for the used
realtek ALC289. The fixup stets the correct pin to get the headset mic
correctly recognized on audio-jack.
Signed-off-by: Armas Spann <zappel@retarded.farm>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200711110557.18681-1-zappel@retarded.farm
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6117,6 +6117,7 @@ enum {
ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS,
ALC269VC_FIXUP_ACER_HEADSET_MIC,
ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE,
+ ALC289_FIXUP_ASUS_G401,
};
static const struct hda_fixup alc269_fixups[] = {
@@ -7324,6 +7325,13 @@ static const struct hda_fixup alc269_fix
.chained = true,
.chain_id = ALC269_FIXUP_HEADSET_MIC
},
+ [ALC289_FIXUP_ASUS_G401] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x03a11020 }, /* headset mic with jack detect */
+ { }
+ },
+ },
};
static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -7504,6 +7512,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_G401),
SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC),
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 156/244] ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 155/244] ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289 Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 157/244] ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534 Greg Kroah-Hartman
` (88 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jian-Hong Pan, Takashi Iwai
From: Jian-Hong Pan <jian-hong@endlessm.com>
commit f50a121d2f32bccc1d6b94df925a1ce44ea7eff7 upstream.
The Acer TravelMate B311R-31 laptop's audio (1025:1430) with ALC256
cannot detect the headset microphone until
ALC256_FIXUP_ACER_MIC_NO_PRESENCE quirk maps the NID 0x19 as the headset
mic pin.
Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200713060421.62435-1-jian-hong@endlessm.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6118,6 +6118,7 @@ enum {
ALC269VC_FIXUP_ACER_HEADSET_MIC,
ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE,
ALC289_FIXUP_ASUS_G401,
+ ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
};
static const struct hda_fixup alc269_fixups[] = {
@@ -7332,6 +7333,15 @@ static const struct hda_fixup alc269_fix
{ }
},
},
+ [ALC256_FIXUP_ACER_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x02a11120 }, /* use as headset mic, without its own jack detect */
+ { }
+ },
+ .chained = true,
+ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
+ },
};
static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -7360,6 +7370,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 157/244] ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 156/244] ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256 Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 158/244] ALSA: hda/realtek - Enable Speaker for ASUS UX563 Greg Kroah-Hartman
` (87 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
From: Kailang Yang <kailang@realtek.com>
commit 473fbe13fd6f9082e413aea37e624ecbce5463cc upstream.
ASUS UX533 and UX534 speaker still can't output.
End User feedback speaker didn't have output.
Add this COEF value will enable it.
Fixes: 4e051106730d ("ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294")
Cc: <stable@vger.kernel.org>
Signed-off-by: Kailang Yang <kailang@realtek.com>
Link: https://lore.kernel.org/r/80334402a93b48e385f8f4841b59ae09@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7101,6 +7101,8 @@ static const struct hda_fixup alc269_fix
/* Set EAPD high */
{ 0x20, AC_VERB_SET_COEF_INDEX, 0x40 },
{ 0x20, AC_VERB_SET_PROC_COEF, 0x8800 },
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x0f },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x7774 },
{ }
},
.chained = true,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 158/244] ALSA: hda/realtek - Enable Speaker for ASUS UX563
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 157/244] ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534 Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 159/244] thunderbolt: Fix path indices used in USB3 tunnel discovery Greg Kroah-Hartman
` (86 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
From: Kailang Yang <kailang@realtek.com>
commit 158ae2f5e6fead30be1f0c203037f5556871513b upstream.
ASUS UX563 speaker can't output.
Add quirk to link suitable model will enable it.
This model also could enable headset Mic.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/96dee3ab01a04c28a7b44061e88009dd@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7516,6 +7516,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK),
SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x194e, "ASUS UX563FD", ALC294_FIXUP_ASUS_HPE),
SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 159/244] thunderbolt: Fix path indices used in USB3 tunnel discovery
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 158/244] ALSA: hda/realtek - Enable Speaker for ASUS UX563 Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 160/244] USB: c67x00: fix use after free in c67x00_giveback_urb Greg Kroah-Hartman
` (85 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mika Westerberg
From: Mika Westerberg <mika.westerberg@linux.intel.com>
commit 8b94a4b92327d061327117e127d7d44a4a43e639 upstream.
The USB3 discovery used wrong indices when tunnel is discovered. It
should use TB_USB3_PATH_DOWN for path that flows downstream and
TB_USB3_PATH_UP when it flows upstream. This should not affect the
functionality but better to fix it.
Fixes: e6f818585713 ("thunderbolt: Add support for USB 3.x tunnels")
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: stable@vger.kernel.org # v5.6+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/tunnel.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/thunderbolt/tunnel.c
+++ b/drivers/thunderbolt/tunnel.c
@@ -913,21 +913,21 @@ struct tb_tunnel *tb_tunnel_discover_usb
* case.
*/
path = tb_path_discover(down, TB_USB3_HOPID, NULL, -1,
- &tunnel->dst_port, "USB3 Up");
+ &tunnel->dst_port, "USB3 Down");
if (!path) {
/* Just disable the downstream port */
tb_usb3_port_enable(down, false);
goto err_free;
}
- tunnel->paths[TB_USB3_PATH_UP] = path;
- tb_usb3_init_path(tunnel->paths[TB_USB3_PATH_UP]);
+ tunnel->paths[TB_USB3_PATH_DOWN] = path;
+ tb_usb3_init_path(tunnel->paths[TB_USB3_PATH_DOWN]);
path = tb_path_discover(tunnel->dst_port, -1, down, TB_USB3_HOPID, NULL,
- "USB3 Down");
+ "USB3 Up");
if (!path)
goto err_deactivate;
- tunnel->paths[TB_USB3_PATH_DOWN] = path;
- tb_usb3_init_path(tunnel->paths[TB_USB3_PATH_DOWN]);
+ tunnel->paths[TB_USB3_PATH_UP] = path;
+ tb_usb3_init_path(tunnel->paths[TB_USB3_PATH_UP]);
/* Validate that the tunnel is complete */
if (!tb_port_is_usb3_up(tunnel->dst_port)) {
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 160/244] USB: c67x00: fix use after free in c67x00_giveback_urb
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 159/244] thunderbolt: Fix path indices used in USB3 tunnel discovery Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 161/244] usb: dwc2: Fix shutdown callback in platform Greg Kroah-Hartman
` (84 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tom Rix
From: Tom Rix <trix@redhat.com>
commit 211f08347355cba1f769bbf3355816a12b3ddd55 upstream.
clang static analysis flags this error
c67x00-sched.c:489:55: warning: Use of memory after it is freed [unix.Malloc]
usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
^~~~~~~~~~~~
Problem happens in this block of code
c67x00_release_urb(c67x00, urb);
usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
spin_unlock(&c67x00->lock);
usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
In the call to c67x00_release_urb has this freeing of urbp
urbp = urb->hcpriv;
urb->hcpriv = NULL;
list_del(&urbp->hep_node);
kfree(urbp);
And so urbp is freed before usb_hcd_giveback_urb uses it as its 3rd
parameter.
Since all is required is the status, pass the status directly as is
done in c64x00_urb_dequeue
Fixes: e9b29ffc519b ("USB: add Cypress c67x00 OTG controller HCD driver")
Signed-off-by: Tom Rix <trix@redhat.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200708131243.24336-1-trix@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/c67x00/c67x00-sched.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/c67x00/c67x00-sched.c
+++ b/drivers/usb/c67x00/c67x00-sched.c
@@ -486,7 +486,7 @@ c67x00_giveback_urb(struct c67x00_hcd *c
c67x00_release_urb(c67x00, urb);
usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
spin_unlock(&c67x00->lock);
- usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
+ usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, status);
spin_lock(&c67x00->lock);
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 161/244] usb: dwc2: Fix shutdown callback in platform
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 160/244] USB: c67x00: fix use after free in c67x00_giveback_urb Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 162/244] usb: chipidea: core: add wakeup support for extcon Greg Kroah-Hartman
` (83 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Frank Mori Hess, Alan Stern,
Doug Anderson, Minas Harutyunyan, Felipe Balbi
From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
commit 4fdf228cdf6925af45a2066d403821e0977bfddb upstream.
To avoid lot of interrupts from dwc2 core, which can be asserted in
specific conditions need to disable interrupts on HW level instead of
disable IRQs on Kernel level, because of IRQ can be shared between
drivers.
Cc: stable@vger.kernel.org
Fixes: a40a00318c7fc ("usb: dwc2: add shutdown callback to platform variant")
Tested-by: Frank Mori Hess <fmh6jj@gmail.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Doug Anderson <dianders@chromium.org>
Reviewed-by: Frank Mori Hess <fmh6jj@gmail.com>
Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/platform.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -342,7 +342,8 @@ static void dwc2_driver_shutdown(struct
{
struct dwc2_hsotg *hsotg = platform_get_drvdata(dev);
- disable_irq(hsotg->irq);
+ dwc2_disable_global_interrupts(hsotg);
+ synchronize_irq(hsotg->irq);
}
/**
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 162/244] usb: chipidea: core: add wakeup support for extcon
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 161/244] usb: dwc2: Fix shutdown callback in platform Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 163/244] usb: gadget: function: fix missing spinlock in f_uac1_legacy Greg Kroah-Hartman
` (82 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Philippe Schenker, Peter Chen
From: Peter Chen <peter.chen@nxp.com>
commit 876d4e1e8298ad1f94d9e9392fc90486755437b4 upstream.
If wakeup event occurred by extcon event, it needs to call
ci_irq again since the first ci_irq calling at extcon notifier
only wakes up controller, but do noop for event handling,
it causes the extcon use case can't work well from low power mode.
Cc: <stable@vger.kernel.org>
Fixes: 3ecb3e09b042 ("usb: chipidea: Use extcon framework for VBUS and ID detect")
Reported-by: Philippe Schenker <philippe.schenker@toradex.com>
Tested-by: Philippe Schenker <philippe.schenker@toradex.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20200707060601.31907-2-peter.chen@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/chipidea/core.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -1265,6 +1265,29 @@ static void ci_controller_suspend(struct
enable_irq(ci->irq);
}
+/*
+ * Handle the wakeup interrupt triggered by extcon connector
+ * We need to call ci_irq again for extcon since the first
+ * interrupt (wakeup int) only let the controller be out of
+ * low power mode, but not handle any interrupts.
+ */
+static void ci_extcon_wakeup_int(struct ci_hdrc *ci)
+{
+ struct ci_hdrc_cable *cable_id, *cable_vbus;
+ u32 otgsc = hw_read_otgsc(ci, ~0);
+
+ cable_id = &ci->platdata->id_extcon;
+ cable_vbus = &ci->platdata->vbus_extcon;
+
+ if (!IS_ERR(cable_id->edev) && ci->is_otg &&
+ (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS))
+ ci_irq(ci->irq, ci);
+
+ if (!IS_ERR(cable_vbus->edev) && ci->is_otg &&
+ (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS))
+ ci_irq(ci->irq, ci);
+}
+
static int ci_controller_resume(struct device *dev)
{
struct ci_hdrc *ci = dev_get_drvdata(dev);
@@ -1297,6 +1320,7 @@ static int ci_controller_resume(struct d
enable_irq(ci->irq);
if (ci_otg_is_fsm_mode(ci))
ci_otg_fsm_wakeup_by_srp(ci);
+ ci_extcon_wakeup_int(ci);
}
return 0;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 163/244] usb: gadget: function: fix missing spinlock in f_uac1_legacy
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 162/244] usb: chipidea: core: add wakeup support for extcon Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 164/244] USB: serial: iuu_phoenix: fix memory corruption Greg Kroah-Hartman
` (81 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhang Qiang, Felipe Balbi
From: Zhang Qiang <qiang.zhang@windriver.com>
commit 8778eb0927ddcd3f431805c37b78fa56481aeed9 upstream.
Add a missing spinlock protection for play_queue, because
the play_queue may be destroyed when the "playback_work"
work func and "f_audio_out_ep_complete" callback func
operate this paly_queue at the same time.
Fixes: c6994e6f067cf ("USB: gadget: add USB Audio Gadget driver")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Zhang Qiang <qiang.zhang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_uac1_legacy.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/gadget/function/f_uac1_legacy.c
+++ b/drivers/usb/gadget/function/f_uac1_legacy.c
@@ -336,7 +336,9 @@ static int f_audio_out_ep_complete(struc
/* Copy buffer is full, add it to the play_queue */
if (audio_buf_size - copy_buf->actual < req->actual) {
+ spin_lock_irq(&audio->lock);
list_add_tail(©_buf->list, &audio->play_queue);
+ spin_unlock_irq(&audio->lock);
schedule_work(&audio->playback_work);
copy_buf = f_audio_buffer_alloc(audio_buf_size);
if (IS_ERR(copy_buf))
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 164/244] USB: serial: iuu_phoenix: fix memory corruption
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 163/244] usb: gadget: function: fix missing spinlock in f_uac1_legacy Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 165/244] USB: serial: cypress_m8: enable Simply Automated UPB PIM Greg Kroah-Hartman
` (80 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
From: Johan Hovold <johan@kernel.org>
commit e7b931bee739e8a77ae216e613d3b99342b6dec0 upstream.
The driver would happily overwrite its write buffer with user data in
256 byte increments due to a removed buffer-space sanity check.
Fixes: 5fcf62b0f1f2 ("tty: iuu_phoenix: fix locking.")
Cc: stable <stable@vger.kernel.org> # 2.6.31
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/iuu_phoenix.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -697,14 +697,16 @@ static int iuu_uart_write(struct tty_str
struct iuu_private *priv = usb_get_serial_port_data(port);
unsigned long flags;
- if (count > 256)
- return -ENOMEM;
-
spin_lock_irqsave(&priv->lock, flags);
+ count = min(count, 256 - priv->writelen);
+ if (count == 0)
+ goto out;
+
/* fill the buffer */
memcpy(priv->writebuf + priv->writelen, buf, count);
priv->writelen += count;
+out:
spin_unlock_irqrestore(&priv->lock, flags);
return count;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 165/244] USB: serial: cypress_m8: enable Simply Automated UPB PIM
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 164/244] USB: serial: iuu_phoenix: fix memory corruption Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 166/244] USB: serial: ch341: add new Product ID for CH340 Greg Kroah-Hartman
` (79 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, James Hilliard, Johan Hovold
From: James Hilliard <james.hilliard1@gmail.com>
commit 5c45d04c5081c1830d674f4d22d4400ea2083afe upstream.
This is a UPB (Universal Powerline Bus) PIM (Powerline Interface Module)
which allows for controlling multiple UPB compatible devices from Linux
using the standard serial interface.
Based on vendor application source code there are two different models
of USB based PIM devices in addition to a number of RS232 based PIM's.
The vendor UPB application source contains the following USB ID's:
#define USB_PCS_VENDOR_ID 0x04b4
#define USB_PCS_PIM_PRODUCT_ID 0x5500
#define USB_SAI_VENDOR_ID 0x17dd
#define USB_SAI_PIM_PRODUCT_ID 0x5500
The first set of ID's correspond to the PIM variant sold by Powerline
Control Systems while the second corresponds to the Simply Automated
Incorporated PIM. As the product ID for both of these match the default
cypress HID->COM RS232 product ID it assumed that they both use an
internal variant of this HID->COM RS232 converter hardware. However
as the vendor ID for the Simply Automated variant is different we need
to also add it to the cypress_M8 driver so that it is properly
detected.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Link: https://lore.kernel.org/r/20200616220403.1807003-1-james.hilliard1@gmail.com
Cc: stable@vger.kernel.org
[ johan: amend VID define entry ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/cypress_m8.c | 2 ++
drivers/usb/serial/cypress_m8.h | 3 +++
2 files changed, 5 insertions(+)
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -59,6 +59,7 @@ static const struct usb_device_id id_tab
static const struct usb_device_id id_table_cyphidcomrs232[] = {
{ USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
+ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) },
{ USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
{ USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) },
{ } /* Terminating entry */
@@ -73,6 +74,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) },
{ USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) },
{ USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
+ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) },
{ USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
{ USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) },
{ USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) },
--- a/drivers/usb/serial/cypress_m8.h
+++ b/drivers/usb/serial/cypress_m8.h
@@ -25,6 +25,9 @@
#define VENDOR_ID_CYPRESS 0x04b4
#define PRODUCT_ID_CYPHIDCOM 0x5500
+/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */
+#define VENDOR_ID_SAI 0x17dd
+
/* FRWD Dongle - a GPS sports watch */
#define VENDOR_ID_FRWD 0x6737
#define PRODUCT_ID_CYPHIDCOM_FRWD 0x0001
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 166/244] USB: serial: ch341: add new Product ID for CH340
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 165/244] USB: serial: cypress_m8: enable Simply Automated UPB PIM Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 167/244] USB: serial: option: add GosunCn GM500 series Greg Kroah-Hartman
` (78 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Igor Moura, Johan Hovold
From: Igor Moura <imphilippini@gmail.com>
commit 5d0136f8e79f8287e6a36780601f0ce797cf11c2 upstream.
Add PID for CH340 that's found on some ESP8266 dev boards made by
LilyGO. The specific device that contains such serial converter can be
seen here: https://github.com/LilyGO/LILYGO-T-OI.
Apparently, it's a regular CH340, but I've confirmed with others that
also bought this board that the PID found on this device (0x7522)
differs from other devices with the "same" converter (0x7523).
Simply adding its PID to the driver and rebuilding it made it work
as expected.
Signed-off-by: Igor Moura <imphilippini@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ch341.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -77,6 +77,7 @@
static const struct usb_device_id id_table[] = {
{ USB_DEVICE(0x4348, 0x5523) },
+ { USB_DEVICE(0x1a86, 0x7522) },
{ USB_DEVICE(0x1a86, 0x7523) },
{ USB_DEVICE(0x1a86, 0x5523) },
{ },
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 167/244] USB: serial: option: add GosunCn GM500 series
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 166/244] USB: serial: ch341: add new Product ID for CH340 Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 168/244] USB: serial: option: add Quectel EG95 LTE modem Greg Kroah-Hartman
` (77 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jörgen Storvist, Johan Hovold
From: Jörgen Storvist <jorgen.storvist@gmail.com>
commit 08d4ef5cc9203a113702f24725f6cf4db476c958 upstream.
Add USB IDs for GosunCn GM500 series cellular modules.
RNDIS config:
usb-devices
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 12 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=305a ProdID=1404 Rev=03.18
S: Manufacturer=Android
S: Product=Android
S: SerialNumber=
C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#=0x0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
MBIM config:
usb-devices
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=305a ProdID=1405 Rev=03.18
S: Manufacturer=Android
S: Product=Android
S: SerialNumber=
C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
ECM config:
usb-devices
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=305a ProdID=1406 Rev=03.18
S: Manufacturer=Android
S: Product=Android
S: SerialNumber=
C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2028,6 +2028,9 @@ static const struct usb_device_id option
.driver_info = RSVD(4) | RSVD(5) },
{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */
.driver_info = RSVD(6) },
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
{ } /* Terminating entry */
};
MODULE_DEVICE_TABLE(usb, option_ids);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 168/244] USB: serial: option: add Quectel EG95 LTE modem
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 167/244] USB: serial: option: add GosunCn GM500 series Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 169/244] virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers to match upstream Greg Kroah-Hartman
` (76 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, AceLan Kao, Johan Hovold
From: AceLan Kao <acelan.kao@canonical.com>
commit da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 upstream.
Add support for Quectel Wireless Solutions Co., Ltd. EG95 LTE modem
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 5 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0195 Rev=03.18
S: Manufacturer=Android
S: Product=Android
C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -245,6 +245,7 @@ static void option_instat_callback(struc
/* These Quectel products use Quectel's vendor ID */
#define QUECTEL_PRODUCT_EC21 0x0121
#define QUECTEL_PRODUCT_EC25 0x0125
+#define QUECTEL_PRODUCT_EG95 0x0195
#define QUECTEL_PRODUCT_BG96 0x0296
#define QUECTEL_PRODUCT_EP06 0x0306
#define QUECTEL_PRODUCT_EM12 0x0512
@@ -1097,6 +1098,8 @@ static const struct usb_device_id option
.driver_info = RSVD(4) },
{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
.driver_info = RSVD(4) },
+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95),
+ .driver_info = RSVD(4) },
{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
.driver_info = RSVD(4) },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 169/244] virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers to match upstream
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 168/244] USB: serial: option: add Quectel EG95 LTE modem Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 170/244] virt: vbox: Fix guest capabilities mask check Greg Kroah-Hartman
` (75 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Hans de Goede
From: Hans de Goede <hdegoede@redhat.com>
commit f794db6841e5480208f0c3a3ac1df445a96b079e upstream.
Until this commit the mainline kernel version (this version) of the
vboxguest module contained a bug where it defined
VBGL_IOCTL_VMMDEV_REQUEST_BIG and VBGL_IOCTL_LOG using
_IOC(_IOC_READ | _IOC_WRITE, 'V', ...) instead of
_IO(V, ...) as the out of tree VirtualBox upstream version does.
Since the VirtualBox userspace bits are always built against VirtualBox
upstream's headers, this means that so far the mainline kernel version
of the vboxguest module has been failing these 2 ioctls with -ENOTTY.
I guess that VBGL_IOCTL_VMMDEV_REQUEST_BIG is never used causing us to
not hit that one and sofar the vboxguest driver has failed to actually
log any log messages passed it through VBGL_IOCTL_LOG.
This commit changes the VBGL_IOCTL_VMMDEV_REQUEST_BIG and VBGL_IOCTL_LOG
defines to match the out of tree VirtualBox upstream vboxguest version,
while keeping compatibility with the old wrong request defines so as
to not break the kernel ABI in case someone has been using the old
request defines.
Fixes: f6ddd094f579 ("virt: Add vboxguest driver for Virtual Box Guest integration UAPI")
Cc: stable@vger.kernel.org
Acked-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20200709120858.63928-2-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/virt/vboxguest/vboxguest_core.c | 4 +++-
drivers/virt/vboxguest/vboxguest_core.h | 15 +++++++++++++++
drivers/virt/vboxguest/vboxguest_linux.c | 3 ++-
include/uapi/linux/vboxguest.h | 4 ++--
4 files changed, 22 insertions(+), 4 deletions(-)
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -1520,7 +1520,8 @@ int vbg_core_ioctl(struct vbg_session *s
/* For VMMDEV_REQUEST hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT */
if (req_no_size == VBG_IOCTL_VMMDEV_REQUEST(0) ||
- req == VBG_IOCTL_VMMDEV_REQUEST_BIG)
+ req == VBG_IOCTL_VMMDEV_REQUEST_BIG ||
+ req == VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT)
return vbg_ioctl_vmmrequest(gdev, session, data);
if (hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT)
@@ -1558,6 +1559,7 @@ int vbg_core_ioctl(struct vbg_session *s
case VBG_IOCTL_HGCM_CALL(0):
return vbg_ioctl_hgcm_call(gdev, session, f32bit, data);
case VBG_IOCTL_LOG(0):
+ case VBG_IOCTL_LOG_ALT(0):
return vbg_ioctl_log(data);
}
--- a/drivers/virt/vboxguest/vboxguest_core.h
+++ b/drivers/virt/vboxguest/vboxguest_core.h
@@ -15,6 +15,21 @@
#include <linux/vboxguest.h>
#include "vmmdev.h"
+/*
+ * The mainline kernel version (this version) of the vboxguest module
+ * contained a bug where it defined VBGL_IOCTL_VMMDEV_REQUEST_BIG and
+ * VBGL_IOCTL_LOG using _IOC(_IOC_READ | _IOC_WRITE, 'V', ...) instead
+ * of _IO(V, ...) as the out of tree VirtualBox upstream version does.
+ *
+ * These _ALT definitions keep compatibility with the wrong defines the
+ * mainline kernel version used for a while.
+ * Note the VirtualBox userspace bits have always been built against
+ * VirtualBox upstream's headers, so this is likely not necessary. But
+ * we must never break our ABI so we keep these around to be 100% sure.
+ */
+#define VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT _IOC(_IOC_READ | _IOC_WRITE, 'V', 3, 0)
+#define VBG_IOCTL_LOG_ALT(s) _IOC(_IOC_READ | _IOC_WRITE, 'V', 9, s)
+
struct vbg_session;
/** VBox guest memory balloon. */
--- a/drivers/virt/vboxguest/vboxguest_linux.c
+++ b/drivers/virt/vboxguest/vboxguest_linux.c
@@ -131,7 +131,8 @@ static long vbg_misc_device_ioctl(struct
* the need for a bounce-buffer and another copy later on.
*/
is_vmmdev_req = (req & ~IOCSIZE_MASK) == VBG_IOCTL_VMMDEV_REQUEST(0) ||
- req == VBG_IOCTL_VMMDEV_REQUEST_BIG;
+ req == VBG_IOCTL_VMMDEV_REQUEST_BIG ||
+ req == VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT;
if (is_vmmdev_req)
buf = vbg_req_alloc(size, VBG_IOCTL_HDR_TYPE_DEFAULT,
--- a/include/uapi/linux/vboxguest.h
+++ b/include/uapi/linux/vboxguest.h
@@ -103,7 +103,7 @@ VMMDEV_ASSERT_SIZE(vbg_ioctl_driver_vers
/* IOCTL to perform a VMM Device request larger then 1KB. */
-#define VBG_IOCTL_VMMDEV_REQUEST_BIG _IOC(_IOC_READ | _IOC_WRITE, 'V', 3, 0)
+#define VBG_IOCTL_VMMDEV_REQUEST_BIG _IO('V', 3)
/** VBG_IOCTL_HGCM_CONNECT data structure. */
@@ -198,7 +198,7 @@ struct vbg_ioctl_log {
} u;
};
-#define VBG_IOCTL_LOG(s) _IOC(_IOC_READ | _IOC_WRITE, 'V', 9, s)
+#define VBG_IOCTL_LOG(s) _IO('V', 9)
/** VBG_IOCTL_WAIT_FOR_EVENTS data structure. */
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 170/244] virt: vbox: Fix guest capabilities mask check
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 169/244] virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers to match upstream Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 171/244] Revert "tty: xilinx_uartps: Fix missing id assignment to the console" Greg Kroah-Hartman
` (74 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Hans de Goede
From: Hans de Goede <hdegoede@redhat.com>
commit 59d1d2e8e1e7c50d2657d5e4812b53f71f507968 upstream.
Check the passed in capabilities against VMMDEV_GUEST_CAPABILITIES_MASK
instead of against VMMDEV_EVENT_VALID_EVENT_MASK.
This tightens the allowed mask from 0x7ff to 0x7.
Fixes: 0ba002bc4393 ("virt: Add vboxguest driver for Virtual Box Guest integration")
Cc: stable@vger.kernel.org
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20200709120858.63928-3-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/virt/vboxguest/vboxguest_core.c | 2 +-
drivers/virt/vboxguest/vmmdev.h | 2 ++
2 files changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -1444,7 +1444,7 @@ static int vbg_ioctl_change_guest_capabi
or_mask = caps->u.in.or_mask;
not_mask = caps->u.in.not_mask;
- if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK)
+ if ((or_mask | not_mask) & ~VMMDEV_GUEST_CAPABILITIES_MASK)
return -EINVAL;
ret = vbg_set_session_capabilities(gdev, session, or_mask, not_mask,
--- a/drivers/virt/vboxguest/vmmdev.h
+++ b/drivers/virt/vboxguest/vmmdev.h
@@ -206,6 +206,8 @@ VMMDEV_ASSERT_SIZE(vmmdev_mask, 24 + 8);
* not.
*/
#define VMMDEV_GUEST_SUPPORTS_GRAPHICS BIT(2)
+/* The mask of valid capabilities, for sanity checking. */
+#define VMMDEV_GUEST_CAPABILITIES_MASK 0x00000007U
/** struct vmmdev_hypervisorinfo - Hypervisor info structure. */
struct vmmdev_hypervisorinfo {
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 171/244] Revert "tty: xilinx_uartps: Fix missing id assignment to the console"
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 170/244] virt: vbox: Fix guest capabilities mask check Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 172/244] tty: serial: cpm_uart: Fix behaviour for non existing GPIOs Greg Kroah-Hartman
` (73 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jan Kiszka, Michal Simek
From: Jan Kiszka <jan.kiszka@siemens.com>
commit 76ed2e105796710cf5b8a4ba43c81eceed948b70 upstream.
This reverts commit 2ae11c46d5fdc46cb396e35911c713d271056d35.
It turned out to break the ultra96-rev1, e.g., which uses uart1 as
serial0 (and stdout-path = "serial0:115200n8").
Fixes: 2ae11c46d5fd ("tty: xilinx_uartps: Fix missing id assignment to the console")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Michal Simek <michal.simek@xilinx.com>
Tested-by: Michal Simek <michal.simek@xilinx.com>
Link: https://lore.kernel.org/r/f4092727-d8f5-5f91-2c9f-76643aace993@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/xilinx_uartps.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -1459,7 +1459,6 @@ static int cdns_uart_probe(struct platfo
cdns_uart_uart_driver.nr = CDNS_UART_NR_PORTS;
#ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE
cdns_uart_uart_driver.cons = &cdns_uart_console;
- cdns_uart_console.index = id;
#endif
rc = uart_register_driver(&cdns_uart_uart_driver);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 172/244] tty: serial: cpm_uart: Fix behaviour for non existing GPIOs
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 171/244] Revert "tty: xilinx_uartps: Fix missing id assignment to the console" Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 173/244] virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial Greg Kroah-Hartman
` (72 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Linus Walleij, Christophe Leroy
From: Christophe Leroy <christophe.leroy@csgroup.eu>
commit 311eab8d5900ea9088513d4c6b4570058958edb5 upstream.
devm_gpiod_get_index() doesn't return NULL but -ENOENT when the
requested GPIO doesn't exist, leading to the following messages:
[ 2.742468] gpiod_direction_input: invalid GPIO (errorpointer)
[ 2.748147] can't set direction for gpio #2: -2
[ 2.753081] gpiod_direction_input: invalid GPIO (errorpointer)
[ 2.758724] can't set direction for gpio #3: -2
[ 2.763666] gpiod_direction_output: invalid GPIO (errorpointer)
[ 2.769394] can't set direction for gpio #4: -2
[ 2.774341] gpiod_direction_input: invalid GPIO (errorpointer)
[ 2.779981] can't set direction for gpio #5: -2
[ 2.784545] ff000a20.serial: ttyCPM1 at MMIO 0xfff00a20 (irq = 39, base_baud = 8250000) is a CPM UART
Use devm_gpiod_get_index_optional() instead.
At the same time, handle the error case and properly exit
with an error.
Fixes: 97cbaf2c829b ("tty: serial: cpm_uart: Convert to use GPIO descriptors")
Cc: stable@vger.kernel.org
Cc: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/694a25fdce548c5ee8b060ef6a4b02746b8f25c0.1591986307.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/cpm_uart/cpm_uart_core.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
@@ -1215,7 +1215,12 @@ static int cpm_uart_init_port(struct dev
pinfo->gpios[i] = NULL;
- gpiod = devm_gpiod_get_index(dev, NULL, i, GPIOD_ASIS);
+ gpiod = devm_gpiod_get_index_optional(dev, NULL, i, GPIOD_ASIS);
+
+ if (IS_ERR(gpiod)) {
+ ret = PTR_ERR(gpiod);
+ goto out_irq;
+ }
if (gpiod) {
if (i == GPIO_RTS || i == GPIO_DTR)
@@ -1237,6 +1242,8 @@ static int cpm_uart_init_port(struct dev
return cpm_uart_request_port(&pinfo->port);
+out_irq:
+ irq_dispose_mapping(pinfo->port.irq);
out_pram:
cpm_uart_unmap_pram(pinfo, pram);
out_mem:
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 173/244] virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 172/244] tty: serial: cpm_uart: Fix behaviour for non existing GPIOs Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 174/244] serial: sh-sci: Initialize spinlock for uart console Greg Kroah-Hartman
` (71 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Lobakin, Amit Shah
From: Alexander Lobakin <alobakin@pm.me>
commit 897c44f0bae574c5fb318c759b060bebf9dd6013 upstream.
rproc_serial_id_table lacks an exposure to module devicetable, so
when remoteproc firmware requests VIRTIO_ID_RPROC_SERIAL, no uevent
is generated and no module autoloading occurs.
Add missing MODULE_DEVICE_TABLE() annotation and move the existing
one for VIRTIO_ID_CONSOLE right to the table itself.
Fixes: 1b6370463e88 ("virtio_console: Add support for remoteproc serial")
Cc: <stable@vger.kernel.org> # v3.8+
Signed-off-by: Alexander Lobakin <alobakin@pm.me>
Reviewed-by: Amit Shah <amit@kernel.org>
Link: https://lore.kernel.org/r/x7C_CbeJtoGMy258nwAXASYz3xgFMFpyzmUvOyZzRnQrgWCREBjaqBOpAUS7ol4NnZYvSVwmTsCG0Ohyfvta-ygw6HMHcoeKK0C3QFiAO_Q=@pm.me
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/virtio_console.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -2116,6 +2116,7 @@ static struct virtio_device_id id_table[
{ VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID },
{ 0 },
};
+MODULE_DEVICE_TABLE(virtio, id_table);
static unsigned int features[] = {
VIRTIO_CONSOLE_F_SIZE,
@@ -2128,6 +2129,7 @@ static struct virtio_device_id rproc_ser
#endif
{ 0 },
};
+MODULE_DEVICE_TABLE(virtio, rproc_serial_id_table);
static unsigned int rproc_serial_features[] = {
};
@@ -2280,6 +2282,5 @@ static void __exit fini(void)
module_init(init);
module_exit(fini);
-MODULE_DEVICE_TABLE(virtio, id_table);
MODULE_DESCRIPTION("Virtio console driver");
MODULE_LICENSE("GPL");
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 174/244] serial: sh-sci: Initialize spinlock for uart console
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 173/244] virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 175/244] serial: mxs-auart: add missed iounmap() in probe failure and remove Greg Kroah-Hartman
` (70 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lad Prabhakar, Biju Das
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
commit f38278e9b810b06aff2981d505267be984423ba3 upstream.
serial core expects the spinlock to be initialized by the controller
driver for serial console, this patch makes sure the spinlock is
initialized, fixing the below issue:
[ 0.865928] BUG: spinlock bad magic on CPU#0, swapper/0/1
[ 0.865945] lock: sci_ports+0x0/0x4c80, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
[ 0.865955] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.8.0-rc1+ #112
[ 0.865961] Hardware name: HopeRun HiHope RZ/G2H with sub board (DT)
[ 0.865968] Call trace:
[ 0.865979] dump_backtrace+0x0/0x1d8
[ 0.865985] show_stack+0x14/0x20
[ 0.865996] dump_stack+0xe8/0x130
[ 0.866006] spin_dump+0x6c/0x88
[ 0.866012] do_raw_spin_lock+0xb0/0xf8
[ 0.866023] _raw_spin_lock_irqsave+0x80/0xa0
[ 0.866032] uart_add_one_port+0x3a4/0x4e0
[ 0.866039] sci_probe+0x504/0x7c8
[ 0.866048] platform_drv_probe+0x50/0xa0
[ 0.866059] really_probe+0xdc/0x330
[ 0.866066] driver_probe_device+0x58/0xb8
[ 0.866072] device_driver_attach+0x6c/0x90
[ 0.866078] __driver_attach+0x88/0xd0
[ 0.866085] bus_for_each_dev+0x74/0xc8
[ 0.866091] driver_attach+0x20/0x28
[ 0.866098] bus_add_driver+0x14c/0x1f8
[ 0.866104] driver_register+0x60/0x110
[ 0.866109] __platform_driver_register+0x40/0x48
[ 0.866119] sci_init+0x2c/0x34
[ 0.866127] do_one_initcall+0x88/0x428
[ 0.866137] kernel_init_freeable+0x2c0/0x328
[ 0.866143] kernel_init+0x10/0x108
[ 0.866150] ret_from_fork+0x10/0x18
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Fixes: a3cb39d258ef ("serial: core: Allow detach and attach serial device for console")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1593618100-2151-1-git-send-email-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/sh-sci.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -3301,6 +3301,9 @@ static int sci_probe_single(struct platf
sciport->port.flags |= UPF_HARD_FLOW;
}
+ if (sci_uart_driver.cons->index == sciport->port.line)
+ spin_lock_init(&sciport->port.lock);
+
ret = uart_add_one_port(&sci_uart_driver, &sciport->port);
if (ret) {
sci_cleanup_single(sciport);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 175/244] serial: mxs-auart: add missed iounmap() in probe failure and remove
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 174/244] serial: sh-sci: Initialize spinlock for uart console Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 176/244] Revert "serial: core: Refactor uart_unlock_and_check_sysrq()" Greg Kroah-Hartman
` (69 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chuhong Yuan
From: Chuhong Yuan <hslester96@gmail.com>
commit d8edf8eb5f6e921fe6389f96d2cd05862730a6ff upstream.
This driver calls ioremap() in probe, but it misses calling iounmap() in
probe's error handler and remove.
Add the missed calls to fix it.
Fixes: 47d37d6f94cc ("serial: Add auart driver for i.MX23/28")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200709135608.68290-1-hslester96@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/mxs-auart.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -1698,21 +1698,21 @@ static int mxs_auart_probe(struct platfo
irq = platform_get_irq(pdev, 0);
if (irq < 0) {
ret = irq;
- goto out_disable_clks;
+ goto out_iounmap;
}
s->port.irq = irq;
ret = devm_request_irq(&pdev->dev, irq, mxs_auart_irq_handle, 0,
dev_name(&pdev->dev), s);
if (ret)
- goto out_disable_clks;
+ goto out_iounmap;
platform_set_drvdata(pdev, s);
ret = mxs_auart_init_gpios(s, &pdev->dev);
if (ret) {
dev_err(&pdev->dev, "Failed to initialize GPIOs.\n");
- goto out_disable_clks;
+ goto out_iounmap;
}
/*
@@ -1720,7 +1720,7 @@ static int mxs_auart_probe(struct platfo
*/
ret = mxs_auart_request_gpio_irq(s);
if (ret)
- goto out_disable_clks;
+ goto out_iounmap;
auart_port[s->port.line] = s;
@@ -1746,6 +1746,9 @@ out_free_qpio_irq:
mxs_auart_free_gpio_irq(s);
auart_port[pdev->id] = NULL;
+out_iounmap:
+ iounmap(s->port.membase);
+
out_disable_clks:
if (is_asm9260_auart(s)) {
clk_disable_unprepare(s->clk);
@@ -1761,6 +1764,7 @@ static int mxs_auart_remove(struct platf
uart_remove_one_port(&auart_driver, &s->port);
auart_port[pdev->id] = NULL;
mxs_auart_free_gpio_irq(s);
+ iounmap(s->port.membase);
if (is_asm9260_auart(s)) {
clk_disable_unprepare(s->clk);
clk_disable_unprepare(s->clk_ahb);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 176/244] Revert "serial: core: Refactor uart_unlock_and_check_sysrq()"
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 175/244] serial: mxs-auart: add missed iounmap() in probe failure and remove Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 177/244] serial: core: fix sysrq overhead regression Greg Kroah-Hartman
` (68 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Andy Shevchenko
From: Johan Hovold <johan@kernel.org>
commit 10652a9e9fe3fbcaca090f99cd3060ac3fee2913 upstream.
This reverts commit da9a5aa3402db0ff3b57216d8dbf2478e1046cae.
In order to ease backporting a fix for a sysrq regression, revert this
rewrite which was since added on top.
The other sysrq helpers now bail out early when sysrq is not enabled;
it's better to keep that pattern here as well.
Note that the __releases() attribute won't be needed after the follow-on
fix either.
Fixes: da9a5aa3402d ("serial: core: Refactor uart_unlock_and_check_sysrq()")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20200610152232.16925-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/serial_core.c | 23 +++++++++++++----------
include/linux/serial_core.h | 3 ++-
2 files changed, 15 insertions(+), 11 deletions(-)
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -3251,19 +3251,22 @@ int uart_prepare_sysrq_char(struct uart_
}
EXPORT_SYMBOL_GPL(uart_prepare_sysrq_char);
-void uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long flags)
-__releases(&port->lock)
+void uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
{
- if (port->has_sysrq) {
- int sysrq_ch = port->sysrq_ch;
+ int sysrq_ch;
- port->sysrq_ch = 0;
- spin_unlock_irqrestore(&port->lock, flags);
- if (sysrq_ch)
- handle_sysrq(sysrq_ch);
- } else {
- spin_unlock_irqrestore(&port->lock, flags);
+ if (!port->has_sysrq) {
+ spin_unlock_irqrestore(&port->lock, irqflags);
+ return;
}
+
+ sysrq_ch = port->sysrq_ch;
+ port->sysrq_ch = 0;
+
+ spin_unlock_irqrestore(&port->lock, irqflags);
+
+ if (sysrq_ch)
+ handle_sysrq(sysrq_ch);
}
EXPORT_SYMBOL_GPL(uart_unlock_and_check_sysrq);
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -462,7 +462,8 @@ extern void uart_insert_char(struct uart
extern int uart_handle_sysrq_char(struct uart_port *port, unsigned int ch);
extern int uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch);
-extern void uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long flags);
+extern void uart_unlock_and_check_sysrq(struct uart_port *port,
+ unsigned long irqflags);
extern int uart_handle_break(struct uart_port *port);
/*
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 177/244] serial: core: fix sysrq overhead regression
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 176/244] Revert "serial: core: Refactor uart_unlock_and_check_sysrq()" Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 178/244] ovl: fix regression with re-formatted lower squashfs Greg Kroah-Hartman
` (67 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Safonov, Johan Hovold,
Andy Shevchenko
From: Johan Hovold <johan@kernel.org>
commit 08d5470308ac3598e7709d08b8979ce6e9de8da2 upstream.
Commit 8e20fc391711 ("serial_core: Move sysrq functions from header
file") converted the inline sysrq helpers to exported functions which
are now called for every received character, interrupt and break signal
also on systems without CONFIG_MAGIC_SYSRQ_SERIAL instead of being
optimised away by the compiler.
Inlining these helpers again also avoids the function call overhead when
CONFIG_MAGIC_SYSRQ_SERIAL is enabled (e.g. when the port is not used as
a console).
Fixes: 8e20fc391711 ("serial_core: Move sysrq functions from header file")
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>
Link: https://lore.kernel.org/r/20200610152232.16925-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/serial_core.c | 99 -------------------------------------
include/linux/serial_core.h | 103 +++++++++++++++++++++++++++++++++++++--
2 files changed, 100 insertions(+), 102 deletions(-)
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -41,8 +41,6 @@ static struct lock_class_key port_lock_k
#define HIGH_BITS_OFFSET ((sizeof(long)-sizeof(int))*8)
-#define SYSRQ_TIMEOUT (HZ * 5)
-
static void uart_change_speed(struct tty_struct *tty, struct uart_state *state,
struct ktermios *old_termios);
static void uart_wait_until_sent(struct tty_struct *tty, int timeout);
@@ -3175,7 +3173,7 @@ static DECLARE_WORK(sysrq_enable_work, u
* Returns false if @ch is out of enabling sequence and should be
* handled some other way, true if @ch was consumed.
*/
-static bool uart_try_toggle_sysrq(struct uart_port *port, unsigned int ch)
+bool uart_try_toggle_sysrq(struct uart_port *port, unsigned int ch)
{
int sysrq_toggle_seq_len = strlen(sysrq_toggle_seq);
@@ -3198,102 +3196,9 @@ static bool uart_try_toggle_sysrq(struct
port->sysrq = 0;
return true;
}
-#else
-static inline bool uart_try_toggle_sysrq(struct uart_port *port, unsigned int ch)
-{
- return false;
-}
+EXPORT_SYMBOL_GPL(uart_try_toggle_sysrq);
#endif
-int uart_handle_sysrq_char(struct uart_port *port, unsigned int ch)
-{
- if (!IS_ENABLED(CONFIG_MAGIC_SYSRQ_SERIAL))
- return 0;
-
- if (!port->has_sysrq || !port->sysrq)
- return 0;
-
- if (ch && time_before(jiffies, port->sysrq)) {
- if (sysrq_mask()) {
- handle_sysrq(ch);
- port->sysrq = 0;
- return 1;
- }
- if (uart_try_toggle_sysrq(port, ch))
- return 1;
- }
- port->sysrq = 0;
-
- return 0;
-}
-EXPORT_SYMBOL_GPL(uart_handle_sysrq_char);
-
-int uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch)
-{
- if (!IS_ENABLED(CONFIG_MAGIC_SYSRQ_SERIAL))
- return 0;
-
- if (!port->has_sysrq || !port->sysrq)
- return 0;
-
- if (ch && time_before(jiffies, port->sysrq)) {
- if (sysrq_mask()) {
- port->sysrq_ch = ch;
- port->sysrq = 0;
- return 1;
- }
- if (uart_try_toggle_sysrq(port, ch))
- return 1;
- }
- port->sysrq = 0;
-
- return 0;
-}
-EXPORT_SYMBOL_GPL(uart_prepare_sysrq_char);
-
-void uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
-{
- int sysrq_ch;
-
- if (!port->has_sysrq) {
- spin_unlock_irqrestore(&port->lock, irqflags);
- return;
- }
-
- sysrq_ch = port->sysrq_ch;
- port->sysrq_ch = 0;
-
- spin_unlock_irqrestore(&port->lock, irqflags);
-
- if (sysrq_ch)
- handle_sysrq(sysrq_ch);
-}
-EXPORT_SYMBOL_GPL(uart_unlock_and_check_sysrq);
-
-/*
- * We do the SysRQ and SAK checking like this...
- */
-int uart_handle_break(struct uart_port *port)
-{
- struct uart_state *state = port->state;
-
- if (port->handle_break)
- port->handle_break(port);
-
- if (port->has_sysrq && uart_console(port)) {
- if (!port->sysrq) {
- port->sysrq = jiffies + SYSRQ_TIMEOUT;
- return 1;
- }
- port->sysrq = 0;
- }
-
- if (port->flags & UPF_SAK)
- do_SAK(state->port.tty);
- return 0;
-}
-EXPORT_SYMBOL_GPL(uart_handle_break);
-
EXPORT_SYMBOL(uart_write_wakeup);
EXPORT_SYMBOL(uart_register_driver);
EXPORT_SYMBOL(uart_unregister_driver);
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -460,11 +460,104 @@ extern void uart_handle_cts_change(struc
extern void uart_insert_char(struct uart_port *port, unsigned int status,
unsigned int overrun, unsigned int ch, unsigned int flag);
-extern int uart_handle_sysrq_char(struct uart_port *port, unsigned int ch);
-extern int uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch);
-extern void uart_unlock_and_check_sysrq(struct uart_port *port,
- unsigned long irqflags);
-extern int uart_handle_break(struct uart_port *port);
+#ifdef CONFIG_MAGIC_SYSRQ_SERIAL
+#define SYSRQ_TIMEOUT (HZ * 5)
+
+bool uart_try_toggle_sysrq(struct uart_port *port, unsigned int ch);
+
+static inline int uart_handle_sysrq_char(struct uart_port *port, unsigned int ch)
+{
+ if (!port->has_sysrq || !port->sysrq)
+ return 0;
+
+ if (ch && time_before(jiffies, port->sysrq)) {
+ if (sysrq_mask()) {
+ handle_sysrq(ch);
+ port->sysrq = 0;
+ return 1;
+ }
+ if (uart_try_toggle_sysrq(port, ch))
+ return 1;
+ }
+ port->sysrq = 0;
+
+ return 0;
+}
+
+static inline int uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch)
+{
+ if (!port->has_sysrq || !port->sysrq)
+ return 0;
+
+ if (ch && time_before(jiffies, port->sysrq)) {
+ if (sysrq_mask()) {
+ port->sysrq_ch = ch;
+ port->sysrq = 0;
+ return 1;
+ }
+ if (uart_try_toggle_sysrq(port, ch))
+ return 1;
+ }
+ port->sysrq = 0;
+
+ return 0;
+}
+
+static inline void uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
+{
+ int sysrq_ch;
+
+ if (!port->has_sysrq) {
+ spin_unlock_irqrestore(&port->lock, irqflags);
+ return;
+ }
+
+ sysrq_ch = port->sysrq_ch;
+ port->sysrq_ch = 0;
+
+ spin_unlock_irqrestore(&port->lock, irqflags);
+
+ if (sysrq_ch)
+ handle_sysrq(sysrq_ch);
+}
+#else /* CONFIG_MAGIC_SYSRQ_SERIAL */
+static inline int uart_handle_sysrq_char(struct uart_port *port, unsigned int ch)
+{
+ return 0;
+}
+static inline int uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch)
+{
+ return 0;
+}
+static inline void uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
+{
+ spin_unlock_irqrestore(&port->lock, irqflags);
+}
+#endif /* CONFIG_MAGIC_SYSRQ_SERIAL */
+
+/*
+ * We do the SysRQ and SAK checking like this...
+ */
+static inline int uart_handle_break(struct uart_port *port)
+{
+ struct uart_state *state = port->state;
+
+ if (port->handle_break)
+ port->handle_break(port);
+
+#ifdef CONFIG_MAGIC_SYSRQ_SERIAL
+ if (port->has_sysrq && uart_console(port)) {
+ if (!port->sysrq) {
+ port->sysrq = jiffies + SYSRQ_TIMEOUT;
+ return 1;
+ }
+ port->sysrq = 0;
+ }
+#endif
+ if (port->flags & UPF_SAK)
+ do_SAK(state->port.tty);
+ return 0;
+}
/*
* UART_ENABLE_MS - determine if port should enable modem status irqs
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 178/244] ovl: fix regression with re-formatted lower squashfs
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 177/244] serial: core: fix sysrq overhead regression Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 179/244] ovl: inode reference leak in ovl_is_inuse true case Greg Kroah-Hartman
` (66 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fabian, Amir Goldstein, Miklos Szeredi
From: Amir Goldstein <amir73il@gmail.com>
commit a888db310195400f050b89c47673f0f8babfbb41 upstream.
Commit 9df085f3c9a2 ("ovl: relax requirement for non null uuid of lower
fs") relaxed the requirement for non null uuid with single lower layer to
allow enabling index and nfs_export features with single lower squashfs.
Fabian reported a regression in a setup when overlay re-uses an existing
upper layer and re-formats the lower squashfs image. Because squashfs
has no uuid, the origin xattr in upper layer are decoded from the new
lower layer where they may resolve to a wrong origin file and user may
get an ESTALE or EIO error on lookup.
To avoid the reported regression while still allowing the new features
with single lower squashfs, do not allow decoding origin with lower null
uuid unless user opted-in to one of the new features that require
following the lower inode of non-dir upper (index, xino, metacopy).
Reported-by: Fabian <godi.beat@gmx.net>
Link: https://lore.kernel.org/linux-unionfs/32532923.JtPX5UtSzP@fgdesktop/
Fixes: 9df085f3c9a2 ("ovl: relax requirement for non null uuid of lower fs")
Cc: stable@vger.kernel.org # v4.20+
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/super.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1331,6 +1331,18 @@ static bool ovl_lower_uuid_ok(struct ovl
if (!ofs->config.nfs_export && !ofs->upper_mnt)
return true;
+ /*
+ * We allow using single lower with null uuid for index and nfs_export
+ * for example to support those features with single lower squashfs.
+ * To avoid regressions in setups of overlay with re-formatted lower
+ * squashfs, do not allow decoding origin with lower null uuid unless
+ * user opted-in to one of the new features that require following the
+ * lower inode of non-dir upper.
+ */
+ if (!ofs->config.index && !ofs->config.metacopy && !ofs->config.xino &&
+ uuid_is_null(uuid))
+ return false;
+
for (i = 0; i < ofs->numfs; i++) {
/*
* We use uuid to associate an overlay lower file handle with a
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 179/244] ovl: inode reference leak in ovl_is_inuse true case.
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 178/244] ovl: fix regression with re-formatted lower squashfs Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 180/244] ovl: relax WARN_ON() when decoding lower directory file handle Greg Kroah-Hartman
` (65 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Amir Goldstein, youngjun, Miklos Szeredi
From: youngjun <her0gyugyu@gmail.com>
commit 24f14009b8f1754ec2ae4c168940c01259b0f88a upstream.
When "ovl_is_inuse" true case, trap inode reference not put. plus adding
the comment explaining sequence of ovl_is_inuse after ovl_setup_trap.
Fixes: 0be0bfd2de9d ("ovl: fix regression caused by overlapping layers detection")
Cc: <stable@vger.kernel.org> # v4.19+
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: youngjun <her0gyugyu@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/super.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1450,14 +1450,23 @@ static int ovl_get_layers(struct super_b
if (err < 0)
goto out;
+ /*
+ * Check if lower root conflicts with this overlay layers before
+ * checking if it is in-use as upperdir/workdir of "another"
+ * mount, because we do not bother to check in ovl_is_inuse() if
+ * the upperdir/workdir is in fact in-use by our
+ * upperdir/workdir.
+ */
err = ovl_setup_trap(sb, stack[i].dentry, &trap, "lowerdir");
if (err)
goto out;
if (ovl_is_inuse(stack[i].dentry)) {
err = ovl_report_in_use(ofs, "lowerdir");
- if (err)
+ if (err) {
+ iput(trap);
goto out;
+ }
}
mnt = clone_private_mount(&stack[i]);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 180/244] ovl: relax WARN_ON() when decoding lower directory file handle
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 179/244] ovl: inode reference leak in ovl_is_inuse true case Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 181/244] ovl: fix unneeded call to ovl_change_flags() Greg Kroah-Hartman
` (64 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Amir Goldstein, Miklos Szeredi
From: Amir Goldstein <amir73il@gmail.com>
commit 124c2de2c0aee96271e4ddab190083d8aa7aa71a upstream.
Decoding a lower directory file handle to overlay path with cold
inode/dentry cache may go as follows:
1. Decode real lower file handle to lower dir path
2. Check if lower dir is indexed (was copied up)
3. If indexed, get the upper dir path from index
4. Lookup upper dir path in overlay
5. If overlay path found, verify that overlay lower is the lower dir
from step 1
On failure to verify step 5 above, user will get an ESTALE error and a
WARN_ON will be printed.
A mismatch in step 5 could be a result of lower directory that was renamed
while overlay was offline, after that lower directory has been copied up
and indexed.
This is a scripted reproducer based on xfstest overlay/052:
# Create lower subdir
create_dirs
create_test_files $lower/lowertestdir/subdir
mount_dirs
# Copy up lower dir and encode lower subdir file handle
touch $SCRATCH_MNT/lowertestdir
test_file_handles $SCRATCH_MNT/lowertestdir/subdir -p -o $tmp.fhandle
# Rename lower dir offline
unmount_dirs
mv $lower/lowertestdir $lower/lowertestdir.new/
mount_dirs
# Attempt to decode lower subdir file handle
test_file_handles $SCRATCH_MNT -p -i $tmp.fhandle
Since this WARN_ON() can be triggered by user we need to relax it.
Fixes: 4b91c30a5a19 ("ovl: lookup connected ancestor of dir in inode cache")
Cc: <stable@vger.kernel.org> # v4.16+
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/export.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/overlayfs/export.c
+++ b/fs/overlayfs/export.c
@@ -478,7 +478,7 @@ static struct dentry *ovl_lookup_real_in
if (IS_ERR_OR_NULL(this))
return this;
- if (WARN_ON(ovl_dentry_real_at(this, layer->idx) != real)) {
+ if (ovl_dentry_real_at(this, layer->idx) != real) {
dput(this);
this = ERR_PTR(-EIO);
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 181/244] ovl: fix unneeded call to ovl_change_flags()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 180/244] ovl: relax WARN_ON() when decoding lower directory file handle Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 182/244] fuse: ignore data argument of mount(..., MS_REMOUNT) Greg Kroah-Hartman
` (63 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Amir Goldstein, Miklos Szeredi
From: Amir Goldstein <amir73il@gmail.com>
commit 81a33c1ee941c3bb9ffc6bac8f676be13351344e upstream.
The check if user has changed the overlay file was wrong, causing unneeded
call to ovl_change_flags() including taking f_lock on every file access.
Fixes: d989903058a8 ("ovl: do not generate duplicate fsnotify events for "fake" path")
Cc: <stable@vger.kernel.org> # v4.19+
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/file.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -32,13 +32,16 @@ static char ovl_whatisit(struct inode *i
return 'm';
}
+/* No atime modificaton nor notify on underlying */
+#define OVL_OPEN_FLAGS (O_NOATIME | FMODE_NONOTIFY)
+
static struct file *ovl_open_realfile(const struct file *file,
struct inode *realinode)
{
struct inode *inode = file_inode(file);
struct file *realfile;
const struct cred *old_cred;
- int flags = file->f_flags | O_NOATIME | FMODE_NONOTIFY;
+ int flags = file->f_flags | OVL_OPEN_FLAGS;
old_cred = ovl_override_creds(inode->i_sb);
realfile = open_with_fake_path(&file->f_path, flags, realinode,
@@ -59,8 +62,7 @@ static int ovl_change_flags(struct file
struct inode *inode = file_inode(file);
int err;
- /* No atime modificaton on underlying */
- flags |= O_NOATIME | FMODE_NONOTIFY;
+ flags |= OVL_OPEN_FLAGS;
/* If some flag changed that cannot be changed then something's amiss */
if (WARN_ON((file->f_flags ^ flags) & ~OVL_SETFL_MASK))
@@ -113,7 +115,7 @@ static int ovl_real_fdget_meta(const str
}
/* Did the flags change since open? */
- if (unlikely((file->f_flags ^ real->file->f_flags) & ~O_NOATIME))
+ if (unlikely((file->f_flags ^ real->file->f_flags) & ~OVL_OPEN_FLAGS))
return ovl_change_flags(real->file, file->f_flags);
return 0;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 182/244] fuse: ignore data argument of mount(..., MS_REMOUNT)
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 181/244] ovl: fix unneeded call to ovl_change_flags() Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 183/244] fuse: use ->reconfigure() instead of ->remount_fs() Greg Kroah-Hartman
` (62 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Priebe, Miklos Szeredi
From: Miklos Szeredi <mszeredi@redhat.com>
commit e8b20a474cf2c42698d1942f939ff2128819f151 upstream.
The command
mount -o remount -o unknownoption /mnt/fuse
succeeds on kernel versions prior to v5.4 and fails on kernel version at or
after. This is because fuse_parse_param() rejects any unrecognised options
in case of FS_CONTEXT_FOR_RECONFIGURE, just as for FS_CONTEXT_FOR_MOUNT.
This causes a regression in case the fuse filesystem is in fstab, since
remount sends all options found there to the kernel; even ones that are
meant for the initial mount and are consumed by the userspace fuse server.
Fix this by ignoring mount options, just as fuse_remount_fs() did prior to
the conversion to the new API.
Reported-by: Stefan Priebe <s.priebe@profihost.ag>
Fixes: c30da2e981a7 ("fuse: convert to use the new mount API")
Cc: <stable@vger.kernel.org> # v5.4
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/inode.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -468,6 +468,13 @@ static int fuse_parse_param(struct fs_co
struct fuse_fs_context *ctx = fc->fs_private;
int opt;
+ /*
+ * Ignore options coming from mount(MS_REMOUNT) for backward
+ * compatibility.
+ */
+ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE)
+ return 0;
+
opt = fs_parse(fc, fuse_fs_parameters, param, &result);
if (opt < 0)
return opt;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 183/244] fuse: use ->reconfigure() instead of ->remount_fs()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 182/244] fuse: ignore data argument of mount(..., MS_REMOUNT) Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 184/244] fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS Greg Kroah-Hartman
` (61 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miklos Szeredi
From: Miklos Szeredi <mszeredi@redhat.com>
commit 0189a2d367f49729622fdafaef5da73161591859 upstream.
s_op->remount_fs() is only called from legacy_reconfigure(), which is not
used after being converted to the new API.
Convert to using ->reconfigure(). This restores the previous behavior of
syncing the filesystem and rejecting MS_MANDLOCK on remount.
Fixes: c30da2e981a7 ("fuse: convert to use the new mount API")
Cc: <stable@vger.kernel.org> # v5.4
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/inode.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -121,10 +121,12 @@ static void fuse_evict_inode(struct inod
}
}
-static int fuse_remount_fs(struct super_block *sb, int *flags, char *data)
+static int fuse_reconfigure(struct fs_context *fc)
{
+ struct super_block *sb = fc->root->d_sb;
+
sync_filesystem(sb);
- if (*flags & SB_MANDLOCK)
+ if (fc->sb_flags & SB_MANDLOCK)
return -EINVAL;
return 0;
@@ -817,7 +819,6 @@ static const struct super_operations fus
.evict_inode = fuse_evict_inode,
.write_inode = fuse_write_inode,
.drop_inode = generic_delete_inode,
- .remount_fs = fuse_remount_fs,
.put_super = fuse_put_super,
.umount_begin = fuse_umount_begin,
.statfs = fuse_statfs,
@@ -1291,6 +1292,7 @@ static int fuse_get_tree(struct fs_conte
static const struct fs_context_operations fuse_context_ops = {
.free = fuse_free_fc,
.parse_param = fuse_parse_param,
+ .reconfigure = fuse_reconfigure,
.get_tree = fuse_get_tree,
};
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 184/244] fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 183/244] fuse: use ->reconfigure() instead of ->remount_fs() Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 185/244] Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()" Greg Kroah-Hartman
` (60 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chirantan Ekbote, Miklos Szeredi
From: Chirantan Ekbote <chirantan@chromium.org>
commit 31070f6ccec09f3bd4f1e28cd1e592fa4f3ba0b6 upstream.
The ioctl encoding for this parameter is a long but the documentation says
it should be an int and the kernel drivers expect it to be an int. If the
fuse driver treats this as a long it might end up scribbling over the stack
of a userspace process that only allocated enough space for an int.
This was previously discussed in [1] and a patch for fuse was proposed in
[2]. From what I can tell the patch in [2] was nacked in favor of adding
new, "fixed" ioctls and using those from userspace. However there is still
no "fixed" version of these ioctls and the fact is that it's sometimes
infeasible to change all userspace to use the new one.
Handling the ioctls specially in the fuse driver seems like the most
pragmatic way for fuse servers to support them without causing crashes in
userspace applications that call them.
[1]: https://lore.kernel.org/linux-fsdevel/20131126200559.GH20559@hall.aurel32.net/T/
[2]: https://sourceforge.net/p/fuse/mailman/message/31771759/
Signed-off-by: Chirantan Ekbote <chirantan@chromium.org>
Fixes: 59efec7b9039 ("fuse: implement ioctl support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/file.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -18,6 +18,7 @@
#include <linux/swap.h>
#include <linux/falloc.h>
#include <linux/uio.h>
+#include <linux/fs.h>
static struct page **fuse_pages_alloc(unsigned int npages, gfp_t flags,
struct fuse_page_desc **desc)
@@ -2758,7 +2759,16 @@ long fuse_do_ioctl(struct file *file, un
struct iovec *iov = iov_page;
iov->iov_base = (void __user *)arg;
- iov->iov_len = _IOC_SIZE(cmd);
+
+ switch (cmd) {
+ case FS_IOC_GETFLAGS:
+ case FS_IOC_SETFLAGS:
+ iov->iov_len = sizeof(int);
+ break;
+ default:
+ iov->iov_len = _IOC_SIZE(cmd);
+ break;
+ }
if (_IOC_DIR(cmd) & _IOC_WRITE) {
in_iov = iov;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 185/244] Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()"
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 184/244] fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 186/244] mei: bus: dont clean driver pointer Greg Kroah-Hartman
` (59 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wade Mealing, Steffen Maier, Minchan Kim
From: Wade Mealing <wmealing@redhat.com>
commit 853eab68afc80f59f36bbdeb715e5c88c501e680 upstream.
Turns out that the permissions for 0400 really are what we want here,
otherwise any user can read from this file.
[fixed formatting, added changelog, and made attribute static - gregkh]
Reported-by: Wade Mealing <wmealing@redhat.com>
Cc: stable <stable@vger.kernel.org>
Fixes: f40609d1591f ("zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()")
Link: https://bugzilla.redhat.com/show_bug.cgi?id=1847832
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Acked-by: Minchan Kim <minchan@kernel.org>
Link: https://lore.kernel.org/r/20200617114946.GA2131650@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/zram/zram_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -2025,7 +2025,8 @@ static ssize_t hot_add_show(struct class
return ret;
return scnprintf(buf, PAGE_SIZE, "%d\n", ret);
}
-static CLASS_ATTR_RO(hot_add);
+static struct class_attribute class_attr_hot_add =
+ __ATTR(hot_add, 0400, hot_add_show, NULL);
static ssize_t hot_remove_store(struct class *class,
struct class_attribute *attr,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 186/244] mei: bus: dont clean driver pointer
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 185/244] Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()" Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 187/244] Revert "Input: elants_i2c - report resolution information for touch major" Greg Kroah-Hartman
` (58 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Whitcroft, Alexander Usyskin,
Tomas Winkler
From: Alexander Usyskin <alexander.usyskin@intel.com>
commit e852c2c251ed9c23ae6e3efebc5ec49adb504207 upstream.
It's not needed to set driver to NULL in mei_cl_device_remove()
which is bus_type remove() handler as this is done anyway
in __device_release_driver().
Actually this is causing an endless loop in driver_detach()
on ubuntu patched kernel, while removing (rmmod) the mei_hdcp module.
The reason list_empty(&drv->p->klist_devices.k_list) is always not-empty.
as the check is always true in __device_release_driver()
if (dev->driver != drv)
return;
The non upstream patch is causing this behavior, titled:
'vfio -- release device lock before userspace requests'
Nevertheless the fix is correct also for the upstream.
Link: https://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20180912085046.3401-2-apw@canonical.com/
Cc: <stable@vger.kernel.org>
Cc: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20200628225359.2185929-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/mei/bus.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -745,9 +745,8 @@ static int mei_cl_device_remove(struct d
mei_cl_bus_module_put(cldev);
module_put(THIS_MODULE);
- dev->driver = NULL;
- return ret;
+ return ret;
}
static ssize_t name_show(struct device *dev, struct device_attribute *a,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 187/244] Revert "Input: elants_i2c - report resolution information for touch major"
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 186/244] mei: bus: dont clean driver pointer Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 188/244] Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list Greg Kroah-Hartman
` (57 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Harry Cutts, Dmitry Torokhov
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 93b9de223c0135db495c25334e66cb669bef13e2 upstream.
This reverts commit 061706716384f1633d3d5090b22a99f33f1fcf2f - it turns
out that the resolution of 1 unit per mm was not correct for a number of
touch screens, causing touch sizes to be reported as way too large.
See https://crbug.com/1085648
Reported-by: Harry Cutts <hcutts@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/elants_i2c.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/input/touchscreen/elants_i2c.c
+++ b/drivers/input/touchscreen/elants_i2c.c
@@ -1318,7 +1318,6 @@ static int elants_i2c_probe(struct i2c_c
0, MT_TOOL_PALM, 0, 0);
input_abs_set_res(ts->input, ABS_MT_POSITION_X, ts->x_res);
input_abs_set_res(ts->input, ABS_MT_POSITION_Y, ts->y_res);
- input_abs_set_res(ts->input, ABS_MT_TOUCH_MAJOR, 1);
error = input_register_device(ts->input);
if (error) {
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 188/244] Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 187/244] Revert "Input: elants_i2c - report resolution information for touch major" Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 189/244] Input: elan_i2c - add more hardware ID for Lenovo laptops Greg Kroah-Hartman
` (56 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Pedersen, Dmitry Torokhov
From: David Pedersen <limero1337@gmail.com>
commit 17d51429da722cd8fc77a365a112f008abf4f8b3 upstream.
This fixes two finger trackpad scroll on the Lenovo XiaoXin Air 12.
Without nomux, the trackpad behaves as if only one finger is present and
moves the cursor when trying to scroll.
Signed-off-by: David Pedersen <limero1337@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200625133754.291325-1-limero1337@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -426,6 +426,13 @@ static const struct dmi_system_id __init
},
},
{
+ /* Lenovo XiaoXin Air 12 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "80UN"),
+ },
+ },
+ {
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1360"),
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 189/244] Input: elan_i2c - add more hardware ID for Lenovo laptops
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 188/244] Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 190/244] coresight: etmv4: Fix CPU power management setup in probe() function Greg Kroah-Hartman
` (55 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dave Wang, Dmitry Torokhov
From: Dave Wang <dave.wang@emc.com.tw>
commit a50ca29523b18baea548bdf5df9b4b923c2bb4f6 upstream.
This adds more hardware IDs for Elan touchpads found in various Lenovo
laptops.
Signed-off-by: Dave Wang <dave.wang@emc.com.tw>
Link: https://lore.kernel.org/r/000201d5a8bd$9fead3f0$dfc07bd0$@emc.com.tw
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/input/elan-i2c-ids.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/include/linux/input/elan-i2c-ids.h
+++ b/include/linux/input/elan-i2c-ids.h
@@ -67,8 +67,15 @@ static const struct acpi_device_id elan_
{ "ELAN062B", 0 },
{ "ELAN062C", 0 },
{ "ELAN062D", 0 },
+ { "ELAN062E", 0 }, /* Lenovo V340 Whiskey Lake U */
+ { "ELAN062F", 0 }, /* Lenovo V340 Comet Lake U */
{ "ELAN0631", 0 },
{ "ELAN0632", 0 },
+ { "ELAN0633", 0 }, /* Lenovo S145 */
+ { "ELAN0634", 0 }, /* Lenovo V340 Ice lake */
+ { "ELAN0635", 0 }, /* Lenovo V1415-IIL */
+ { "ELAN0636", 0 }, /* Lenovo V1415-Dali */
+ { "ELAN0637", 0 }, /* Lenovo V1415-IGLR */
{ "ELAN1000", 0 },
{ }
};
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 190/244] coresight: etmv4: Fix CPU power management setup in probe() function
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 189/244] Input: elan_i2c - add more hardware ID for Lenovo laptops Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 191/244] uio_pdrv_genirq: Remove warning when irq is not specified Greg Kroah-Hartman
` (54 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mike Leach, Mathieu Poirier
From: Mike Leach <mike.leach@linaro.org>
commit 9b6a3f3633a5cc928b78627764793b60cb62e0f6 upstream.
The current probe() function calls a pair of cpuhp_xxx API functions to
setup CPU hotplug handling. The hotplug lock is held for the duration of
the two calls and other CPU related code using cpus_read_lock() /
cpus_read_unlock() calls.
The problem is that on error states, goto: statements bypass the
cpus_read_unlock() call. This code has increased in complexity as the
driver has developed.
This patch introduces a pair of helper functions etm4_pm_setup_cpuslocked()
and etm4_pm_clear() which correct the issues above and group the PM code a
little better.
The two functions etm4_cpu_pm_register() and etm4_cpu_pm_unregister() are
dropped as these call cpu_pm_register_notifier() / ..unregister_notifier()
dependent on CONFIG_CPU_PM - but this define is used to nop these functions
out in the pm headers - so the wrapper functions are superfluous.
Fixes: f188b5e76aae ("coresight: etm4x: Save/restore state across CPU low power states")
Fixes: e9f5d63f84fe ("hwtracing/coresight-etm4x: Use cpuhp_setup_state_nocalls_cpuslocked()")
Fixes: 58eb457be028 ("hwtracing/coresight-etm4x: Convert to hotplug state machine")
Signed-off-by: Mike Leach <mike.leach@linaro.org>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20200701160852.2782823-3-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/coresight/coresight-etm4x.c | 82 ++++++++++++++++----------
1 file changed, 53 insertions(+), 29 deletions(-)
--- a/drivers/hwtracing/coresight/coresight-etm4x.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x.c
@@ -1399,18 +1399,57 @@ static struct notifier_block etm4_cpu_pm
.notifier_call = etm4_cpu_pm_notify,
};
-static int etm4_cpu_pm_register(void)
+/* Setup PM. Called with cpus locked. Deals with error conditions and counts */
+static int etm4_pm_setup_cpuslocked(void)
{
- if (IS_ENABLED(CONFIG_CPU_PM))
- return cpu_pm_register_notifier(&etm4_cpu_pm_nb);
+ int ret;
- return 0;
+ if (etm4_count++)
+ return 0;
+
+ ret = cpu_pm_register_notifier(&etm4_cpu_pm_nb);
+ if (ret)
+ goto reduce_count;
+
+ ret = cpuhp_setup_state_nocalls_cpuslocked(CPUHP_AP_ARM_CORESIGHT_STARTING,
+ "arm/coresight4:starting",
+ etm4_starting_cpu, etm4_dying_cpu);
+
+ if (ret)
+ goto unregister_notifier;
+
+ ret = cpuhp_setup_state_nocalls_cpuslocked(CPUHP_AP_ONLINE_DYN,
+ "arm/coresight4:online",
+ etm4_online_cpu, NULL);
+
+ /* HP dyn state ID returned in ret on success */
+ if (ret > 0) {
+ hp_online = ret;
+ return 0;
+ }
+
+ /* failed dyn state - remove others */
+ cpuhp_remove_state_nocalls_cpuslocked(CPUHP_AP_ARM_CORESIGHT_STARTING);
+
+unregister_notifier:
+ cpu_pm_unregister_notifier(&etm4_cpu_pm_nb);
+
+reduce_count:
+ --etm4_count;
+ return ret;
}
-static void etm4_cpu_pm_unregister(void)
+static void etm4_pm_clear(void)
{
- if (IS_ENABLED(CONFIG_CPU_PM))
- cpu_pm_unregister_notifier(&etm4_cpu_pm_nb);
+ if (--etm4_count != 0)
+ return;
+
+ cpu_pm_unregister_notifier(&etm4_cpu_pm_nb);
+ cpuhp_remove_state_nocalls(CPUHP_AP_ARM_CORESIGHT_STARTING);
+ if (hp_online) {
+ cpuhp_remove_state_nocalls(hp_online);
+ hp_online = 0;
+ }
}
static int etm4_probe(struct amba_device *adev, const struct amba_id *id)
@@ -1464,24 +1503,15 @@ static int etm4_probe(struct amba_device
etm4_init_arch_data, drvdata, 1))
dev_err(dev, "ETM arch init failed\n");
- if (!etm4_count++) {
- cpuhp_setup_state_nocalls_cpuslocked(CPUHP_AP_ARM_CORESIGHT_STARTING,
- "arm/coresight4:starting",
- etm4_starting_cpu, etm4_dying_cpu);
- ret = cpuhp_setup_state_nocalls_cpuslocked(CPUHP_AP_ONLINE_DYN,
- "arm/coresight4:online",
- etm4_online_cpu, NULL);
- if (ret < 0)
- goto err_arch_supported;
- hp_online = ret;
+ ret = etm4_pm_setup_cpuslocked();
+ cpus_read_unlock();
- ret = etm4_cpu_pm_register();
- if (ret)
- goto err_arch_supported;
+ /* etm4_pm_setup_cpuslocked() does its own cleanup - exit on error */
+ if (ret) {
+ etmdrvdata[drvdata->cpu] = NULL;
+ return ret;
}
- cpus_read_unlock();
-
if (etm4_arch_supported(drvdata->arch) == false) {
ret = -EINVAL;
goto err_arch_supported;
@@ -1528,13 +1558,7 @@ static int etm4_probe(struct amba_device
err_arch_supported:
etmdrvdata[drvdata->cpu] = NULL;
- if (--etm4_count == 0) {
- etm4_cpu_pm_unregister();
-
- cpuhp_remove_state_nocalls(CPUHP_AP_ARM_CORESIGHT_STARTING);
- if (hp_online)
- cpuhp_remove_state_nocalls(hp_online);
- }
+ etm4_pm_clear();
return ret;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 191/244] uio_pdrv_genirq: Remove warning when irq is not specified
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 190/244] coresight: etmv4: Fix CPU power management setup in probe() function Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 192/244] uio_pdrv_genirq: fix use without device tree and no interrupt Greg Kroah-Hartman
` (53 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Esben Haabendal
From: Esben Haabendal <esben@geanix.com>
commit 324ac45f25e634eca6346953ae531e8da3e0c73d upstream.
Since e3a3c3a20555 ("UIO: fix uio_pdrv_genirq with device tree but no
interrupt"), the uio_pdrv_genirq has supported use without interrupt,
so the change in 7723f4c5ecdb ("driver core: platform: Add an error
message to") added false warnings for those cases.
Fixes: 7723f4c5ecdb ("driver core: platform: Add an error message to platform_get_irq*()")
Signed-off-by: Esben Haabendal <esben@geanix.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200701145659.3978-2-esben@geanix.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/uio/uio_pdrv_genirq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/uio/uio_pdrv_genirq.c
+++ b/drivers/uio/uio_pdrv_genirq.c
@@ -159,7 +159,7 @@ static int uio_pdrv_genirq_probe(struct
priv->pdev = pdev;
if (!uioinfo->irq) {
- ret = platform_get_irq(pdev, 0);
+ ret = platform_get_irq_optional(pdev, 0);
uioinfo->irq = ret;
if (ret == -ENXIO && pdev->dev.of_node)
uioinfo->irq = UIO_IRQ_NONE;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 192/244] uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 191/244] uio_pdrv_genirq: Remove warning when irq is not specified Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 193/244] scsi: megaraid_sas: Remove undefined ENABLE_IRQ_POLL macro Greg Kroah-Hartman
` (52 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Esben Haabendal
From: Esben Haabendal <esben@geanix.com>
commit bf12fdf0ab728ca8e5933aac46dd972c0dd0421e upstream.
While e3a3c3a20555 ("UIO: fix uio_pdrv_genirq with device tree but no
interrupt") added support for using uio_pdrv_genirq for devices without
interrupt for device tree platforms, the removal of uio_pdrv in
26dac3c49d56 ("uio: Remove uio_pdrv and use uio_pdrv_genirq instead")
broke the support for non device tree platforms.
This change fixes this, so that uio_pdrv_genirq can be used without
interrupt on all platforms.
This still leaves the support that uio_pdrv had for custom interrupt
handler lacking, as uio_pdrv_genirq does not handle it (yet).
Fixes: 26dac3c49d56 ("uio: Remove uio_pdrv and use uio_pdrv_genirq instead")
Signed-off-by: Esben Haabendal <esben@geanix.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200701145659.3978-3-esben@geanix.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/uio/uio_pdrv_genirq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/uio/uio_pdrv_genirq.c
+++ b/drivers/uio/uio_pdrv_genirq.c
@@ -161,7 +161,7 @@ static int uio_pdrv_genirq_probe(struct
if (!uioinfo->irq) {
ret = platform_get_irq_optional(pdev, 0);
uioinfo->irq = ret;
- if (ret == -ENXIO && pdev->dev.of_node)
+ if (ret == -ENXIO)
uioinfo->irq = UIO_IRQ_NONE;
else if (ret == -EPROBE_DEFER)
return ret;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 193/244] scsi: megaraid_sas: Remove undefined ENABLE_IRQ_POLL macro
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 192/244] uio_pdrv_genirq: fix use without device tree and no interrupt Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 194/244] timer: Prevent base->clk from moving backward Greg Kroah-Hartman
` (51 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chandrakanth Patil, Kashyap Desai,
Martin K. Petersen
From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
commit 07d3f04550023395bbf34b99ec7e00fc50d9859f upstream.
As the ENABLE_IRQ_POLL macro is undefined, the check for ENABLE_IRQ_POLL
macro in ISR will always be false. This leads to irq polling being
non-functional.
Remove ENABLE_IRQ_POLL check from ISR.
Link: https://lore.kernel.org/r/20200715120153.20512-1-chandrakanth.patil@broadcom.com
Fixes: a6ffd5bf6819 ("scsi: megaraid_sas: Call disable_irq from process IRQ")
Cc: <stable@vger.kernel.org> # v5.3+
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/megaraid/megaraid_sas_fusion.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -3797,10 +3797,8 @@ static irqreturn_t megasas_isr_fusion(in
if (instance->mask_interrupts)
return IRQ_NONE;
-#if defined(ENABLE_IRQ_POLL)
if (irq_context->irq_poll_scheduled)
return IRQ_HANDLED;
-#endif
if (!instance->msix_vectors) {
mfiStatus = instance->instancet->clear_intr(instance);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 194/244] timer: Prevent base->clk from moving backward
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 193/244] scsi: megaraid_sas: Remove undefined ENABLE_IRQ_POLL macro Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 195/244] timer: Fix wheel index calculation on last level Greg Kroah-Hartman
` (50 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Frederic Weisbecker, Thomas Gleixner,
Anna-Maria Behnsen, Juri Lelli
From: Frederic Weisbecker <frederic@kernel.org>
commit 30c66fc30ee7a98c4f3adf5fb7e213b61884474f upstream.
When a timer is enqueued with a negative delta (ie: expiry is below
base->clk), it gets added to the wheel as expiring now (base->clk).
Yet the value that gets stored in base->next_expiry, while calling
trigger_dyntick_cpu(), is the initial timer->expires value. The
resulting state becomes:
base->next_expiry < base->clk
On the next timer enqueue, forward_timer_base() may accidentally
rewind base->clk. As a possible outcome, timers may expire way too
early, the worst case being that the highest wheel levels get spuriously
processed again.
To prevent from that, make sure that base->next_expiry doesn't get below
base->clk.
Fixes: a683f390b93f ("timers: Forward the wheel clock whenever possible")
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Anna-Maria Behnsen <anna-maria@linutronix.de>
Tested-by: Juri Lelli <juri.lelli@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20200703010657.2302-1-frederic@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/timer.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -585,7 +585,15 @@ trigger_dyntick_cpu(struct timer_base *b
* Set the next expiry time and kick the CPU so it can reevaluate the
* wheel:
*/
- base->next_expiry = timer->expires;
+ if (time_before(timer->expires, base->clk)) {
+ /*
+ * Prevent from forward_timer_base() moving the base->clk
+ * backward
+ */
+ base->next_expiry = base->clk;
+ } else {
+ base->next_expiry = timer->expires;
+ }
wake_up_nohz_cpu(base->cpu);
}
@@ -897,10 +905,13 @@ static inline void forward_timer_base(st
* If the next expiry value is > jiffies, then we fast forward to
* jiffies otherwise we forward to the next expiry value.
*/
- if (time_after(base->next_expiry, jnow))
+ if (time_after(base->next_expiry, jnow)) {
base->clk = jnow;
- else
+ } else {
+ if (WARN_ON_ONCE(time_before(base->next_expiry, base->clk)))
+ return;
base->clk = base->next_expiry;
+ }
#endif
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 195/244] timer: Fix wheel index calculation on last level
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 194/244] timer: Prevent base->clk from moving backward Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 196/244] riscv: use 16KB kernel stack on 64-bit Greg Kroah-Hartman
` (49 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Frederic Weisbecker, Thomas Gleixner
From: Frederic Weisbecker <frederic@kernel.org>
commit e2a71bdea81690b6ef11f4368261ec6f5b6891aa upstream.
When an expiration delta falls into the last level of the wheel, that delta
has be compared against the maximum possible delay and reduced to fit in if
necessary.
However instead of comparing the delta against the maximum, the code
compares the actual expiry against the maximum. Then instead of fixing the
delta to fit in, it sets the maximum delta as the expiry value.
This can result in various undesired outcomes, the worst possible one
being a timer expiring 15 days ahead to fire immediately.
Fixes: 500462a9de65 ("timers: Switch to a non-cascading wheel")
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20200717140551.29076-2-frederic@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/timer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -522,8 +522,8 @@ static int calc_wheel_index(unsigned lon
* Force expire obscene large timeouts to expire at the
* capacity limit of the wheel.
*/
- if (expires >= WHEEL_TIMEOUT_CUTOFF)
- expires = WHEEL_TIMEOUT_MAX;
+ if (delta >= WHEEL_TIMEOUT_CUTOFF)
+ expires = clk + WHEEL_TIMEOUT_MAX;
idx = calc_index(expires, LVL_DEPTH - 1);
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 196/244] riscv: use 16KB kernel stack on 64-bit
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 195/244] timer: Fix wheel index calculation on last level Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 197/244] hwmon: (emc2103) fix unable to change fan pwm1_enable attribute Greg Kroah-Hartman
` (48 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Schwab, Anup Patel, Palmer Dabbelt
From: Andreas Schwab <schwab@suse.de>
commit 0cac21b02ba5f3095fd2dcc77c26a25a0b2432ed upstream.
With the current 8KB stack size there are frequent overflows in a 64-bit
configuration. We may split IRQ stacks off in the future, but this fixes a
number of issues right now.
Signed-off-by: Andreas Schwab <schwab@suse.de>
Reviewed-by: Anup Patel <anup@brainfault.org>
[Palmer: mention irqstack in the commit text]
Fixes: 7db91e57a0ac ("RISC-V: Task implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/include/asm/thread_info.h | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/riscv/include/asm/thread_info.h
+++ b/arch/riscv/include/asm/thread_info.h
@@ -12,7 +12,11 @@
#include <linux/const.h>
/* thread information allocation */
+#ifdef CONFIG_64BIT
+#define THREAD_SIZE_ORDER (2)
+#else
#define THREAD_SIZE_ORDER (1)
+#endif
#define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER)
#ifndef __ASSEMBLY__
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 197/244] hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 196/244] riscv: use 16KB kernel stack on 64-bit Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 198/244] hwmon: (drivetemp) Avoid SCT usage on Toshiba DT01ACA family drives Greg Kroah-Hartman
` (47 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vishwas M, Guenter Roeck
From: Vishwas M <vishwas.reddy.vr@gmail.com>
commit 14b0e83dc4f1e52b94acaeb85a18fd7fdd46d2dc upstream.
This patch fixes a bug which does not let FAN mode to be changed from
sysfs(pwm1_enable). i.e pwm1_enable can not be set to 3, it will always
remain at 0.
This is caused because the device driver handles the result of
"read_u8_from_i2c(client, REG_FAN_CONF1, &conf_reg)" incorrectly. The
driver thinks an error has occurred if the (result != 0). This has been
fixed by changing the condition to (result < 0).
Signed-off-by: Vishwas M <vishwas.reddy.vr@gmail.com>
Link: https://lore.kernel.org/r/20200707142747.118414-1-vishwas.reddy.vr@gmail.com
Fixes: 9df7305b5a86 ("hwmon: Add driver for SMSC EMC2103 temperature monitor and fan controller")
Cc: stable@vger.kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/emc2103.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hwmon/emc2103.c
+++ b/drivers/hwmon/emc2103.c
@@ -443,7 +443,7 @@ static ssize_t pwm1_enable_store(struct
}
result = read_u8_from_i2c(client, REG_FAN_CONF1, &conf_reg);
- if (result) {
+ if (result < 0) {
count = result;
goto err;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 198/244] hwmon: (drivetemp) Avoid SCT usage on Toshiba DT01ACA family drives
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 197/244] hwmon: (emc2103) fix unable to change fan pwm1_enable attribute Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 199/244] powerpc/book3s64/pkeys: Fix pkey_access_permitted() for execute disable pkey Greg Kroah-Hartman
` (46 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maciej S. Szmigiero, Guenter Roeck
From: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
commit c66ef39eb27fe123ee05082b90eb2985c33c7715 upstream.
It has been observed that Toshiba DT01ACA family drives have
WRITE FPDMA QUEUED command timeouts and sometimes just freeze until
power-cycled under heavy write loads when their temperature is getting
polled in SCT mode. The SMART mode seems to be fine, though.
Let's make sure we don't use SCT mode for these drives then.
While only the 3 TB model was actually caught exhibiting the problem let's
play safe here to avoid data corruption and extend the ban to the whole
family.
Fixes: 5b46903d8bf3 ("hwmon: Driver for disk and solid state drives with temperature sensors")
Cc: stable@vger.kernel.org
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Link: https://lore.kernel.org/r/0cb2e7022b66c6d21d3f189a12a97878d0e7511b.1595075458.git.mail@maciej.szmigiero.name
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/drivetemp.c | 43 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 43 insertions(+)
--- a/drivers/hwmon/drivetemp.c
+++ b/drivers/hwmon/drivetemp.c
@@ -285,6 +285,42 @@ static int drivetemp_get_scttemp(struct
return err;
}
+static const char * const sct_avoid_models[] = {
+/*
+ * These drives will have WRITE FPDMA QUEUED command timeouts and sometimes just
+ * freeze until power-cycled under heavy write loads when their temperature is
+ * getting polled in SCT mode. The SMART mode seems to be fine, though.
+ *
+ * While only the 3 TB model (DT01ACA3) was actually caught exhibiting the
+ * problem let's play safe here to avoid data corruption and ban the whole
+ * DT01ACAx family.
+
+ * The models from this array are prefix-matched.
+ */
+ "TOSHIBA DT01ACA",
+};
+
+static bool drivetemp_sct_avoid(struct drivetemp_data *st)
+{
+ struct scsi_device *sdev = st->sdev;
+ unsigned int ctr;
+
+ if (!sdev->model)
+ return false;
+
+ /*
+ * The "model" field contains just the raw SCSI INQUIRY response
+ * "product identification" field, which has a width of 16 bytes.
+ * This field is space-filled, but is NOT NULL-terminated.
+ */
+ for (ctr = 0; ctr < ARRAY_SIZE(sct_avoid_models); ctr++)
+ if (!strncmp(sdev->model, sct_avoid_models[ctr],
+ strlen(sct_avoid_models[ctr])))
+ return true;
+
+ return false;
+}
+
static int drivetemp_identify_sata(struct drivetemp_data *st)
{
struct scsi_device *sdev = st->sdev;
@@ -326,6 +362,13 @@ static int drivetemp_identify_sata(struc
/* bail out if this is not a SATA device */
if (!is_ata || !is_sata)
return -ENODEV;
+
+ if (have_sct && drivetemp_sct_avoid(st)) {
+ dev_notice(&sdev->sdev_gendev,
+ "will avoid using SCT for temperature monitoring\n");
+ have_sct = false;
+ }
+
if (!have_sct)
goto skip_sct;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 199/244] powerpc/book3s64/pkeys: Fix pkey_access_permitted() for execute disable pkey
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 198/244] hwmon: (drivetemp) Avoid SCT usage on Toshiba DT01ACA family drives Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 200/244] powerpc/pseries/svm: Fix incorrect check for shared_lppaca_size Greg Kroah-Hartman
` (45 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sandipan Das, Aneesh Kumar K.V,
Michael Ellerman
From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
commit 192b6a780598976feb7321ff007754f8511a4129 upstream.
Even if the IAMR value denies execute access, the current code returns
true from pkey_access_permitted() for an execute permission check, if
the AMR read pkey bit is cleared.
This results in repeated page fault loop with a test like below:
#define _GNU_SOURCE
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <inttypes.h>
#include <assert.h>
#include <malloc.h>
#include <unistd.h>
#include <pthread.h>
#include <sys/mman.h>
#ifdef SYS_pkey_mprotect
#undef SYS_pkey_mprotect
#endif
#ifdef SYS_pkey_alloc
#undef SYS_pkey_alloc
#endif
#ifdef SYS_pkey_free
#undef SYS_pkey_free
#endif
#undef PKEY_DISABLE_EXECUTE
#define PKEY_DISABLE_EXECUTE 0x4
#define SYS_pkey_mprotect 386
#define SYS_pkey_alloc 384
#define SYS_pkey_free 385
#define PPC_INST_NOP 0x60000000
#define PPC_INST_BLR 0x4e800020
#define PROT_RWX (PROT_READ | PROT_WRITE | PROT_EXEC)
static int sys_pkey_mprotect(void *addr, size_t len, int prot, int pkey)
{
return syscall(SYS_pkey_mprotect, addr, len, prot, pkey);
}
static int sys_pkey_alloc(unsigned long flags, unsigned long access_rights)
{
return syscall(SYS_pkey_alloc, flags, access_rights);
}
static int sys_pkey_free(int pkey)
{
return syscall(SYS_pkey_free, pkey);
}
static void do_execute(void *region)
{
/* jump to region */
asm volatile(
"mtctr %0;"
"bctrl"
: : "r"(region) : "ctr", "lr");
}
static void do_protect(void *region)
{
size_t pgsize;
int i, pkey;
pgsize = getpagesize();
pkey = sys_pkey_alloc(0, PKEY_DISABLE_EXECUTE);
assert (pkey > 0);
/* perform mprotect */
assert(!sys_pkey_mprotect(region, pgsize, PROT_RWX, pkey));
do_execute(region);
/* free pkey */
assert(!sys_pkey_free(pkey));
}
int main(int argc, char **argv)
{
size_t pgsize, numinsns;
unsigned int *region;
int i;
/* allocate memory region to protect */
pgsize = getpagesize();
region = memalign(pgsize, pgsize);
assert(region != NULL);
assert(!mprotect(region, pgsize, PROT_RWX));
/* fill page with NOPs with a BLR at the end */
numinsns = pgsize / sizeof(region[0]);
for (i = 0; i < numinsns - 1; i++)
region[i] = PPC_INST_NOP;
region[i] = PPC_INST_BLR;
do_protect(region);
return EXIT_SUCCESS;
}
The fix is to only check the IAMR for an execute check, the AMR value
is not relevant.
Fixes: f2407ef3ba22 ("powerpc: helper to validate key-access permissions of a pte")
Cc: stable@vger.kernel.org # v4.16+
Reported-by: Sandipan Das <sandipan@linux.ibm.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
[mpe: Add detail to change log, tweak wording & formatting]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200712132047.1038594-1-aneesh.kumar@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/mm/book3s64/pkeys.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/arch/powerpc/mm/book3s64/pkeys.c
+++ b/arch/powerpc/mm/book3s64/pkeys.c
@@ -357,12 +357,14 @@ static bool pkey_access_permitted(int pk
return true;
pkey_shift = pkeyshift(pkey);
- if (execute && !(read_iamr() & (IAMR_EX_BIT << pkey_shift)))
- return true;
+ if (execute)
+ return !(read_iamr() & (IAMR_EX_BIT << pkey_shift));
+
+ amr = read_amr();
+ if (write)
+ return !(amr & (AMR_WR_BIT << pkey_shift));
- amr = read_amr(); /* Delay reading amr until absolutely needed */
- return ((!write && !(amr & (AMR_RD_BIT << pkey_shift))) ||
- (write && !(amr & (AMR_WR_BIT << pkey_shift))));
+ return !(amr & (AMR_RD_BIT << pkey_shift));
}
bool arch_pte_access_permitted(u64 pte, bool write, bool execute)
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 200/244] powerpc/pseries/svm: Fix incorrect check for shared_lppaca_size
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 199/244] powerpc/book3s64/pkeys: Fix pkey_access_permitted() for execute disable pkey Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 201/244] intel_th: pci: Add Jasper Lake CPU support Greg Kroah-Hartman
` (44 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Satheesh Rajendran, Laurent Dufour,
Thiago Jung Bauermann, Michael Ellerman
From: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
commit b710d27bf72068b15b2f0305d825988183e2ff28 upstream.
Early secure guest boot hits the below crash while booting with
vcpus numbers aligned with page boundary for PAGE size of 64k
and LPPACA size of 1k i.e 64, 128 etc.
Partition configured for 64 cpus.
CPU maps initialized for 1 thread per core
------------[ cut here ]------------
kernel BUG at arch/powerpc/kernel/paca.c:89!
Oops: Exception in kernel mode, sig: 5 [#1]
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
This is due to the BUG_ON() for shared_lppaca_total_size equal to
shared_lppaca_size. Instead the code should only BUG_ON() if we have
exceeded the total_size, which indicates we've overflowed the array.
Fixes: bd104e6db6f0 ("powerpc/pseries/svm: Use shared memory for LPPACA structures")
Cc: stable@vger.kernel.org # v5.4+
Signed-off-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
Reviewed-by: Laurent Dufour <ldufour@linux.ibm.com>
Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
[mpe: Reword change log to clarify we're fixing not removing the check]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200619070113.16696-1-sathnaga@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/paca.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/paca.c
+++ b/arch/powerpc/kernel/paca.c
@@ -86,7 +86,7 @@ static void *__init alloc_shared_lppaca(
* This is very early in boot, so no harm done if the kernel crashes at
* this point.
*/
- BUG_ON(shared_lppaca_size >= shared_lppaca_total_size);
+ BUG_ON(shared_lppaca_size > shared_lppaca_total_size);
return ptr;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 201/244] intel_th: pci: Add Jasper Lake CPU support
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 200/244] powerpc/pseries/svm: Fix incorrect check for shared_lppaca_size Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 202/244] intel_th: pci: Add Tiger Lake PCH-H support Greg Kroah-Hartman
` (43 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Shishkin, Andy Shevchenko
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
commit 203c1f615052921901b7a8fbe2005d8ea6add076 upstream.
This adds support for the Trace Hub in Jasper Lake CPU.
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: stable@vger.kernel.org # v4.14+
Link: https://lore.kernel.org/r/20200706161339.55468-2-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/intel_th/pci.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -239,6 +239,11 @@ static const struct pci_device_id intel_
.driver_data = (kernel_ulong_t)&intel_th_2x,
},
{
+ /* Jasper Lake CPU */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4e29),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
+ {
/* Elkhart Lake CPU */
PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4529),
.driver_data = (kernel_ulong_t)&intel_th_2x,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 202/244] intel_th: pci: Add Tiger Lake PCH-H support
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 201/244] intel_th: pci: Add Jasper Lake CPU support Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 203/244] intel_th: pci: Add Emmitsburg PCH support Greg Kroah-Hartman
` (42 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Shishkin, Andy Shevchenko
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
commit 6227585dc7b6a5405fc08dc322f98cb95e2f0eb4 upstream.
This adds support for the Trace Hub in Tiger Lake PCH-H.
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: stable@vger.kernel.org # v4.14+
Link: https://lore.kernel.org/r/20200706161339.55468-3-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/intel_th/pci.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -234,6 +234,11 @@ static const struct pci_device_id intel_
.driver_data = (kernel_ulong_t)&intel_th_2x,
},
{
+ /* Tiger Lake PCH-H */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x43a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
+ {
/* Jasper Lake PCH */
PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6),
.driver_data = (kernel_ulong_t)&intel_th_2x,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 203/244] intel_th: pci: Add Emmitsburg PCH support
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 202/244] intel_th: pci: Add Tiger Lake PCH-H support Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 204/244] intel_th: Fix a NULL dereference when hub driver is not loaded Greg Kroah-Hartman
` (41 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Shishkin, Andy Shevchenko
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
commit fd73d74a32bfaaf259441322cc5a1c83caaa94f2 upstream.
This adds support for the Trace Hub in Emmitsburg PCH.
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: stable@vger.kernel.org # v4.14+
Link: https://lore.kernel.org/r/20200706161339.55468-4-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/intel_th/pci.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -258,6 +258,11 @@ static const struct pci_device_id intel_
PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26),
.driver_data = (kernel_ulong_t)&intel_th_2x,
},
+ {
+ /* Emmitsburg PCH */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x1bcc),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
{ 0 },
};
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 204/244] intel_th: Fix a NULL dereference when hub driver is not loaded
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 203/244] intel_th: pci: Add Emmitsburg PCH support Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 205/244] opp: Increase parsed_static_opps in _of_add_opp_table_v1() Greg Kroah-Hartman
` (40 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Shishkin, Andy Shevchenko, Ammy Yi
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
commit e78e1fdb282726beaf88aa75943682217e6ded0e upstream.
Connecting master to an output port when GTH driver module is not loaded
triggers a NULL dereference:
> RIP: 0010:intel_th_set_output+0x35/0x70 [intel_th]
> Call Trace:
> ? sth_stm_link+0x12/0x20 [intel_th_sth]
> stm_source_link_store+0x164/0x270 [stm_core]
> dev_attr_store+0x17/0x30
> sysfs_kf_write+0x3e/0x50
> kernfs_fop_write+0xda/0x1b0
> __vfs_write+0x1b/0x40
> vfs_write+0xb9/0x1a0
> ksys_write+0x67/0xe0
> __x64_sys_write+0x1a/0x20
> do_syscall_64+0x57/0x1d0
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
Make sure the module in question is loaded and return an error if not.
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Fixes: 39f4034693b7c ("intel_th: Add driver infrastructure for Intel(R) Trace Hub devices")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reported-by: Ammy Yi <ammy.yi@intel.com>
Tested-by: Ammy Yi <ammy.yi@intel.com>
Cc: stable@vger.kernel.org # v4.4
Link: https://lore.kernel.org/r/20200706161339.55468-5-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/intel_th/core.c | 21 ++++++++++++++++++---
drivers/hwtracing/intel_th/sth.c | 4 +---
2 files changed, 19 insertions(+), 6 deletions(-)
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -1021,15 +1021,30 @@ int intel_th_set_output(struct intel_th_
{
struct intel_th_device *hub = to_intel_th_hub(thdev);
struct intel_th_driver *hubdrv = to_intel_th_driver(hub->dev.driver);
+ int ret;
/* In host mode, this is up to the external debugger, do nothing. */
if (hub->host_mode)
return 0;
- if (!hubdrv->set_output)
- return -ENOTSUPP;
+ /*
+ * hub is instantiated together with the source device that
+ * calls here, so guaranteed to be present.
+ */
+ hubdrv = to_intel_th_driver(hub->dev.driver);
+ if (!hubdrv || !try_module_get(hubdrv->driver.owner))
+ return -EINVAL;
- return hubdrv->set_output(hub, master);
+ if (!hubdrv->set_output) {
+ ret = -ENOTSUPP;
+ goto out;
+ }
+
+ ret = hubdrv->set_output(hub, master);
+
+out:
+ module_put(hubdrv->driver.owner);
+ return ret;
}
EXPORT_SYMBOL_GPL(intel_th_set_output);
--- a/drivers/hwtracing/intel_th/sth.c
+++ b/drivers/hwtracing/intel_th/sth.c
@@ -161,9 +161,7 @@ static int sth_stm_link(struct stm_data
{
struct sth_device *sth = container_of(stm_data, struct sth_device, stm);
- intel_th_set_output(to_intel_th_device(sth->dev), master);
-
- return 0;
+ return intel_th_set_output(to_intel_th_device(sth->dev), master);
}
static int intel_th_sw_init(struct sth_device *sth)
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 205/244] opp: Increase parsed_static_opps in _of_add_opp_table_v1()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 204/244] intel_th: Fix a NULL dereference when hub driver is not loaded Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 206/244] dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler Greg Kroah-Hartman
` (39 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Walter Lozano, Viresh Kumar
From: Walter Lozano <walter.lozano@collabora.com>
commit 6544abc520f0fff701e9da382110dc29676c683a upstream.
Currently, when using _of_add_opp_table_v2 parsed_static_opps is
increased and this value is used in _opp_remove_all_static() to
check if there are static opp entries that need to be freed.
Unfortunately this does not happen when using _of_add_opp_table_v1(),
which leads to warnings.
This patch increases parsed_static_opps in _of_add_opp_table_v1() in a
similar way as in _of_add_opp_table_v2().
Fixes: 03758d60265c ("opp: Replace list_kref with a local counter")
Cc: v5.6+ <stable@vger.kernel.org> # v5.6+
Signed-off-by: Walter Lozano <walter.lozano@collabora.com>
[ Viresh: Do the operation with lock held and set the value to 1 instead
of incrementing it ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/opp/of.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/opp/of.c
+++ b/drivers/opp/of.c
@@ -733,6 +733,10 @@ static int _of_add_opp_table_v1(struct d
return -EINVAL;
}
+ mutex_lock(&opp_table->lock);
+ opp_table->parsed_static_opps = 1;
+ mutex_unlock(&opp_table->lock);
+
val = prop->value;
while (nr) {
unsigned long freq = be32_to_cpup(val++) * 1000;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 206/244] dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 205/244] opp: Increase parsed_static_opps in _of_add_opp_table_v1() Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 207/244] dmaengine: mcf-edma: Fix NULL pointer exception in mcf_edma_tx_handler Greg Kroah-Hartman
` (38 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Robin Gong, Vinod Koul
From: Krzysztof Kozlowski <krzk@kernel.org>
commit f5e5677c420346b4e9788051c2e4d750996c428c upstream.
NULL pointer exception happens occasionally on serial output initiated
by login timeout. This was reproduced only if kernel was built with
significant debugging options and EDMA driver is used with serial
console.
col-vf50 login: root
Password:
Login timed out after 60 seconds.
Unable to handle kernel NULL pointer dereference at virtual address 00000044
Internal error: Oops: 5 [#1] ARM
CPU: 0 PID: 157 Comm: login Not tainted 5.7.0-next-20200610-dirty #4
Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree)
(fsl_edma_tx_handler) from [<8016eb10>] (__handle_irq_event_percpu+0x64/0x304)
(__handle_irq_event_percpu) from [<8016eddc>] (handle_irq_event_percpu+0x2c/0x7c)
(handle_irq_event_percpu) from [<8016ee64>] (handle_irq_event+0x38/0x5c)
(handle_irq_event) from [<801729e4>] (handle_fasteoi_irq+0xa4/0x160)
(handle_fasteoi_irq) from [<8016ddcc>] (generic_handle_irq+0x34/0x44)
(generic_handle_irq) from [<8016e40c>] (__handle_domain_irq+0x54/0xa8)
(__handle_domain_irq) from [<80508bc8>] (gic_handle_irq+0x4c/0x80)
(gic_handle_irq) from [<80100af0>] (__irq_svc+0x70/0x98)
Exception stack(0x8459fe80 to 0x8459fec8)
fe80: 72286b00 e3359f64 00000001 0000412d a0070013 85c98840 85c98840 a0070013
fea0: 8054e0d4 00000000 00000002 00000000 00000002 8459fed0 8081fbe8 8081fbec
fec0: 60070013 ffffffff
(__irq_svc) from [<8081fbec>] (_raw_spin_unlock_irqrestore+0x30/0x58)
(_raw_spin_unlock_irqrestore) from [<8056cb48>] (uart_flush_buffer+0x88/0xf8)
(uart_flush_buffer) from [<80554e60>] (tty_ldisc_hangup+0x38/0x1ac)
(tty_ldisc_hangup) from [<8054c7f4>] (__tty_hangup+0x158/0x2bc)
(__tty_hangup) from [<80557b90>] (disassociate_ctty.part.1+0x30/0x23c)
(disassociate_ctty.part.1) from [<8011fc18>] (do_exit+0x580/0xba0)
(do_exit) from [<801214f8>] (do_group_exit+0x3c/0xb4)
(do_group_exit) from [<80121580>] (__wake_up_parent+0x0/0x14)
Issue looks like race condition between interrupt handler fsl_edma_tx_handler()
(called as result of fsl_edma_xfer_desc()) and terminating the transfer with
fsl_edma_terminate_all().
The fsl_edma_tx_handler() handles interrupt for a transfer with already freed
edesc and idle==true.
Fixes: d6be34fbd39b ("dma: Add Freescale eDMA engine driver support")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1591877861-28156-2-git-send-email-krzk@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/fsl-edma.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/dma/fsl-edma.c
+++ b/drivers/dma/fsl-edma.c
@@ -45,6 +45,13 @@ static irqreturn_t fsl_edma_tx_handler(i
fsl_chan = &fsl_edma->chans[ch];
spin_lock(&fsl_chan->vchan.lock);
+
+ if (!fsl_chan->edesc) {
+ /* terminate_all called before */
+ spin_unlock(&fsl_chan->vchan.lock);
+ continue;
+ }
+
if (!fsl_chan->edesc->iscyclic) {
list_del(&fsl_chan->edesc->vdesc.node);
vchan_cookie_complete(&fsl_chan->edesc->vdesc);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 207/244] dmaengine: mcf-edma: Fix NULL pointer exception in mcf_edma_tx_handler
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 206/244] dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:37 ` [PATCH 5.7 208/244] dmaengine: fsl-edma-common: correct DSIZE_32BYTE Greg Kroah-Hartman
` (37 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Robin Gong, Vinod Koul
From: Krzysztof Kozlowski <krzk@kernel.org>
commit 8995aa3d164ddd9200e6abcf25c449cf5298c858 upstream.
On Toradex Colibri VF50 (Vybrid VF5xx) with fsl-edma driver NULL pointer
exception happens occasionally on serial output initiated by login
timeout.
This was reproduced only if kernel was built with significant debugging
options and EDMA driver is used with serial console.
Issue looks like a race condition between interrupt handler
fsl_edma_tx_handler() (called as a result of fsl_edma_xfer_desc()) and
terminating the transfer with fsl_edma_terminate_all().
The fsl_edma_tx_handler() handles interrupt for a transfer with already
freed edesc and idle==true.
The mcf-edma driver shares design and lot of code with fsl-edma. It
looks like being affected by same problem. Fix this pattern the same
way as fix for fsl-edma driver.
Fixes: e7a3ff92eaf1 ("dmaengine: fsl-edma: add ColdFire mcf5441x edma support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>
Link: https://lore.kernel.org/r/1591881665-25592-1-git-send-email-krzk@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/mcf-edma.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/dma/mcf-edma.c
+++ b/drivers/dma/mcf-edma.c
@@ -35,6 +35,13 @@ static irqreturn_t mcf_edma_tx_handler(i
mcf_chan = &mcf_edma->chans[ch];
spin_lock(&mcf_chan->vchan.lock);
+
+ if (!mcf_chan->edesc) {
+ /* terminate_all called before */
+ spin_unlock(&mcf_chan->vchan.lock);
+ continue;
+ }
+
if (!mcf_chan->edesc->iscyclic) {
list_del(&mcf_chan->edesc->vdesc.node);
vchan_cookie_complete(&mcf_chan->edesc->vdesc);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 208/244] dmaengine: fsl-edma-common: correct DSIZE_32BYTE
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 207/244] dmaengine: mcf-edma: Fix NULL pointer exception in mcf_edma_tx_handler Greg Kroah-Hartman
@ 2020-07-20 15:37 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 209/244] misc: atmel-ssc: lock with mutex instead of spinlock Greg Kroah-Hartman
` (36 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Robin Gong, Angelo Dureghello, Vinod Koul
From: Robin Gong <yibin.gong@nxp.com>
commit e142087b15960a4e1e5932942e5abae1f49d2318 upstream.
Correct EDMA_TCD_ATTR_DSIZE_32BYTE define since it's broken by the below:
'0x0005 --> BIT(3) | BIT(0))'
Fixes: 4d6d3a90e4ac ("dmaengine: fsl-edma: fix macros")
Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Tested-by: Angelo Dureghello <angelo@sysam.it>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1593449998-32091-1-git-send-email-yibin.gong@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/fsl-edma-common.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/fsl-edma-common.h
+++ b/drivers/dma/fsl-edma-common.h
@@ -33,7 +33,7 @@
#define EDMA_TCD_ATTR_DSIZE_16BIT BIT(0)
#define EDMA_TCD_ATTR_DSIZE_32BIT BIT(1)
#define EDMA_TCD_ATTR_DSIZE_64BIT (BIT(0) | BIT(1))
-#define EDMA_TCD_ATTR_DSIZE_32BYTE (BIT(3) | BIT(0))
+#define EDMA_TCD_ATTR_DSIZE_32BYTE (BIT(2) | BIT(0))
#define EDMA_TCD_ATTR_SSIZE_8BIT 0
#define EDMA_TCD_ATTR_SSIZE_16BIT (EDMA_TCD_ATTR_DSIZE_16BIT << 8)
#define EDMA_TCD_ATTR_SSIZE_32BIT (EDMA_TCD_ATTR_DSIZE_32BIT << 8)
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 209/244] misc: atmel-ssc: lock with mutex instead of spinlock
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2020-07-20 15:37 ` [PATCH 5.7 208/244] dmaengine: fsl-edma-common: correct DSIZE_32BYTE Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 210/244] dmabuf: use spinlock to access dmabuf->name Greg Kroah-Hartman
` (35 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michał Mirosław
From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
commit b037d60a3b1d1227609fd858fa34321f41829911 upstream.
Uninterruptible context is not needed in the driver and causes lockdep
warning because of mutex taken in of_alias_get_id(). Convert the lock to
mutex to avoid the issue.
Cc: stable@vger.kernel.org
Fixes: 099343c64e16 ("ARM: at91: atmel-ssc: add device tree support")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://lore.kernel.org/r/50f0d7fa107f318296afb49477c3571e4d6978c5.1592998403.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/atmel-ssc.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -10,7 +10,7 @@
#include <linux/clk.h>
#include <linux/err.h>
#include <linux/io.h>
-#include <linux/spinlock.h>
+#include <linux/mutex.h>
#include <linux/atmel-ssc.h>
#include <linux/slab.h>
#include <linux/module.h>
@@ -20,7 +20,7 @@
#include "../../sound/soc/atmel/atmel_ssc_dai.h"
/* Serialize access to ssc_list and user count */
-static DEFINE_SPINLOCK(user_lock);
+static DEFINE_MUTEX(user_lock);
static LIST_HEAD(ssc_list);
struct ssc_device *ssc_request(unsigned int ssc_num)
@@ -28,7 +28,7 @@ struct ssc_device *ssc_request(unsigned
int ssc_valid = 0;
struct ssc_device *ssc;
- spin_lock(&user_lock);
+ mutex_lock(&user_lock);
list_for_each_entry(ssc, &ssc_list, list) {
if (ssc->pdev->dev.of_node) {
if (of_alias_get_id(ssc->pdev->dev.of_node, "ssc")
@@ -44,18 +44,18 @@ struct ssc_device *ssc_request(unsigned
}
if (!ssc_valid) {
- spin_unlock(&user_lock);
+ mutex_unlock(&user_lock);
pr_err("ssc: ssc%d platform device is missing\n", ssc_num);
return ERR_PTR(-ENODEV);
}
if (ssc->user) {
- spin_unlock(&user_lock);
+ mutex_unlock(&user_lock);
dev_dbg(&ssc->pdev->dev, "module busy\n");
return ERR_PTR(-EBUSY);
}
ssc->user++;
- spin_unlock(&user_lock);
+ mutex_unlock(&user_lock);
clk_prepare(ssc->clk);
@@ -67,14 +67,14 @@ void ssc_free(struct ssc_device *ssc)
{
bool disable_clk = true;
- spin_lock(&user_lock);
+ mutex_lock(&user_lock);
if (ssc->user)
ssc->user--;
else {
disable_clk = false;
dev_dbg(&ssc->pdev->dev, "device already free\n");
}
- spin_unlock(&user_lock);
+ mutex_unlock(&user_lock);
if (disable_clk)
clk_unprepare(ssc->clk);
@@ -237,9 +237,9 @@ static int ssc_probe(struct platform_dev
return -ENXIO;
}
- spin_lock(&user_lock);
+ mutex_lock(&user_lock);
list_add_tail(&ssc->list, &ssc_list);
- spin_unlock(&user_lock);
+ mutex_unlock(&user_lock);
platform_set_drvdata(pdev, ssc);
@@ -258,9 +258,9 @@ static int ssc_remove(struct platform_de
ssc_sound_dai_remove(ssc);
- spin_lock(&user_lock);
+ mutex_lock(&user_lock);
list_del(&ssc->list);
- spin_unlock(&user_lock);
+ mutex_unlock(&user_lock);
return 0;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 210/244] dmabuf: use spinlock to access dmabuf->name
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 209/244] misc: atmel-ssc: lock with mutex instead of spinlock Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 211/244] thermal: int3403_thermal: Downgrade error message Greg Kroah-Hartman
` (34 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Charan Teja Kalla, Michael J. Ruhl,
Christian König, Sumit Semwal
From: Charan Teja Kalla <charante@codeaurora.org>
commit 6348dd291e3653534a9e28e6917569bc9967b35b upstream.
There exists a sleep-while-atomic bug while accessing the dmabuf->name
under mutex in the dmabuffs_dname(). This is caused from the SELinux
permissions checks on a process where it tries to validate the inherited
files from fork() by traversing them through iterate_fd() (which
traverse files under spin_lock) and call
match_file(security/selinux/hooks.c) where the permission checks happen.
This audit information is logged using dump_common_audit_data() where it
calls d_path() to get the file path name. If the file check happen on
the dmabuf's fd, then it ends up in ->dmabuffs_dname() and use mutex to
access dmabuf->name. The flow will be like below:
flush_unauthorized_files()
iterate_fd()
spin_lock() --> Start of the atomic section.
match_file()
file_has_perm()
avc_has_perm()
avc_audit()
slow_avc_audit()
common_lsm_audit()
dump_common_audit_data()
audit_log_d_path()
d_path()
dmabuffs_dname()
mutex_lock()--> Sleep while atomic.
Call trace captured (on 4.19 kernels) is below:
___might_sleep+0x204/0x208
__might_sleep+0x50/0x88
__mutex_lock_common+0x5c/0x1068
__mutex_lock_common+0x5c/0x1068
mutex_lock_nested+0x40/0x50
dmabuffs_dname+0xa0/0x170
d_path+0x84/0x290
audit_log_d_path+0x74/0x130
common_lsm_audit+0x334/0x6e8
slow_avc_audit+0xb8/0xf8
avc_has_perm+0x154/0x218
file_has_perm+0x70/0x180
match_file+0x60/0x78
iterate_fd+0x128/0x168
selinux_bprm_committing_creds+0x178/0x248
security_bprm_committing_creds+0x30/0x48
install_exec_creds+0x1c/0x68
load_elf_binary+0x3a4/0x14e0
search_binary_handler+0xb0/0x1e0
So, use spinlock to access dmabuf->name to avoid sleep-while-atomic.
Cc: <stable@vger.kernel.org> [5.3+]
Signed-off-by: Charan Teja Kalla <charante@codeaurora.org>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Acked-by: Christian König <christian.koenig@amd.com>
[sumits: added comment to spinlock_t definition to avoid warning]
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/a83e7f0d-4e54-9848-4b58-e1acdbe06735@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma-buf/dma-buf.c | 11 +++++++----
include/linux/dma-buf.h | 1 +
2 files changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -45,10 +45,10 @@ static char *dmabuffs_dname(struct dentr
size_t ret = 0;
dmabuf = dentry->d_fsdata;
- dma_resv_lock(dmabuf->resv, NULL);
+ spin_lock(&dmabuf->name_lock);
if (dmabuf->name)
ret = strlcpy(name, dmabuf->name, DMA_BUF_NAME_LEN);
- dma_resv_unlock(dmabuf->resv);
+ spin_unlock(&dmabuf->name_lock);
return dynamic_dname(dentry, buffer, buflen, "/%s:%s",
dentry->d_name.name, ret > 0 ? name : "");
@@ -338,8 +338,10 @@ static long dma_buf_set_name(struct dma_
kfree(name);
goto out_unlock;
}
+ spin_lock(&dmabuf->name_lock);
kfree(dmabuf->name);
dmabuf->name = name;
+ spin_unlock(&dmabuf->name_lock);
out_unlock:
dma_resv_unlock(dmabuf->resv);
@@ -402,10 +404,10 @@ static void dma_buf_show_fdinfo(struct s
/* Don't count the temporary reference taken inside procfs seq_show */
seq_printf(m, "count:\t%ld\n", file_count(dmabuf->file) - 1);
seq_printf(m, "exp_name:\t%s\n", dmabuf->exp_name);
- dma_resv_lock(dmabuf->resv, NULL);
+ spin_lock(&dmabuf->name_lock);
if (dmabuf->name)
seq_printf(m, "name:\t%s\n", dmabuf->name);
- dma_resv_unlock(dmabuf->resv);
+ spin_unlock(&dmabuf->name_lock);
}
static const struct file_operations dma_buf_fops = {
@@ -542,6 +544,7 @@ struct dma_buf *dma_buf_export(const str
dmabuf->size = exp_info->size;
dmabuf->exp_name = exp_info->exp_name;
dmabuf->owner = exp_info->owner;
+ spin_lock_init(&dmabuf->name_lock);
init_waitqueue_head(&dmabuf->poll);
dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll;
dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0;
--- a/include/linux/dma-buf.h
+++ b/include/linux/dma-buf.h
@@ -311,6 +311,7 @@ struct dma_buf {
void *vmap_ptr;
const char *exp_name;
const char *name;
+ spinlock_t name_lock; /* spinlock to protect name access */
struct module *owner;
struct list_head list_node;
void *priv;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 211/244] thermal: int3403_thermal: Downgrade error message
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 210/244] dmabuf: use spinlock to access dmabuf->name Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 212/244] ARM: dts: imx6qdl-gw551x: fix audio SSI Greg Kroah-Hartman
` (33 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhang Rui, Alex Hung
From: Alex Hung <alex.hung@canonical.com>
commit f3d7fb38976b1b0a8462ba1c7cbd404ddfaad086 upstream.
Downgrade "Unsupported event" message from dev_err to dev_dbg to avoid
flooding with this message on some platforms.
Cc: stable@vger.kernel.org # v5.4+
Suggested-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Alex Hung <alex.hung@canonical.com>
[ rzhang: fix typo in changelog ]
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Link: https://lore.kernel.org/r/20200615223957.183153-1-alex.hung@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/intel/int340x_thermal/int3403_thermal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/thermal/intel/int340x_thermal/int3403_thermal.c
+++ b/drivers/thermal/intel/int340x_thermal/int3403_thermal.c
@@ -74,7 +74,7 @@ static void int3403_notify(acpi_handle h
THERMAL_TRIP_CHANGED);
break;
default:
- dev_err(&priv->pdev->dev, "Unsupported event [0x%x]\n", event);
+ dev_dbg(&priv->pdev->dev, "Unsupported event [0x%x]\n", event);
break;
}
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 212/244] ARM: dts: imx6qdl-gw551x: fix audio SSI
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 211/244] thermal: int3403_thermal: Downgrade error message Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 213/244] arm64: dts: agilex: add status to qspi dts node Greg Kroah-Hartman
` (32 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tim Harvey, Shawn Guo
From: Tim Harvey <tharvey@gateworks.com>
commit 4237c625304b212a3f30adf787901082082511ec upstream.
The audio codec on the GW551x routes to ssi1. It fixes audio capture on
the device.
Cc: stable@vger.kernel.org
Fixes: 3117e851cef1 ("ARM: dts: imx: Add TDA19971 HDMI Receiver to GW551x")
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
@@ -110,7 +110,7 @@
simple-audio-card,frame-master = <&sound_codec>;
sound_cpu: simple-audio-card,cpu {
- sound-dai = <&ssi2>;
+ sound-dai = <&ssi1>;
};
sound_codec: simple-audio-card,codec {
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 213/244] arm64: dts: agilex: add status to qspi dts node
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 212/244] ARM: dts: imx6qdl-gw551x: fix audio SSI Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 214/244] arm64: dts: stratix10: " Greg Kroah-Hartman
` (31 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dinh Nguyen
From: Dinh Nguyen <dinguyen@kernel.org>
commit 60176e6be0bb6f629b15aea7dcab5a95ecb158e9 upstream.
Add status = "okay" to QSPI node.
Fixes: c4c8757b2d895 ("arm64: dts: agilex: add QSPI support for Intel Agilex")
Cc: linux-stable <stable@vger.kernel.org> # >= v5.5
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/intel/socfpga_agilex_socdk.dts | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm64/boot/dts/intel/socfpga_agilex_socdk.dts
+++ b/arch/arm64/boot/dts/intel/socfpga_agilex_socdk.dts
@@ -98,6 +98,7 @@
};
&qspi {
+ status = "okay";
flash@0 {
#address-cells = <1>;
#size-cells = <1>;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 214/244] arm64: dts: stratix10: add status to qspi dts node
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 213/244] arm64: dts: agilex: add status to qspi dts node Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 215/244] arm64: dts: stratix10: increase QSPI reg address in nand dts file Greg Kroah-Hartman
` (30 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dinh Nguyen
From: Dinh Nguyen <dinguyen@kernel.org>
commit 263a0269a59c0b4145829462a107fe7f7327105f upstream.
Add status = "okay" to QSPI node.
Fixes: 0cb140d07fc75 ("arm64: dts: stratix10: Add QSPI support for Stratix10")
Cc: linux-stable <stable@vger.kernel.org> # >= v5.6
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts | 1 +
arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts | 1 +
2 files changed, 2 insertions(+)
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
@@ -155,6 +155,7 @@
};
&qspi {
+ status = "okay";
flash@0 {
#address-cells = <1>;
#size-cells = <1>;
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts
@@ -188,6 +188,7 @@
};
&qspi {
+ status = "okay";
flash@0 {
#address-cells = <1>;
#size-cells = <1>;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 215/244] arm64: dts: stratix10: increase QSPI reg address in nand dts file
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 214/244] arm64: dts: stratix10: " Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 216/244] arm64: ptrace: Override SPSR.SS when single-stepping is enabled Greg Kroah-Hartman
` (29 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dinh Nguyen
From: Dinh Nguyen <dinh.nguyen@intel.com>
commit 3bf9b8ffc8980c1090bdd3a5570cf42420620838 upstream.
Match the QSPI reg address in the socfpga_stratix10_socdk.dts file.
Fixes: 80f132d73709 ("arm64: dts: increase the QSPI reg address for Stratix10 and Agilex")
Cc: linux-stable <stable@vger.kernel.org> # >= v5.6
Signed-off-by: Dinh Nguyen <dinh.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts
@@ -212,12 +212,12 @@
qspi_boot: partition@0 {
label = "Boot and fpga data";
- reg = <0x0 0x034B0000>;
+ reg = <0x0 0x03FE0000>;
};
- qspi_rootfs: partition@4000000 {
+ qspi_rootfs: partition@3FE0000 {
label = "Root Filesystem - JFFS2";
- reg = <0x034B0000 0x0EB50000>;
+ reg = <0x03FE0000 0x0C020000>;
};
};
};
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 216/244] arm64: ptrace: Override SPSR.SS when single-stepping is enabled
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 215/244] arm64: dts: stratix10: increase QSPI reg address in nand dts file Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 217/244] arm64: ptrace: Consistently use pseudo-singlestep exceptions Greg Kroah-Hartman
` (28 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Rutland, Keno Fischer,
Luis Machado, Will Deacon
From: Will Deacon <will@kernel.org>
commit 3a5a4366cecc25daa300b9a9174f7fdd352b9068 upstream.
Luis reports that, when reverse debugging with GDB, single-step does not
function as expected on arm64:
| I've noticed, under very specific conditions, that a PTRACE_SINGLESTEP
| request by GDB won't execute the underlying instruction. As a consequence,
| the PC doesn't move, but we return a SIGTRAP just like we would for a
| regular successful PTRACE_SINGLESTEP request.
The underlying problem is that when the CPU register state is restored
as part of a reverse step, the SPSR.SS bit is cleared and so the hardware
single-step state can transition to the "active-pending" state, causing
an unexpected step exception to be taken immediately if a step operation
is attempted.
In hindsight, we probably shouldn't have exposed SPSR.SS in the pstate
accessible by the GPR regset, but it's a bit late for that now. Instead,
simply prevent userspace from configuring the bit to a value which is
inconsistent with the TIF_SINGLESTEP state for the task being traced.
Cc: <stable@vger.kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Keno Fischer <keno@juliacomputing.com>
Link: https://lore.kernel.org/r/1eed6d69-d53d-9657-1fc9-c089be07f98c@linaro.org
Reported-by: Luis Machado <luis.machado@linaro.org>
Tested-by: Luis Machado <luis.machado@linaro.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/debug-monitors.h | 2 ++
arch/arm64/kernel/debug-monitors.c | 20 ++++++++++++++++----
arch/arm64/kernel/ptrace.c | 4 ++--
3 files changed, 20 insertions(+), 6 deletions(-)
--- a/arch/arm64/include/asm/debug-monitors.h
+++ b/arch/arm64/include/asm/debug-monitors.h
@@ -109,6 +109,8 @@ void disable_debug_monitors(enum dbg_act
void user_rewind_single_step(struct task_struct *task);
void user_fastforward_single_step(struct task_struct *task);
+void user_regs_reset_single_step(struct user_pt_regs *regs,
+ struct task_struct *task);
void kernel_enable_single_step(struct pt_regs *regs);
void kernel_disable_single_step(void);
--- a/arch/arm64/kernel/debug-monitors.c
+++ b/arch/arm64/kernel/debug-monitors.c
@@ -141,17 +141,20 @@ postcore_initcall(debug_monitors_init);
/*
* Single step API and exception handling.
*/
-static void set_regs_spsr_ss(struct pt_regs *regs)
+static void set_user_regs_spsr_ss(struct user_pt_regs *regs)
{
regs->pstate |= DBG_SPSR_SS;
}
-NOKPROBE_SYMBOL(set_regs_spsr_ss);
+NOKPROBE_SYMBOL(set_user_regs_spsr_ss);
-static void clear_regs_spsr_ss(struct pt_regs *regs)
+static void clear_user_regs_spsr_ss(struct user_pt_regs *regs)
{
regs->pstate &= ~DBG_SPSR_SS;
}
-NOKPROBE_SYMBOL(clear_regs_spsr_ss);
+NOKPROBE_SYMBOL(clear_user_regs_spsr_ss);
+
+#define set_regs_spsr_ss(r) set_user_regs_spsr_ss(&(r)->user_regs)
+#define clear_regs_spsr_ss(r) clear_user_regs_spsr_ss(&(r)->user_regs)
static DEFINE_SPINLOCK(debug_hook_lock);
static LIST_HEAD(user_step_hook);
@@ -404,6 +407,15 @@ void user_fastforward_single_step(struct
clear_regs_spsr_ss(task_pt_regs(task));
}
+void user_regs_reset_single_step(struct user_pt_regs *regs,
+ struct task_struct *task)
+{
+ if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
+ set_user_regs_spsr_ss(regs);
+ else
+ clear_user_regs_spsr_ss(regs);
+}
+
/* Kernel API */
void kernel_enable_single_step(struct pt_regs *regs)
{
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -1935,8 +1935,8 @@ static int valid_native_regs(struct user
*/
int valid_user_regs(struct user_pt_regs *regs, struct task_struct *task)
{
- if (!test_tsk_thread_flag(task, TIF_SINGLESTEP))
- regs->pstate &= ~DBG_SPSR_SS;
+ /* https://lore.kernel.org/lkml/20191118131525.GA4180@willie-the-truck */
+ user_regs_reset_single_step(regs, task);
if (is_compat_thread(task_thread_info(task)))
return valid_compat_regs(regs);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 217/244] arm64: ptrace: Consistently use pseudo-singlestep exceptions
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 216/244] arm64: ptrace: Override SPSR.SS when single-stepping is enabled Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 218/244] arm64: compat: Ensure upper 32 bits of x0 are zero on syscall return Greg Kroah-Hartman
` (27 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Rutland, Luis Machado,
Keno Fischer, Will Deacon
From: Will Deacon <will@kernel.org>
commit ac2081cdc4d99c57f219c1a6171526e0fa0a6fff upstream.
Although the arm64 single-step state machine can be fast-forwarded in
cases where we wish to generate a SIGTRAP without actually executing an
instruction, this has two major limitations outside of simply skipping
an instruction due to emulation.
1. Stepping out of a ptrace signal stop into a signal handler where
SIGTRAP is blocked. Fast-forwarding the stepping state machine in
this case will result in a forced SIGTRAP, with the handler reset to
SIG_DFL.
2. The hardware implicitly fast-forwards the state machine when executing
an SVC instruction for issuing a system call. This can interact badly
with subsequent ptrace stops signalled during the execution of the
system call (e.g. SYSCALL_EXIT or seccomp traps), as they may corrupt
the stepping state by updating the PSTATE for the tracee.
Resolve both of these issues by injecting a pseudo-singlestep exception
on entry to a signal handler and also on return to userspace following a
system call.
Cc: <stable@vger.kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Tested-by: Luis Machado <luis.machado@linaro.org>
Reported-by: Keno Fischer <keno@juliacomputing.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/thread_info.h | 1 +
arch/arm64/kernel/ptrace.c | 27 ++++++++++++++++++++-------
arch/arm64/kernel/signal.c | 11 ++---------
arch/arm64/kernel/syscall.c | 2 +-
4 files changed, 24 insertions(+), 17 deletions(-)
--- a/arch/arm64/include/asm/thread_info.h
+++ b/arch/arm64/include/asm/thread_info.h
@@ -89,6 +89,7 @@ void arch_release_task_struct(struct tas
#define _TIF_SYSCALL_EMU (1 << TIF_SYSCALL_EMU)
#define _TIF_UPROBE (1 << TIF_UPROBE)
#define _TIF_FSCHECK (1 << TIF_FSCHECK)
+#define _TIF_SINGLESTEP (1 << TIF_SINGLESTEP)
#define _TIF_32BIT (1 << TIF_32BIT)
#define _TIF_SVE (1 << TIF_SVE)
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -1819,12 +1819,23 @@ static void tracehook_report_syscall(str
saved_reg = regs->regs[regno];
regs->regs[regno] = dir;
- if (dir == PTRACE_SYSCALL_EXIT)
+ if (dir == PTRACE_SYSCALL_ENTER) {
+ if (tracehook_report_syscall_entry(regs))
+ forget_syscall(regs);
+ regs->regs[regno] = saved_reg;
+ } else if (!test_thread_flag(TIF_SINGLESTEP)) {
tracehook_report_syscall_exit(regs, 0);
- else if (tracehook_report_syscall_entry(regs))
- forget_syscall(regs);
-
- regs->regs[regno] = saved_reg;
+ regs->regs[regno] = saved_reg;
+ } else {
+ regs->regs[regno] = saved_reg;
+
+ /*
+ * Signal a pseudo-step exception since we are stepping but
+ * tracer modifications to the registers may have rewound the
+ * state machine.
+ */
+ tracehook_report_syscall_exit(regs, 1);
+ }
}
int syscall_trace_enter(struct pt_regs *regs)
@@ -1852,12 +1863,14 @@ int syscall_trace_enter(struct pt_regs *
void syscall_trace_exit(struct pt_regs *regs)
{
+ unsigned long flags = READ_ONCE(current_thread_info()->flags);
+
audit_syscall_exit(regs);
- if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
+ if (flags & _TIF_SYSCALL_TRACEPOINT)
trace_sys_exit(regs, regs_return_value(regs));
- if (test_thread_flag(TIF_SYSCALL_TRACE))
+ if (flags & (_TIF_SYSCALL_TRACE | _TIF_SINGLESTEP))
tracehook_report_syscall(regs, PTRACE_SYSCALL_EXIT);
rseq_syscall(regs);
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -784,7 +784,6 @@ static void setup_restart_syscall(struct
*/
static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
{
- struct task_struct *tsk = current;
sigset_t *oldset = sigmask_to_save();
int usig = ksig->sig;
int ret;
@@ -808,14 +807,8 @@ static void handle_signal(struct ksignal
*/
ret |= !valid_user_regs(®s->user_regs, current);
- /*
- * Fast forward the stepping logic so we step into the signal
- * handler.
- */
- if (!ret)
- user_fastforward_single_step(tsk);
-
- signal_setup_done(ret, ksig, 0);
+ /* Step into the signal handler if we are stepping */
+ signal_setup_done(ret, ksig, test_thread_flag(TIF_SINGLESTEP));
}
/*
--- a/arch/arm64/kernel/syscall.c
+++ b/arch/arm64/kernel/syscall.c
@@ -121,7 +121,7 @@ static void el0_svc_common(struct pt_reg
if (!has_syscall_work(flags) && !IS_ENABLED(CONFIG_DEBUG_RSEQ)) {
local_daif_mask();
flags = current_thread_info()->flags;
- if (!has_syscall_work(flags)) {
+ if (!has_syscall_work(flags) && !(flags & _TIF_SINGLESTEP)) {
/*
* We're off to userspace, where interrupts are
* always enabled after we restore the flags from
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 218/244] arm64: compat: Ensure upper 32 bits of x0 are zero on syscall return
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 217/244] arm64: ptrace: Consistently use pseudo-singlestep exceptions Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 219/244] sched: Fix unreliable rseq cpu_id for new tasks Greg Kroah-Hartman
` (26 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Rutland, Keno Fischer,
Luis Machado, Will Deacon
From: Will Deacon <will@kernel.org>
commit 15956689a0e60aa0c795174f3c310b60d8794235 upstream.
Although we zero the upper bits of x0 on entry to the kernel from an
AArch32 task, we do not clear them on the exception return path and can
therefore expose 64-bit sign extended syscall return values to userspace
via interfaces such as the 'perf_regs' ABI, which deal exclusively with
64-bit registers.
Explicitly clear the upper 32 bits of x0 on return from a compat system
call.
Cc: <stable@vger.kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Keno Fischer <keno@juliacomputing.com>
Cc: Luis Machado <luis.machado@linaro.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/syscall.h | 12 +++++++++++-
arch/arm64/kernel/syscall.c | 3 +++
2 files changed, 14 insertions(+), 1 deletion(-)
--- a/arch/arm64/include/asm/syscall.h
+++ b/arch/arm64/include/asm/syscall.h
@@ -34,6 +34,10 @@ static inline long syscall_get_error(str
struct pt_regs *regs)
{
unsigned long error = regs->regs[0];
+
+ if (is_compat_thread(task_thread_info(task)))
+ error = sign_extend64(error, 31);
+
return IS_ERR_VALUE(error) ? error : 0;
}
@@ -47,7 +51,13 @@ static inline void syscall_set_return_va
struct pt_regs *regs,
int error, long val)
{
- regs->regs[0] = (long) error ? error : val;
+ if (error)
+ val = error;
+
+ if (is_compat_thread(task_thread_info(task)))
+ val = lower_32_bits(val);
+
+ regs->regs[0] = val;
}
#define SYSCALL_MAX_ARGS 6
--- a/arch/arm64/kernel/syscall.c
+++ b/arch/arm64/kernel/syscall.c
@@ -50,6 +50,9 @@ static void invoke_syscall(struct pt_reg
ret = do_ni_syscall(regs, scno);
}
+ if (is_compat_task())
+ ret = lower_32_bits(ret);
+
regs->regs[0] = ret;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 219/244] sched: Fix unreliable rseq cpu_id for new tasks
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 218/244] arm64: compat: Ensure upper 32 bits of x0 are zero on syscall return Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 220/244] sched/fair: handle case of task_h_load() returning 0 Greg Kroah-Hartman
` (25 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Weimer, Mathieu Desnoyers,
Peter Zijlstra (Intel)
From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
commit ce3614daabea8a2d01c1dd17ae41d1ec5e5ae7db upstream.
While integrating rseq into glibc and replacing glibc's sched_getcpu
implementation with rseq, glibc's tests discovered an issue with
incorrect __rseq_abi.cpu_id field value right after the first time
a newly created process issues sched_setaffinity.
For the records, it triggers after building glibc and running tests, and
then issuing:
for x in {1..2000} ; do posix/tst-affinity-static & done
and shows up as:
error: Unexpected CPU 2, expected 0
error: Unexpected CPU 2, expected 0
error: Unexpected CPU 2, expected 0
error: Unexpected CPU 2, expected 0
error: Unexpected CPU 138, expected 0
error: Unexpected CPU 138, expected 0
error: Unexpected CPU 138, expected 0
error: Unexpected CPU 138, expected 0
This is caused by the scheduler invoking __set_task_cpu() directly from
sched_fork() and wake_up_new_task(), thus bypassing rseq_migrate() which
is done by set_task_cpu().
Add the missing rseq_migrate() to both functions. The only other direct
use of __set_task_cpu() is done by init_idle(), which does not involve a
user-space task.
Based on my testing with the glibc test-case, just adding rseq_migrate()
to wake_up_new_task() is sufficient to fix the observed issue. Also add
it to sched_fork() to keep things consistent.
The reason why this never triggered so far with the rseq/basic_test
selftest is unclear.
The current use of sched_getcpu(3) does not typically require it to be
always accurate. However, use of the __rseq_abi.cpu_id field within rseq
critical sections requires it to be accurate. If it is not accurate, it
can cause corruption in the per-cpu data targeted by rseq critical
sections in user-space.
Reported-By: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-By: Florian Weimer <fweimer@redhat.com>
Cc: stable@vger.kernel.org # v4.18+
Link: https://lkml.kernel.org/r/20200707201505.2632-1-mathieu.desnoyers@efficios.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2876,6 +2876,7 @@ int sched_fork(unsigned long clone_flags
* Silence PROVE_RCU.
*/
raw_spin_lock_irqsave(&p->pi_lock, flags);
+ rseq_migrate(p);
/*
* We're setting the CPU for the first time, we don't migrate,
* so use __set_task_cpu().
@@ -2940,6 +2941,7 @@ void wake_up_new_task(struct task_struct
* as we're not fully set-up yet.
*/
p->recent_used_cpu = task_cpu(p);
+ rseq_migrate(p);
__set_task_cpu(p, select_task_rq(p, task_cpu(p), SD_BALANCE_FORK, 0));
#endif
rq = __task_rq_lock(p, &rf);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 220/244] sched/fair: handle case of task_h_load() returning 0
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 219/244] sched: Fix unreliable rseq cpu_id for new tasks Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 221/244] x86/ioperm: Fix io bitmap invalidation on Xen PV Greg Kroah-Hartman
` (24 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vincent Guittot,
Peter Zijlstra (Intel),
Valentin Schneider, Dietmar Eggemann
From: Vincent Guittot <vincent.guittot@linaro.org>
commit 01cfcde9c26d8555f0e6e9aea9d6049f87683998 upstream.
task_h_load() can return 0 in some situations like running stress-ng
mmapfork, which forks thousands of threads, in a sched group on a 224 cores
system. The load balance doesn't handle this correctly because
env->imbalance never decreases and it will stop pulling tasks only after
reaching loop_max, which can be equal to the number of running tasks of
the cfs. Make sure that imbalance will be decreased by at least 1.
misfit task is the other feature that doesn't handle correctly such
situation although it's probably more difficult to face the problem
because of the smaller number of CPUs and running tasks on heterogenous
system.
We can't simply ensure that task_h_load() returns at least one because it
would imply to handle underflow in other places.
Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: <stable@vger.kernel.org> # v4.4+
Link: https://lkml.kernel.org/r/20200710152426.16981-1-vincent.guittot@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/fair.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4033,7 +4033,11 @@ static inline void update_misfit_status(
return;
}
- rq->misfit_task_load = task_h_load(p);
+ /*
+ * Make sure that misfit_task_load will not be null even if
+ * task_h_load() returns 0.
+ */
+ rq->misfit_task_load = max_t(unsigned long, task_h_load(p), 1);
}
#else /* CONFIG_SMP */
@@ -7633,7 +7637,14 @@ static int detach_tasks(struct lb_env *e
switch (env->migration_type) {
case migrate_load:
- load = task_h_load(p);
+ /*
+ * Depending of the number of CPUs and tasks and the
+ * cgroup hierarchy, task_h_load() can return a null
+ * value. Make sure that env->imbalance decreases
+ * otherwise detach_tasks() will stop only after
+ * detaching up to loop_max tasks.
+ */
+ load = max_t(unsigned long, task_h_load(p), 1);
if (sched_feat(LB_MIN) &&
load < 16 && !env->sd->nr_balance_failed)
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 221/244] x86/ioperm: Fix io bitmap invalidation on Xen PV
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 220/244] sched/fair: handle case of task_h_load() returning 0 Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 222/244] genirq/affinity: Handle affinity setting on inactive interrupts correctly Greg Kroah-Hartman
` (23 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Lutomirski, Thomas Gleixner,
Juergen Gross
From: Andy Lutomirski <luto@kernel.org>
commit cadfad870154e14f745ec845708bc17d166065f2 upstream.
tss_invalidate_io_bitmap() wasn't wired up properly through the pvop
machinery, so the TSS and Xen's io bitmap would get out of sync
whenever disabling a valid io bitmap.
Add a new pvop for tss_invalidate_io_bitmap() to fix it.
This is XSA-329.
Fixes: 22fe5b0439dd ("x86/ioperm: Move TSS bitmap update to exit to user work")
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/d53075590e1f91c19f8af705059d3ff99424c020.1595030016.git.luto@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/io_bitmap.h | 16 ++++++++++++++++
arch/x86/include/asm/paravirt.h | 5 +++++
arch/x86/include/asm/paravirt_types.h | 1 +
arch/x86/kernel/paravirt.c | 3 ++-
arch/x86/kernel/process.c | 18 ++----------------
arch/x86/xen/enlighten_pv.c | 12 ++++++++++++
6 files changed, 38 insertions(+), 17 deletions(-)
--- a/arch/x86/include/asm/io_bitmap.h
+++ b/arch/x86/include/asm/io_bitmap.h
@@ -19,12 +19,28 @@ struct task_struct;
void io_bitmap_share(struct task_struct *tsk);
void io_bitmap_exit(struct task_struct *tsk);
+static inline void native_tss_invalidate_io_bitmap(void)
+{
+ /*
+ * Invalidate the I/O bitmap by moving io_bitmap_base outside the
+ * TSS limit so any subsequent I/O access from user space will
+ * trigger a #GP.
+ *
+ * This is correct even when VMEXIT rewrites the TSS limit
+ * to 0x67 as the only requirement is that the base points
+ * outside the limit.
+ */
+ this_cpu_write(cpu_tss_rw.x86_tss.io_bitmap_base,
+ IO_BITMAP_OFFSET_INVALID);
+}
+
void native_tss_update_io_bitmap(void);
#ifdef CONFIG_PARAVIRT_XXL
#include <asm/paravirt.h>
#else
#define tss_update_io_bitmap native_tss_update_io_bitmap
+#define tss_invalidate_io_bitmap native_tss_invalidate_io_bitmap
#endif
#else
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -296,6 +296,11 @@ static inline void write_idt_entry(gate_
}
#ifdef CONFIG_X86_IOPL_IOPERM
+static inline void tss_invalidate_io_bitmap(void)
+{
+ PVOP_VCALL0(cpu.invalidate_io_bitmap);
+}
+
static inline void tss_update_io_bitmap(void)
{
PVOP_VCALL0(cpu.update_io_bitmap);
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -141,6 +141,7 @@ struct pv_cpu_ops {
void (*load_sp0)(unsigned long sp0);
#ifdef CONFIG_X86_IOPL_IOPERM
+ void (*invalidate_io_bitmap)(void);
void (*update_io_bitmap)(void);
#endif
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -343,7 +343,8 @@ struct paravirt_patch_template pv_ops =
.cpu.swapgs = native_swapgs,
#ifdef CONFIG_X86_IOPL_IOPERM
- .cpu.update_io_bitmap = native_tss_update_io_bitmap,
+ .cpu.invalidate_io_bitmap = native_tss_invalidate_io_bitmap,
+ .cpu.update_io_bitmap = native_tss_update_io_bitmap,
#endif
.cpu.start_context_switch = paravirt_nop,
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -322,20 +322,6 @@ void arch_setup_new_exec(void)
}
#ifdef CONFIG_X86_IOPL_IOPERM
-static inline void tss_invalidate_io_bitmap(struct tss_struct *tss)
-{
- /*
- * Invalidate the I/O bitmap by moving io_bitmap_base outside the
- * TSS limit so any subsequent I/O access from user space will
- * trigger a #GP.
- *
- * This is correct even when VMEXIT rewrites the TSS limit
- * to 0x67 as the only requirement is that the base points
- * outside the limit.
- */
- tss->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET_INVALID;
-}
-
static inline void switch_to_bitmap(unsigned long tifp)
{
/*
@@ -346,7 +332,7 @@ static inline void switch_to_bitmap(unsi
* user mode.
*/
if (tifp & _TIF_IO_BITMAP)
- tss_invalidate_io_bitmap(this_cpu_ptr(&cpu_tss_rw));
+ tss_invalidate_io_bitmap();
}
static void tss_copy_io_bitmap(struct tss_struct *tss, struct io_bitmap *iobm)
@@ -380,7 +366,7 @@ void native_tss_update_io_bitmap(void)
u16 *base = &tss->x86_tss.io_bitmap_base;
if (!test_thread_flag(TIF_IO_BITMAP)) {
- tss_invalidate_io_bitmap(tss);
+ native_tss_invalidate_io_bitmap();
return;
}
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -841,6 +841,17 @@ static void xen_load_sp0(unsigned long s
}
#ifdef CONFIG_X86_IOPL_IOPERM
+static void xen_invalidate_io_bitmap(void)
+{
+ struct physdev_set_iobitmap iobitmap = {
+ .bitmap = 0,
+ .nr_ports = 0,
+ };
+
+ native_tss_invalidate_io_bitmap();
+ HYPERVISOR_physdev_op(PHYSDEVOP_set_iobitmap, &iobitmap);
+}
+
static void xen_update_io_bitmap(void)
{
struct physdev_set_iobitmap iobitmap;
@@ -1070,6 +1081,7 @@ static const struct pv_cpu_ops xen_cpu_o
.load_sp0 = xen_load_sp0,
#ifdef CONFIG_X86_IOPL_IOPERM
+ .invalidate_io_bitmap = xen_invalidate_io_bitmap,
.update_io_bitmap = xen_update_io_bitmap,
#endif
.io_delay = xen_io_delay,
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 222/244] genirq/affinity: Handle affinity setting on inactive interrupts correctly
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 221/244] x86/ioperm: Fix io bitmap invalidation on Xen PV Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 223/244] drm/vmwgfx: fix update of display surface when resolution changes Greg Kroah-Hartman
` (22 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ali Saidi, Thomas Gleixner
From: Thomas Gleixner <tglx@linutronix.de>
commit baedb87d1b53532f81b4bd0387f83b05d4f7eb9a upstream.
Setting interrupt affinity on inactive interrupts is inconsistent when
hierarchical irq domains are enabled. The core code should just store the
affinity and not call into the irq chip driver for inactive interrupts
because the chip drivers may not be in a state to handle such requests.
X86 has a hacky workaround for that but all other irq chips have not which
causes problems e.g. on GIC V3 ITS.
Instead of adding more ugly hacks all over the place, solve the problem in
the core code. If the affinity is set on an inactive interrupt then:
- Store it in the irq descriptors affinity mask
- Update the effective affinity to reflect that so user space has
a consistent view
- Don't call into the irq chip driver
This is the core equivalent of the X86 workaround and works correctly
because the affinity setting is established in the irq chip when the
interrupt is activated later on.
Note, that this is only effective when hierarchical irq domains are enabled
by the architecture. Doing it unconditionally would break legacy irq chip
implementations.
For hierarchial irq domains this works correctly as none of the drivers can
have a dependency on affinity setting in inactive state by design.
Remove the X86 workaround as it is not longer required.
Fixes: 02edee152d6e ("x86/apic/vector: Ignore set_affinity call for inactive interrupts")
Reported-by: Ali Saidi <alisaidi@amazon.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Ali Saidi <alisaidi@amazon.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200529015501.15771-1-alisaidi@amazon.com
Link: https://lkml.kernel.org/r/877dv2rv25.fsf@nanos.tec.linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/apic/vector.c | 22 +++++-----------------
kernel/irq/manage.c | 37 +++++++++++++++++++++++++++++++++++--
2 files changed, 40 insertions(+), 19 deletions(-)
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -446,12 +446,10 @@ static int x86_vector_activate(struct ir
trace_vector_activate(irqd->irq, apicd->is_managed,
apicd->can_reserve, reserve);
- /* Nothing to do for fixed assigned vectors */
- if (!apicd->can_reserve && !apicd->is_managed)
- return 0;
-
raw_spin_lock_irqsave(&vector_lock, flags);
- if (reserve || irqd_is_managed_and_shutdown(irqd))
+ if (!apicd->can_reserve && !apicd->is_managed)
+ assign_irq_vector_any_locked(irqd);
+ else if (reserve || irqd_is_managed_and_shutdown(irqd))
vector_assign_managed_shutdown(irqd);
else if (apicd->is_managed)
ret = activate_managed(irqd);
@@ -775,20 +773,10 @@ void lapic_offline(void)
static int apic_set_affinity(struct irq_data *irqd,
const struct cpumask *dest, bool force)
{
- struct apic_chip_data *apicd = apic_chip_data(irqd);
int err;
- /*
- * Core code can call here for inactive interrupts. For inactive
- * interrupts which use managed or reservation mode there is no
- * point in going through the vector assignment right now as the
- * activation will assign a vector which fits the destination
- * cpumask. Let the core code store the destination mask and be
- * done with it.
- */
- if (!irqd_is_activated(irqd) &&
- (apicd->is_managed || apicd->can_reserve))
- return IRQ_SET_MASK_OK;
+ if (WARN_ON_ONCE(!irqd_is_activated(irqd)))
+ return -EIO;
raw_spin_lock(&vector_lock);
cpumask_and(vector_searchmask, dest, cpu_online_mask);
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -195,9 +195,9 @@ void irq_set_thread_affinity(struct irq_
set_bit(IRQTF_AFFINITY, &action->thread_flags);
}
+#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
static void irq_validate_effective_affinity(struct irq_data *data)
{
-#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
const struct cpumask *m = irq_data_get_effective_affinity_mask(data);
struct irq_chip *chip = irq_data_get_irq_chip(data);
@@ -205,9 +205,19 @@ static void irq_validate_effective_affin
return;
pr_warn_once("irq_chip %s did not update eff. affinity mask of irq %u\n",
chip->name, data->irq);
-#endif
}
+static inline void irq_init_effective_affinity(struct irq_data *data,
+ const struct cpumask *mask)
+{
+ cpumask_copy(irq_data_get_effective_affinity_mask(data), mask);
+}
+#else
+static inline void irq_validate_effective_affinity(struct irq_data *data) { }
+static inline void irq_init_effective_affinity(struct irq_data *data,
+ const struct cpumask *mask) { }
+#endif
+
int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
bool force)
{
@@ -304,6 +314,26 @@ static int irq_try_set_affinity(struct i
return ret;
}
+static bool irq_set_affinity_deactivated(struct irq_data *data,
+ const struct cpumask *mask, bool force)
+{
+ struct irq_desc *desc = irq_data_to_desc(data);
+
+ /*
+ * If the interrupt is not yet activated, just store the affinity
+ * mask and do not call the chip driver at all. On activation the
+ * driver has to make sure anyway that the interrupt is in a
+ * useable state so startup works.
+ */
+ if (!IS_ENABLED(CONFIG_IRQ_DOMAIN_HIERARCHY) || irqd_is_activated(data))
+ return false;
+
+ cpumask_copy(desc->irq_common_data.affinity, mask);
+ irq_init_effective_affinity(data, mask);
+ irqd_set(data, IRQD_AFFINITY_SET);
+ return true;
+}
+
int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
bool force)
{
@@ -314,6 +344,9 @@ int irq_set_affinity_locked(struct irq_d
if (!chip || !chip->irq_set_affinity)
return -EINVAL;
+ if (irq_set_affinity_deactivated(data, mask, force))
+ return 0;
+
if (irq_can_move_pcntxt(data) && !irqd_is_setaffinity_pending(data)) {
ret = irq_try_set_affinity(data, mask, force);
} else {
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 223/244] drm/vmwgfx: fix update of display surface when resolution changes
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 222/244] genirq/affinity: Handle affinity setting on inactive interrupts correctly Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 224/244] drm/amdgpu/powerplay: Modify SMC message name for setting power profile mode Greg Kroah-Hartman
` (21 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Charmaine Lee, Roland Scheidegger
From: Roland Scheidegger <sroland@vmware.com>
commit 1f054fd26e29784d373c3d29c348ee48f1c41fb2 upstream.
The assignment of metadata overwrote the new display resolution values,
hence we'd miss the size actually changed and wouldn't redefine the
surface. This would then lead to command buffer error when trying to
update the screen target (due to the size mismatch), and result in a
VM with black screen.
Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata")
Reviewed-by: Charmaine Lee <charmainel@vmware.com>
Signed-off-by: Roland Scheidegger <sroland@vmware.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -1069,10 +1069,6 @@ vmw_stdu_primary_plane_prepare_fb(struct
if (new_content_type != SAME_AS_DISPLAY) {
struct vmw_surface_metadata metadata = {0};
- metadata.base_size.width = hdisplay;
- metadata.base_size.height = vdisplay;
- metadata.base_size.depth = 1;
-
/*
* If content buffer is a buffer object, then we have to
* construct surface info
@@ -1104,6 +1100,10 @@ vmw_stdu_primary_plane_prepare_fb(struct
metadata = new_vfbs->surface->metadata;
}
+ metadata.base_size.width = hdisplay;
+ metadata.base_size.height = vdisplay;
+ metadata.base_size.depth = 1;
+
if (vps->surf) {
struct drm_vmw_size cur_base_size =
vps->surf->metadata.base_size;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 224/244] drm/amdgpu/powerplay: Modify SMC message name for setting power profile mode
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 223/244] drm/vmwgfx: fix update of display surface when resolution changes Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 225/244] drm/amdgpu/sdma5: fix wptr overwritten in ->get_wptr() Greg Kroah-Hartman
` (20 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, chen gong, Evan Quan, Alex Deucher
From: chen gong <curry.gong@amd.com>
commit 98a34cf931e848f8489d3fb15a8f5fc03802ad65 upstream.
I consulted Cai Land(Chuntian.Cai@amd.com), he told me corresponding smc
message name to fSMC_MSG_SetWorkloadMask() is
"PPSMC_MSG_ActiveProcessNotify" in firmware code of Renoir.
Strange though it may seem, but it's a fact.
Signed-off-by: chen gong <curry.gong@amd.com>
Reviewed-by: Evan Quan <evan.quan@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/powerplay/renoir_ppt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/powerplay/renoir_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/renoir_ppt.c
@@ -687,7 +687,7 @@ static int renoir_set_power_profile_mode
return -EINVAL;
}
- ret = smu_send_smc_msg_with_param(smu, SMU_MSG_SetWorkloadMask,
+ ret = smu_send_smc_msg_with_param(smu, SMU_MSG_ActiveProcessNotify,
1 << workload_type,
NULL);
if (ret) {
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 225/244] drm/amdgpu/sdma5: fix wptr overwritten in ->get_wptr()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 224/244] drm/amdgpu/powerplay: Modify SMC message name for setting power profile mode Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 226/244] drm/amd/display: handle failed allocation during stream construction Greg Kroah-Hartman
` (19 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Le Ma, Xiaojie Yuan,
Christian König, Alex Deucher
From: Xiaojie Yuan <xiaojie.yuan@amd.com>
commit 05051496b2622e4d12e2036b35165969aa502f89 upstream.
"u64 *wptr" points to the the wptr value in write back buffer and
"*wptr = (*wptr) >> 2;" results in the value being overwritten each time
when ->get_wptr() is called.
umr uses /sys/kernel/debug/dri/0/amdgpu_ring_sdma0 to get rptr/wptr and
decode ring content and it is affected by this issue.
fix and simplify the logic similar as sdma_v4_0_ring_get_wptr().
v2: fix for sdma5.2 as well
v3: drop sdma 5.2 changes for 5.8 and stable
Suggested-by: Le Ma <le.ma@amd.com>
Signed-off-by: Xiaojie Yuan <xiaojie.yuan@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 26 ++++++++------------------
1 file changed, 8 insertions(+), 18 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
@@ -286,30 +286,20 @@ static uint64_t sdma_v5_0_ring_get_rptr(
static uint64_t sdma_v5_0_ring_get_wptr(struct amdgpu_ring *ring)
{
struct amdgpu_device *adev = ring->adev;
- u64 *wptr = NULL;
- uint64_t local_wptr = 0;
+ u64 wptr;
if (ring->use_doorbell) {
/* XXX check if swapping is necessary on BE */
- wptr = ((u64 *)&adev->wb.wb[ring->wptr_offs]);
- DRM_DEBUG("wptr/doorbell before shift == 0x%016llx\n", *wptr);
- *wptr = (*wptr) >> 2;
- DRM_DEBUG("wptr/doorbell after shift == 0x%016llx\n", *wptr);
+ wptr = READ_ONCE(*((u64 *)&adev->wb.wb[ring->wptr_offs]));
+ DRM_DEBUG("wptr/doorbell before shift == 0x%016llx\n", wptr);
} else {
- u32 lowbit, highbit;
-
- wptr = &local_wptr;
- lowbit = RREG32(sdma_v5_0_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR)) >> 2;
- highbit = RREG32(sdma_v5_0_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR_HI)) >> 2;
-
- DRM_DEBUG("wptr [%i]high== 0x%08x low==0x%08x\n",
- ring->me, highbit, lowbit);
- *wptr = highbit;
- *wptr = (*wptr) << 32;
- *wptr |= lowbit;
+ wptr = RREG32(sdma_v5_0_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR_HI));
+ wptr = wptr << 32;
+ wptr |= RREG32(sdma_v5_0_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR));
+ DRM_DEBUG("wptr before shift [%i] wptr == 0x%016llx\n", ring->me, wptr);
}
- return *wptr;
+ return wptr >> 2;
}
/**
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 226/244] drm/amd/display: handle failed allocation during stream construction
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 225/244] drm/amdgpu/sdma5: fix wptr overwritten in ->get_wptr() Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 227/244] drm/amd/display: OLED panel backlight adjust not work with external display connected Greg Kroah-Hartman
` (18 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josip Pavic, Aric Cyr,
Rodrigo Siqueira, Alex Deucher
From: Josip Pavic <Josip.Pavic@amd.com>
commit be73e608ae2711dc8a1ab8b9549d9e348061b2ee upstream.
[Why]
Failing to allocate a transfer function during stream construction leads
to a null pointer dereference
[How]
Handle the failed allocation by failing the stream construction
Cc: stable@vger.kernel.org
Signed-off-by: Josip Pavic <Josip.Pavic@amd.com>
Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -56,7 +56,7 @@ void update_stream_signal(struct dc_stre
}
}
-static void dc_stream_construct(struct dc_stream_state *stream,
+static bool dc_stream_construct(struct dc_stream_state *stream,
struct dc_sink *dc_sink_data)
{
uint32_t i = 0;
@@ -118,11 +118,17 @@ static void dc_stream_construct(struct d
update_stream_signal(stream, dc_sink_data);
stream->out_transfer_func = dc_create_transfer_func();
+ if (stream->out_transfer_func == NULL) {
+ dc_sink_release(dc_sink_data);
+ return false;
+ }
stream->out_transfer_func->type = TF_TYPE_BYPASS;
stream->out_transfer_func->ctx = stream->ctx;
stream->stream_id = stream->ctx->dc_stream_id_count;
stream->ctx->dc_stream_id_count++;
+
+ return true;
}
static void dc_stream_destruct(struct dc_stream_state *stream)
@@ -164,13 +170,20 @@ struct dc_stream_state *dc_create_stream
stream = kzalloc(sizeof(struct dc_stream_state), GFP_KERNEL);
if (stream == NULL)
- return NULL;
+ goto alloc_fail;
- dc_stream_construct(stream, sink);
+ if (dc_stream_construct(stream, sink) == false)
+ goto construct_fail;
kref_init(&stream->refcount);
return stream;
+
+construct_fail:
+ kfree(stream);
+
+alloc_fail:
+ return NULL;
}
struct dc_stream_state *dc_copy_stream(const struct dc_stream_state *stream)
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 227/244] drm/amd/display: OLED panel backlight adjust not work with external display connected
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 226/244] drm/amd/display: handle failed allocation during stream construction Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 228/244] drm/amdgpu/display: create fake mst encoders ahead of time (v4) Greg Kroah-Hartman
` (17 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, hersen wu, Nicholas Kazlauskas,
Rodrigo Siqueira, Alex Deucher
From: hersen wu <hersenxs.wu@amd.com>
commit b448d30b0c303d5454ea572b772d1ffae96bc6e7 upstream.
[Why]
amdgpu_dm->backlight_caps is for single eDP only. the caps are upddated
for very connector. Real eDP caps will be overwritten by other external
display. For OLED panel, caps->aux_support is set to 1 for OLED pnael.
after external connected, caps+.aux_support is set to 0. This causes
OLED backlight adjustment not work.
[How]
within update_conector_ext_caps, backlight caps will be updated only for
eDP connector.
Cc: stable@vger.kernel.org
Signed-off-by: hersen wu <hersenxs.wu@amd.com>
Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1804,6 +1804,7 @@ static void update_connector_ext_caps(st
struct amdgpu_display_manager *dm;
struct drm_connector *conn_base;
struct amdgpu_device *adev;
+ struct dc_link *link = NULL;
static const u8 pre_computed_values[] = {
50, 51, 52, 53, 55, 56, 57, 58, 59, 61, 62, 63, 65, 66, 68, 69,
71, 72, 74, 75, 77, 79, 81, 82, 84, 86, 88, 90, 92, 94, 96, 98};
@@ -1811,6 +1812,10 @@ static void update_connector_ext_caps(st
if (!aconnector || !aconnector->dc_link)
return;
+ link = aconnector->dc_link;
+ if (link->connector_signal != SIGNAL_TYPE_EDP)
+ return;
+
conn_base = &aconnector->base;
adev = conn_base->dev->dev_private;
dm = &adev->dm;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 228/244] drm/amdgpu/display: create fake mst encoders ahead of time (v4)
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 227/244] drm/amd/display: OLED panel backlight adjust not work with external display connected Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 229/244] drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2 Greg Kroah-Hartman
` (16 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicholas Kazlauskas, Alex Deucher
From: Alex Deucher <alexander.deucher@amd.com>
commit 3168470142e0a82b5732c04ed4c031a9322ae170 upstream.
Prevents a warning in the MST create connector case.
v2: create global fake encoders rather per connector fake encoders
to avoid running out of encoder indices.
v3: use the actual number of crtcs on the asic rather than the max
to conserve encoders.
v4: v3 plus missing hunk I forgot to git add.
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1108
Fixes: c6385e503aeaf9 ("drm/amdgpu: drop legacy drm load and unload callbacks")
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 5.7.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 9 +
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 11 ++
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 57 +++++-------
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h | 3
4 files changed, 50 insertions(+), 30 deletions(-)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -956,6 +956,9 @@ static int amdgpu_dm_init(struct amdgpu_
/* Update the actual used number of crtc */
adev->mode_info.num_crtc = adev->dm.display_indexes_num;
+ /* create fake encoders for MST */
+ dm_dp_create_fake_mst_encoders(adev);
+
/* TODO: Add_display_info? */
/* TODO use dynamic cursor width */
@@ -979,6 +982,12 @@ error:
static void amdgpu_dm_fini(struct amdgpu_device *adev)
{
+ int i;
+
+ for (i = 0; i < adev->dm.display_indexes_num; i++) {
+ drm_encoder_cleanup(&adev->dm.mst_encoders[i].base);
+ }
+
amdgpu_dm_audio_fini(adev);
amdgpu_dm_destroy_drm_device(&adev->dm);
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
@@ -43,6 +43,9 @@
*/
#define AMDGPU_DM_MAX_DISPLAY_INDEX 31
+
+#define AMDGPU_DM_MAX_CRTC 6
+
/*
#include "include/amdgpu_dal_power_if.h"
#include "amdgpu_dm_irq.h"
@@ -327,6 +330,13 @@ struct amdgpu_display_manager {
* available in FW
*/
const struct gpu_info_soc_bounding_box_v1_0 *soc_bounding_box;
+
+ /**
+ * @mst_encoders:
+ *
+ * fake encoders used for DP MST.
+ */
+ struct amdgpu_encoder mst_encoders[AMDGPU_DM_MAX_CRTC];
};
struct amdgpu_dm_connector {
@@ -355,7 +365,6 @@ struct amdgpu_dm_connector {
struct amdgpu_dm_dp_aux dm_dp_aux;
struct drm_dp_mst_port *port;
struct amdgpu_dm_connector *mst_port;
- struct amdgpu_encoder *mst_encoder;
struct drm_dp_aux *dsc_aux;
/* TODO see if we can merge with ddc_bus or make a dm_connector */
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -137,13 +137,10 @@ static void
dm_dp_mst_connector_destroy(struct drm_connector *connector)
{
struct amdgpu_dm_connector *amdgpu_dm_connector = to_amdgpu_dm_connector(connector);
- struct amdgpu_encoder *amdgpu_encoder = amdgpu_dm_connector->mst_encoder;
kfree(amdgpu_dm_connector->edid);
amdgpu_dm_connector->edid = NULL;
- drm_encoder_cleanup(&amdgpu_encoder->base);
- kfree(amdgpu_encoder);
drm_connector_cleanup(connector);
drm_dp_mst_put_port_malloc(amdgpu_dm_connector->port);
kfree(amdgpu_dm_connector);
@@ -280,7 +277,11 @@ static struct drm_encoder *
dm_mst_atomic_best_encoder(struct drm_connector *connector,
struct drm_connector_state *connector_state)
{
- return &to_amdgpu_dm_connector(connector)->mst_encoder->base;
+ struct drm_device *dev = connector->dev;
+ struct amdgpu_device *adev = dev->dev_private;
+ struct amdgpu_crtc *acrtc = to_amdgpu_crtc(connector_state->crtc);
+
+ return &adev->dm.mst_encoders[acrtc->crtc_id].base;
}
static int
@@ -343,31 +344,27 @@ static const struct drm_encoder_funcs am
.destroy = amdgpu_dm_encoder_destroy,
};
-static struct amdgpu_encoder *
-dm_dp_create_fake_mst_encoder(struct amdgpu_dm_connector *connector)
+void
+dm_dp_create_fake_mst_encoders(struct amdgpu_device *adev)
{
- struct drm_device *dev = connector->base.dev;
- struct amdgpu_device *adev = dev->dev_private;
- struct amdgpu_encoder *amdgpu_encoder;
- struct drm_encoder *encoder;
-
- amdgpu_encoder = kzalloc(sizeof(*amdgpu_encoder), GFP_KERNEL);
- if (!amdgpu_encoder)
- return NULL;
+ struct drm_device *dev = adev->ddev;
+ int i;
- encoder = &amdgpu_encoder->base;
- encoder->possible_crtcs = amdgpu_dm_get_encoder_crtc_mask(adev);
+ for (i = 0; i < adev->dm.display_indexes_num; i++) {
+ struct amdgpu_encoder *amdgpu_encoder = &adev->dm.mst_encoders[i];
+ struct drm_encoder *encoder = &amdgpu_encoder->base;
+
+ encoder->possible_crtcs = amdgpu_dm_get_encoder_crtc_mask(adev);
+
+ drm_encoder_init(
+ dev,
+ &amdgpu_encoder->base,
+ &amdgpu_dm_encoder_funcs,
+ DRM_MODE_ENCODER_DPMST,
+ NULL);
- drm_encoder_init(
- dev,
- &amdgpu_encoder->base,
- &amdgpu_dm_encoder_funcs,
- DRM_MODE_ENCODER_DPMST,
- NULL);
-
- drm_encoder_helper_add(encoder, &amdgpu_dm_encoder_helper_funcs);
-
- return amdgpu_encoder;
+ drm_encoder_helper_add(encoder, &amdgpu_dm_encoder_helper_funcs);
+ }
}
static struct drm_connector *
@@ -380,6 +377,7 @@ dm_dp_add_mst_connector(struct drm_dp_ms
struct amdgpu_device *adev = dev->dev_private;
struct amdgpu_dm_connector *aconnector;
struct drm_connector *connector;
+ int i;
aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL);
if (!aconnector)
@@ -406,9 +404,10 @@ dm_dp_add_mst_connector(struct drm_dp_ms
master->dc_link,
master->connector_id);
- aconnector->mst_encoder = dm_dp_create_fake_mst_encoder(master);
- drm_connector_attach_encoder(&aconnector->base,
- &aconnector->mst_encoder->base);
+ for (i = 0; i < adev->dm.display_indexes_num; i++) {
+ drm_connector_attach_encoder(&aconnector->base,
+ &adev->dm.mst_encoders[i].base);
+ }
connector->max_bpc_property = master->base.max_bpc_property;
if (connector->max_bpc_property)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
@@ -35,6 +35,9 @@ void amdgpu_dm_initialize_dp_connector(s
struct amdgpu_dm_connector *aconnector,
int link_index);
+void
+dm_dp_create_fake_mst_encoders(struct amdgpu_device *adev);
+
#if defined(CONFIG_DRM_AMD_DC_DCN)
bool compute_mst_dsc_configs_for_state(struct drm_atomic_state *state,
struct dc_state *dc_state);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 229/244] drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2.
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 228/244] drm/amdgpu/display: create fake mst encoders ahead of time (v4) Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 230/244] drm/i915/gt: Ignore irq enabling on the virtual engines Greg Kroah-Hartman
` (15 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maarten Lankhorst, Daniel Vetter,
Jani Nikula
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
commit 6647e6cdba753e71170be7da2acfead7154f56d8 upstream.
This fixes the following KASAN splash on module reload:
[ 145.136327] ==================================================================
[ 145.136502] BUG: KASAN: use-after-free in intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136514] Read of size 8 at addr ffff888216641830 by task kworker/1:1/134
[ 145.136535] CPU: 1 PID: 134 Comm: kworker/1:1 Tainted: G U T 5.5.0-rc7-valkyria+ #5783
[ 145.136539] Hardware name: GIGABYTE GB-BKi3A-7100/MFLP3AP-00, BIOS F1 07/27/2016
[ 145.136546] Workqueue: events drm_connector_free_work_fn
[ 145.136551] Call Trace:
[ 145.136560] dump_stack+0xa1/0xe0
[ 145.136571] print_address_description.constprop.0+0x1e/0x210
[ 145.136639] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136703] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136710] __kasan_report.cold+0x1b/0x37
[ 145.136790] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136863] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136870] kasan_report+0x27/0x30
[ 145.136881] __asan_report_load8_noabort+0x1c/0x20
[ 145.136946] intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136954] drm_connector_free_work_fn+0xd1/0x100
[ 145.136967] process_one_work+0x86e/0x1610
[ 145.136987] ? pwq_dec_nr_in_flight+0x2f0/0x2f0
[ 145.137004] ? move_linked_works+0x128/0x2c0
[ 145.137021] worker_thread+0x63e/0xc90
[ 145.137048] kthread+0x2f6/0x3f0
[ 145.137054] ? calculate_sigpending+0x81/0xa0
[ 145.137059] ? process_one_work+0x1610/0x1610
[ 145.137064] ? kthread_bind+0x40/0x40
[ 145.137075] ret_from_fork+0x24/0x30
[ 145.137111] Allocated by task 0:
[ 145.137119] (stack is not available)
[ 145.137137] Freed by task 5053:
[ 145.137147] save_stack+0x28/0x90
[ 145.137152] __kasan_slab_free+0x136/0x180
[ 145.137157] kasan_slab_free+0x26/0x30
[ 145.137161] kfree+0xe6/0x350
[ 145.137242] intel_ddi_encoder_destroy+0x60/0x80 [i915]
[ 145.137252] drm_mode_config_cleanup+0x11d/0x8f0
[ 145.137329] intel_modeset_driver_remove+0x1f5/0x350 [i915]
[ 145.137403] i915_driver_remove+0xc4/0x130 [i915]
[ 145.137482] i915_pci_remove+0x3e/0x90 [i915]
[ 145.137489] pci_device_remove+0x108/0x2d0
[ 145.137494] device_release_driver_internal+0x1e6/0x4a0
[ 145.137499] driver_detach+0xcb/0x198
[ 145.137503] bus_remove_driver+0xde/0x204
[ 145.137508] driver_unregister+0x6d/0xa0
[ 145.137513] pci_unregister_driver+0x2e/0x230
[ 145.137576] i915_exit+0x1f/0x26 [i915]
[ 145.137157] kasan_slab_free+0x26/0x30
[ 145.137161] kfree+0xe6/0x350
[ 145.137242] intel_ddi_encoder_destroy+0x60/0x80 [i915]
[ 145.137252] drm_mode_config_cleanup+0x11d/0x8f0
[ 145.137329] intel_modeset_driver_remove+0x1f5/0x350 [i915]
[ 145.137403] i915_driver_remove+0xc4/0x130 [i915]
[ 145.137482] i915_pci_remove+0x3e/0x90 [i915]
[ 145.137489] pci_device_remove+0x108/0x2d0
[ 145.137494] device_release_driver_internal+0x1e6/0x4a0
[ 145.137499] driver_detach+0xcb/0x198
[ 145.137503] bus_remove_driver+0xde/0x204
[ 145.137508] driver_unregister+0x6d/0xa0
[ 145.137513] pci_unregister_driver+0x2e/0x230
[ 145.137576] i915_exit+0x1f/0x26 [i915]
[ 145.137581] __x64_sys_delete_module+0x35b/0x470
[ 145.137586] do_syscall_64+0x99/0x4e0
[ 145.137591] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 145.137606] The buggy address belongs to the object at ffff888216640000
which belongs to the cache kmalloc-8k of size 8192
[ 145.137618] The buggy address is located 6192 bytes inside of
8192-byte region [ffff888216640000, ffff888216642000)
[ 145.137630] The buggy address belongs to the page:
[ 145.137640] page:ffffea0008599000 refcount:1 mapcount:0 mapping:ffff888107c02a80 index:0xffff888216644000 compound_mapcount: 0
[ 145.137647] raw: 0200000000010200 0000000000000000 0000000100000001 ffff888107c02a80
[ 145.137652] raw: ffff888216644000 0000000080020001 00000001ffffffff 0000000000000000
[ 145.137656] page dumped because: kasan: bad access detected
[ 145.137668] Memory state around the buggy address:
[ 145.137678] ffff888216641700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 145.137687] ffff888216641780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 145.137697] >ffff888216641800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 145.137706] ^
[ 145.137715] ffff888216641880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 145.137724] ffff888216641900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 145.137733] ==================================================================
[ 145.137742] Disabling lock debugging due to kernel taint
Changes since v1:
- Add fixes tags.
- Use early unregister.
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Fixes: 9c229127aee2 ("drm/i915: hdmi: add CEC notifier to intel_hdmi")
Cc: <stable@vger.kernel.org> # v4.19+
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20200212135445.1469133-1-maarten.lankhorst@linux.intel.com
(cherry picked from commit a581483b1e5466d28fc50ff623fba31cea2cccb6)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/intel_hdmi.c | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
--- a/drivers/gpu/drm/i915/display/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/display/intel_hdmi.c
@@ -2821,19 +2821,13 @@ intel_hdmi_connector_register(struct drm
return ret;
}
-static void intel_hdmi_destroy(struct drm_connector *connector)
+static void intel_hdmi_connector_unregister(struct drm_connector *connector)
{
struct cec_notifier *n = intel_attached_hdmi(to_intel_connector(connector))->cec_notifier;
cec_notifier_conn_unregister(n);
- intel_connector_destroy(connector);
-}
-
-static void intel_hdmi_connector_unregister(struct drm_connector *connector)
-{
intel_hdmi_remove_i2c_symlink(connector);
-
intel_connector_unregister(connector);
}
@@ -2845,7 +2839,7 @@ static const struct drm_connector_funcs
.atomic_set_property = intel_digital_connector_atomic_set_property,
.late_register = intel_hdmi_connector_register,
.early_unregister = intel_hdmi_connector_unregister,
- .destroy = intel_hdmi_destroy,
+ .destroy = intel_connector_destroy,
.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
.atomic_duplicate_state = intel_digital_connector_duplicate_state,
};
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 230/244] drm/i915/gt: Ignore irq enabling on the virtual engines
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 229/244] drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2 Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 231/244] drm/i915/gt: Only swap to a random sibling once upon creation Greg Kroah-Hartman
` (14 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Mika Kuoppala,
Tvrtko Ursulin, Jani Nikula
From: Chris Wilson <chris@chris-wilson.co.uk>
commit 858f1299fd6f7518ddef19ddd304c8398ac79fa5 upstream.
We do not use the virtual engines for interrupts (they have physical
components), but we do use them to decouple the fence signaling during
submission. Currently, when we submit a completed request, we try to
enable the interrupt handler for the virtual engine, but we never disarm
it. A quick fix is then to mark the irq as enabled, and it will then
remain enabled -- and this prevents us from waking the device and never
letting it sleep again.
Fixes: f8db4d051b5e ("drm/i915: Initialise breadcrumb lists on the virtual engine")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: <stable@vger.kernel.org> # v5.5+
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200711203236.12330-1-chris@chris-wilson.co.uk
(cherry picked from commit 4fe6abb8f51355224808ab02a9febf65d184c40b)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/gt/intel_lrc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/i915/gt/intel_lrc.c
+++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
@@ -5188,6 +5188,7 @@ intel_execlists_create_virtual(struct in
intel_engine_init_active(&ve->base, ENGINE_VIRTUAL);
intel_engine_init_breadcrumbs(&ve->base);
intel_engine_init_execlists(&ve->base);
+ ve->base.breadcrumbs.irq_armed = true; /* fake HW, used for irq_work */
ve->base.cops = &virtual_context_ops;
ve->base.request_alloc = execlists_request_alloc;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 231/244] drm/i915/gt: Only swap to a random sibling once upon creation
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 230/244] drm/i915/gt: Ignore irq enabling on the virtual engines Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 232/244] libceph: dont omit recovery_deletes in target_copy() Greg Kroah-Hartman
` (13 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Tvrtko Ursulin, Jani Nikula
From: Chris Wilson <chris@chris-wilson.co.uk>
commit 110f9efa858f584c6bed177cd48d0c0f526940e1 upstream.
The danger in switching at random upon intel_context_pin is that the
context may still actually be inflight, as it will not be scheduled out
until a context switch after it is complete -- that may be a long time
after we do a final intel_context_unpin.
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2118
Fixes: 6d06779e8672 ("drm/i915: Load balancing across a virtual engine")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: <stable@vger.kernel.org> # v5.3+
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200713160549.17344-1-chris@chris-wilson.co.uk
(cherry picked from commit 90a987205c6cf74116a102ed446d22d92cdaf915)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/gt/intel_lrc.c | 18 ++++--------------
1 file changed, 4 insertions(+), 14 deletions(-)
--- a/drivers/gpu/drm/i915/gt/intel_lrc.c
+++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
@@ -4897,13 +4897,8 @@ static void virtual_engine_initial_hint(
* typically be the first we inspect for submission.
*/
swp = prandom_u32_max(ve->num_siblings);
- if (!swp)
- return;
-
- swap(ve->siblings[swp], ve->siblings[0]);
- if (!intel_engine_has_relative_mmio(ve->siblings[0]))
- virtual_update_register_offsets(ve->context.lrc_reg_state,
- ve->siblings[0]);
+ if (swp)
+ swap(ve->siblings[swp], ve->siblings[0]);
}
static int virtual_context_alloc(struct intel_context *ce)
@@ -4916,15 +4911,9 @@ static int virtual_context_alloc(struct
static int virtual_context_pin(struct intel_context *ce)
{
struct virtual_engine *ve = container_of(ce, typeof(*ve), context);
- int err;
/* Note: we must use a real engine class for setting up reg state */
- err = __execlists_context_pin(ce, ve->siblings[0]);
- if (err)
- return err;
-
- virtual_engine_initial_hint(ve);
- return 0;
+ return __execlists_context_pin(ce, ve->siblings[0]);
}
static void virtual_context_enter(struct intel_context *ce)
@@ -5270,6 +5259,7 @@ intel_execlists_create_virtual(struct in
ve->base.flags |= I915_ENGINE_IS_VIRTUAL;
+ virtual_engine_initial_hint(ve);
return &ve->context;
err_put:
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 232/244] libceph: dont omit recovery_deletes in target_copy()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 231/244] drm/i915/gt: Only swap to a random sibling once upon creation Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range Greg Kroah-Hartman
` (12 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Jeff Layton
From: Ilya Dryomov <idryomov@gmail.com>
commit 2f3fead62144002557f322c2a7c15e1255df0653 upstream.
Currently target_copy() is used only for sending linger pings, so
this doesn't come up, but generally omitting recovery_deletes can
result in unneeded resends (force_resend in calc_target()).
Fixes: ae78dd8139ce ("libceph: make RECOVERY_DELETES feature create a new interval")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/osd_client.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -445,6 +445,7 @@ static void target_copy(struct ceph_osd_
dest->size = src->size;
dest->min_size = src->min_size;
dest->sort_bitwise = src->sort_bitwise;
+ dest->recovery_deletes = src->recovery_deletes;
dest->flags = src->flags;
dest->paused = src->paused;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 232/244] libceph: dont omit recovery_deletes in target_copy() Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 17:41 ` Naresh Kamboju
2020-07-20 15:38 ` [PATCH 5.7 234/244] rxrpc: Fix trace string Greg Kroah-Hartman
` (11 subsequent siblings)
244 siblings, 1 reply; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Atish Patra, Michel Lespinasse,
Zong Li, Palmer Dabbelt
From: Atish Patra <atish.patra@wdc.com>
commit 0e2c09011d4de4161f615ff860a605a9186cf62a upstream.
As per walk_page_range documentation, mmap lock should be acquired by the
caller before invoking walk_page_range. mmap_assert_locked gets triggered
without that. The details can be found here.
http://lists.infradead.org/pipermail/linux-riscv/2020-June/010335.html
Fixes: 395a21ff859c(riscv: add ARCH_HAS_SET_DIRECT_MAP support)
Signed-off-by: Atish Patra <atish.patra@wdc.com>
Reviewed-by: Michel Lespinasse <walken@google.com>
Reviewed-by: Zong Li <zong.li@sifive.com>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/mm/pageattr.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/arch/riscv/mm/pageattr.c
+++ b/arch/riscv/mm/pageattr.c
@@ -151,6 +151,7 @@ int set_memory_nx(unsigned long addr, in
int set_direct_map_invalid_noflush(struct page *page)
{
+ int ret;
unsigned long start = (unsigned long)page_address(page);
unsigned long end = start + PAGE_SIZE;
struct pageattr_masks masks = {
@@ -158,11 +159,16 @@ int set_direct_map_invalid_noflush(struc
.clear_mask = __pgprot(_PAGE_PRESENT)
};
- return walk_page_range(&init_mm, start, end, &pageattr_ops, &masks);
+ mmap_read_lock(&init_mm);
+ ret = walk_page_range(&init_mm, start, end, &pageattr_ops, &masks);
+ mmap_read_unlock(&init_mm);
+
+ return ret;
}
int set_direct_map_default_noflush(struct page *page)
{
+ int ret;
unsigned long start = (unsigned long)page_address(page);
unsigned long end = start + PAGE_SIZE;
struct pageattr_masks masks = {
@@ -170,7 +176,11 @@ int set_direct_map_default_noflush(struc
.clear_mask = __pgprot(0)
};
- return walk_page_range(&init_mm, start, end, &pageattr_ops, &masks);
+ mmap_read_lock(&init_mm);
+ ret = walk_page_range(&init_mm, start, end, &pageattr_ops, &masks);
+ mmap_read_unlock(&init_mm);
+
+ return ret;
}
void __kernel_map_pages(struct page *page, int numpages, int enable)
^ permalink raw reply [flat|nested] 256+ messages in thread* Re: [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range
2020-07-20 15:38 ` [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range Greg Kroah-Hartman
@ 2020-07-20 17:41 ` Naresh Kamboju
2020-07-20 18:50 ` Atish Patra
0 siblings, 1 reply; 256+ messages in thread
From: Naresh Kamboju @ 2020-07-20 17:41 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux- stable
Cc: open list, Atish Patra, Michel Lespinasse, Zong Li,
Palmer Dabbelt, lkft-triage
RISC-V build breaks on stable-rc 5.7 branch.
build failed with gcc-8, gcc-9 and gcc-9.
On Mon, 20 Jul 2020 at 21:46, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> From: Atish Patra <atish.patra@wdc.com>
>
> commit 0e2c09011d4de4161f615ff860a605a9186cf62a upstream.
>
> As per walk_page_range documentation, mmap lock should be acquired by the
> caller before invoking walk_page_range. mmap_assert_locked gets triggered
> without that. The details can be found here.
>
> http://lists.infradead.org/pipermail/linux-riscv/2020-June/010335.html
>
> Fixes: 395a21ff859c(riscv: add ARCH_HAS_SET_DIRECT_MAP support)
> Signed-off-by: Atish Patra <atish.patra@wdc.com>
> Reviewed-by: Michel Lespinasse <walken@google.com>
> Reviewed-by: Zong Li <zong.li@sifive.com>
> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> arch/riscv/mm/pageattr.c | 14 ++++++++++++--
> 1 file changed, 12 insertions(+), 2 deletions(-)
>
> --- a/arch/riscv/mm/pageattr.c
> +++ b/arch/riscv/mm/pageattr.c
> @@ -151,6 +151,7 @@ int set_memory_nx(unsigned long addr, in
>
> int set_direct_map_invalid_noflush(struct page *page)
> {
> + int ret;
> unsigned long start = (unsigned long)page_address(page);
> unsigned long end = start + PAGE_SIZE;
> struct pageattr_masks masks = {
> @@ -158,11 +159,16 @@ int set_direct_map_invalid_noflush(struc
> .clear_mask = __pgprot(_PAGE_PRESENT)
> };
>
> - return walk_page_range(&init_mm, start, end, &pageattr_ops, &masks);
> + mmap_read_lock(&init_mm);
> + ret = walk_page_range(&init_mm, start, end, &pageattr_ops, &masks);
> + mmap_read_unlock(&init_mm);
make -sk KBUILD_BUILD_USER=TuxBuild -C/linux ARCH=riscv
CROSS_COMPILE=riscv64-linux-gnu- HOSTCC=gcc CC="sccache
riscv64-linux-gnu-gcc" O=build defconfig
#
#
make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j32 ARCH=riscv
CROSS_COMPILE=riscv64-linux-gnu- HOSTCC=gcc CC="sccache
riscv64-linux-gnu-gcc" O=build
#
../arch/riscv/mm/pageattr.c: In function ‘set_direct_map_invalid_noflush’:
../arch/riscv/mm/pageattr.c:162:2: error: implicit declaration of
function ‘mmap_read_lock’; did you mean ‘_raw_read_lock’?
[-Werror=implicit-function-declaration]
162 | mmap_read_lock(&init_mm);
| ^~~~~~~~~~~~~~
| _raw_read_lock
../arch/riscv/mm/pageattr.c:164:2: error: implicit declaration of
function ‘mmap_read_unlock’; did you mean ‘_raw_read_unlock’?
[-Werror=implicit-function-declaration]
164 | mmap_read_unlock(&init_mm);
| ^~~~~~~~~~~~~~~~
| _raw_read_unlock
cc1: some warnings being treated as errors
> +
> + return ret;
> }
>
> int set_direct_map_default_noflush(struct page *page)
> {
> + int ret;
> unsigned long start = (unsigned long)page_address(page);
> unsigned long end = start + PAGE_SIZE;
> struct pageattr_masks masks = {
> @@ -170,7 +176,11 @@ int set_direct_map_default_noflush(struc
> .clear_mask = __pgprot(0)
> };
>
> - return walk_page_range(&init_mm, start, end, &pageattr_ops, &masks);
> + mmap_read_lock(&init_mm);
> + ret = walk_page_range(&init_mm, start, end, &pageattr_ops, &masks);
> + mmap_read_unlock(&init_mm);
> +
> + return ret;
> }
>
> void __kernel_map_pages(struct page *page, int numpages, int enable)
>
ref:
full build log with default config.
https://gitlab.com/Linaro/lkft/kernel-runs/-/jobs/647154950
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 256+ messages in thread* Re: [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range
2020-07-20 17:41 ` Naresh Kamboju
@ 2020-07-20 18:50 ` Atish Patra
2020-07-20 19:14 ` gregkh
0 siblings, 1 reply; 256+ messages in thread
From: Atish Patra @ 2020-07-20 18:50 UTC (permalink / raw)
To: naresh.kamboju, gregkh, stable
Cc: walken, palmerdabbelt, linux-kernel, zong.li, lkft-triage
On Mon, 2020-07-20 at 23:11 +0530, Naresh Kamboju wrote:
> RISC-V build breaks on stable-rc 5.7 branch.
> build failed with gcc-8, gcc-9 and gcc-9.
>
Sorry for the compilation issue.
mmap_read_lock was intrdouced in the following commit.
commit 9740ca4e95b4
Author: Michel Lespinasse <walken@google.com>
Date: Mon Jun 8 21:33:14 2020 -0700
mmap locking API: initial implementation as rwsem wrappers
The following two commits replaced the usage of mmap_sem rwsem calls
with mmap_lock.
d8ed45c5dcd4 (mmap locking API: use coccinelle to convert mmap_sem
rwsem call sites)
89154dd5313f (mmap locking API: convert mmap_sem call sites missed by
coccinelle)
The first commit is not present in stale 5.7-y for obvious reasons.
Do we need to send a separate patch only for stable branch with
mmap_sem ? I am not sure if that will cause a conflict again in future.
> On Mon, 20 Jul 2020 at 21:46, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> > From: Atish Patra <atish.patra@wdc.com>
> >
> > commit 0e2c09011d4de4161f615ff860a605a9186cf62a upstream.
> >
> > As per walk_page_range documentation, mmap lock should be acquired
> > by the
> > caller before invoking walk_page_range. mmap_assert_locked gets
> > triggered
> > without that. The details can be found here.
> >
> > http://lists.infradead.org/pipermail/linux-riscv/2020-June/010335.html
> >
> > Fixes: 395a21ff859c(riscv: add ARCH_HAS_SET_DIRECT_MAP support)
> > Signed-off-by: Atish Patra <atish.patra@wdc.com>
> > Reviewed-by: Michel Lespinasse <walken@google.com>
> > Reviewed-by: Zong Li <zong.li@sifive.com>
> > Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> >
> > ---
> > arch/riscv/mm/pageattr.c | 14 ++++++++++++--
> > 1 file changed, 12 insertions(+), 2 deletions(-)
> >
> > --- a/arch/riscv/mm/pageattr.c
> > +++ b/arch/riscv/mm/pageattr.c
> > @@ -151,6 +151,7 @@ int set_memory_nx(unsigned long addr, in
> >
> > int set_direct_map_invalid_noflush(struct page *page)
> > {
> > + int ret;
> > unsigned long start = (unsigned long)page_address(page);
> > unsigned long end = start + PAGE_SIZE;
> > struct pageattr_masks masks = {
> > @@ -158,11 +159,16 @@ int set_direct_map_invalid_noflush(struc
> > .clear_mask = __pgprot(_PAGE_PRESENT)
> > };
> >
> > - return walk_page_range(&init_mm, start, end, &pageattr_ops,
> > &masks);
> > + mmap_read_lock(&init_mm);
> > + ret = walk_page_range(&init_mm, start, end, &pageattr_ops,
> > &masks);
> > + mmap_read_unlock(&init_mm);
>
> make -sk KBUILD_BUILD_USER=TuxBuild -C/linux ARCH=riscv
> CROSS_COMPILE=riscv64-linux-gnu- HOSTCC=gcc CC="sccache
> riscv64-linux-gnu-gcc" O=build defconfig
> #
> #
> make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j32 ARCH=riscv
> CROSS_COMPILE=riscv64-linux-gnu- HOSTCC=gcc CC="sccache
> riscv64-linux-gnu-gcc" O=build
> #
> ../arch/riscv/mm/pageattr.c: In function
> ‘set_direct_map_invalid_noflush’:
> ../arch/riscv/mm/pageattr.c:162:2: error: implicit declaration of
> function ‘mmap_read_lock’; did you mean ‘_raw_read_lock’?
> [-Werror=implicit-function-declaration]
> 162 | mmap_read_lock(&init_mm);
> | ^~~~~~~~~~~~~~
> | _raw_read_lock
> ../arch/riscv/mm/pageattr.c:164:2: error: implicit declaration of
> function ‘mmap_read_unlock’; did you mean ‘_raw_read_unlock’?
> [-Werror=implicit-function-declaration]
> 164 | mmap_read_unlock(&init_mm);
> | ^~~~~~~~~~~~~~~~
> | _raw_read_unlock
> cc1: some warnings being treated as errors
>
> > +
> > + return ret;
> > }
> >
> > int set_direct_map_default_noflush(struct page *page)
> > {
> > + int ret;
> > unsigned long start = (unsigned long)page_address(page);
> > unsigned long end = start + PAGE_SIZE;
> > struct pageattr_masks masks = {
> > @@ -170,7 +176,11 @@ int set_direct_map_default_noflush(struc
> > .clear_mask = __pgprot(0)
> > };
> >
> > - return walk_page_range(&init_mm, start, end, &pageattr_ops,
> > &masks);
> > + mmap_read_lock(&init_mm);
> > + ret = walk_page_range(&init_mm, start, end, &pageattr_ops,
> > &masks);
> > + mmap_read_unlock(&init_mm);
> > +
> > + return ret;
> > }
> >
> > void __kernel_map_pages(struct page *page, int numpages, int
> > enable)
> >
>
> ref:
> full build log with default config.
> https://gitlab.com/Linaro/lkft/kernel-runs/-/jobs/647154950
>
--
Regards,
Atish
^ permalink raw reply [flat|nested] 256+ messages in thread* Re: [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range
2020-07-20 18:50 ` Atish Patra
@ 2020-07-20 19:14 ` gregkh
2020-07-21 22:50 ` Palmer Dabbelt
0 siblings, 1 reply; 256+ messages in thread
From: gregkh @ 2020-07-20 19:14 UTC (permalink / raw)
To: Atish Patra
Cc: naresh.kamboju, stable, walken, palmerdabbelt, linux-kernel,
zong.li, lkft-triage
On Mon, Jul 20, 2020 at 06:50:10PM +0000, Atish Patra wrote:
> On Mon, 2020-07-20 at 23:11 +0530, Naresh Kamboju wrote:
> > RISC-V build breaks on stable-rc 5.7 branch.
> > build failed with gcc-8, gcc-9 and gcc-9.
> >
>
> Sorry for the compilation issue.
>
> mmap_read_lock was intrdouced in the following commit.
>
> commit 9740ca4e95b4
> Author: Michel Lespinasse <walken@google.com>
> Date: Mon Jun 8 21:33:14 2020 -0700
>
> mmap locking API: initial implementation as rwsem wrappers
>
> The following two commits replaced the usage of mmap_sem rwsem calls
> with mmap_lock.
>
> d8ed45c5dcd4 (mmap locking API: use coccinelle to convert mmap_sem
> rwsem call sites)
> 89154dd5313f (mmap locking API: convert mmap_sem call sites missed by
> coccinelle)
>
> The first commit is not present in stale 5.7-y for obvious reasons.
>
> Do we need to send a separate patch only for stable branch with
> mmap_sem ? I am not sure if that will cause a conflict again in future.
I do not like taking odd backports, and would rather take the real patch
that is upstream.
I will drop this patch from the tree now, so everyone can figure out
what they want to do in the future :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 256+ messages in thread
* Re: [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range
2020-07-20 19:14 ` gregkh
@ 2020-07-21 22:50 ` Palmer Dabbelt
2020-07-22 12:48 ` Greg KH
0 siblings, 1 reply; 256+ messages in thread
From: Palmer Dabbelt @ 2020-07-21 22:50 UTC (permalink / raw)
To: Greg KH, walken
Cc: Atish Patra, naresh.kamboju, stable, linux-kernel, zong.li, lkft-triage
On Mon, 20 Jul 2020 12:14:03 PDT (-0700), Greg KH wrote:
> On Mon, Jul 20, 2020 at 06:50:10PM +0000, Atish Patra wrote:
>> On Mon, 2020-07-20 at 23:11 +0530, Naresh Kamboju wrote:
>> > RISC-V build breaks on stable-rc 5.7 branch.
>> > build failed with gcc-8, gcc-9 and gcc-9.
>> >
>>
>> Sorry for the compilation issue.
>>
>> mmap_read_lock was intrdouced in the following commit.
>>
>> commit 9740ca4e95b4
>> Author: Michel Lespinasse <walken@google.com>
>> Date: Mon Jun 8 21:33:14 2020 -0700
>>
>> mmap locking API: initial implementation as rwsem wrappers
>>
>> The following two commits replaced the usage of mmap_sem rwsem calls
>> with mmap_lock.
>>
>> d8ed45c5dcd4 (mmap locking API: use coccinelle to convert mmap_sem
>> rwsem call sites)
>> 89154dd5313f (mmap locking API: convert mmap_sem call sites missed by
>> coccinelle)
>>
>> The first commit is not present in stale 5.7-y for obvious reasons.
>>
>> Do we need to send a separate patch only for stable branch with
>> mmap_sem ? I am not sure if that will cause a conflict again in future.
>
> I do not like taking odd backports, and would rather take the real patch
> that is upstream.
I guess I'm a bit new to stable backports so I'm not sure what's expected here.
The failing patch fixes a bug by using a new interface. The smallest diff fix
for the stable kernels would be to construct a similar fix without the new
interface, which in this case is very easy as the new interface just converted
some generic locking calls to one-line functions. It seems somewhat circuitous
to land that in Linus' tree, though, as it would require breaking our port
before fixing it to use the old interfaces and then cleaning it up to use the
new interfaces.
Are we expected to pull the new interface onto stable in addition to this fix?
The new interface doesn't actually fix anything itself, but it would allow a
functional kernel to be constructed that consisted of only backports from
Linus' tree (which would also make further fixes easier). It seems safe to
just pull in 9740ca4e95b4 ("mmap locking API: initial implementation as rwsem
wrappers") before this failing patch, as in this case the new interface will
function correctly with only a subset of callers having been converted. Of
course that's not a generally true statement so I don't know if future code
will behave that way, but pulling in those conversion patches is definitely
unnecessary diff right now.
> I will drop this patch from the tree now, so everyone can figure out
> what they want to do in the future :)
That certainly seems like the right way to go for now, thanks!
^ permalink raw reply [flat|nested] 256+ messages in thread* Re: [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range
2020-07-21 22:50 ` Palmer Dabbelt
@ 2020-07-22 12:48 ` Greg KH
2020-07-22 15:11 ` Atish Patra
0 siblings, 1 reply; 256+ messages in thread
From: Greg KH @ 2020-07-22 12:48 UTC (permalink / raw)
To: Palmer Dabbelt
Cc: walken, Atish Patra, naresh.kamboju, stable, linux-kernel,
zong.li, lkft-triage
On Tue, Jul 21, 2020 at 03:50:35PM -0700, Palmer Dabbelt wrote:
> On Mon, 20 Jul 2020 12:14:03 PDT (-0700), Greg KH wrote:
> > On Mon, Jul 20, 2020 at 06:50:10PM +0000, Atish Patra wrote:
> > > On Mon, 2020-07-20 at 23:11 +0530, Naresh Kamboju wrote:
> > > > RISC-V build breaks on stable-rc 5.7 branch.
> > > > build failed with gcc-8, gcc-9 and gcc-9.
> > > >
> > >
> > > Sorry for the compilation issue.
> > >
> > > mmap_read_lock was intrdouced in the following commit.
> > >
> > > commit 9740ca4e95b4
> > > Author: Michel Lespinasse <walken@google.com>
> > > Date: Mon Jun 8 21:33:14 2020 -0700
> > >
> > > mmap locking API: initial implementation as rwsem wrappers
> > >
> > > The following two commits replaced the usage of mmap_sem rwsem calls
> > > with mmap_lock.
> > >
> > > d8ed45c5dcd4 (mmap locking API: use coccinelle to convert mmap_sem
> > > rwsem call sites)
> > > 89154dd5313f (mmap locking API: convert mmap_sem call sites missed by
> > > coccinelle)
> > >
> > > The first commit is not present in stale 5.7-y for obvious reasons.
> > >
> > > Do we need to send a separate patch only for stable branch with
> > > mmap_sem ? I am not sure if that will cause a conflict again in future.
> >
> > I do not like taking odd backports, and would rather take the real patch
> > that is upstream.
>
> I guess I'm a bit new to stable backports so I'm not sure what's expected here.
> The failing patch fixes a bug by using a new interface. The smallest diff fix
> for the stable kernels would be to construct a similar fix without the new
> interface, which in this case is very easy as the new interface just converted
> some generic locking calls to one-line functions. It seems somewhat circuitous
> to land that in Linus' tree, though, as it would require breaking our port
> before fixing it to use the old interfaces and then cleaning it up to use the
> new interfaces.
>
> Are we expected to pull the new interface onto stable in addition to this fix?
If it really does fix a big issue, yes, that is fine to do.
> The new interface doesn't actually fix anything itself, but it would allow a
> functional kernel to be constructed that consisted of only backports from
> Linus' tree (which would also make further fixes easier).
That's fine.
> It seems safe to
> just pull in 9740ca4e95b4 ("mmap locking API: initial implementation as rwsem
> wrappers") before this failing patch, as in this case the new interface will
> function correctly with only a subset of callers having been converted. Of
> course that's not a generally true statement so I don't know if future code
> will behave that way, but pulling in those conversion patches is definitely
> unnecessary diff right now.
If someone wants to send me a full set of the git ids that need to be
pulled in, I will be glad to do so.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 256+ messages in thread* Re: [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range
2020-07-22 12:48 ` Greg KH
@ 2020-07-22 15:11 ` Atish Patra
2020-07-23 4:46 ` Stafford Horne
0 siblings, 1 reply; 256+ messages in thread
From: Atish Patra @ 2020-07-22 15:11 UTC (permalink / raw)
To: gregkh, palmerdabbelt
Cc: walken, naresh.kamboju, stable, lkft-triage, linux-kernel,
zong.li, shorne
On Wed, 2020-07-22 at 14:48 +0200, Greg KH wrote:
> On Tue, Jul 21, 2020 at 03:50:35PM -0700, Palmer Dabbelt wrote:
> > On Mon, 20 Jul 2020 12:14:03 PDT (-0700), Greg KH wrote:
> > > On Mon, Jul 20, 2020 at 06:50:10PM +0000, Atish Patra wrote:
> > > > On Mon, 2020-07-20 at 23:11 +0530, Naresh Kamboju wrote:
> > > > > RISC-V build breaks on stable-rc 5.7 branch.
> > > > > build failed with gcc-8, gcc-9 and gcc-9.
> > > > >
> > > >
> > > > Sorry for the compilation issue.
> > > >
> > > > mmap_read_lock was intrdouced in the following commit.
> > > >
> > > > commit 9740ca4e95b4
> > > > Author: Michel Lespinasse <walken@google.com>
> > > > Date: Mon Jun 8 21:33:14 2020 -0700
> > > >
> > > > mmap locking API: initial implementation as rwsem wrappers
> > > >
> > > > The following two commits replaced the usage of mmap_sem rwsem
> > > > calls
> > > > with mmap_lock.
> > > >
> > > > d8ed45c5dcd4 (mmap locking API: use coccinelle to convert
> > > > mmap_sem
> > > > rwsem call sites)
> > > > 89154dd5313f (mmap locking API: convert mmap_sem call sites
> > > > missed by
> > > > coccinelle)
> > > >
> > > > The first commit is not present in stale 5.7-y for obvious
> > > > reasons.
> > > >
> > > > Do we need to send a separate patch only for stable branch with
> > > > mmap_sem ? I am not sure if that will cause a conflict again in
> > > > future.
> > >
> > > I do not like taking odd backports, and would rather take the
> > > real patch
> > > that is upstream.
> >
> > I guess I'm a bit new to stable backports so I'm not sure what's
> > expected here.
> > The failing patch fixes a bug by using a new interface. The
> > smallest diff fix
> > for the stable kernels would be to construct a similar fix without
> > the new
> > interface, which in this case is very easy as the new interface
> > just converted
> > some generic locking calls to one-line functions. It seems
> > somewhat circuitous
> > to land that in Linus' tree, though, as it would require breaking
> > our port
> > before fixing it to use the old interfaces and then cleaning it up
> > to use the
> > new interfaces.
> >
> > Are we expected to pull the new interface onto stable in addition
> > to this fix?
>
> If it really does fix a big issue, yes, that is fine to do.
>
The original issue was manifests only for certain rootfs with
CONFIG_DEBUG_VM enabled in kernel. I am not sure if that qualfies for a
big issue :). But there was a similar fix for OpenRISC as well.
+stafford (who fixed the issue for OpenRISC)
@stafford Was there a request to backport the fix to stable ?
I can combine all the git ids that needs to be pulled in.
> > The new interface doesn't actually fix anything itself, but it
> > would allow a
> > functional kernel to be constructed that consisted of only
> > backports from
> > Linus' tree (which would also make further fixes easier).
>
> That's fine.
>
> > It seems safe to
> > just pull in 9740ca4e95b4 ("mmap locking API: initial
> > implementation as rwsem
> > wrappers") before this failing patch, as in this case the new
> > interface will
> > function correctly with only a subset of callers having been
> > converted. Of
> > course that's not a generally true statement so I don't know if
> > future code
> > will behave that way, but pulling in those conversion patches is
> > definitely
> > unnecessary diff right now.
>
> If someone wants to send me a full set of the git ids that need to be
> pulled in, I will be glad to do so.
>
> thanks,
>
> greg k-h
--
Regards,
Atish
^ permalink raw reply [flat|nested] 256+ messages in thread* Re: [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range
2020-07-22 15:11 ` Atish Patra
@ 2020-07-23 4:46 ` Stafford Horne
2020-07-27 17:31 ` Atish Patra
0 siblings, 1 reply; 256+ messages in thread
From: Stafford Horne @ 2020-07-23 4:46 UTC (permalink / raw)
To: Atish Patra
Cc: gregkh, palmerdabbelt, walken, naresh.kamboju, stable,
lkft-triage, linux-kernel, zong.li
On Wed, Jul 22, 2020 at 03:11:35PM +0000, Atish Patra wrote:
> On Wed, 2020-07-22 at 14:48 +0200, Greg KH wrote:
> > On Tue, Jul 21, 2020 at 03:50:35PM -0700, Palmer Dabbelt wrote:
> > > On Mon, 20 Jul 2020 12:14:03 PDT (-0700), Greg KH wrote:
> > > > On Mon, Jul 20, 2020 at 06:50:10PM +0000, Atish Patra wrote:
> > > > > On Mon, 2020-07-20 at 23:11 +0530, Naresh Kamboju wrote:
> > > > > > RISC-V build breaks on stable-rc 5.7 branch.
> > > > > > build failed with gcc-8, gcc-9 and gcc-9.
> > > > > >
> > > > >
> > > > > Sorry for the compilation issue.
> > > > >
> > > > > mmap_read_lock was intrdouced in the following commit.
> > > > >
> > > > > commit 9740ca4e95b4
> > > > > Author: Michel Lespinasse <walken@google.com>
> > > > > Date: Mon Jun 8 21:33:14 2020 -0700
> > > > >
> > > > > mmap locking API: initial implementation as rwsem wrappers
> > > > >
> > > > > The following two commits replaced the usage of mmap_sem rwsem
> > > > > calls
> > > > > with mmap_lock.
> > > > >
> > > > > d8ed45c5dcd4 (mmap locking API: use coccinelle to convert
> > > > > mmap_sem
> > > > > rwsem call sites)
> > > > > 89154dd5313f (mmap locking API: convert mmap_sem call sites
> > > > > missed by
> > > > > coccinelle)
> > > > >
> > > > > The first commit is not present in stale 5.7-y for obvious
> > > > > reasons.
> > > > >
> > > > > Do we need to send a separate patch only for stable branch with
> > > > > mmap_sem ? I am not sure if that will cause a conflict again in
> > > > > future.
> > > >
> > > > I do not like taking odd backports, and would rather take the
> > > > real patch
> > > > that is upstream.
> > >
> > > I guess I'm a bit new to stable backports so I'm not sure what's
> > > expected here.
> > > The failing patch fixes a bug by using a new interface. The
> > > smallest diff fix
> > > for the stable kernels would be to construct a similar fix without
> > > the new
> > > interface, which in this case is very easy as the new interface
> > > just converted
> > > some generic locking calls to one-line functions. It seems
> > > somewhat circuitous
> > > to land that in Linus' tree, though, as it would require breaking
> > > our port
> > > before fixing it to use the old interfaces and then cleaning it up
> > > to use the
> > > new interfaces.
> > >
> > > Are we expected to pull the new interface onto stable in addition
> > > to this fix?
> >
> > If it really does fix a big issue, yes, that is fine to do.
> >
>
> The original issue was manifests only for certain rootfs with
> CONFIG_DEBUG_VM enabled in kernel. I am not sure if that qualfies for a
> big issue :). But there was a similar fix for OpenRISC as well.
>
> +stafford (who fixed the issue for OpenRISC)
>
> @stafford Was there a request to backport the fix to stable ?
I have not requested pulling my patch to stable. Mine is this one:
313a5257b84c2 ("openrisc: fix boot oops when DEBUG_VM is enabled")
If you cat request that would be great.
> I can combine all the git ids that needs to be pulled in.
Note, mine lists:
Fixes: 42fc541404f2 ("mmap locking API: add mmap_assert_locked() and mmap_assert_write_locked()")
while your's lists:
Fixes: 395a21ff859c(riscv: add ARCH_HAS_SET_DIRECT_MAP support)
That is when the code was introduced to the riscv port, but not the commit that
broke booting.
I think if you list the Fixes as I did when backporting to stable Greg, or his
tools, would also know that the patch depends on the the 42fc541404f2 commit.
Also, I guess there is no problem with listing 2 "Fixes" in the future.
Thanks Atish and Palmer.
-Stafford
> > > The new interface doesn't actually fix anything itself, but it
> > > would allow a
> > > functional kernel to be constructed that consisted of only
> > > backports from
> > > Linus' tree (which would also make further fixes easier).
> >
> > That's fine.
> >
> > > It seems safe to
> > > just pull in 9740ca4e95b4 ("mmap locking API: initial
> > > implementation as rwsem
> > > wrappers") before this failing patch, as in this case the new
> > > interface will
> > > function correctly with only a subset of callers having been
> > > converted. Of
> > > course that's not a generally true statement so I don't know if
> > > future code
> > > will behave that way, but pulling in those conversion patches is
> > > definitely
> > > unnecessary diff right now.
> >
> > If someone wants to send me a full set of the git ids that need to be
> > pulled in, I will be glad to do so.
> >
> > thanks,
> >
> > greg k-h
>
> --
> Regards,
> Atish
^ permalink raw reply [flat|nested] 256+ messages in thread* Re: [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range
2020-07-23 4:46 ` Stafford Horne
@ 2020-07-27 17:31 ` Atish Patra
0 siblings, 0 replies; 256+ messages in thread
From: Atish Patra @ 2020-07-27 17:31 UTC (permalink / raw)
To: shorne, gregkh
Cc: walken, naresh.kamboju, stable, palmerdabbelt, lkft-triage,
linux-kernel, zong.li
On Thu, 2020-07-23 at 13:46 +0900, Stafford Horne wrote:
> On Wed, Jul 22, 2020 at 03:11:35PM +0000, Atish Patra wrote:
> > On Wed, 2020-07-22 at 14:48 +0200, Greg KH wrote:
> > > On Tue, Jul 21, 2020 at 03:50:35PM -0700, Palmer Dabbelt wrote:
> > > > On Mon, 20 Jul 2020 12:14:03 PDT (-0700), Greg KH wrote:
> > > > > On Mon, Jul 20, 2020 at 06:50:10PM +0000, Atish Patra wrote:
> > > > > > On Mon, 2020-07-20 at 23:11 +0530, Naresh Kamboju wrote:
> > > > > > > RISC-V build breaks on stable-rc 5.7 branch.
> > > > > > > build failed with gcc-8, gcc-9 and gcc-9.
> > > > > > >
> > > > > >
> > > > > > Sorry for the compilation issue.
> > > > > >
> > > > > > mmap_read_lock was intrdouced in the following commit.
> > > > > >
> > > > > > commit 9740ca4e95b4
> > > > > > Author: Michel Lespinasse <walken@google.com>
> > > > > > Date: Mon Jun 8 21:33:14 2020 -0700
> > > > > >
> > > > > > mmap locking API: initial implementation as rwsem
> > > > > > wrappers
> > > > > >
> > > > > > The following two commits replaced the usage of mmap_sem
> > > > > > rwsem
> > > > > > calls
> > > > > > with mmap_lock.
> > > > > >
> > > > > > d8ed45c5dcd4 (mmap locking API: use coccinelle to convert
> > > > > > mmap_sem
> > > > > > rwsem call sites)
> > > > > > 89154dd5313f (mmap locking API: convert mmap_sem call sites
> > > > > > missed by
> > > > > > coccinelle)
> > > > > >
> > > > > > The first commit is not present in stale 5.7-y for obvious
> > > > > > reasons.
> > > > > >
> > > > > > Do we need to send a separate patch only for stable branch
> > > > > > with
> > > > > > mmap_sem ? I am not sure if that will cause a conflict
> > > > > > again in
> > > > > > future.
> > > > >
> > > > > I do not like taking odd backports, and would rather take the
> > > > > real patch
> > > > > that is upstream.
> > > >
> > > > I guess I'm a bit new to stable backports so I'm not sure
> > > > what's
> > > > expected here.
> > > > The failing patch fixes a bug by using a new interface. The
> > > > smallest diff fix
> > > > for the stable kernels would be to construct a similar fix
> > > > without
> > > > the new
> > > > interface, which in this case is very easy as the new interface
> > > > just converted
> > > > some generic locking calls to one-line functions. It seems
> > > > somewhat circuitous
> > > > to land that in Linus' tree, though, as it would require
> > > > breaking
> > > > our port
> > > > before fixing it to use the old interfaces and then cleaning it
> > > > up
> > > > to use the
> > > > new interfaces.
> > > >
> > > > Are we expected to pull the new interface onto stable in
> > > > addition
> > > > to this fix?
> > >
> > > If it really does fix a big issue, yes, that is fine to do.
> > >
> >
> > The original issue was manifests only for certain rootfs with
> > CONFIG_DEBUG_VM enabled in kernel. I am not sure if that qualfies
> > for a
> > big issue :). But there was a similar fix for OpenRISC as well.
> >
> > +stafford (who fixed the issue for OpenRISC)
> >
> > @stafford Was there a request to backport the fix to stable ?
>
> I have not requested pulling my patch to stable. Mine is this one:
>
> 313a5257b84c2 ("openrisc: fix boot oops when DEBUG_VM is enabled")
>
> If you cat request that would be great.
>
> > I can combine all the git ids that needs to be pulled in.
>
> Note, mine lists:
>
> Fixes: 42fc541404f2 ("mmap locking API: add mmap_assert_locked()
> and mmap_assert_write_locked()")
>
> while your's lists:
>
> Fixes: 395a21ff859c(riscv: add ARCH_HAS_SET_DIRECT_MAP support)
>
> That is when the code was introduced to the riscv port, but not the
> commit that
> broke booting.
>
> I think if you list the Fixes as I did when backporting to stable
> Greg, or his
> tools, would also know that the patch depends on the the 42fc541404f2
> commit.
>
> Also, I guess there is no problem with listing 2 "Fixes" in the
> future.
>
Thanks. I will keep that in mind in future.
Backporting the RISC-V fix would require the original commit to be
backported as well.
commit 9740ca4e95b4 (mmap locking API: initial implementation as rwsem
wrappers)
However, that is the first commit for big cleanup 12 patch series.
https://lkml.org/lkml/2020/5/20/56
While backporting the first commit (9740ca4e95b4) would solve the
problem for RISC-V, all other architecture fixes won't be there.
Do we want that in stable tree?
> Thanks Atish and Palmer.
>
> -Stafford
>
> > > > The new interface doesn't actually fix anything itself, but it
> > > > would allow a
> > > > functional kernel to be constructed that consisted of only
> > > > backports from
> > > > Linus' tree (which would also make further fixes easier).
> > >
> > > That's fine.
> > >
> > > > It seems safe to
> > > > just pull in 9740ca4e95b4 ("mmap locking API: initial
> > > > implementation as rwsem
> > > > wrappers") before this failing patch, as in this case the new
> > > > interface will
> > > > function correctly with only a subset of callers having been
> > > > converted. Of
> > > > course that's not a generally true statement so I don't know if
> > > > future code
> > > > will behave that way, but pulling in those conversion patches
> > > > is
> > > > definitely
> > > > unnecessary diff right now.
> > >
> > > If someone wants to send me a full set of the git ids that need
> > > to be
> > > pulled in, I will be glad to do so.
> > >
> > > thanks,
> > >
> > > greg k-h
> >
> > --
> > Regards,
> > Atish
--
Regards,
Atish
^ permalink raw reply [flat|nested] 256+ messages in thread
* [PATCH 5.7 234/244] rxrpc: Fix trace string
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 233/244] RISC-V: Acquire mmap lock before invoking walk_page_range Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 235/244] spi: sprd: switch the sequence of setting WDG_LOAD_LOW and _HIGH Greg Kroah-Hartman
` (10 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Howells
From: David Howells <dhowells@redhat.com>
commit aadf9dcef9d4cd68c73a4ab934f93319c4becc47 upstream.
The trace symbol printer (__print_symbolic()) ignores symbols that map to
an empty string and prints the hex value instead.
Fix the symbol for rxrpc_cong_no_change to " -" instead of "" to avoid
this.
Fixes: b54a134a7de4 ("rxrpc: Fix handling of enums-to-string translation in tracing")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/trace/events/rxrpc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -400,7 +400,7 @@ enum rxrpc_tx_point {
EM(rxrpc_cong_begin_retransmission, " Retrans") \
EM(rxrpc_cong_cleared_nacks, " Cleared") \
EM(rxrpc_cong_new_low_nack, " NewLowN") \
- EM(rxrpc_cong_no_change, "") \
+ EM(rxrpc_cong_no_change, " -") \
EM(rxrpc_cong_progress, " Progres") \
EM(rxrpc_cong_retransmit_again, " ReTxAgn") \
EM(rxrpc_cong_rtt_window_end, " RttWinE") \
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 235/244] spi: sprd: switch the sequence of setting WDG_LOAD_LOW and _HIGH
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 234/244] rxrpc: Fix trace string Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 236/244] ionic: no link check while resetting queues Greg Kroah-Hartman
` (9 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lingling Xu, Chunyan Zhang, Mark Brown
From: Lingling Xu <ling_ling.xu@unisoc.com>
commit 8bdd79dae1ff5397351b95e249abcae126572617 upstream.
The watchdog counter consists of WDG_LOAD_LOW and WDG_LOAD_HIGH,
which would be loaded to watchdog counter once writing WDG_LOAD_LOW.
Fixes: ac1775012058 ("spi: sprd: Add the support of restarting the system")
Signed-off-by: Lingling Xu <ling_ling.xu@unisoc.com>
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Link: https://lore.kernel.org/r/20200602082415.5848-1-zhang.lyra@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-sprd-adi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/spi/spi-sprd-adi.c
+++ b/drivers/spi/spi-sprd-adi.c
@@ -389,9 +389,9 @@ static int sprd_adi_restart_handler(stru
sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_CTRL, val);
/* Load the watchdog timeout value, 50ms is always enough. */
+ sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOAD_HIGH, 0);
sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOAD_LOW,
WDG_LOAD_VAL & WDG_LOAD_MASK);
- sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOAD_HIGH, 0);
/* Start the watchdog to reset system */
sprd_adi_read(sadi, sadi->slave_pbase + REG_WDG_CTRL, &val);
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 236/244] ionic: no link check while resetting queues
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 235/244] spi: sprd: switch the sequence of setting WDG_LOAD_LOW and _HIGH Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 237/244] ionic: export features for vlans to use Greg Kroah-Hartman
` (8 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shannon Nelson, Jonathan Toppins,
David S. Miller
From: Shannon Nelson <snelson@pensando.io>
commit 3103b6feb4454646558eedc50ece728bc469f341 upstream.
If the driver is busy resetting queues after a change in
MTU or queue parameters, don't bother checking the link,
wait until the next watchdog cycle.
Fixes: 987c0871e8ae ("ionic: check for linkup in watchdog")
Signed-off-by: Shannon Nelson <snelson@pensando.io>
Acked-by: Jonathan Toppins <jtoppins@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/pensando/ionic/ionic_lif.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -85,7 +85,8 @@ static void ionic_link_status_check(stru
u16 link_status;
bool link_up;
- if (!test_bit(IONIC_LIF_F_LINK_CHECK_REQUESTED, lif->state))
+ if (!test_bit(IONIC_LIF_F_LINK_CHECK_REQUESTED, lif->state) ||
+ test_bit(IONIC_LIF_F_QUEUE_RESET, lif->state))
return;
if (lif->ionic->is_mgmt_nic)
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 237/244] ionic: export features for vlans to use
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 236/244] ionic: no link check while resetting queues Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 238/244] iommu/vt-d: Make Intel SVM code 64-bit only Greg Kroah-Hartman
` (7 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shannon Nelson, Jonathan Toppins,
David S. Miller
From: Shannon Nelson <snelson@pensando.io>
commit ef7232da6bcd4294cbb2d424bc35885721570f01 upstream.
Set up vlan_features for use by any vlans above us.
Fixes: beead698b173 ("ionic: Add the basic NDO callbacks for netdev support")
Signed-off-by: Shannon Nelson <snelson@pensando.io>
Acked-by: Jonathan Toppins <jtoppins@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/pensando/ionic/ionic_lif.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -1236,6 +1236,7 @@ static int ionic_init_nic_features(struc
netdev->hw_features |= netdev->hw_enc_features;
netdev->features |= netdev->hw_features;
+ netdev->vlan_features |= netdev->features & ~NETIF_F_VLAN_FEATURES;
netdev->priv_flags |= IFF_UNICAST_FLT |
IFF_LIVE_ADDR_CHANGE;
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 238/244] iommu/vt-d: Make Intel SVM code 64-bit only
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 237/244] ionic: export features for vlans to use Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 239/244] mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages() Greg Kroah-Hartman
` (6 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joerg Roedel, Lu Baolu
From: Lu Baolu <baolu.lu@linux.intel.com>
commit 9486727f5981a5ec5c0b699fb1777451bd6786e4 upstream.
Current Intel SVM is designed by setting the pgd_t of the processor page
table to FLPTR field of the PASID entry. The first level translation only
supports 4 and 5 level paging structures, hence it's infeasible for the
IOMMU to share a processor's page table when it's running in 32-bit mode.
Let's disable 32bit support for now and claim support only when all the
missing pieces are ready in the future.
Fixes: 1c4f88b7f1f92 ("iommu/vt-d: Shared virtual address in scalable mode")
Suggested-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/20200622231345.29722-2-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -211,7 +211,7 @@ config INTEL_IOMMU_DEBUGFS
config INTEL_IOMMU_SVM
bool "Support for Shared Virtual Memory with Intel IOMMU"
- depends on INTEL_IOMMU && X86
+ depends on INTEL_IOMMU && X86_64
select PCI_PASID
select PCI_PRI
select MMU_NOTIFIER
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 239/244] mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages()
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 238/244] iommu/vt-d: Make Intel SVM code 64-bit only Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 240/244] drm/i915/gvt: Fix two CFL MMIO handling caused by regression Greg Kroah-Hartman
` (5 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arjun Roy, David Rientjes,
Eric Dumazet, Hugh Dickins, Soheil Hassas Yeganeh, Andrew Morton,
Linus Torvalds
From: Arjun Roy <arjunroy@google.com>
commit 7f70c2a68a51496289df163f6969d4db7c383f30 upstream.
Calls to pte_offset_map() in vm_insert_pages() are erroneously not
matched with a call to pte_unmap(). This would cause problems on
architectures where that is not a no-op.
This patch does away with the non-traditional locking in the existing
code, and instead uses pte_offset_map_lock/unlock() as usual,
incrementing PTE as necessary. The PTE pointer is kept within bounds
since we clamp it with PTRS_PER_PTE.
Link: http://lkml.kernel.org/r/20200618220446.20284-1-arjunroy.kdev@gmail.com
Fixes: 8cd3984d81d5 ("mm/memory.c: add vm_insert_pages()")
Signed-off-by: Arjun Roy <arjunroy@google.com>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memory.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1501,7 +1501,7 @@ out:
}
#ifdef pte_index
-static int insert_page_in_batch_locked(struct mm_struct *mm, pmd_t *pmd,
+static int insert_page_in_batch_locked(struct mm_struct *mm, pte_t *pte,
unsigned long addr, struct page *page, pgprot_t prot)
{
int err;
@@ -1509,8 +1509,9 @@ static int insert_page_in_batch_locked(s
if (!page_count(page))
return -EINVAL;
err = validate_page_before_insert(page);
- return err ? err : insert_page_into_pte_locked(
- mm, pte_offset_map(pmd, addr), addr, page, prot);
+ if (err)
+ return err;
+ return insert_page_into_pte_locked(mm, pte, addr, page, prot);
}
/* insert_pages() amortizes the cost of spinlock operations
@@ -1520,7 +1521,8 @@ static int insert_pages(struct vm_area_s
struct page **pages, unsigned long *num, pgprot_t prot)
{
pmd_t *pmd = NULL;
- spinlock_t *pte_lock = NULL;
+ pte_t *start_pte, *pte;
+ spinlock_t *pte_lock;
struct mm_struct *const mm = vma->vm_mm;
unsigned long curr_page_idx = 0;
unsigned long remaining_pages_total = *num;
@@ -1539,18 +1541,17 @@ more:
ret = -ENOMEM;
if (pte_alloc(mm, pmd))
goto out;
- pte_lock = pte_lockptr(mm, pmd);
while (pages_to_write_in_pmd) {
int pte_idx = 0;
const int batch_size = min_t(int, pages_to_write_in_pmd, 8);
- spin_lock(pte_lock);
- for (; pte_idx < batch_size; ++pte_idx) {
- int err = insert_page_in_batch_locked(mm, pmd,
+ start_pte = pte_offset_map_lock(mm, pmd, addr, &pte_lock);
+ for (pte = start_pte; pte_idx < batch_size; ++pte, ++pte_idx) {
+ int err = insert_page_in_batch_locked(mm, pte,
addr, pages[curr_page_idx], prot);
if (unlikely(err)) {
- spin_unlock(pte_lock);
+ pte_unmap_unlock(start_pte, pte_lock);
ret = err;
remaining_pages_total -= pte_idx;
goto out;
@@ -1558,7 +1559,7 @@ more:
addr += PAGE_SIZE;
++curr_page_idx;
}
- spin_unlock(pte_lock);
+ pte_unmap_unlock(start_pte, pte_lock);
pages_to_write_in_pmd -= batch_size;
remaining_pages_total -= batch_size;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 240/244] drm/i915/gvt: Fix two CFL MMIO handling caused by regression.
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 239/244] mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages() Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 241/244] gpio: pca953x: disable regmap locking for automatic address incrementing Greg Kroah-Hartman
` (4 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhenyu Wang, Colin Xu
From: Colin Xu <colin.xu@intel.com>
commit fccd0f7cf4d532674d727c7f204f038456675dee upstream.
D_CFL was incorrectly removed for:
GAMT_CHKN_BIT_REG
GEN9_CTX_PREEMPT_REG
V2: Update commit message.
V3: Rebase and split Fixes and mis-handled MMIO.
Fixes: 43226e6fe798 (drm/i915/gvt: replaced register address with name)
Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Colin Xu <colin.xu@intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20200601030638.16002-1-colin.xu@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/gvt/handlers.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -3131,8 +3131,8 @@ static int init_skl_mmio_info(struct int
MMIO_DFH(GEN9_WM_CHICKEN3, D_SKL_PLUS, F_MODE_MASK | F_CMD_ACCESS,
NULL, NULL);
- MMIO_D(GAMT_CHKN_BIT_REG, D_KBL);
- MMIO_D(GEN9_CTX_PREEMPT_REG, D_KBL | D_SKL);
+ MMIO_D(GAMT_CHKN_BIT_REG, D_KBL | D_CFL);
+ MMIO_D(GEN9_CTX_PREEMPT_REG, D_SKL_PLUS);
return 0;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 241/244] gpio: pca953x: disable regmap locking for automatic address incrementing
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 240/244] drm/i915/gvt: Fix two CFL MMIO handling caused by regression Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 242/244] bpf: sockmap: Check value of unused args to BPF_PROG_ATTACH Greg Kroah-Hartman
` (3 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König,
Andy Shevchenko, Bartosz Golaszewski
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
commit ec3decd21380081e3b5de4ba8d85d90a95f201a0 upstream.
It's a repetition of the commit aa58a21ae378
("gpio: pca953x: disable regmap locking")
which states the following:
This driver uses its own locking but regmap silently uses
a mutex for all operations too. Add the option to disable
locking to the regmap config struct.
Fixes: bcf41dc480b1 ("gpio: pca953x: fix handling of automatic address incrementing")
Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-pca953x.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -399,6 +399,7 @@ static const struct regmap_config pca953
.writeable_reg = pca953x_writeable_register,
.volatile_reg = pca953x_volatile_register,
+ .disable_locking = true,
.cache_type = REGCACHE_RBTREE,
.max_register = 0x7f,
};
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 242/244] bpf: sockmap: Check value of unused args to BPF_PROG_ATTACH
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 241/244] gpio: pca953x: disable regmap locking for automatic address incrementing Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 243/244] bpf: sockmap: Require attach_bpf_fd when detaching a program Greg Kroah-Hartman
` (2 subsequent siblings)
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lorenz Bauer, Alexei Starovoitov
From: Lorenz Bauer <lmb@cloudflare.com>
commit 9b2b09717e1812e450782a43ca0c2790651cf380 upstream.
Using BPF_PROG_ATTACH on a sockmap program currently understands no
flags or replace_bpf_fd, but accepts any value. Return EINVAL instead.
Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200629095630.7933-4-lmb@cloudflare.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/sock_map.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -70,6 +70,9 @@ int sock_map_get_from_fd(const union bpf
struct fd f;
int ret;
+ if (attr->attach_flags || attr->replace_bpf_fd)
+ return -EINVAL;
+
f = fdget(ufd);
map = __bpf_map_get(f);
if (IS_ERR(map))
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 243/244] bpf: sockmap: Require attach_bpf_fd when detaching a program
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 242/244] bpf: sockmap: Check value of unused args to BPF_PROG_ATTACH Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-20 15:38 ` [PATCH 5.7 244/244] drm/i915/perf: Use GTT when saving/restoring engine GPR Greg Kroah-Hartman
2020-07-21 13:06 ` [PATCH 5.7 000/244] 5.7.10-rc1 review Thierry Reding
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lorenz Bauer, Alexei Starovoitov
From: Lorenz Bauer <lmb@cloudflare.com>
commit bb0de3131f4c60a9bf976681e0fe4d1e55c7a821 upstream.
The sockmap code currently ignores the value of attach_bpf_fd when
detaching a program. This is contrary to the usual behaviour of
checking that attach_bpf_fd represents the currently attached
program.
Ensure that attach_bpf_fd is indeed the currently attached
program. It turns out that all sockmap selftests already do this,
which indicates that this is unlikely to cause breakage.
Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200629095630.7933-5-lmb@cloudflare.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/bpf.h | 13 +++++++++++--
include/linux/skmsg.h | 13 +++++++++++++
kernel/bpf/syscall.c | 2 +-
net/core/sock_map.c | 50 +++++++++++++++++++++++++++++++++++++++++++++-----
4 files changed, 70 insertions(+), 8 deletions(-)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1444,13 +1444,16 @@ static inline void bpf_map_offload_map_f
#endif /* CONFIG_NET && CONFIG_BPF_SYSCALL */
#if defined(CONFIG_BPF_STREAM_PARSER)
-int sock_map_prog_update(struct bpf_map *map, struct bpf_prog *prog, u32 which);
+int sock_map_prog_update(struct bpf_map *map, struct bpf_prog *prog,
+ struct bpf_prog *old, u32 which);
int sock_map_get_from_fd(const union bpf_attr *attr, struct bpf_prog *prog);
+int sock_map_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype);
void sock_map_unhash(struct sock *sk);
void sock_map_close(struct sock *sk, long timeout);
#else
static inline int sock_map_prog_update(struct bpf_map *map,
- struct bpf_prog *prog, u32 which)
+ struct bpf_prog *prog,
+ struct bpf_prog *old, u32 which)
{
return -EOPNOTSUPP;
}
@@ -1460,6 +1463,12 @@ static inline int sock_map_get_from_fd(c
{
return -EINVAL;
}
+
+static inline int sock_map_prog_detach(const union bpf_attr *attr,
+ enum bpf_prog_type ptype)
+{
+ return -EOPNOTSUPP;
+}
#endif /* CONFIG_BPF_STREAM_PARSER */
#if defined(CONFIG_INET) && defined(CONFIG_BPF_SYSCALL)
--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -430,6 +430,19 @@ static inline void psock_set_prog(struct
bpf_prog_put(prog);
}
+static inline int psock_replace_prog(struct bpf_prog **pprog,
+ struct bpf_prog *prog,
+ struct bpf_prog *old)
+{
+ if (cmpxchg(pprog, old, prog) != old)
+ return -ENOENT;
+
+ if (old)
+ bpf_prog_put(old);
+
+ return 0;
+}
+
static inline void psock_progs_drop(struct sk_psock_progs *progs)
{
psock_set_prog(&progs->msg_parser, NULL);
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2695,7 +2695,7 @@ static int bpf_prog_detach(const union b
switch (ptype) {
case BPF_PROG_TYPE_SK_MSG:
case BPF_PROG_TYPE_SK_SKB:
- return sock_map_get_from_fd(attr, NULL);
+ return sock_map_prog_detach(attr, ptype);
case BPF_PROG_TYPE_LIRC_MODE2:
return lirc_prog_detach(attr);
case BPF_PROG_TYPE_FLOW_DISSECTOR:
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -77,7 +77,42 @@ int sock_map_get_from_fd(const union bpf
map = __bpf_map_get(f);
if (IS_ERR(map))
return PTR_ERR(map);
- ret = sock_map_prog_update(map, prog, attr->attach_type);
+ ret = sock_map_prog_update(map, prog, NULL, attr->attach_type);
+ fdput(f);
+ return ret;
+}
+
+int sock_map_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype)
+{
+ u32 ufd = attr->target_fd;
+ struct bpf_prog *prog;
+ struct bpf_map *map;
+ struct fd f;
+ int ret;
+
+ if (attr->attach_flags || attr->replace_bpf_fd)
+ return -EINVAL;
+
+ f = fdget(ufd);
+ map = __bpf_map_get(f);
+ if (IS_ERR(map))
+ return PTR_ERR(map);
+
+ prog = bpf_prog_get(attr->attach_bpf_fd);
+ if (IS_ERR(prog)) {
+ ret = PTR_ERR(prog);
+ goto put_map;
+ }
+
+ if (prog->type != ptype) {
+ ret = -EINVAL;
+ goto put_prog;
+ }
+
+ ret = sock_map_prog_update(map, NULL, prog, attr->attach_type);
+put_prog:
+ bpf_prog_put(prog);
+put_map:
fdput(f);
return ret;
}
@@ -1192,27 +1227,32 @@ static struct sk_psock_progs *sock_map_p
}
int sock_map_prog_update(struct bpf_map *map, struct bpf_prog *prog,
- u32 which)
+ struct bpf_prog *old, u32 which)
{
struct sk_psock_progs *progs = sock_map_progs(map);
+ struct bpf_prog **pprog;
if (!progs)
return -EOPNOTSUPP;
switch (which) {
case BPF_SK_MSG_VERDICT:
- psock_set_prog(&progs->msg_parser, prog);
+ pprog = &progs->msg_parser;
break;
case BPF_SK_SKB_STREAM_PARSER:
- psock_set_prog(&progs->skb_parser, prog);
+ pprog = &progs->skb_parser;
break;
case BPF_SK_SKB_STREAM_VERDICT:
- psock_set_prog(&progs->skb_verdict, prog);
+ pprog = &progs->skb_verdict;
break;
default:
return -EOPNOTSUPP;
}
+ if (old)
+ return psock_replace_prog(pprog, prog, old);
+
+ psock_set_prog(pprog, prog);
return 0;
}
^ permalink raw reply [flat|nested] 256+ messages in thread* [PATCH 5.7 244/244] drm/i915/perf: Use GTT when saving/restoring engine GPR
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 243/244] bpf: sockmap: Require attach_bpf_fd when detaching a program Greg Kroah-Hartman
@ 2020-07-20 15:38 ` Greg Kroah-Hartman
2020-07-21 13:06 ` [PATCH 5.7 000/244] 5.7.10-rc1 review Thierry Reding
244 siblings, 0 replies; 256+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-20 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Prathap Kumar Valsan,
Umesh Nerlige Ramappa, Lionel Landwerlin, Chris Wilson,
Jani Nikula
From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
commit aee62e02c48bd62b9b07f5e297ecfc9aaa964937 upstream.
MI_STORE_REGISTER_MEM and MI_LOAD_REGISTER_MEM need to know which
translation to use when saving restoring the engine general purpose
registers to and from the GT scratch. Since GT scratch is mapped to
ggtt, we need to set an additional bit in the command to use GTT.
Fixes: daed3e44396d17 ("drm/i915/perf: implement active wait for noa configurations")
Suggested-by: Prathap Kumar Valsan <prathap.kumar.valsan@intel.com>
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20200709224504.11345-1-chris@chris-wilson.co.uk
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
(cherry picked from commit e43ff99c8deda85234e6233e0f4af6cb09566a37)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_perf.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -1645,6 +1645,7 @@ static u32 *save_restore_register(struct
u32 d;
cmd = save ? MI_STORE_REGISTER_MEM : MI_LOAD_REGISTER_MEM;
+ cmd |= MI_SRM_LRM_GLOBAL_GTT;
if (INTEL_GEN(stream->perf->i915) >= 8)
cmd++;
^ permalink raw reply [flat|nested] 256+ messages in thread* Re: [PATCH 5.7 000/244] 5.7.10-rc1 review
2020-07-20 15:34 [PATCH 5.7 000/244] 5.7.10-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2020-07-20 15:38 ` [PATCH 5.7 244/244] drm/i915/perf: Use GTT when saving/restoring engine GPR Greg Kroah-Hartman
@ 2020-07-21 13:06 ` Thierry Reding
244 siblings, 0 replies; 256+ messages in thread
From: Thierry Reding @ 2020-07-21 13:06 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
[-- Attachment #1: Type: text/plain, Size: 1214 bytes --]
On Mon, Jul 20, 2020 at 05:34:31PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.7.10 release.
> There are 244 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.7.10-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.7.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests are passing for Tegra ...
Test results for stable-v5.7:
11 builds: 11 pass, 0 fail
26 boots: 26 pass, 0 fail
56 tests: 56 pass, 0 fail
Linux version: 5.7.10-rc1-gd3c98742b46c
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04
Cheers,
Thierry
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 256+ messages in thread