* [PATCH 6.1 001/193] dma-buf: fix dma_buf_export init order v2
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 002/193] btrfs: fix trace event name typo for FLUSH_DELAYED_REFS Greg Kroah-Hartman
` (200 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König,
Michael J. Ruhl, T.J. Mercier, Sumit Semwal, Sasha Levin
From: Christian König <christian.koenig@amd.com>
[ Upstream commit f728a5ea27c92133893590e731ce10f6561ced87 ]
The init order and resulting error handling in dma_buf_export
was pretty messy.
Subordinate objects like the file and the sysfs kernel objects
were initializing and wiring itself up with the object in the
wrong order resulting not only in complicating and partially
incorrect error handling, but also in publishing only halve
initialized DMA-buf objects.
Clean this up thoughtfully by allocating the file independent
of the DMA-buf object. Then allocate and initialize the DMA-buf
object itself, before publishing it through sysfs. If everything
works as expected the file is then connected with the DMA-buf
object and publish it through debugfs.
Also adds the missing dma_resv_fini() into the error handling.
v2: add some missing changes to dma_bug_getfile() and a missing NULL
check in dma_buf_file_release()
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Reviewed-by: T.J. Mercier <tjmercier@google.com>
Acked-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20221209071535.933698-1-christian.koenig@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma-buf/dma-buf-sysfs-stats.c | 7 +--
drivers/dma-buf/dma-buf-sysfs-stats.h | 4 +-
drivers/dma-buf/dma-buf.c | 84 +++++++++++++--------------
3 files changed, 43 insertions(+), 52 deletions(-)
diff --git a/drivers/dma-buf/dma-buf-sysfs-stats.c b/drivers/dma-buf/dma-buf-sysfs-stats.c
index 2bba0babcb62..4b680e10c15a 100644
--- a/drivers/dma-buf/dma-buf-sysfs-stats.c
+++ b/drivers/dma-buf/dma-buf-sysfs-stats.c
@@ -168,14 +168,11 @@ void dma_buf_uninit_sysfs_statistics(void)
kset_unregister(dma_buf_stats_kset);
}
-int dma_buf_stats_setup(struct dma_buf *dmabuf)
+int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file)
{
struct dma_buf_sysfs_entry *sysfs_entry;
int ret;
- if (!dmabuf || !dmabuf->file)
- return -EINVAL;
-
if (!dmabuf->exp_name) {
pr_err("exporter name must not be empty if stats needed\n");
return -EINVAL;
@@ -192,7 +189,7 @@ int dma_buf_stats_setup(struct dma_buf *dmabuf)
/* create the directory for buffer stats */
ret = kobject_init_and_add(&sysfs_entry->kobj, &dma_buf_ktype, NULL,
- "%lu", file_inode(dmabuf->file)->i_ino);
+ "%lu", file_inode(file)->i_ino);
if (ret)
goto err_sysfs_dmabuf;
diff --git a/drivers/dma-buf/dma-buf-sysfs-stats.h b/drivers/dma-buf/dma-buf-sysfs-stats.h
index a49c6e2650cc..7a8a995b75ba 100644
--- a/drivers/dma-buf/dma-buf-sysfs-stats.h
+++ b/drivers/dma-buf/dma-buf-sysfs-stats.h
@@ -13,7 +13,7 @@
int dma_buf_init_sysfs_statistics(void);
void dma_buf_uninit_sysfs_statistics(void);
-int dma_buf_stats_setup(struct dma_buf *dmabuf);
+int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file);
void dma_buf_stats_teardown(struct dma_buf *dmabuf);
#else
@@ -25,7 +25,7 @@ static inline int dma_buf_init_sysfs_statistics(void)
static inline void dma_buf_uninit_sysfs_statistics(void) {}
-static inline int dma_buf_stats_setup(struct dma_buf *dmabuf)
+static inline int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file)
{
return 0;
}
diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index e6f36c014c4c..eb6b59363c4f 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -95,10 +95,11 @@ static int dma_buf_file_release(struct inode *inode, struct file *file)
return -EINVAL;
dmabuf = file->private_data;
-
- mutex_lock(&db_list.lock);
- list_del(&dmabuf->list_node);
- mutex_unlock(&db_list.lock);
+ if (dmabuf) {
+ mutex_lock(&db_list.lock);
+ list_del(&dmabuf->list_node);
+ mutex_unlock(&db_list.lock);
+ }
return 0;
}
@@ -523,17 +524,17 @@ static inline int is_dma_buf_file(struct file *file)
return file->f_op == &dma_buf_fops;
}
-static struct file *dma_buf_getfile(struct dma_buf *dmabuf, int flags)
+static struct file *dma_buf_getfile(size_t size, int flags)
{
static atomic64_t dmabuf_inode = ATOMIC64_INIT(0);
- struct file *file;
struct inode *inode = alloc_anon_inode(dma_buf_mnt->mnt_sb);
+ struct file *file;
if (IS_ERR(inode))
return ERR_CAST(inode);
- inode->i_size = dmabuf->size;
- inode_set_bytes(inode, dmabuf->size);
+ inode->i_size = size;
+ inode_set_bytes(inode, size);
/*
* The ->i_ino acquired from get_next_ino() is not unique thus
@@ -547,8 +548,6 @@ static struct file *dma_buf_getfile(struct dma_buf *dmabuf, int flags)
flags, &dma_buf_fops);
if (IS_ERR(file))
goto err_alloc_file;
- file->private_data = dmabuf;
- file->f_path.dentry->d_fsdata = dmabuf;
return file;
@@ -614,19 +613,11 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
size_t alloc_size = sizeof(struct dma_buf);
int ret;
- if (!exp_info->resv)
- alloc_size += sizeof(struct dma_resv);
- else
- /* prevent &dma_buf[1] == dma_buf->resv */
- alloc_size += 1;
-
- if (WARN_ON(!exp_info->priv
- || !exp_info->ops
- || !exp_info->ops->map_dma_buf
- || !exp_info->ops->unmap_dma_buf
- || !exp_info->ops->release)) {
+ if (WARN_ON(!exp_info->priv || !exp_info->ops
+ || !exp_info->ops->map_dma_buf
+ || !exp_info->ops->unmap_dma_buf
+ || !exp_info->ops->release))
return ERR_PTR(-EINVAL);
- }
if (WARN_ON(exp_info->ops->cache_sgt_mapping &&
(exp_info->ops->pin || exp_info->ops->unpin)))
@@ -638,10 +629,21 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
if (!try_module_get(exp_info->owner))
return ERR_PTR(-ENOENT);
+ file = dma_buf_getfile(exp_info->size, exp_info->flags);
+ if (IS_ERR(file)) {
+ ret = PTR_ERR(file);
+ goto err_module;
+ }
+
+ if (!exp_info->resv)
+ alloc_size += sizeof(struct dma_resv);
+ else
+ /* prevent &dma_buf[1] == dma_buf->resv */
+ alloc_size += 1;
dmabuf = kzalloc(alloc_size, GFP_KERNEL);
if (!dmabuf) {
ret = -ENOMEM;
- goto err_module;
+ goto err_file;
}
dmabuf->priv = exp_info->priv;
@@ -653,44 +655,36 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
init_waitqueue_head(&dmabuf->poll);
dmabuf->cb_in.poll = dmabuf->cb_out.poll = &dmabuf->poll;
dmabuf->cb_in.active = dmabuf->cb_out.active = 0;
+ mutex_init(&dmabuf->lock);
+ INIT_LIST_HEAD(&dmabuf->attachments);
if (!resv) {
- resv = (struct dma_resv *)&dmabuf[1];
- dma_resv_init(resv);
+ dmabuf->resv = (struct dma_resv *)&dmabuf[1];
+ dma_resv_init(dmabuf->resv);
+ } else {
+ dmabuf->resv = resv;
}
- dmabuf->resv = resv;
- file = dma_buf_getfile(dmabuf, exp_info->flags);
- if (IS_ERR(file)) {
- ret = PTR_ERR(file);
+ ret = dma_buf_stats_setup(dmabuf, file);
+ if (ret)
goto err_dmabuf;
- }
+ file->private_data = dmabuf;
+ file->f_path.dentry->d_fsdata = dmabuf;
dmabuf->file = file;
- mutex_init(&dmabuf->lock);
- INIT_LIST_HEAD(&dmabuf->attachments);
-
mutex_lock(&db_list.lock);
list_add(&dmabuf->list_node, &db_list.head);
mutex_unlock(&db_list.lock);
- ret = dma_buf_stats_setup(dmabuf);
- if (ret)
- goto err_sysfs;
-
return dmabuf;
-err_sysfs:
- /*
- * Set file->f_path.dentry->d_fsdata to NULL so that when
- * dma_buf_release() gets invoked by dentry_ops, it exits
- * early before calling the release() dma_buf op.
- */
- file->f_path.dentry->d_fsdata = NULL;
- fput(file);
err_dmabuf:
+ if (!resv)
+ dma_resv_fini(dmabuf->resv);
kfree(dmabuf);
+err_file:
+ fput(file);
err_module:
module_put(exp_info->owner);
return ERR_PTR(ret);
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 002/193] btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 001/193] dma-buf: fix dma_buf_export init order v2 Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 003/193] wifi: iwlwifi: fw: skip PPAG for JF Greg Kroah-Hartman
` (199 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn, Naohiro Aota,
David Sterba, Sasha Levin
From: Naohiro Aota <naohiro.aota@wdc.com>
[ Upstream commit 0a3212de8ab3e2ce5808c6265855e528d4a6767b ]
Fix a typo of printing FLUSH_DELAYED_REFS event in flush_space() as
FLUSH_ELAYED_REFS.
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/trace/events/btrfs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
index ed50e81174bf..5e10b5b1d16c 100644
--- a/include/trace/events/btrfs.h
+++ b/include/trace/events/btrfs.h
@@ -98,7 +98,7 @@ struct raid56_bio_trace_info;
EM( FLUSH_DELALLOC_WAIT, "FLUSH_DELALLOC_WAIT") \
EM( FLUSH_DELALLOC_FULL, "FLUSH_DELALLOC_FULL") \
EM( FLUSH_DELAYED_REFS_NR, "FLUSH_DELAYED_REFS_NR") \
- EM( FLUSH_DELAYED_REFS, "FLUSH_ELAYED_REFS") \
+ EM( FLUSH_DELAYED_REFS, "FLUSH_DELAYED_REFS") \
EM( ALLOC_CHUNK, "ALLOC_CHUNK") \
EM( ALLOC_CHUNK_FORCE, "ALLOC_CHUNK_FORCE") \
EM( RUN_DELAYED_IPUTS, "RUN_DELAYED_IPUTS") \
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 003/193] wifi: iwlwifi: fw: skip PPAG for JF
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 001/193] dma-buf: fix dma_buf_export init order v2 Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 002/193] btrfs: fix trace event name typo for FLUSH_DELAYED_REFS Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 004/193] pNFS/filelayout: Fix coalescing test for single DS Greg Kroah-Hartman
` (198 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Gregory Greenman,
Kalle Valo, Sasha Levin, Íñigo Huguet
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 1c4c0b28b517d778d37900deedfe91088839f07a ]
For JF RFs we don't support PPAG, but many firmware
images lie about it. Always skip support for JF to
avoid firmware errors when sending the command.
Reported-and-tested-by: Íñigo Huguet <ihuguet@redhat.com>
Link: https://lore.kernel.org/linux-wireless/CACT4oufQsqHGp6bah2c4+jPn2wG1oZqY=UKa_TmPx=F6Lxng8Q@mail.gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221213225723.2a43415d8990.I9ac210740a45b41f1b2e15274e1daf4284f2808a@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
index e6d64152c81a..a02e5a67b706 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -1106,6 +1106,11 @@ int iwl_read_ppag_table(struct iwl_fw_runtime *fwrt, union iwl_ppag_table_cmd *c
int i, j, num_sub_bands;
s8 *gain;
+ /* many firmware images for JF lie about this */
+ if (CSR_HW_RFID_TYPE(fwrt->trans->hw_rf_id) ==
+ CSR_HW_RFID_TYPE(CSR_HW_RF_ID_TYPE_JF))
+ return -EOPNOTSUPP;
+
if (!fw_has_capa(&fwrt->fw->ucode_capa, IWL_UCODE_TLV_CAPA_SET_PPAG)) {
IWL_DEBUG_RADIO(fwrt,
"PPAG capability not supported by FW, command not sent.\n");
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 004/193] pNFS/filelayout: Fix coalescing test for single DS
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 003/193] wifi: iwlwifi: fw: skip PPAG for JF Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 005/193] selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID Greg Kroah-Hartman
` (197 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Kornievskaia, Trond Myklebust,
Sasha Levin
From: Olga Kornievskaia <olga.kornievskaia@gmail.com>
[ Upstream commit a6b9d2fa0024e7e399c26facd0fb466b7396e2b9 ]
When there is a single DS no striping constraints need to be placed on
the IO. When such constraint is applied then buffered reads don't
coalesce to the DS's rsize.
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/filelayout/filelayout.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index ad34a33b0737..4974cd18ca46 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -783,6 +783,12 @@ filelayout_alloc_lseg(struct pnfs_layout_hdr *layoutid,
return &fl->generic_hdr;
}
+static bool
+filelayout_lseg_is_striped(const struct nfs4_filelayout_segment *flseg)
+{
+ return flseg->num_fh > 1;
+}
+
/*
* filelayout_pg_test(). Called by nfs_can_coalesce_requests()
*
@@ -803,6 +809,8 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
size = pnfs_generic_pg_test(pgio, prev, req);
if (!size)
return 0;
+ else if (!filelayout_lseg_is_striped(FILELAYOUT_LSEG(pgio->pg_lseg)))
+ return size;
/* see if req and prev are in the same stripe */
if (prev) {
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 005/193] selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 004/193] pNFS/filelayout: Fix coalescing test for single DS Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 006/193] net: ethernet: marvell: octeontx2: Fix uninitialized variable warning Greg Kroah-Hartman
` (196 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao Sun, Martin KaFai Lau, Sasha Levin
From: Hao Sun <sunhao.th@gmail.com>
[ Upstream commit cedebd74cf3883f0384af9ec26b4e6f8f1964dd4 ]
Verify that nullness information is not porpagated in the branches
of register to register JEQ and JNE operations if one of them is
PTR_TO_BTF_ID. Implement this in C level so we can use CO-RE.
Signed-off-by: Hao Sun <sunhao.th@gmail.com>
Suggested-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20221222024414.29539-2-sunhao.th@gmail.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../bpf/prog_tests/jeq_infer_not_null.c | 9 ++++
.../bpf/progs/jeq_infer_not_null_fail.c | 42 +++++++++++++++++++
2 files changed, 51 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c
create mode 100644 tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c
diff --git a/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c b/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c
new file mode 100644
index 000000000000..3add34df5767
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <test_progs.h>
+#include "jeq_infer_not_null_fail.skel.h"
+
+void test_jeq_infer_not_null(void)
+{
+ RUN_TESTS(jeq_infer_not_null_fail);
+}
diff --git a/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c b/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c
new file mode 100644
index 000000000000..f46965053acb
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+struct {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __uint(max_entries, 1);
+ __type(key, u64);
+ __type(value, u64);
+} m_hash SEC(".maps");
+
+SEC("?raw_tp")
+__failure __msg("R8 invalid mem access 'map_value_or_null")
+int jeq_infer_not_null_ptr_to_btfid(void *ctx)
+{
+ struct bpf_map *map = (struct bpf_map *)&m_hash;
+ struct bpf_map *inner_map = map->inner_map_meta;
+ u64 key = 0, ret = 0, *val;
+
+ val = bpf_map_lookup_elem(map, &key);
+ /* Do not mark ptr as non-null if one of them is
+ * PTR_TO_BTF_ID (R9), reject because of invalid
+ * access to map value (R8).
+ *
+ * Here, we need to inline those insns to access
+ * R8 directly, since compiler may use other reg
+ * once it figures out val==inner_map.
+ */
+ asm volatile("r8 = %[val];\n"
+ "r9 = %[inner_map];\n"
+ "if r8 != r9 goto +1;\n"
+ "%[ret] = *(u64 *)(r8 +0);\n"
+ : [ret] "+r"(ret)
+ : [inner_map] "r"(inner_map), [val] "r"(val)
+ : "r8", "r9");
+
+ return ret;
+}
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 006/193] net: ethernet: marvell: octeontx2: Fix uninitialized variable warning
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 005/193] selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 007/193] tools/virtio: initialize spinlocks in vring_test.c Greg Kroah-Hartman
` (195 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anuradha Weeraman, David S. Miller,
Sasha Levin
From: Anuradha Weeraman <anuradha@debian.org>
[ Upstream commit d3805695fe1e7383517903715cefc9bbdcffdc90 ]
Fix for uninitialized variable warning.
Addresses-Coverity: ("Uninitialized scalar variable")
Signed-off-by: Anuradha Weeraman <anuradha@debian.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c
index fa8029a94068..eb25e458266c 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c
@@ -589,7 +589,7 @@ int rvu_mbox_handler_mcs_free_resources(struct rvu *rvu,
u16 pcifunc = req->hdr.pcifunc;
struct mcs_rsrc_map *map;
struct mcs *mcs;
- int rc;
+ int rc = 0;
if (req->mcs_id >= rvu->mcs_blk_cnt)
return MCS_AF_ERR_INVALID_MCSID;
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 007/193] tools/virtio: initialize spinlocks in vring_test.c
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 006/193] net: ethernet: marvell: octeontx2: Fix uninitialized variable warning Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 008/193] vdpa/mlx5: Return error on vlan ctrl commands if not supported Greg Kroah-Hartman
` (194 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Cañuelo,
Michael S. Tsirkin, Xuan Zhuo, Sasha Levin
From: Ricardo Cañuelo <ricardo.canuelo@collabora.com>
[ Upstream commit c262f75cb6bb5a63828e72ce3b8fe808e5029479 ]
The virtio_device vqs_list spinlocks must be initialized before use to
prevent functions that manipulate the device virtualqueues, such as
vring_new_virtqueue(), from blocking indefinitely.
Signed-off-by: Ricardo Cañuelo <ricardo.canuelo@collabora.com>
Message-Id: <20221012062949.1526176-1-ricardo.canuelo@collabora.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/virtio/vringh_test.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/virtio/vringh_test.c b/tools/virtio/vringh_test.c
index fa87b58bd5fa..98ff808d6f0c 100644
--- a/tools/virtio/vringh_test.c
+++ b/tools/virtio/vringh_test.c
@@ -308,6 +308,7 @@ static int parallel_test(u64 features,
gvdev.vdev.features = features;
INIT_LIST_HEAD(&gvdev.vdev.vqs);
+ spin_lock_init(&gvdev.vdev.vqs_list_lock);
gvdev.to_host_fd = to_host[1];
gvdev.notifies = 0;
@@ -455,6 +456,7 @@ int main(int argc, char *argv[])
getrange = getrange_iov;
vdev.features = 0;
INIT_LIST_HEAD(&vdev.vqs);
+ spin_lock_init(&vdev.vqs_list_lock);
while (argv[1]) {
if (strcmp(argv[1], "--indirect") == 0)
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 008/193] vdpa/mlx5: Return error on vlan ctrl commands if not supported
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 007/193] tools/virtio: initialize spinlocks in vring_test.c Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 009/193] vdpa/mlx5: Avoid using reslock in event_handler Greg Kroah-Hartman
` (193 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eli Cohen, Michael S. Tsirkin,
Jason Wang, Eugenio Pérez, Sasha Levin
From: Eli Cohen <elic@nvidia.com>
[ Upstream commit 5aec804936bbff182081f1cdc271fcb76af1a4ff ]
Check if VIRTIO_NET_F_CTRL_VLAN is negotiated and return error if
control VQ command is received.
Signed-off-by: Eli Cohen <elic@nvidia.com>
Message-Id: <20221114131759.57883-3-elic@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/mlx5/net/mlx5_vnet.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
index 444d6572b2d0..b06260a37680 100644
--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -1823,6 +1823,9 @@ static virtio_net_ctrl_ack handle_ctrl_vlan(struct mlx5_vdpa_dev *mvdev, u8 cmd)
size_t read;
u16 id;
+ if (!(ndev->mvdev.actual_features & BIT_ULL(VIRTIO_NET_F_CTRL_VLAN)))
+ return status;
+
switch (cmd) {
case VIRTIO_NET_CTRL_VLAN_ADD:
read = vringh_iov_pull_iotlb(&cvq->vring, &cvq->riov, &vlan, sizeof(vlan));
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 009/193] vdpa/mlx5: Avoid using reslock in event_handler
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 008/193] vdpa/mlx5: Return error on vlan ctrl commands if not supported Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 010/193] vdpa/mlx5: Avoid overwriting CVQ iotlb Greg Kroah-Hartman
` (192 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eli Cohen, Michael S. Tsirkin, Sasha Levin
From: Eli Cohen <elic@nvidia.com>
[ Upstream commit 0dbc1b4ae07d003b2e88ba9d4142846320f8e349 ]
event_handler runs under atomic context and may not acquire reslock. We
can still guarantee that the handler won't be called after suspend by
clearing nb_registered, unregistering the handler and flushing the
workqueue.
Signed-off-by: Eli Cohen <elic@nvidia.com>
Message-Id: <20221114131759.57883-5-elic@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/mlx5/net/mlx5_vnet.c | 16 ++++------------
1 file changed, 4 insertions(+), 12 deletions(-)
diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
index b06260a37680..98dd8ce8af26 100644
--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -2845,8 +2845,8 @@ static int mlx5_vdpa_suspend(struct vdpa_device *vdev)
int i;
down_write(&ndev->reslock);
- mlx5_notifier_unregister(mvdev->mdev, &ndev->nb);
ndev->nb_registered = false;
+ mlx5_notifier_unregister(mvdev->mdev, &ndev->nb);
flush_workqueue(ndev->mvdev.wq);
for (i = 0; i < ndev->cur_num_vqs; i++) {
mvq = &ndev->vqs[i];
@@ -3024,7 +3024,7 @@ static void update_carrier(struct work_struct *work)
else
ndev->config.status &= cpu_to_mlx5vdpa16(mvdev, ~VIRTIO_NET_S_LINK_UP);
- if (ndev->config_cb.callback)
+ if (ndev->nb_registered && ndev->config_cb.callback)
ndev->config_cb.callback(ndev->config_cb.private);
kfree(wqent);
@@ -3041,21 +3041,13 @@ static int event_handler(struct notifier_block *nb, unsigned long event, void *p
switch (eqe->sub_type) {
case MLX5_PORT_CHANGE_SUBTYPE_DOWN:
case MLX5_PORT_CHANGE_SUBTYPE_ACTIVE:
- down_read(&ndev->reslock);
- if (!ndev->nb_registered) {
- up_read(&ndev->reslock);
- return NOTIFY_DONE;
- }
wqent = kzalloc(sizeof(*wqent), GFP_ATOMIC);
- if (!wqent) {
- up_read(&ndev->reslock);
+ if (!wqent)
return NOTIFY_DONE;
- }
wqent->mvdev = &ndev->mvdev;
INIT_WORK(&wqent->work, update_carrier);
queue_work(ndev->mvdev.wq, &wqent->work);
- up_read(&ndev->reslock);
ret = NOTIFY_OK;
break;
default:
@@ -3242,8 +3234,8 @@ static void mlx5_vdpa_dev_del(struct vdpa_mgmt_dev *v_mdev, struct vdpa_device *
struct workqueue_struct *wq;
if (ndev->nb_registered) {
- mlx5_notifier_unregister(mvdev->mdev, &ndev->nb);
ndev->nb_registered = false;
+ mlx5_notifier_unregister(mvdev->mdev, &ndev->nb);
}
wq = mvdev->wq;
mvdev->wq = NULL;
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 010/193] vdpa/mlx5: Avoid overwriting CVQ iotlb
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 009/193] vdpa/mlx5: Avoid using reslock in event_handler Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 011/193] virtio_pci: modify ENOENT to EINVAL Greg Kroah-Hartman
` (191 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eugenio Pérez, Eli Cohen,
Michael S. Tsirkin, Jason Wang, Sasha Levin
From: Eli Cohen <elic@nvidia.com>
[ Upstream commit 38fc462f57ef4e5dc722bab6824854b105de8aa2 ]
When qemu uses different address spaces for data and control virtqueues,
the current code would overwrite the control virtqueue iotlb through the
dup_iotlb call. Fix this by referring to the address space identifier
and the group to asid mapping to determine which mapping needs to be
updated. We also move the address space logic from mlx5 net to core
directory.
Reported-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Eli Cohen <elic@nvidia.com>
Message-Id: <20221114131759.57883-6-elic@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/mlx5/core/mlx5_vdpa.h | 5 +--
drivers/vdpa/mlx5/core/mr.c | 44 ++++++++++++++++-----------
drivers/vdpa/mlx5/net/mlx5_vnet.c | 49 ++++++------------------------
3 files changed, 39 insertions(+), 59 deletions(-)
diff --git a/drivers/vdpa/mlx5/core/mlx5_vdpa.h b/drivers/vdpa/mlx5/core/mlx5_vdpa.h
index 6af9fdbb86b7..058fbe28107e 100644
--- a/drivers/vdpa/mlx5/core/mlx5_vdpa.h
+++ b/drivers/vdpa/mlx5/core/mlx5_vdpa.h
@@ -116,8 +116,9 @@ int mlx5_vdpa_create_mkey(struct mlx5_vdpa_dev *mvdev, u32 *mkey, u32 *in,
int inlen);
int mlx5_vdpa_destroy_mkey(struct mlx5_vdpa_dev *mvdev, u32 mkey);
int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
- bool *change_map);
-int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb);
+ bool *change_map, unsigned int asid);
+int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
+ unsigned int asid);
void mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev);
#define mlx5_vdpa_warn(__dev, format, ...) \
diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c
index a639b9208d41..a4d7ee2339fa 100644
--- a/drivers/vdpa/mlx5/core/mr.c
+++ b/drivers/vdpa/mlx5/core/mr.c
@@ -511,7 +511,8 @@ void mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev)
mutex_unlock(&mr->mkey_mtx);
}
-static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb)
+static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev,
+ struct vhost_iotlb *iotlb, unsigned int asid)
{
struct mlx5_vdpa_mr *mr = &mvdev->mr;
int err;
@@ -519,42 +520,49 @@ static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb
if (mr->initialized)
return 0;
- if (iotlb)
- err = create_user_mr(mvdev, iotlb);
- else
- err = create_dma_mr(mvdev, mr);
+ if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] == asid) {
+ if (iotlb)
+ err = create_user_mr(mvdev, iotlb);
+ else
+ err = create_dma_mr(mvdev, mr);
- if (err)
- return err;
+ if (err)
+ return err;
+ }
- err = dup_iotlb(mvdev, iotlb);
- if (err)
- goto out_err;
+ if (mvdev->group2asid[MLX5_VDPA_CVQ_GROUP] == asid) {
+ err = dup_iotlb(mvdev, iotlb);
+ if (err)
+ goto out_err;
+ }
mr->initialized = true;
return 0;
out_err:
- if (iotlb)
- destroy_user_mr(mvdev, mr);
- else
- destroy_dma_mr(mvdev, mr);
+ if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] == asid) {
+ if (iotlb)
+ destroy_user_mr(mvdev, mr);
+ else
+ destroy_dma_mr(mvdev, mr);
+ }
return err;
}
-int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb)
+int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
+ unsigned int asid)
{
int err;
mutex_lock(&mvdev->mr.mkey_mtx);
- err = _mlx5_vdpa_create_mr(mvdev, iotlb);
+ err = _mlx5_vdpa_create_mr(mvdev, iotlb, asid);
mutex_unlock(&mvdev->mr.mkey_mtx);
return err;
}
int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
- bool *change_map)
+ bool *change_map, unsigned int asid)
{
struct mlx5_vdpa_mr *mr = &mvdev->mr;
int err = 0;
@@ -566,7 +574,7 @@ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *io
*change_map = true;
}
if (!*change_map)
- err = _mlx5_vdpa_create_mr(mvdev, iotlb);
+ err = _mlx5_vdpa_create_mr(mvdev, iotlb, asid);
mutex_unlock(&mr->mkey_mtx);
return err;
diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
index 98dd8ce8af26..3a6dbbc6440d 100644
--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -2394,7 +2394,8 @@ static void restore_channels_info(struct mlx5_vdpa_net *ndev)
}
}
-static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb)
+static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev,
+ struct vhost_iotlb *iotlb, unsigned int asid)
{
struct mlx5_vdpa_net *ndev = to_mlx5_vdpa_ndev(mvdev);
int err;
@@ -2406,7 +2407,7 @@ static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb
teardown_driver(ndev);
mlx5_vdpa_destroy_mr(mvdev);
- err = mlx5_vdpa_create_mr(mvdev, iotlb);
+ err = mlx5_vdpa_create_mr(mvdev, iotlb, asid);
if (err)
goto err_mr;
@@ -2587,7 +2588,7 @@ static int mlx5_vdpa_reset(struct vdpa_device *vdev)
++mvdev->generation;
if (MLX5_CAP_GEN(mvdev->mdev, umem_uid_0)) {
- if (mlx5_vdpa_create_mr(mvdev, NULL))
+ if (mlx5_vdpa_create_mr(mvdev, NULL, 0))
mlx5_vdpa_warn(mvdev, "create MR failed\n");
}
up_write(&ndev->reslock);
@@ -2623,41 +2624,20 @@ static u32 mlx5_vdpa_get_generation(struct vdpa_device *vdev)
return mvdev->generation;
}
-static int set_map_control(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb)
-{
- u64 start = 0ULL, last = 0ULL - 1;
- struct vhost_iotlb_map *map;
- int err = 0;
-
- spin_lock(&mvdev->cvq.iommu_lock);
- vhost_iotlb_reset(mvdev->cvq.iotlb);
-
- for (map = vhost_iotlb_itree_first(iotlb, start, last); map;
- map = vhost_iotlb_itree_next(map, start, last)) {
- err = vhost_iotlb_add_range(mvdev->cvq.iotlb, map->start,
- map->last, map->addr, map->perm);
- if (err)
- goto out;
- }
-
-out:
- spin_unlock(&mvdev->cvq.iommu_lock);
- return err;
-}
-
-static int set_map_data(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb)
+static int set_map_data(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
+ unsigned int asid)
{
bool change_map;
int err;
- err = mlx5_vdpa_handle_set_map(mvdev, iotlb, &change_map);
+ err = mlx5_vdpa_handle_set_map(mvdev, iotlb, &change_map, asid);
if (err) {
mlx5_vdpa_warn(mvdev, "set map failed(%d)\n", err);
return err;
}
if (change_map)
- err = mlx5_vdpa_change_map(mvdev, iotlb);
+ err = mlx5_vdpa_change_map(mvdev, iotlb, asid);
return err;
}
@@ -2670,16 +2650,7 @@ static int mlx5_vdpa_set_map(struct vdpa_device *vdev, unsigned int asid,
int err = -EINVAL;
down_write(&ndev->reslock);
- if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] == asid) {
- err = set_map_data(mvdev, iotlb);
- if (err)
- goto out;
- }
-
- if (mvdev->group2asid[MLX5_VDPA_CVQ_GROUP] == asid)
- err = set_map_control(mvdev, iotlb);
-
-out:
+ err = set_map_data(mvdev, iotlb, asid);
up_write(&ndev->reslock);
return err;
}
@@ -3182,7 +3153,7 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name,
goto err_mpfs;
if (MLX5_CAP_GEN(mvdev->mdev, umem_uid_0)) {
- err = mlx5_vdpa_create_mr(mvdev, NULL);
+ err = mlx5_vdpa_create_mr(mvdev, NULL, 0);
if (err)
goto err_res;
}
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 011/193] virtio_pci: modify ENOENT to EINVAL
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 010/193] vdpa/mlx5: Avoid overwriting CVQ iotlb Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 012/193] vduse: Validate vq_num in vduse_validate_config() Greg Kroah-Hartman
` (190 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Angus Chen, Michael S. Tsirkin, Sasha Levin
From: Angus Chen <angus.chen@jaguarmicro.com>
[ Upstream commit b66ead2d0ecac00c3a06a6218af5411cb5fcb5d5 ]
Virtio_crypto use max_data_queues+1 to setup vqs,
we use vp_modern_get_num_queues to protect the vq range in setup_vq.
We could enter index >= vp_modern_get_num_queues(mdev) in setup_vq
if common->num_queues is not set well,and it return -ENOENT.
It is better to use -EINVAL instead.
Signed-off-by: Angus Chen <angus.chen@jaguarmicro.com>
Message-Id: <20221101111655.1947-1-angus.chen@jaguarmicro.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/virtio/virtio_pci_modern.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c
index c3b9f2761849..edf2e18014cd 100644
--- a/drivers/virtio/virtio_pci_modern.c
+++ b/drivers/virtio/virtio_pci_modern.c
@@ -303,7 +303,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
int err;
if (index >= vp_modern_get_num_queues(mdev))
- return ERR_PTR(-ENOENT);
+ return ERR_PTR(-EINVAL);
/* Check if queue is either not available or already active. */
num = vp_modern_get_queue_size(mdev, index);
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 012/193] vduse: Validate vq_num in vduse_validate_config()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 011/193] virtio_pci: modify ENOENT to EINVAL Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 013/193] vdpa_sim_net: should not drop the multicast/broadcast packet Greg Kroah-Hartman
` (189 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael S. Tsirkin,
Harshit Mogalapalli, Jason Wang, Sasha Levin
From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
[ Upstream commit 937c783aa3d8d77963ec91918d3298edb45b9161 ]
Add a limit to 'config->vq_num' which is user controlled data which
comes from an vduse_ioctl to prevent large memory allocations.
Micheal says - This limit is somewhat arbitrary.
However, currently virtio pci and ccw are limited to a 16 bit vq number.
While MMIO isn't it is also isn't used with lots of VQs due to
current lack of support for per-vq interrupts.
Thus, the 0xffff limit on number of VQs corresponding
to a 16-bit VQ number seems sufficient for now.
This is found using static analysis with smatch.
Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Message-Id: <20221128155717.2579992-1-harshit.m.mogalapalli@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/vdpa_user/vduse_dev.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c
index 35dceee3ed56..31017ebc4d7c 100644
--- a/drivers/vdpa/vdpa_user/vduse_dev.c
+++ b/drivers/vdpa/vdpa_user/vduse_dev.c
@@ -1440,6 +1440,9 @@ static bool vduse_validate_config(struct vduse_dev_config *config)
if (config->config_size > PAGE_SIZE)
return false;
+ if (config->vq_num > 0xffff)
+ return false;
+
if (!device_is_allowed(config->device_id))
return false;
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 013/193] vdpa_sim_net: should not drop the multicast/broadcast packet
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 012/193] vduse: Validate vq_num in vduse_validate_config() Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 014/193] net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats Greg Kroah-Hartman
` (188 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cindy Lu, Michael S. Tsirkin,
Jason Wang, Sasha Levin
From: Cindy Lu <lulu@redhat.com>
[ Upstream commit 72455a1142527e607e1d69439f3ffa2ef6d09e26 ]
In the receive_filter(), should not drop the packet with the
broadcast/multicast address. Add the check for this
Signed-off-by: Cindy Lu <lulu@redhat.com>
Message-Id: <20221214054306.24145-1-lulu@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/vdpa_sim/vdpa_sim_net.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim_net.c b/drivers/vdpa/vdpa_sim/vdpa_sim_net.c
index 11f5a121df24..584b975a98a7 100644
--- a/drivers/vdpa/vdpa_sim/vdpa_sim_net.c
+++ b/drivers/vdpa/vdpa_sim/vdpa_sim_net.c
@@ -62,6 +62,9 @@ static bool receive_filter(struct vdpasim *vdpasim, size_t len)
if (len < ETH_ALEN + hdr_len)
return false;
+ if (is_broadcast_ether_addr(vdpasim->buffer + hdr_len) ||
+ is_multicast_ether_addr(vdpasim->buffer + hdr_len))
+ return true;
if (!strncmp(vdpasim->buffer + hdr_len, vio_config->mac, ETH_ALEN))
return true;
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 014/193] net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 013/193] vdpa_sim_net: should not drop the multicast/broadcast packet Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 015/193] r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down() Greg Kroah-Hartman
` (187 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniil Tatianin, Andrew Lunn,
David S. Miller, Sasha Levin
From: Daniil Tatianin <d-tatianin@yandex-team.ru>
[ Upstream commit 9deb1e9fb88b1120a908676fa33bdf9e2eeaefce ]
It's not very useful to copy back an empty ethtool_stats struct and
return 0 if we didn't actually have any stats. This also allows for
further simplification of this function in the future commits.
Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ethtool/ioctl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
index 81fe2422fe58..038398d41a93 100644
--- a/net/ethtool/ioctl.c
+++ b/net/ethtool/ioctl.c
@@ -2094,7 +2094,8 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
return n_stats;
if (n_stats > S32_MAX / sizeof(u64))
return -ENOMEM;
- WARN_ON_ONCE(!n_stats);
+ if (WARN_ON_ONCE(!n_stats))
+ return -EOPNOTSUPP;
if (copy_from_user(&stats, useraddr, sizeof(stats)))
return -EFAULT;
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 015/193] r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 014/193] net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 016/193] r8169: fix dmar pte write access is not set error Greg Kroah-Hartman
` (186 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chunhao Lin, Heiner Kallweit,
David S. Miller, Sasha Levin
From: Chunhao Lin <hau@realtek.com>
[ Upstream commit ad425666a1f05d9b215a84cf010c3789b2ea8206 ]
There is no functional change. Moving these two functions for following
patch "r8169: fix dmar pte write access is not set error".
Signed-off-by: Chunhao Lin <hau@realtek.com>
Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/realtek/r8169_main.c | 44 +++++++++++------------
1 file changed, 22 insertions(+), 22 deletions(-)
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index fe8dc8e0522b..316c925c956f 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -2207,28 +2207,6 @@ static int rtl_set_mac_address(struct net_device *dev, void *p)
return 0;
}
-static void rtl_wol_enable_rx(struct rtl8169_private *tp)
-{
- if (tp->mac_version >= RTL_GIGA_MAC_VER_25)
- RTL_W32(tp, RxConfig, RTL_R32(tp, RxConfig) |
- AcceptBroadcast | AcceptMulticast | AcceptMyPhys);
-}
-
-static void rtl_prepare_power_down(struct rtl8169_private *tp)
-{
- if (tp->dash_type != RTL_DASH_NONE)
- return;
-
- if (tp->mac_version == RTL_GIGA_MAC_VER_32 ||
- tp->mac_version == RTL_GIGA_MAC_VER_33)
- rtl_ephy_write(tp, 0x19, 0xff64);
-
- if (device_may_wakeup(tp_to_dev(tp))) {
- phy_speed_down(tp->phydev, false);
- rtl_wol_enable_rx(tp);
- }
-}
-
static void rtl_init_rxcfg(struct rtl8169_private *tp)
{
switch (tp->mac_version) {
@@ -2452,6 +2430,28 @@ static void rtl_enable_rxdvgate(struct rtl8169_private *tp)
rtl_wait_txrx_fifo_empty(tp);
}
+static void rtl_wol_enable_rx(struct rtl8169_private *tp)
+{
+ if (tp->mac_version >= RTL_GIGA_MAC_VER_25)
+ RTL_W32(tp, RxConfig, RTL_R32(tp, RxConfig) |
+ AcceptBroadcast | AcceptMulticast | AcceptMyPhys);
+}
+
+static void rtl_prepare_power_down(struct rtl8169_private *tp)
+{
+ if (tp->dash_type != RTL_DASH_NONE)
+ return;
+
+ if (tp->mac_version == RTL_GIGA_MAC_VER_32 ||
+ tp->mac_version == RTL_GIGA_MAC_VER_33)
+ rtl_ephy_write(tp, 0x19, 0xff64);
+
+ if (device_may_wakeup(tp_to_dev(tp))) {
+ phy_speed_down(tp->phydev, false);
+ rtl_wol_enable_rx(tp);
+ }
+}
+
static void rtl_set_tx_config_registers(struct rtl8169_private *tp)
{
u32 val = TX_DMA_BURST << TxDMAShift |
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 016/193] r8169: fix dmar pte write access is not set error
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 015/193] r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down() Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 017/193] bpf: keep a reference to the mm, in case the task is dead Greg Kroah-Hartman
` (185 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chunhao Lin, Heiner Kallweit,
David S. Miller, Sasha Levin
From: Chunhao Lin <hau@realtek.com>
[ Upstream commit bb41c13c05c23d9bc46b4e37d8914078c6a40e3a ]
When close device, if wol is enabled, rx will be enabled. When open
device it will cause rx packet to be dma to the wrong memory address
after pci_set_master() and system log will show blow messages.
DMAR: DRHD: handling fault status reg 3
DMAR: [DMA Write] Request device [02:00.0] PASID ffffffff fault addr
ffdd4000 [fault reason 05] PTE Write access is not set
In this patch, driver disable tx/rx when close device. If wol is
enabled, only enable rx filter and disable rxdv_gate(if support) to
let hardware only receive packet to fifo but not to dma it.
Signed-off-by: Chunhao Lin <hau@realtek.com>
Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/realtek/r8169_main.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 316c925c956f..cabed1b7b45e 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -2435,6 +2435,9 @@ static void rtl_wol_enable_rx(struct rtl8169_private *tp)
if (tp->mac_version >= RTL_GIGA_MAC_VER_25)
RTL_W32(tp, RxConfig, RTL_R32(tp, RxConfig) |
AcceptBroadcast | AcceptMulticast | AcceptMyPhys);
+
+ if (tp->mac_version >= RTL_GIGA_MAC_VER_40)
+ rtl_disable_rxdvgate(tp);
}
static void rtl_prepare_power_down(struct rtl8169_private *tp)
@@ -3869,7 +3872,7 @@ static void rtl8169_tx_clear(struct rtl8169_private *tp)
netdev_reset_queue(tp->dev);
}
-static void rtl8169_cleanup(struct rtl8169_private *tp, bool going_down)
+static void rtl8169_cleanup(struct rtl8169_private *tp)
{
napi_disable(&tp->napi);
@@ -3881,9 +3884,6 @@ static void rtl8169_cleanup(struct rtl8169_private *tp, bool going_down)
rtl_rx_close(tp);
- if (going_down && tp->dev->wol_enabled)
- goto no_reset;
-
switch (tp->mac_version) {
case RTL_GIGA_MAC_VER_28:
case RTL_GIGA_MAC_VER_31:
@@ -3904,7 +3904,7 @@ static void rtl8169_cleanup(struct rtl8169_private *tp, bool going_down)
}
rtl_hw_reset(tp);
-no_reset:
+
rtl8169_tx_clear(tp);
rtl8169_init_ring_indexes(tp);
}
@@ -3915,7 +3915,7 @@ static void rtl_reset_work(struct rtl8169_private *tp)
netif_stop_queue(tp->dev);
- rtl8169_cleanup(tp, false);
+ rtl8169_cleanup(tp);
for (i = 0; i < NUM_RX_DESC; i++)
rtl8169_mark_to_asic(tp->RxDescArray + i);
@@ -4601,7 +4601,7 @@ static void rtl8169_down(struct rtl8169_private *tp)
pci_clear_master(tp->pci_dev);
rtl_pci_commit(tp);
- rtl8169_cleanup(tp, true);
+ rtl8169_cleanup(tp);
rtl_disable_exit_l1(tp);
rtl_prepare_power_down(tp);
}
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 017/193] bpf: keep a reference to the mm, in case the task is dead.
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 016/193] r8169: fix dmar pte write access is not set error Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 018/193] RDMA/srp: Move large values to a new enum for gcc13 Greg Kroah-Hartman
` (184 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Liu, Kui-Feng Lee,
Nathan Slingerland, Yonghong Song, Alexei Starovoitov,
Sasha Levin
From: Kui-Feng Lee <kuifeng@meta.com>
[ Upstream commit 7ff94f276f8ea05df82eb115225e9b26f47a3347 ]
Fix the system crash that happens when a task iterator travel through
vma of tasks.
In task iterators, we used to access mm by following the pointer on
the task_struct; however, the death of a task will clear the pointer,
even though we still hold the task_struct. That can cause an
unexpected crash for a null pointer when an iterator is visiting a
task that dies during the visit. Keeping a reference of mm on the
iterator ensures we always have a valid pointer to mm.
Co-developed-by: Song Liu <song@kernel.org>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Kui-Feng Lee <kuifeng@meta.com>
Reported-by: Nathan Slingerland <slinger@meta.com>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/r/20221216221855.4122288-2-kuifeng@meta.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/task_iter.c | 39 +++++++++++++++++++++++++++------------
1 file changed, 27 insertions(+), 12 deletions(-)
diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
index c2a2182ce570..c4ab9d6cdbe9 100644
--- a/kernel/bpf/task_iter.c
+++ b/kernel/bpf/task_iter.c
@@ -438,6 +438,7 @@ struct bpf_iter_seq_task_vma_info {
*/
struct bpf_iter_seq_task_common common;
struct task_struct *task;
+ struct mm_struct *mm;
struct vm_area_struct *vma;
u32 tid;
unsigned long prev_vm_start;
@@ -456,16 +457,19 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
enum bpf_task_vma_iter_find_op op;
struct vm_area_struct *curr_vma;
struct task_struct *curr_task;
+ struct mm_struct *curr_mm;
u32 saved_tid = info->tid;
/* If this function returns a non-NULL vma, it holds a reference to
- * the task_struct, and holds read lock on vma->mm->mmap_lock.
+ * the task_struct, holds a refcount on mm->mm_users, and holds
+ * read lock on vma->mm->mmap_lock.
* If this function returns NULL, it does not hold any reference or
* lock.
*/
if (info->task) {
curr_task = info->task;
curr_vma = info->vma;
+ curr_mm = info->mm;
/* In case of lock contention, drop mmap_lock to unblock
* the writer.
*
@@ -504,13 +508,15 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
* 4.2) VMA2 and VMA2' covers different ranges, process
* VMA2'.
*/
- if (mmap_lock_is_contended(curr_task->mm)) {
+ if (mmap_lock_is_contended(curr_mm)) {
info->prev_vm_start = curr_vma->vm_start;
info->prev_vm_end = curr_vma->vm_end;
op = task_vma_iter_find_vma;
- mmap_read_unlock(curr_task->mm);
- if (mmap_read_lock_killable(curr_task->mm))
+ mmap_read_unlock(curr_mm);
+ if (mmap_read_lock_killable(curr_mm)) {
+ mmput(curr_mm);
goto finish;
+ }
} else {
op = task_vma_iter_next_vma;
}
@@ -535,42 +541,47 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
op = task_vma_iter_find_vma;
}
- if (!curr_task->mm)
+ curr_mm = get_task_mm(curr_task);
+ if (!curr_mm)
goto next_task;
- if (mmap_read_lock_killable(curr_task->mm))
+ if (mmap_read_lock_killable(curr_mm)) {
+ mmput(curr_mm);
goto finish;
+ }
}
switch (op) {
case task_vma_iter_first_vma:
- curr_vma = find_vma(curr_task->mm, 0);
+ curr_vma = find_vma(curr_mm, 0);
break;
case task_vma_iter_next_vma:
- curr_vma = find_vma(curr_task->mm, curr_vma->vm_end);
+ curr_vma = find_vma(curr_mm, curr_vma->vm_end);
break;
case task_vma_iter_find_vma:
/* We dropped mmap_lock so it is necessary to use find_vma
* to find the next vma. This is similar to the mechanism
* in show_smaps_rollup().
*/
- curr_vma = find_vma(curr_task->mm, info->prev_vm_end - 1);
+ curr_vma = find_vma(curr_mm, info->prev_vm_end - 1);
/* case 1) and 4.2) above just use curr_vma */
/* check for case 2) or case 4.1) above */
if (curr_vma &&
curr_vma->vm_start == info->prev_vm_start &&
curr_vma->vm_end == info->prev_vm_end)
- curr_vma = find_vma(curr_task->mm, curr_vma->vm_end);
+ curr_vma = find_vma(curr_mm, curr_vma->vm_end);
break;
}
if (!curr_vma) {
/* case 3) above, or case 2) 4.1) with vma->next == NULL */
- mmap_read_unlock(curr_task->mm);
+ mmap_read_unlock(curr_mm);
+ mmput(curr_mm);
goto next_task;
}
info->task = curr_task;
info->vma = curr_vma;
+ info->mm = curr_mm;
return curr_vma;
next_task:
@@ -579,6 +590,7 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
put_task_struct(curr_task);
info->task = NULL;
+ info->mm = NULL;
info->tid++;
goto again;
@@ -587,6 +599,7 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
put_task_struct(curr_task);
info->task = NULL;
info->vma = NULL;
+ info->mm = NULL;
return NULL;
}
@@ -658,7 +671,9 @@ static void task_vma_seq_stop(struct seq_file *seq, void *v)
*/
info->prev_vm_start = ~0UL;
info->prev_vm_end = info->vma->vm_end;
- mmap_read_unlock(info->task->mm);
+ mmap_read_unlock(info->mm);
+ mmput(info->mm);
+ info->mm = NULL;
put_task_struct(info->task);
info->task = NULL;
}
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 018/193] RDMA/srp: Move large values to a new enum for gcc13
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 017/193] bpf: keep a reference to the mm, in case the task is dead Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 019/193] selftests: net: fix cmsg_so_mark.sh test hang Greg Kroah-Hartman
` (183 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE),
Bart Van Assche, Leon Romanovsky, Sasha Levin
From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
[ Upstream commit 56c5dab20a6391604df9521f812c01d1e3fe1bd0 ]
Since gcc13, each member of an enum has the same type as the enum [1]. And
that is inherited from its members. Provided these two:
SRP_TAG_NO_REQ = ~0U,
SRP_TAG_TSK_MGMT = 1U << 31
all other members are unsigned ints.
Esp. with SRP_MAX_SGE and SRP_TSK_MGMT_SQ_SIZE and their use in min(),
this results in the following warnings:
include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast
drivers/infiniband/ulp/srp/ib_srp.c:563:42: note: in expansion of macro 'min'
include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast
drivers/infiniband/ulp/srp/ib_srp.c:2369:27: note: in expansion of macro 'min'
So move the large values away to a separate enum, so that they don't
affect other members.
[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36113
Link: https://lore.kernel.org/r/20221212120411.13750-1-jirislaby@kernel.org
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/srp/ib_srp.h | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
index 00b0068fda20..5d94db453df3 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.h
+++ b/drivers/infiniband/ulp/srp/ib_srp.h
@@ -62,9 +62,6 @@ enum {
SRP_DEFAULT_CMD_SQ_SIZE = SRP_DEFAULT_QUEUE_SIZE - SRP_RSP_SQ_SIZE -
SRP_TSK_MGMT_SQ_SIZE,
- SRP_TAG_NO_REQ = ~0U,
- SRP_TAG_TSK_MGMT = 1U << 31,
-
SRP_MAX_PAGES_PER_MR = 512,
SRP_MAX_ADD_CDB_LEN = 16,
@@ -79,6 +76,11 @@ enum {
sizeof(struct srp_imm_buf),
};
+enum {
+ SRP_TAG_NO_REQ = ~0U,
+ SRP_TAG_TSK_MGMT = BIT(31),
+};
+
enum srp_target_state {
SRP_TARGET_SCANNING,
SRP_TARGET_LIVE,
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 019/193] selftests: net: fix cmsg_so_mark.sh test hang
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 018/193] RDMA/srp: Move large values to a new enum for gcc13 Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 020/193] btrfs: always report error in run_one_delayed_ref() Greg Kroah-Hartman
` (182 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Po-Hsu Lin, David S. Miller, Sasha Levin
From: Po-Hsu Lin <po-hsu.lin@canonical.com>
[ Upstream commit 1573c6882018f69991aead951d09423ce978adac ]
This cmsg_so_mark.sh test will hang on non-amd64 systems because of the
infinity loop for argument parsing in cmsg_sender.
Variable "o" in cs_parse_args() for taking getopt() should be an int,
otherwise it will be 255 when getopt() returns -1 on non-amd64 system
and thus causing infinity loop.
Link: https://lore.kernel.org/lkml/CA+G9fYsM2k7mrF7W4V_TrZ-qDauWM394=8yEJ=-t1oUg8_40YA@mail.gmail.com/t/
Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/cmsg_sender.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/net/cmsg_sender.c b/tools/testing/selftests/net/cmsg_sender.c
index 75dd83e39207..24b21b15ed3f 100644
--- a/tools/testing/selftests/net/cmsg_sender.c
+++ b/tools/testing/selftests/net/cmsg_sender.c
@@ -110,7 +110,7 @@ static void __attribute__((noreturn)) cs_usage(const char *bin)
static void cs_parse_args(int argc, char *argv[])
{
- char o;
+ int o;
while ((o = getopt(argc, argv, "46sS:p:m:M:d:tf:F:c:C:l:L:H:")) != -1) {
switch (o) {
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 020/193] btrfs: always report error in run_one_delayed_ref()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 019/193] selftests: net: fix cmsg_so_mark.sh test hang Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 021/193] x86/asm: Fix an assembler warning with current binutils Greg Kroah-Hartman
` (181 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anand Jain, Qu Wenruo, David Sterba,
Sasha Levin
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit 39f501d68ec1ed5cd5c66ac6ec2a7131c517bb92 ]
Currently we have a btrfs_debug() for run_one_delayed_ref() failure, but
if end users hit such problem, there will be no chance that
btrfs_debug() is enabled. This can lead to very little useful info for
debugging.
This patch will:
- Add extra info for error reporting
Including:
* logical bytenr
* num_bytes
* type
* action
* ref_mod
- Replace the btrfs_debug() with btrfs_err()
- Move the error reporting into run_one_delayed_ref()
This is to avoid use-after-free, the @node can be freed in the caller.
This error should only be triggered at most once.
As if run_one_delayed_ref() failed, we trigger the error message, then
causing the call chain to error out:
btrfs_run_delayed_refs()
`- btrfs_run_delayed_refs()
`- btrfs_run_delayed_refs_for_head()
`- run_one_delayed_ref()
And we will abort the current transaction in btrfs_run_delayed_refs().
If we have to run delayed refs for the abort transaction,
run_one_delayed_ref() will just cleanup the refs and do nothing, thus no
new error messages would be output.
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/extent-tree.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 2801c991814f..571fcc5ae4dc 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1706,6 +1706,11 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans,
BUG();
if (ret && insert_reserved)
btrfs_pin_extent(trans, node->bytenr, node->num_bytes, 1);
+ if (ret < 0)
+ btrfs_err(trans->fs_info,
+"failed to run delayed ref for logical %llu num_bytes %llu type %u action %u ref_mod %d: %d",
+ node->bytenr, node->num_bytes, node->type,
+ node->action, node->ref_mod, ret);
return ret;
}
@@ -1947,8 +1952,6 @@ static int btrfs_run_delayed_refs_for_head(struct btrfs_trans_handle *trans,
if (ret) {
unselect_delayed_ref_head(delayed_refs, locked_ref);
btrfs_put_delayed_ref(ref);
- btrfs_debug(fs_info, "run_one_delayed_ref returned %d",
- ret);
return ret;
}
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 021/193] x86/asm: Fix an assembler warning with current binutils
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 020/193] btrfs: always report error in run_one_delayed_ref() Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 022/193] f2fs: lets avoid panic if extent_tree is not created Greg Kroah-Hartman
` (180 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Ingo Molnar,
linux-kernel, Sasha Levin
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 55d235361fccef573990dfa5724ab453866e7816 ]
Fix a warning: "found `movsd'; assuming `movsl' was meant"
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/lib/iomap_copy_64.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
index a1f9416bf67a..6ff2f56cb0f7 100644
--- a/arch/x86/lib/iomap_copy_64.S
+++ b/arch/x86/lib/iomap_copy_64.S
@@ -10,6 +10,6 @@
*/
SYM_FUNC_START(__iowrite32_copy)
movl %edx,%ecx
- rep movsd
+ rep movsl
RET
SYM_FUNC_END(__iowrite32_copy)
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 022/193] f2fs: lets avoid panic if extent_tree is not created
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 021/193] x86/asm: Fix an assembler warning with current binutils Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 023/193] perf/x86/rapl: Treat Tigerlake like Icelake Greg Kroah-Hartman
` (179 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jaegeuk Kim, Sasha Levin
From: Jaegeuk Kim <jaegeuk@kernel.org>
[ Upstream commit df9d44b645b83fffccfb4e28c1f93376585fdec8 ]
This patch avoids the below panic.
pc : __lookup_extent_tree+0xd8/0x760
lr : f2fs_do_write_data_page+0x104/0x87c
sp : ffffffc010cbb3c0
x29: ffffffc010cbb3e0 x28: 0000000000000000
x27: ffffff8803e7f020 x26: ffffff8803e7ed40
x25: ffffff8803e7f020 x24: ffffffc010cbb460
x23: ffffffc010cbb480 x22: 0000000000000000
x21: 0000000000000000 x20: ffffffff22e90900
x19: 0000000000000000 x18: ffffffc010c5d080
x17: 0000000000000000 x16: 0000000000000020
x15: ffffffdb1acdbb88 x14: ffffff888759e2b0
x13: 0000000000000000 x12: ffffff802da49000
x11: 000000000a001200 x10: ffffff8803e7ed40
x9 : ffffff8023195800 x8 : ffffff802da49078
x7 : 0000000000000001 x6 : 0000000000000000
x5 : 0000000000000006 x4 : ffffffc010cbba28
x3 : 0000000000000000 x2 : ffffffc010cbb480
x1 : 0000000000000000 x0 : ffffff8803e7ed40
Call trace:
__lookup_extent_tree+0xd8/0x760
f2fs_do_write_data_page+0x104/0x87c
f2fs_write_single_data_page+0x420/0xb60
f2fs_write_cache_pages+0x418/0xb1c
__f2fs_write_data_pages+0x428/0x58c
f2fs_write_data_pages+0x30/0x40
do_writepages+0x88/0x190
__writeback_single_inode+0x48/0x448
writeback_sb_inodes+0x468/0x9e8
__writeback_inodes_wb+0xb8/0x2a4
wb_writeback+0x33c/0x740
wb_do_writeback+0x2b4/0x400
wb_workfn+0xe4/0x34c
process_one_work+0x24c/0x5bc
worker_thread+0x3e8/0xa50
kthread+0x150/0x1b4
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/extent_cache.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
index 932c070173b9..6c9e6f78a3e3 100644
--- a/fs/f2fs/extent_cache.c
+++ b/fs/f2fs/extent_cache.c
@@ -415,7 +415,8 @@ static bool f2fs_lookup_extent_tree(struct inode *inode, pgoff_t pgofs,
struct extent_node *en;
bool ret = false;
- f2fs_bug_on(sbi, !et);
+ if (!et)
+ return false;
trace_f2fs_lookup_extent_tree_start(inode, pgofs);
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 023/193] perf/x86/rapl: Treat Tigerlake like Icelake
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 022/193] f2fs: lets avoid panic if extent_tree is not created Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 024/193] cifs: fix race in assemble_neg_contexts() Greg Kroah-Hartman
` (178 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Wilson, Rodrigo Vivi,
Ingo Molnar, Peter Zijlstra, Stephane Eranian, Zhang Rui,
Sasha Levin
From: Chris Wilson <chris@chris-wilson.co.uk>
[ Upstream commit c07311b5509f6035f1dd828db3e90ff4859cf3b9 ]
Since Tigerlake seems to have inherited its cstates and other RAPL power
caps from Icelake, assume it also follows Icelake for its RAPL events.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Zhang Rui <rui.zhang@intel.com>
Link: https://lore.kernel.org/r/20221228113454.1199118-1-rodrigo.vivi@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/rapl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c
index a829492bca4c..ae5779ea4417 100644
--- a/arch/x86/events/rapl.c
+++ b/arch/x86/events/rapl.c
@@ -800,6 +800,8 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = {
X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_X, &model_hsx),
X86_MATCH_INTEL_FAM6_MODEL(COMETLAKE_L, &model_skl),
X86_MATCH_INTEL_FAM6_MODEL(COMETLAKE, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE_L, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE, &model_skl),
X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE, &model_skl),
X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, &model_skl),
X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_N, &model_skl),
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 024/193] cifs: fix race in assemble_neg_contexts()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 023/193] perf/x86/rapl: Treat Tigerlake like Icelake Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 025/193] memblock tests: Fix compilation error Greg Kroah-Hartman
` (177 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (SUSE),
Enzo Matsumiya, Steve French, Sasha Levin
From: Paulo Alcantara <pc@cjr.nz>
[ Upstream commit 775e44d6d86dca400d614cbda5dab4def4951fe7 ]
Serialise access of TCP_Server_Info::hostname in
assemble_neg_contexts() by holding the server's mutex otherwise it
might end up accessing an already-freed hostname pointer from
cifs_reconnect() or cifs_resolve_server().
Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/smb2pdu.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 4ac5b1bfaf78..727f16b426be 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -541,9 +541,10 @@ static void
assemble_neg_contexts(struct smb2_negotiate_req *req,
struct TCP_Server_Info *server, unsigned int *total_len)
{
- char *pneg_ctxt;
- char *hostname = NULL;
unsigned int ctxt_len, neg_context_count;
+ struct TCP_Server_Info *pserver;
+ char *pneg_ctxt;
+ char *hostname;
if (*total_len > 200) {
/* In case length corrupted don't want to overrun smb buffer */
@@ -574,8 +575,9 @@ assemble_neg_contexts(struct smb2_negotiate_req *req,
* secondary channels don't have the hostname field populated
* use the hostname field in the primary channel instead
*/
- hostname = CIFS_SERVER_IS_CHAN(server) ?
- server->primary_server->hostname : server->hostname;
+ pserver = CIFS_SERVER_IS_CHAN(server) ? server->primary_server : server;
+ cifs_server_lock(pserver);
+ hostname = pserver->hostname;
if (hostname && (hostname[0] != 0)) {
ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt,
hostname);
@@ -584,6 +586,7 @@ assemble_neg_contexts(struct smb2_negotiate_req *req,
neg_context_count = 3;
} else
neg_context_count = 2;
+ cifs_server_unlock(pserver);
build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt);
*total_len += sizeof(struct smb2_posix_neg_context);
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 025/193] memblock tests: Fix compilation error.
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 024/193] cifs: fix race in assemble_neg_contexts() Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 026/193] perf/x86/rapl: Add support for Intel Meteor Lake Greg Kroah-Hartman
` (176 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaron Thompson, Mike Rapoport (IBM),
Sasha Levin
From: Aaron Thompson <dev@aaront.org>
[ Upstream commit 340726747336716350eb5a928b860a29db955f05 ]
Commit cf4694be2b2cf ("tools: Add atomic_test_and_set_bit()") changed
tools/arch/x86/include/asm/atomic.h to include <asm/asm.h>, which causes
'make -C tools/testing/memblock' to fail with:
In file included from ../../include/asm/atomic.h:6,
from ../../include/linux/atomic.h:5,
from ./linux/mmzone.h:5,
from ../../include/linux/mm.h:5,
from ../../include/linux/pfn.h:5,
from ./linux/memory_hotplug.h:6,
from ./linux/init.h:7,
from ./linux/memblock.h:11,
from tests/common.h:8,
from tests/basic_api.h:5,
from main.c:2:
../../include/asm/../../arch/x86/include/asm/atomic.h:11:10: fatal error: asm/asm.h: No such file or directory
11 | #include <asm/asm.h>
| ^~~~~~~~~~~
Create a symlink to asm/asm.h in the same manner as the existing one to
asm/cmpxchg.h.
Signed-off-by: Aaron Thompson <dev@aaront.org>
Link: https://lore.kernel.org/r/010101857c402765-96e2dbc6-b82b-47e2-a437-4834dbe0b96b-000000@us-west-2.amazonses.com
Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/memblock/.gitignore | 1 +
tools/testing/memblock/Makefile | 3 ++-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/tools/testing/memblock/.gitignore b/tools/testing/memblock/.gitignore
index 654338e0be52..4cc7cd5aac2b 100644
--- a/tools/testing/memblock/.gitignore
+++ b/tools/testing/memblock/.gitignore
@@ -1,4 +1,5 @@
main
memblock.c
linux/memblock.h
+asm/asm.h
asm/cmpxchg.h
diff --git a/tools/testing/memblock/Makefile b/tools/testing/memblock/Makefile
index 246f7ac8489b..575e98fddc21 100644
--- a/tools/testing/memblock/Makefile
+++ b/tools/testing/memblock/Makefile
@@ -29,13 +29,14 @@ include: ../../../include/linux/memblock.h ../../include/linux/*.h \
@mkdir -p linux
test -L linux/memblock.h || ln -s ../../../../include/linux/memblock.h linux/memblock.h
+ test -L asm/asm.h || ln -s ../../../arch/x86/include/asm/asm.h asm/asm.h
test -L asm/cmpxchg.h || ln -s ../../../arch/x86/include/asm/cmpxchg.h asm/cmpxchg.h
memblock.c: $(EXTR_SRC)
test -L memblock.c || ln -s $(EXTR_SRC) memblock.c
clean:
- $(RM) $(TARGETS) $(OFILES) linux/memblock.h memblock.c asm/cmpxchg.h
+ $(RM) $(TARGETS) $(OFILES) linux/memblock.h memblock.c asm/asm.h asm/cmpxchg.h
help:
@echo 'Memblock simulator'
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 026/193] perf/x86/rapl: Add support for Intel Meteor Lake
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 025/193] memblock tests: Fix compilation error Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 027/193] perf/x86/rapl: Add support for Intel Emerald Rapids Greg Kroah-Hartman
` (175 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhang Rui, Ingo Molnar, Sasha Levin
From: Zhang Rui <rui.zhang@intel.com>
[ Upstream commit f52853a668bfeddd79f319d536a506f68cc2b478 ]
Meteor Lake RAPL support is the same as previous Sky Lake.
Add Meteor Lake model for RAPL.
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20230104145831.25498-1-rui.zhang@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/rapl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c
index ae5779ea4417..589c6885560d 100644
--- a/arch/x86/events/rapl.c
+++ b/arch/x86/events/rapl.c
@@ -809,6 +809,8 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = {
X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, &model_skl),
X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &model_skl),
X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE_L, &model_skl),
{},
};
MODULE_DEVICE_TABLE(x86cpu, rapl_model_match);
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 027/193] perf/x86/rapl: Add support for Intel Emerald Rapids
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 026/193] perf/x86/rapl: Add support for Intel Meteor Lake Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 028/193] of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2 Greg Kroah-Hartman
` (174 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhang Rui, Ingo Molnar, Sasha Levin
From: Zhang Rui <rui.zhang@intel.com>
[ Upstream commit 57512b57dcfaf63c52d8ad2fb35321328cde31b0 ]
Emerald Rapids RAPL support is the same as previous Sapphire Rapids.
Add Emerald Rapids model for RAPL.
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20230104145831.25498-2-rui.zhang@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/rapl.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c
index 589c6885560d..52e6e7ed4f78 100644
--- a/arch/x86/events/rapl.c
+++ b/arch/x86/events/rapl.c
@@ -806,6 +806,7 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = {
X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, &model_skl),
X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_N, &model_skl),
X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, &model_spr),
+ X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X, &model_spr),
X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, &model_skl),
X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &model_skl),
X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &model_skl),
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 028/193] of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 027/193] perf/x86/rapl: Add support for Intel Emerald Rapids Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 029/193] fbdev: omapfb: avoid stack overflow warning Greg Kroah-Hartman
` (173 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Sverdlin, Linus Walleij,
Arnd Bergmann, Geoff Levand, Rob Herring, Sasha Levin
From: Rob Herring <robh@kernel.org>
[ Upstream commit 064e32dc5b03114d0767893fecdaf7b5dfd8c286 ]
I do not read a strict requirement on /chosen node in either ePAPR or in
Documentation/devicetree. Help text for CONFIG_CMDLINE and
CONFIG_CMDLINE_EXTEND doesn't make their behavior explicitly dependent on
the presence of /chosen or the presense of /chosen/bootargs.
However the early check for /chosen and bailing out in
early_init_dt_scan_chosen() skips CONFIG_CMDLINE handling which is not
really related to /chosen node or the particular method of passing cmdline
from bootloader.
This leads to counterintuitive combinations (assuming
CONFIG_CMDLINE_EXTEND=y):
a) bootargs="foo", CONFIG_CMDLINE="bar" => cmdline=="foo bar"
b) /chosen missing, CONFIG_CMDLINE="bar" => cmdline==""
c) bootargs="", CONFIG_CMDLINE="bar" => cmdline==" bar"
Rework early_init_dt_scan_chosen() so that the cmdline config options are
always handled.
[commit msg written by Alexander Sverdlin]
Cc: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Tested-by: Geoff Levand <geoff@infradead.org>
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://lore.kernel.org/r/20230103-dt-cmdline-fix-v1-2-7038e88b18b6@kernel.org
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/fdt.c | 28 +++++++++++++++-------------
1 file changed, 15 insertions(+), 13 deletions(-)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 4f88e8bbdd27..f08b25195ae7 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -1163,18 +1163,32 @@ int __init early_init_dt_scan_chosen(char *cmdline)
if (node < 0)
node = fdt_path_offset(fdt, "/chosen@0");
if (node < 0)
- return -ENOENT;
+ /* Handle the cmdline config options even if no /chosen node */
+ goto handle_cmdline;
chosen_node_offset = node;
early_init_dt_check_for_initrd(node);
early_init_dt_check_for_elfcorehdr(node);
+ rng_seed = of_get_flat_dt_prop(node, "rng-seed", &l);
+ if (rng_seed && l > 0) {
+ add_bootloader_randomness(rng_seed, l);
+
+ /* try to clear seed so it won't be found. */
+ fdt_nop_property(initial_boot_params, node, "rng-seed");
+
+ /* update CRC check value */
+ of_fdt_crc32 = crc32_be(~0, initial_boot_params,
+ fdt_totalsize(initial_boot_params));
+ }
+
/* Retrieve command line */
p = of_get_flat_dt_prop(node, "bootargs", &l);
if (p != NULL && l > 0)
strscpy(cmdline, p, min(l, COMMAND_LINE_SIZE));
+handle_cmdline:
/*
* CONFIG_CMDLINE is meant to be a default in case nothing else
* managed to set the command line, unless CONFIG_CMDLINE_FORCE
@@ -1195,18 +1209,6 @@ int __init early_init_dt_scan_chosen(char *cmdline)
pr_debug("Command line is: %s\n", (char *)cmdline);
- rng_seed = of_get_flat_dt_prop(node, "rng-seed", &l);
- if (rng_seed && l > 0) {
- add_bootloader_randomness(rng_seed, l);
-
- /* try to clear seed so it won't be found. */
- fdt_nop_property(initial_boot_params, node, "rng-seed");
-
- /* update CRC check value */
- of_fdt_crc32 = crc32_be(~0, initial_boot_params,
- fdt_totalsize(initial_boot_params));
- }
-
return 0;
}
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 029/193] fbdev: omapfb: avoid stack overflow warning
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 028/193] of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2 Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 030/193] Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 Greg Kroah-Hartman
` (172 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Helge Deller, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 634cf6ead93988b0da9ac054521ab63a3ba189db ]
The dsi_irq_stats structure is a little too big to fit on the
stack of a 32-bit task, depending on the specific gcc options:
fbdev/omap2/omapfb/dss/dsi.c: In function 'dsi_dump_dsidev_irqs':
fbdev/omap2/omapfb/dss/dsi.c:1621:1: error: the frame size of 1064 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
Since this is only a debugfs file, performance is not critical,
so just dynamically allocate it, and print an error message
in there in place of a failure code when the allocation fails.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 28 ++++++++++++++--------
1 file changed, 18 insertions(+), 10 deletions(-)
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
index 54b0f034c2ed..7cddb7b8ae34 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
@@ -1536,22 +1536,28 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev,
{
struct dsi_data *dsi = dsi_get_dsidrv_data(dsidev);
unsigned long flags;
- struct dsi_irq_stats stats;
+ struct dsi_irq_stats *stats;
+
+ stats = kzalloc(sizeof(*stats), GFP_KERNEL);
+ if (!stats) {
+ seq_printf(s, "out of memory\n");
+ return;
+ }
spin_lock_irqsave(&dsi->irq_stats_lock, flags);
- stats = dsi->irq_stats;
+ *stats = dsi->irq_stats;
memset(&dsi->irq_stats, 0, sizeof(dsi->irq_stats));
dsi->irq_stats.last_reset = jiffies;
spin_unlock_irqrestore(&dsi->irq_stats_lock, flags);
seq_printf(s, "period %u ms\n",
- jiffies_to_msecs(jiffies - stats.last_reset));
+ jiffies_to_msecs(jiffies - stats->last_reset));
- seq_printf(s, "irqs %d\n", stats.irq_count);
+ seq_printf(s, "irqs %d\n", stats->irq_count);
#define PIS(x) \
- seq_printf(s, "%-20s %10d\n", #x, stats.dsi_irqs[ffs(DSI_IRQ_##x)-1])
+ seq_printf(s, "%-20s %10d\n", #x, stats->dsi_irqs[ffs(DSI_IRQ_##x)-1])
seq_printf(s, "-- DSI%d interrupts --\n", dsi->module_id + 1);
PIS(VC0);
@@ -1575,10 +1581,10 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev,
#define PIS(x) \
seq_printf(s, "%-20s %10d %10d %10d %10d\n", #x, \
- stats.vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \
- stats.vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \
- stats.vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \
- stats.vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]);
+ stats->vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \
+ stats->vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \
+ stats->vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \
+ stats->vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]);
seq_printf(s, "-- VC interrupts --\n");
PIS(CS);
@@ -1594,7 +1600,7 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev,
#define PIS(x) \
seq_printf(s, "%-20s %10d\n", #x, \
- stats.cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]);
+ stats->cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]);
seq_printf(s, "-- CIO interrupts --\n");
PIS(ERRSYNCESC1);
@@ -1618,6 +1624,8 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev,
PIS(ULPSACTIVENOT_ALL0);
PIS(ULPSACTIVENOT_ALL1);
#undef PIS
+
+ kfree(stats);
}
static void dsi1_dump_irqs(struct seq_file *s)
--
2.35.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 030/193] Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 029/193] fbdev: omapfb: avoid stack overflow warning Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 031/193] Bluetooth: hci_qca: Fix driver shutdown on closed serdev Greg Kroah-Hartman
` (171 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
commit 3a4d29b6d631bb00236a98887e1039bbfc1b6ab5 upstream.
Don't try to use HCI_OP_LE_READ_BUFFER_SIZE_V2 if controller don't
support ISO channels, but in order to check if ISO channels are
supported HCI_OP_LE_READ_LOCAL_FEATURES needs to be done earlier so the
features bits can be checked on hci_le_read_buffer_size_sync.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216817
Fixes: c1631dbc00c1 ("Bluetooth: hci_sync: Fix hci_read_buffer_size_sync")
Cc: stable@vger.kernel.org # 6.1
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_sync.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -3554,7 +3554,7 @@ static const struct hci_init_stage hci_i
static int hci_le_read_buffer_size_sync(struct hci_dev *hdev)
{
/* Use Read LE Buffer Size V2 if supported */
- if (hdev->commands[41] & 0x20)
+ if (iso_capable(hdev) && hdev->commands[41] & 0x20)
return __hci_cmd_sync_status(hdev,
HCI_OP_LE_READ_BUFFER_SIZE_V2,
0, NULL, HCI_CMD_TIMEOUT);
@@ -3579,10 +3579,10 @@ static int hci_le_read_supported_states_
/* LE Controller init stage 2 command sequence */
static const struct hci_init_stage le_init2[] = {
- /* HCI_OP_LE_READ_BUFFER_SIZE */
- HCI_INIT(hci_le_read_buffer_size_sync),
/* HCI_OP_LE_READ_LOCAL_FEATURES */
HCI_INIT(hci_le_read_local_features_sync),
+ /* HCI_OP_LE_READ_BUFFER_SIZE */
+ HCI_INIT(hci_le_read_buffer_size_sync),
/* HCI_OP_LE_READ_SUPPORTED_STATES */
HCI_INIT(hci_le_read_supported_states_sync),
{}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 031/193] Bluetooth: hci_qca: Fix driver shutdown on closed serdev
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 030/193] Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 032/193] wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices Greg Kroah-Hartman
` (170 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Luiz Augusto von Dentz
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 272970be3dabd24cbe50e393ffee8f04aec3b9a8 upstream.
The driver shutdown callback (which sends EDL_SOC_RESET to the device
over serdev) should not be invoked when HCI device is not open (e.g. if
hci_dev_open_sync() failed), because the serdev and its TTY are not open
either. Also skip this step if device is powered off
(qca_power_shutdown()).
The shutdown callback causes use-after-free during system reboot with
Qualcomm Atheros Bluetooth:
Unable to handle kernel paging request at virtual address
0072662f67726fd7
...
CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G W
6.1.0-rt5-00325-g8a5f56bcfcca #8
Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
Call trace:
tty_driver_flush_buffer+0x4/0x30
serdev_device_write_flush+0x24/0x34
qca_serdev_shutdown+0x80/0x130 [hci_uart]
device_shutdown+0x15c/0x260
kernel_restart+0x48/0xac
KASAN report:
BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50
Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1
CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted
6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28
Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
Call trace:
dump_backtrace.part.0+0xdc/0xf0
show_stack+0x18/0x30
dump_stack_lvl+0x68/0x84
print_report+0x188/0x488
kasan_report+0xa4/0xf0
__asan_load8+0x80/0xac
tty_driver_flush_buffer+0x1c/0x50
ttyport_write_flush+0x34/0x44
serdev_device_write_flush+0x48/0x60
qca_serdev_shutdown+0x124/0x274
device_shutdown+0x1e8/0x350
kernel_restart+0x48/0xb0
__do_sys_reboot+0x244/0x2d0
__arm64_sys_reboot+0x54/0x70
invoke_syscall+0x60/0x190
el0_svc_common.constprop.0+0x7c/0x160
do_el0_svc+0x44/0xf0
el0_svc+0x2c/0x6c
el0t_64_sync_handler+0xbc/0x140
el0t_64_sync+0x190/0x194
Fixes: 7e7bbddd029b ("Bluetooth: hci_qca: Fix qca6390 enable failure after warm reboot")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_qca.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -2157,10 +2157,17 @@ static void qca_serdev_shutdown(struct d
int timeout = msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS);
struct serdev_device *serdev = to_serdev_device(dev);
struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
+ struct hci_uart *hu = &qcadev->serdev_hu;
+ struct hci_dev *hdev = hu->hdev;
+ struct qca_data *qca = hu->priv;
const u8 ibs_wake_cmd[] = { 0xFD };
const u8 edl_reset_soc_cmd[] = { 0x01, 0x00, 0xFC, 0x01, 0x05 };
if (qcadev->btsoc_type == QCA_QCA6390) {
+ if (test_bit(QCA_BT_OFF, &qca->flags) ||
+ !test_bit(HCI_RUNNING, &hdev->flags))
+ return;
+
serdev_device_write_flush(serdev);
ret = serdev_device_write_buf(serdev, ibs_wake_cmd,
sizeof(ibs_wake_cmd));
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 032/193] wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 031/193] Bluetooth: hci_qca: Fix driver shutdown on closed serdev Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 033/193] wifi: mac80211: fix MLO + AP_VLAN check Greg Kroah-Hartman
` (169 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, chainofflowers, Christian Marillat,
Arend van Spriel, Kalle Valo
From: Arend van Spriel <arend.vanspriel@broadcom.com>
commit ed05cb177ae5cd7f02f1d6e7706ba627d30f1696 upstream.
A sanity check was introduced considering maximum flowrings above
256 as insane and effectively aborting the device probe. This
resulted in regression for number of users as the value turns out
to be sane after all.
Fixes: 2aca4f3734bd ("brcmfmac: return error when getting invalid max_flowrings from dongle")
Reported-by: chainofflowers <chainofflowers@posteo.net>
Link: https://lore.kernel.org/all/4781984.GXAFRqVoOG@luna/
Reported-by: Christian Marillat <marillat@debian.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216894
Cc: stable@vger.kernel.org
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230111112419.24185-1-arend.vanspriel@broadcom.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1218,7 +1218,7 @@ static int brcmf_pcie_init_ringbuffers(s
BRCMF_NROF_H2D_COMMON_MSGRINGS;
max_completionrings = BRCMF_NROF_D2H_COMMON_MSGRINGS;
}
- if (max_flowrings > 256) {
+ if (max_flowrings > 512) {
brcmf_err(bus, "invalid max_flowrings(%d)\n", max_flowrings);
return -EIO;
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 033/193] wifi: mac80211: fix MLO + AP_VLAN check
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 032/193] wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 034/193] wifi: mac80211: reset multiple BSSID options in stop_ap() Greg Kroah-Hartman
` (168 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Johannes Berg
From: Felix Fietkau <nbd@nbd.name>
commit f216033d770f7ca0eda491fe01a9f02e7af59576 upstream.
Instead of preventing adding AP_VLAN to MLO enabled APs, this check was
preventing adding more than one 4-addr AP_VLAN regardless of the MLO status.
Fix this by adding missing extra checks.
Fixes: ae960ee90bb1 ("wifi: mac80211: prevent VLANs on MLDs")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20221214130326.37756-1-nbd@nbd.name
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/iface.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index d49a5906a943..e20c3fe9a0b1 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -364,7 +364,9 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
/* No support for VLAN with MLO yet */
if (iftype == NL80211_IFTYPE_AP_VLAN &&
- nsdata->wdev.use_4addr)
+ sdata->wdev.use_4addr &&
+ nsdata->vif.type == NL80211_IFTYPE_AP &&
+ nsdata->vif.valid_links)
return -EOPNOTSUPP;
/*
--
2.39.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 034/193] wifi: mac80211: reset multiple BSSID options in stop_ap()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 033/193] wifi: mac80211: fix MLO + AP_VLAN check Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 035/193] wifi: mac80211: sdata can be NULL during AMPDU start Greg Kroah-Hartman
` (167 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jouni Malinen, Aloka Dixit, Johannes Berg
From: Aloka Dixit <quic_alokad@quicinc.com>
commit 0eb38842ada035d71bb06fb9116f26f24ee0f998 upstream.
Reset multiple BSSID options when all AP related configurations are
reset in ieee80211_stop_ap().
Stale values result in HWSIM test failures (e.g. p2p_group_cli_invalid),
if run after 'he_ap_ema'.
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
Link: https://lore.kernel.org/r/20221221185616.11514-1-quic_alokad@quicinc.com
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/cfg.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -147,6 +147,7 @@ static int ieee80211_set_ap_mbssid_optio
link_conf->bssid_index = 0;
link_conf->nontransmitted = false;
link_conf->ema_ap = false;
+ link_conf->bssid_indicator = 0;
if (sdata->vif.type != NL80211_IFTYPE_AP || !params.tx_wdev)
return -EINVAL;
@@ -1511,6 +1512,12 @@ static int ieee80211_stop_ap(struct wiph
kfree(link_conf->ftmr_params);
link_conf->ftmr_params = NULL;
+ sdata->vif.mbssid_tx_vif = NULL;
+ link_conf->bssid_index = 0;
+ link_conf->nontransmitted = false;
+ link_conf->ema_ap = false;
+ link_conf->bssid_indicator = 0;
+
__sta_info_flush(sdata, true);
ieee80211_free_keys(sdata, true);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 035/193] wifi: mac80211: sdata can be NULL during AMPDU start
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 034/193] wifi: mac80211: reset multiple BSSID options in stop_ap() Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 036/193] wifi: mac80211: fix initialization of rx->link and rx->link_sta Greg Kroah-Hartman
` (166 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Wetzel, Johannes Berg
From: Alexander Wetzel <alexander@wetzel-home.de>
commit 69403bad97aa0162e3d7911b27e25abe774093df upstream.
ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a
deauthentication is ongoing.
Here a trace triggering the race with the hostapd test
multi_ap_fronthaul_on_ap:
(gdb) list *drv_ampdu_action+0x46
0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396).
391 int ret = -EOPNOTSUPP;
392
393 might_sleep();
394
395 sdata = get_bss_sdata(sdata);
396 if (!check_sdata_in_driver(sdata))
397 return -EIO;
398
399 trace_drv_ampdu_action(local, sdata, params);
400
wlan0: moving STA 02:00:00:00:03:00 to state 3
wlan0: associated
wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING)
wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0
wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port)
wlan0: moving STA 02:00:00:00:03:00 to state 2
wlan0: moving STA 02:00:00:00:03:00 to state 1
wlan0: Removed STA 02:00:00:00:03:00
wlan0: Destroyed STA 02:00:00:00:03:00
BUG: unable to handle page fault for address: fffffffffffffb48
PGD 11814067 P4D 11814067 PUD 11816067 PMD 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G W 6.1.0-rc8-wt+ #59
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014
Workqueue: phy3 ieee80211_ba_session_work [mac80211]
RIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211]
Code: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85
RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287
RAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240
RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40
RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0
R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8
FS: 0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0
Call Trace:
<TASK>
ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211]
ieee80211_ba_session_work+0xff/0x2e0 [mac80211]
process_one_work+0x29f/0x620
worker_thread+0x4d/0x3d0
? process_one_work+0x620/0x620
kthread+0xfb/0x120
? kthread_complete_and_exit+0x20/0x20
ret_from_fork+0x22/0x30
</TASK>
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Link: https://lore.kernel.org/r/20221230121850.218810-2-alexander@wetzel-home.de
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/agg-tx.c | 6 +++++-
net/mac80211/driver-ops.c | 3 +++
2 files changed, 8 insertions(+), 1 deletion(-)
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -491,7 +491,7 @@ void ieee80211_tx_ba_session_handle_star
{
struct tid_ampdu_tx *tid_tx;
struct ieee80211_local *local = sta->local;
- struct ieee80211_sub_if_data *sdata = sta->sdata;
+ struct ieee80211_sub_if_data *sdata;
struct ieee80211_ampdu_params params = {
.sta = &sta->sta,
.action = IEEE80211_AMPDU_TX_START,
@@ -521,6 +521,7 @@ void ieee80211_tx_ba_session_handle_star
*/
synchronize_net();
+ sdata = sta->sdata;
params.ssn = sta->tid_seq[tid] >> 4;
ret = drv_ampdu_action(local, sdata, ¶ms);
tid_tx->ssn = params.ssn;
@@ -534,6 +535,9 @@ void ieee80211_tx_ba_session_handle_star
*/
set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state);
} else if (ret) {
+ if (!sdata)
+ return;
+
ht_dbg(sdata,
"BA request denied - HW unavailable for %pM tid %d\n",
sta->sta.addr, tid);
--- a/net/mac80211/driver-ops.c
+++ b/net/mac80211/driver-ops.c
@@ -391,6 +391,9 @@ int drv_ampdu_action(struct ieee80211_lo
might_sleep();
+ if (!sdata)
+ return -EIO;
+
sdata = get_bss_sdata(sdata);
if (!check_sdata_in_driver(sdata))
return -EIO;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 036/193] wifi: mac80211: fix initialization of rx->link and rx->link_sta
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 035/193] wifi: mac80211: sdata can be NULL during AMPDU start Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 037/193] nommu: fix memory leak in do_mmap() error path Greg Kroah-Hartman
` (165 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Johannes Berg
From: Felix Fietkau <nbd@nbd.name>
commit e66b7920aa5ac5b1a1997a454004ba9246a3c005 upstream.
There are some codepaths that do not initialize rx->link_sta properly. This
causes a crash in places which assume that rx->link_sta is valid if rx->sta
is valid.
One known instance is triggered by __ieee80211_rx_h_amsdu being called from
fast-rx. It results in a crash like this one:
BUG: kernel NULL pointer dereference, address: 00000000000000a8
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP PTI
CPU: 1 PID: 506 Comm: mt76-usb-rx phy Tainted: G E 6.1.0-debian64x+1.7 #3
Hardware name: ZOTAC ZBOX-ID92/ZBOX-IQ01/ZBOX-ID92/ZBOX-IQ01, BIOS B220P007 05/21/2014
RIP: 0010:ieee80211_deliver_skb+0x62/0x1f0 [mac80211]
Code: 00 48 89 04 24 e8 9e a7 c3 df 89 c0 48 03 1c c5 a0 ea 39 a1 4c 01 6b 08 48 ff 03 48
83 7d 28 00 74 11 48 8b 45 30 48 63 55 44 <48> 83 84 d0 a8 00 00 00 01 41 8b 86 c0
11 00 00 8d 50 fd 83 fa 01
RSP: 0018:ffff999040803b10 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffffb9903f496480 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff999040803ce0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d21828ac900
R13: 000000000000004a R14: ffff8d2198ed89c0 R15: ffff8d2198ed8000
FS: 0000000000000000(0000) GS:ffff8d24afe80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000a8 CR3: 0000000429810002 CR4: 00000000001706e0
Call Trace:
<TASK>
__ieee80211_rx_h_amsdu+0x1b5/0x240 [mac80211]
? ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211]
? __local_bh_enable_ip+0x3b/0xa0
ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211]
? prepare_transfer+0x109/0x1a0 [xhci_hcd]
ieee80211_rx_list+0xa80/0xda0 [mac80211]
mt76_rx_complete+0x207/0x2e0 [mt76]
mt76_rx_poll_complete+0x357/0x5a0 [mt76]
mt76u_rx_worker+0x4f5/0x600 [mt76_usb]
? mt76_get_min_avg_rssi+0x140/0x140 [mt76]
__mt76_worker_fn+0x50/0x80 [mt76]
kthread+0xed/0x120
? kthread_complete_and_exit+0x20/0x20
ret_from_fork+0x22/0x30
Since the initialization of rx->link and rx->link_sta is rather convoluted
and duplicated in many places, clean it up by using a helper function to
set it.
Fixes: ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling")
Fixes: b320d6c456ff ("wifi: mac80211: use correct rx link_sta instead of default")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20221230200747.19040-1-nbd@nbd.name
[remove unnecessary rx->sta->sta.mlo check]
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/rx.c | 222 ++++++++++++++++++++++++------------------------------
1 file changed, 99 insertions(+), 123 deletions(-)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -4070,6 +4070,58 @@ static void ieee80211_invoke_rx_handlers
#undef CALL_RXH
}
+static bool
+ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
+{
+ if (!sta->mlo)
+ return false;
+
+ return !!(sta->valid_links & BIT(link_id));
+}
+
+static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
+ u8 link_id)
+{
+ rx->link_id = link_id;
+ rx->link = rcu_dereference(rx->sdata->link[link_id]);
+
+ if (!rx->sta)
+ return rx->link;
+
+ if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))
+ return false;
+
+ rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
+
+ return rx->link && rx->link_sta;
+}
+
+static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
+ struct ieee80211_sta *pubsta,
+ int link_id)
+{
+ struct sta_info *sta;
+
+ sta = container_of(pubsta, struct sta_info, sta);
+
+ rx->link_id = link_id;
+ rx->sta = sta;
+
+ if (sta) {
+ rx->local = sta->sdata->local;
+ if (!rx->sdata)
+ rx->sdata = sta->sdata;
+ rx->link_sta = &sta->deflink;
+ }
+
+ if (link_id < 0)
+ rx->link = &rx->sdata->deflink;
+ else if (!ieee80211_rx_data_set_link(rx, link_id))
+ return false;
+
+ return true;
+}
+
/*
* This function makes calls into the RX path, therefore
* it has to be invoked under RCU read lock.
@@ -4078,16 +4130,19 @@ void ieee80211_release_reorder_timeout(s
{
struct sk_buff_head frames;
struct ieee80211_rx_data rx = {
- .sta = sta,
- .sdata = sta->sdata,
- .local = sta->local,
/* This is OK -- must be QoS data frame */
.security_idx = tid,
.seqno_idx = tid,
- .link_id = -1,
};
struct tid_ampdu_rx *tid_agg_rx;
- u8 link_id;
+ int link_id = -1;
+
+ /* FIXME: statistics won't be right with this */
+ if (sta->sta.valid_links)
+ link_id = ffs(sta->sta.valid_links) - 1;
+
+ if (!ieee80211_rx_data_set_sta(&rx, &sta->sta, link_id))
+ return;
tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
if (!tid_agg_rx)
@@ -4107,10 +4162,6 @@ void ieee80211_release_reorder_timeout(s
};
drv_event_callback(rx.local, rx.sdata, &event);
}
- /* FIXME: statistics won't be right with this */
- link_id = sta->sta.valid_links ? ffs(sta->sta.valid_links) - 1 : 0;
- rx.link = rcu_dereference(sta->sdata->link[link_id]);
- rx.link_sta = rcu_dereference(sta->link[link_id]);
ieee80211_rx_handlers(&rx, &frames);
}
@@ -4126,7 +4177,6 @@ void ieee80211_mark_rx_ba_filtered_frame
/* This is OK -- must be QoS data frame */
.security_idx = tid,
.seqno_idx = tid,
- .link_id = -1,
};
int i, diff;
@@ -4137,10 +4187,8 @@ void ieee80211_mark_rx_ba_filtered_frame
sta = container_of(pubsta, struct sta_info, sta);
- rx.sta = sta;
- rx.sdata = sta->sdata;
- rx.link = &rx.sdata->deflink;
- rx.local = sta->local;
+ if (!ieee80211_rx_data_set_sta(&rx, pubsta, -1))
+ return;
rcu_read_lock();
tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
@@ -4527,15 +4575,6 @@ void ieee80211_check_fast_rx_iface(struc
mutex_unlock(&local->sta_mtx);
}
-static bool
-ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
-{
- if (!sta->mlo)
- return false;
-
- return !!(sta->valid_links & BIT(link_id));
-}
-
static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
struct ieee80211_fast_rx *fast_rx,
int orig_len)
@@ -4646,7 +4685,6 @@ static bool ieee80211_invoke_fast_rx(str
struct sk_buff *skb = rx->skb;
struct ieee80211_hdr *hdr = (void *)skb->data;
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
- struct sta_info *sta = rx->sta;
int orig_len = skb->len;
int hdrlen = ieee80211_hdrlen(hdr->frame_control);
int snap_offs = hdrlen;
@@ -4658,7 +4696,6 @@ static bool ieee80211_invoke_fast_rx(str
u8 da[ETH_ALEN];
u8 sa[ETH_ALEN];
} addrs __aligned(2);
- struct link_sta_info *link_sta;
struct ieee80211_sta_rx_stats *stats;
/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
@@ -4761,18 +4798,10 @@ static bool ieee80211_invoke_fast_rx(str
drop:
dev_kfree_skb(skb);
- if (rx->link_id >= 0) {
- link_sta = rcu_dereference(sta->link[rx->link_id]);
- if (!link_sta)
- return true;
- } else {
- link_sta = &sta->deflink;
- }
-
if (fast_rx->uses_rss)
- stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
+ stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
else
- stats = &link_sta->rx_stats;
+ stats = &rx->link_sta->rx_stats;
stats->dropped++;
return true;
@@ -4790,8 +4819,8 @@ static bool ieee80211_prepare_and_rx_han
struct ieee80211_local *local = rx->local;
struct ieee80211_sub_if_data *sdata = rx->sdata;
struct ieee80211_hdr *hdr = (void *)skb->data;
- struct link_sta_info *link_sta = NULL;
- struct ieee80211_link_data *link;
+ struct link_sta_info *link_sta = rx->link_sta;
+ struct ieee80211_link_data *link = rx->link;
rx->skb = skb;
@@ -4813,35 +4842,6 @@ static bool ieee80211_prepare_and_rx_han
if (!ieee80211_accept_frame(rx))
return false;
- if (rx->link_id >= 0) {
- link = rcu_dereference(rx->sdata->link[rx->link_id]);
-
- /* we might race link removal */
- if (!link)
- return true;
- rx->link = link;
-
- if (rx->sta) {
- rx->link_sta =
- rcu_dereference(rx->sta->link[rx->link_id]);
- if (!rx->link_sta)
- return true;
- }
- } else {
- if (rx->sta)
- rx->link_sta = &rx->sta->deflink;
-
- rx->link = &sdata->deflink;
- }
-
- if (unlikely(!is_multicast_ether_addr(hdr->addr1) &&
- rx->link_id >= 0 && rx->sta && rx->sta->sta.mlo)) {
- link_sta = rcu_dereference(rx->sta->link[rx->link_id]);
-
- if (WARN_ON_ONCE(!link_sta))
- return true;
- }
-
if (!consume) {
struct skb_shared_hwtstamps *shwt;
@@ -4861,7 +4861,7 @@ static bool ieee80211_prepare_and_rx_han
shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
}
- if (unlikely(link_sta)) {
+ if (unlikely(rx->sta && rx->sta->sta.mlo)) {
/* translate to MLD addresses */
if (ether_addr_equal(link->conf->addr, hdr->addr1))
ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
@@ -4891,6 +4891,7 @@ static void __ieee80211_rx_handle_8023(s
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
struct ieee80211_fast_rx *fast_rx;
struct ieee80211_rx_data rx;
+ int link_id = -1;
memset(&rx, 0, sizeof(rx));
rx.skb = skb;
@@ -4907,12 +4908,8 @@ static void __ieee80211_rx_handle_8023(s
if (!pubsta)
goto drop;
- rx.sta = container_of(pubsta, struct sta_info, sta);
- rx.sdata = rx.sta->sdata;
-
- if (status->link_valid &&
- !ieee80211_rx_is_valid_sta_link_id(pubsta, status->link_id))
- goto drop;
+ if (status->link_valid)
+ link_id = status->link_id;
/*
* TODO: Should the frame be dropped if the right link_id is not
@@ -4921,19 +4918,8 @@ static void __ieee80211_rx_handle_8023(s
* link_id is used only for stats purpose and updating the stats on
* the deflink is fine?
*/
- if (status->link_valid)
- rx.link_id = status->link_id;
-
- if (rx.link_id >= 0) {
- struct ieee80211_link_data *link;
-
- link = rcu_dereference(rx.sdata->link[rx.link_id]);
- if (!link)
- goto drop;
- rx.link = link;
- } else {
- rx.link = &rx.sdata->deflink;
- }
+ if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
+ goto drop;
fast_rx = rcu_dereference(rx.sta->fast_rx);
if (!fast_rx)
@@ -4951,6 +4937,8 @@ static bool ieee80211_rx_for_interface(s
{
struct link_sta_info *link_sta;
struct ieee80211_hdr *hdr = (void *)skb->data;
+ struct sta_info *sta;
+ int link_id = -1;
/*
* Look up link station first, in case there's a
@@ -4960,24 +4948,19 @@ static bool ieee80211_rx_for_interface(s
*/
link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
if (link_sta) {
- rx->sta = link_sta->sta;
- rx->link_id = link_sta->link_id;
+ sta = link_sta->sta;
+ link_id = link_sta->link_id;
} else {
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
- rx->sta = sta_info_get_bss(rx->sdata, hdr->addr2);
- if (rx->sta) {
- if (status->link_valid &&
- !ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta,
- status->link_id))
- return false;
-
- rx->link_id = status->link_valid ? status->link_id : -1;
- } else {
- rx->link_id = -1;
- }
+ sta = sta_info_get_bss(rx->sdata, hdr->addr2);
+ if (status->link_valid)
+ link_id = status->link_id;
}
+ if (!ieee80211_rx_data_set_sta(rx, &sta->sta, link_id))
+ return false;
+
return ieee80211_prepare_and_rx_handle(rx, skb, consume);
}
@@ -5036,19 +5019,15 @@ static void __ieee80211_rx_handle_packet
if (ieee80211_is_data(fc)) {
struct sta_info *sta, *prev_sta;
- u8 link_id = status->link_id;
+ int link_id = -1;
- if (pubsta) {
- rx.sta = container_of(pubsta, struct sta_info, sta);
- rx.sdata = rx.sta->sdata;
+ if (status->link_valid)
+ link_id = status->link_id;
- if (status->link_valid &&
- !ieee80211_rx_is_valid_sta_link_id(pubsta, link_id))
+ if (pubsta) {
+ if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
goto out;
- if (status->link_valid)
- rx.link_id = status->link_id;
-
/*
* In MLO connection, fetch the link_id using addr2
* when the driver does not pass link_id in status.
@@ -5066,7 +5045,7 @@ static void __ieee80211_rx_handle_packet
if (!link_sta)
goto out;
- rx.link_id = link_sta->link_id;
+ ieee80211_rx_data_set_link(&rx, link_sta->link_id);
}
if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
@@ -5082,30 +5061,27 @@ static void __ieee80211_rx_handle_packet
continue;
}
- if ((status->link_valid &&
- !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
- link_id)) ||
- (!status->link_valid && prev_sta->sta.mlo))
+ rx.sdata = prev_sta->sdata;
+ if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
+ link_id))
+ goto out;
+
+ if (!status->link_valid && prev_sta->sta.mlo)
continue;
- rx.link_id = status->link_valid ? link_id : -1;
- rx.sta = prev_sta;
- rx.sdata = prev_sta->sdata;
ieee80211_prepare_and_rx_handle(&rx, skb, false);
prev_sta = sta;
}
if (prev_sta) {
- if ((status->link_valid &&
- !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
- link_id)) ||
- (!status->link_valid && prev_sta->sta.mlo))
+ rx.sdata = prev_sta->sdata;
+ if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
+ link_id))
goto out;
- rx.link_id = status->link_valid ? link_id : -1;
- rx.sta = prev_sta;
- rx.sdata = prev_sta->sdata;
+ if (!status->link_valid && prev_sta->sta.mlo)
+ goto out;
if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
return;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 037/193] nommu: fix memory leak in do_mmap() error path
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 036/193] wifi: mac80211: fix initialization of rx->link and rx->link_sta Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 038/193] nommu: fix do_munmap() " Greg Kroah-Hartman
` (164 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liam R. Howlett,
Matthew Wilcox (Oracle),
Vlastimil Babka, Yu Zhao, Andrew Morton
From: Liam Howlett <liam.howlett@oracle.com>
commit 7f31cced5724e6d414fe750aa1cd7e7b578ec22f upstream.
The preallocation of the maple tree nodes may leak if the error path to
"error_just_free" is taken. Fix this by moving the freeing of the maple
tree nodes to a shared location for all error paths.
Link: https://lkml.kernel.org/r/20230109205507.955577-1-Liam.Howlett@oracle.com
Fixes: 8220543df148 ("nommu: remove uses of VMA linked list")
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Yu Zhao <yuzhao@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/nommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/nommu.c b/mm/nommu.c
index 214c70e1d059..c8252f01d5db 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1240,6 +1240,7 @@ unsigned long do_mmap(struct file *file,
error_just_free:
up_write(&nommu_region_sem);
error:
+ mas_destroy(&mas);
if (region->vm_file)
fput(region->vm_file);
kmem_cache_free(vm_region_jar, region);
@@ -1250,7 +1251,6 @@ unsigned long do_mmap(struct file *file,
sharing_violation:
up_write(&nommu_region_sem);
- mas_destroy(&mas);
pr_warn("Attempt to share mismatched mappings\n");
ret = -EINVAL;
goto error;
--
2.39.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 038/193] nommu: fix do_munmap() error path
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 037/193] nommu: fix memory leak in do_mmap() error path Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 039/193] nommu: fix split_vma() map_count error Greg Kroah-Hartman
` (163 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liam R. Howlett,
Matthew Wilcox (Oracle),
Vlastimil Babka, Yu Zhao, Andrew Morton
From: Liam Howlett <liam.howlett@oracle.com>
commit 80be727ec87225797771a39f3e6801baf291faaf upstream.
When removing a VMA from the tree fails due to no memory, do not free the
VMA since a reference still exists.
Link: https://lkml.kernel.org/r/20230109205708.956103-1-Liam.Howlett@oracle.com
Fixes: 8220543df148 ("nommu: remove uses of VMA linked list")
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Yu Zhao <yuzhao@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/nommu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/nommu.c b/mm/nommu.c
index c8252f01d5db..844af5be7640 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1509,7 +1509,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len, struct list
erase_whole_vma:
if (delete_vma_from_mm(vma))
ret = -ENOMEM;
- delete_vma(mm, vma);
+ else
+ delete_vma(mm, vma);
return ret;
}
--
2.39.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 039/193] nommu: fix split_vma() map_count error
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 038/193] nommu: fix do_munmap() " Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 040/193] proc: fix PIE proc-empty-vm, proc-pid-vm tests Greg Kroah-Hartman
` (162 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liam R. Howlett,
Matthew Wilcox (Oracle),
Vlastimil Babka, Yu Zhao, Andrew Morton
From: Liam Howlett <liam.howlett@oracle.com>
commit fd9edbdbdcde6b489ce59f326755ef16a2ffadd7 upstream.
During the maple tree conversion of nommu, an error in counting the VMAs
was introduced by counting the existing VMA again. The counting used to
be decremented by one and incremented by two, but now it only increments
by two. Fix the counting error by moving the increment outside the
setup_vma_to_mm() function to the callers.
Link: https://lkml.kernel.org/r/20230109205809.956325-1-Liam.Howlett@oracle.com
Fixes: 8220543df148 ("nommu: remove uses of VMA linked list")
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Yu Zhao <yuzhao@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/nommu.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/mm/nommu.c b/mm/nommu.c
index 844af5be7640..5b83938ecb67 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -559,7 +559,6 @@ void vma_mas_remove(struct vm_area_struct *vma, struct ma_state *mas)
static void setup_vma_to_mm(struct vm_area_struct *vma, struct mm_struct *mm)
{
- mm->map_count++;
vma->vm_mm = mm;
/* add the VMA to the mapping */
@@ -587,6 +586,7 @@ static void mas_add_vma_to_mm(struct ma_state *mas, struct mm_struct *mm,
BUG_ON(!vma->vm_region);
setup_vma_to_mm(vma, mm);
+ mm->map_count++;
/* add the VMA to the tree */
vma_mas_store(vma, mas);
@@ -1347,6 +1347,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
if (vma->vm_file)
return -ENOMEM;
+ mm = vma->vm_mm;
if (mm->map_count >= sysctl_max_map_count)
return -ENOMEM;
@@ -1398,6 +1399,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
mas_set_range(&mas, vma->vm_start, vma->vm_end - 1);
mas_store(&mas, vma);
vma_mas_store(new, &mas);
+ mm->map_count++;
return 0;
err_mas_preallocate:
--
2.39.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 040/193] proc: fix PIE proc-empty-vm, proc-pid-vm tests
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 039/193] nommu: fix split_vma() map_count error Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 041/193] Add exception protection processing for vd in axi_chan_handle_err function Greg Kroah-Hartman
` (161 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Dobriyan,
Mirsad Goran Todorovac, Andrew Morton
From: Alexey Dobriyan <adobriyan@gmail.com>
commit 5316a017d093f644675a56523bcf5787ba8f4fef upstream.
vsyscall detection code uses direct call to the beginning of
the vsyscall page:
asm ("call %P0" :: "i" (0xffffffffff600000))
It generates "call rel32" instruction but it is not relocated if binary
is PIE, so binary segfaults into random userspace address and vsyscall
page status is detected incorrectly.
Do more direct:
asm ("call *%rax")
which doesn't do need any relocaltions.
Mark g_vsyscall as volatile for a good measure, I didn't find instruction
setting it to 0. Now the code is obviously correct:
xor eax, eax
mov rdi, rbp
mov rsi, rbp
mov DWORD PTR [rip+0x2d15], eax # g_vsyscall = 0
mov rax, 0xffffffffff600000
call rax
mov DWORD PTR [rip+0x2d02], 1 # g_vsyscall = 1
mov eax, DWORD PTR ds:0xffffffffff600000
mov DWORD PTR [rip+0x2cf1], 2 # g_vsyscall = 2
mov edi, [rip+0x2ceb] # exit(g_vsyscall)
call exit
Note: fixed proc-empty-vm test oopses 5.19.0-28-generic kernel
but this is separate story.
Link: https://lkml.kernel.org/r/Y7h2xvzKLg36DSq8@p183
Fixes: 5bc73bb3451b9 ("proc: test how it holds up with mapping'less process")
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Tested-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/proc/proc-empty-vm.c | 12 +++++++-----
tools/testing/selftests/proc/proc-pid-vm.c | 9 +++++----
2 files changed, 12 insertions(+), 9 deletions(-)
diff --git a/tools/testing/selftests/proc/proc-empty-vm.c b/tools/testing/selftests/proc/proc-empty-vm.c
index d95b1cb43d9d..7588428b8fcd 100644
--- a/tools/testing/selftests/proc/proc-empty-vm.c
+++ b/tools/testing/selftests/proc/proc-empty-vm.c
@@ -25,6 +25,7 @@
#undef NDEBUG
#include <assert.h>
#include <errno.h>
+#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -41,7 +42,7 @@
* 1: vsyscall VMA is --xp vsyscall=xonly
* 2: vsyscall VMA is r-xp vsyscall=emulate
*/
-static int g_vsyscall;
+static volatile int g_vsyscall;
static const char *g_proc_pid_maps_vsyscall;
static const char *g_proc_pid_smaps_vsyscall;
@@ -147,11 +148,12 @@ static void vsyscall(void)
g_vsyscall = 0;
/* gettimeofday(NULL, NULL); */
+ uint64_t rax = 0xffffffffff600000;
asm volatile (
- "call %P0"
- :
- : "i" (0xffffffffff600000), "D" (NULL), "S" (NULL)
- : "rax", "rcx", "r11"
+ "call *%[rax]"
+ : [rax] "+a" (rax)
+ : "D" (NULL), "S" (NULL)
+ : "rcx", "r11"
);
g_vsyscall = 1;
diff --git a/tools/testing/selftests/proc/proc-pid-vm.c b/tools/testing/selftests/proc/proc-pid-vm.c
index 69551bfa215c..cacbd2a4aec9 100644
--- a/tools/testing/selftests/proc/proc-pid-vm.c
+++ b/tools/testing/selftests/proc/proc-pid-vm.c
@@ -257,11 +257,12 @@ static void vsyscall(void)
g_vsyscall = 0;
/* gettimeofday(NULL, NULL); */
+ uint64_t rax = 0xffffffffff600000;
asm volatile (
- "call %P0"
- :
- : "i" (0xffffffffff600000), "D" (NULL), "S" (NULL)
- : "rax", "rcx", "r11"
+ "call *%[rax]"
+ : [rax] "+a" (rax)
+ : "D" (NULL), "S" (NULL)
+ : "rcx", "r11"
);
g_vsyscall = 1;
--
2.39.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 041/193] Add exception protection processing for vd in axi_chan_handle_err function
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 040/193] proc: fix PIE proc-empty-vm, proc-pid-vm tests Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 042/193] LoongArch: Add HWCAP_LOONGARCH_CPUCFG to elf_hwcap Greg Kroah-Hartman
` (160 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shawn.Shao, Vinod Koul
From: Shawn.Shao <shawn.shao@jaguarmicro.com>
commit 57054fe516d59d03a7bcf1888e82479ccc244f87 upstream.
Since there is no protection for vd, a kernel panic will be
triggered here in exceptional cases.
You can refer to the processing of axi_chan_block_xfer_complete function
The triggered kernel panic is as follows:
[ 67.848444] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060
[ 67.848447] Mem abort info:
[ 67.848449] ESR = 0x96000004
[ 67.848451] EC = 0x25: DABT (current EL), IL = 32 bits
[ 67.848454] SET = 0, FnV = 0
[ 67.848456] EA = 0, S1PTW = 0
[ 67.848458] Data abort info:
[ 67.848460] ISV = 0, ISS = 0x00000004
[ 67.848462] CM = 0, WnR = 0
[ 67.848465] user pgtable: 4k pages, 48-bit VAs, pgdp=00000800c4c0b000
[ 67.848468] [0000000000000060] pgd=0000000000000000, p4d=0000000000000000
[ 67.848472] Internal error: Oops: 96000004 [#1] SMP
[ 67.848475] Modules linked in: dmatest
[ 67.848479] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.100-emu_x2rc+ #11
[ 67.848483] pstate: 62000085 (nZCv daIf -PAN -UAO +TCO BTYPE=--)
[ 67.848487] pc : axi_chan_handle_err+0xc4/0x230
[ 67.848491] lr : axi_chan_handle_err+0x30/0x230
[ 67.848493] sp : ffff0803fe55ae50
[ 67.848495] x29: ffff0803fe55ae50 x28: ffff800011212200
[ 67.848500] x27: ffff0800c42c0080 x26: ffff0800c097c080
[ 67.848504] x25: ffff800010d33880 x24: ffff80001139d850
[ 67.848508] x23: ffff0800c097c168 x22: 0000000000000000
[ 67.848512] x21: 0000000000000080 x20: 0000000000002000
[ 67.848517] x19: ffff0800c097c080 x18: 0000000000000000
[ 67.848521] x17: 0000000000000000 x16: 0000000000000000
[ 67.848525] x15: 0000000000000000 x14: 0000000000000000
[ 67.848529] x13: 0000000000000000 x12: 0000000000000040
[ 67.848533] x11: ffff0800c0400248 x10: ffff0800c040024a
[ 67.848538] x9 : ffff800010576cd4 x8 : ffff0800c0400270
[ 67.848542] x7 : 0000000000000000 x6 : ffff0800c04003e0
[ 67.848546] x5 : ffff0800c0400248 x4 : ffff0800c4294480
[ 67.848550] x3 : dead000000000100 x2 : dead000000000122
[ 67.848555] x1 : 0000000000000100 x0 : ffff0800c097c168
[ 67.848559] Call trace:
[ 67.848562] axi_chan_handle_err+0xc4/0x230
[ 67.848566] dw_axi_dma_interrupt+0xf4/0x590
[ 67.848569] __handle_irq_event_percpu+0x60/0x220
[ 67.848573] handle_irq_event+0x64/0x120
[ 67.848576] handle_fasteoi_irq+0xc4/0x220
[ 67.848580] __handle_domain_irq+0x80/0xe0
[ 67.848583] gic_handle_irq+0xc0/0x138
[ 67.848585] el1_irq+0xc8/0x180
[ 67.848588] arch_cpu_idle+0x14/0x2c
[ 67.848591] default_idle_call+0x40/0x16c
[ 67.848594] do_idle+0x1f0/0x250
[ 67.848597] cpu_startup_entry+0x2c/0x60
[ 67.848600] rest_init+0xc0/0xcc
[ 67.848603] arch_call_rest_init+0x14/0x1c
[ 67.848606] start_kernel+0x4cc/0x500
[ 67.848610] Code: eb0002ff 9a9f12d6 f2fbd5a2 f2fbd5a3 (a94602c1)
[ 67.848613] ---[ end trace 585a97036f88203a ]---
Signed-off-by: Shawn.Shao <shawn.shao@jaguarmicro.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230112055802.1764-1-shawn.shao@jaguarmicro.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -1018,6 +1018,11 @@ static noinline void axi_chan_handle_err
/* The bad descriptor currently is in the head of vc list */
vd = vchan_next_desc(&chan->vc);
+ if (!vd) {
+ dev_err(chan2dev(chan), "BUG: %s, IRQ with no descriptors\n",
+ axi_chan_name(chan));
+ goto out;
+ }
/* Remove the completed descriptor from issued list */
list_del(&vd->node);
@@ -1032,6 +1037,7 @@ static noinline void axi_chan_handle_err
/* Try to restart the controller */
axi_chan_start_first_queued(chan);
+out:
spin_unlock_irqrestore(&chan->vc.lock, flags);
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 042/193] LoongArch: Add HWCAP_LOONGARCH_CPUCFG to elf_hwcap
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 041/193] Add exception protection processing for vd in axi_chan_handle_err function Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 043/193] zonefs: Detect append writes at invalid locations Greg Kroah-Hartman
` (159 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yinyu Cai, Huacai Chen
From: Huacai Chen <chenhuacai@loongson.cn>
commit d52fec86a465355b379e839fa372ead0334d62e6 upstream.
HWCAP_LOONGARCH_CPUCFG is missing in elf_hwcap, so add it for glibc's
later use.
Cc: stable@vger.kernel.org
Reported-by: Yinyu Cai <caiyinyu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/kernel/cpu-probe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/loongarch/kernel/cpu-probe.c
+++ b/arch/loongarch/kernel/cpu-probe.c
@@ -94,7 +94,7 @@ static void cpu_probe_common(struct cpui
c->options = LOONGARCH_CPU_CPUCFG | LOONGARCH_CPU_CSR |
LOONGARCH_CPU_TLB | LOONGARCH_CPU_VINT | LOONGARCH_CPU_WATCH;
- elf_hwcap |= HWCAP_LOONGARCH_CRC32;
+ elf_hwcap = HWCAP_LOONGARCH_CPUCFG | HWCAP_LOONGARCH_CRC32;
config = read_cpucfg(LOONGARCH_CPUCFG1);
if (config & CPUCFG1_UAL) {
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 043/193] zonefs: Detect append writes at invalid locations
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 042/193] LoongArch: Add HWCAP_LOONGARCH_CPUCFG to elf_hwcap Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 044/193] nilfs2: fix general protection fault in nilfs_btree_insert() Greg Kroah-Hartman
` (158 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Johannes Thumshirn
From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
commit a608da3bd730d718f2d3ebec1c26f9865f8f17ce upstream.
Using REQ_OP_ZONE_APPEND operations for synchronous writes to sequential
files succeeds regardless of the zone write pointer position, as long as
the target zone is not full. This means that if an external (buggy)
application writes to the zone of a sequential file underneath the file
system, subsequent file write() operation will succeed but the file size
will not be correct and the file will contain invalid data written by
another application.
Modify zonefs_file_dio_append() to check the written sector of an append
write (returned in bio->bi_iter.bi_sector) and return -EIO if there is a
mismatch with the file zone wp offset field. This change triggers a call
to zonefs_io_error() and a zone check. Modify zonefs_io_error_cb() to
not expose the unexpected data after the current inode size when the
errors=remount-ro mode is used. Other error modes are correctly handled
already.
Fixes: 02ef12a663c7 ("zonefs: use REQ_OP_ZONE_APPEND for sync DIO")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/zonefs/super.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/fs/zonefs/super.c
+++ b/fs/zonefs/super.c
@@ -442,6 +442,10 @@ static int zonefs_io_error_cb(struct blk
data_size = zonefs_check_zone_condition(inode, zone,
false, false);
}
+ } else if (sbi->s_mount_opts & ZONEFS_MNTOPT_ERRORS_RO &&
+ data_size > isize) {
+ /* Do not expose garbage data */
+ data_size = isize;
}
/*
@@ -805,6 +809,24 @@ static ssize_t zonefs_file_dio_append(st
ret = submit_bio_wait(bio);
+ /*
+ * If the file zone was written underneath the file system, the zone
+ * write pointer may not be where we expect it to be, but the zone
+ * append write can still succeed. So check manually that we wrote where
+ * we intended to, that is, at zi->i_wpoffset.
+ */
+ if (!ret) {
+ sector_t wpsector =
+ zi->i_zsector + (zi->i_wpoffset >> SECTOR_SHIFT);
+
+ if (bio->bi_iter.bi_sector != wpsector) {
+ zonefs_warn(inode->i_sb,
+ "Corrupted write pointer %llu for zone at %llu\n",
+ wpsector, zi->i_zsector);
+ ret = -EIO;
+ }
+ }
+
zonefs_file_write_dio_end_io(iocb, size, ret, 0);
trace_zonefs_file_dio_append(inode, size, ret);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 044/193] nilfs2: fix general protection fault in nilfs_btree_insert()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 043/193] zonefs: Detect append writes at invalid locations Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 045/193] mm/shmem: restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE Greg Kroah-Hartman
` (157 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryusuke Konishi,
syzbot+ede796cecd5296353515, Andrew Morton
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
commit 7633355e5c7f29c049a9048e461427d1d8ed3051 upstream.
If nilfs2 reads a corrupted disk image and tries to reads a b-tree node
block by calling __nilfs_btree_get_block() against an invalid virtual
block address, it returns -ENOENT because conversion of the virtual block
address to a disk block address fails. However, this return value is the
same as the internal code that b-tree lookup routines return to indicate
that the block being searched does not exist, so functions that operate on
that b-tree may misbehave.
When nilfs_btree_insert() receives this spurious 'not found' code from
nilfs_btree_do_lookup(), it misunderstands that the 'not found' check was
successful and continues the insert operation using incomplete lookup path
data, causing the following crash:
general protection fault, probably for non-canonical address
0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
...
RIP: 0010:nilfs_btree_get_nonroot_node fs/nilfs2/btree.c:418 [inline]
RIP: 0010:nilfs_btree_prepare_insert fs/nilfs2/btree.c:1077 [inline]
RIP: 0010:nilfs_btree_insert+0x6d3/0x1c10 fs/nilfs2/btree.c:1238
Code: bc 24 80 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89
ff e8 4b 02 92 fe 4d 8b 3f 49 83 c7 28 4c 89 f8 48 c1 e8 03 <42> 80 3c
28 00 74 08 4c 89 ff e8 2e 02 92 fe 4d 8b 3f 49 83 c7 02
...
Call Trace:
<TASK>
nilfs_bmap_do_insert fs/nilfs2/bmap.c:121 [inline]
nilfs_bmap_insert+0x20d/0x360 fs/nilfs2/bmap.c:147
nilfs_get_block+0x414/0x8d0 fs/nilfs2/inode.c:101
__block_write_begin_int+0x54c/0x1a80 fs/buffer.c:1991
__block_write_begin fs/buffer.c:2041 [inline]
block_write_begin+0x93/0x1e0 fs/buffer.c:2102
nilfs_write_begin+0x9c/0x110 fs/nilfs2/inode.c:261
generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772
__generic_file_write_iter+0x176/0x400 mm/filemap.c:3900
generic_file_write_iter+0xab/0x310 mm/filemap.c:3932
call_write_iter include/linux/fs.h:2186 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x7dc/0xc50 fs/read_write.c:584
ksys_write+0x177/0x2a0 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
...
</TASK>
This patch fixes the root cause of this problem by replacing the error
code that __nilfs_btree_get_block() returns on block address conversion
failure from -ENOENT to another internal code -EINVAL which means that the
b-tree metadata is corrupted.
By returning -EINVAL, it propagates without glitches, and for all relevant
b-tree operations, functions in the upper bmap layer output an error
message indicating corrupted b-tree metadata via
nilfs_bmap_convert_error(), and code -EIO will be eventually returned as
it should be.
Link: https://lkml.kernel.org/r/000000000000bd89e205f0e38355@google.com
Link: https://lkml.kernel.org/r/20230105055356.8811-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+ede796cecd5296353515@syzkaller.appspotmail.com
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/btree.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -480,9 +480,18 @@ static int __nilfs_btree_get_block(const
ret = nilfs_btnode_submit_block(btnc, ptr, 0, REQ_OP_READ, &bh,
&submit_ptr);
if (ret) {
- if (ret != -EEXIST)
- return ret;
- goto out_check;
+ if (likely(ret == -EEXIST))
+ goto out_check;
+ if (ret == -ENOENT) {
+ /*
+ * Block address translation failed due to invalid
+ * value of 'ptr'. In this case, return internal code
+ * -EINVAL (broken bmap) to notify bmap layer of fatal
+ * metadata corruption.
+ */
+ ret = -EINVAL;
+ }
+ return ret;
}
if (ra) {
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 045/193] mm/shmem: restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 044/193] nilfs2: fix general protection fault in nilfs_btree_insert() Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 046/193] hugetlb: unshare some PMDs when splitting VMAs Greg Kroah-Hartman
` (156 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zach OKeefe, Hugh Dickins,
David Hildenbrand, Yang Shi, Andrew Morton
From: Zach O'Keefe <zokeefe@google.com>
commit 3de0c269adc6c2fac0bb1fb11965f0de699dc32b upstream.
SHMEM_HUGE_DENY is for emergency use by the admin, to disable allocation
of shmem huge pages if, for example, a dangerous bug is found in their
usage: see "deny" in Documentation/mm/transhuge.rst. An app using
madvise(,,MADV_COLLAPSE) should not be allowed to override it: restore its
precedence over shmem_huge_force.
Restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE.
Link: https://lkml.kernel.org/r/20221224082035.3197140-2-zokeefe@google.com
Fixes: 7c6c6cc4d3a2 ("mm/shmem: add flag to enforce shmem THP in hugepage_vma_check()")
Signed-off-by: Zach O'Keefe <zokeefe@google.com>
Suggested-by: Hugh Dickins <hughd@google.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Yang Shi <shy828301@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/shmem.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -472,12 +472,10 @@ bool shmem_is_huge(struct vm_area_struct
if (vma && ((vma->vm_flags & VM_NOHUGEPAGE) ||
test_bit(MMF_DISABLE_THP, &vma->vm_mm->flags)))
return false;
- if (shmem_huge_force)
- return true;
- if (shmem_huge == SHMEM_HUGE_FORCE)
- return true;
if (shmem_huge == SHMEM_HUGE_DENY)
return false;
+ if (shmem_huge_force || shmem_huge == SHMEM_HUGE_FORCE)
+ return true;
switch (SHMEM_SB(inode->i_sb)->huge) {
case SHMEM_HUGE_ALWAYS:
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 046/193] hugetlb: unshare some PMDs when splitting VMAs
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 045/193] mm/shmem: restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 047/193] mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma Greg Kroah-Hartman
` (155 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Houghton, Mike Kravetz,
Peter Xu, Axel Rasmussen, Muchun Song, Andrew Morton
From: James Houghton <jthoughton@google.com>
commit b30c14cd61025eeea2f2e8569606cd167ba9ad2d upstream.
PMD sharing can only be done in PUD_SIZE-aligned pieces of VMAs; however,
it is possible that HugeTLB VMAs are split without unsharing the PMDs
first.
Without this fix, it is possible to hit the uffd-wp-related WARN_ON_ONCE
in hugetlb_change_protection [1]. The key there is that
hugetlb_unshare_all_pmds will not attempt to unshare PMDs in
non-PUD_SIZE-aligned sections of the VMA.
It might seem ideal to unshare in hugetlb_vm_op_open, but we need to
unshare in both the new and old VMAs, so unsharing in hugetlb_vm_op_split
seems natural.
[1]: https://lore.kernel.org/linux-mm/CADrL8HVeOkj0QH5VZZbRzybNE8CG-tEGFshnA+bG9nMgcWtBSg@mail.gmail.com/
Link: https://lkml.kernel.org/r/20230104231910.1464197-1-jthoughton@google.com
Fixes: 6dfeaff93be1 ("hugetlb/userfaultfd: unshare all pmds for hugetlbfs when register wp")
Signed-off-by: James Houghton <jthoughton@google.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Acked-by: Peter Xu <peterx@redhat.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Muchun Song <songmuchun@bytedance.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 44 +++++++++++++++++++++++++++++++++++---------
1 file changed, 35 insertions(+), 9 deletions(-)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -94,6 +94,8 @@ static int hugetlb_acct_memory(struct hs
static void hugetlb_vma_lock_free(struct vm_area_struct *vma);
static void hugetlb_vma_lock_alloc(struct vm_area_struct *vma);
static void __hugetlb_vma_unlock_write_free(struct vm_area_struct *vma);
+static void hugetlb_unshare_pmds(struct vm_area_struct *vma,
+ unsigned long start, unsigned long end);
static inline bool subpool_is_free(struct hugepage_subpool *spool)
{
@@ -4825,6 +4827,25 @@ static int hugetlb_vm_op_split(struct vm
{
if (addr & ~(huge_page_mask(hstate_vma(vma))))
return -EINVAL;
+
+ /*
+ * PMD sharing is only possible for PUD_SIZE-aligned address ranges
+ * in HugeTLB VMAs. If we will lose PUD_SIZE alignment due to this
+ * split, unshare PMDs in the PUD_SIZE interval surrounding addr now.
+ */
+ if (addr & ~PUD_MASK) {
+ /*
+ * hugetlb_vm_op_split is called right before we attempt to
+ * split the VMA. We will need to unshare PMDs in the old and
+ * new VMAs, so let's unshare before we split.
+ */
+ unsigned long floor = addr & PUD_MASK;
+ unsigned long ceil = floor + PUD_SIZE;
+
+ if (floor >= vma->vm_start && ceil <= vma->vm_end)
+ hugetlb_unshare_pmds(vma, floor, ceil);
+ }
+
return 0;
}
@@ -7386,26 +7407,21 @@ void move_hugetlb_state(struct page *old
}
}
-/*
- * This function will unconditionally remove all the shared pmd pgtable entries
- * within the specific vma for a hugetlbfs memory range.
- */
-void hugetlb_unshare_all_pmds(struct vm_area_struct *vma)
+static void hugetlb_unshare_pmds(struct vm_area_struct *vma,
+ unsigned long start,
+ unsigned long end)
{
struct hstate *h = hstate_vma(vma);
unsigned long sz = huge_page_size(h);
struct mm_struct *mm = vma->vm_mm;
struct mmu_notifier_range range;
- unsigned long address, start, end;
+ unsigned long address;
spinlock_t *ptl;
pte_t *ptep;
if (!(vma->vm_flags & VM_MAYSHARE))
return;
- start = ALIGN(vma->vm_start, PUD_SIZE);
- end = ALIGN_DOWN(vma->vm_end, PUD_SIZE);
-
if (start >= end)
return;
@@ -7437,6 +7453,16 @@ void hugetlb_unshare_all_pmds(struct vm_
mmu_notifier_invalidate_range_end(&range);
}
+/*
+ * This function will unconditionally remove all the shared pmd pgtable entries
+ * within the specific vma for a hugetlbfs memory range.
+ */
+void hugetlb_unshare_all_pmds(struct vm_area_struct *vma)
+{
+ hugetlb_unshare_pmds(vma, ALIGN(vma->vm_start, PUD_SIZE),
+ ALIGN_DOWN(vma->vm_end, PUD_SIZE));
+}
+
#ifdef CONFIG_CMA
static bool cma_reserve_called __initdata;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 047/193] mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 046/193] hugetlb: unshare some PMDs when splitting VMAs Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 048/193] serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler Greg Kroah-Hartman
` (154 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hugh Dickins, David Hildenbrand,
Jann Horn, Yang Shi, Zach OKeefe, Song Liu, Andrew Morton
From: Hugh Dickins <hughd@google.com>
commit ab0c3f1251b4670978fde0bd54161795a139b060 upstream.
uprobe_write_opcode() uses collapse_pte_mapped_thp() to restore huge pmd,
when removing a breakpoint from hugepage text: vma->anon_vma is always set
in that case, so undo the prohibition. And MADV_COLLAPSE ought to be able
to collapse some page tables in a vma which happens to have anon_vma set
from CoWing elsewhere.
Is anon_vma lock required? Almost not: if any page other than expected
subpage of the non-anon huge page is found in the page table, collapse is
aborted without making any change. However, it is possible that an anon
page was CoWed from this extent in another mm or vma, in which case a
concurrent lookup might look here: so keep it away while clearing pmd (but
perhaps we shall go back to using pmd_lock() there in future).
Note that collapse_pte_mapped_thp() is exceptional in freeing a page table
without having cleared its ptes: I'm uneasy about that, and had thought
pte_clear()ing appropriate; but exclusive i_mmap lock does fix the
problem, and we would have to move the mmu_notification if clearing those
ptes.
What this fixes is not a dangerous instability. But I suggest Cc stable
because uprobes "healing" has regressed in that way, so this should follow
8d3c106e19e8 into those stable releases where it was backported (and may
want adjustment there - I'll supply backports as needed).
Link: https://lkml.kernel.org/r/b740c9fb-edba-92ba-59fb-7a5592e5dfc@google.com
Fixes: 8d3c106e19e8 ("mm/khugepaged: take the right locks for page table retraction")
Signed-off-by: Hugh Dickins <hughd@google.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Yang Shi <shy828301@gmail.com>
Cc: Zach O'Keefe <zokeefe@google.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: <stable@vger.kernel.org> [5.4+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/khugepaged.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1467,14 +1467,6 @@ int collapse_pte_mapped_thp(struct mm_st
if (!hugepage_vma_check(vma, vma->vm_flags, false, false, false))
return SCAN_VMA_CHECK;
- /*
- * Symmetry with retract_page_tables(): Exclude MAP_PRIVATE mappings
- * that got written to. Without this, we'd have to also lock the
- * anon_vma if one exists.
- */
- if (vma->anon_vma)
- return SCAN_VMA_CHECK;
-
/* Keep pmd pgtable for uffd-wp; see comment in retract_page_tables() */
if (userfaultfd_wp(vma))
return SCAN_PTE_UFFD_WP;
@@ -1574,8 +1566,14 @@ int collapse_pte_mapped_thp(struct mm_st
}
/* step 4: remove pte entries */
+ /* we make no change to anon, but protect concurrent anon page lookup */
+ if (vma->anon_vma)
+ anon_vma_lock_write(vma->anon_vma);
+
collapse_and_free_pmd(mm, vma, haddr, pmd);
+ if (vma->anon_vma)
+ anon_vma_unlock_write(vma->anon_vma);
i_mmap_unlock_write(vma->vm_file->f_mapping);
maybe_install_pmd:
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 048/193] serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 047/193] mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 049/193] Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler" Greg Kroah-Hartman
` (153 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Marek Vasut, Valentin Caron
From: Marek Vasut <marex@denx.de>
commit f24771b62a83239f0dce816bddf0f6807f436235 upstream.
Requesting an interrupt with IRQF_ONESHOT will run the primary handler
in the hard-IRQ context even in the force-threaded mode. The
force-threaded mode is used by PREEMPT_RT in order to avoid acquiring
sleeping locks (spinlock_t) in hard-IRQ context. This combination
makes it impossible and leads to "sleeping while atomic" warnings.
Use one interrupt handler for both handlers (primary and secondary)
and drop the IRQF_ONESHOT flag which is not needed.
Fixes: e359b4411c283 ("serial: stm32: fix threaded interrupt handling")
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Tested-by: Valentin Caron <valentin.caron@foss.st.com> # V3
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230112180417.25595-1-marex@denx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/stm32-usart.c | 31 ++++---------------------------
1 file changed, 4 insertions(+), 27 deletions(-)
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -798,23 +798,9 @@ static irqreturn_t stm32_usart_interrupt
spin_unlock(&port->lock);
}
- if (stm32_usart_rx_dma_enabled(port))
- return IRQ_WAKE_THREAD;
- else
- return IRQ_HANDLED;
-}
-
-static irqreturn_t stm32_usart_threaded_interrupt(int irq, void *ptr)
-{
- struct uart_port *port = ptr;
- struct tty_port *tport = &port->state->port;
- struct stm32_port *stm32_port = to_stm32_port(port);
- unsigned int size;
- unsigned long flags;
-
/* Receiver timeout irq for DMA RX */
- if (!stm32_port->throttled) {
- spin_lock_irqsave(&port->lock, flags);
+ if (stm32_usart_rx_dma_enabled(port) && !stm32_port->throttled) {
+ spin_lock(&port->lock);
size = stm32_usart_receive_chars(port, false);
uart_unlock_and_check_sysrq_irqrestore(port, flags);
if (size)
@@ -1016,10 +1002,8 @@ static int stm32_usart_startup(struct ua
u32 val;
int ret;
- ret = request_threaded_irq(port->irq, stm32_usart_interrupt,
- stm32_usart_threaded_interrupt,
- IRQF_ONESHOT | IRQF_NO_SUSPEND,
- name, port);
+ ret = request_irq(port->irq, stm32_usart_interrupt,
+ IRQF_NO_SUSPEND, name, port);
if (ret)
return ret;
@@ -1602,13 +1586,6 @@ static int stm32_usart_of_dma_rx_probe(s
struct dma_slave_config config;
int ret;
- /*
- * Using DMA and threaded handler for the console could lead to
- * deadlocks.
- */
- if (uart_console(port))
- return -ENODEV;
-
stm32port->rx_buf = dma_alloc_coherent(dev, RX_BUF_L,
&stm32port->rx_dma_buf,
GFP_KERNEL);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 049/193] Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler"
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 048/193] serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 050/193] xhci-pci: set the dma max_seg_size Greg Kroah-Hartman
` (152 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
Sebastian Andrzej Siewior, Marek Vasut, Johan Hovold,
Valentin Caron
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2cbafffbf69addd7509072f4be5917f81d238cf6 upstream.
This reverts commit f24771b62a83239f0dce816bddf0f6807f436235 as it is
reported to break the build.
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/r/202301200130.ttBiTzfO-lkp@intel.com
Fixes: f24771b62a83 ("serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler")
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Valentin Caron <valentin.caron@foss.st.com> # V3
Cc: Marek Vasut <marex@denx.de>
Cc: Johan Hovold <johan@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/stm32-usart.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -798,9 +798,23 @@ static irqreturn_t stm32_usart_interrupt
spin_unlock(&port->lock);
}
+ if (stm32_usart_rx_dma_enabled(port))
+ return IRQ_WAKE_THREAD;
+ else
+ return IRQ_HANDLED;
+}
+
+static irqreturn_t stm32_usart_threaded_interrupt(int irq, void *ptr)
+{
+ struct uart_port *port = ptr;
+ struct tty_port *tport = &port->state->port;
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ unsigned int size;
+ unsigned long flags;
+
/* Receiver timeout irq for DMA RX */
- if (stm32_usart_rx_dma_enabled(port) && !stm32_port->throttled) {
- spin_lock(&port->lock);
+ if (!stm32_port->throttled) {
+ spin_lock_irqsave(&port->lock, flags);
size = stm32_usart_receive_chars(port, false);
uart_unlock_and_check_sysrq_irqrestore(port, flags);
if (size)
@@ -1002,8 +1016,10 @@ static int stm32_usart_startup(struct ua
u32 val;
int ret;
- ret = request_irq(port->irq, stm32_usart_interrupt,
- IRQF_NO_SUSPEND, name, port);
+ ret = request_threaded_irq(port->irq, stm32_usart_interrupt,
+ stm32_usart_threaded_interrupt,
+ IRQF_ONESHOT | IRQF_NO_SUSPEND,
+ name, port);
if (ret)
return ret;
@@ -1586,6 +1602,13 @@ static int stm32_usart_of_dma_rx_probe(s
struct dma_slave_config config;
int ret;
+ /*
+ * Using DMA and threaded handler for the console could lead to
+ * deadlocks.
+ */
+ if (uart_console(port))
+ return -ENODEV;
+
stm32port->rx_buf = dma_alloc_coherent(dev, RX_BUF_L,
&stm32port->rx_dma_buf,
GFP_KERNEL);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 050/193] xhci-pci: set the dma max_seg_size
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 049/193] Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler" Greg Kroah-Hartman
@ 2023-01-22 15:02 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 051/193] usb: xhci: Check endpoint is valid before dereferencing it Greg Kroah-Hartman
` (151 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Ricardo Ribalda,
Mathias Nyman
From: Ricardo Ribalda <ribalda@chromium.org>
commit 93915a4170e9defd56a767a18e6c4076f3d18609 upstream.
Allow devices to have dma operations beyond 64K, and avoid warnings such
as:
xhci_hcd 0000:00:14.0: mapping sg segment longer than device claims to support [len=98304] [max=65536]
Cc: stable@vger.kernel.org
Cc: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230116142216.1141605-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-pci.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -455,6 +455,8 @@ static int xhci_pci_probe(struct pci_dev
if (xhci->quirks & XHCI_DEFAULT_PM_RUNTIME_ALLOW)
pm_runtime_allow(&dev->dev);
+ dma_set_max_seg_size(&dev->dev, UINT_MAX);
+
return 0;
put_usb3_hcd:
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 051/193] usb: xhci: Check endpoint is valid before dereferencing it
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2023-01-22 15:02 ` [PATCH 6.1 050/193] xhci-pci: set the dma max_seg_size Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 052/193] xhci: Fix null pointer dereference when host dies Greg Kroah-Hartman
` (150 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jimmy Hu, Mathias Nyman
From: Jimmy Hu <hhhuuu@google.com>
commit e8fb5bc76eb86437ab87002d4a36d6da02165654 upstream.
When the host controller is not responding, all URBs queued to all
endpoints need to be killed. This can cause a kernel panic if we
dereference an invalid endpoint.
Fix this by using xhci_get_virt_ep() helper to find the endpoint and
checking if the endpoint is valid before dereferencing it.
[233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead
[233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8
[233311.853964] pc : xhci_hc_died+0x10c/0x270
[233311.853971] lr : xhci_hc_died+0x1ac/0x270
[233311.854077] Call trace:
[233311.854085] xhci_hc_died+0x10c/0x270
[233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4
[233311.854105] call_timer_fn+0x50/0x2d4
[233311.854112] expire_timers+0xac/0x2e4
[233311.854118] run_timer_softirq+0x300/0xabc
[233311.854127] __do_softirq+0x148/0x528
[233311.854135] irq_exit+0x194/0x1a8
[233311.854143] __handle_domain_irq+0x164/0x1d0
[233311.854149] gic_handle_irq.22273+0x10c/0x188
[233311.854156] el1_irq+0xfc/0x1a8
[233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm]
[233311.854185] cpuidle_enter_state+0x1f0/0x764
[233311.854194] do_idle+0x594/0x6ac
[233311.854201] cpu_startup_entry+0x7c/0x80
[233311.854209] secondary_start_kernel+0x170/0x198
Fixes: 50e8725e7c42 ("xhci: Refactor command watchdog and fix split string.")
Cc: stable@vger.kernel.org
Signed-off-by: Jimmy Hu <hhhuuu@google.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Message-ID: <0fe978ed-8269-9774-1c40-f8a98c17e838@linux.intel.com>
Link: https://lore.kernel.org/r/20230116142216.1141605-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1170,7 +1170,10 @@ static void xhci_kill_endpoint_urbs(stru
struct xhci_virt_ep *ep;
struct xhci_ring *ring;
- ep = &xhci->devs[slot_id]->eps[ep_index];
+ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
+ if (!ep)
+ return;
+
if ((ep->ep_state & EP_HAS_STREAMS) ||
(ep->ep_state & EP_GETTING_NO_STREAMS)) {
int stream_id;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 052/193] xhci: Fix null pointer dereference when host dies
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 051/193] usb: xhci: Check endpoint is valid before dereferencing it Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 053/193] xhci: Add update_hub_device override for PCI xHCI hosts Greg Kroah-Hartman
` (149 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit a2bc47c43e70cf904b1af49f76d572326c08bca7 upstream.
Make sure xhci_free_dev() and xhci_kill_endpoint_urbs() do not race
and cause null pointer dereference when host suddenly dies.
Usb core may call xhci_free_dev() which frees the xhci->devs[slot_id]
virt device at the same time that xhci_kill_endpoint_urbs() tries to
loop through all the device's endpoints, checking if there are any
cancelled urbs left to give back.
hold the xhci spinlock while freeing the virt device
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230116142216.1141605-4-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3974,6 +3974,7 @@ static void xhci_free_dev(struct usb_hcd
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
struct xhci_virt_device *virt_dev;
struct xhci_slot_ctx *slot_ctx;
+ unsigned long flags;
int i, ret;
/*
@@ -4000,7 +4001,11 @@ static void xhci_free_dev(struct usb_hcd
virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING;
virt_dev->udev = NULL;
xhci_disable_slot(xhci, udev->slot_id);
+
+ spin_lock_irqsave(&xhci->lock, flags);
xhci_free_virt_device(xhci, udev->slot_id);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+
}
int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 053/193] xhci: Add update_hub_device override for PCI xHCI hosts
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 052/193] xhci: Fix null pointer dereference when host dies Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 054/193] xhci: Add a flag to disable USB3 lpm on a xhci root port level Greg Kroah-Hartman
` (148 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit 23a3b8d5a2365653fd9bc5a9454d1e7f4facbf85 upstream.
Allow PCI hosts to check and tune roothub and port settings
before the hub is up and running.
This override is needed to turn off U1 and U2 LPM for some ports
based on per port ACPI _DSM, _UPC, or possibly vendor specific mmio
values for Intel xHC hosts.
Usb core calls the host update_hub_device once it creates a hub.
Entering U1 or U2 link power save state on ports with this limitation
will cause link to fail, turning the usb device unusable in that setup.
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230116142216.1141605-5-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-pci.c | 9 +++++++++
drivers/usb/host/xhci.c | 5 ++++-
drivers/usb/host/xhci.h | 4 ++++
3 files changed, 17 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -78,9 +78,12 @@ static const char hcd_name[] = "xhci_hcd
static struct hc_driver __read_mostly xhci_pci_hc_driver;
static int xhci_pci_setup(struct usb_hcd *hcd);
+static int xhci_pci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
+ struct usb_tt *tt, gfp_t mem_flags);
static const struct xhci_driver_overrides xhci_pci_overrides __initconst = {
.reset = xhci_pci_setup,
+ .update_hub_device = xhci_pci_update_hub_device,
};
/* called after powerup, by probe or system-pm "wakeup" */
@@ -386,6 +389,12 @@ static int xhci_pci_setup(struct usb_hcd
return xhci_pci_reinit(xhci, pdev);
}
+static int xhci_pci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
+ struct usb_tt *tt, gfp_t mem_flags)
+{
+ return xhci_update_hub_device(hcd, hdev, tt, mem_flags);
+}
+
/*
* We need to register our own PCI probe function (instead of the USB core's
* function) in order to create a second roothub under xHCI.
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -5124,7 +5124,7 @@ static int xhci_disable_usb3_lpm_timeout
/* Once a hub descriptor is fetched for a device, we need to update the xHC's
* internal data structures for the device.
*/
-static int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
+int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
struct usb_tt *tt, gfp_t mem_flags)
{
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
@@ -5224,6 +5224,7 @@ static int xhci_update_hub_device(struct
xhci_free_command(xhci, config_cmd);
return ret;
}
+EXPORT_SYMBOL_GPL(xhci_update_hub_device);
static int xhci_get_frame(struct usb_hcd *hcd)
{
@@ -5507,6 +5508,8 @@ void xhci_init_driver(struct hc_driver *
drv->check_bandwidth = over->check_bandwidth;
if (over->reset_bandwidth)
drv->reset_bandwidth = over->reset_bandwidth;
+ if (over->update_hub_device)
+ drv->update_hub_device = over->update_hub_device;
}
}
EXPORT_SYMBOL_GPL(xhci_init_driver);
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1943,6 +1943,8 @@ struct xhci_driver_overrides {
struct usb_host_endpoint *ep);
int (*check_bandwidth)(struct usb_hcd *, struct usb_device *);
void (*reset_bandwidth)(struct usb_hcd *, struct usb_device *);
+ int (*update_hub_device)(struct usb_hcd *hcd, struct usb_device *hdev,
+ struct usb_tt *tt, gfp_t mem_flags);
};
#define XHCI_CFC_DELAY 10
@@ -2122,6 +2124,8 @@ int xhci_drop_endpoint(struct usb_hcd *h
struct usb_host_endpoint *ep);
int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev);
void xhci_reset_bandwidth(struct usb_hcd *hcd, struct usb_device *udev);
+int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
+ struct usb_tt *tt, gfp_t mem_flags);
int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id);
int xhci_ext_cap_init(struct xhci_hcd *xhci);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 054/193] xhci: Add a flag to disable USB3 lpm on a xhci root port level.
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 053/193] xhci: Add update_hub_device override for PCI xHCI hosts Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 055/193] usb: acpi: add helper to check port lpm capability using acpi _DSM Greg Kroah-Hartman
` (147 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit 0522b9a1653048440da5f21747f21e498b9220d1 upstream.
One USB3 roothub port may support link power management, while another
root port on the same xHC can't due to different retimers used for
the ports.
This is the case with Intel Alder Lake, and possible future platforms
where retimers used for USB4 ports cause too long exit latecy to
enable native USB3 lpm U1 and U2 states.
Add a flag in the xhci port structure to indicate if the port is
lpm_incapable, and check it while calculating exit latency.
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230116142216.1141605-6-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 8 ++++++++
drivers/usb/host/xhci.h | 1 +
2 files changed, 9 insertions(+)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -5049,6 +5049,7 @@ static int xhci_enable_usb3_lpm_timeout(
struct usb_device *udev, enum usb3_link_state state)
{
struct xhci_hcd *xhci;
+ struct xhci_port *port;
u16 hub_encoded_timeout;
int mel;
int ret;
@@ -5065,6 +5066,13 @@ static int xhci_enable_usb3_lpm_timeout(
if (xhci_check_tier_policy(xhci, udev, state) < 0)
return USB3_LPM_DISABLED;
+ /* If connected to root port then check port can handle lpm */
+ if (udev->parent && !udev->parent->parent) {
+ port = xhci->usb3_rhub.ports[udev->portnum - 1];
+ if (port->lpm_incapable)
+ return USB3_LPM_DISABLED;
+ }
+
hub_encoded_timeout = xhci_calculate_lpm_timeout(hcd, udev, state);
mel = calculate_max_exit_latency(udev, state, hub_encoded_timeout);
if (mel < 0) {
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1735,6 +1735,7 @@ struct xhci_port {
int hcd_portnum;
struct xhci_hub *rhub;
struct xhci_port_cap *port_cap;
+ unsigned int lpm_incapable:1;
};
struct xhci_hub {
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 055/193] usb: acpi: add helper to check port lpm capability using acpi _DSM
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 054/193] xhci: Add a flag to disable USB3 lpm on a xhci root port level Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 056/193] xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables Greg Kroah-Hartman
` (146 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ron Lee, Mathias Nyman
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit cd702d18c882d5a4ea44bbdb38edd5d5577ef640 upstream.
Add a helper to evaluate ACPI usb device specific method (_DSM) provided
in case the USB3 port shouldn't enter U1 and U2 link states.
This _DSM was added as port specific retimer configuration may lead to
exit latencies growing beyond U1/U2 exit limits, and OS needs a way to
find which ports can't support U1/U2 link power management states.
This _DSM is also used by windows:
Link: https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/usb-device-specific-method---dsm-
Some patch issues found in testing resolved by Ron Lee
Cc: stable@vger.kernel.org
Tested-by: Ron Lee <ron.lee@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230116142216.1141605-7-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/usb-acpi.c | 65 ++++++++++++++++++++++++++++++++++++++++++++
include/linux/usb.h | 3 ++
2 files changed, 68 insertions(+)
--- a/drivers/usb/core/usb-acpi.c
+++ b/drivers/usb/core/usb-acpi.c
@@ -37,6 +37,71 @@ bool usb_acpi_power_manageable(struct us
}
EXPORT_SYMBOL_GPL(usb_acpi_power_manageable);
+#define UUID_USB_CONTROLLER_DSM "ce2ee385-00e6-48cb-9f05-2edb927c4899"
+#define USB_DSM_DISABLE_U1_U2_FOR_PORT 5
+
+/**
+ * usb_acpi_port_lpm_incapable - check if lpm should be disabled for a port.
+ * @hdev: USB device belonging to the usb hub
+ * @index: zero based port index
+ *
+ * Some USB3 ports may not support USB3 link power management U1/U2 states
+ * due to different retimer setup. ACPI provides _DSM method which returns 0x01
+ * if U1 and U2 states should be disabled. Evaluate _DSM with:
+ * Arg0: UUID = ce2ee385-00e6-48cb-9f05-2edb927c4899
+ * Arg1: Revision ID = 0
+ * Arg2: Function Index = 5
+ * Arg3: (empty)
+ *
+ * Return 1 if USB3 port is LPM incapable, negative on error, otherwise 0
+ */
+
+int usb_acpi_port_lpm_incapable(struct usb_device *hdev, int index)
+{
+ union acpi_object *obj;
+ acpi_handle port_handle;
+ int port1 = index + 1;
+ guid_t guid;
+ int ret;
+
+ ret = guid_parse(UUID_USB_CONTROLLER_DSM, &guid);
+ if (ret)
+ return ret;
+
+ port_handle = usb_get_hub_port_acpi_handle(hdev, port1);
+ if (!port_handle) {
+ dev_dbg(&hdev->dev, "port-%d no acpi handle\n", port1);
+ return -ENODEV;
+ }
+
+ if (!acpi_check_dsm(port_handle, &guid, 0,
+ BIT(USB_DSM_DISABLE_U1_U2_FOR_PORT))) {
+ dev_dbg(&hdev->dev, "port-%d no _DSM function %d\n",
+ port1, USB_DSM_DISABLE_U1_U2_FOR_PORT);
+ return -ENODEV;
+ }
+
+ obj = acpi_evaluate_dsm(port_handle, &guid, 0,
+ USB_DSM_DISABLE_U1_U2_FOR_PORT, NULL);
+
+ if (!obj)
+ return -ENODEV;
+
+ if (obj->type != ACPI_TYPE_INTEGER) {
+ dev_dbg(&hdev->dev, "evaluate port-%d _DSM failed\n", port1);
+ ACPI_FREE(obj);
+ return -EINVAL;
+ }
+
+ if (obj->integer.value == 0x01)
+ ret = 1;
+
+ ACPI_FREE(obj);
+
+ return ret;
+}
+EXPORT_SYMBOL_GPL(usb_acpi_port_lpm_incapable);
+
/**
* usb_acpi_set_power_state - control usb port's power via acpi power
* resource
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -751,11 +751,14 @@ extern struct device *usb_intf_get_dma_d
extern int usb_acpi_set_power_state(struct usb_device *hdev, int index,
bool enable);
extern bool usb_acpi_power_manageable(struct usb_device *hdev, int index);
+extern int usb_acpi_port_lpm_incapable(struct usb_device *hdev, int index);
#else
static inline int usb_acpi_set_power_state(struct usb_device *hdev, int index,
bool enable) { return 0; }
static inline bool usb_acpi_power_manageable(struct usb_device *hdev, int index)
{ return true; }
+static inline int usb_acpi_port_lpm_incapable(struct usb_device *hdev, int index)
+ { return 0; }
#endif
/* USB autosuspend and autoresume */
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 056/193] xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 055/193] usb: acpi: add helper to check port lpm capability using acpi _DSM Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 057/193] prlimit: do_prlimit needs to have a speculation check Greg Kroah-Hartman
` (145 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit 74622f0a81d0c2bcfc39f9192b788124e8c7f0af upstream.
USB3 ports on xHC hosts may have retimers that cause too long
exit latency to work with native USB3 U1/U2 link power management states.
For now only use usb_acpi_port_lpm_incapable() to evaluate if port lpm
should be disabled while setting up the USB3 roothub.
Other ways to identify lpm incapable ports can be added here later if
ACPI _DSM does not exist.
Limit this to Intel hosts for now, this is to my knowledge only
an Intel issue.
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230116142216.1141605-8-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-pci.c | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -355,8 +355,38 @@ static void xhci_pme_acpi_rtd3_enable(st
NULL);
ACPI_FREE(obj);
}
+
+static void xhci_find_lpm_incapable_ports(struct usb_hcd *hcd, struct usb_device *hdev)
+{
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct xhci_hub *rhub = &xhci->usb3_rhub;
+ int ret;
+ int i;
+
+ /* This is not the usb3 roothub we are looking for */
+ if (hcd != rhub->hcd)
+ return;
+
+ if (hdev->maxchild > rhub->num_ports) {
+ dev_err(&hdev->dev, "USB3 roothub port number mismatch\n");
+ return;
+ }
+
+ for (i = 0; i < hdev->maxchild; i++) {
+ ret = usb_acpi_port_lpm_incapable(hdev, i);
+
+ dev_dbg(&hdev->dev, "port-%d disable U1/U2 _DSM: %d\n", i + 1, ret);
+
+ if (ret >= 0) {
+ rhub->ports[i]->lpm_incapable = ret;
+ continue;
+ }
+ }
+}
+
#else
static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev) { }
+static void xhci_find_lpm_incapable_ports(struct usb_hcd *hcd, struct usb_device *hdev) { }
#endif /* CONFIG_ACPI */
/* called during probe() after chip reset completes */
@@ -392,6 +422,10 @@ static int xhci_pci_setup(struct usb_hcd
static int xhci_pci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
struct usb_tt *tt, gfp_t mem_flags)
{
+ /* Check if acpi claims some USB3 roothub ports are lpm incapable */
+ if (!hdev->parent)
+ xhci_find_lpm_incapable_ports(hcd, hdev);
+
return xhci_update_hub_device(hcd, hdev, tt, mem_flags);
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 057/193] prlimit: do_prlimit needs to have a speculation check
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 056/193] xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 058/193] USB: serial: option: add Quectel EM05-G (GR) modem Greg Kroah-Hartman
` (144 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jordy Zomer, Linus Torvalds
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 739790605705ddcf18f21782b9c99ad7d53a8c11 upstream.
do_prlimit() adds the user-controlled resource value to a pointer that
will subsequently be dereferenced. In order to help prevent this
codepath from being used as a spectre "gadget" a barrier needs to be
added after checking the range.
Reported-by: Jordy Zomer <jordyzomer@google.com>
Tested-by: Jordy Zomer <jordyzomer@google.com>
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sys.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1442,6 +1442,8 @@ static int do_prlimit(struct task_struct
if (resource >= RLIM_NLIMITS)
return -EINVAL;
+ resource = array_index_nospec(resource, RLIM_NLIMITS);
+
if (new_rlim) {
if (new_rlim->rlim_cur > new_rlim->rlim_max)
return -EINVAL;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 058/193] USB: serial: option: add Quectel EM05-G (GR) modem
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 057/193] prlimit: do_prlimit needs to have a speculation check Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 059/193] USB: serial: option: add Quectel EM05-G (CS) modem Greg Kroah-Hartman
` (143 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Duke Xin , Johan Hovold
From: Duke Xin(辛安文) <duke_xinanwen@163.com>
commit 6c331f32e32ac71eb3e8b93fceda2802d7ecb889 upstream.
The EM05-G (GR) modem has 2 USB configurations that are configurable via
the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate
with the following interfaces, respectively:
"RMNET" : AT + DIAG + NMEA + Modem + QMI
"MBIM" : MBIM + AT + DIAG + NMEA + Modem
The detailed description of the USB configuration for each mode as follows:
RMNET Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0313 Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-G
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
MBIM Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0313 Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-G
C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Duke Xin(辛安文) <duke_xinanwen@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -256,6 +256,7 @@ static void option_instat_callback(struc
#define QUECTEL_PRODUCT_EM05G 0x030a
#define QUECTEL_PRODUCT_EM060K 0x030b
#define QUECTEL_PRODUCT_EM05G_SG 0x0311
+#define QUECTEL_PRODUCT_EM05G_GR 0x0313
#define QUECTEL_PRODUCT_EM12 0x0512
#define QUECTEL_PRODUCT_RM500Q 0x0800
#define QUECTEL_PRODUCT_RM520N 0x0801
@@ -1161,6 +1162,8 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff),
.driver_info = RSVD(6) | ZLP },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff),
+ .driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_SG, 0xff),
.driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 059/193] USB: serial: option: add Quectel EM05-G (CS) modem
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 058/193] USB: serial: option: add Quectel EM05-G (GR) modem Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 060/193] USB: serial: option: add Quectel EM05-G (RS) modem Greg Kroah-Hartman
` (142 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Duke Xin , Johan Hovold
From: Duke Xin(辛安文) <duke_xinanwen@163.com>
commit bb78654b0b46316dac687fd4b7dc7cce636f46cd upstream.
The EM05-G (CS) modem has 2 USB configurations that are configurable via
the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate
with the following interfaces, respectively:
"RMNET" : AT + DIAG + NMEA + Modem + QMI
"MBIM" : MBIM + AT + DIAG + NMEA + Modem
The detailed description of the USB configuration for each mode as follows:
RMNET Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=030C Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-G
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
MBIM Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=030C Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-G
C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Duke Xin(辛安文) <duke_xinanwen@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -255,6 +255,7 @@ static void option_instat_callback(struc
#define QUECTEL_PRODUCT_EP06 0x0306
#define QUECTEL_PRODUCT_EM05G 0x030a
#define QUECTEL_PRODUCT_EM060K 0x030b
+#define QUECTEL_PRODUCT_EM05G_CS 0x030c
#define QUECTEL_PRODUCT_EM05G_SG 0x0311
#define QUECTEL_PRODUCT_EM05G_GR 0x0313
#define QUECTEL_PRODUCT_EM12 0x0512
@@ -1164,6 +1165,8 @@ static const struct usb_device_id option
.driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff),
.driver_info = RSVD(6) | ZLP },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff),
+ .driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_SG, 0xff),
.driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 060/193] USB: serial: option: add Quectel EM05-G (RS) modem
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 059/193] USB: serial: option: add Quectel EM05-G (CS) modem Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 061/193] USB: serial: option: add Quectel EC200U modem Greg Kroah-Hartman
` (141 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Duke Xin , Johan Hovold
From: Duke Xin(辛安文) <duke_xinanwen@163.com>
commit b72d13977689f0c717444010e108c4f20658dfee upstream.
The EM05-G (RS) modem has 2 USB configurations that are configurable via
the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate
with the following interfaces, respectively:
"RMNET" : AT + DIAG + NMEA + Modem + QMI
"MBIM" : MBIM + AT + DIAG + NMEA + Modem
The detailed description of the USB configuration for each mode as follows:
RMNET Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0314 Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-G
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
MBIM Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0314 Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-G
C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Duke Xin(辛安文) <duke_xinanwen@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -258,6 +258,7 @@ static void option_instat_callback(struc
#define QUECTEL_PRODUCT_EM05G_CS 0x030c
#define QUECTEL_PRODUCT_EM05G_SG 0x0311
#define QUECTEL_PRODUCT_EM05G_GR 0x0313
+#define QUECTEL_PRODUCT_EM05G_RS 0x0314
#define QUECTEL_PRODUCT_EM12 0x0512
#define QUECTEL_PRODUCT_RM500Q 0x0800
#define QUECTEL_PRODUCT_RM520N 0x0801
@@ -1167,6 +1168,8 @@ static const struct usb_device_id option
.driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff),
.driver_info = RSVD(6) | ZLP },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_RS, 0xff),
+ .driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_SG, 0xff),
.driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 061/193] USB: serial: option: add Quectel EC200U modem
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 060/193] USB: serial: option: add Quectel EM05-G (RS) modem Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 062/193] USB: serial: option: add Quectel EM05CN (SG) modem Greg Kroah-Hartman
` (140 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ali Mirghasemi, Johan Hovold
From: Ali Mirghasemi <ali.mirghasemi1376@gmail.com>
commit d9bbb15881046bd76f8710c76e26a740eee997ef upstream.
Add support for EC200U modem
0x0901: EC200U - AT + AP + CP + NMEA + DIAG + MOS
usb-device output:
T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 4 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0901 Rev= 3.18
S: Manufacturer=Android
S: Product=Android
C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA
A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=03(Int.) MxPS= 512 Ivl=4096ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=03(Int.) MxPS= 512 Ivl=4096ms
I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Ali Mirghasemi <ali.mirghasemi1376@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -262,6 +262,7 @@ static void option_instat_callback(struc
#define QUECTEL_PRODUCT_EM12 0x0512
#define QUECTEL_PRODUCT_RM500Q 0x0800
#define QUECTEL_PRODUCT_RM520N 0x0801
+#define QUECTEL_PRODUCT_EC200U 0x0901
#define QUECTEL_PRODUCT_EC200S_CN 0x6002
#define QUECTEL_PRODUCT_EC200T 0x6026
#define QUECTEL_PRODUCT_RM500K 0x7001
@@ -1189,6 +1190,7 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0xff, 0x30) },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) },
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 062/193] USB: serial: option: add Quectel EM05CN (SG) modem
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 061/193] USB: serial: option: add Quectel EC200U modem Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 063/193] USB: serial: option: add Quectel EM05CN modem Greg Kroah-Hartman
` (139 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Duke Xin , Johan Hovold
From: Duke Xin(辛安文) <duke_xinanwen@163.com>
commit 1541dd0097c0f8f470e76eddf5120fc55a7e3101 upstream.
The EM05CN (SG) modem has 2 USB configurations that are configurable via the AT
command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with
the following interfaces, respectively:
"MBIM" : AT + MBIM + DIAG + NMEA + MODEM
"RMNET" : AT + DIAG + NMEA + Modem + QMI
The detailed description of the USB configuration for each mode as follows:
MBIM Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0310 Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-CN
C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
A: FirstIf#= 1 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 2 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:* If#= 2 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
RMNET Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0310 Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-CN
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Duke Xin(辛安文) <duke_xinanwen@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -256,6 +256,7 @@ static void option_instat_callback(struc
#define QUECTEL_PRODUCT_EM05G 0x030a
#define QUECTEL_PRODUCT_EM060K 0x030b
#define QUECTEL_PRODUCT_EM05G_CS 0x030c
+#define QUECTEL_PRODUCT_EM05CN_SG 0x0310
#define QUECTEL_PRODUCT_EM05G_SG 0x0311
#define QUECTEL_PRODUCT_EM05G_GR 0x0313
#define QUECTEL_PRODUCT_EM05G_RS 0x0314
@@ -1163,6 +1164,8 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
.driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05CN_SG, 0xff),
+ .driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff),
.driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff),
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 063/193] USB: serial: option: add Quectel EM05CN modem
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 062/193] USB: serial: option: add Quectel EM05CN (SG) modem Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 064/193] staging: vchiq_arm: fix enum vchiq_status return types Greg Kroah-Hartman
` (138 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Duke Xin , Johan Hovold
From: Duke Xin(辛安文) <duke_xinanwen@163.com>
commit 71dfd381a7c051f16a61f82fbd38a4cca563bdca upstream.
The EM05CN modem has 2 USB configurations that are configurable via the AT
command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with
the following interfaces, respectively:
"MBIM" : AT + MBIM + DIAG + NMEA + MODEM
"RMNET" : AT + DIAG + NMEA + Modem + QMI
The detailed description of the USB configuration for each mode as follows:
MBIM Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0312 Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-CN
C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
A: FirstIf#= 1 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 2 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:* If#= 2 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
RMNET Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0312 Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-CN
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Duke Xin(辛安文) <duke_xinanwen@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -258,6 +258,7 @@ static void option_instat_callback(struc
#define QUECTEL_PRODUCT_EM05G_CS 0x030c
#define QUECTEL_PRODUCT_EM05CN_SG 0x0310
#define QUECTEL_PRODUCT_EM05G_SG 0x0311
+#define QUECTEL_PRODUCT_EM05CN 0x0312
#define QUECTEL_PRODUCT_EM05G_GR 0x0313
#define QUECTEL_PRODUCT_EM05G_RS 0x0314
#define QUECTEL_PRODUCT_EM12 0x0512
@@ -1164,6 +1165,8 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
.driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05CN, 0xff),
+ .driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05CN_SG, 0xff),
.driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff),
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 064/193] staging: vchiq_arm: fix enum vchiq_status return types
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 063/193] USB: serial: option: add Quectel EM05CN modem Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 065/193] USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 Greg Kroah-Hartman
` (137 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Arnd Bergmann
From: Arnd Bergmann <arnd@arndb.de>
commit 7d83299351fe7c812c529f5e39fe63b5312e4233 upstream.
gcc-13 notices a type mismatch between function declaration
and definition for a few functions that have been converted
from returning vchiq specific status values to regular error
codes:
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:662:5: error: conflicting types for 'vchiq_initialise' due to enum/integer mismatch; have 'int(struct vchiq_instance **)' [-Werror=enum-int-mismatch]
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1411:1: error: conflicting types for 'vchiq_use_internal' due to enum/integer mismatch; have 'int(struct vchiq_state *, struct vchiq_service *, enum USE_TYPE_E)' [-Werror=enum-int-mismatch]
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1468:1: error: conflicting types for 'vchiq_release_internal' due to enum/integer mismatch; have 'int(struct vchiq_state *, struct vchiq_service *)' [-Werror=enum-int-mismatch]
Change the declarations to match the actual function definition.
Fixes: a9fbd828be7f ("staging: vchiq_arm: drop enum vchiq_status from vchiq_*_internal")
Cc: stable <stable@kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20230117163957.1109872-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/vc04_services/include/linux/raspberrypi/vchiq.h | 2 +-
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/staging/vc04_services/include/linux/raspberrypi/vchiq.h
+++ b/drivers/staging/vc04_services/include/linux/raspberrypi/vchiq.h
@@ -86,7 +86,7 @@ struct vchiq_service_params_kernel {
struct vchiq_instance;
-extern enum vchiq_status vchiq_initialise(struct vchiq_instance **pinstance);
+extern int vchiq_initialise(struct vchiq_instance **pinstance);
extern enum vchiq_status vchiq_shutdown(struct vchiq_instance *instance);
extern enum vchiq_status vchiq_connect(struct vchiq_instance *instance);
extern enum vchiq_status vchiq_open_service(struct vchiq_instance *instance,
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h
@@ -100,10 +100,10 @@ vchiq_dump_platform_use_state(struct vch
extern void
vchiq_dump_service_use_state(struct vchiq_state *state);
-extern enum vchiq_status
+extern int
vchiq_use_internal(struct vchiq_state *state, struct vchiq_service *service,
enum USE_TYPE_E use_type);
-extern enum vchiq_status
+extern int
vchiq_release_internal(struct vchiq_state *state,
struct vchiq_service *service);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 065/193] USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 064/193] staging: vchiq_arm: fix enum vchiq_status return types Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 066/193] usb: misc: onboard_hub: Invert driver registration order Greg Kroah-Hartman
` (136 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Christoph Jung
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 14ff7460bb58662d86aa50298943cc7d25532e28 upstream.
The USB_DEVICE_ID_CODEMERCS_IOW100 header size was incorrect, it should
be 12, not 13.
Cc: stable <stable@kernel.org>
Fixes: 17a82716587e ("USB: iowarrior: fix up report size handling for some devices")
Reported-by: Christoph Jung <jung@codemercs.com>
Link: https://lore.kernel.org/r/20230120135330.3842518-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/iowarrior.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -814,7 +814,7 @@ static int iowarrior_probe(struct usb_in
break;
case USB_DEVICE_ID_CODEMERCS_IOW100:
- dev->report_size = 13;
+ dev->report_size = 12;
break;
}
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 066/193] usb: misc: onboard_hub: Invert driver registration order
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 065/193] USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 067/193] usb: misc: onboard_hub: Move attach work to the driver Greg Kroah-Hartman
` (135 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Stein, Matthias Kaehlcke,
Stefan Wahren
From: Matthias Kaehlcke <mka@chromium.org>
commit e5854355d76b8d768cea8e4fc3ce6dfdba25518a upstream.
The onboard_hub 'driver' consists of two drivers, a platform
driver and a USB driver. Currently when the onboard hub driver
is initialized it first registers the platform driver, then the
USB driver. This results in a race condition when the 'attach'
work is executed, which is scheduled when the platform device
is probed. The purpose of fhe 'attach' work is to bind elegible
USB hub devices to the onboard_hub USB driver. This fails if
the work runs before the USB driver has been registered.
Register the USB driver first, then the platform driver. This
increases the chances that the onboard_hub USB devices are probed
before their corresponding platform device, which the USB driver
tries to locate in _probe(). The driver already handles this
situation and defers probing if the onboard hub platform device
doesn't exist yet.
Cc: stable@vger.kernel.org
Fixes: 8bc063641ceb ("usb: misc: Add onboard_usb_hub driver")
Link: https://lore.kernel.org/lkml/Y6W00vQm3jfLflUJ@hovoldconsulting.com/T/#m0d64295f017942fd988f7c53425db302d61952b4
Reported-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Link: https://lore.kernel.org/r/20230110172954.v2.1.I75494ebee7027a50235ce4b1e930fa73a578fbe2@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/onboard_usb_hub.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/usb/misc/onboard_usb_hub.c
+++ b/drivers/usb/misc/onboard_usb_hub.c
@@ -431,13 +431,13 @@ static int __init onboard_hub_init(void)
{
int ret;
- ret = platform_driver_register(&onboard_hub_driver);
+ ret = usb_register_device_driver(&onboard_hub_usbdev_driver, THIS_MODULE);
if (ret)
return ret;
- ret = usb_register_device_driver(&onboard_hub_usbdev_driver, THIS_MODULE);
+ ret = platform_driver_register(&onboard_hub_driver);
if (ret)
- platform_driver_unregister(&onboard_hub_driver);
+ usb_deregister_device_driver(&onboard_hub_usbdev_driver);
return ret;
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 067/193] usb: misc: onboard_hub: Move attach work to the driver
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 066/193] usb: misc: onboard_hub: Invert driver registration order Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 068/193] misc: fastrpc: Fix use-after-free and race in fastrpc_map_find Greg Kroah-Hartman
` (134 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stefan Wahren, Matthias Kaehlcke
From: Matthias Kaehlcke <mka@chromium.org>
commit cde37881e2e14590675d0acdfbad408300d9ca95 upstream.
Currently each onboard_hub platform device owns an 'attach' work,
which is scheduled when the device probes. With this deadlocks
have been reported on a Raspberry Pi 3 B+ [1], which has nested
onboard hubs.
The flow of the deadlock is something like this (with the onboard_hub
driver built as a module) [2]:
- USB root hub is instantiated
- core hub driver calls onboard_hub_create_pdevs(), which creates the
'raw' platform device for the 1st level hub
- 1st level hub is probed by the core hub driver
- core hub driver calls onboard_hub_create_pdevs(), which creates
the 'raw' platform device for the 2nd level hub
- onboard_hub platform driver is registered
- platform device for 1st level hub is probed
- schedules 'attach' work
- platform device for 2nd level hub is probed
- schedules 'attach' work
- onboard_hub USB driver is registered
- device (and parent) lock of hub is held while the device is
re-probed with the onboard_hub driver
- 'attach' work (running in another thread) calls driver_attach(), which
blocks on one of the hub device locks
- onboard_hub_destroy_pdevs() is called by the core hub driver when one
of the hubs is detached
- destroying the pdevs invokes onboard_hub_remove(), which waits for the
'attach' work to complete
- waits forever, since the 'attach' work can't acquire the device lock
Use a single work struct for the driver instead of having a work struct
per onboard hub platform driver instance. With that it isn't necessary
to cancel the work in onboard_hub_remove(), which fixes the deadlock.
The work is only cancelled when the driver is unloaded.
[1] https://lore.kernel.org/r/d04bcc45-3471-4417-b30b-5cf9880d785d@i2se.com/
[2] https://lore.kernel.org/all/Y6OrGbqaMy2iVDWB@google.com/
Cc: stable@vger.kernel.org
Fixes: 8bc063641ceb ("usb: misc: Add onboard_usb_hub driver")
Link: https://lore.kernel.org/r/d04bcc45-3471-4417-b30b-5cf9880d785d@i2se.com/
Link: https://lore.kernel.org/all/Y6OrGbqaMy2iVDWB@google.com/
Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Link: https://lore.kernel.org/r/20230110172954.v2.2.I16b51f32db0c32f8a8532900bfe1c70c8572881a@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/onboard_usb_hub.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/usb/misc/onboard_usb_hub.c
+++ b/drivers/usb/misc/onboard_usb_hub.c
@@ -27,7 +27,10 @@
#include "onboard_usb_hub.h"
+static void onboard_hub_attach_usb_driver(struct work_struct *work);
+
static struct usb_device_driver onboard_hub_usbdev_driver;
+static DECLARE_WORK(attach_usb_driver_work, onboard_hub_attach_usb_driver);
/************************** Platform driver **************************/
@@ -45,7 +48,6 @@ struct onboard_hub {
bool is_powered_on;
bool going_away;
struct list_head udev_list;
- struct work_struct attach_usb_driver_work;
struct mutex lock;
};
@@ -271,8 +273,7 @@ static int onboard_hub_probe(struct plat
* This needs to be done deferred to avoid self-deadlocks on systems
* with nested onboard hubs.
*/
- INIT_WORK(&hub->attach_usb_driver_work, onboard_hub_attach_usb_driver);
- schedule_work(&hub->attach_usb_driver_work);
+ schedule_work(&attach_usb_driver_work);
return 0;
}
@@ -285,9 +286,6 @@ static int onboard_hub_remove(struct pla
hub->going_away = true;
- if (&hub->attach_usb_driver_work != current_work())
- cancel_work_sync(&hub->attach_usb_driver_work);
-
mutex_lock(&hub->lock);
/* unbind the USB devices to avoid dangling references to this device */
@@ -447,6 +445,8 @@ static void __exit onboard_hub_exit(void
{
usb_deregister_device_driver(&onboard_hub_usbdev_driver);
platform_driver_unregister(&onboard_hub_driver);
+
+ cancel_work_sync(&attach_usb_driver_work);
}
module_exit(onboard_hub_exit);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 068/193] misc: fastrpc: Fix use-after-free and race in fastrpc_map_find
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 067/193] usb: misc: onboard_hub: Move attach work to the driver Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 069/193] misc: fastrpc: Dont remove map on creater_process and device_release Greg Kroah-Hartman
` (133 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ola Jeppsson, Abel Vesa,
Srinivas Kandagatla
From: Abel Vesa <abel.vesa@linaro.org>
commit 9446fa1683a7e3937d9970248ced427c1983a1c5 upstream.
Currently, there is a race window between the point when the mutex is
unlocked in fastrpc_map_lookup and the reference count increasing
(fastrpc_map_get) in fastrpc_map_find, which can also lead to
use-after-free.
So lets merge fastrpc_map_find into fastrpc_map_lookup which allows us
to both protect the maps list by also taking the &fl->lock spinlock and
the reference count, since the spinlock will be released only after.
Add take_ref argument to make this suitable for all callers.
Fixes: 8f6c1d8c4f0c ("misc: fastrpc: Add fdlist implementation")
Cc: stable <stable@kernel.org>
Co-developed-by: Ola Jeppsson <ola@snap.com>
Signed-off-by: Ola Jeppsson <ola@snap.com>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20221124174941.418450-2-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 41 +++++++++++++++++++++--------------------
1 file changed, 21 insertions(+), 20 deletions(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -333,30 +333,31 @@ static void fastrpc_map_get(struct fastr
static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd,
- struct fastrpc_map **ppmap)
+ struct fastrpc_map **ppmap, bool take_ref)
{
+ struct fastrpc_session_ctx *sess = fl->sctx;
struct fastrpc_map *map = NULL;
+ int ret = -ENOENT;
- mutex_lock(&fl->mutex);
+ spin_lock(&fl->lock);
list_for_each_entry(map, &fl->maps, node) {
- if (map->fd == fd) {
- *ppmap = map;
- mutex_unlock(&fl->mutex);
- return 0;
- }
- }
- mutex_unlock(&fl->mutex);
-
- return -ENOENT;
-}
+ if (map->fd != fd)
+ continue;
-static int fastrpc_map_find(struct fastrpc_user *fl, int fd,
- struct fastrpc_map **ppmap)
-{
- int ret = fastrpc_map_lookup(fl, fd, ppmap);
+ if (take_ref) {
+ ret = fastrpc_map_get(map);
+ if (ret) {
+ dev_dbg(sess->dev, "%s: Failed to get map fd=%d ret=%d\n",
+ __func__, fd, ret);
+ break;
+ }
+ }
- if (!ret)
- fastrpc_map_get(*ppmap);
+ *ppmap = map;
+ ret = 0;
+ break;
+ }
+ spin_unlock(&fl->lock);
return ret;
}
@@ -703,7 +704,7 @@ static int fastrpc_map_create(struct fas
struct fastrpc_map *map = NULL;
int err = 0;
- if (!fastrpc_map_find(fl, fd, ppmap))
+ if (!fastrpc_map_lookup(fl, fd, ppmap, true))
return 0;
map = kzalloc(sizeof(*map), GFP_KERNEL);
@@ -1026,7 +1027,7 @@ static int fastrpc_put_args(struct fastr
for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
if (!fdlist[i])
break;
- if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap))
+ if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap, false))
fastrpc_map_put(mmap);
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 069/193] misc: fastrpc: Dont remove map on creater_process and device_release
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 068/193] misc: fastrpc: Fix use-after-free and race in fastrpc_map_find Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 070/193] misc: fastrpc: Fix use-after-free race condition for maps Greg Kroah-Hartman
` (132 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ola Jeppsson, Abel Vesa,
Srinivas Kandagatla
From: Abel Vesa <abel.vesa@linaro.org>
commit 5bb96c8f9268e2fdb0e5321cbc358ee5941efc15 upstream.
Do not remove the map from the list on error path in
fastrpc_init_create_process, instead call fastrpc_map_put, to avoid
use-after-free. Do not remove it on fastrpc_device_release either,
call fastrpc_map_put instead.
The fastrpc_free_map is the only proper place to remove the map.
This is called only after the reference count is 0.
Fixes: b49f6d83e290 ("misc: fastrpc: Fix a possible double free")
Cc: stable <stable@kernel.org>
Co-developed-by: Ola Jeppsson <ola@snap.com>
Signed-off-by: Ola Jeppsson <ola@snap.com>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20221124174941.418450-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -316,6 +316,13 @@ static void fastrpc_free_map(struct kref
dma_buf_put(map->buf);
}
+ if (map->fl) {
+ spin_lock(&map->fl->lock);
+ list_del(&map->node);
+ spin_unlock(&map->fl->lock);
+ map->fl = NULL;
+ }
+
kfree(map);
}
@@ -1266,12 +1273,7 @@ err_invoke:
fl->init_mem = NULL;
fastrpc_buf_free(imem);
err_alloc:
- if (map) {
- spin_lock(&fl->lock);
- list_del(&map->node);
- spin_unlock(&fl->lock);
- fastrpc_map_put(map);
- }
+ fastrpc_map_put(map);
err:
kfree(args);
@@ -1347,10 +1349,8 @@ static int fastrpc_device_release(struct
fastrpc_context_put(ctx);
}
- list_for_each_entry_safe(map, m, &fl->maps, node) {
- list_del(&map->node);
+ list_for_each_entry_safe(map, m, &fl->maps, node)
fastrpc_map_put(map);
- }
list_for_each_entry_safe(buf, b, &fl->mmaps, node) {
list_del(&buf->node);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 070/193] misc: fastrpc: Fix use-after-free race condition for maps
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 069/193] misc: fastrpc: Dont remove map on creater_process and device_release Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 071/193] usb: core: hub: disable autosuspend for TI TUSB8041 Greg Kroah-Hartman
` (131 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ola Jeppsson, Abel Vesa,
Srinivas Kandagatla
From: Ola Jeppsson <ola@snap.com>
commit 96b328d119eca7563c1edcc4e1039a62e6370ecb upstream.
It is possible that in between calling fastrpc_map_get() until
map->fl->lock is taken in fastrpc_free_map(), another thread can call
fastrpc_map_lookup() and get a reference to a map that is about to be
deleted.
Rewrite fastrpc_map_get() to only increase the reference count of a map
if it's non-zero. Propagate this to callers so they can know if a map is
about to be deleted.
Fixes this warning:
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate
...
Call trace:
refcount_warn_saturate
[fastrpc_map_get inlined]
[fastrpc_map_lookup inlined]
fastrpc_map_create
fastrpc_internal_invoke
fastrpc_device_ioctl
__arm64_sys_ioctl
invoke_syscall
Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable <stable@kernel.org>
Signed-off-by: Ola Jeppsson <ola@snap.com>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20221124174941.418450-4-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -332,10 +332,12 @@ static void fastrpc_map_put(struct fastr
kref_put(&map->refcount, fastrpc_free_map);
}
-static void fastrpc_map_get(struct fastrpc_map *map)
+static int fastrpc_map_get(struct fastrpc_map *map)
{
- if (map)
- kref_get(&map->refcount);
+ if (!map)
+ return -ENOENT;
+
+ return kref_get_unless_zero(&map->refcount) ? 0 : -ENOENT;
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 071/193] usb: core: hub: disable autosuspend for TI TUSB8041
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 070/193] misc: fastrpc: Fix use-after-free race condition for maps Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 072/193] comedi: adv_pci1760: Fix PWM instruction handling Greg Kroah-Hartman
` (130 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Flavio Suligoi, stable, Alan Stern
From: Flavio Suligoi <f.suligoi@asem.it>
commit 7171b0e261b17de96490adf053b8bb4b00061bcf upstream.
The Texas Instruments TUSB8041 has an autosuspend problem at high
temperature.
If there is not USB traffic, after a couple of ms, the device enters in
autosuspend mode. In this condition the external clock stops working, to
save energy. When the USB activity turns on, ther hub exits the
autosuspend state, the clock starts running again and all works fine.
At ambient temperature all works correctly, but at high temperature,
when the USB activity turns on, the external clock doesn't restart and
the hub disappears from the USB bus.
Disabling the autosuspend mode for this hub solves the issue.
Signed-off-by: Flavio Suligoi <f.suligoi@asem.it>
Cc: stable <stable@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20221219124759.3207032-1-f.suligoi@asem.it
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -44,6 +44,9 @@
#define USB_PRODUCT_USB5534B 0x5534
#define USB_VENDOR_CYPRESS 0x04b4
#define USB_PRODUCT_CY7C65632 0x6570
+#define USB_VENDOR_TEXAS_INSTRUMENTS 0x0451
+#define USB_PRODUCT_TUSB8041_USB3 0x8140
+#define USB_PRODUCT_TUSB8041_USB2 0x8142
#define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01
#define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02
@@ -5798,6 +5801,16 @@ static const struct usb_device_id hub_id
.idVendor = USB_VENDOR_GENESYS_LOGIC,
.bInterfaceClass = USB_CLASS_HUB,
.driver_info = HUB_QUIRK_CHECK_PORT_AUTOSUSPEND},
+ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
+ | USB_DEVICE_ID_MATCH_PRODUCT,
+ .idVendor = USB_VENDOR_TEXAS_INSTRUMENTS,
+ .idProduct = USB_PRODUCT_TUSB8041_USB2,
+ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
+ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
+ | USB_DEVICE_ID_MATCH_PRODUCT,
+ .idVendor = USB_VENDOR_TEXAS_INSTRUMENTS,
+ .idProduct = USB_PRODUCT_TUSB8041_USB3,
+ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
{ .match_flags = USB_DEVICE_ID_MATCH_DEV_CLASS,
.bDeviceClass = USB_CLASS_HUB},
{ .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 072/193] comedi: adv_pci1760: Fix PWM instruction handling
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 071/193] usb: core: hub: disable autosuspend for TI TUSB8041 Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 073/193] ACPI: PRM: Check whether EFI runtime is available Greg Kroah-Hartman
` (129 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Abbott
From: Ian Abbott <abbotti@mev.co.uk>
commit 2efb6edd52dc50273f5e68ad863dd1b1fb2f2d1c upstream.
(Actually, this is fixing the "Read the Current Status" command sent to
the device's outgoing mailbox, but it is only currently used for the PWM
instructions.)
The PCI-1760 is operated mostly by sending commands to a set of Outgoing
Mailbox registers, waiting for the command to complete, and reading the
result from the Incoming Mailbox registers. One of these commands is
the "Read the Current Status" command. The number of this command is
0x07 (see the User's Manual for the PCI-1760 at
<https://advdownload.advantech.com/productfile/Downloadfile2/1-11P6653/PCI-1760.pdf>.
The `PCI1760_CMD_GET_STATUS` macro defined in the driver should expand
to this command number 0x07, but unfortunately it currently expands to
0x03. (Command number 0x03 is not defined in the User's Manual.)
Correct the definition of the `PCI1760_CMD_GET_STATUS` macro to fix it.
This is used by all the PWM subdevice related instructions handled by
`pci1760_pwm_insn_config()` which are probably all broken. The effect
of sending the undefined command number 0x03 is not known.
Fixes: 14b93bb6bbf0 ("staging: comedi: adv_pci_dio: separate out PCI-1760 support")
Cc: <stable@vger.kernel.org> # v4.5+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20230103143754.17564-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/comedi/drivers/adv_pci1760.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/comedi/drivers/adv_pci1760.c
+++ b/drivers/comedi/drivers/adv_pci1760.c
@@ -58,7 +58,7 @@
#define PCI1760_CMD_CLR_IMB2 0x00 /* Clears IMB2 */
#define PCI1760_CMD_SET_DO 0x01 /* Set output state */
#define PCI1760_CMD_GET_DO 0x02 /* Read output status */
-#define PCI1760_CMD_GET_STATUS 0x03 /* Read current status */
+#define PCI1760_CMD_GET_STATUS 0x07 /* Read current status */
#define PCI1760_CMD_GET_FW_VER 0x0e /* Read firmware version */
#define PCI1760_CMD_GET_HW_VER 0x0f /* Read hardware version */
#define PCI1760_CMD_SET_PWM_HI(x) (0x10 + (x) * 2) /* Set "hi" period */
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 073/193] ACPI: PRM: Check whether EFI runtime is available
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 072/193] comedi: adv_pci1760: Fix PWM instruction handling Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 074/193] mmc: sunxi-mmc: Fix clock refcount imbalance during unbind Greg Kroah-Hartman
` (128 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Rafael J. Wysocki
From: Ard Biesheuvel <ardb@kernel.org>
commit 182da6f2b81a78709c58021542fb694f8ed80774 upstream.
The ACPI PRM address space handler calls efi_call_virt_pointer() to
execute PRM firmware code, but doing so is only permitted when the EFI
runtime environment is available. Otherwise, such calls are guaranteed
to result in a crash, and must therefore be avoided.
Given that the EFI runtime services may become unavailable after a crash
occurring in the firmware, we need to check this each time the PRM
address space handler is invoked. If the EFI runtime services were not
available at registration time to being with, don't install the address
space handler at all.
Fixes: cefc7ca46235 ("ACPI: PRM: implement OperationRegion handler for the PlatformRtMechanism subtype")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/prmt.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/acpi/prmt.c
+++ b/drivers/acpi/prmt.c
@@ -236,6 +236,11 @@ static acpi_status acpi_platformrt_space
efi_status_t status;
struct prm_context_buffer context;
+ if (!efi_enabled(EFI_RUNTIME_SERVICES)) {
+ pr_err_ratelimited("PRM: EFI runtime services no longer available\n");
+ return AE_NO_HANDLER;
+ }
+
/*
* The returned acpi_status will always be AE_OK. Error values will be
* saved in the first byte of the PRM message buffer to be used by ASL.
@@ -325,6 +330,11 @@ void __init init_prmt(void)
pr_info("PRM: found %u modules\n", mc);
+ if (!efi_enabled(EFI_RUNTIME_SERVICES)) {
+ pr_err("PRM: EFI runtime services unavailable\n");
+ return;
+ }
+
status = acpi_install_address_space_handler(ACPI_ROOT_OBJECT,
ACPI_ADR_SPACE_PLATFORM_RT,
&acpi_platformrt_space_handler,
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 074/193] mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 073/193] ACPI: PRM: Check whether EFI runtime is available Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 075/193] mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting Greg Kroah-Hartman
` (127 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Holland, Jernej Skrabec, Ulf Hansson
From: Samuel Holland <samuel@sholland.org>
commit 8509419758f2cc28dd05370385af0d91573b76b4 upstream.
If the controller is suspended by runtime PM, the clock is already
disabled, so do not try to disable it again during removal. Use
pm_runtime_disable() to flush any pending runtime PM transitions.
Fixes: 9a8e1e8cc2c0 ("mmc: sunxi: Add runtime_pm support")
Signed-off-by: Samuel Holland <samuel@sholland.org>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20220810022509.43743-1-samuel@sholland.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sunxi-mmc.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/mmc/host/sunxi-mmc.c
+++ b/drivers/mmc/host/sunxi-mmc.c
@@ -1492,9 +1492,11 @@ static int sunxi_mmc_remove(struct platf
struct sunxi_mmc_host *host = mmc_priv(mmc);
mmc_remove_host(mmc);
- pm_runtime_force_suspend(&pdev->dev);
- disable_irq(host->irq);
- sunxi_mmc_disable(host);
+ pm_runtime_disable(&pdev->dev);
+ if (!pm_runtime_status_suspended(&pdev->dev)) {
+ disable_irq(host->irq);
+ sunxi_mmc_disable(host);
+ }
dma_free_coherent(&pdev->dev, PAGE_SIZE, host->sg_cpu, host->sg_dma);
mmc_free_host(mmc);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 075/193] mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 074/193] mmc: sunxi-mmc: Fix clock refcount imbalance during unbind Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 076/193] mm/hugetlb: fix PTE marker handling in hugetlb_change_protection() Greg Kroah-Hartman
` (126 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haibo Chen, Adrian Hunter, Ulf Hansson
From: Haibo Chen <haibo.chen@nxp.com>
commit 1e336aa0c0250ec84c6f16efac40c9f0138e367d upstream.
Current code logic may be impacted by the setting of ROM/Bootloader,
so unmask these bits first, then setting these bits accordingly.
Fixes: 2b16cf326b70 ("mmc: sdhci-esdhc-imx: move tuning static configuration into hwinit function")
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20221207112315.1812222-1-haibo.chen@nxp.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci-esdhc-imx.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -107,6 +107,7 @@
#define ESDHC_TUNING_START_TAP_DEFAULT 0x1
#define ESDHC_TUNING_START_TAP_MASK 0x7f
#define ESDHC_TUNING_CMD_CRC_CHECK_DISABLE (1 << 7)
+#define ESDHC_TUNING_STEP_DEFAULT 0x1
#define ESDHC_TUNING_STEP_MASK 0x00070000
#define ESDHC_TUNING_STEP_SHIFT 16
@@ -1361,7 +1362,7 @@ static void sdhci_esdhc_imx_hwinit(struc
struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
struct cqhci_host *cq_host = host->mmc->cqe_private;
- int tmp;
+ u32 tmp;
if (esdhc_is_usdhc(imx_data)) {
/*
@@ -1416,17 +1417,24 @@ static void sdhci_esdhc_imx_hwinit(struc
if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
tmp = readl(host->ioaddr + ESDHC_TUNING_CTRL);
- tmp |= ESDHC_STD_TUNING_EN |
- ESDHC_TUNING_START_TAP_DEFAULT;
- if (imx_data->boarddata.tuning_start_tap) {
- tmp &= ~ESDHC_TUNING_START_TAP_MASK;
+ tmp |= ESDHC_STD_TUNING_EN;
+
+ /*
+ * ROM code or bootloader may config the start tap
+ * and step, unmask them first.
+ */
+ tmp &= ~(ESDHC_TUNING_START_TAP_MASK | ESDHC_TUNING_STEP_MASK);
+ if (imx_data->boarddata.tuning_start_tap)
tmp |= imx_data->boarddata.tuning_start_tap;
- }
+ else
+ tmp |= ESDHC_TUNING_START_TAP_DEFAULT;
if (imx_data->boarddata.tuning_step) {
- tmp &= ~ESDHC_TUNING_STEP_MASK;
tmp |= imx_data->boarddata.tuning_step
<< ESDHC_TUNING_STEP_SHIFT;
+ } else {
+ tmp |= ESDHC_TUNING_STEP_DEFAULT
+ << ESDHC_TUNING_STEP_SHIFT;
}
/* Disable the CMD CRC check for tuning, if not, need to
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 076/193] mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 075/193] mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 077/193] mm/hugetlb: fix uffd-wp handling for migration entries " Greg Kroah-Hartman
` (125 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand, Peter Xu,
Mike Kravetz, Miaohe Lin, Muchun Song, Andrew Morton
From: David Hildenbrand <david@redhat.com>
commit 0e678153f5be7e6c8d28835f5a678618da4b7a9c upstream.
Patch series "mm/hugetlb: uffd-wp fixes for hugetlb_change_protection()".
Playing with virtio-mem and background snapshots (using uffd-wp) on
hugetlb in QEMU, I managed to trigger a VM_BUG_ON(). Looking into the
details, hugetlb_change_protection() seems to not handle uffd-wp correctly
in all cases.
Patch #1 fixes my test case. I don't have reproducers for patch #2, as it
requires running into migration entries.
I did not yet check in detail yet if !hugetlb code requires similar care.
This patch (of 2):
There are two problematic cases when stumbling over a PTE marker in
hugetlb_change_protection():
(1) We protect an uffd-wp PTE marker a second time using uffd-wp: we will
end up in the "!huge_pte_none(pte)" case and mess up the PTE marker.
(2) We unprotect a uffd-wp PTE marker: we will similarly end up in the
"!huge_pte_none(pte)" case even though we cleared the PTE, because
the "pte" variable is stale. We'll mess up the PTE marker.
For example, if we later stumble over such a "wrongly modified" PTE marker,
we'll treat it like a present PTE that maps some garbage page.
This can, for example, be triggered by mapping a memfd backed by huge
pages, registering uffd-wp, uffd-wp'ing an unmapped page and (a)
uffd-wp'ing it a second time; or (b) uffd-unprotecting it; or (c)
unregistering uffd-wp. Then, ff we trigger fallocate(FALLOC_FL_PUNCH_HOLE)
on that file range, we will run into a VM_BUG_ON:
[ 195.039560] page:00000000ba1f2987 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x0
[ 195.039565] flags: 0x7ffffc0001000(reserved|node=0|zone=0|lastcpupid=0x1fffff)
[ 195.039568] raw: 0007ffffc0001000 ffffe742c0000008 ffffe742c0000008 0000000000000000
[ 195.039569] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 195.039569] page dumped because: VM_BUG_ON_PAGE(compound && !PageHead(page))
[ 195.039573] ------------[ cut here ]------------
[ 195.039574] kernel BUG at mm/rmap.c:1346!
[ 195.039579] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
[ 195.039581] CPU: 7 PID: 4777 Comm: qemu-system-x86 Not tainted 6.0.12-200.fc36.x86_64 #1
[ 195.039583] Hardware name: LENOVO 20WNS1F81N/20WNS1F81N, BIOS N35ET50W (1.50 ) 09/15/2022
[ 195.039584] RIP: 0010:page_remove_rmap+0x45b/0x550
[ 195.039588] Code: [...]
[ 195.039589] RSP: 0018:ffffbc03c3633ba8 EFLAGS: 00010292
[ 195.039591] RAX: 0000000000000040 RBX: ffffe742c0000000 RCX: 0000000000000000
[ 195.039592] RDX: 0000000000000002 RSI: ffffffff8e7aac1a RDI: 00000000ffffffff
[ 195.039592] RBP: 0000000000000001 R08: 0000000000000000 R09: ffffbc03c3633a08
[ 195.039593] R10: 0000000000000003 R11: ffffffff8f146328 R12: ffff9b04c42754b0
[ 195.039594] R13: ffffffff8fcc6328 R14: ffffbc03c3633c80 R15: ffff9b0484ab9100
[ 195.039595] FS: 00007fc7aaf68640(0000) GS:ffff9b0bbf7c0000(0000) knlGS:0000000000000000
[ 195.039596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 195.039597] CR2: 000055d402c49110 CR3: 0000000159392003 CR4: 0000000000772ee0
[ 195.039598] PKRU: 55555554
[ 195.039599] Call Trace:
[ 195.039600] <TASK>
[ 195.039602] __unmap_hugepage_range+0x33b/0x7d0
[ 195.039605] unmap_hugepage_range+0x55/0x70
[ 195.039608] hugetlb_vmdelete_list+0x77/0xa0
[ 195.039611] hugetlbfs_fallocate+0x410/0x550
[ 195.039612] ? _raw_spin_unlock_irqrestore+0x23/0x40
[ 195.039616] vfs_fallocate+0x12e/0x360
[ 195.039618] __x64_sys_fallocate+0x40/0x70
[ 195.039620] do_syscall_64+0x58/0x80
[ 195.039623] ? syscall_exit_to_user_mode+0x17/0x40
[ 195.039624] ? do_syscall_64+0x67/0x80
[ 195.039626] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 195.039628] RIP: 0033:0x7fc7b590651f
[ 195.039653] Code: [...]
[ 195.039654] RSP: 002b:00007fc7aaf66e70 EFLAGS: 00000293 ORIG_RAX: 000000000000011d
[ 195.039655] RAX: ffffffffffffffda RBX: 0000558ef4b7f370 RCX: 00007fc7b590651f
[ 195.039656] RDX: 0000000018000000 RSI: 0000000000000003 RDI: 000000000000000c
[ 195.039657] RBP: 0000000008000000 R08: 0000000000000000 R09: 0000000000000073
[ 195.039658] R10: 0000000008000000 R11: 0000000000000293 R12: 0000000018000000
[ 195.039658] R13: 00007fb8bbe00000 R14: 000000000000000c R15: 0000000000001000
[ 195.039661] </TASK>
Fix it by not going into the "!huge_pte_none(pte)" case if we stumble over
an exclusive marker. spin_unlock() + continue would get the job done.
However, instead, make it clearer that there are no fall-through
statements: we process each case (hwpoison, migration, marker, !none,
none) and then unlock the page table to continue with the next PTE. Let's
avoid "continue" statements and use a single spin_unlock() at the end.
Link: https://lkml.kernel.org/r/20221222205511.675832-1-david@redhat.com
Link: https://lkml.kernel.org/r/20221222205511.675832-2-david@redhat.com
Fixes: 60dfaad65aa9 ("mm/hugetlb: allow uffd wr-protect none ptes")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 21 +++++++--------------
1 file changed, 7 insertions(+), 14 deletions(-)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6623,10 +6623,8 @@ unsigned long hugetlb_change_protection(
}
pte = huge_ptep_get(ptep);
if (unlikely(is_hugetlb_entry_hwpoisoned(pte))) {
- spin_unlock(ptl);
- continue;
- }
- if (unlikely(is_hugetlb_entry_migration(pte))) {
+ /* Nothing to do. */
+ } else if (unlikely(is_hugetlb_entry_migration(pte))) {
swp_entry_t entry = pte_to_swp_entry(pte);
struct page *page = pfn_swap_entry_to_page(entry);
@@ -6647,18 +6645,13 @@ unsigned long hugetlb_change_protection(
set_huge_pte_at(mm, address, ptep, newpte);
pages++;
}
- spin_unlock(ptl);
- continue;
- }
- if (unlikely(pte_marker_uffd_wp(pte))) {
- /*
- * This is changing a non-present pte into a none pte,
- * no need for huge_ptep_modify_prot_start/commit().
- */
+ } else if (unlikely(is_pte_marker(pte))) {
+ /* No other markers apply for now. */
+ WARN_ON_ONCE(!pte_marker_uffd_wp(pte));
if (uffd_wp_resolve)
+ /* Safe to modify directly (non-present->none). */
huge_pte_clear(mm, address, ptep, psize);
- }
- if (!huge_pte_none(pte)) {
+ } else if (!huge_pte_none(pte)) {
pte_t old_pte;
unsigned int shift = huge_page_shift(hstate_vma(vma));
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 077/193] mm/hugetlb: fix uffd-wp handling for migration entries in hugetlb_change_protection()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 076/193] mm/hugetlb: fix PTE marker handling in hugetlb_change_protection() Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 078/193] mm/hugetlb: pre-allocate pgtable pages for uffd wr-protects Greg Kroah-Hartman
` (124 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand, Mike Kravetz,
Miaohe Lin, Muchun Song, Peter Xu, Andrew Morton
From: David Hildenbrand <david@redhat.com>
commit 44f86392bdd165da7e43d3c772aeb1e128ffd6c8 upstream.
We have to update the uffd-wp SWP PTE bit independent of the type of
migration entry. Currently, if we're unlucky and we want to install/clear
the uffd-wp bit just while we're migrating a read-only mapped hugetlb
page, we would miss to set/clear the uffd-wp bit.
Further, if we're processing a readable-exclusive migration entry and
neither want to set or clear the uffd-wp bit, we could currently end up
losing the uffd-wp bit. Note that the same would hold for writable
migrating entries, however, having a writable migration entry with the
uffd-wp bit set would already mean that something went wrong.
Note that the change from !is_readable_migration_entry ->
writable_migration_entry is harmless and actually cleaner, as raised by
Miaohe Lin and discussed in [1].
[1] https://lkml.kernel.org/r/90dd6a93-4500-e0de-2bf0-bf522c311b0c@huawei.com
Link: https://lkml.kernel.org/r/20221222205511.675832-3-david@redhat.com
Fixes: 60dfaad65aa9 ("mm/hugetlb: allow uffd wr-protect none ptes")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Peter Xu <peterx@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6627,10 +6627,9 @@ unsigned long hugetlb_change_protection(
} else if (unlikely(is_hugetlb_entry_migration(pte))) {
swp_entry_t entry = pte_to_swp_entry(pte);
struct page *page = pfn_swap_entry_to_page(entry);
+ pte_t newpte = pte;
- if (!is_readable_migration_entry(entry)) {
- pte_t newpte;
-
+ if (is_writable_migration_entry(entry)) {
if (PageAnon(page))
entry = make_readable_exclusive_migration_entry(
swp_offset(entry));
@@ -6638,13 +6637,15 @@ unsigned long hugetlb_change_protection(
entry = make_readable_migration_entry(
swp_offset(entry));
newpte = swp_entry_to_pte(entry);
- if (uffd_wp)
- newpte = pte_swp_mkuffd_wp(newpte);
- else if (uffd_wp_resolve)
- newpte = pte_swp_clear_uffd_wp(newpte);
- set_huge_pte_at(mm, address, ptep, newpte);
pages++;
}
+
+ if (uffd_wp)
+ newpte = pte_swp_mkuffd_wp(newpte);
+ else if (uffd_wp_resolve)
+ newpte = pte_swp_clear_uffd_wp(newpte);
+ if (!pte_same(pte, newpte))
+ set_huge_pte_at(mm, address, ptep, newpte);
} else if (unlikely(is_pte_marker(pte))) {
/* No other markers apply for now. */
WARN_ON_ONCE(!pte_marker_uffd_wp(pte));
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 078/193] mm/hugetlb: pre-allocate pgtable pages for uffd wr-protects
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 077/193] mm/hugetlb: fix uffd-wp handling for migration entries " Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 079/193] mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a VMA Greg Kroah-Hartman
` (123 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Xu, James Houghton,
Mike Kravetz, David Hildenbrand, Andrea Arcangeli,
Axel Rasmussen, Muchun Song, Nadav Amit, Andrew Morton
From: Peter Xu <peterx@redhat.com>
commit fed15f1345dc8a7fc8baa81e8b55c3ba010d7f4b upstream.
Userfaultfd-wp uses pte markers to mark wr-protected pages for both shmem
and hugetlb. Shmem has pre-allocation ready for markers, but hugetlb path
was overlooked.
Doing so by calling huge_pte_alloc() if the initial pgtable walk fails to
find the huge ptep. It's possible that huge_pte_alloc() can fail with
high memory pressure, in that case stop the loop immediately and fail
silently. This is not the most ideal solution but it matches with what we
do with shmem meanwhile it avoids the splat in dmesg.
Link: https://lkml.kernel.org/r/20230104225207.1066932-2-peterx@redhat.com
Fixes: 60dfaad65aa9 ("mm/hugetlb: allow uffd wr-protect none ptes")
Signed-off-by: Peter Xu <peterx@redhat.com>
Reported-by: James Houghton <jthoughton@google.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: James Houghton <jthoughton@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Muchun Song <songmuchun@bytedance.com>
Cc: Nadav Amit <nadav.amit@gmail.com>
Cc: <stable@vger.kernel.org> [5.19+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6604,8 +6604,17 @@ unsigned long hugetlb_change_protection(
spinlock_t *ptl;
ptep = huge_pte_offset(mm, address, psize);
if (!ptep) {
- address |= last_addr_mask;
- continue;
+ if (!uffd_wp) {
+ address |= last_addr_mask;
+ continue;
+ }
+ /*
+ * Userfaultfd wr-protect requires pgtable
+ * pre-allocations to install pte markers.
+ */
+ ptep = huge_pte_alloc(mm, vma, address, psize);
+ if (!ptep)
+ break;
}
ptl = huge_pte_lock(h, mm, ptep);
if (huge_pmd_unshare(mm, vma, address, ptep)) {
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 079/193] mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a VMA
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 078/193] mm/hugetlb: pre-allocate pgtable pages for uffd wr-protects Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 080/193] mm/MADV_COLLAPSE: dont expand collapse when vm_end is past requested end Greg Kroah-Hartman
` (122 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand, Ives van Hoorne,
Peter Xu, Hugh Dickins, Alistair Popple, Mike Rapoport,
Nadav Amit, Andrea Arcangeli, Andrew Morton
From: David Hildenbrand <david@redhat.com>
commit 51d3d5eb74ff53b92dcff48b30ae2ed8edd85a32 upstream.
Currently, we don't enable writenotify when enabling userfaultfd-wp on a
shared writable mapping (for now only shmem and hugetlb). The consequence
is that vma->vm_page_prot will still include write permissions, to be set
as default for all PTEs that get remapped (e.g., mprotect(), NUMA hinting,
page migration, ...).
So far, vma->vm_page_prot is assumed to be a safe default, meaning that we
only add permissions (e.g., mkwrite) but not remove permissions (e.g.,
wrprotect). For example, when enabling softdirty tracking, we enable
writenotify. With uffd-wp on shared mappings, that changed. More details
on vma->vm_page_prot semantics were summarized in [1].
This is problematic for uffd-wp: we'd have to manually check for a uffd-wp
PTEs/PMDs and manually write-protect PTEs/PMDs, which is error prone.
Prone to such issues is any code that uses vma->vm_page_prot to set PTE
permissions: primarily pte_modify() and mk_pte().
Instead, let's enable writenotify such that PTEs/PMDs/... will be mapped
write-protected as default and we will only allow selected PTEs that are
definitely safe to be mapped without write-protection (see
can_change_pte_writable()) to be writable. In the future, we might want
to enable write-bit recovery -- e.g., can_change_pte_writable() -- at more
locations, for example, also when removing uffd-wp protection.
This fixes two known cases:
(a) remove_migration_pte() mapping uffd-wp'ed PTEs writable, resulting
in uffd-wp not triggering on write access.
(b) do_numa_page() / do_huge_pmd_numa_page() mapping uffd-wp'ed PTEs/PMDs
writable, resulting in uffd-wp not triggering on write access.
Note that do_numa_page() / do_huge_pmd_numa_page() can be reached even
without NUMA hinting (which currently doesn't seem to be applicable to
shmem), for example, by using uffd-wp with a PROT_WRITE shmem VMA. On
such a VMA, userfaultfd-wp is currently non-functional.
Note that when enabling userfaultfd-wp, there is no need to walk page
tables to enforce the new default protection for the PTEs: we know that
they cannot be uffd-wp'ed yet, because that can only happen after enabling
uffd-wp for the VMA in general.
Also note that this makes mprotect() on ranges with uffd-wp'ed PTEs not
accidentally set the write bit -- which would result in uffd-wp not
triggering on later write access. This commit makes uffd-wp on shmem
behave just like uffd-wp on anonymous memory in that regard, even though,
mixing mprotect with uffd-wp is controversial.
[1] https://lkml.kernel.org/r/92173bad-caa3-6b43-9d1e-9a471fdbc184@redhat.com
Link: https://lkml.kernel.org/r/20221209080912.7968-1-david@redhat.com
Fixes: b1f9e876862d ("mm/uffd: enable write protection for shmem & hugetlbfs")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reported-by: Ives van Hoorne <ives@codesandbox.io>
Debugged-by: Peter Xu <peterx@redhat.com>
Acked-by: Peter Xu <peterx@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Nadav Amit <nadav.amit@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/userfaultfd.c | 28 ++++++++++++++++++++++------
mm/mmap.c | 4 ++++
2 files changed, 26 insertions(+), 6 deletions(-)
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -108,6 +108,21 @@ static bool userfaultfd_is_initialized(s
return ctx->features & UFFD_FEATURE_INITIALIZED;
}
+static void userfaultfd_set_vm_flags(struct vm_area_struct *vma,
+ vm_flags_t flags)
+{
+ const bool uffd_wp_changed = (vma->vm_flags ^ flags) & VM_UFFD_WP;
+
+ vma->vm_flags = flags;
+ /*
+ * For shared mappings, we want to enable writenotify while
+ * userfaultfd-wp is enabled (see vma_wants_writenotify()). We'll simply
+ * recalculate vma->vm_page_prot whenever userfaultfd-wp changes.
+ */
+ if ((vma->vm_flags & VM_SHARED) && uffd_wp_changed)
+ vma_set_page_prot(vma);
+}
+
static int userfaultfd_wake_function(wait_queue_entry_t *wq, unsigned mode,
int wake_flags, void *key)
{
@@ -618,7 +633,8 @@ static void userfaultfd_event_wait_compl
for_each_vma(vmi, vma) {
if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) {
vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
- vma->vm_flags &= ~__VM_UFFD_FLAGS;
+ userfaultfd_set_vm_flags(vma,
+ vma->vm_flags & ~__VM_UFFD_FLAGS);
}
}
mmap_write_unlock(mm);
@@ -652,7 +668,7 @@ int dup_userfaultfd(struct vm_area_struc
octx = vma->vm_userfaultfd_ctx.ctx;
if (!octx || !(octx->features & UFFD_FEATURE_EVENT_FORK)) {
vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
- vma->vm_flags &= ~__VM_UFFD_FLAGS;
+ userfaultfd_set_vm_flags(vma, vma->vm_flags & ~__VM_UFFD_FLAGS);
return 0;
}
@@ -733,7 +749,7 @@ void mremap_userfaultfd_prep(struct vm_a
} else {
/* Drop uffd context if remap feature not enabled */
vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
- vma->vm_flags &= ~__VM_UFFD_FLAGS;
+ userfaultfd_set_vm_flags(vma, vma->vm_flags & ~__VM_UFFD_FLAGS);
}
}
@@ -895,7 +911,7 @@ static int userfaultfd_release(struct in
prev = vma;
}
- vma->vm_flags = new_flags;
+ userfaultfd_set_vm_flags(vma, new_flags);
vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
}
mmap_write_unlock(mm);
@@ -1463,7 +1479,7 @@ static int userfaultfd_register(struct u
* the next vma was merged into the current one and
* the current one has not been updated yet.
*/
- vma->vm_flags = new_flags;
+ userfaultfd_set_vm_flags(vma, new_flags);
vma->vm_userfaultfd_ctx.ctx = ctx;
if (is_vm_hugetlb_page(vma) && uffd_disable_huge_pmd_share(vma))
@@ -1651,7 +1667,7 @@ static int userfaultfd_unregister(struct
* the next vma was merged into the current one and
* the current one has not been updated yet.
*/
- vma->vm_flags = new_flags;
+ userfaultfd_set_vm_flags(vma, new_flags);
vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
skip:
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1524,6 +1524,10 @@ int vma_wants_writenotify(struct vm_area
if (vma_soft_dirty_enabled(vma) && !is_vm_hugetlb_page(vma))
return 1;
+ /* Do we need write faults for uffd-wp tracking? */
+ if (userfaultfd_wp(vma))
+ return 1;
+
/* Specialty mapping? */
if (vm_flags & VM_PFNMAP)
return 0;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 080/193] mm/MADV_COLLAPSE: dont expand collapse when vm_end is past requested end
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 079/193] mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a VMA Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 081/193] btrfs: add extra error messages to cover non-ENOMEM errors from device_add_list() Greg Kroah-Hartman
` (121 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zach OKeefe, Hugh Dickins, Yang Shi,
Andrew Morton
From: Zach O'Keefe <zokeefe@google.com>
commit 52dc031088f00e323140ece4004e70c33153c6dd upstream.
MADV_COLLAPSE acts on one hugepage-aligned/sized region at a time, until
it has collapsed all eligible memory contained within the bounds supplied
by the user.
At the top of each hugepage iteration we (re)lock mmap_lock and
(re)validate the VMA for eligibility and update variables that might have
changed while mmap_lock was dropped. One thing that might occur is that
the VMA could be resized, and as such, we refetch vma->vm_end to make sure
we don't collapse past the end of the VMA's new end.
However, it's possible that when refetching vma->vm_end that we expand the
region acted on by MADV_COLLAPSE if vma->vm_end is greater than size+len
supplied by the user.
The consequence here is that we may attempt to collapse more memory than
requested, possibly yielding either "too much success" or "false failure"
user-visible results. An example of the former is if we MADV_COLLAPSE the
first 4MiB of a 2TiB mmap()'d file, the incorrect refetch would cause the
operation to block for much longer than anticipated as we attempt to
collapse the entire TiB region. An example of the latter is that applying
MADV_COLLPSE to a 4MiB file mapped to the start of a 6MiB VMA will
successfully collapse the first 4MiB, then incorrectly attempt to collapse
the last hugepage-aligned/sized region -- fail (since readahead/page cache
lookup will fail) -- and report a failure to the user.
I don't believe there is a kernel stability concern here as we always
(re)validate the VMA / region accordingly. Also as Hugh mentions, the
user-visible effects are: we try to collapse more memory than requested
by the user, and/or failing an operation that should have otherwise
succeeded. An example is trying to collapse a 4MiB file contained
within a 12MiB VMA.
Don't expand the acted-on region when refetching vma->vm_end.
Link: https://lkml.kernel.org/r/20221224082035.3197140-1-zokeefe@google.com
Fixes: 4d24de9425f7 ("mm: MADV_COLLAPSE: refetch vm_end after reacquiring mmap_lock")
Signed-off-by: Zach O'Keefe <zokeefe@google.com>
Reported-by: Hugh Dickins <hughd@google.com>
Cc: Yang Shi <shy828301@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/khugepaged.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -2644,7 +2644,7 @@ int madvise_collapse(struct vm_area_stru
goto out_nolock;
}
- hend = vma->vm_end & HPAGE_PMD_MASK;
+ hend = min(hend, vma->vm_end & HPAGE_PMD_MASK);
}
mmap_assert_locked(mm);
memset(cc->node_load, 0, sizeof(cc->node_load));
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 081/193] btrfs: add extra error messages to cover non-ENOMEM errors from device_add_list()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 080/193] mm/MADV_COLLAPSE: dont expand collapse when vm_end is past requested end Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 082/193] btrfs: fix missing error handling when logging directory items Greg Kroah-Hartman
` (120 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qu Wenruo, David Sterba
From: Qu Wenruo <wqu@suse.com>
commit ed02363fbbed52a3f5ea0d188edd09045a806eb5 upstream.
[BUG]
When test case btrfs/219 (aka, mount a registered device but with a lower
generation) failed, there is not any useful information for the end user
to find out what's going wrong.
The mount failure just looks like this:
# mount -o loop /tmp/219.img2 /mnt/btrfs/
mount: /mnt/btrfs: mount(2) system call failed: File exists.
dmesg(1) may have more information after failed mount system call.
While the dmesg contains nothing but the loop device change:
loop1: detected capacity change from 0 to 524288
[CAUSE]
In device_list_add() we have a lot of extra checks to reject invalid
cases.
That function also contains the regular device scan result like the
following prompt:
BTRFS: device fsid 6222333e-f9f1-47e6-b306-55ddd4dcaef4 devid 1 transid 8 /dev/loop0 scanned by systemd-udevd (3027)
But unfortunately not all errors have their own error messages, thus if
we hit something wrong in device_add_list(), there may be no error
messages at all.
[FIX]
Add errors message for all non-ENOMEM errors.
For ENOMEM, I'd say we're in a much worse situation, and there should be
some OOM messages way before our call sites.
CC: stable@vger.kernel.org # 6.0+
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/volumes.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -770,8 +770,11 @@ static noinline struct btrfs_device *dev
BTRFS_SUPER_FLAG_CHANGING_FSID_V2);
error = lookup_bdev(path, &path_devt);
- if (error)
+ if (error) {
+ btrfs_err(NULL, "failed to lookup block device for path %s: %d",
+ path, error);
return ERR_PTR(error);
+ }
if (fsid_change_in_progress) {
if (!has_metadata_uuid)
@@ -836,6 +839,9 @@ static noinline struct btrfs_device *dev
if (!device) {
if (fs_devices->opened) {
+ btrfs_err(NULL,
+ "device %s belongs to fsid %pU, and the fs is already mounted",
+ path, fs_devices->fsid);
mutex_unlock(&fs_devices->device_list_mutex);
return ERR_PTR(-EBUSY);
}
@@ -910,6 +916,9 @@ static noinline struct btrfs_device *dev
* generation are equal.
*/
mutex_unlock(&fs_devices->device_list_mutex);
+ btrfs_err(NULL,
+"device %s already registered with a higher generation, found %llu expect %llu",
+ path, found_transid, device->generation);
return ERR_PTR(-EEXIST);
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 082/193] btrfs: fix missing error handling when logging directory items
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 081/193] btrfs: add extra error messages to cover non-ENOMEM errors from device_add_list() Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 083/193] btrfs: fix directory logging due to race with concurrent index key deletion Greg Kroah-Hartman
` (119 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Arendt, Josef Bacik,
Filipe Manana, David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit 6d3d970b2735b967650d319be27268fedc5598d1 upstream.
When logging a directory, at log_dir_items(), if we get an error when
attempting to search the subvolume tree for a dir index item, we end up
returning 0 (success) from log_dir_items() because 'err' is left with a
value of 0.
This can lead to a few problems, specially in the case the variable
'last_offset' has a value of (u64)-1 (and it's initialized to that when
it was declared):
1) By returning from log_dir_items() with success (0) and a value of
(u64)-1 for '*last_offset_ret', we end up not logging any other dir
index keys that follow the missing, just deleted, index key. The
(u64)-1 value makes log_directory_changes() not call log_dir_items()
again;
2) Before returning with success (0), log_dir_items(), will log a dir
index range item covering a range from the last old dentry index
(stored in the variable 'last_old_dentry_offset') to the value of
'last_offset'. If 'last_offset' has a value of (u64)-1, then it means
if the log is persisted and replayed after a power failure, it will
cause deletion of all the directory entries that have an index number
between last_old_dentry_offset + 1 and (u64)-1;
3) We can end up returning from log_dir_items() with
ctx->last_dir_item_offset having a lower value than
inode->last_dir_index_offset, because the former is set to the current
key we are processing at process_dir_items_leaf(), and at the end of
log_directory_changes() we set inode->last_dir_index_offset to the
current value of ctx->last_dir_item_offset. So if for example a
deletion of a lower dir index key happened, we set
ctx->last_dir_item_offset to that index value, then if we return from
log_dir_items() because btrfs_search_slot() returned an error, we end up
returning without any error from log_dir_items() and then
log_directory_changes() sets inode->last_dir_index_offset to a lower
value than it had before.
This can result in unpredictable and unexpected behaviour when we
need to log again the directory in the same transaction, and can result
in ending up with a log tree leaf that has duplicated keys, as we do
batch insertions of dir index keys into a log tree.
Fix this by setting 'err' to the value of 'ret' in case
btrfs_search_slot() or btrfs_previous_item() returned an error. That will
result in falling back to a full transaction commit.
Reported-by: David Arendt <admin@prnet.org>
Link: https://lore.kernel.org/linux-btrfs/ae169fc6-f504-28f0-a098-6fa6a4dfb612@leemhuis.info/
Fixes: e02119d5a7b4 ("Btrfs: Add a write ahead tree log to optimize synchronous operations")
CC: stable@vger.kernel.org # 4.14+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/tree-log.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3857,7 +3857,10 @@ static noinline int log_dir_items(struct
path->slots[0]);
if (tmp.type == BTRFS_DIR_INDEX_KEY)
last_old_dentry_offset = tmp.offset;
+ } else if (ret < 0) {
+ err = ret;
}
+
goto done;
}
@@ -3877,7 +3880,11 @@ static noinline int log_dir_items(struct
*/
if (tmp.type == BTRFS_DIR_INDEX_KEY)
last_old_dentry_offset = tmp.offset;
+ } else if (ret < 0) {
+ err = ret;
+ goto done;
}
+
btrfs_release_path(path);
/*
@@ -3890,6 +3897,8 @@ static noinline int log_dir_items(struct
*/
search:
ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0);
+ if (ret < 0)
+ err = ret;
if (ret != 0)
goto done;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 083/193] btrfs: fix directory logging due to race with concurrent index key deletion
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 082/193] btrfs: fix missing error handling when logging directory items Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 084/193] btrfs: add missing setup of log for full commit at add_conflicting_inode() Greg Kroah-Hartman
` (118 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Arendt, Josef Bacik,
Filipe Manana, David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit 8bb6898da6271d82d8e76d8088d66b971a7dcfa6 upstream.
Sometimes we log a directory without holding its VFS lock, so while we
logging it, dir index entries may be added or removed. This typically
happens when logging a dentry from a parent directory that points to a
new directory, through log_new_dir_dentries(), or when while logging
some other inode we also need to log its parent directories (through
btrfs_log_all_parents()).
This means that while we are at log_dir_items(), we may not find a dir
index key we found before, because it was deleted in the meanwhile, so
a call to btrfs_search_slot() may return 1 (key not found). In that case
we return from log_dir_items() with a success value (the variable 'err'
has a value of 0). This can lead to a few problems, specially in the case
where the variable 'last_offset' has a value of (u64)-1 (and it's
initialized to that when it was declared):
1) By returning from log_dir_items() with success (0) and a value of
(u64)-1 for '*last_offset_ret', we end up not logging any other dir
index keys that follow the missing, just deleted, index key. The
(u64)-1 value makes log_directory_changes() not call log_dir_items()
again;
2) Before returning with success (0), log_dir_items(), will log a dir
index range item covering a range from the last old dentry index
(stored in the variable 'last_old_dentry_offset') to the value of
'last_offset'. If 'last_offset' has a value of (u64)-1, then it means
if the log is persisted and replayed after a power failure, it will
cause deletion of all the directory entries that have an index number
between last_old_dentry_offset + 1 and (u64)-1;
3) We can end up returning from log_dir_items() with
ctx->last_dir_item_offset having a lower value than
inode->last_dir_index_offset, because the former is set to the current
key we are processing at process_dir_items_leaf(), and at the end of
log_directory_changes() we set inode->last_dir_index_offset to the
current value of ctx->last_dir_item_offset. So if for example a
deletion of a lower dir index key happened, we set
ctx->last_dir_item_offset to that index value, then if we return from
log_dir_items() because btrfs_search_slot() returned 1, we end up
returning from log_dir_items() with success (0) and then
log_directory_changes() sets inode->last_dir_index_offset to a lower
value than it had before.
This can result in unpredictable and unexpected behaviour when we
need to log again the directory in the same transaction, and can result
in ending up with a log tree leaf that has duplicated keys, as we do
batch insertions of dir index keys into a log tree.
So fix this by making log_dir_items() move on to the next dir index key
if it does not find the one it was looking for.
Reported-by: David Arendt <admin@prnet.org>
Link: https://lore.kernel.org/linux-btrfs/ae169fc6-f504-28f0-a098-6fa6a4dfb612@leemhuis.info/
CC: stable@vger.kernel.org # 4.14+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/tree-log.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3888,17 +3888,26 @@ static noinline int log_dir_items(struct
btrfs_release_path(path);
/*
- * Find the first key from this transaction again. See the note for
- * log_new_dir_dentries, if we're logging a directory recursively we
- * won't be holding its i_mutex, which means we can modify the directory
- * while we're logging it. If we remove an entry between our first
- * search and this search we'll not find the key again and can just
- * bail.
+ * Find the first key from this transaction again or the one we were at
+ * in the loop below in case we had to reschedule. We may be logging the
+ * directory without holding its VFS lock, which happen when logging new
+ * dentries (through log_new_dir_dentries()) or in some cases when we
+ * need to log the parent directory of an inode. This means a dir index
+ * key might be deleted from the inode's root, and therefore we may not
+ * find it anymore. If we can't find it, just move to the next key. We
+ * can not bail out and ignore, because if we do that we will simply
+ * not log dir index keys that come after the one that was just deleted
+ * and we can end up logging a dir index range that ends at (u64)-1
+ * (@last_offset is initialized to that), resulting in removing dir
+ * entries we should not remove at log replay time.
*/
search:
ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0);
+ if (ret > 0)
+ ret = btrfs_next_item(root, path);
if (ret < 0)
err = ret;
+ /* If ret is 1, there are no more keys in the inode's root. */
if (ret != 0)
goto done;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 084/193] btrfs: add missing setup of log for full commit at add_conflicting_inode()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 083/193] btrfs: fix directory logging due to race with concurrent index key deletion Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 085/193] btrfs: do not abort transaction on failure to write log tree when syncing log Greg Kroah-Hartman
` (117 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Filipe Manana, David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit 94cd63ae679973edeb5ea95ec25a54467c3e54c8 upstream.
When logging conflicting inodes, if we reach the maximum limit of inodes,
we return BTRFS_LOG_FORCE_COMMIT to force a transaction commit. However
we don't mark the log for full commit (with btrfs_set_log_full_commit()),
which means that once we leave the log transaction and before we commit
the transaction, some other task may sync the log, which is incomplete
as we have not logged all conflicting inodes, leading to some inconsistent
in case that log ends up being replayed.
So also call btrfs_set_log_full_commit() at add_conflicting_inode().
Fixes: e09d94c9e448 ("btrfs: log conflicting inodes without holding log mutex of the initial inode")
CC: stable@vger.kernel.org # 6.1
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/tree-log.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -5626,8 +5626,10 @@ static int add_conflicting_inode(struct
* LOG_INODE_EXISTS mode) and slow down other fsyncs or transaction
* commits.
*/
- if (ctx->num_conflict_inodes >= MAX_CONFLICT_INODES)
+ if (ctx->num_conflict_inodes >= MAX_CONFLICT_INODES) {
+ btrfs_set_log_full_commit(trans);
return BTRFS_LOG_FORCE_COMMIT;
+ }
inode = btrfs_iget(root->fs_info->sb, ino, root);
/*
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 085/193] btrfs: do not abort transaction on failure to write log tree when syncing log
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 084/193] btrfs: add missing setup of log for full commit at add_conflicting_inode() Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 086/193] btrfs: do not abort transaction on failure to update log root Greg Kroah-Hartman
` (116 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Filipe Manana, David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit 16199ad9eb6db60a6b10794a09fc1ac6d09312ff upstream.
When syncing the log, if we fail to write log tree extent buffers, we mark
the log for a full commit and abort the transaction. However we don't need
to abort the transaction, all we really need to do is to make sure no one
can commit a superblock pointing to new log tree roots. Just because we
got a failure writing extent buffers for a log tree, it does not mean we
will also fail to do a transaction commit.
One particular case is if due to a bug somewhere, when writing log tree
extent buffers, the tree checker detects some corruption and the writeout
fails because of that. Aborting the transaction can be very disruptive for
a user, specially if the issue happened on a root filesystem. One example
is the scenario in the Link tag below, where an isolated corruption on log
tree leaves was causing transaction aborts when syncing the log.
Link: https://lore.kernel.org/linux-btrfs/ae169fc6-f504-28f0-a098-6fa6a4dfb612@leemhuis.info/
CC: stable@vger.kernel.org # 5.15+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/disk-io.c | 9 ++++++++-
fs/btrfs/tree-log.c | 2 --
2 files changed, 8 insertions(+), 3 deletions(-)
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -344,7 +344,14 @@ error:
btrfs_print_tree(eb, 0);
btrfs_err(fs_info, "block=%llu write time tree block corruption detected",
eb->start);
- WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG));
+ /*
+ * Be noisy if this is an extent buffer from a log tree. We don't abort
+ * a transaction in case there's a bad log tree extent buffer, we just
+ * fallback to a transaction commit. Still we want to know when there is
+ * a bad log tree extent buffer, as that may signal a bug somewhere.
+ */
+ WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG) ||
+ btrfs_header_owner(eb) == BTRFS_TREE_LOG_OBJECTID);
return ret;
}
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3011,7 +3011,6 @@ int btrfs_sync_log(struct btrfs_trans_ha
ret = 0;
if (ret) {
blk_finish_plug(&plug);
- btrfs_abort_transaction(trans, ret);
btrfs_set_log_full_commit(trans);
mutex_unlock(&root->log_mutex);
goto out;
@@ -3143,7 +3142,6 @@ int btrfs_sync_log(struct btrfs_trans_ha
goto out_wake_log_root;
} else if (ret) {
btrfs_set_log_full_commit(trans);
- btrfs_abort_transaction(trans, ret);
mutex_unlock(&log_root_tree->log_mutex);
goto out_wake_log_root;
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 086/193] btrfs: do not abort transaction on failure to update log root
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 085/193] btrfs: do not abort transaction on failure to write log tree when syncing log Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 087/193] btrfs: qgroup: do not warn on record without old_roots populated Greg Kroah-Hartman
` (115 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Filipe Manana, David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit 09e44868f1e03c7825ca4283256abedc95e249a3 upstream.
When syncing a log, if we fail to update a log root in the log root tree,
we are aborting the transaction if the failure was not -ENOSPC. This is
excessive because there is a chance that a transaction commit can succeed,
and therefore avoid to turn the filesystem into RO mode. All we need to be
careful about is to mark the log for a full commit, which we already do,
to make sure no one commits a super block pointing to an outdated log root
tree.
So don't abort the transaction if we fail to update a log root in the log
root tree, and log an error if the failure is not -ENOSPC, so that it does
not go completely unnoticed.
CC: stable@vger.kernel.org # 6.0+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/tree-log.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3075,15 +3075,12 @@ int btrfs_sync_log(struct btrfs_trans_ha
blk_finish_plug(&plug);
btrfs_set_log_full_commit(trans);
-
- if (ret != -ENOSPC) {
- btrfs_abort_transaction(trans, ret);
- mutex_unlock(&log_root_tree->log_mutex);
- goto out;
- }
+ if (ret != -ENOSPC)
+ btrfs_err(fs_info,
+ "failed to update log for root %llu ret %d",
+ root->root_key.objectid, ret);
btrfs_wait_tree_log_extents(log, mark);
mutex_unlock(&log_root_tree->log_mutex);
- ret = BTRFS_LOG_FORCE_COMMIT;
goto out;
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 087/193] btrfs: qgroup: do not warn on record without old_roots populated
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 086/193] btrfs: do not abort transaction on failure to update log root Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 088/193] btrfs: fix invalid leaf access due to inline extent during lseek Greg Kroah-Hartman
` (114 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Straub, HanatoK, Qu Wenruo,
David Sterba
From: Qu Wenruo <wqu@suse.com>
commit 75181406b4eafacc531ff2ee5fb032bd93317e2b upstream.
[BUG]
There are some reports from the mailing list that since v6.1 kernel, the
WARN_ON() inside btrfs_qgroup_account_extent() gets triggered during
rescan:
WARNING: CPU: 3 PID: 6424 at fs/btrfs/qgroup.c:2756 btrfs_qgroup_account_extents+0x1ae/0x260 [btrfs]
CPU: 3 PID: 6424 Comm: snapperd Tainted: P OE 6.1.2-1-default #1 openSUSE Tumbleweed 05c7a1b1b61d5627475528f71f50444637b5aad7
RIP: 0010:btrfs_qgroup_account_extents+0x1ae/0x260 [btrfs]
Call Trace:
<TASK>
btrfs_commit_transaction+0x30c/0xb40 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6]
? start_transaction+0xc3/0x5b0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6]
btrfs_qgroup_rescan+0x42/0xc0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6]
btrfs_ioctl+0x1ab9/0x25c0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6]
? __rseq_handle_notify_resume+0xa9/0x4a0
? mntput_no_expire+0x4a/0x240
? __seccomp_filter+0x319/0x4d0
__x64_sys_ioctl+0x90/0xd0
do_syscall_64+0x5b/0x80
? syscall_exit_to_user_mode+0x17/0x40
? do_syscall_64+0x67/0x80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fd9b790d9bf
</TASK>
[CAUSE]
Since commit e15e9f43c7ca ("btrfs: introduce
BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING to skip qgroup accounting"), if
our qgroup is already in inconsistent state, we will no longer do the
time-consuming backref walk.
This can leave some qgroup records without a valid old_roots ulist.
Normally this is fine, as btrfs_qgroup_account_extents() would also skip
those records if we have NO_ACCOUNTING flag set.
But there is a small window, if we have NO_ACCOUNTING flag set, and
inserted some qgroup_record without a old_roots ulist, but then the user
triggered a qgroup rescan.
During btrfs_qgroup_rescan(), we firstly clear NO_ACCOUNTING flag, then
commit current transaction.
And since we have a qgroup_record with old_roots = NULL, we trigger the
WARN_ON() during btrfs_qgroup_account_extents().
[FIX]
Unfortunately due to the introduction of NO_ACCOUNTING flag, the
assumption that every qgroup_record would have its old_roots populated
is no longer correct.
Fix the false alerts and drop the WARN_ON().
Reported-by: Lukas Straub <lukasstraub2@web.de>
Reported-by: HanatoK <summersnow9403@gmail.com>
Fixes: e15e9f43c7ca ("btrfs: introduce BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING to skip qgroup accounting")
CC: stable@vger.kernel.org # 6.1
Link: https://lore.kernel.org/linux-btrfs/2403c697-ddaf-58ad-3829-0335fc89df09@gmail.com/
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/qgroup.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2751,9 +2751,19 @@ int btrfs_qgroup_account_extents(struct
BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING)) {
/*
* Old roots should be searched when inserting qgroup
- * extent record
+ * extent record.
+ *
+ * But for INCONSISTENT (NO_ACCOUNTING) -> rescan case,
+ * we may have some record inserted during
+ * NO_ACCOUNTING (thus no old_roots populated), but
+ * later we start rescan, which clears NO_ACCOUNTING,
+ * leaving some inserted records without old_roots
+ * populated.
+ *
+ * Those cases are rare and should not cause too much
+ * time spent during commit_transaction().
*/
- if (WARN_ON(!record->old_roots)) {
+ if (!record->old_roots) {
/* Search commit root to find old_roots */
ret = btrfs_find_all_roots(NULL, fs_info,
record->bytenr, 0,
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 088/193] btrfs: fix invalid leaf access due to inline extent during lseek
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 087/193] btrfs: qgroup: do not warn on record without old_roots populated Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 089/193] btrfs: fix race between quota rescan and disable leading to NULL pointer deref Greg Kroah-Hartman
` (113 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Schoepfer, Filipe Manana,
David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit 1f55ee6d0901d915801618bda0af4e5b937e3db7 upstream.
During lseek, for SEEK_DATA and SEEK_HOLE modes, we access the disk_bytenr
of an extent without checking its type. However inline extents have their
data starting the offset of the disk_bytenr field, so accessing that field
when we have an inline extent can result in either of the following:
1) Interpret the inline extent's data as a disk_bytenr value;
2) In case the inline data is less than 8 bytes, we access part of some
other item in the leaf, or unused space in the leaf;
3) In case the inline data is less than 8 bytes and the extent item is
the first item in the leaf, we can access beyond the leaf's limit.
So fix this by not accessing the disk_bytenr field if we have an inline
extent.
Fixes: b6e833567ea1 ("btrfs: make hole and data seeking a lot more efficient")
Reported-by: Matthias Schoepfer <matthias.schoepfer@googlemail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216908
Link: https://lore.kernel.org/linux-btrfs/7f25442f-b121-2a3a-5a3d-22bcaae83cd4@leemhuis.info/
CC: stable@vger.kernel.org # 6.1
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/file.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -3838,6 +3838,7 @@ static loff_t find_desired_extent(struct
struct extent_buffer *leaf = path->nodes[0];
struct btrfs_file_extent_item *extent;
u64 extent_end;
+ u8 type;
if (path->slots[0] >= btrfs_header_nritems(leaf)) {
ret = btrfs_next_leaf(root, path);
@@ -3892,10 +3893,16 @@ static loff_t find_desired_extent(struct
extent = btrfs_item_ptr(leaf, path->slots[0],
struct btrfs_file_extent_item);
+ type = btrfs_file_extent_type(leaf, extent);
- if (btrfs_file_extent_disk_bytenr(leaf, extent) == 0 ||
- btrfs_file_extent_type(leaf, extent) ==
- BTRFS_FILE_EXTENT_PREALLOC) {
+ /*
+ * Can't access the extent's disk_bytenr field if this is an
+ * inline extent, since at that offset, it's where the extent
+ * data starts.
+ */
+ if (type == BTRFS_FILE_EXTENT_PREALLOC ||
+ (type == BTRFS_FILE_EXTENT_REG &&
+ btrfs_file_extent_disk_bytenr(leaf, extent) == 0)) {
/*
* Explicit hole or prealloc extent, search for delalloc.
* A prealloc extent is treated like a hole.
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 089/193] btrfs: fix race between quota rescan and disable leading to NULL pointer deref
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 088/193] btrfs: fix invalid leaf access due to inline extent during lseek Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 090/193] cifs: do not include page data when checking signature Greg Kroah-Hartman
` (112 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+96977faa68092ad382c4,
Filipe Manana, David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit b7adbf9ada3513d2092362c8eac5cddc5b651f5c upstream.
If we have one task trying to start the quota rescan worker while another
one is trying to disable quotas, we can end up hitting a race that results
in the quota rescan worker doing a NULL pointer dereference. The steps for
this are the following:
1) Quotas are enabled;
2) Task A calls the quota rescan ioctl and enters btrfs_qgroup_rescan().
It calls qgroup_rescan_init() which returns 0 (success) and then joins a
transaction and commits it;
3) Task B calls the quota disable ioctl and enters btrfs_quota_disable().
It clears the bit BTRFS_FS_QUOTA_ENABLED from fs_info->flags and calls
btrfs_qgroup_wait_for_completion(), which returns immediately since the
rescan worker is not yet running.
Then it starts a transaction and locks fs_info->qgroup_ioctl_lock;
4) Task A queues the rescan worker, by calling btrfs_queue_work();
5) The rescan worker starts, and calls rescan_should_stop() at the start
of its while loop, which results in 0 iterations of the loop, since
the flag BTRFS_FS_QUOTA_ENABLED was cleared from fs_info->flags by
task B at step 3);
6) Task B sets fs_info->quota_root to NULL;
7) The rescan worker tries to start a transaction and uses
fs_info->quota_root as the root argument for btrfs_start_transaction().
This results in a NULL pointer dereference down the call chain of
btrfs_start_transaction(). The stack trace is something like the one
reported in Link tag below:
general protection fault, probably for non-canonical address 0xdffffc0000000041: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000208-0x000000000000020f]
CPU: 1 PID: 34 Comm: kworker/u4:2 Not tainted 6.1.0-syzkaller-13872-gb6bb9676f216 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: btrfs-qgroup-rescan btrfs_work_helper
RIP: 0010:start_transaction+0x48/0x10f0 fs/btrfs/transaction.c:564
Code: 48 89 fb 48 (...)
RSP: 0018:ffffc90000ab7ab0 EFLAGS: 00010206
RAX: 0000000000000041 RBX: 0000000000000208 RCX: ffff88801779ba80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000001 R09: fffff52000156f5d
R10: fffff52000156f5d R11: 1ffff92000156f5c R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000003
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2bea75b718 CR3: 000000001d0cc000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
btrfs_qgroup_rescan_worker+0x3bb/0x6a0 fs/btrfs/qgroup.c:3402
btrfs_work_helper+0x312/0x850 fs/btrfs/async-thread.c:280
process_one_work+0x877/0xdb0 kernel/workqueue.c:2289
worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
kthread+0x266/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Modules linked in:
So fix this by having the rescan worker function not attempt to start a
transaction if it didn't do any rescan work.
Reported-by: syzbot+96977faa68092ad382c4@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-btrfs/000000000000e5454b05f065a803@google.com/
Fixes: e804861bd4e6 ("btrfs: fix deadlock between quota disable and qgroup rescan worker")
CC: stable@vger.kernel.org # 5.4+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/qgroup.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -3348,6 +3348,7 @@ static void btrfs_qgroup_rescan_worker(s
int err = -ENOMEM;
int ret = 0;
bool stopped = false;
+ bool did_leaf_rescans = false;
path = btrfs_alloc_path();
if (!path)
@@ -3368,6 +3369,7 @@ static void btrfs_qgroup_rescan_worker(s
}
err = qgroup_rescan_leaf(trans, path);
+ did_leaf_rescans = true;
if (err > 0)
btrfs_commit_transaction(trans);
@@ -3388,16 +3390,23 @@ out:
mutex_unlock(&fs_info->qgroup_rescan_lock);
/*
- * only update status, since the previous part has already updated the
- * qgroup info.
+ * Only update status, since the previous part has already updated the
+ * qgroup info, and only if we did any actual work. This also prevents
+ * race with a concurrent quota disable, which has already set
+ * fs_info->quota_root to NULL and cleared BTRFS_FS_QUOTA_ENABLED at
+ * btrfs_quota_disable().
*/
- trans = btrfs_start_transaction(fs_info->quota_root, 1);
- if (IS_ERR(trans)) {
- err = PTR_ERR(trans);
+ if (did_leaf_rescans) {
+ trans = btrfs_start_transaction(fs_info->quota_root, 1);
+ if (IS_ERR(trans)) {
+ err = PTR_ERR(trans);
+ trans = NULL;
+ btrfs_err(fs_info,
+ "fail to start transaction for status update: %d",
+ err);
+ }
+ } else {
trans = NULL;
- btrfs_err(fs_info,
- "fail to start transaction for status update: %d",
- err);
}
mutex_lock(&fs_info->qgroup_rescan_lock);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 090/193] cifs: do not include page data when checking signature
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 089/193] btrfs: fix race between quota rescan and disable leading to NULL pointer deref Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 091/193] thunderbolt: Disable XDomain lane 1 only in software connection manager Greg Kroah-Hartman
` (111 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Enzo Matsumiya,
Paulo Alcantara (SUSE),
Steve French
From: Enzo Matsumiya <ematsumiya@suse.de>
commit 30b2b2196d6e4cc24cbec633535a2404f258ce69 upstream.
On async reads, page data is allocated before sending. When the
response is received but it has no data to fill (e.g.
STATUS_END_OF_FILE), __calc_signature() will still include the pages in
its computation, leading to an invalid signature check.
This patch fixes this by not setting the async read smb_rqst page data
(zeroed by default) if its got_bytes is 0.
This can be reproduced/verified with xfstests generic/465.
Cc: <stable@vger.kernel.org>
Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2pdu.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -4162,12 +4162,15 @@ smb2_readv_callback(struct mid_q_entry *
(struct smb2_hdr *)rdata->iov[0].iov_base;
struct cifs_credits credits = { .value = 0, .instance = 0 };
struct smb_rqst rqst = { .rq_iov = &rdata->iov[1],
- .rq_nvec = 1,
- .rq_pages = rdata->pages,
- .rq_offset = rdata->page_offset,
- .rq_npages = rdata->nr_pages,
- .rq_pagesz = rdata->pagesz,
- .rq_tailsz = rdata->tailsz };
+ .rq_nvec = 1, };
+
+ if (rdata->got_bytes) {
+ rqst.rq_pages = rdata->pages;
+ rqst.rq_offset = rdata->page_offset;
+ rqst.rq_npages = rdata->nr_pages;
+ rqst.rq_pagesz = rdata->pagesz;
+ rqst.rq_tailsz = rdata->tailsz;
+ }
WARN_ONCE(rdata->server != mid->server,
"rdata server %p != mid server %p",
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 091/193] thunderbolt: Disable XDomain lane 1 only in software connection manager
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 090/193] cifs: do not include page data when checking signature Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 092/193] thunderbolt: Use correct function to calculate maximum USB3 link rate Greg Kroah-Hartman
` (110 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yehezkel Bernat, Mika Westerberg
From: Mika Westerberg <mika.westerberg@linux.intel.com>
commit 84ee211c83212f4d35b56e0603acdcc41f860f1b upstream.
When firmware connection manager is in use we should not touch the lane
adapter (well or any) configuration space so do this only when we know
that the software connection manager is active.
Fixes: 8e1de7042596 ("thunderbolt: Add support for XDomain lane bonding")
Cc: stable@vger.kernel.org
Acked-by: Yehezkel Bernat <YehezkelShB@gmail.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/xdomain.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c
index cfa83486c9da..3c51e47dd86b 100644
--- a/drivers/thunderbolt/xdomain.c
+++ b/drivers/thunderbolt/xdomain.c
@@ -1419,12 +1419,19 @@ static int tb_xdomain_get_properties(struct tb_xdomain *xd)
* registered, we notify the userspace that it has changed.
*/
if (!update) {
- struct tb_port *port;
+ /*
+ * Now disable lane 1 if bonding was not enabled. Do
+ * this only if bonding was possible at the beginning
+ * (that is we are the connection manager and there are
+ * two lanes).
+ */
+ if (xd->bonding_possible) {
+ struct tb_port *port;
- /* Now disable lane 1 if bonding was not enabled */
- port = tb_port_at(xd->route, tb_xdomain_parent(xd));
- if (!port->bonded)
- tb_port_disable(port->dual_link_port);
+ port = tb_port_at(xd->route, tb_xdomain_parent(xd));
+ if (!port->bonded)
+ tb_port_disable(port->dual_link_port);
+ }
if (device_add(&xd->dev)) {
dev_err(&xd->dev, "failed to add XDomain device\n");
--
2.39.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 092/193] thunderbolt: Use correct function to calculate maximum USB3 link rate
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 091/193] thunderbolt: Disable XDomain lane 1 only in software connection manager Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 093/193] thunderbolt: Do not report errors if on-board retimers are found Greg Kroah-Hartman
` (109 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yehezkel Bernat, Mika Westerberg
From: Mika Westerberg <mika.westerberg@linux.intel.com>
commit e8ff07fb33026c5c1bb5b81293496faba5d68059 upstream.
We need to take minimum of both sides of the USB3 link into consideration,
not just the downstream port. Fix this by calling tb_usb3_max_link_rate()
instead.
Fixes: 0bd680cd900c ("thunderbolt: Add USB3 bandwidth management")
Cc: stable@vger.kernel.org
Acked-by: Yehezkel Bernat <YehezkelShB@gmail.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/tunnel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/thunderbolt/tunnel.c
+++ b/drivers/thunderbolt/tunnel.c
@@ -1275,7 +1275,7 @@ static void tb_usb3_reclaim_available_ba
return;
} else if (!ret) {
/* Use maximum link rate if the link valid is not set */
- ret = usb4_usb3_port_max_link_rate(tunnel->src_port);
+ ret = tb_usb3_max_link_rate(tunnel->dst_port, tunnel->src_port);
if (ret < 0) {
tb_tunnel_warn(tunnel, "failed to read maximum link rate\n");
return;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 093/193] thunderbolt: Do not report errors if on-board retimers are found
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 092/193] thunderbolt: Use correct function to calculate maximum USB3 link rate Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 094/193] thunderbolt: Do not call PM runtime functions in tb_retimer_scan() Greg Kroah-Hartman
` (108 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Utkarsh Patel, Mika Westerberg
From: Utkarsh Patel <utkarsh.h.patel@intel.com>
commit c28f3d80383571d3630df1a0e89500d23e855924 upstream.
Currently we return an error even if on-board retimers are found and
that's not expected. Fix this to return an error only if there was one
and 0 otherwise.
Fixes: 1e56c88adecc ("thunderbolt: Runtime resume USB4 port when retimers are scanned")
Cc: stable@vger.kernel.org
Signed-off-by: Utkarsh Patel <utkarsh.h.patel@intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/retimer.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/thunderbolt/retimer.c
+++ b/drivers/thunderbolt/retimer.c
@@ -471,10 +471,9 @@ int tb_retimer_scan(struct tb_port *port
break;
}
- if (!last_idx) {
- ret = 0;
+ ret = 0;
+ if (!last_idx)
goto out;
- }
/* Add on-board retimers if they do not exist already */
for (i = 1; i <= last_idx; i++) {
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 094/193] thunderbolt: Do not call PM runtime functions in tb_retimer_scan()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 093/193] thunderbolt: Do not report errors if on-board retimers are found Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 095/193] riscv: dts: sifive: fu740: fix size of pcie 32bit memory Greg Kroah-Hartman
` (107 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Utkarsh Patel, Yehezkel Bernat,
Mika Westerberg
From: Mika Westerberg <mika.westerberg@linux.intel.com>
commit 23257cfc1cb7202fd0065e9f4a6a0aac1c04c4a9 upstream.
We cannot call PM runtime functions in tb_retimer_scan() because it will
also be called when retimers are scanned from userspace (happens when
there is no device connected on ChromeOS for instance) and at the same
USB4 port runtime resume hook. This leads to hang because neither can
proceed.
Fix this by runtime resuming USB4 ports in tb_scan_port() instead. This
makes sure the ports are runtime PM active when retimers are added under
it while avoiding the reported hang as well.
Reported-by: Utkarsh Patel <utkarsh.h.patel@intel.com>
Fixes: 1e56c88adecc ("thunderbolt: Runtime resume USB4 port when retimers are scanned")
Cc: stable@vger.kernel.org
Acked-by: Yehezkel Bernat <YehezkelShB@gmail.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/retimer.c | 17 +++--------------
drivers/thunderbolt/tb.c | 20 +++++++++++++++-----
2 files changed, 18 insertions(+), 19 deletions(-)
--- a/drivers/thunderbolt/retimer.c
+++ b/drivers/thunderbolt/retimer.c
@@ -427,13 +427,6 @@ int tb_retimer_scan(struct tb_port *port
{
u32 status[TB_MAX_RETIMER_INDEX + 1] = {};
int ret, i, last_idx = 0;
- struct usb4_port *usb4;
-
- usb4 = port->usb4;
- if (!usb4)
- return 0;
-
- pm_runtime_get_sync(&usb4->dev);
/*
* Send broadcast RT to make sure retimer indices facing this
@@ -441,7 +434,7 @@ int tb_retimer_scan(struct tb_port *port
*/
ret = usb4_port_enumerate_retimers(port);
if (ret)
- goto out;
+ return ret;
/*
* Enable sideband channel for each retimer. We can do this
@@ -471,11 +464,11 @@ int tb_retimer_scan(struct tb_port *port
break;
}
- ret = 0;
if (!last_idx)
- goto out;
+ return 0;
/* Add on-board retimers if they do not exist already */
+ ret = 0;
for (i = 1; i <= last_idx; i++) {
struct tb_retimer *rt;
@@ -489,10 +482,6 @@ int tb_retimer_scan(struct tb_port *port
}
}
-out:
- pm_runtime_mark_last_busy(&usb4->dev);
- pm_runtime_put_autosuspend(&usb4->dev);
-
return ret;
}
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -628,11 +628,15 @@ static void tb_scan_port(struct tb_port
* Downstream switch is reachable through two ports.
* Only scan on the primary port (link_nr == 0).
*/
+
+ if (port->usb4)
+ pm_runtime_get_sync(&port->usb4->dev);
+
if (tb_wait_for_port(port, false) <= 0)
- return;
+ goto out_rpm_put;
if (port->remote) {
tb_port_dbg(port, "port already has a remote\n");
- return;
+ goto out_rpm_put;
}
tb_retimer_scan(port, true);
@@ -647,12 +651,12 @@ static void tb_scan_port(struct tb_port
*/
if (PTR_ERR(sw) == -EIO || PTR_ERR(sw) == -EADDRNOTAVAIL)
tb_scan_xdomain(port);
- return;
+ goto out_rpm_put;
}
if (tb_switch_configure(sw)) {
tb_switch_put(sw);
- return;
+ goto out_rpm_put;
}
/*
@@ -681,7 +685,7 @@ static void tb_scan_port(struct tb_port
if (tb_switch_add(sw)) {
tb_switch_put(sw);
- return;
+ goto out_rpm_put;
}
/* Link the switches using both links if available */
@@ -733,6 +737,12 @@ static void tb_scan_port(struct tb_port
tb_add_dp_resources(sw);
tb_scan_switch(sw);
+
+out_rpm_put:
+ if (port->usb4) {
+ pm_runtime_mark_last_busy(&port->usb4->dev);
+ pm_runtime_put_autosuspend(&port->usb4->dev);
+ }
}
static void tb_deactivate_and_free_tunnel(struct tb_tunnel *tunnel)
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 095/193] riscv: dts: sifive: fu740: fix size of pcie 32bit memory
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 094/193] thunderbolt: Do not call PM runtime functions in tb_retimer_scan() Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 096/193] bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD Greg Kroah-Hartman
` (106 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Walmsley, Greentime Hu,
Ben Dooks, Conor Dooley, Ron Economos
From: Ben Dooks <ben.dooks@codethink.co.uk>
commit 43d5f5d63699724d47f0d9e0eae516a260d232b4 upstream.
The 32-bit memory resource is needed for non-prefetchable memory
allocations on the PCIe bus, however with some cards (such as the
SM768) the system fails to allocate memory from this.
Checking the allocation against the datasheet, it looks like there
has been a mis-calcualation of the resource for the first memory
region (0x0060090000..0x0070ffffff) which in the data-sheet for
the fu740 (v1p2) is from 0x0060000000..0x007fffffff. Changing
this to allocate from 0x0060090000..0x007fffffff fixes the probing
issues.
Fixes: ae80d5148085 ("riscv: dts: Add PCIe support for the SiFive FU740-C000 SoC")
Cc: Paul Walmsley <paul.walmsley@sifive.com>
Cc: Greentime Hu <greentime.hu@sifive.com>
Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Cc: stable@vger.kernel.org
Tested-by: Ron Economos <re@w6rz.net> # from IRC
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/boot/dts/sifive/fu740-c000.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/riscv/boot/dts/sifive/fu740-c000.dtsi
+++ b/arch/riscv/boot/dts/sifive/fu740-c000.dtsi
@@ -328,7 +328,7 @@
bus-range = <0x0 0xff>;
ranges = <0x81000000 0x0 0x60080000 0x0 0x60080000 0x0 0x10000>, /* I/O */
<0x82000000 0x0 0x60090000 0x0 0x60090000 0x0 0xff70000>, /* mem */
- <0x82000000 0x0 0x70000000 0x0 0x70000000 0x0 0x1000000>, /* mem */
+ <0x82000000 0x0 0x70000000 0x0 0x70000000 0x0 0x10000000>, /* mem */
<0xc3000000 0x20 0x00000000 0x20 0x00000000 0x20 0x00000000>; /* mem prefetchable */
num-lanes = <0x8>;
interrupts = <56>, <57>, <58>, <59>, <60>, <61>, <62>, <63>, <64>;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 096/193] bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 095/193] riscv: dts: sifive: fu740: fix size of pcie 32bit memory Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 097/193] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Greg Kroah-Hartman
` (105 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Burn Alting, Jiri Olsa,
Stanislav Fomichev, Alexei Starovoitov, Paul Moore,
Alexei Starovoitov
From: Paul Moore <paul@paul-moore.com>
commit ef01f4e25c1760920e2c94f1c232350277ace69b upstream.
When changing the ebpf program put() routines to support being called
from within IRQ context the program ID was reset to zero prior to
calling the perf event and audit UNLOAD record generators, which
resulted in problems as the ebpf program ID was bogus (always zero).
This patch addresses this problem by removing an unnecessary call to
bpf_prog_free_id() in __bpf_prog_offload_destroy() and adjusting
__bpf_prog_put() to only call bpf_prog_free_id() after audit and perf
have finished their bpf program unload tasks in
bpf_prog_put_deferred(). For the record, no one can determine, or
remember, why it was necessary to free the program ID, and remove it
from the IDR, prior to executing bpf_prog_put_deferred();
regardless, both Stanislav and Alexei agree that the approach in this
patch should be safe.
It is worth noting that when moving the bpf_prog_free_id() call, the
do_idr_lock parameter was forced to true as the ebpf devs determined
this was the correct as the do_idr_lock should always be true. The
do_idr_lock parameter will be removed in a follow-up patch, but it
was kept here to keep the patch small in an effort to ease any stable
backports.
I also modified the bpf_audit_prog() logic used to associate the
AUDIT_BPF record with other associated records, e.g. @ctx != NULL.
Instead of keying off the operation, it now keys off the execution
context, e.g. '!in_irg && !irqs_disabled()', which is much more
appropriate and should help better connect the UNLOAD operations with
the associated audit state (other audit records).
Cc: stable@vger.kernel.org
Fixes: d809e134be7a ("bpf: Prepare bpf_prog_put() to be called from irq context.")
Reported-by: Burn Alting <burn.alting@iinet.net.au>
Reported-by: Jiri Olsa <olsajiri@gmail.com>
Suggested-by: Stanislav Fomichev <sdf@google.com>
Suggested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Acked-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/r/20230106154400.74211-1-paul@paul-moore.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/offload.c | 3 ---
kernel/bpf/syscall.c | 6 ++----
2 files changed, 2 insertions(+), 7 deletions(-)
--- a/kernel/bpf/offload.c
+++ b/kernel/bpf/offload.c
@@ -216,9 +216,6 @@ static void __bpf_prog_offload_destroy(s
if (offload->dev_state)
offload->offdev->ops->destroy(prog);
- /* Make sure BPF_PROG_GET_NEXT_ID can't find this dead program */
- bpf_prog_free_id(prog, true);
-
list_del_init(&offload->offloads);
kfree(offload);
prog->aux->offload = NULL;
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1958,7 +1958,7 @@ static void bpf_audit_prog(const struct
return;
if (audit_enabled == AUDIT_OFF)
return;
- if (op == BPF_AUDIT_LOAD)
+ if (!in_irq() && !irqs_disabled())
ctx = audit_context();
ab = audit_log_start(ctx, GFP_ATOMIC, AUDIT_BPF);
if (unlikely(!ab))
@@ -2053,6 +2053,7 @@ static void bpf_prog_put_deferred(struct
prog = aux->prog;
perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_UNLOAD, 0);
bpf_audit_prog(prog, BPF_AUDIT_UNLOAD);
+ bpf_prog_free_id(prog, true);
__bpf_prog_put_noref(prog, true);
}
@@ -2061,9 +2062,6 @@ static void __bpf_prog_put(struct bpf_pr
struct bpf_prog_aux *aux = prog->aux;
if (atomic64_dec_and_test(&aux->refcnt)) {
- /* bpf_prog_free_id() must be called first */
- bpf_prog_free_id(prog, do_idr_lock);
-
if (in_irq() || irqs_disabled()) {
INIT_WORK(&aux->work, bpf_prog_put_deferred);
schedule_work(&aux->work);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 097/193] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 096/193] bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 098/193] tty: fix possible null-ptr-defer in spk_ttyio_release Greg Kroah-Hartman
` (104 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Jiri Slaby
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit b8caf69a6946e18ffebad49847e258f5b6d52ac2 upstream.
Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on
default RX FIFO depth, e.g. 16. Later during serial startup the
qcom_geni_serial_port_setup() updates the RX FIFO depth
(port->rx_fifo_depth) to match real device capabilities, e.g. to 32.
The RX UART handle code will read "port->rx_fifo_depth" number of words
into "port->rx_fifo" buffer, thus exceeding the bounds. This can be
observed in certain configurations with Qualcomm Bluetooth HCI UART
device and KASAN:
Bluetooth: hci0: QCA Product ID :0x00000010
Bluetooth: hci0: QCA SOC Version :0x400a0200
Bluetooth: hci0: QCA ROM Version :0x00000200
Bluetooth: hci0: QCA Patch Version:0x00000d2b
Bluetooth: hci0: QCA controller version 0x02000200
Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv
bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2
Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2)
Bluetooth: hci0: QCA Failed to download patch (-2)
==================================================================
BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c
Write of size 4 at addr ffff279347d578c0 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26
Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
Call trace:
dump_backtrace.part.0+0xe0/0xf0
show_stack+0x18/0x40
dump_stack_lvl+0x8c/0xb8
print_report+0x188/0x488
kasan_report+0xb4/0x100
__asan_store4+0x80/0xa4
handle_rx_uart+0xa8/0x18c
qcom_geni_serial_handle_rx+0x84/0x9c
qcom_geni_serial_isr+0x24c/0x760
__handle_irq_event_percpu+0x108/0x500
handle_irq_event+0x6c/0x110
handle_fasteoi_irq+0x138/0x2cc
generic_handle_domain_irq+0x48/0x64
If the RX FIFO depth changes after probe, be sure to resize the buffer.
Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Link: https://lore.kernel.org/r/20221221164022.1087814-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/qcom_geni_serial.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -864,9 +864,10 @@ out_unlock:
return IRQ_HANDLED;
}
-static void get_tx_fifo_size(struct qcom_geni_serial_port *port)
+static int setup_fifos(struct qcom_geni_serial_port *port)
{
struct uart_port *uport;
+ u32 old_rx_fifo_depth = port->rx_fifo_depth;
uport = &port->uport;
port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se);
@@ -874,6 +875,16 @@ static void get_tx_fifo_size(struct qcom
port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se);
uport->fifosize =
(port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE;
+
+ if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) {
+ port->rx_fifo = devm_krealloc(uport->dev, port->rx_fifo,
+ port->rx_fifo_depth * sizeof(u32),
+ GFP_KERNEL);
+ if (!port->rx_fifo)
+ return -ENOMEM;
+ }
+
+ return 0;
}
@@ -888,6 +899,7 @@ static int qcom_geni_serial_port_setup(s
u32 rxstale = DEFAULT_BITS_PER_CHAR * STALE_TIMEOUT;
u32 proto;
u32 pin_swap;
+ int ret;
proto = geni_se_read_proto(&port->se);
if (proto != GENI_SE_UART) {
@@ -897,7 +909,9 @@ static int qcom_geni_serial_port_setup(s
qcom_geni_serial_stop_rx(uport);
- get_tx_fifo_size(port);
+ ret = setup_fifos(port);
+ if (ret)
+ return ret;
writel(rxstale, uport->membase + SE_UART_RX_STALE_CNT);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 098/193] tty: fix possible null-ptr-defer in spk_ttyio_release
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 097/193] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 099/193] pktcdvd: check for NULL returna fter calling bio_split_to_limits() Greg Kroah-Hartman
` (103 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Gaosheng Cui, Samuel Thibault
From: Gaosheng Cui <cuigaosheng1@huawei.com>
commit 5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5 upstream.
Run the following tests on the qemu platform:
syzkaller:~# modprobe speakup_audptr
input: Speakup as /devices/virtual/input/input4
initialized device: /dev/synth, node (MAJOR 10, MINOR 125)
speakup 3.1.6: initialized
synth name on entry is: (null)
synth probe
spk_ttyio_initialise_ldisc failed because tty_kopen_exclusive returned
failed (errno -16), then remove the module, we will get a null-ptr-defer
problem, as follow:
syzkaller:~# modprobe -r speakup_audptr
releasing synth audptr
BUG: kernel NULL pointer dereference, address: 0000000000000080
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP PTI
CPU: 2 PID: 204 Comm: modprobe Not tainted 6.1.0-rc6-dirty #1
RIP: 0010:mutex_lock+0x14/0x30
Call Trace:
<TASK>
spk_ttyio_release+0x19/0x70 [speakup]
synth_release.part.6+0xac/0xc0 [speakup]
synth_remove+0x56/0x60 [speakup]
__x64_sys_delete_module+0x156/0x250
? fpregs_assert_state_consistent+0x1d/0x50
do_syscall_64+0x37/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
</TASK>
Modules linked in: speakup_audptr(-) speakup
Dumping ftrace buffer:
in_synth->dev was not initialized during modprobe, so we add check
for in_synth->dev to fix this bug.
Fixes: 4f2a81f3a882 ("speakup: Reference synth from tty and tty from synth")
Cc: stable <stable@kernel.org>
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Link: https://lore.kernel.org/r/20221202060633.217364-1-cuigaosheng1@huawei.com
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/accessibility/speakup/spk_ttyio.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/accessibility/speakup/spk_ttyio.c
+++ b/drivers/accessibility/speakup/spk_ttyio.c
@@ -354,6 +354,9 @@ void spk_ttyio_release(struct spk_synth
{
struct tty_struct *tty = in_synth->dev;
+ if (tty == NULL)
+ return;
+
tty_lock(tty);
if (tty->ops->close)
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 099/193] pktcdvd: check for NULL returna fter calling bio_split_to_limits()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 098/193] tty: fix possible null-ptr-defer in spk_ttyio_release Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 100/193] io_uring/poll: dont reissue in case of poll race on multishot request Greg Kroah-Hartman
` (102 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe
From: Jens Axboe <axboe@kernel.dk>
commit 3e9900f3bd7ba30d60f82b162b70a1dffe4e8e24 upstream.
The revert of the removal of this driver happened after we fixed up
the split limits for NOWAIT issue, hence it got missed. Ensure that
we check for a NULL bio after splitting, in case it should be retried.
Marking this as fixing both commits, so that stable backport will do
this correctly.
Cc: stable@vger.kernel.org
Fixes: 9cea62b2cbab ("block: don't allow splitting of a REQ_NOWAIT bio")
Fixes: 4b83e99ee709 ("Revert "pktcdvd: remove driver."")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/pktcdvd.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -2400,6 +2400,8 @@ static void pkt_submit_bio(struct bio *b
struct bio *split;
bio = bio_split_to_limits(bio);
+ if (!bio)
+ return;
pkt_dbg(2, pd, "start = %6llx stop = %6llx\n",
(unsigned long long)bio->bi_iter.bi_sector,
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 100/193] io_uring/poll: dont reissue in case of poll race on multishot request
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 099/193] pktcdvd: check for NULL returna fter calling bio_split_to_limits() Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 101/193] mptcp: explicitly specify sock family at subflow creation time Greg Kroah-Hartman
` (101 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe, Olivier Langlois
From: Jens Axboe <axboe@kernel.dk>
commit 8caa03f10bf92cb8657408a6ece6a8a73f96ce13 upstream.
A previous commit fixed a poll race that can occur, but it's only
applicable for multishot requests. For a multishot request, we can safely
ignore a spurious wakeup, as we never leave the waitqueue to begin with.
A blunt reissue of a multishot armed request can cause us to leak a
buffer, if they are ring provided. While this seems like a bug in itself,
it's not really defined behavior to reissue a multishot request directly.
It's less efficient to do so as well, and not required to rearm anything
like it is for singleshot poll requests.
Cc: stable@vger.kernel.org
Fixes: 6e5aedb9324a ("io_uring/poll: attempt request issue after racy poll wakeup")
Reported-and-tested-by: Olivier Langlois <olivier@trillion01.com>
Link: https://github.com/axboe/liburing/issues/778
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/poll.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -281,8 +281,12 @@ static int io_poll_check_events(struct i
* to the waitqueue, so if we get nothing back, we
* should be safe and attempt a reissue.
*/
- if (unlikely(!req->cqe.res))
+ if (unlikely(!req->cqe.res)) {
+ /* Multishot armed need not reissue */
+ if (!(req->apoll_events & EPOLLONESHOT))
+ continue;
return IOU_POLL_REISSUE;
+ }
}
if (req->apoll_events & EPOLLONESHOT)
return IOU_POLL_DONE;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 101/193] mptcp: explicitly specify sock family at subflow creation time
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 100/193] io_uring/poll: dont reissue in case of poll race on multishot request Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 102/193] mptcp: netlink: respect v4/v6-only sockets Greg Kroah-Hartman
` (100 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthieu Baerts, Paolo Abeni,
Mat Martineau, Jakub Kicinski
From: Paolo Abeni <pabeni@redhat.com>
commit 6bc1fe7dd748ba5e76e7917d110837cafe7b931c upstream.
Let the caller specify the to-be-created subflow family.
For a given MPTCP socket created with the AF_INET6 family, the current
userspace PM can already ask the kernel to create subflows in v4 and v6.
If "plain" IPv4 addresses are passed to the kernel, they are
automatically mapped in v6 addresses "by accident". This can be
problematic because the userspace will need to pass different addresses,
now the v4-mapped-v6 addresses to destroy this new subflow.
On the other hand, if the MPTCP socket has been created with the AF_INET
family, the command to create a subflow in v6 will be accepted but the
result will not be the one as expected as new subflow will be created in
IPv4 using part of the v6 addresses passed to the kernel: not creating
the expected subflow then.
No functional change intended for the in-kernel PM where an explicit
enforcement is currently in place. This arbitrary enforcement will be
leveraged by other patches in a future version.
Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Co-developed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 2 +-
net/mptcp/protocol.h | 3 ++-
net/mptcp/subflow.c | 9 +++++----
3 files changed, 8 insertions(+), 6 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -107,7 +107,7 @@ static int __mptcp_socket_create(struct
struct socket *ssock;
int err;
- err = mptcp_subflow_create_socket(sk, &ssock);
+ err = mptcp_subflow_create_socket(sk, sk->sk_family, &ssock);
if (err)
return err;
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -626,7 +626,8 @@ bool mptcp_addresses_equal(const struct
/* called with sk socket lock held */
int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc,
const struct mptcp_addr_info *remote);
-int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock);
+int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
+ struct socket **new_sock);
void mptcp_info2sockaddr(const struct mptcp_addr_info *info,
struct sockaddr_storage *addr,
unsigned short family);
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -1492,7 +1492,7 @@ int __mptcp_subflow_connect(struct sock
if (!mptcp_is_fully_established(sk))
goto err_out;
- err = mptcp_subflow_create_socket(sk, &sf);
+ err = mptcp_subflow_create_socket(sk, loc->family, &sf);
if (err)
goto err_out;
@@ -1604,7 +1604,9 @@ static void mptcp_subflow_ops_undo_overr
#endif
ssk->sk_prot = &tcp_prot;
}
-int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock)
+
+int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
+ struct socket **new_sock)
{
struct mptcp_subflow_context *subflow;
struct net *net = sock_net(sk);
@@ -1617,8 +1619,7 @@ int mptcp_subflow_create_socket(struct s
if (unlikely(!sk->sk_socket))
return -EINVAL;
- err = sock_create_kern(net, sk->sk_family, SOCK_STREAM, IPPROTO_TCP,
- &sf);
+ err = sock_create_kern(net, family, SOCK_STREAM, IPPROTO_TCP, &sf);
if (err)
return err;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 102/193] mptcp: netlink: respect v4/v6-only sockets
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 101/193] mptcp: explicitly specify sock family at subflow creation time Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 103/193] selftests: mptcp: userspace: validate v4-v6 subflows mix Greg Kroah-Hartman
` (99 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mat Martineau, Matthieu Baerts,
Jakub Kicinski
From: Matthieu Baerts <matthieu.baerts@tessares.net>
commit fb00ee4f3343acb2b9222ca9b73b47dd1e1a8efc upstream.
If an MPTCP socket has been created with AF_INET6 and the IPV6_V6ONLY
option has been set, the userspace PM would allow creating subflows
using IPv4 addresses, e.g. mapped in v6.
The kernel side of userspace PM will also accept creating subflows with
local and remote addresses having different families. Depending on the
subflow socket's family, different behaviours are expected:
- If AF_INET is forced with a v6 address, the kernel will take the last
byte of the IP and try to connect to that: a new subflow is created
but to a non expected address.
- If AF_INET6 is forced with a v4 address, the kernel will try to
connect to a v4 address (v4-mapped-v6). A -EBADF error from the
connect() part is then expected.
It is then required to check the given families can be accepted. This is
done by using a new helper for addresses family matching, taking care of
IPv4 vs IPv4-mapped-IPv6 addresses. This helper will be re-used later by
the in-kernel path-manager to use mixed IPv4 and IPv6 addresses.
While at it, a clear error message is now reported if there are some
conflicts with the families that have been passed by the userspace.
Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/pm.c | 25 +++++++++++++++++++++++++
net/mptcp/pm_userspace.c | 7 +++++++
net/mptcp/protocol.h | 3 +++
3 files changed, 35 insertions(+)
--- a/net/mptcp/pm.c
+++ b/net/mptcp/pm.c
@@ -420,6 +420,31 @@ void mptcp_pm_subflow_chk_stale(const st
}
}
+/* if sk is ipv4 or ipv6_only allows only same-family local and remote addresses,
+ * otherwise allow any matching local/remote pair
+ */
+bool mptcp_pm_addr_families_match(const struct sock *sk,
+ const struct mptcp_addr_info *loc,
+ const struct mptcp_addr_info *rem)
+{
+ bool mptcp_is_v4 = sk->sk_family == AF_INET;
+
+#if IS_ENABLED(CONFIG_MPTCP_IPV6)
+ bool loc_is_v4 = loc->family == AF_INET || ipv6_addr_v4mapped(&loc->addr6);
+ bool rem_is_v4 = rem->family == AF_INET || ipv6_addr_v4mapped(&rem->addr6);
+
+ if (mptcp_is_v4)
+ return loc_is_v4 && rem_is_v4;
+
+ if (ipv6_only_sock(sk))
+ return !loc_is_v4 && !rem_is_v4;
+
+ return loc_is_v4 == rem_is_v4;
+#else
+ return mptcp_is_v4 && loc->family == AF_INET && rem->family == AF_INET;
+#endif
+}
+
void mptcp_pm_data_reset(struct mptcp_sock *msk)
{
u8 pm_type = mptcp_get_pm_type(sock_net((struct sock *)msk));
--- a/net/mptcp/pm_userspace.c
+++ b/net/mptcp/pm_userspace.c
@@ -294,6 +294,13 @@ int mptcp_nl_cmd_sf_create(struct sk_buf
}
sk = &msk->sk.icsk_inet.sk;
+
+ if (!mptcp_pm_addr_families_match(sk, &addr_l, &addr_r)) {
+ GENL_SET_ERR_MSG(info, "families mismatch");
+ err = -EINVAL;
+ goto create_err;
+ }
+
lock_sock(sk);
err = __mptcp_subflow_connect(sk, &addr_l, &addr_r);
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -762,6 +762,9 @@ int mptcp_pm_parse_addr(struct nlattr *a
int mptcp_pm_parse_entry(struct nlattr *attr, struct genl_info *info,
bool require_family,
struct mptcp_pm_addr_entry *entry);
+bool mptcp_pm_addr_families_match(const struct sock *sk,
+ const struct mptcp_addr_info *loc,
+ const struct mptcp_addr_info *rem);
void mptcp_pm_subflow_chk_stale(const struct mptcp_sock *msk, struct sock *ssk);
void mptcp_pm_nl_subflow_chk_stale(const struct mptcp_sock *msk, struct sock *ssk);
void mptcp_pm_new_connection(struct mptcp_sock *msk, const struct sock *ssk, int server_side);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 103/193] selftests: mptcp: userspace: validate v4-v6 subflows mix
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 102/193] mptcp: netlink: respect v4/v6-only sockets Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 104/193] USB: gadgetfs: Fix race between mounting and unmounting Greg Kroah-Hartman
` (98 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mat Martineau, Matthieu Baerts,
Jakub Kicinski
From: Matthieu Baerts <matthieu.baerts@tessares.net>
commit 4656d72c1efa495a58ad6d8b073a60907073e4e6 upstream.
MPTCP protocol supports having subflows in both IPv4 and IPv6. In Linux,
it is possible to have that if the MPTCP socket has been created with
AF_INET6 family without the IPV6_V6ONLY option.
Here, a new IPv4 subflow is being added to the initial IPv6 connection,
then being removed using Netlink commands.
Cc: stable@vger.kernel.org # v5.19+
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/userspace_pm.sh | 47 ++++++++++++++++++++++
1 file changed, 47 insertions(+)
--- a/tools/testing/selftests/net/mptcp/userspace_pm.sh
+++ b/tools/testing/selftests/net/mptcp/userspace_pm.sh
@@ -776,6 +776,52 @@ test_subflows()
rm -f "$evts"
}
+test_subflows_v4_v6_mix()
+{
+ # Attempt to add a listener at 10.0.2.1:<subflow-port>
+ ip netns exec "$ns1" ./pm_nl_ctl listen 10.0.2.1\
+ $app6_port > /dev/null 2>&1 &
+ local listener_pid=$!
+
+ # ADD_ADDR4 from server to client machine reusing the subflow port on
+ # the established v6 connection
+ :>"$client_evts"
+ ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server6_token" id\
+ $server_addr_id dev ns1eth2 > /dev/null 2>&1
+ stdbuf -o0 -e0 printf "ADD_ADDR4 id:%d 10.0.2.1 (ns1) => ns2, reuse port\t\t" $server_addr_id
+ sleep 0.5
+ verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "10.0.2.1"\
+ "$server_addr_id" "$app6_port"
+
+ # CREATE_SUBFLOW from client to server machine
+ :>"$client_evts"
+ ip netns exec "$ns2" ./pm_nl_ctl csf lip 10.0.2.2 lid 23 rip 10.0.2.1 rport\
+ $app6_port token "$client6_token" > /dev/null 2>&1
+ sleep 0.5
+ verify_subflow_events "$client_evts" "$SUB_ESTABLISHED" "$client6_token"\
+ "$AF_INET" "10.0.2.2" "10.0.2.1" "$app6_port" "23"\
+ "$server_addr_id" "ns2" "ns1"
+
+ # Delete the listener from the server ns, if one was created
+ kill_wait $listener_pid
+
+ sport=$(sed --unbuffered -n 's/.*\(sport:\)\([[:digit:]]*\).*$/\2/p;q' "$client_evts")
+
+ # DESTROY_SUBFLOW from client to server machine
+ :>"$client_evts"
+ ip netns exec "$ns2" ./pm_nl_ctl dsf lip 10.0.2.2 lport "$sport" rip 10.0.2.1 rport\
+ $app6_port token "$client6_token" > /dev/null 2>&1
+ sleep 0.5
+ verify_subflow_events "$client_evts" "$SUB_CLOSED" "$client6_token" \
+ "$AF_INET" "10.0.2.2" "10.0.2.1" "$app6_port" "23"\
+ "$server_addr_id" "ns2" "ns1"
+
+ # RM_ADDR from server to client machine
+ ip netns exec "$ns1" ./pm_nl_ctl rem id $server_addr_id token\
+ "$server6_token" > /dev/null 2>&1
+ sleep 0.5
+}
+
test_prio()
{
local count
@@ -812,6 +858,7 @@ make_connection "v6"
test_announce
test_remove
test_subflows
+test_subflows_v4_v6_mix
test_prio
exit 0
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 104/193] USB: gadgetfs: Fix race between mounting and unmounting
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 103/193] selftests: mptcp: userspace: validate v4-v6 subflows mix Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 105/193] USB: serial: cp210x: add SCALANCE LPE-9000 device id Greg Kroah-Hartman
` (97 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern,
syzbot+33d7ad66d65044b93f16, Gerald Lee
From: Alan Stern <stern@rowland.harvard.edu>
commit d18dcfe9860e842f394e37ba01ca9440ab2178f4 upstream.
The syzbot fuzzer and Gerald Lee have identified a use-after-free bug
in the gadgetfs driver, involving processes concurrently mounting and
unmounting the gadgetfs filesystem. In particular, gadgetfs_fill_super()
can race with gadgetfs_kill_sb(), causing the latter to deallocate
the_device while the former is using it. The output from KASAN says,
in part:
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline]
BUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]
BUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline]
BUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline]
BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline]
BUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline]
BUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086
Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689
CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
...
atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]
__refcount_sub_and_test include/linux/refcount.h:272 [inline]
__refcount_dec_and_test include/linux/refcount.h:315 [inline]
refcount_dec_and_test include/linux/refcount.h:333 [inline]
put_dev drivers/usb/gadget/legacy/inode.c:159 [inline]
gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086
deactivate_locked_super+0xa7/0xf0 fs/super.c:332
vfs_get_super fs/super.c:1190 [inline]
get_tree_single+0xd0/0x160 fs/super.c:1207
vfs_get_tree+0x88/0x270 fs/super.c:1531
vfs_fsconfig_locked fs/fsopen.c:232 [inline]
The simplest solution is to ensure that gadgetfs_fill_super() and
gadgetfs_kill_sb() are serialized by making them both acquire a new
mutex.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+33d7ad66d65044b93f16@syzkaller.appspotmail.com
Reported-and-tested-by: Gerald Lee <sundaywind2004@gmail.com>
Link: https://lore.kernel.org/linux-usb/CAO3qeMVzXDP-JU6v1u5Ags6Q-bb35kg3=C6d04DjzA9ffa5x1g@mail.gmail.com/
Fixes: e5d82a7360d1 ("vfs: Convert gadgetfs to use the new mount API")
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/Y6XCPXBpn3tmjdCC@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/legacy/inode.c | 28 +++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -229,6 +229,7 @@ static void put_ep (struct ep_data *data
*/
static const char *CHIP;
+static DEFINE_MUTEX(sb_mutex); /* Serialize superblock operations */
/*----------------------------------------------------------------------*/
@@ -2010,13 +2011,20 @@ gadgetfs_fill_super (struct super_block
{
struct inode *inode;
struct dev_data *dev;
+ int rc;
- if (the_device)
- return -ESRCH;
+ mutex_lock(&sb_mutex);
+
+ if (the_device) {
+ rc = -ESRCH;
+ goto Done;
+ }
CHIP = usb_get_gadget_udc_name();
- if (!CHIP)
- return -ENODEV;
+ if (!CHIP) {
+ rc = -ENODEV;
+ goto Done;
+ }
/* superblock */
sb->s_blocksize = PAGE_SIZE;
@@ -2053,13 +2061,17 @@ gadgetfs_fill_super (struct super_block
* from binding to a controller.
*/
the_device = dev;
- return 0;
+ rc = 0;
+ goto Done;
-Enomem:
+ Enomem:
kfree(CHIP);
CHIP = NULL;
+ rc = -ENOMEM;
- return -ENOMEM;
+ Done:
+ mutex_unlock(&sb_mutex);
+ return rc;
}
/* "mount -t gadgetfs path /dev/gadget" ends up here */
@@ -2081,6 +2093,7 @@ static int gadgetfs_init_fs_context(stru
static void
gadgetfs_kill_sb (struct super_block *sb)
{
+ mutex_lock(&sb_mutex);
kill_litter_super (sb);
if (the_device) {
put_dev (the_device);
@@ -2088,6 +2101,7 @@ gadgetfs_kill_sb (struct super_block *sb
}
kfree(CHIP);
CHIP = NULL;
+ mutex_unlock(&sb_mutex);
}
/*----------------------------------------------------------------------*/
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 105/193] USB: serial: cp210x: add SCALANCE LPE-9000 device id
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 104/193] USB: gadgetfs: Fix race between mounting and unmounting Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 106/193] usb: cdns3: remove fetched trb from cache before dequeuing Greg Kroah-Hartman
` (96 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Adler, Johan Hovold
From: Michael Adler <michael.adler@siemens.com>
commit 3f9e76e31704a325170e5aec2243c8d084d74854 upstream.
Add the USB serial console device ID for Siemens SCALANCE LPE-9000
which have a USB port for their serial console.
Signed-off-by: Michael Adler <michael.adler@siemens.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/cp210x.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -60,6 +60,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
{ USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
{ USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
+ { USB_DEVICE(0x0908, 0x0070) }, /* Siemens SCALANCE LPE-9000 USB Serial Console */
{ USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
{ USB_DEVICE(0x0988, 0x0578) }, /* Teraoka AD2000 */
{ USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 106/193] usb: cdns3: remove fetched trb from cache before dequeuing
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 105/193] USB: serial: cp210x: add SCALANCE LPE-9000 device id Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 107/193] usb: host: ehci-fsl: Fix module alias Greg Kroah-Hartman
` (95 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pawel Laszczak, Peter Chen
From: Pawel Laszczak <pawell@cadence.com>
commit 1301c7b9f7efad2f11ef924e317c18ebd714fc9a upstream.
After doorbell DMA fetches the TRB. If during dequeuing request
driver changes NORMAL TRB to LINK TRB but doesn't delete it from
controller cache then controller will handle cached TRB and packet
can be lost.
The example scenario for this issue looks like:
1. queue request - set doorbell
2. dequeue request
3. send OUT data packet from host
4. Device will accept this packet which is unexpected
5. queue new request - set doorbell
6. Device lost the expected packet.
By setting DFLUSH controller clears DRDY bit and stop DMA transfer.
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
cc: <stable@vger.kernel.org>
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20221115100039.441295-1-pawell@cadence.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/cdns3-gadget.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2614,6 +2614,7 @@ int cdns3_gadget_ep_dequeue(struct usb_e
u8 req_on_hw_ring = 0;
unsigned long flags;
int ret = 0;
+ int val;
if (!ep || !request || !ep->desc)
return -EINVAL;
@@ -2649,6 +2650,13 @@ found:
/* Update ring only if removed request is on pending_req_list list */
if (req_on_hw_ring && link_trb) {
+ /* Stop DMA */
+ writel(EP_CMD_DFLUSH, &priv_dev->regs->ep_cmd);
+
+ /* wait for DFLUSH cleared */
+ readl_poll_timeout_atomic(&priv_dev->regs->ep_cmd, val,
+ !(val & EP_CMD_DFLUSH), 1, 1000);
+
link_trb->buffer = cpu_to_le32(TRB_BUFFER(priv_ep->trb_pool_dma +
((priv_req->end_trb + 1) * TRB_SIZE)));
link_trb->control = cpu_to_le32((le32_to_cpu(link_trb->control) & TRB_CYCLE) |
@@ -2660,6 +2668,10 @@ found:
cdns3_gadget_giveback(priv_ep, priv_req, -ECONNRESET);
+ req = cdns3_next_request(&priv_ep->pending_req_list);
+ if (req)
+ cdns3_rearm_transfer(priv_ep, 1);
+
not_found:
spin_unlock_irqrestore(&priv_dev->lock, flags);
return ret;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 107/193] usb: host: ehci-fsl: Fix module alias
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 106/193] usb: cdns3: remove fetched trb from cache before dequeuing Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 108/193] usb: musb: fix error return code in omap2430_probe() Greg Kroah-Hartman
` (94 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Alexander Stein
From: Alexander Stein <alexander.stein@ew.tq-group.com>
commit 5d3d01ae15d2f37ed0325c99ab47ef0ae5d05f3c upstream.
Commit ca07e1c1e4a6 ("drivers:usb:fsl:Make fsl ehci drv an independent
driver module") changed DRV_NAME which was used for MODULE_ALIAS as well.
Starting from this the module alias didn't match the platform device
name created in fsl-mph-dr-of.c
Change DRV_NAME to match the driver name for host mode in fsl-mph-dr-of.
This is needed for module autoloading on ls1021a.
Fixes: ca07e1c1e4a6 ("drivers:usb:fsl:Make fsl ehci drv an independent driver module")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Link: https://lore.kernel.org/r/20230120122714.3848784-1-alexander.stein@ew.tq-group.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ehci-fsl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -29,7 +29,7 @@
#include "ehci-fsl.h"
#define DRIVER_DESC "Freescale EHCI Host controller driver"
-#define DRV_NAME "ehci-fsl"
+#define DRV_NAME "fsl-ehci"
static struct hc_driver __read_mostly fsl_ehci_hc_driver;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 108/193] usb: musb: fix error return code in omap2430_probe()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 107/193] usb: host: ehci-fsl: Fix module alias Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 109/193] usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail Greg Kroah-Hartman
` (93 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Yang Yingliang
From: Yang Yingliang <yangyingliang@huawei.com>
commit bd449ad8cee9d4b523abbdfa73e1a2a08333f331 upstream.
Before calling platform_get_resource() in omap2430_probe(), the 'ret' is
re-assgined to 0, it can't return an error code, if platform_get_resource
fails. Set the error code to -EINVAL to fix this.
Fixes: ffbe2feac59b ("usb: musb: omap2430: Fix probe regression for missing resources")
Cc: stable <stable@kernel.org>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221230081730.1655616-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/musb/omap2430.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 476f55d1fec3..44a21ec865fb 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -411,8 +411,10 @@ static int omap2430_probe(struct platform_device *pdev)
memset(musb_res, 0, sizeof(*musb_res) * ARRAY_SIZE(musb_res));
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- if (!res)
+ if (!res) {
+ ret = -EINVAL;
goto err2;
+ }
musb_res[i].start = res->start;
musb_res[i].end = res->end;
--
2.39.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 109/193] usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 108/193] usb: musb: fix error return code in omap2430_probe() Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:03 ` [PATCH 6.1 110/193] usb: typec: altmodes/displayport: Add pin assignment helper Greg Kroah-Hartman
` (92 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Macpaul Lin, TommyYl Chen,
ChiYuan Huang, Heikki Krogerus
From: ChiYuan Huang <cy_huang@richtek.com>
commit 36f78477ac2c89e9a2eed4a31404a291a3450b5d upstream.
There's the altmode re-registeration issue after data role
swap (DR_SWAP).
Comparing to USBPD 2.0, in USBPD 3.0, it loose the limit that only DFP
can initiate the VDM command to get partner identity information.
For a USBPD 3.0 UFP device, it may already get the identity information
from its port partner before DR_SWAP. If DR_SWAP send or receive at the
mean time, 'send_discover' flag will be raised again. It causes discover
identify action restart while entering ready state. And after all
discover actions are done, the 'tcpm_register_altmodes' will be called.
If old altmode is not unregistered, this sysfs create fail can be found.
In 'DR_SWAP_CHANGE_DR' state case, only DFP will unregister altmodes.
For UFP, the original altmodes keep registered.
This patch fix the logic that after DR_SWAP, 'tcpm_unregister_altmodes'
must be called whatever the current data role is.
Reviewed-by: Macpaul Lin <macpaul.lin@mediatek.com>
Fixes: ae8a2ca8a221 ("usb: typec: Group all TCPCI/TCPM code together")
Reported-by: TommyYl Chen <tommyyl.chen@mediatek.com>
Cc: stable@vger.kernel.org
Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/1673248790-15794-1-git-send-email-cy_huang@richtek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/tcpm/tcpm.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -4594,14 +4594,13 @@ static void run_state_machine(struct tcp
tcpm_set_state(port, ready_state(port), 0);
break;
case DR_SWAP_CHANGE_DR:
- if (port->data_role == TYPEC_HOST) {
- tcpm_unregister_altmodes(port);
+ tcpm_unregister_altmodes(port);
+ if (port->data_role == TYPEC_HOST)
tcpm_set_roles(port, true, port->pwr_role,
TYPEC_DEVICE);
- } else {
+ else
tcpm_set_roles(port, true, port->pwr_role,
TYPEC_HOST);
- }
tcpm_ams_finish(port);
tcpm_set_state(port, ready_state(port), 0);
break;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 110/193] usb: typec: altmodes/displayport: Add pin assignment helper
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 109/193] usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail Greg Kroah-Hartman
@ 2023-01-22 15:03 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 111/193] usb: typec: altmodes/displayport: Fix pin assignment calculation Greg Kroah-Hartman
` (91 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heikki Krogerus, Prashant Malani,
Benson Leung
From: Prashant Malani <pmalani@chromium.org>
commit 582836e3cfab4faafbdc93bbec96fce036a08ee1 upstream.
The code to extract a peripheral's currently supported Pin Assignments
is repeated in a couple of locations. Factor it out into a separate
function.
This will also make it easier to add fixes (we only need to update 1
location instead of 2).
Fixes: c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles")
Cc: stable@vger.kernel.org
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Prashant Malani <pmalani@chromium.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20230111020546.3384569-1-pmalani@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/altmodes/displayport.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
--- a/drivers/usb/typec/altmodes/displayport.c
+++ b/drivers/usb/typec/altmodes/displayport.c
@@ -419,6 +419,18 @@ static const char * const pin_assignment
[DP_PIN_ASSIGN_F] = "F",
};
+/*
+ * Helper function to extract a peripheral's currently supported
+ * Pin Assignments from its DisplayPort alternate mode state.
+ */
+static u8 get_current_pin_assignments(struct dp_altmode *dp)
+{
+ if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D)
+ return DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo);
+ else
+ return DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo);
+}
+
static ssize_t
pin_assignment_store(struct device *dev, struct device_attribute *attr,
const char *buf, size_t size)
@@ -445,10 +457,7 @@ pin_assignment_store(struct device *dev,
goto out_unlock;
}
- if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D)
- assignments = DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo);
- else
- assignments = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo);
+ assignments = get_current_pin_assignments(dp);
if (!(DP_CONF_GET_PIN_ASSIGN(conf) & assignments)) {
ret = -EINVAL;
@@ -485,10 +494,7 @@ static ssize_t pin_assignment_show(struc
cur = get_count_order(DP_CONF_GET_PIN_ASSIGN(dp->data.conf));
- if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D)
- assignments = DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo);
- else
- assignments = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo);
+ assignments = get_current_pin_assignments(dp);
for (i = 0; assignments; assignments >>= 1, i++) {
if (assignments & 1) {
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 111/193] usb: typec: altmodes/displayport: Fix pin assignment calculation
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2023-01-22 15:03 ` [PATCH 6.1 110/193] usb: typec: altmodes/displayport: Add pin assignment helper Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 112/193] usb: gadget: g_webcam: Send color matching descriptor per frame Greg Kroah-Hartman
` (90 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heikki Krogerus, Prashant Malani,
Benson Leung
From: Prashant Malani <pmalani@chromium.org>
commit 9682b41e52cc9f42f5c33caf410464392adaef04 upstream.
Commit c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin
assignment for UFP receptacles") fixed the pin assignment calculation
to take into account whether the peripheral was a plug or a receptacle.
But the "pin_assignments" sysfs logic was not updated. Address this by
using the macros introduced in the aforementioned commit in the sysfs
logic too.
Fixes: c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles")
Cc: stable@vger.kernel.org
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Prashant Malani <pmalani@chromium.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20230111020546.3384569-2-pmalani@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/altmodes/displayport.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/typec/altmodes/displayport.c
+++ b/drivers/usb/typec/altmodes/displayport.c
@@ -426,9 +426,9 @@ static const char * const pin_assignment
static u8 get_current_pin_assignments(struct dp_altmode *dp)
{
if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D)
- return DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo);
+ return DP_CAP_PIN_ASSIGN_DFP_D(dp->alt->vdo);
else
- return DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo);
+ return DP_CAP_PIN_ASSIGN_UFP_D(dp->alt->vdo);
}
static ssize_t
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 112/193] usb: gadget: g_webcam: Send color matching descriptor per frame
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 111/193] usb: typec: altmodes/displayport: Fix pin assignment calculation Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 113/193] USB: gadget: Add ID numbers to configfs-gadget driver names Greg Kroah-Hartman
` (89 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Daniel Scally,
Laurent Pinchart, Kieran Bingham
From: Daniel Scally <dan.scally@ideasonboard.com>
commit e95765e97d9cb93258a4840440d410fa6ff7e819 upstream.
Currently the color matching descriptor is only sent across the wire
a single time, following the descriptors for each format and frame.
According to the UVC 1.5 Specification 3.9.2.6 ("Color Matching
Descriptors"):
"Only one instance is allowed for a given format and if present,
the Color Matching descriptor shall be placed following the Video
and Still Image Frame descriptors for that format".
Add another reference to the color matching descriptor after the
yuyv frames so that it's correctly transmitted for that format
too.
Fixes: a9914127e834 ("USB gadget: Webcam device")
Cc: stable <stable@kernel.org>
Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Link: https://lore.kernel.org/r/20221216160528.479094-1-dan.scally@ideasonboard.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/legacy/webcam.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/gadget/legacy/webcam.c
+++ b/drivers/usb/gadget/legacy/webcam.c
@@ -293,6 +293,7 @@ static const struct uvc_descriptor_heade
(const struct uvc_descriptor_header *) &uvc_format_yuv,
(const struct uvc_descriptor_header *) &uvc_frame_yuv_360p,
(const struct uvc_descriptor_header *) &uvc_frame_yuv_720p,
+ (const struct uvc_descriptor_header *) &uvc_color_matching,
(const struct uvc_descriptor_header *) &uvc_format_mjpg,
(const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p,
(const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
@@ -305,6 +306,7 @@ static const struct uvc_descriptor_heade
(const struct uvc_descriptor_header *) &uvc_format_yuv,
(const struct uvc_descriptor_header *) &uvc_frame_yuv_360p,
(const struct uvc_descriptor_header *) &uvc_frame_yuv_720p,
+ (const struct uvc_descriptor_header *) &uvc_color_matching,
(const struct uvc_descriptor_header *) &uvc_format_mjpg,
(const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p,
(const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
@@ -317,6 +319,7 @@ static const struct uvc_descriptor_heade
(const struct uvc_descriptor_header *) &uvc_format_yuv,
(const struct uvc_descriptor_header *) &uvc_frame_yuv_360p,
(const struct uvc_descriptor_header *) &uvc_frame_yuv_720p,
+ (const struct uvc_descriptor_header *) &uvc_color_matching,
(const struct uvc_descriptor_header *) &uvc_format_mjpg,
(const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p,
(const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 113/193] USB: gadget: Add ID numbers to configfs-gadget driver names
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 112/193] usb: gadget: g_webcam: Send color matching descriptor per frame Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 114/193] usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() Greg Kroah-Hartman
` (88 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Chanh Nguyen,
Andrzej Pietrasiewicz, Heikki Krogerus, Frank Li
From: Chanh Nguyen <chanh@os.amperecomputing.com>
commit 7c07553807c5125c89de242d35c10c206fd8e6bb upstream.
It is unable to use configfs to attach more than one gadget. When
attaching the second gadget, it always fails and the kernel message
prints out:
Error: Driver 'configfs-gadget' is already registered, aborting...
UDC core: g1: driver registration failed: -16
This commit fixes the problem by using the gadget name as a suffix
to each configfs_gadget's driver name, thus making the names
distinct.
Fixes: fc274c1e9973 ("USB: gadget: Add a new bus for gadgets")
Cc: stable <stable@kernel.org>
Signed-off-by: Chanh Nguyen <chanh@os.amperecomputing.com>
Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Frank Li <frank.li@nxp.com>
Link: https://lore.kernel.org/r/20230111065105.29205-1-chanh@os.amperecomputing.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/configfs.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -392,6 +392,7 @@ static void gadget_info_attr_release(str
WARN_ON(!list_empty(&gi->string_list));
WARN_ON(!list_empty(&gi->available_func));
kfree(gi->composite.gadget_driver.function);
+ kfree(gi->composite.gadget_driver.driver.name);
kfree(gi);
}
@@ -1571,7 +1572,6 @@ static const struct usb_gadget_driver co
.max_speed = USB_SPEED_SUPER_PLUS,
.driver = {
.owner = THIS_MODULE,
- .name = "configfs-gadget",
},
.match_existing_only = 1,
};
@@ -1622,13 +1622,21 @@ static struct config_group *gadgets_make
gi->composite.gadget_driver = configfs_driver_template;
+ gi->composite.gadget_driver.driver.name = kasprintf(GFP_KERNEL,
+ "configfs-gadget.%s", name);
+ if (!gi->composite.gadget_driver.driver.name)
+ goto err;
+
gi->composite.gadget_driver.function = kstrdup(name, GFP_KERNEL);
gi->composite.name = gi->composite.gadget_driver.function;
if (!gi->composite.gadget_driver.function)
- goto err;
+ goto out_free_driver_name;
return &gi->group;
+
+out_free_driver_name:
+ kfree(gi->composite.gadget_driver.driver.name);
err:
kfree(gi);
return ERR_PTR(-ENOMEM);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 114/193] usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 113/193] USB: gadget: Add ID numbers to configfs-gadget driver names Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 115/193] usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 Greg Kroah-Hartman
` (87 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felipe Balbi, Lorenzo Colitti,
Carlos Llamas, Maciej Żenczykowski, stable
From: Maciej Żenczykowski <maze@google.com>
commit c6ec929595c7443250b2a4faea988c62019d5cd2 upstream.
In Google internal bug 265639009 we've received an (as yet) unreproducible
crash report from an aarch64 GKI 5.10.149-android13 running device.
AFAICT the source code is at:
https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10
The call stack is:
ncm_close() -> ncm_notify() -> ncm_do_notify()
with the crash at:
ncm_do_notify+0x98/0x270
Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b)
Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...):
// halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification)
0B 0D 00 79 strh w11, [x8, #6]
// word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request)
6C 0A 00 B9 str w12, [x19, #8]
// x10 (NULL) was read here from offset 0 of valid pointer x9
// IMHO we're reading 'cdev->gadget' and getting NULL
// gadget is indeed at offset 0 of struct usb_composite_dev
2A 01 40 F9 ldr x10, [x9]
// loading req->buf pointer, which is at offset 0 of struct usb_request
69 02 40 F9 ldr x9, [x19]
// x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed
4B 5D 40 B9 ldr w11, [x10, #0x5c]
which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment:
event->wLength = cpu_to_le16(8);
req->length = NCM_STATUS_BYTECOUNT;
/* SPEED_CHANGE data is up/down speeds in bits/sec */
data = req->buf + sizeof *event;
data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
My analysis of registers and NULL ptr deref crash offset
(Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c)
heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing:
data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
which calls:
ncm_bitrate(NULL)
which then calls:
gadget_is_superspeed(NULL)
which reads
((struct usb_gadget *)NULL)->max_speed
and hits a panic.
AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C.
(remember there's a GKI KABI reservation of 16 bytes in struct work_struct)
It's not at all clear to me how this is all supposed to work...
but returning 0 seems much better than panic-ing...
Cc: Felipe Balbi <balbi@kernel.org>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Carlos Llamas <cmllamas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20230117131839.1138208-1-maze@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_ncm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -83,7 +83,9 @@ static inline struct f_ncm *func_to_ncm(
/* peak (theoretical) bulk transfer rate in bits-per-second */
static inline unsigned ncm_bitrate(struct usb_gadget *g)
{
- if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
+ if (!g)
+ return 0;
+ else if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
return 4250000000U;
else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
return 3750000000U;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 115/193] usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 114/193] usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 116/193] arm64: dts: imx8mp: correct usb clocks Greg Kroah-Hartman
` (86 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern, Hongling Zeng,
Juhyung Park, Oliver Neukum
From: Juhyung Park <qkrwngud825@gmail.com>
commit dbd24ec17b85b45f4e823d1aa5607721920f2b05 upstream.
The commit e00b488e813f ("usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS")
blacklists UAS for all of RTL9210 enclosures.
The RTL9210 controller was advertised with UAS since its release back in
2019 and was shipped with a lot of enclosure products with different
firmware combinations.
Blacklist UAS only for HIKSEMI MD202.
This should hopefully be replaced with more robust method than just
comparing strings. But with limited information [1] provided thus far
(dmesg when the device is plugged in, which includes manufacturer and
product, but no lsusb -v to compare against), this is the best we can do
for now.
[1] https://lore.kernel.org/all/20230109115550.71688-1-qkrwngud825@gmail.com
Fixes: e00b488e813f ("usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS")
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Hongling Zeng <zenghongling@kylinos.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20230117085154.123301-1-qkrwngud825@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/uas-detect.h | 13 +++++++++++++
drivers/usb/storage/unusual_uas.h | 7 -------
2 files changed, 13 insertions(+), 7 deletions(-)
--- a/drivers/usb/storage/uas-detect.h
+++ b/drivers/usb/storage/uas-detect.h
@@ -116,6 +116,19 @@ static int uas_use_uas_driver(struct usb
if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bc2)
flags |= US_FL_NO_ATA_1X;
+ /*
+ * RTL9210-based enclosure from HIKSEMI, MD202 reportedly have issues
+ * with UAS. This isn't distinguishable with just idVendor and
+ * idProduct, use manufacturer and product too.
+ *
+ * Reported-by: Hongling Zeng <zenghongling@kylinos.cn>
+ */
+ if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bda &&
+ le16_to_cpu(udev->descriptor.idProduct) == 0x9210 &&
+ (udev->manufacturer && !strcmp(udev->manufacturer, "HIKSEMI")) &&
+ (udev->product && !strcmp(udev->product, "MD202")))
+ flags |= US_FL_IGNORE_UAS;
+
usb_stor_adjust_quirks(udev, &flags);
if (flags & US_FL_IGNORE_UAS) {
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -83,13 +83,6 @@ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x99
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_NO_REPORT_LUNS),
-/* Reported-by: Hongling Zeng <zenghongling@kylinos.cn> */
-UNUSUAL_DEV(0x0bda, 0x9210, 0x0000, 0x9999,
- "Hiksemi",
- "External HDD",
- USB_SC_DEVICE, USB_PR_DEVICE, NULL,
- US_FL_IGNORE_UAS),
-
/* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
"Initio Corporation",
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 116/193] arm64: dts: imx8mp: correct usb clocks
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 115/193] usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 117/193] dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation Greg Kroah-Hartman
` (85 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peng Fan, Alexander Stein, Li Jun,
Shawn Guo
From: Li Jun <jun.li@nxp.com>
commit 8a1ed98fe0f2e7669f0409de0f46f317b275f8be upstream.
After commit cf7f3f4fa9e5 ("clk: imx8mp: fix usb_root_clk parent"),
usb_root_clk is no longer for suspend clock so update dts accordingly
to use right bus clock and suspend clock.
Fixes: fb8587a2c165 ("arm64: dtsi: imx8mp: add usb nodes")
Cc: stable@vger.kernel.org # ed1f4ccfe947: clk: imx: imx8mp: add shared clk gate for usb suspend clk
Cc: stable@vger.kernel.org # v5.19+
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/freescale/imx8mp.dtsi | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
@@ -1279,7 +1279,7 @@
reg = <0x32f10100 0x8>,
<0x381f0000 0x20>;
clocks = <&clk IMX8MP_CLK_HSIO_ROOT>,
- <&clk IMX8MP_CLK_USB_ROOT>;
+ <&clk IMX8MP_CLK_USB_SUSP>;
clock-names = "hsio", "suspend";
interrupts = <GIC_SPI 148 IRQ_TYPE_LEVEL_HIGH>;
power-domains = <&hsio_blk_ctrl IMX8MP_HSIOBLK_PD_USB>;
@@ -1292,9 +1292,9 @@
usb_dwc3_0: usb@38100000 {
compatible = "snps,dwc3";
reg = <0x38100000 0x10000>;
- clocks = <&clk IMX8MP_CLK_HSIO_AXI>,
+ clocks = <&clk IMX8MP_CLK_USB_ROOT>,
<&clk IMX8MP_CLK_USB_CORE_REF>,
- <&clk IMX8MP_CLK_USB_ROOT>;
+ <&clk IMX8MP_CLK_USB_SUSP>;
clock-names = "bus_early", "ref", "suspend";
interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
phys = <&usb3_phy0>, <&usb3_phy0>;
@@ -1321,7 +1321,7 @@
reg = <0x32f10108 0x8>,
<0x382f0000 0x20>;
clocks = <&clk IMX8MP_CLK_HSIO_ROOT>,
- <&clk IMX8MP_CLK_USB_ROOT>;
+ <&clk IMX8MP_CLK_USB_SUSP>;
clock-names = "hsio", "suspend";
interrupts = <GIC_SPI 149 IRQ_TYPE_LEVEL_HIGH>;
power-domains = <&hsio_blk_ctrl IMX8MP_HSIOBLK_PD_USB>;
@@ -1334,9 +1334,9 @@
usb_dwc3_1: usb@38200000 {
compatible = "snps,dwc3";
reg = <0x38200000 0x10000>;
- clocks = <&clk IMX8MP_CLK_HSIO_AXI>,
+ clocks = <&clk IMX8MP_CLK_USB_ROOT>,
<&clk IMX8MP_CLK_USB_CORE_REF>,
- <&clk IMX8MP_CLK_USB_ROOT>;
+ <&clk IMX8MP_CLK_USB_SUSP>;
clock-names = "bus_early", "ref", "suspend";
interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
phys = <&usb3_phy1>, <&usb3_phy1>;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 117/193] dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 116/193] arm64: dts: imx8mp: correct usb clocks Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 118/193] dt-bindings: phy: g12a-usb3-pcie-phy: " Greg Kroah-Hartman
` (84 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiner Kallweit,
Martin Blumenstingl, Krzysztof Kozlowski, Vinod Koul
From: Heiner Kallweit <hkallweit1@gmail.com>
commit c63835bf1c750c9b3aec1d5c23d811d6375fc23d upstream.
The compatible strings in the driver don't have the meson prefix.
Fix this in the documentation and rename the file accordingly.
Fixes: da86d286cce8 ("dt-bindings: phy: meson-g12a-usb2-phy: convert to yaml")
Cc: stable@vger.kernel.org
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/8d960029-e94d-224b-911f-03e5deb47ebc@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/phy/amlogic,g12a-usb2-phy.yaml | 78 ++++++++++
Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb2-phy.yaml | 78 ----------
2 files changed, 78 insertions(+), 78 deletions(-)
rename Documentation/devicetree/bindings/phy/{amlogic,meson-g12a-usb2-phy.yaml => amlogic,g12a-usb2-phy.yaml} (85%)
--- /dev/null
+++ b/Documentation/devicetree/bindings/phy/amlogic,g12a-usb2-phy.yaml
@@ -0,0 +1,78 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+# Copyright 2019 BayLibre, SAS
+%YAML 1.2
+---
+$id: "http://devicetree.org/schemas/phy/amlogic,g12a-usb2-phy.yaml#"
+$schema: "http://devicetree.org/meta-schemas/core.yaml#"
+
+title: Amlogic G12A USB2 PHY
+
+maintainers:
+ - Neil Armstrong <neil.armstrong@linaro.org>
+
+properties:
+ compatible:
+ enum:
+ - amlogic,g12a-usb2-phy
+ - amlogic,a1-usb2-phy
+
+ reg:
+ maxItems: 1
+
+ clocks:
+ maxItems: 1
+
+ clock-names:
+ items:
+ - const: xtal
+
+ resets:
+ maxItems: 1
+
+ reset-names:
+ items:
+ - const: phy
+
+ "#phy-cells":
+ const: 0
+
+ phy-supply:
+ description:
+ Phandle to a regulator that provides power to the PHY. This
+ regulator will be managed during the PHY power on/off sequence.
+
+required:
+ - compatible
+ - reg
+ - clocks
+ - clock-names
+ - resets
+ - reset-names
+ - "#phy-cells"
+
+if:
+ properties:
+ compatible:
+ enum:
+ - amlogic,meson-a1-usb-ctrl
+
+then:
+ properties:
+ power-domains:
+ maxItems: 1
+ required:
+ - power-domains
+
+additionalProperties: false
+
+examples:
+ - |
+ phy@36000 {
+ compatible = "amlogic,g12a-usb2-phy";
+ reg = <0x36000 0x2000>;
+ clocks = <&xtal>;
+ clock-names = "xtal";
+ resets = <&phy_reset>;
+ reset-names = "phy";
+ #phy-cells = <0>;
+ };
--- a/Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb2-phy.yaml
+++ /dev/null
@@ -1,78 +0,0 @@
-# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
-# Copyright 2019 BayLibre, SAS
-%YAML 1.2
----
-$id: "http://devicetree.org/schemas/phy/amlogic,meson-g12a-usb2-phy.yaml#"
-$schema: "http://devicetree.org/meta-schemas/core.yaml#"
-
-title: Amlogic G12A USB2 PHY
-
-maintainers:
- - Neil Armstrong <neil.armstrong@linaro.org>
-
-properties:
- compatible:
- enum:
- - amlogic,meson-g12a-usb2-phy
- - amlogic,meson-a1-usb2-phy
-
- reg:
- maxItems: 1
-
- clocks:
- maxItems: 1
-
- clock-names:
- items:
- - const: xtal
-
- resets:
- maxItems: 1
-
- reset-names:
- items:
- - const: phy
-
- "#phy-cells":
- const: 0
-
- phy-supply:
- description:
- Phandle to a regulator that provides power to the PHY. This
- regulator will be managed during the PHY power on/off sequence.
-
-required:
- - compatible
- - reg
- - clocks
- - clock-names
- - resets
- - reset-names
- - "#phy-cells"
-
-if:
- properties:
- compatible:
- enum:
- - amlogic,meson-a1-usb-ctrl
-
-then:
- properties:
- power-domains:
- maxItems: 1
- required:
- - power-domains
-
-additionalProperties: false
-
-examples:
- - |
- phy@36000 {
- compatible = "amlogic,meson-g12a-usb2-phy";
- reg = <0x36000 0x2000>;
- clocks = <&xtal>;
- clock-names = "xtal";
- resets = <&phy_reset>;
- reset-names = "phy";
- #phy-cells = <0>;
- };
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 118/193] dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 117/193] dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 119/193] serial: pch_uart: Pass correct sg to dma_unmap_sg() Greg Kroah-Hartman
` (83 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiner Kallweit,
Martin Blumenstingl, Krzysztof Kozlowski, Vinod Koul
From: Heiner Kallweit <hkallweit1@gmail.com>
commit e181119046a0ec16126b682163040e8e33f310c1 upstream.
The compatible string in the driver doesn't have the meson prefix.
Fix this in the documentation and rename the file accordingly.
Fixes: 87a55485f2fc ("dt-bindings: phy: meson-g12a-usb3-pcie-phy: convert to yaml")
Cc: stable@vger.kernel.org
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/0a82be92-ce85-da34-9d6f-4b33034473e5@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml | 59 ++++++++++
Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml | 59 ----------
2 files changed, 59 insertions(+), 59 deletions(-)
rename Documentation/devicetree/bindings/phy/{amlogic,meson-g12a-usb3-pcie-phy.yaml => amlogic,g12a-usb3-pcie-phy.yaml} (82%)
--- /dev/null
+++ b/Documentation/devicetree/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml
@@ -0,0 +1,59 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+# Copyright 2019 BayLibre, SAS
+%YAML 1.2
+---
+$id: "http://devicetree.org/schemas/phy/amlogic,g12a-usb3-pcie-phy.yaml#"
+$schema: "http://devicetree.org/meta-schemas/core.yaml#"
+
+title: Amlogic G12A USB3 + PCIE Combo PHY
+
+maintainers:
+ - Neil Armstrong <neil.armstrong@linaro.org>
+
+properties:
+ compatible:
+ enum:
+ - amlogic,g12a-usb3-pcie-phy
+
+ reg:
+ maxItems: 1
+
+ clocks:
+ maxItems: 1
+
+ clock-names:
+ items:
+ - const: ref_clk
+
+ resets:
+ maxItems: 1
+
+ reset-names:
+ items:
+ - const: phy
+
+ "#phy-cells":
+ const: 1
+
+required:
+ - compatible
+ - reg
+ - clocks
+ - clock-names
+ - resets
+ - reset-names
+ - "#phy-cells"
+
+additionalProperties: false
+
+examples:
+ - |
+ phy@46000 {
+ compatible = "amlogic,g12a-usb3-pcie-phy";
+ reg = <0x46000 0x2000>;
+ clocks = <&ref_clk>;
+ clock-names = "ref_clk";
+ resets = <&phy_reset>;
+ reset-names = "phy";
+ #phy-cells = <1>;
+ };
--- a/Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml
+++ /dev/null
@@ -1,59 +0,0 @@
-# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
-# Copyright 2019 BayLibre, SAS
-%YAML 1.2
----
-$id: "http://devicetree.org/schemas/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml#"
-$schema: "http://devicetree.org/meta-schemas/core.yaml#"
-
-title: Amlogic G12A USB3 + PCIE Combo PHY
-
-maintainers:
- - Neil Armstrong <neil.armstrong@linaro.org>
-
-properties:
- compatible:
- enum:
- - amlogic,meson-g12a-usb3-pcie-phy
-
- reg:
- maxItems: 1
-
- clocks:
- maxItems: 1
-
- clock-names:
- items:
- - const: ref_clk
-
- resets:
- maxItems: 1
-
- reset-names:
- items:
- - const: phy
-
- "#phy-cells":
- const: 1
-
-required:
- - compatible
- - reg
- - clocks
- - clock-names
- - resets
- - reset-names
- - "#phy-cells"
-
-additionalProperties: false
-
-examples:
- - |
- phy@46000 {
- compatible = "amlogic,meson-g12a-usb3-pcie-phy";
- reg = <0x46000 0x2000>;
- clocks = <&ref_clk>;
- clock-names = "ref_clk";
- resets = <&phy_reset>;
- reset-names = "phy";
- #phy-cells = <1>;
- };
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 119/193] serial: pch_uart: Pass correct sg to dma_unmap_sg()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 118/193] dt-bindings: phy: g12a-usb3-pcie-phy: " Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 120/193] dmaengine: lgm: Move DT parsing after initialization Greg Kroah-Hartman
` (82 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
commit e8914b52e5b024e4af3d810a935fe0805eee8a36 upstream.
A local variable sg is used to store scatterlist pointer in
pch_dma_tx_complete(). The for loop doing Tx byte accounting before
dma_unmap_sg() alters sg in its increment statement. Therefore, the
pointer passed into dma_unmap_sg() won't match to the one given to
dma_map_sg().
To fix the problem, use priv->sg_tx_p directly in dma_unmap_sg()
instead of the local variable.
Fixes: da3564ee027e ("pch_uart: add multi-scatter processing")
Cc: stable@vger.kernel.org
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://lore.kernel.org/r/20230103093435.4396-1-ilpo.jarvinen@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/pch_uart.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -752,7 +752,7 @@ static void pch_dma_tx_complete(void *ar
}
xmit->tail &= UART_XMIT_SIZE - 1;
async_tx_ack(priv->desc_tx);
- dma_unmap_sg(port->dev, sg, priv->orig_nent, DMA_TO_DEVICE);
+ dma_unmap_sg(port->dev, priv->sg_tx_p, priv->orig_nent, DMA_TO_DEVICE);
priv->tx_dma_use = 0;
priv->nent = 0;
priv->orig_nent = 0;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 120/193] dmaengine: lgm: Move DT parsing after initialization
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 119/193] serial: pch_uart: Pass correct sg to dma_unmap_sg() Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 121/193] dmaengine: tegra210-adma: fix global intr clear Greg Kroah-Hartman
` (81 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peter Harliman Liem, Vinod Koul
From: Peter Harliman Liem <pliem@maxlinear.com>
commit 96b3bb18f6cbe259ef4e0bed3135911b7e8d2af5 upstream.
ldma_cfg_init() will parse DT to retrieve certain configs.
However, that is called before ldma_dma_init_vXX(), which
will make some initialization to channel configs. It will
thus incorrectly overwrite certain configs that are declared
in DT.
To fix that, we move DT parsing after initialization.
Function name is renamed to better represent what it does.
Fixes: 32d31c79a1a4 ("dmaengine: Add Intel LGM SoC DMA support.")
Signed-off-by: Peter Harliman Liem <pliem@maxlinear.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/afef6fc1ed20098b684e0d53737d69faf63c125f.1672887183.git.pliem@maxlinear.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/lgm/lgm-dma.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/dma/lgm/lgm-dma.c
+++ b/drivers/dma/lgm/lgm-dma.c
@@ -914,7 +914,7 @@ static void ldma_dev_init(struct ldma_de
}
}
-static int ldma_cfg_init(struct ldma_dev *d)
+static int ldma_parse_dt(struct ldma_dev *d)
{
struct fwnode_handle *fwnode = dev_fwnode(d->dev);
struct ldma_port *p;
@@ -1661,10 +1661,6 @@ static int intel_ldma_probe(struct platf
p->ldev = d;
}
- ret = ldma_cfg_init(d);
- if (ret)
- return ret;
-
dma_dev->dev = &pdev->dev;
ch_mask = (unsigned long)d->channels_mask;
@@ -1675,6 +1671,10 @@ static int intel_ldma_probe(struct platf
ldma_dma_init_v3X(j, d);
}
+ ret = ldma_parse_dt(d);
+ if (ret)
+ return ret;
+
dma_dev->device_alloc_chan_resources = ldma_alloc_chan_resources;
dma_dev->device_free_chan_resources = ldma_free_chan_resources;
dma_dev->device_terminate_all = ldma_terminate_all;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 121/193] dmaengine: tegra210-adma: fix global intr clear
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 120/193] dmaengine: lgm: Move DT parsing after initialization Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 122/193] dmaengine: idxd: Let probe fail when workqueue cannot be enabled Greg Kroah-Hartman
` (80 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mohan Kumar, Vinod Koul
From: Mohan Kumar <mkumard@nvidia.com>
commit 9c7e355ccbb33d239360c876dbe49ad5ade65b47 upstream.
The current global interrupt clear programming register offset
was not correct. Fix the programming with right offset
Fixes: ded1f3db4cd6 ("dmaengine: tegra210-adma: prepare for supporting newer Tegra chips")
Cc: stable@vger.kernel.org
Signed-off-by: Mohan Kumar <mkumard@nvidia.com>
Link: https://lore.kernel.org/r/20230102064844.31306-1-mkumard@nvidia.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/tegra210-adma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -221,7 +221,7 @@ static int tegra_adma_init(struct tegra_
int ret;
/* Clear any interrupts */
- tdma_write(tdma, tdma->cdata->global_int_clear, 0x1);
+ tdma_write(tdma, tdma->cdata->ch_base_offset + tdma->cdata->global_int_clear, 0x1);
/* Assert soft reset */
tdma_write(tdma, ADMA_GLOBAL_SOFT_RESET, 0x1);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 122/193] dmaengine: idxd: Let probe fail when workqueue cannot be enabled
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 121/193] dmaengine: tegra210-adma: fix global intr clear Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 123/193] dmaengine: idxd: Prevent use after free on completion memory Greg Kroah-Hartman
` (79 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Reinette Chatre, Dave Jiang,
Fenghua Yu, Vinod Koul
From: Reinette Chatre <reinette.chatre@intel.com>
commit b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f upstream.
The workqueue is enabled when the appropriate driver is loaded and
disabled when the driver is removed. When the driver is removed it
assumes that the workqueue was enabled successfully and proceeds to
free allocations made during workqueue enabling.
Failure during workqueue enabling does not prevent the driver from
being loaded. This is because the error path within drv_enable_wq()
returns success unless a second failure is encountered
during the error path. By returning success it is possible to load
the driver even if the workqueue cannot be enabled and
allocations that do not exist are attempted to be freed during
driver remove.
Some examples of problematic flows:
(a)
idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq():
In above flow, if idxd_wq_request_irq() fails then
idxd_wq_unmap_portal() is called on error exit path, but
drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The
driver is thus loaded successfully.
idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal()
Above flow on driver unload triggers the WARN in devm_iounmap() because
the device resource has already been removed during error path of
drv_enable_wq().
(b)
idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq():
In above flow, if idxd_wq_request_irq() fails then
idxd_wq_init_percpu_ref() is never called to initialize the percpu
counter, yet the driver loads successfully because drv_enable_wq()
returns 0.
idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill():
Above flow on driver unload triggers a BUG when attempting to drop the
initial ref of the uninitialized percpu ref:
BUG: kernel NULL pointer dereference, address: 0000000000000010
Fix the drv_enable_wq() error path by returning the original error that
indicates failure of workqueue enabling. This ensures that the probe
fails when an error is encountered and the driver remove paths are only
attempted when the workqueue was enabled successfully.
Fixes: 1f2bb40337f0 ("dmaengine: idxd: move wq_enable() to device.c")
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/e8d8116e5efa0fd14fadc5adae6ffd319f0e5ff1.1670452419.git.reinette.chatre@intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/idxd/device.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -1391,8 +1391,7 @@ err_res_alloc:
err_irq:
idxd_wq_unmap_portal(wq);
err_map_portal:
- rc = idxd_wq_disable(wq, false);
- if (rc < 0)
+ if (idxd_wq_disable(wq, false))
dev_dbg(dev, "wq %s disable failed\n", dev_name(wq_confdev(wq)));
err:
return rc;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 123/193] dmaengine: idxd: Prevent use after free on completion memory
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 122/193] dmaengine: idxd: Let probe fail when workqueue cannot be enabled Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 124/193] dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable Greg Kroah-Hartman
` (78 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Jiang, Reinette Chatre,
Fenghua Yu, Vinod Koul
From: Reinette Chatre <reinette.chatre@intel.com>
commit 1beeec45f9ac31eba52478379f70a5fa9c2ad005 upstream.
On driver unload any pending descriptors are flushed at the
time the interrupt is freed:
idxd_dmaengine_drv_remove() ->
drv_disable_wq() ->
idxd_wq_free_irq() ->
idxd_flush_pending_descs().
If there are any descriptors present that need to be flushed this
flow triggers a "not present" page fault as below:
BUG: unable to handle page fault for address: ff391c97c70c9040
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
The address that triggers the fault is the address of the
descriptor that was freed moments earlier via:
drv_disable_wq()->idxd_wq_free_resources()
Fix the use after free by freeing the descriptors after any possible
usage. This is done after idxd_wq_reset() to ensure that the memory
remains accessible during possible completion writes by the device.
Fixes: 63c14ae6c161 ("dmaengine: idxd: refactor wq driver enable/disable operations")
Suggested-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/6c4657d9cff0a0a00501a7b928297ac966e9ec9d.1670452419.git.reinette.chatre@intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/idxd/device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -1408,11 +1408,11 @@ void drv_disable_wq(struct idxd_wq *wq)
dev_warn(dev, "Clients has claim on wq %d: %d\n",
wq->id, idxd_wq_refcount(wq));
- idxd_wq_free_resources(wq);
idxd_wq_unmap_portal(wq);
idxd_wq_drain(wq);
idxd_wq_free_irq(wq);
idxd_wq_reset(wq);
+ idxd_wq_free_resources(wq);
percpu_ref_exit(&wq->wq_active);
wq->type = IDXD_WQT_NONE;
wq->client_count = 0;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 124/193] dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 123/193] dmaengine: idxd: Prevent use after free on completion memory Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 125/193] serial: amba-pl011: fix high priority character transmission in rs486 mode Greg Kroah-Hartman
` (77 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Reinette Chatre, Dave Jiang,
Fenghua Yu, Vinod Koul
From: Reinette Chatre <reinette.chatre@intel.com>
commit 6744a030d81e456883bfbb627ac1f30465c1a989 upstream.
On driver unload any pending descriptors are flushed and pending
DMA descriptors are explicitly completed:
idxd_dmaengine_drv_remove() ->
drv_disable_wq() ->
idxd_wq_free_irq() ->
idxd_flush_pending_descs() ->
idxd_dma_complete_txd()
With this done during driver unload any remaining descriptor is
likely stuck and can be dropped. Even so, the descriptor may still
have a callback set that could no longer be accessible. An
example of such a problem is when the dmatest fails and the dmatest
module is unloaded. The failure of dmatest leaves descriptors with
dma_async_tx_descriptor::callback pointing to code that no longer
exist. This causes a page fault as below at the time the IDXD driver
is unloaded when it attempts to run the callback:
BUG: unable to handle page fault for address: ffffffffc0665190
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
Fix this by clearing the callback pointers on the transmit
descriptors only when workqueue is disabled.
Fixes: 403a2e236538 ("dmaengine: idxd: change MSIX allocation based on per wq activation")
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/37d06b772aa7f8863ca50f90930ea2fd80b38fc3.1670452419.git.reinette.chatre@intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/idxd/device.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -1173,8 +1173,19 @@ static void idxd_flush_pending_descs(str
spin_unlock(&ie->list_lock);
list_for_each_entry_safe(desc, itr, &flist, list) {
+ struct dma_async_tx_descriptor *tx;
+
list_del(&desc->list);
ctype = desc->completion->status ? IDXD_COMPLETE_NORMAL : IDXD_COMPLETE_ABORT;
+ /*
+ * wq is being disabled. Any remaining descriptors are
+ * likely to be stuck and can be dropped. callback could
+ * point to code that is no longer accessible, for example
+ * if dmatest module has been unloaded.
+ */
+ tx = &desc->txd;
+ tx->callback = NULL;
+ tx->callback_result = NULL;
idxd_dma_complete_txd(desc, ctype, true);
}
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 125/193] serial: amba-pl011: fix high priority character transmission in rs486 mode
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 124/193] dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 126/193] serial: atmel: fix incorrect baudrate setup Greg Kroah-Hartman
` (76 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lino Sanfilippo
From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
commit 4f39aca2360c82dccd2f5179d77e94aab665bea6 upstream.
In RS485 mode the transmission of a high priority character fails since it
is written to the data register before the transmitter is enabled. Fix this
in pl011_tx_chars() by enabling RS485 transmission before writing the
character.
Fixes: 8d479237727c ("serial: amba-pl011: add RS485 support")
Cc: stable@vger.kernel.org
Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
Link: https://lore.kernel.org/r/20230108181735.10937-1-LinoSanfilippo@gmx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/amba-pl011.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1467,6 +1467,10 @@ static bool pl011_tx_chars(struct uart_a
struct circ_buf *xmit = &uap->port.state->xmit;
int count = uap->fifosize >> 1;
+ if ((uap->port.rs485.flags & SER_RS485_ENABLED) &&
+ !uap->rs485_tx_started)
+ pl011_rs485_tx_start(uap);
+
if (uap->port.x_char) {
if (!pl011_tx_char(uap, uap->port.x_char, from_irq))
return true;
@@ -1478,10 +1482,6 @@ static bool pl011_tx_chars(struct uart_a
return false;
}
- if ((uap->port.rs485.flags & SER_RS485_ENABLED) &&
- !uap->rs485_tx_started)
- pl011_rs485_tx_start(uap);
-
/* If we are using DMA mode, try to send some characters. */
if (pl011_dma_tx_irq(uap))
return true;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 126/193] serial: atmel: fix incorrect baudrate setup
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 125/193] serial: amba-pl011: fix high priority character transmission in rs486 mode Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 127/193] serial: exar: Add support for Sealevel 7xxxC serial cards Greg Kroah-Hartman
` (75 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Tobias Schramm, Richard Genoud
From: Tobias Schramm <t.schramm@manjaro.org>
commit 5bfdd3c654bd879bff50c2e85e42f85ae698b42f upstream.
Commit ba47f97a18f2 ("serial: core: remove baud_rates when serial console
setup") changed uart_set_options to select the correct baudrate
configuration based on the absolute error between requested baudrate and
available standard baudrate settings.
Prior to that commit the baudrate was selected based on which predefined
standard baudrate did not exceed the requested baudrate.
This change of selection logic was never reflected in the atmel serial
driver. Thus the comment left in the atmel serial driver is no longer
accurate.
Additionally the manual rounding up described in that comment and applied
via (quot - 1) requests an incorrect baudrate. Since uart_set_options uses
tty_termios_encode_baud_rate to determine the appropriate baudrate flags
this can cause baudrate selection to fail entirely because
tty_termios_encode_baud_rate will only select a baudrate if relative error
between requested and selected baudrate does not exceed +/-2%.
Fix that by requesting actual, exact baudrate used by the serial.
Fixes: ba47f97a18f2 ("serial: core: remove baud_rates when serial console setup")
Cc: stable <stable@kernel.org>
Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
Acked-by: Richard Genoud <richard.genoud@gmail.com>
Link: https://lore.kernel.org/r/20230109072940.202936-1-t.schramm@manjaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/atmel_serial.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -2673,13 +2673,7 @@ static void __init atmel_console_get_opt
else if (mr == ATMEL_US_PAR_ODD)
*parity = 'o';
- /*
- * The serial core only rounds down when matching this to a
- * supported baud rate. Make sure we don't end up slightly
- * lower than one of those, as it would make us fall through
- * to a much lower baud rate than we really want.
- */
- *baud = port->uartclk / (16 * (quot - 1));
+ *baud = port->uartclk / (16 * quot);
}
static int __init atmel_console_setup(struct console *co, char *options)
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 127/193] serial: exar: Add support for Sealevel 7xxxC serial cards
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 126/193] serial: atmel: fix incorrect baudrate setup Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 128/193] gsmi: fix null-deref in gsmi_get_variable Greg Kroah-Hartman
` (74 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matthew Howell, stable
From: Matthew Howell <matthew.howell@sealevel.com>
commit 14ee78d5932afeb710c8305196a676a715bfdea8 upstream.
Add support for Sealevel 7xxxC serial cards.
This patch:
* Adds IDs to recognize 7xxxC cards from Sealevel Systems.
* Updates exar_pci_probe() to set nr_ports to last two bytes of primary
dev ID for these cards.
Signed-off-by: Matthew Howell <matthew.howell@sealevel.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/alpine.DEB.2.21.2301191440010.22558@tstest-VirtualBox
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_exar.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/drivers/tty/serial/8250/8250_exar.c
+++ b/drivers/tty/serial/8250/8250_exar.c
@@ -43,6 +43,12 @@
#define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358
#define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358
+#define PCI_DEVICE_ID_SEALEVEL_710xC 0x1001
+#define PCI_DEVICE_ID_SEALEVEL_720xC 0x1002
+#define PCI_DEVICE_ID_SEALEVEL_740xC 0x1004
+#define PCI_DEVICE_ID_SEALEVEL_780xC 0x1008
+#define PCI_DEVICE_ID_SEALEVEL_716xC 0x1010
+
#define UART_EXAR_INT0 0x80
#define UART_EXAR_8XMODE 0x88 /* 8X sampling rate select */
#define UART_EXAR_SLEEP 0x8b /* Sleep mode */
@@ -638,6 +644,8 @@ exar_pci_probe(struct pci_dev *pcidev, c
nr_ports = BIT(((pcidev->device & 0x38) >> 3) - 1);
else if (board->num_ports)
nr_ports = board->num_ports;
+ else if (pcidev->vendor == PCI_VENDOR_ID_SEALEVEL)
+ nr_ports = pcidev->device & 0xff;
else
nr_ports = pcidev->device & 0x0f;
@@ -864,6 +872,12 @@ static const struct pci_device_id exar_p
EXAR_DEVICE(COMMTECH, 4224PCI335, pbn_fastcom335_4),
EXAR_DEVICE(COMMTECH, 2324PCI335, pbn_fastcom335_4),
EXAR_DEVICE(COMMTECH, 2328PCI335, pbn_fastcom335_8),
+
+ EXAR_DEVICE(SEALEVEL, 710xC, pbn_exar_XR17V35x),
+ EXAR_DEVICE(SEALEVEL, 720xC, pbn_exar_XR17V35x),
+ EXAR_DEVICE(SEALEVEL, 740xC, pbn_exar_XR17V35x),
+ EXAR_DEVICE(SEALEVEL, 780xC, pbn_exar_XR17V35x),
+ EXAR_DEVICE(SEALEVEL, 716xC, pbn_exar_XR17V35x),
{ 0, }
};
MODULE_DEVICE_TABLE(pci, exar_pci_tbl);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 128/193] gsmi: fix null-deref in gsmi_get_variable
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 127/193] serial: exar: Add support for Sealevel 7xxxC serial cards Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 129/193] mei: bus: fix unlink on bus in error path Greg Kroah-Hartman
` (73 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Khazhismel Kumykov
From: Khazhismel Kumykov <khazhy@chromium.org>
commit a769b05eeed7accc4019a1ed9799dd72067f1ce8 upstream.
We can get EFI variables without fetching the attribute, so we must
allow for that in gsmi.
commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore
access layer") added a new get_variable call with attr=NULL, which
triggers panic in gsmi.
Fixes: 74c5b31c6618 ("driver: Google EFI SMI")
Cc: stable <stable@kernel.org>
Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
Link: https://lore.kernel.org/r/20230118010212.1268474-1-khazhy@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/google/gsmi.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/firmware/google/gsmi.c
+++ b/drivers/firmware/google/gsmi.c
@@ -361,9 +361,10 @@ static efi_status_t gsmi_get_variable(ef
memcpy(data, gsmi_dev.data_buf->start, *data_size);
/* All variables are have the following attributes */
- *attr = EFI_VARIABLE_NON_VOLATILE |
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS;
+ if (attr)
+ *attr = EFI_VARIABLE_NON_VOLATILE |
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS;
}
spin_unlock_irqrestore(&gsmi_dev.lock, flags);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 129/193] mei: bus: fix unlink on bus in error path
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 128/193] gsmi: fix null-deref in gsmi_get_variable Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 130/193] mei: me: add meteor lake point M DID Greg Kroah-Hartman
` (72 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Usyskin, Tomas Winkler
From: Alexander Usyskin <alexander.usyskin@intel.com>
commit a43866856125c3c432e2fbb6cc63cee1539ec4a7 upstream.
Unconditional call to mei_cl_unlink in mei_cl_bus_dev_release leads
to call of the mei_cl_unlink without corresponding mei_cl_link.
This leads to miscalculation of open_handle_count (decrease without
increase).
Call unlink in mei_cldev_enable fail path and remove blanket unlink
from mei_cl_bus_dev_release.
Fixes: 34f1166afd67 ("mei: bus: need to unlink client before freeing")
Cc: <stable@vger.kernel.org>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Reviewed-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20221212220247.286019-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/mei/bus.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -665,13 +665,15 @@ void *mei_cldev_dma_map(struct mei_cl_de
if (cl->state == MEI_FILE_UNINITIALIZED) {
ret = mei_cl_link(cl);
if (ret)
- goto out;
+ goto notlinked;
/* update pointers */
cl->cldev = cldev;
}
ret = mei_cl_dma_alloc_and_map(cl, NULL, buffer_id, size);
-out:
+ if (ret)
+ mei_cl_unlink(cl);
+notlinked:
mutex_unlock(&bus->device_lock);
if (ret)
return ERR_PTR(ret);
@@ -721,7 +723,7 @@ int mei_cldev_enable(struct mei_cl_devic
if (cl->state == MEI_FILE_UNINITIALIZED) {
ret = mei_cl_link(cl);
if (ret)
- goto out;
+ goto notlinked;
/* update pointers */
cl->cldev = cldev;
}
@@ -748,6 +750,9 @@ int mei_cldev_enable(struct mei_cl_devic
}
out:
+ if (ret)
+ mei_cl_unlink(cl);
+notlinked:
mutex_unlock(&bus->device_lock);
return ret;
@@ -1115,7 +1120,6 @@ static void mei_cl_bus_dev_release(struc
mei_cl_flush_queues(cldev->cl, NULL);
mei_me_cl_put(cldev->me_cl);
mei_dev_bus_put(cldev->bus);
- mei_cl_unlink(cldev->cl);
kfree(cldev->cl);
kfree(cldev);
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 130/193] mei: me: add meteor lake point M DID
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 129/193] mei: bus: fix unlink on bus in error path Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 131/193] VMCI: Use threaded irqs instead of tasklets Greg Kroah-Hartman
` (71 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Usyskin, Tomas Winkler
From: Alexander Usyskin <alexander.usyskin@intel.com>
commit 0c4d68261717f89fa8c4f98a6967c3832fcb3ad0 upstream.
Add Meteor Lake Point M device id.
Cc: <stable@vger.kernel.org>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20221212220247.286019-2-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/mei/hw-me-regs.h | 2 ++
drivers/misc/mei/pci-me.c | 2 ++
2 files changed, 4 insertions(+)
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -111,6 +111,8 @@
#define MEI_DEV_ID_RPL_S 0x7A68 /* Raptor Lake Point S */
+#define MEI_DEV_ID_MTL_M 0x7E70 /* Meteor Lake Point M */
+
/*
* MEI HW Section
*/
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -118,6 +118,8 @@ static const struct pci_device_id mei_me
{MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)},
+
/* required last entry */
{0, }
};
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 131/193] VMCI: Use threaded irqs instead of tasklets
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 130/193] mei: me: add meteor lake point M DID Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 132/193] ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI Greg Kroah-Hartman
` (70 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vishnu Dasa, Zack Rusin, Nadav Amit,
Nathan Chancellor, VMware PV-Drivers Reviewers, Bryan Tan
From: Vishnu Dasa <vdasa@vmware.com>
commit 3daed6345d5880464f46adab871d208e1baa2f3a upstream.
The vmci_dispatch_dgs() tasklet function calls vmci_read_data()
which uses wait_event() resulting in invalid sleep in an atomic
context (and therefore potentially in a deadlock).
Use threaded irqs to fix this issue and completely remove usage
of tasklets.
[ 20.264639] BUG: sleeping function called from invalid context at drivers/misc/vmw_vmci/vmci_guest.c:145
[ 20.264643] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 762, name: vmtoolsd
[ 20.264645] preempt_count: 101, expected: 0
[ 20.264646] RCU nest depth: 0, expected: 0
[ 20.264647] 1 lock held by vmtoolsd/762:
[ 20.264648] #0: ffff0000874ae440 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connect+0x60/0x330 [vsock]
[ 20.264658] Preemption disabled at:
[ 20.264659] [<ffff80000151d7d8>] vmci_send_datagram+0x44/0xa0 [vmw_vmci]
[ 20.264665] CPU: 0 PID: 762 Comm: vmtoolsd Not tainted 5.19.0-0.rc8.20220727git39c3c396f813.60.fc37.aarch64 #1
[ 20.264667] Hardware name: VMware, Inc. VBSA/VBSA, BIOS VEFI 12/31/2020
[ 20.264668] Call trace:
[ 20.264669] dump_backtrace+0xc4/0x130
[ 20.264672] show_stack+0x24/0x80
[ 20.264673] dump_stack_lvl+0x88/0xb4
[ 20.264676] dump_stack+0x18/0x34
[ 20.264677] __might_resched+0x1a0/0x280
[ 20.264679] __might_sleep+0x58/0x90
[ 20.264681] vmci_read_data+0x74/0x120 [vmw_vmci]
[ 20.264683] vmci_dispatch_dgs+0x64/0x204 [vmw_vmci]
[ 20.264686] tasklet_action_common.constprop.0+0x13c/0x150
[ 20.264688] tasklet_action+0x40/0x50
[ 20.264689] __do_softirq+0x23c/0x6b4
[ 20.264690] __irq_exit_rcu+0x104/0x214
[ 20.264691] irq_exit_rcu+0x1c/0x50
[ 20.264693] el1_interrupt+0x38/0x6c
[ 20.264695] el1h_64_irq_handler+0x18/0x24
[ 20.264696] el1h_64_irq+0x68/0x6c
[ 20.264697] preempt_count_sub+0xa4/0xe0
[ 20.264698] _raw_spin_unlock_irqrestore+0x64/0xb0
[ 20.264701] vmci_send_datagram+0x7c/0xa0 [vmw_vmci]
[ 20.264703] vmci_datagram_dispatch+0x84/0x100 [vmw_vmci]
[ 20.264706] vmci_datagram_send+0x2c/0x40 [vmw_vmci]
[ 20.264709] vmci_transport_send_control_pkt+0xb8/0x120 [vmw_vsock_vmci_transport]
[ 20.264711] vmci_transport_connect+0x40/0x7c [vmw_vsock_vmci_transport]
[ 20.264713] vsock_connect+0x278/0x330 [vsock]
[ 20.264715] __sys_connect_file+0x8c/0xc0
[ 20.264718] __sys_connect+0x84/0xb4
[ 20.264720] __arm64_sys_connect+0x2c/0x3c
[ 20.264721] invoke_syscall+0x78/0x100
[ 20.264723] el0_svc_common.constprop.0+0x68/0x124
[ 20.264724] do_el0_svc+0x38/0x4c
[ 20.264725] el0_svc+0x60/0x180
[ 20.264726] el0t_64_sync_handler+0x11c/0x150
[ 20.264728] el0t_64_sync+0x190/0x194
Signed-off-by: Vishnu Dasa <vdasa@vmware.com>
Suggested-by: Zack Rusin <zackr@vmware.com>
Reported-by: Nadav Amit <namit@vmware.com>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Fixes: 463713eb6164 ("VMCI: dma dg: add support for DMA datagrams receive")
Cc: <stable@vger.kernel.org> # v5.18+
Cc: VMware PV-Drivers Reviewers <pv-drivers@vmware.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Bryan Tan <bryantan@vmware.com>
Reviewed-by: Bryan Tan <bryantan@vmware.com>
Reviewed-by: Zack Rusin <zackr@vmware.com>
Link: https://lore.kernel.org/r/20221130070511.46558-1-vdasa@vmware.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/vmw_vmci/vmci_guest.c | 49 ++++++++++++------------------
1 file changed, 19 insertions(+), 30 deletions(-)
diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c
index aa7b05de97dd..4f8d962bb5b2 100644
--- a/drivers/misc/vmw_vmci/vmci_guest.c
+++ b/drivers/misc/vmw_vmci/vmci_guest.c
@@ -56,8 +56,6 @@ struct vmci_guest_device {
bool exclusive_vectors;
- struct tasklet_struct datagram_tasklet;
- struct tasklet_struct bm_tasklet;
struct wait_queue_head inout_wq;
void *data_buffer;
@@ -304,9 +302,8 @@ static int vmci_check_host_caps(struct pci_dev *pdev)
* This function assumes that it has exclusive access to the data
* in register(s) for the duration of the call.
*/
-static void vmci_dispatch_dgs(unsigned long data)
+static void vmci_dispatch_dgs(struct vmci_guest_device *vmci_dev)
{
- struct vmci_guest_device *vmci_dev = (struct vmci_guest_device *)data;
u8 *dg_in_buffer = vmci_dev->data_buffer;
struct vmci_datagram *dg;
size_t dg_in_buffer_size = VMCI_MAX_DG_SIZE;
@@ -465,10 +462,8 @@ static void vmci_dispatch_dgs(unsigned long data)
* Scans the notification bitmap for raised flags, clears them
* and handles the notifications.
*/
-static void vmci_process_bitmap(unsigned long data)
+static void vmci_process_bitmap(struct vmci_guest_device *dev)
{
- struct vmci_guest_device *dev = (struct vmci_guest_device *)data;
-
if (!dev->notification_bitmap) {
dev_dbg(dev->dev, "No bitmap present in %s\n", __func__);
return;
@@ -486,13 +481,13 @@ static irqreturn_t vmci_interrupt(int irq, void *_dev)
struct vmci_guest_device *dev = _dev;
/*
- * If we are using MSI-X with exclusive vectors then we simply schedule
- * the datagram tasklet, since we know the interrupt was meant for us.
+ * If we are using MSI-X with exclusive vectors then we simply call
+ * vmci_dispatch_dgs(), since we know the interrupt was meant for us.
* Otherwise we must read the ICR to determine what to do.
*/
if (dev->exclusive_vectors) {
- tasklet_schedule(&dev->datagram_tasklet);
+ vmci_dispatch_dgs(dev);
} else {
unsigned int icr;
@@ -502,12 +497,12 @@ static irqreturn_t vmci_interrupt(int irq, void *_dev)
return IRQ_NONE;
if (icr & VMCI_ICR_DATAGRAM) {
- tasklet_schedule(&dev->datagram_tasklet);
+ vmci_dispatch_dgs(dev);
icr &= ~VMCI_ICR_DATAGRAM;
}
if (icr & VMCI_ICR_NOTIFICATION) {
- tasklet_schedule(&dev->bm_tasklet);
+ vmci_process_bitmap(dev);
icr &= ~VMCI_ICR_NOTIFICATION;
}
@@ -536,7 +531,7 @@ static irqreturn_t vmci_interrupt_bm(int irq, void *_dev)
struct vmci_guest_device *dev = _dev;
/* For MSI-X we can just assume it was meant for us. */
- tasklet_schedule(&dev->bm_tasklet);
+ vmci_process_bitmap(dev);
return IRQ_HANDLED;
}
@@ -638,10 +633,6 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
vmci_dev->iobase = iobase;
vmci_dev->mmio_base = mmio_base;
- tasklet_init(&vmci_dev->datagram_tasklet,
- vmci_dispatch_dgs, (unsigned long)vmci_dev);
- tasklet_init(&vmci_dev->bm_tasklet,
- vmci_process_bitmap, (unsigned long)vmci_dev);
init_waitqueue_head(&vmci_dev->inout_wq);
if (mmio_base != NULL) {
@@ -808,8 +799,9 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
* Request IRQ for legacy or MSI interrupts, or for first
* MSI-X vector.
*/
- error = request_irq(pci_irq_vector(pdev, 0), vmci_interrupt,
- IRQF_SHARED, KBUILD_MODNAME, vmci_dev);
+ error = request_threaded_irq(pci_irq_vector(pdev, 0), NULL,
+ vmci_interrupt, IRQF_SHARED,
+ KBUILD_MODNAME, vmci_dev);
if (error) {
dev_err(&pdev->dev, "Irq %u in use: %d\n",
pci_irq_vector(pdev, 0), error);
@@ -823,9 +815,9 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
* between the vectors.
*/
if (vmci_dev->exclusive_vectors) {
- error = request_irq(pci_irq_vector(pdev, 1),
- vmci_interrupt_bm, 0, KBUILD_MODNAME,
- vmci_dev);
+ error = request_threaded_irq(pci_irq_vector(pdev, 1), NULL,
+ vmci_interrupt_bm, 0,
+ KBUILD_MODNAME, vmci_dev);
if (error) {
dev_err(&pdev->dev,
"Failed to allocate irq %u: %d\n",
@@ -833,9 +825,11 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
goto err_free_irq;
}
if (caps_in_use & VMCI_CAPS_DMA_DATAGRAM) {
- error = request_irq(pci_irq_vector(pdev, 2),
- vmci_interrupt_dma_datagram,
- 0, KBUILD_MODNAME, vmci_dev);
+ error = request_threaded_irq(pci_irq_vector(pdev, 2),
+ NULL,
+ vmci_interrupt_dma_datagram,
+ 0, KBUILD_MODNAME,
+ vmci_dev);
if (error) {
dev_err(&pdev->dev,
"Failed to allocate irq %u: %d\n",
@@ -871,8 +865,6 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
err_free_irq:
free_irq(pci_irq_vector(pdev, 0), vmci_dev);
- tasklet_kill(&vmci_dev->datagram_tasklet);
- tasklet_kill(&vmci_dev->bm_tasklet);
err_disable_msi:
pci_free_irq_vectors(pdev);
@@ -943,9 +935,6 @@ static void vmci_guest_remove_device(struct pci_dev *pdev)
free_irq(pci_irq_vector(pdev, 0), vmci_dev);
pci_free_irq_vectors(pdev);
- tasklet_kill(&vmci_dev->datagram_tasklet);
- tasklet_kill(&vmci_dev->bm_tasklet);
-
if (vmci_dev->notification_bitmap) {
/*
* The device reset above cleared the bitmap state of the
--
2.39.1
^ permalink raw reply related [flat|nested] 210+ messages in thread* [PATCH 6.1 132/193] ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 131/193] VMCI: Use threaded irqs instead of tasklets Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 133/193] ARM: omap1: fix !ARCH_OMAP1_ANY link failures Greg Kroah-Hartman
` (69 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski,
Dmitry Baryshkov, Bjorn Andersson
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 0154252a3b87f77db1e44516d1ed2e82e2d29c30 upstream.
While changing node names of APQ8084 SDHCI, the ones in IFC6540 board
were not updated leading to disabled and misconfigured SDHCI.
Cc: <stable@vger.kernel.org>
Fixes: 2477d81901a2 ("ARM: dts: qcom: Fix sdhci node names - use 'mmc@'")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221204084614.12193-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/qcom-apq8084-ifc6540.dts | 20 ++++++++++----------
arch/arm/boot/dts/qcom-apq8084.dtsi | 4 ++--
2 files changed, 12 insertions(+), 12 deletions(-)
--- a/arch/arm/boot/dts/qcom-apq8084-ifc6540.dts
+++ b/arch/arm/boot/dts/qcom-apq8084-ifc6540.dts
@@ -19,16 +19,16 @@
serial@f995e000 {
status = "okay";
};
+ };
+};
- sdhci@f9824900 {
- bus-width = <8>;
- non-removable;
- status = "okay";
- };
+&sdhc_1 {
+ bus-width = <8>;
+ non-removable;
+ status = "okay";
+};
- sdhci@f98a4900 {
- cd-gpios = <&tlmm 122 GPIO_ACTIVE_LOW>;
- bus-width = <4>;
- };
- };
+&sdhc_2 {
+ cd-gpios = <&tlmm 122 GPIO_ACTIVE_LOW>;
+ bus-width = <4>;
};
--- a/arch/arm/boot/dts/qcom-apq8084.dtsi
+++ b/arch/arm/boot/dts/qcom-apq8084.dtsi
@@ -419,7 +419,7 @@
status = "disabled";
};
- mmc@f9824900 {
+ sdhc_1: mmc@f9824900 {
compatible = "qcom,apq8084-sdhci", "qcom,sdhci-msm-v4";
reg = <0xf9824900 0x11c>, <0xf9824000 0x800>;
reg-names = "hc", "core";
@@ -432,7 +432,7 @@
status = "disabled";
};
- mmc@f98a4900 {
+ sdhc_2: mmc@f98a4900 {
compatible = "qcom,apq8084-sdhci", "qcom,sdhci-msm-v4";
reg = <0xf98a4900 0x11c>, <0xf98a4000 0x800>;
reg-names = "hc", "core";
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 133/193] ARM: omap1: fix !ARCH_OMAP1_ANY link failures
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 132/193] ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 134/193] drm/amdgpu: fix amdgpu_job_free_resources v2 Greg Kroah-Hartman
` (68 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aaro Koskinen, Arnd Bergmann
From: Arnd Bergmann <arnd@arndb.de>
commit 980a637d11fe8dfc734f508a422185c2de55e669 upstream.
While compile-testing randconfig builds for the upcoming boardfile
removal, I noticed that an earlier patch of mine was completely
broken, and the introduction of CONFIG_ARCH_OMAP1_ANY only replaced
one set of build failures with another one, now resulting in
link failures like
ld: drivers/video/fbdev/omap/omapfb_main.o: in function `omapfb_do_probe':
drivers/video/fbdev/omap/omapfb_main.c:1703: undefined reference to `omap_set_dma_priority'
ld: drivers/dma/ti/omap-dma.o: in function `omap_dma_free_chan_resources':
drivers/dma/ti/omap-dma.c:777: undefined reference to `omap_free_dma'
drivers/dma/ti/omap-dma.c:1685: undefined reference to `omap_get_plat_info'
ld: drivers/usb/gadget/udc/omap_udc.o: in function `next_in_dma':
drivers/usb/gadget/udc/omap_udc.c:820: undefined reference to `omap_get_dma_active_status'
I tried reworking it, but the resulting patch ended up much bigger than
simply avoiding the original problem of unused-function warnings like
arch/arm/mach-omap1/mcbsp.c:76:30: error: unused variable 'omap1_mcbsp_ops' [-Werror,-Wunused-variable]
As a result, revert the previous fix, and rearrange the code that
produces warnings to hide them. For mcbsp, the #ifdef check can
simply be removed as the cpu_is_omapxxx() checks already achieve
the same result, while in the io.c the easiest solution appears to
be to merge the common map bits into each soc specific portion.
This gets cleaned in a nicer way after omap7xx support gets dropped,
as the remaining SoCs all have the exact same I/O map.
Fixes: 615dce5bf736 ("ARM: omap1: fix build with no SoC selected")
Cc: stable@vger.kernel.org
Acked-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap1/Kconfig | 5 +----
arch/arm/mach-omap1/Makefile | 4 ----
arch/arm/mach-omap1/io.c | 32 +++++++++++++++-----------------
arch/arm/mach-omap1/mcbsp.c | 21 ---------------------
arch/arm/mach-omap1/pm.h | 7 -------
include/linux/soc/ti/omap1-io.h | 4 ++--
6 files changed, 18 insertions(+), 55 deletions(-)
--- a/arch/arm/mach-omap1/Kconfig
+++ b/arch/arm/mach-omap1/Kconfig
@@ -4,6 +4,7 @@ menuconfig ARCH_OMAP1
depends on ARCH_MULTI_V4T || ARCH_MULTI_V5
depends on CPU_LITTLE_ENDIAN
depends on ATAGS
+ select ARCH_OMAP
select ARCH_HAS_HOLES_MEMORYMODEL
select ARCH_OMAP
select CLKSRC_MMIO
@@ -45,10 +46,6 @@ config ARCH_OMAP16XX
select CPU_ARM926T
select OMAP_DM_TIMER
-config ARCH_OMAP1_ANY
- select ARCH_OMAP
- def_bool ARCH_OMAP730 || ARCH_OMAP850 || ARCH_OMAP15XX || ARCH_OMAP16XX
-
config ARCH_OMAP
bool
--- a/arch/arm/mach-omap1/Makefile
+++ b/arch/arm/mach-omap1/Makefile
@@ -3,8 +3,6 @@
# Makefile for the linux kernel.
#
-ifdef CONFIG_ARCH_OMAP1_ANY
-
# Common support
obj-y := io.o id.o sram-init.o sram.o time.o irq.o mux.o flash.o \
serial.o devices.o dma.o omap-dma.o fb.o
@@ -59,5 +57,3 @@ obj-$(CONFIG_ARCH_OMAP730) += gpio7xx.o
obj-$(CONFIG_ARCH_OMAP850) += gpio7xx.o
obj-$(CONFIG_ARCH_OMAP15XX) += gpio15xx.o
obj-$(CONFIG_ARCH_OMAP16XX) += gpio16xx.o
-
-endif
--- a/arch/arm/mach-omap1/io.c
+++ b/arch/arm/mach-omap1/io.c
@@ -22,17 +22,14 @@
* The machine specific code may provide the extra mapping besides the
* default mapping provided here.
*/
-static struct map_desc omap_io_desc[] __initdata = {
+#if defined (CONFIG_ARCH_OMAP730) || defined (CONFIG_ARCH_OMAP850)
+static struct map_desc omap7xx_io_desc[] __initdata = {
{
.virtual = OMAP1_IO_VIRT,
.pfn = __phys_to_pfn(OMAP1_IO_PHYS),
.length = OMAP1_IO_SIZE,
.type = MT_DEVICE
- }
-};
-
-#if defined (CONFIG_ARCH_OMAP730) || defined (CONFIG_ARCH_OMAP850)
-static struct map_desc omap7xx_io_desc[] __initdata = {
+ },
{
.virtual = OMAP7XX_DSP_BASE,
.pfn = __phys_to_pfn(OMAP7XX_DSP_START),
@@ -50,6 +47,12 @@ static struct map_desc omap7xx_io_desc[]
#ifdef CONFIG_ARCH_OMAP15XX
static struct map_desc omap1510_io_desc[] __initdata = {
{
+ .virtual = OMAP1_IO_VIRT,
+ .pfn = __phys_to_pfn(OMAP1_IO_PHYS),
+ .length = OMAP1_IO_SIZE,
+ .type = MT_DEVICE
+ },
+ {
.virtual = OMAP1510_DSP_BASE,
.pfn = __phys_to_pfn(OMAP1510_DSP_START),
.length = OMAP1510_DSP_SIZE,
@@ -66,6 +69,12 @@ static struct map_desc omap1510_io_desc[
#if defined(CONFIG_ARCH_OMAP16XX)
static struct map_desc omap16xx_io_desc[] __initdata = {
{
+ .virtual = OMAP1_IO_VIRT,
+ .pfn = __phys_to_pfn(OMAP1_IO_PHYS),
+ .length = OMAP1_IO_SIZE,
+ .type = MT_DEVICE
+ },
+ {
.virtual = OMAP16XX_DSP_BASE,
.pfn = __phys_to_pfn(OMAP16XX_DSP_START),
.length = OMAP16XX_DSP_SIZE,
@@ -79,18 +88,9 @@ static struct map_desc omap16xx_io_desc[
};
#endif
-/*
- * Maps common IO regions for omap1
- */
-static void __init omap1_map_common_io(void)
-{
- iotable_init(omap_io_desc, ARRAY_SIZE(omap_io_desc));
-}
-
#if defined (CONFIG_ARCH_OMAP730) || defined (CONFIG_ARCH_OMAP850)
void __init omap7xx_map_io(void)
{
- omap1_map_common_io();
iotable_init(omap7xx_io_desc, ARRAY_SIZE(omap7xx_io_desc));
}
#endif
@@ -98,7 +98,6 @@ void __init omap7xx_map_io(void)
#ifdef CONFIG_ARCH_OMAP15XX
void __init omap15xx_map_io(void)
{
- omap1_map_common_io();
iotable_init(omap1510_io_desc, ARRAY_SIZE(omap1510_io_desc));
}
#endif
@@ -106,7 +105,6 @@ void __init omap15xx_map_io(void)
#if defined(CONFIG_ARCH_OMAP16XX)
void __init omap16xx_map_io(void)
{
- omap1_map_common_io();
iotable_init(omap16xx_io_desc, ARRAY_SIZE(omap16xx_io_desc));
}
#endif
--- a/arch/arm/mach-omap1/mcbsp.c
+++ b/arch/arm/mach-omap1/mcbsp.c
@@ -89,7 +89,6 @@ static struct omap_mcbsp_ops omap1_mcbsp
#define OMAP1610_MCBSP2_BASE 0xfffb1000
#define OMAP1610_MCBSP3_BASE 0xe1017000
-#if defined(CONFIG_ARCH_OMAP730) || defined(CONFIG_ARCH_OMAP850)
struct resource omap7xx_mcbsp_res[][6] = {
{
{
@@ -159,14 +158,7 @@ static struct omap_mcbsp_platform_data o
};
#define OMAP7XX_MCBSP_RES_SZ ARRAY_SIZE(omap7xx_mcbsp_res[1])
#define OMAP7XX_MCBSP_COUNT ARRAY_SIZE(omap7xx_mcbsp_res)
-#else
-#define omap7xx_mcbsp_res_0 NULL
-#define omap7xx_mcbsp_pdata NULL
-#define OMAP7XX_MCBSP_RES_SZ 0
-#define OMAP7XX_MCBSP_COUNT 0
-#endif
-#ifdef CONFIG_ARCH_OMAP15XX
struct resource omap15xx_mcbsp_res[][6] = {
{
{
@@ -266,14 +258,7 @@ static struct omap_mcbsp_platform_data o
};
#define OMAP15XX_MCBSP_RES_SZ ARRAY_SIZE(omap15xx_mcbsp_res[1])
#define OMAP15XX_MCBSP_COUNT ARRAY_SIZE(omap15xx_mcbsp_res)
-#else
-#define omap15xx_mcbsp_res_0 NULL
-#define omap15xx_mcbsp_pdata NULL
-#define OMAP15XX_MCBSP_RES_SZ 0
-#define OMAP15XX_MCBSP_COUNT 0
-#endif
-#ifdef CONFIG_ARCH_OMAP16XX
struct resource omap16xx_mcbsp_res[][6] = {
{
{
@@ -373,12 +358,6 @@ static struct omap_mcbsp_platform_data o
};
#define OMAP16XX_MCBSP_RES_SZ ARRAY_SIZE(omap16xx_mcbsp_res[1])
#define OMAP16XX_MCBSP_COUNT ARRAY_SIZE(omap16xx_mcbsp_res)
-#else
-#define omap16xx_mcbsp_res_0 NULL
-#define omap16xx_mcbsp_pdata NULL
-#define OMAP16XX_MCBSP_RES_SZ 0
-#define OMAP16XX_MCBSP_COUNT 0
-#endif
static void omap_mcbsp_register_board_cfg(struct resource *res, int res_count,
struct omap_mcbsp_platform_data *config, int size)
--- a/arch/arm/mach-omap1/pm.h
+++ b/arch/arm/mach-omap1/pm.h
@@ -106,13 +106,6 @@
#define OMAP7XX_IDLECT3 0xfffece24
#define OMAP7XX_IDLE_LOOP_REQUEST 0x0C00
-#if !defined(CONFIG_ARCH_OMAP730) && \
- !defined(CONFIG_ARCH_OMAP850) && \
- !defined(CONFIG_ARCH_OMAP15XX) && \
- !defined(CONFIG_ARCH_OMAP16XX)
-#warning "Power management for this processor not implemented yet"
-#endif
-
#ifndef __ASSEMBLER__
#include <linux/clk.h>
--- a/include/linux/soc/ti/omap1-io.h
+++ b/include/linux/soc/ti/omap1-io.h
@@ -5,7 +5,7 @@
#ifndef __ASSEMBLER__
#include <linux/types.h>
-#ifdef CONFIG_ARCH_OMAP1_ANY
+#ifdef CONFIG_ARCH_OMAP1
/*
* NOTE: Please use ioremap + __raw_read/write where possible instead of these
*/
@@ -15,7 +15,7 @@ extern u32 omap_readl(u32 pa);
extern void omap_writeb(u8 v, u32 pa);
extern void omap_writew(u16 v, u32 pa);
extern void omap_writel(u32 v, u32 pa);
-#else
+#elif defined(CONFIG_COMPILE_TEST)
static inline u8 omap_readb(u32 pa) { return 0; }
static inline u16 omap_readw(u32 pa) { return 0; }
static inline u32 omap_readl(u32 pa) { return 0; }
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 134/193] drm/amdgpu: fix amdgpu_job_free_resources v2
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 133/193] ARM: omap1: fix !ARCH_OMAP1_ANY link failures Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 135/193] drm/amdgpu: allow multipipe policy on ASICs with one MEC Greg Kroah-Hartman
` (67 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian König, Alex Deucher
From: Christian König <christian.koenig@amd.com>
commit 74ea8e78ab349514c9f4df0be1189d91267d750d upstream.
It can be that neither fence were initialized when we run out of UVD
streams for example.
v2: fix typo breaking compile
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2324
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.1.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
@@ -154,8 +154,14 @@ void amdgpu_job_free_resources(struct am
struct dma_fence *f;
unsigned i;
- /* use sched fence if available */
- f = job->base.s_fence ? &job->base.s_fence->finished : &job->hw_fence;
+ /* Check if any fences where initialized */
+ if (job->base.s_fence && job->base.s_fence->finished.ops)
+ f = &job->base.s_fence->finished;
+ else if (job->hw_fence.ops)
+ f = &job->hw_fence;
+ else
+ f = NULL;
+
for (i = 0; i < job->num_ibs; ++i)
amdgpu_ib_free(ring->adev, &job->ibs[i], f);
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 135/193] drm/amdgpu: allow multipipe policy on ASICs with one MEC
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 134/193] drm/amdgpu: fix amdgpu_job_free_resources v2 Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 136/193] drm/amdgpu: Correct the power calcultion for Renior/Cezanne Greg Kroah-Hartman
` (66 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lang Yu, Aaron Liu, Yifan Zhang,
Alex Deucher
From: Lang Yu <Lang.Yu@amd.com>
commit dc88063b87775971be564d79dc1b05f7b8b5c135 upstream.
Always enable multipipe policy on ASICs with GC VERSION > 9.0.0
instead of MEC number > 1.
This will allow multipipe policy on ASICs with one MEC,
e.g., gfx11 APUs.
Signed-off-by: Lang Yu <Lang.Yu@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.1.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -156,6 +156,9 @@ static bool amdgpu_gfx_is_compute_multip
return amdgpu_compute_multipipe == 1;
}
+ if (adev->ip_versions[GC_HWIP][0] > IP_VERSION(9, 0, 0))
+ return true;
+
/* FIXME: spreading the queues across pipes causes perf regressions
* on POLARIS11 compute workloads */
if (adev->asic_type == CHIP_POLARIS11)
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 136/193] drm/amdgpu: Correct the power calcultion for Renior/Cezanne.
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 135/193] drm/amdgpu: allow multipipe policy on ASICs with one MEC Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 137/193] drm/i915: re-disable RC6p on Sandy Bridge Greg Kroah-Hartman
` (65 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Jesse Zhang, Aaron Liu
From: jie1zhan <jesse.zhang@amd.com>
commit c7bae4aaa5609c1fa9761c35dbcc5fcc92915222 upstream.
>From smu firmware,the value of power is transferred in units of watts.
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2321
Fixes: 137aac26a2ed ("drm/amdgpu/smu12: fix power reporting on renoir")
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c
@@ -1171,6 +1171,7 @@ static int renoir_get_smu_metrics_data(s
int ret = 0;
uint32_t apu_percent = 0;
uint32_t dgpu_percent = 0;
+ struct amdgpu_device *adev = smu->adev;
ret = smu_cmn_get_metrics_table(smu,
@@ -1196,7 +1197,11 @@ static int renoir_get_smu_metrics_data(s
*value = metrics->AverageUvdActivity / 100;
break;
case METRICS_AVERAGE_SOCKETPOWER:
- *value = (metrics->CurrentSocketPower << 8) / 1000;
+ if (((adev->ip_versions[MP1_HWIP][0] == IP_VERSION(12, 0, 1)) && (adev->pm.fw_version >= 0x40000f)) ||
+ ((adev->ip_versions[MP1_HWIP][0] == IP_VERSION(12, 0, 0)) && (adev->pm.fw_version >= 0x373200)))
+ *value = metrics->CurrentSocketPower << 8;
+ else
+ *value = (metrics->CurrentSocketPower << 8) / 1000;
break;
case METRICS_TEMPERATURE_EDGE:
*value = (metrics->GfxTemperature / 100) *
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 137/193] drm/i915: re-disable RC6p on Sandy Bridge
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 136/193] drm/amdgpu: Correct the power calcultion for Renior/Cezanne Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 138/193] drm/i915/display: Check source height is > 0 Greg Kroah-Hartman
` (64 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sasa Dragic, Ville Syrjälä,
Rodrigo Vivi
From: Sasa Dragic <sasa.dragic@gmail.com>
commit 67b0b4ed259e425b7eed09da75b42c80682ca003 upstream.
RC6p on Sandy Bridge got re-enabled over time, causing visual glitches
and GPU hangs.
Disabled originally in commit 1c8ecf80fdee ("drm/i915: do not enable
RC6p on Sandy Bridge").
Signed-off-by: Sasa Dragic <sasa.dragic@gmail.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221219172927.9603-2-sasa.dragic@gmail.com
Fixes: fb6db0f5bf1d ("drm/i915: Remove unsafe i915.enable_rc6")
Fixes: 13c5a577b342 ("drm/i915/gt: Select the deepest available parking mode for rc6")
Cc: stable@vger.kernel.org
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
(cherry picked from commit 0c8a6e9ea232c221976a0670256bd861408d9917)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -423,7 +423,8 @@ static const struct intel_device_info il
.has_coherent_ggtt = true, \
.has_llc = 1, \
.has_rc6 = 1, \
- .has_rc6p = 1, \
+ /* snb does support rc6p, but enabling it causes various issues */ \
+ .has_rc6p = 0, \
.has_rps = true, \
.dma_mask_size = 40, \
.__runtime.ppgtt_type = INTEL_PPGTT_ALIASING, \
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 138/193] drm/i915/display: Check source height is > 0
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 137/193] drm/i915: re-disable RC6p on Sandy Bridge Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [Intel-gfx] " Greg Kroah-Hartman
` (63 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Drew Davenport,
Ville Syrjälä,
Rodrigo Vivi
From: Drew Davenport <ddavenport@chromium.org>
commit 8565c502e7c156d190d8e6d36e443f51b257f165 upstream.
The error message suggests that the height of the src rect must be at
least 1. Reject source with height of 0.
Cc: stable@vger.kernel.org
Signed-off-by: Drew Davenport <ddavenport@chromium.org>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221226225246.1.I15dff7bb5a0e485c862eae61a69096caf12ef29f@changeid
(cherry picked from commit 0fe76b198d482b41771a8d17b45fb726d13083cf)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/skl_universal_plane.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/display/skl_universal_plane.c
+++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c
@@ -1620,7 +1620,7 @@ static int skl_check_main_surface(struct
u32 offset;
int ret;
- if (w > max_width || w < min_width || h > max_height) {
+ if (w > max_width || w < min_width || h > max_height || h < 1) {
drm_dbg_kms(&dev_priv->drm,
"requested Y/RGB source size %dx%d outside limits (min: %dx1 max: %dx%d)\n",
w, h, min_width, max_width, max_height);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 139/193] drm/i915: Allow switching away via vga-switcheroo if uninitialized
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:02 ` [PATCH 6.1 002/193] btrfs: fix trace event name typo for FLUSH_DELAYED_REFS Greg Kroah-Hartman
` (200 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Alex Deucher,
Radhakrishna Sripada, Lucas De Marchi,
José Roberto de Souza, Jani Nikula, Ville Syrjälä,
Jani Nikula, Joonas Lahtinen, Rodrigo Vivi, Tvrtko Ursulin,
Manasi Navare, Stanislav Lisovskiy, Imre Deak,
Jouni Högander, Uma Shankar, Ankit Nautiyal,
Jason A. Donenfeld, Matt Roper, Ramalingam C, Andi Shyti,
Andrzej Hajda, Julia Lawall, intel-gfx
From: Thomas Zimmermann <tzimmermann@suse.de>
commit a273e95721e96885971a05f1b34cb6d093904d9d upstream.
Always allow switching away via vga-switcheroo if the display is
uninitalized. Instead prevent switching to i915 if the device has
not been initialized.
This issue was introduced by commit 5df7bd130818 ("drm/i915: skip
display initialization when there is no display") protected, which
protects code paths from being executed on uninitialized devices.
In the case of vga-switcheroo, we want to allow a switch away from
i915's device. So run vga_switcheroo_process_delayed_switch() and
test in the switcheroo callbacks if the i915 device is available.
Fixes: 5df7bd130818 ("drm/i915: skip display initialization when there is no display")
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Cc: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: José Roberto de Souza <jose.souza@intel.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Cc: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
Cc: Manasi Navare <manasi.d.navare@intel.com>
Cc: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: "Jouni Högander" <jouni.hogander@intel.com>
Cc: Uma Shankar <uma.shankar@intel.com>
Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: Ramalingam C <ramalingam.c@intel.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Andi Shyti <andi.shyti@linux.intel.com>
Cc: Andrzej Hajda <andrzej.hajda@intel.com>
Cc: "José Roberto de Souza" <jose.souza@intel.com>
Cc: Julia Lawall <Julia.Lawall@inria.fr>
Cc: intel-gfx@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v5.14+
Link: https://patchwork.freedesktop.org/patch/msgid/20230116115425.13484-2-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_driver.c | 3 +--
drivers/gpu/drm/i915/i915_switcheroo.c | 6 +++++-
2 files changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/i915/i915_driver.c
+++ b/drivers/gpu/drm/i915/i915_driver.c
@@ -1074,8 +1074,7 @@ static void i915_driver_lastclose(struct
intel_fbdev_restore_mode(dev);
- if (HAS_DISPLAY(i915))
- vga_switcheroo_process_delayed_switch();
+ vga_switcheroo_process_delayed_switch();
}
static void i915_driver_postclose(struct drm_device *dev, struct drm_file *file)
--- a/drivers/gpu/drm/i915/i915_switcheroo.c
+++ b/drivers/gpu/drm/i915/i915_switcheroo.c
@@ -19,6 +19,10 @@ static void i915_switcheroo_set_state(st
dev_err(&pdev->dev, "DRM not initialized, aborting switch.\n");
return;
}
+ if (!HAS_DISPLAY(i915)) {
+ dev_err(&pdev->dev, "Device state not initialized, aborting switch.\n");
+ return;
+ }
if (state == VGA_SWITCHEROO_ON) {
drm_info(&i915->drm, "switched on\n");
@@ -44,7 +48,7 @@ static bool i915_switcheroo_can_switch(s
* locking inversion with the driver load path. And the access here is
* completely racy anyway. So don't bother with locking for now.
*/
- return i915 && atomic_read(&i915->drm.open_count) == 0;
+ return i915 && HAS_DISPLAY(i915) && atomic_read(&i915->drm.open_count) == 0;
}
static const struct vga_switcheroo_client_ops i915_switcheroo_ops = {
^ permalink raw reply [flat|nested] 210+ messages in thread* [Intel-gfx] [PATCH 6.1 139/193] drm/i915: Allow switching away via vga-switcheroo if uninitialized
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
0 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Jason A. Donenfeld, Ramalingam C, Andrzej Hajda, Julia Lawall,
Jani Nikula, intel-gfx, Lucas De Marchi, Rodrigo Vivi,
Greg Kroah-Hartman, patches, Thomas Zimmermann, Alex Deucher
From: Thomas Zimmermann <tzimmermann@suse.de>
commit a273e95721e96885971a05f1b34cb6d093904d9d upstream.
Always allow switching away via vga-switcheroo if the display is
uninitalized. Instead prevent switching to i915 if the device has
not been initialized.
This issue was introduced by commit 5df7bd130818 ("drm/i915: skip
display initialization when there is no display") protected, which
protects code paths from being executed on uninitialized devices.
In the case of vga-switcheroo, we want to allow a switch away from
i915's device. So run vga_switcheroo_process_delayed_switch() and
test in the switcheroo callbacks if the i915 device is available.
Fixes: 5df7bd130818 ("drm/i915: skip display initialization when there is no display")
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Cc: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: José Roberto de Souza <jose.souza@intel.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Cc: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
Cc: Manasi Navare <manasi.d.navare@intel.com>
Cc: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: "Jouni Högander" <jouni.hogander@intel.com>
Cc: Uma Shankar <uma.shankar@intel.com>
Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: Ramalingam C <ramalingam.c@intel.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Andi Shyti <andi.shyti@linux.intel.com>
Cc: Andrzej Hajda <andrzej.hajda@intel.com>
Cc: "José Roberto de Souza" <jose.souza@intel.com>
Cc: Julia Lawall <Julia.Lawall@inria.fr>
Cc: intel-gfx@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v5.14+
Link: https://patchwork.freedesktop.org/patch/msgid/20230116115425.13484-2-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_driver.c | 3 +--
drivers/gpu/drm/i915/i915_switcheroo.c | 6 +++++-
2 files changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/i915/i915_driver.c
+++ b/drivers/gpu/drm/i915/i915_driver.c
@@ -1074,8 +1074,7 @@ static void i915_driver_lastclose(struct
intel_fbdev_restore_mode(dev);
- if (HAS_DISPLAY(i915))
- vga_switcheroo_process_delayed_switch();
+ vga_switcheroo_process_delayed_switch();
}
static void i915_driver_postclose(struct drm_device *dev, struct drm_file *file)
--- a/drivers/gpu/drm/i915/i915_switcheroo.c
+++ b/drivers/gpu/drm/i915/i915_switcheroo.c
@@ -19,6 +19,10 @@ static void i915_switcheroo_set_state(st
dev_err(&pdev->dev, "DRM not initialized, aborting switch.\n");
return;
}
+ if (!HAS_DISPLAY(i915)) {
+ dev_err(&pdev->dev, "Device state not initialized, aborting switch.\n");
+ return;
+ }
if (state == VGA_SWITCHEROO_ON) {
drm_info(&i915->drm, "switched on\n");
@@ -44,7 +48,7 @@ static bool i915_switcheroo_can_switch(s
* locking inversion with the driver load path. And the access here is
* completely racy anyway. So don't bother with locking for now.
*/
- return i915 && atomic_read(&i915->drm.open_count) == 0;
+ return i915 && HAS_DISPLAY(i915) && atomic_read(&i915->drm.open_count) == 0;
}
static const struct vga_switcheroo_client_ops i915_switcheroo_ops = {
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 6.1 140/193] drm/i915: Remove unused variable
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2023-01-22 15:04 ` [Intel-gfx] " Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 141/193] drm/amd/display: Fix set scaling doesns work Greg Kroah-Hartman
` (61 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nirmoy Das, Rodrigo Vivi
From: Nirmoy Das <nirmoy.das@intel.com>
commit 2293a73ad4f3b6c37c06713ff1b67659d92ef43d upstream.
Removed unused i915 var.
Fixes: a273e95721e9 ("drm/i915: Allow switching away via vga-switcheroo if uninitialized")
Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230118170624.9326-1-nirmoy.das@intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_driver.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/gpu/drm/i915/i915_driver.c
+++ b/drivers/gpu/drm/i915/i915_driver.c
@@ -1070,8 +1070,6 @@ static int i915_driver_open(struct drm_d
*/
static void i915_driver_lastclose(struct drm_device *dev)
{
- struct drm_i915_private *i915 = to_i915(dev);
-
intel_fbdev_restore_mode(dev);
vga_switcheroo_process_delayed_switch();
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 141/193] drm/amd/display: Fix set scaling doesns work
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 140/193] drm/i915: Remove unused variable Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 142/193] drm/amd/display: Calculate output_color_space after pixel encoding adjustment Greg Kroah-Hartman
` (60 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harry Wentland, Rodrigo Siqueira,
hongao, Alex Deucher
From: hongao <hongao@uniontech.com>
commit 040625ab82ce6dca7772cb3867fe5c9eb279a344 upstream.
[Why]
Setting scaling does not correctly update CRTC state. As a result
dc stream state's src (composition area) && dest (addressable area)
was not calculated as expected. This causes set scaling doesn's work.
[How]
Correctly update CRTC state when setting scaling property.
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Tested-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: hongao <hongao@uniontech.com>
Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -9433,8 +9433,8 @@ static int amdgpu_dm_atomic_check(struct
goto fail;
}
- if (dm_old_con_state->abm_level !=
- dm_new_con_state->abm_level)
+ if (dm_old_con_state->abm_level != dm_new_con_state->abm_level ||
+ dm_old_con_state->scaling != dm_new_con_state->scaling)
new_crtc_state->connectors_changed = true;
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 142/193] drm/amd/display: Calculate output_color_space after pixel encoding adjustment
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 141/193] drm/amd/display: Fix set scaling doesns work Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 143/193] drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix Greg Kroah-Hartman
` (59 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Melissa Wen, Joshua Ashton, Alex Deucher
From: Joshua Ashton <joshua@froggi.es>
commit 79601b894849cb6f6d6122e6590f1887ac4a66b3 upstream.
Code in get_output_color_space depends on knowing the pixel encoding to
determine whether to pick between eg. COLOR_SPACE_SRGB or
COLOR_SPACE_YCBCR709 for transparent RGB -> YCbCr 4:4:4 in the driver.
v2: Fixed patch being accidentally based on a personal feature branch, oops!
Fixes: ea117312ea9f ("drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded")
Reviewed-by: Melissa Wen <mwen@igalia.com>
Signed-off-by: Joshua Ashton <joshua@froggi.es>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5283,8 +5283,6 @@ static void fill_stream_properties_from_
timing_out->aspect_ratio = get_aspect_ratio(mode_in);
- stream->output_color_space = get_output_color_space(timing_out);
-
stream->out_transfer_func->type = TF_TYPE_PREDEFINED;
stream->out_transfer_func->tf = TRANSFER_FUNCTION_SRGB;
if (stream->signal == SIGNAL_TYPE_HDMI_TYPE_A) {
@@ -5295,6 +5293,8 @@ static void fill_stream_properties_from_
adjust_colour_depth_from_display_info(timing_out, info);
}
}
+
+ stream->output_color_space = get_output_color_space(timing_out);
}
static void fill_audio_info(struct audio_info *audio_info,
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 143/193] drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 142/193] drm/amd/display: Calculate output_color_space after pixel encoding adjustment Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 144/193] drm/amd/display: disable S/G display on DCN 3.1.5 Greg Kroah-Hartman
` (58 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Melissa Wen, Joshua Ashton, Alex Deucher
From: Joshua Ashton <joshua@froggi.es>
commit 973a9c810c785ac270a6d50d8cf862b0c1643a10 upstream.
The YCC conversion matrix for RGB -> COLOR_SPACE_YCBCR2020_TYPE is
missing the values for the fourth column of the matrix.
The fourth column of the matrix is essentially just a value that is
added given that the color is 3 components in size.
These values are needed to bias the chroma from the [-1, 1] -> [0, 1]
range.
This fixes color being very green when using Gamescope HDR on HDMI
output which prefers YCC 4:4:4.
Fixes: 40df2f809e8f ("drm/amd/display: color space ycbcr709 support")
Reviewed-by: Melissa Wen <mwen@igalia.com>
Signed-off-by: Joshua Ashton <joshua@froggi.es>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
@@ -90,8 +90,8 @@ static const struct out_csc_color_matrix
{ 0xE00, 0xF349, 0xFEB7, 0x1000, 0x6CE, 0x16E3,
0x24F, 0x200, 0xFCCB, 0xF535, 0xE00, 0x1000} },
{ COLOR_SPACE_YCBCR2020_TYPE,
- { 0x1000, 0xF149, 0xFEB7, 0x0000, 0x0868, 0x15B2,
- 0x01E6, 0x0000, 0xFB88, 0xF478, 0x1000, 0x0000} },
+ { 0x1000, 0xF149, 0xFEB7, 0x1004, 0x0868, 0x15B2,
+ 0x01E6, 0x201, 0xFB88, 0xF478, 0x1000, 0x1004} },
{ COLOR_SPACE_YCBCR709_BLACK_TYPE,
{ 0x0000, 0x0000, 0x0000, 0x1000, 0x0000, 0x0000,
0x0000, 0x0200, 0x0000, 0x0000, 0x0000, 0x1000} },
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 144/193] drm/amd/display: disable S/G display on DCN 3.1.5
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 143/193] drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 145/193] drm/amd/display: disable S/G display on DCN 3.1.4 Greg Kroah-Hartman
` (57 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, roman.li, yifan1.zhang,
Christian König, Alex Deucher
From: Alex Deucher <alexander.deucher@amd.com>
commit e78cc6a4c7486f50c2786d91dd7d9649a87d1dcb upstream.
Causes flickering or white screens in some configurations.
Disable it for now until we can fix the issue.
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2354
Cc: roman.li@amd.com
Cc: yifan1.zhang@amd.com
Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.1.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1513,7 +1513,6 @@ static int amdgpu_dm_init(struct amdgpu_
case IP_VERSION(3, 1, 2):
case IP_VERSION(3, 1, 3):
case IP_VERSION(3, 1, 4):
- case IP_VERSION(3, 1, 5):
case IP_VERSION(3, 1, 6):
init_data.flags.gpu_vm_support = true;
break;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 145/193] drm/amd/display: disable S/G display on DCN 3.1.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 144/193] drm/amd/display: disable S/G display on DCN 3.1.5 Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 146/193] cifs: reduce roundtrips on create/qinfo requests Greg Kroah-Hartman
` (56 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, roman.li, yifan1.zhang,
Christian König, Roman Li, Alex Deucher
From: Alex Deucher <alexander.deucher@amd.com>
commit a52287d66dfa1cca32e6273623b63ba39d87f126 upstream.
Causes flickering or white screens in some configurations.
Disable it for now until we can fix the issue.
Cc: roman.li@amd.com
Cc: yifan1.zhang@amd.com
Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Roman Li <Roman.Li@amd.com>
Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.1.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1512,7 +1512,6 @@ static int amdgpu_dm_init(struct amdgpu_
case IP_VERSION(3, 0, 1):
case IP_VERSION(3, 1, 2):
case IP_VERSION(3, 1, 3):
- case IP_VERSION(3, 1, 4):
case IP_VERSION(3, 1, 6):
init_data.flags.gpu_vm_support = true;
break;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 146/193] cifs: reduce roundtrips on create/qinfo requests
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 145/193] drm/amd/display: disable S/G display on DCN 3.1.4 Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 147/193] fs/ntfs3: Fix attr_punch_hole() null pointer derenference Greg Kroah-Hartman
` (55 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (SUSE), Steve French
From: Paulo Alcantara <pc@cjr.nz>
commit c877ce47e1378dbafa6f1bf84c0c83a05ca8972a upstream.
To work around some Window servers that return
STATUS_OBJECT_NAME_INVALID on query infos under DFS namespaces that
contain non-ASCII characters, we started checking for -ENOENT on every
file open, and if so, then send additional requests to figure out
whether it is a DFS link or not. It means that all those requests
will be sent to every non-existing file.
So, in order to reduce the number of roundtrips, check earlier whether
status code is STATUS_OBJECT_NAME_INVALID and tcon supports dfs, and
if so, then map -ENOENT to -EREMOTE so mount or automount will take
care of chasing the DFS link -- if it isn't an DFS link, then -ENOENT
will be returned appropriately.
Before patch
SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request...
SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;...
SMB2 228 Ioctl Request FSCTL_DFS_GET_REFERRALS, File: \ada.test\dfs\foo
SMB2 143 Ioctl Response, Error: STATUS_OBJECT_PATH_NOT_FOUND
SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request...
SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;...
SMB2 228 Ioctl Request FSCTL_DFS_GET_REFERRALS, File: \ada.test\dfs\foo
SMB2 143 Ioctl Response, Error: STATUS_OBJECT_PATH_NOT_FOUND
After patch
SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request...
SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;...
SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request...
SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;...
Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/connect.c | 16 ----------------
fs/cifs/inode.c | 6 ------
fs/cifs/misc.c | 45 ---------------------------------------------
fs/cifs/smb2inode.c | 45 ++++++++++++++++++++++++++++++++-------------
fs/cifs/smb2ops.c | 28 ++++++++++++++++++++++++----
5 files changed, 56 insertions(+), 84 deletions(-)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -3554,9 +3554,6 @@ static int is_path_remote(struct mount_c
struct cifs_tcon *tcon = mnt_ctx->tcon;
struct smb3_fs_context *ctx = mnt_ctx->fs_ctx;
char *full_path;
-#ifdef CONFIG_CIFS_DFS_UPCALL
- bool nodfs = cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS;
-#endif
if (!server->ops->is_path_accessible)
return -EOPNOTSUPP;
@@ -3573,19 +3570,6 @@ static int is_path_remote(struct mount_c
rc = server->ops->is_path_accessible(xid, tcon, cifs_sb,
full_path);
-#ifdef CONFIG_CIFS_DFS_UPCALL
- if (nodfs) {
- if (rc == -EREMOTE)
- rc = -EOPNOTSUPP;
- goto out;
- }
-
- /* path *might* exist with non-ASCII characters in DFS root
- * try again with full path (only if nodfs is not set) */
- if (rc == -ENOENT && is_tcon_dfs(tcon))
- rc = cifs_dfs_query_info_nonascii_quirk(xid, tcon, cifs_sb,
- full_path);
-#endif
if (rc != 0 && rc != -EREMOTE)
goto out;
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -991,12 +991,6 @@ int cifs_get_inode_info(struct inode **i
}
rc = server->ops->query_path_info(xid, tcon, cifs_sb, full_path, &tmp_data,
&adjust_tz, &is_reparse_point);
-#ifdef CONFIG_CIFS_DFS_UPCALL
- if (rc == -ENOENT && is_tcon_dfs(tcon))
- rc = cifs_dfs_query_info_nonascii_quirk(xid, tcon,
- cifs_sb,
- full_path);
-#endif
data = &tmp_data;
}
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -1314,49 +1314,4 @@ int cifs_update_super_prepath(struct cif
cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
return 0;
}
-
-/** cifs_dfs_query_info_nonascii_quirk
- * Handle weird Windows SMB server behaviour. It responds with
- * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request
- * for "\<server>\<dfsname>\<linkpath>" DFS reference,
- * where <dfsname> contains non-ASCII unicode symbols.
- *
- * Check such DFS reference.
- */
-int cifs_dfs_query_info_nonascii_quirk(const unsigned int xid,
- struct cifs_tcon *tcon,
- struct cifs_sb_info *cifs_sb,
- const char *linkpath)
-{
- char *treename, *dfspath, sep;
- int treenamelen, linkpathlen, rc;
-
- treename = tcon->tree_name;
- /* MS-DFSC: All paths in REQ_GET_DFS_REFERRAL and RESP_GET_DFS_REFERRAL
- * messages MUST be encoded with exactly one leading backslash, not two
- * leading backslashes.
- */
- sep = CIFS_DIR_SEP(cifs_sb);
- if (treename[0] == sep && treename[1] == sep)
- treename++;
- linkpathlen = strlen(linkpath);
- treenamelen = strnlen(treename, MAX_TREE_SIZE + 1);
- dfspath = kzalloc(treenamelen + linkpathlen + 1, GFP_KERNEL);
- if (!dfspath)
- return -ENOMEM;
- if (treenamelen)
- memcpy(dfspath, treename, treenamelen);
- memcpy(dfspath + treenamelen, linkpath, linkpathlen);
- rc = dfs_cache_find(xid, tcon->ses, cifs_sb->local_nls,
- cifs_remap(cifs_sb), dfspath, NULL, NULL);
- if (rc == 0) {
- cifs_dbg(FYI, "DFS ref '%s' is found, emulate -EREMOTE\n",
- dfspath);
- rc = -EREMOTE;
- } else {
- cifs_dbg(FYI, "%s: dfs_cache_find returned %d\n", __func__, rc);
- }
- kfree(dfspath);
- return rc;
-}
#endif
--- a/fs/cifs/smb2inode.c
+++ b/fs/cifs/smb2inode.c
@@ -540,22 +540,41 @@ int smb2_query_path_info(const unsigned
rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, FILE_READ_ATTRIBUTES, FILE_OPEN,
create_options, ACL_NO_MODE, data, SMB2_OP_QUERY_INFO, cfile,
err_iov, err_buftype);
- if (rc == -EOPNOTSUPP) {
- if (err_iov[0].iov_base && err_buftype[0] != CIFS_NO_BUFFER &&
- ((struct smb2_hdr *)err_iov[0].iov_base)->Command == SMB2_CREATE &&
- ((struct smb2_hdr *)err_iov[0].iov_base)->Status == STATUS_STOPPED_ON_SYMLINK) {
- rc = smb2_parse_symlink_response(cifs_sb, err_iov, &data->symlink_target);
+ if (rc) {
+ struct smb2_hdr *hdr = err_iov[0].iov_base;
+
+ if (unlikely(!hdr || err_buftype[0] == CIFS_NO_BUFFER))
+ goto out;
+ if (rc == -EOPNOTSUPP && hdr->Command == SMB2_CREATE &&
+ hdr->Status == STATUS_STOPPED_ON_SYMLINK) {
+ rc = smb2_parse_symlink_response(cifs_sb, err_iov,
+ &data->symlink_target);
if (rc)
goto out;
- }
- *reparse = true;
- create_options |= OPEN_REPARSE_POINT;
- /* Failed on a symbolic link - query a reparse point info */
- cifs_get_readable_path(tcon, full_path, &cfile);
- rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, FILE_READ_ATTRIBUTES,
- FILE_OPEN, create_options, ACL_NO_MODE, data,
- SMB2_OP_QUERY_INFO, cfile, NULL, NULL);
+ *reparse = true;
+ create_options |= OPEN_REPARSE_POINT;
+
+ /* Failed on a symbolic link - query a reparse point info */
+ cifs_get_readable_path(tcon, full_path, &cfile);
+ rc = smb2_compound_op(xid, tcon, cifs_sb, full_path,
+ FILE_READ_ATTRIBUTES, FILE_OPEN,
+ create_options, ACL_NO_MODE, data,
+ SMB2_OP_QUERY_INFO, cfile, NULL, NULL);
+ goto out;
+ } else if (rc != -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) &&
+ hdr->Status == STATUS_OBJECT_NAME_INVALID) {
+ /*
+ * Handle weird Windows SMB server behaviour. It responds with
+ * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request
+ * for "\<server>\<dfsname>\<linkpath>" DFS reference,
+ * where <dfsname> contains non-ASCII unicode symbols.
+ */
+ rc = -EREMOTE;
+ }
+ if (rc == -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && cifs_sb &&
+ (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS))
+ rc = -EOPNOTSUPP;
}
out:
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -797,7 +797,9 @@ smb2_is_path_accessible(const unsigned i
int rc;
__le16 *utf16_path;
__u8 oplock = SMB2_OPLOCK_LEVEL_NONE;
+ int err_buftype = CIFS_NO_BUFFER;
struct cifs_open_parms oparms;
+ struct kvec err_iov = {};
struct cifs_fid fid;
struct cached_fid *cfid;
@@ -821,14 +823,32 @@ smb2_is_path_accessible(const unsigned i
oparms.fid = &fid;
oparms.reconnect = false;
- rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, NULL,
- NULL);
+ rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL,
+ &err_iov, &err_buftype);
if (rc) {
- kfree(utf16_path);
- return rc;
+ struct smb2_hdr *hdr = err_iov.iov_base;
+
+ if (unlikely(!hdr || err_buftype == CIFS_NO_BUFFER))
+ goto out;
+ /*
+ * Handle weird Windows SMB server behaviour. It responds with
+ * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request
+ * for "\<server>\<dfsname>\<linkpath>" DFS reference,
+ * where <dfsname> contains non-ASCII unicode symbols.
+ */
+ if (rc != -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) &&
+ hdr->Status == STATUS_OBJECT_NAME_INVALID)
+ rc = -EREMOTE;
+ if (rc == -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && cifs_sb &&
+ (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS))
+ rc = -EOPNOTSUPP;
+ goto out;
}
rc = SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid);
+
+out:
+ free_rsp_buf(err_buftype, err_iov.iov_base);
kfree(utf16_path);
return rc;
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 147/193] fs/ntfs3: Fix attr_punch_hole() null pointer derenference
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 146/193] cifs: reduce roundtrips on create/qinfo requests Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 148/193] arm64: efi: Execute runtime services from a dedicated stack Greg Kroah-Hartman
` (54 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alon Zahavi, Tal Lossos, Konstantin Komarov
From: Alon Zahavi <zahavi.alon@gmail.com>
commit 6d5c9e79b726cc473d40e9cb60976dbe8e669624 upstream.
The bug occours due to a misuse of `attr` variable instead of `attr_b`.
`attr` is being initialized as NULL, then being derenfernced
as `attr->res.data_size`.
This bug causes a crash of the ntfs3 driver itself,
If compiled directly to the kernel, it crashes the whole system.
Signed-off-by: Alon Zahavi <zahavi.alon@gmail.com>
Co-developed-by: Tal Lossos <tallossos@gmail.com>
Signed-off-by: Tal Lossos <tallossos@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/attrib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -2038,7 +2038,7 @@ int attr_punch_hole(struct ntfs_inode *n
return -ENOENT;
if (!attr_b->non_res) {
- u32 data_size = le32_to_cpu(attr->res.data_size);
+ u32 data_size = le32_to_cpu(attr_b->res.data_size);
u32 from, to;
if (vbo > data_size)
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 148/193] arm64: efi: Execute runtime services from a dedicated stack
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 147/193] fs/ntfs3: Fix attr_punch_hole() null pointer derenference Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 149/193] efi: rt-wrapper: Add missing include Greg Kroah-Hartman
` (53 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Lee Jones
From: Ard Biesheuvel <ardb@kernel.org>
commit ff7a167961d1b97e0e205f245f806e564d3505e7 upstream.
With the introduction of PRMT in the ACPI subsystem, the EFI rts
workqueue is no longer the only caller of efi_call_virt_pointer() in the
kernel. This means the EFI runtime services lock is no longer sufficient
to manage concurrent calls into firmware, but also that firmware calls
may occur that are not marshalled via the workqueue mechanism, but
originate directly from the caller context.
For added robustness, and to ensure that the runtime services have 8 KiB
of stack space available as per the EFI spec, introduce a spinlock
protected EFI runtime stack of 8 KiB, where the spinlock also ensures
serialization between the EFI rts workqueue (which itself serializes EFI
runtime calls) and other callers of efi_call_virt_pointer().
While at it, use the stack pivot to avoid reloading the shadow call
stack pointer from the ordinary stack, as doing so could produce a
gadget to defeat it.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/efi.h | 3 +++
arch/arm64/kernel/efi-rt-wrapper.S | 13 ++++++++++++-
arch/arm64/kernel/efi.c | 27 +++++++++++++++++++++++++++
3 files changed, 42 insertions(+), 1 deletion(-)
--- a/arch/arm64/include/asm/efi.h
+++ b/arch/arm64/include/asm/efi.h
@@ -25,6 +25,7 @@ int efi_set_mapping_permissions(struct m
({ \
efi_virtmap_load(); \
__efi_fpsimd_begin(); \
+ spin_lock(&efi_rt_lock); \
})
#undef arch_efi_call_virt
@@ -33,10 +34,12 @@ int efi_set_mapping_permissions(struct m
#define arch_efi_call_virt_teardown() \
({ \
+ spin_unlock(&efi_rt_lock); \
__efi_fpsimd_end(); \
efi_virtmap_unload(); \
})
+extern spinlock_t efi_rt_lock;
efi_status_t __efi_rt_asm_wrapper(void *, const char *, ...);
#define ARCH_EFI_IRQ_FLAGS_MASK (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT)
--- a/arch/arm64/kernel/efi-rt-wrapper.S
+++ b/arch/arm64/kernel/efi-rt-wrapper.S
@@ -16,6 +16,12 @@ SYM_FUNC_START(__efi_rt_asm_wrapper)
*/
stp x1, x18, [sp, #16]
+ ldr_l x16, efi_rt_stack_top
+ mov sp, x16
+#ifdef CONFIG_SHADOW_CALL_STACK
+ str x18, [sp, #-16]!
+#endif
+
/*
* We are lucky enough that no EFI runtime services take more than
* 5 arguments, so all are passed in registers rather than via the
@@ -29,6 +35,7 @@ SYM_FUNC_START(__efi_rt_asm_wrapper)
mov x4, x6
blr x8
+ mov sp, x29
ldp x1, x2, [sp, #16]
cmp x2, x18
ldp x29, x30, [sp], #32
@@ -42,6 +49,10 @@ SYM_FUNC_START(__efi_rt_asm_wrapper)
* called with preemption disabled and a separate shadow stack is used
* for interrupts.
*/
- mov x18, x2
+#ifdef CONFIG_SHADOW_CALL_STACK
+ ldr_l x18, efi_rt_stack_top
+ ldr x18, [x18, #-16]
+#endif
+
b efi_handle_corrupted_x18 // tail call
SYM_FUNC_END(__efi_rt_asm_wrapper)
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -144,3 +144,30 @@ asmlinkage efi_status_t efi_handle_corru
pr_err_ratelimited(FW_BUG "register x18 corrupted by EFI %s\n", f);
return s;
}
+
+DEFINE_SPINLOCK(efi_rt_lock);
+
+asmlinkage u64 *efi_rt_stack_top __ro_after_init;
+
+/* EFI requires 8 KiB of stack space for runtime services */
+static_assert(THREAD_SIZE >= SZ_8K);
+
+static int __init arm64_efi_rt_init(void)
+{
+ void *p;
+
+ if (!efi_enabled(EFI_RUNTIME_SERVICES))
+ return 0;
+
+ p = __vmalloc_node(THREAD_SIZE, THREAD_ALIGN, GFP_KERNEL,
+ NUMA_NO_NODE, &&l);
+l: if (!p) {
+ pr_warn("Failed to allocate EFI runtime stack\n");
+ clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+ return -ENOMEM;
+ }
+
+ efi_rt_stack_top = p + THREAD_SIZE;
+ return 0;
+}
+core_initcall(arm64_efi_rt_init);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 149/193] efi: rt-wrapper: Add missing include
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 148/193] arm64: efi: Execute runtime services from a dedicated stack Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 150/193] panic: Separate sysctl logic from CONFIG_SMP Greg Kroah-Hartman
` (52 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Lee Jones
From: Ard Biesheuvel <ardb@kernel.org>
commit 18bba1843fc7f264f58c9345d00827d082f9c558 upstream.
Add the missing #include of asm/assembler.h, which is where the ldr_l
macro is defined.
Fixes: ff7a167961d1b97e ("arm64: efi: Execute runtime services from a dedicated stack")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/efi-rt-wrapper.S | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm64/kernel/efi-rt-wrapper.S
+++ b/arch/arm64/kernel/efi-rt-wrapper.S
@@ -4,6 +4,7 @@
*/
#include <linux/linkage.h>
+#include <asm/assembler.h>
SYM_FUNC_START(__efi_rt_asm_wrapper)
stp x29, x30, [sp, #-32]!
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 150/193] panic: Separate sysctl logic from CONFIG_SMP
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 149/193] efi: rt-wrapper: Add missing include Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 151/193] exit: Put an upper limit on how often we can oops Greg Kroah-Hartman
` (51 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Mladek, Andrew Morton,
tangmeng, Guilherme G. Piccoli, Tiezhu Yang,
Sebastian Andrzej Siewior, Luis Chamberlain, Kees Cook
From: Kees Cook <keescook@chromium.org>
commit 9360d035a579d95d1e76c471061b9065b18a0eb1 upstream.
In preparation for adding more sysctls directly in kernel/panic.c, split
CONFIG_SMP from the logic that adds sysctls.
Cc: Petr Mladek <pmladek@suse.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: tangmeng <tangmeng@uniontech.com>
Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20221117234328.594699-1-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/panic.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -75,8 +75,9 @@ ATOMIC_NOTIFIER_HEAD(panic_notifier_list
EXPORT_SYMBOL(panic_notifier_list);
-#if defined(CONFIG_SMP) && defined(CONFIG_SYSCTL)
+#ifdef CONFIG_SYSCTL
static struct ctl_table kern_panic_table[] = {
+#ifdef CONFIG_SMP
{
.procname = "oops_all_cpu_backtrace",
.data = &sysctl_oops_all_cpu_backtrace,
@@ -86,6 +87,7 @@ static struct ctl_table kern_panic_table
.extra1 = SYSCTL_ZERO,
.extra2 = SYSCTL_ONE,
},
+#endif
{ }
};
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 151/193] exit: Put an upper limit on how often we can oops
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 150/193] panic: Separate sysctl logic from CONFIG_SMP Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 152/193] exit: Expose "oops_count" to sysfs Greg Kroah-Hartman
` (50 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jann Horn, Luis Chamberlain, Kees Cook
From: Jann Horn <jannh@google.com>
commit d4ccd54d28d3c8598e2354acc13e28c060961dbb upstream.
Many Linux systems are configured to not panic on oops; but allowing an
attacker to oops the system **really** often can make even bugs that look
completely unexploitable exploitable (like NULL dereferences and such) if
each crash elevates a refcount by one or a lock is taken in read mode, and
this causes a counter to eventually overflow.
The most interesting counters for this are 32 bits wide (like open-coded
refcounts that don't use refcount_t). (The ldsem reader count on 32-bit
platforms is just 16 bits, but probably nobody cares about 32-bit platforms
that much nowadays.)
So let's panic the system if the kernel is constantly oopsing.
The speed of oopsing 2^32 times probably depends on several factors, like
how long the stack trace is and which unwinder you're using; an empirically
important one is whether your console is showing a graphical environment or
a text console that oopses will be printed to.
In a quick single-threaded benchmark, it looks like oopsing in a vfork()
child with a very short stack trace only takes ~510 microseconds per run
when a graphical console is active; but switching to a text console that
oopses are printed to slows it down around 87x, to ~45 milliseconds per
run.
(Adding more threads makes this faster, but the actual oops printing
happens under &die_lock on x86, so you can maybe speed this up by a factor
of around 2 and then any further improvement gets eaten up by lock
contention.)
It looks like it would take around 8-12 days to overflow a 32-bit counter
with repeated oopsing on a multi-core X86 system running a graphical
environment; both me (in an X86 VM) and Seth (with a distro kernel on
normal hardware in a standard configuration) got numbers in that ballpark.
12 days aren't *that* short on a desktop system, and you'd likely need much
longer on a typical server system (assuming that people don't run graphical
desktop environments on their servers), and this is a *very* noisy and
violent approach to exploiting the kernel; and it also seems to take orders
of magnitude longer on some machines, probably because stuff like EFI
pstore will slow it down a ton if that's active.
Signed-off-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20221107201317.324457-1-jannh@google.com
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20221117234328.594699-2-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/sysctl/kernel.rst | 8 +++++
kernel/exit.c | 42 ++++++++++++++++++++++++++++
2 files changed, 50 insertions(+)
--- a/Documentation/admin-guide/sysctl/kernel.rst
+++ b/Documentation/admin-guide/sysctl/kernel.rst
@@ -667,6 +667,14 @@ This is the default behavior.
an oops event is detected.
+oops_limit
+==========
+
+Number of kernel oopses after which the kernel should panic when
+``panic_on_oops`` is not set. Setting this to 0 or 1 has the same effect
+as setting ``panic_on_oops=1``.
+
+
osrelease, ostype & version
===========================
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -72,6 +72,33 @@
#include <asm/unistd.h>
#include <asm/mmu_context.h>
+/*
+ * The default value should be high enough to not crash a system that randomly
+ * crashes its kernel from time to time, but low enough to at least not permit
+ * overflowing 32-bit refcounts or the ldsem writer count.
+ */
+static unsigned int oops_limit = 10000;
+
+#ifdef CONFIG_SYSCTL
+static struct ctl_table kern_exit_table[] = {
+ {
+ .procname = "oops_limit",
+ .data = &oops_limit,
+ .maxlen = sizeof(oops_limit),
+ .mode = 0644,
+ .proc_handler = proc_douintvec,
+ },
+ { }
+};
+
+static __init int kernel_exit_sysctls_init(void)
+{
+ register_sysctl_init("kernel", kern_exit_table);
+ return 0;
+}
+late_initcall(kernel_exit_sysctls_init);
+#endif
+
static void __unhash_process(struct task_struct *p, bool group_dead)
{
nr_threads--;
@@ -874,6 +901,8 @@ void __noreturn do_exit(long code)
void __noreturn make_task_dead(int signr)
{
+ static atomic_t oops_count = ATOMIC_INIT(0);
+
/*
* Take the task off the cpu after something catastrophic has
* happened.
@@ -898,6 +927,19 @@ void __noreturn make_task_dead(int signr
}
/*
+ * Every time the system oopses, if the oops happens while a reference
+ * to an object was held, the reference leaks.
+ * If the oops doesn't also leak memory, repeated oopsing can cause
+ * reference counters to wrap around (if they're not using refcount_t).
+ * This means that repeated oopsing can make unexploitable-looking bugs
+ * exploitable through repeated oopsing.
+ * To make sure this can't happen, place an upper bound on how often the
+ * kernel may oops without panic().
+ */
+ if (atomic_inc_return(&oops_count) >= READ_ONCE(oops_limit))
+ panic("Oopsed too often (kernel.oops_limit is %d)", oops_limit);
+
+ /*
* We're taking recursive faults here in make_task_dead. Safest is to just
* leave this task alone and wait for reboot.
*/
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 152/193] exit: Expose "oops_count" to sysfs
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 151/193] exit: Put an upper limit on how often we can oops Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 153/193] exit: Allow oops_limit to be disabled Greg Kroah-Hartman
` (49 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric W. Biederman, Jann Horn,
Arnd Bergmann, Luis Chamberlain, Kees Cook
From: Kees Cook <keescook@chromium.org>
commit 9db89b41117024f80b38b15954017fb293133364 upstream.
Since Oops count is now tracked and is a fairly interesting signal, add
the entry /sys/kernel/oops_count to expose it to userspace.
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Jann Horn <jannh@google.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20221117234328.594699-3-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ABI/testing/sysfs-kernel-oops_count | 6 ++++++
MAINTAINERS | 1 +
kernel/exit.c | 22 ++++++++++++++++++++--
3 files changed, 27 insertions(+), 2 deletions(-)
create mode 100644 Documentation/ABI/testing/sysfs-kernel-oops_count
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-kernel-oops_count
@@ -0,0 +1,6 @@
+What: /sys/kernel/oops_count
+Date: November 2022
+KernelVersion: 6.2.0
+Contact: Linux Kernel Hardening List <linux-hardening@vger.kernel.org>
+Description:
+ Shows how many times the system has Oopsed since last boot.
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -11112,6 +11112,7 @@ M: Kees Cook <keescook@chromium.org>
L: linux-hardening@vger.kernel.org
S: Supported
T: git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
+F: Documentation/ABI/testing/sysfs-kernel-oops_count
F: include/linux/overflow.h
F: include/linux/randomize_kstack.h
F: mm/usercopy.c
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -67,6 +67,7 @@
#include <linux/io_uring.h>
#include <linux/kprobes.h>
#include <linux/rethook.h>
+#include <linux/sysfs.h>
#include <linux/uaccess.h>
#include <asm/unistd.h>
@@ -99,6 +100,25 @@ static __init int kernel_exit_sysctls_in
late_initcall(kernel_exit_sysctls_init);
#endif
+static atomic_t oops_count = ATOMIC_INIT(0);
+
+#ifdef CONFIG_SYSFS
+static ssize_t oops_count_show(struct kobject *kobj, struct kobj_attribute *attr,
+ char *page)
+{
+ return sysfs_emit(page, "%d\n", atomic_read(&oops_count));
+}
+
+static struct kobj_attribute oops_count_attr = __ATTR_RO(oops_count);
+
+static __init int kernel_exit_sysfs_init(void)
+{
+ sysfs_add_file_to_group(kernel_kobj, &oops_count_attr.attr, NULL);
+ return 0;
+}
+late_initcall(kernel_exit_sysfs_init);
+#endif
+
static void __unhash_process(struct task_struct *p, bool group_dead)
{
nr_threads--;
@@ -901,8 +921,6 @@ void __noreturn do_exit(long code)
void __noreturn make_task_dead(int signr)
{
- static atomic_t oops_count = ATOMIC_INIT(0);
-
/*
* Take the task off the cpu after something catastrophic has
* happened.
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 153/193] exit: Allow oops_limit to be disabled
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 152/193] exit: Expose "oops_count" to sysfs Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 154/193] panic: Consolidate open-coded panic_on_warn checks Greg Kroah-Hartman
` (48 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jann Horn, Jonathan Corbet,
Andrew Morton, Baolin Wang, Jason A. Donenfeld, Eric Biggers,
Huang Ying, Eric W. Biederman, Arnd Bergmann, linux-doc,
Kees Cook
From: Kees Cook <keescook@chromium.org>
commit de92f65719cd672f4b48397540b9f9eff67eca40 upstream.
In preparation for keeping oops_limit logic in sync with warn_limit,
have oops_limit == 0 disable checking the Oops counter.
Cc: Jann Horn <jannh@google.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Eric Biggers <ebiggers@google.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: linux-doc@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/sysctl/kernel.rst | 5 +++--
kernel/exit.c | 2 +-
2 files changed, 4 insertions(+), 3 deletions(-)
--- a/Documentation/admin-guide/sysctl/kernel.rst
+++ b/Documentation/admin-guide/sysctl/kernel.rst
@@ -671,8 +671,9 @@ oops_limit
==========
Number of kernel oopses after which the kernel should panic when
-``panic_on_oops`` is not set. Setting this to 0 or 1 has the same effect
-as setting ``panic_on_oops=1``.
+``panic_on_oops`` is not set. Setting this to 0 disables checking
+the count. Setting this to 1 has the same effect as setting
+``panic_on_oops=1``. The default value is 10000.
osrelease, ostype & version
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -954,7 +954,7 @@ void __noreturn make_task_dead(int signr
* To make sure this can't happen, place an upper bound on how often the
* kernel may oops without panic().
*/
- if (atomic_inc_return(&oops_count) >= READ_ONCE(oops_limit))
+ if (atomic_inc_return(&oops_count) >= READ_ONCE(oops_limit) && oops_limit)
panic("Oopsed too often (kernel.oops_limit is %d)", oops_limit);
/*
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 154/193] panic: Consolidate open-coded panic_on_warn checks
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 153/193] exit: Allow oops_limit to be disabled Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 155/193] panic: Introduce warn_limit Greg Kroah-Hartman
` (47 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marco Elver, Dmitry Vyukov,
Ingo Molnar, Peter Zijlstra, Juri Lelli, Vincent Guittot,
Dietmar Eggemann, Steven Rostedt, Ben Segall, Mel Gorman,
Daniel Bristot de Oliveira, Valentin Schneider, Andrey Ryabinin,
Alexander Potapenko, Andrey Konovalov, Vincenzo Frascino,
Andrew Morton, David Gow, tangmeng, Jann Horn, Shuah Khan,
Petr Mladek, Paul E. McKenney, Sebastian Andrzej Siewior,
Guilherme G. Piccoli, Tiezhu Yang, kasan-dev, linux-mm,
Luis Chamberlain, Kees Cook
From: Kees Cook <keescook@chromium.org>
commit 79cc1ba7badf9e7a12af99695a557e9ce27ee967 upstream.
Several run-time checkers (KASAN, UBSAN, KFENCE, KCSAN, sched) roll
their own warnings, and each check "panic_on_warn". Consolidate this
into a single function so that future instrumentation can be added in
a single location.
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ben Segall <bsegall@google.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
Cc: Valentin Schneider <vschneid@redhat.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: David Gow <davidgow@google.com>
Cc: tangmeng <tangmeng@uniontech.com>
Cc: Jann Horn <jannh@google.com>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Petr Mladek <pmladek@suse.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
Cc: kasan-dev@googlegroups.com
Cc: linux-mm@kvack.org
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Marco Elver <elver@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Link: https://lore.kernel.org/r/20221117234328.594699-4-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/panic.h | 1 +
kernel/kcsan/report.c | 3 +--
kernel/panic.c | 9 +++++++--
kernel/sched/core.c | 3 +--
lib/ubsan.c | 3 +--
mm/kasan/report.c | 4 ++--
mm/kfence/report.c | 3 +--
7 files changed, 14 insertions(+), 12 deletions(-)
--- a/include/linux/panic.h
+++ b/include/linux/panic.h
@@ -11,6 +11,7 @@ extern long (*panic_blink)(int state);
__printf(1, 2)
void panic(const char *fmt, ...) __noreturn __cold;
void nmi_panic(struct pt_regs *regs, const char *msg);
+void check_panic_on_warn(const char *origin);
extern void oops_enter(void);
extern void oops_exit(void);
extern bool oops_may_print(void);
--- a/kernel/kcsan/report.c
+++ b/kernel/kcsan/report.c
@@ -492,8 +492,7 @@ static void print_report(enum kcsan_valu
dump_stack_print_info(KERN_DEFAULT);
pr_err("==================================================================\n");
- if (panic_on_warn)
- panic("panic_on_warn set ...\n");
+ check_panic_on_warn("KCSAN");
}
static void release_report(unsigned long *flags, struct other_info *other_info)
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -201,6 +201,12 @@ static void panic_print_sys_info(bool co
ftrace_dump(DUMP_ALL);
}
+void check_panic_on_warn(const char *origin)
+{
+ if (panic_on_warn)
+ panic("%s: panic_on_warn set ...\n", origin);
+}
+
/**
* panic - halt the system
* @fmt: The text string to print
@@ -619,8 +625,7 @@ void __warn(const char *file, int line,
if (regs)
show_regs(regs);
- if (panic_on_warn)
- panic("panic_on_warn set ...\n");
+ check_panic_on_warn("kernel");
if (!regs)
dump_stack();
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5778,8 +5778,7 @@ static noinline void __schedule_bug(stru
pr_err("Preemption disabled at:");
print_ip_sym(KERN_ERR, preempt_disable_ip);
}
- if (panic_on_warn)
- panic("scheduling while atomic\n");
+ check_panic_on_warn("scheduling while atomic");
dump_stack();
add_taint(TAINT_WARN, LOCKDEP_STILL_OK);
--- a/lib/ubsan.c
+++ b/lib/ubsan.c
@@ -154,8 +154,7 @@ static void ubsan_epilogue(void)
current->in_ubsan--;
- if (panic_on_warn)
- panic("panic_on_warn set ...\n");
+ check_panic_on_warn("UBSAN");
}
void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs)
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -164,8 +164,8 @@ static void end_report(unsigned long *fl
(unsigned long)addr);
pr_err("==================================================================\n");
spin_unlock_irqrestore(&report_lock, *flags);
- if (panic_on_warn && !test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
- panic("panic_on_warn set ...\n");
+ if (!test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
+ check_panic_on_warn("KASAN");
if (kasan_arg_fault == KASAN_ARG_FAULT_PANIC)
panic("kasan.fault=panic set ...\n");
add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
--- a/mm/kfence/report.c
+++ b/mm/kfence/report.c
@@ -273,8 +273,7 @@ void kfence_report_error(unsigned long a
lockdep_on();
- if (panic_on_warn)
- panic("panic_on_warn set ...\n");
+ check_panic_on_warn("KFENCE");
/* We encountered a memory safety error, taint the kernel! */
add_taint(TAINT_BAD_PAGE, LOCKDEP_STILL_OK);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 155/193] panic: Introduce warn_limit
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 154/193] panic: Consolidate open-coded panic_on_warn checks Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 156/193] panic: Expose "warn_count" to sysfs Greg Kroah-Hartman
` (46 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Corbet, Andrew Morton,
Baolin Wang, Jason A. Donenfeld, Eric Biggers, Huang Ying,
Petr Mladek, tangmeng, Guilherme G. Piccoli, Tiezhu Yang,
Sebastian Andrzej Siewior, linux-doc, Luis Chamberlain,
Kees Cook
From: Kees Cook <keescook@chromium.org>
commit 9fc9e278a5c0b708eeffaf47d6eb0c82aa74ed78 upstream.
Like oops_limit, add warn_limit for limiting the number of warnings when
panic_on_warn is not set.
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Eric Biggers <ebiggers@google.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Petr Mladek <pmladek@suse.com>
Cc: tangmeng <tangmeng@uniontech.com>
Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: linux-doc@vger.kernel.org
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20221117234328.594699-5-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/sysctl/kernel.rst | 10 ++++++++++
kernel/panic.c | 14 ++++++++++++++
2 files changed, 24 insertions(+)
--- a/Documentation/admin-guide/sysctl/kernel.rst
+++ b/Documentation/admin-guide/sysctl/kernel.rst
@@ -1532,6 +1532,16 @@ entry will default to 2 instead of 0.
2 Unprivileged calls to ``bpf()`` are disabled
= =============================================================
+
+warn_limit
+==========
+
+Number of kernel warnings after which the kernel should panic when
+``panic_on_warn`` is not set. Setting this to 0 disables checking
+the warning count. Setting this to 1 has the same effect as setting
+``panic_on_warn=1``. The default value is 0.
+
+
watchdog
========
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -58,6 +58,7 @@ bool crash_kexec_post_notifiers;
int panic_on_warn __read_mostly;
unsigned long panic_on_taint;
bool panic_on_taint_nousertaint = false;
+static unsigned int warn_limit __read_mostly;
int panic_timeout = CONFIG_PANIC_TIMEOUT;
EXPORT_SYMBOL_GPL(panic_timeout);
@@ -88,6 +89,13 @@ static struct ctl_table kern_panic_table
.extra2 = SYSCTL_ONE,
},
#endif
+ {
+ .procname = "warn_limit",
+ .data = &warn_limit,
+ .maxlen = sizeof(warn_limit),
+ .mode = 0644,
+ .proc_handler = proc_douintvec,
+ },
{ }
};
@@ -203,8 +211,14 @@ static void panic_print_sys_info(bool co
void check_panic_on_warn(const char *origin)
{
+ static atomic_t warn_count = ATOMIC_INIT(0);
+
if (panic_on_warn)
panic("%s: panic_on_warn set ...\n", origin);
+
+ if (atomic_inc_return(&warn_count) >= READ_ONCE(warn_limit) && warn_limit)
+ panic("%s: system warned too often (kernel.warn_limit is %d)",
+ origin, warn_limit);
}
/**
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 156/193] panic: Expose "warn_count" to sysfs
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 155/193] panic: Introduce warn_limit Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 157/193] docs: Fix path paste-o for /sys/kernel/warn_count Greg Kroah-Hartman
` (45 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Mladek, Andrew Morton,
tangmeng, Guilherme G. Piccoli, Sebastian Andrzej Siewior,
Tiezhu Yang, Luis Chamberlain, Kees Cook
From: Kees Cook <keescook@chromium.org>
commit 8b05aa26336113c4cea25f1c333ee8cd4fc212a6 upstream.
Since Warn count is now tracked and is a fairly interesting signal, add
the entry /sys/kernel/warn_count to expose it to userspace.
Cc: Petr Mladek <pmladek@suse.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: tangmeng <tangmeng@uniontech.com>
Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20221117234328.594699-6-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ABI/testing/sysfs-kernel-warn_count | 6 ++++++
MAINTAINERS | 1 +
kernel/panic.c | 22 ++++++++++++++++++++--
3 files changed, 27 insertions(+), 2 deletions(-)
create mode 100644 Documentation/ABI/testing/sysfs-kernel-warn_count
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-kernel-warn_count
@@ -0,0 +1,6 @@
+What: /sys/kernel/oops_count
+Date: November 2022
+KernelVersion: 6.2.0
+Contact: Linux Kernel Hardening List <linux-hardening@vger.kernel.org>
+Description:
+ Shows how many times the system has Warned since last boot.
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -11113,6 +11113,7 @@ L: linux-hardening@vger.kernel.org
S: Supported
T: git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
F: Documentation/ABI/testing/sysfs-kernel-oops_count
+F: Documentation/ABI/testing/sysfs-kernel-warn_count
F: include/linux/overflow.h
F: include/linux/randomize_kstack.h
F: mm/usercopy.c
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -32,6 +32,7 @@
#include <linux/bug.h>
#include <linux/ratelimit.h>
#include <linux/debugfs.h>
+#include <linux/sysfs.h>
#include <trace/events/error_report.h>
#include <asm/sections.h>
@@ -107,6 +108,25 @@ static __init int kernel_panic_sysctls_i
late_initcall(kernel_panic_sysctls_init);
#endif
+static atomic_t warn_count = ATOMIC_INIT(0);
+
+#ifdef CONFIG_SYSFS
+static ssize_t warn_count_show(struct kobject *kobj, struct kobj_attribute *attr,
+ char *page)
+{
+ return sysfs_emit(page, "%d\n", atomic_read(&warn_count));
+}
+
+static struct kobj_attribute warn_count_attr = __ATTR_RO(warn_count);
+
+static __init int kernel_panic_sysfs_init(void)
+{
+ sysfs_add_file_to_group(kernel_kobj, &warn_count_attr.attr, NULL);
+ return 0;
+}
+late_initcall(kernel_panic_sysfs_init);
+#endif
+
static long no_blink(int state)
{
return 0;
@@ -211,8 +231,6 @@ static void panic_print_sys_info(bool co
void check_panic_on_warn(const char *origin)
{
- static atomic_t warn_count = ATOMIC_INIT(0);
-
if (panic_on_warn)
panic("%s: panic_on_warn set ...\n", origin);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 157/193] docs: Fix path paste-o for /sys/kernel/warn_count
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 156/193] panic: Expose "warn_count" to sysfs Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 158/193] exit: Use READ_ONCE() for all oops/warn limit reads Greg Kroah-Hartman
` (44 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, linux-hardening,
Kees Cook
From: Kees Cook <keescook@chromium.org>
commit 00dd027f721e0458418f7750d8a5a664ed3e5994 upstream.
Running "make htmldocs" shows that "/sys/kernel/oops_count" was
duplicated. This should have been "warn_count":
Warning: /sys/kernel/oops_count is defined 2 times:
./Documentation/ABI/testing/sysfs-kernel-warn_count:0
./Documentation/ABI/testing/sysfs-kernel-oops_count:0
Fix the typo.
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/linux-doc/202212110529.A3Qav8aR-lkp@intel.com
Fixes: 8b05aa263361 ("panic: Expose "warn_count" to sysfs")
Cc: linux-hardening@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ABI/testing/sysfs-kernel-warn_count | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/Documentation/ABI/testing/sysfs-kernel-warn_count
+++ b/Documentation/ABI/testing/sysfs-kernel-warn_count
@@ -1,4 +1,4 @@
-What: /sys/kernel/oops_count
+What: /sys/kernel/warn_count
Date: November 2022
KernelVersion: 6.2.0
Contact: Linux Kernel Hardening List <linux-hardening@vger.kernel.org>
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 158/193] exit: Use READ_ONCE() for all oops/warn limit reads
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 157/193] docs: Fix path paste-o for /sys/kernel/warn_count Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 159/193] x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN Greg Kroah-Hartman
` (43 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra, Eric W. Biederman,
Jann Horn, Arnd Bergmann, Petr Mladek, Andrew Morton,
Luis Chamberlain, Marco Elver, tangmeng,
Sebastian Andrzej Siewior, Tiezhu Yang, Kees Cook
From: Kees Cook <keescook@chromium.org>
commit 7535b832c6399b5ebfc5b53af5c51dd915ee2538 upstream.
Use a temporary variable to take full advantage of READ_ONCE() behavior.
Without this, the report (and even the test) might be out of sync with
the initial test.
Reported-by: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/lkml/Y5x7GXeluFmZ8E0E@hirez.programming.kicks-ass.net
Fixes: 9fc9e278a5c0 ("panic: Introduce warn_limit")
Fixes: d4ccd54d28d3 ("exit: Put an upper limit on how often we can oops")
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Jann Horn <jannh@google.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Marco Elver <elver@google.com>
Cc: tangmeng <tangmeng@uniontech.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/exit.c | 6 ++++--
kernel/panic.c | 7 +++++--
2 files changed, 9 insertions(+), 4 deletions(-)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -931,6 +931,7 @@ void __noreturn make_task_dead(int signr
* Then do everything else.
*/
struct task_struct *tsk = current;
+ unsigned int limit;
if (unlikely(in_interrupt()))
panic("Aiee, killing interrupt handler!");
@@ -954,8 +955,9 @@ void __noreturn make_task_dead(int signr
* To make sure this can't happen, place an upper bound on how often the
* kernel may oops without panic().
*/
- if (atomic_inc_return(&oops_count) >= READ_ONCE(oops_limit) && oops_limit)
- panic("Oopsed too often (kernel.oops_limit is %d)", oops_limit);
+ limit = READ_ONCE(oops_limit);
+ if (atomic_inc_return(&oops_count) >= limit && limit)
+ panic("Oopsed too often (kernel.oops_limit is %d)", limit);
/*
* We're taking recursive faults here in make_task_dead. Safest is to just
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -231,12 +231,15 @@ static void panic_print_sys_info(bool co
void check_panic_on_warn(const char *origin)
{
+ unsigned int limit;
+
if (panic_on_warn)
panic("%s: panic_on_warn set ...\n", origin);
- if (atomic_inc_return(&warn_count) >= READ_ONCE(warn_limit) && warn_limit)
+ limit = READ_ONCE(warn_limit);
+ if (atomic_inc_return(&warn_count) >= limit && limit)
panic("%s: system warned too often (kernel.warn_limit is %d)",
- origin, warn_limit);
+ origin, limit);
}
/**
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 159/193] x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 158/193] exit: Use READ_ONCE() for all oops/warn limit reads Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 160/193] arch: fix broken BuildID for arm64 and riscv Greg Kroah-Hartman
` (42 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, YingChi Long, Borislav Petkov,
Nick Desaulniers, Nathan Chancellor
From: YingChi Long <me@inclyc.cn>
commit 55228db2697c09abddcb9487c3d9fa5854a932cd upstream.
WG14 N2350 specifies that it is an undefined behavior to have type
definitions within offsetof", see
https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2350.htm
This specification is also part of C23.
Therefore, replace the TYPE_ALIGN macro with the _Alignof builtin to
avoid undefined behavior. (_Alignof itself is C11 and the kernel is
built with -gnu11).
ISO C11 _Alignof is subtly different from the GNU C extension
__alignof__. Latter is the preferred alignment and _Alignof the
minimal alignment. For long long on x86 these are 8 and 4
respectively.
The macro TYPE_ALIGN's behavior matches _Alignof rather than
__alignof__.
[ bp: Massage commit message. ]
Signed-off-by: YingChi Long <me@inclyc.cn>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/r/20220925153151.2467884-1-me@inclyc.cn
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/fpu/init.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -133,9 +133,6 @@ static void __init fpu__init_system_gene
fpu__init_system_mxcsr();
}
-/* Get alignment of the TYPE. */
-#define TYPE_ALIGN(TYPE) offsetof(struct { char x; TYPE test; }, test)
-
/*
* Enforce that 'MEMBER' is the last field of 'TYPE'.
*
@@ -143,8 +140,8 @@ static void __init fpu__init_system_gene
* because that's how C aligns structs.
*/
#define CHECK_MEMBER_AT_END_OF(TYPE, MEMBER) \
- BUILD_BUG_ON(sizeof(TYPE) != ALIGN(offsetofend(TYPE, MEMBER), \
- TYPE_ALIGN(TYPE)))
+ BUILD_BUG_ON(sizeof(TYPE) != \
+ ALIGN(offsetofend(TYPE, MEMBER), _Alignof(TYPE)))
/*
* We append the 'struct fpu' to the task_struct:
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 160/193] arch: fix broken BuildID for arm64 and riscv
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 159/193] x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 161/193] drm/amdgpu/discovery: enable soc21 common for GC 11.0.4 Greg Kroah-Hartman
` (41 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dennis Gilmore, Ard Biesheuvel,
Masahiro Yamada, Palmer Dabbelt
From: Masahiro Yamada <masahiroy@kernel.org>
commit 99cb0d917ffa1ab628bb67364ca9b162c07699b1 upstream.
Dennis Gilmore reports that the BuildID is missing in the arm64 vmlinux
since commit 994b7ac1697b ("arm64: remove special treatment for the
link order of head.o").
The issue is that the type of .notes section, which contains the BuildID,
changed from NOTES to PROGBITS.
Ard Biesheuvel figured out that whichever object gets linked first gets
to decide the type of a section. The PROGBITS type is the result of the
compiler emitting .note.GNU-stack as PROGBITS rather than NOTE.
While Ard provided a fix for arm64, I want to fix this globally because
the same issue is happening on riscv since commit 2348e6bf4421 ("riscv:
remove special treatment for the link order of head.o"). This problem
will happen in general for other architectures if they start to drop
unneeded entries from scripts/head-object-list.txt.
Discard .note.GNU-stack in include/asm-generic/vmlinux.lds.h.
Link: https://lore.kernel.org/lkml/CAABkxwuQoz1CTbyb57n0ZX65eSYiTonFCU8-LCQc=74D=xE=rA@mail.gmail.com/
Fixes: 994b7ac1697b ("arm64: remove special treatment for the link order of head.o")
Fixes: 2348e6bf4421 ("riscv: remove special treatment for the link order of head.o")
Reported-by: Dennis Gilmore <dennis@ausil.us>
Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/asm-generic/vmlinux.lds.h | 5 +++++
1 file changed, 5 insertions(+)
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -929,7 +929,12 @@
#define PRINTK_INDEX
#endif
+/*
+ * Discard .note.GNU-stack, which is emitted as PROGBITS by the compiler.
+ * Otherwise, the type of .notes section would become PROGBITS instead of NOTES.
+ */
#define NOTES \
+ /DISCARD/ : { *(.note.GNU-stack) } \
.notes : AT(ADDR(.notes) - LOAD_OFFSET) { \
__start_notes = .; \
KEEP(*(.note.*)) \
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 161/193] drm/amdgpu/discovery: enable soc21 common for GC 11.0.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 160/193] arch: fix broken BuildID for arm64 and riscv Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 162/193] drm/amdgpu/discovery: enable gmc v11 " Greg Kroah-Hartman
` (40 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit 69dc98bbd44160930b6b3ca9ca558f89435d2702 upstream.
Enable soc21 common for GC 11.0.4.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1507,6 +1507,7 @@ static int amdgpu_discovery_set_common_i
case IP_VERSION(11, 0, 1):
case IP_VERSION(11, 0, 2):
case IP_VERSION(11, 0, 3):
+ case IP_VERSION(11, 0, 4):
amdgpu_device_ip_block_add(adev, &soc21_common_ip_block);
break;
default:
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 162/193] drm/amdgpu/discovery: enable gmc v11 for GC 11.0.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 161/193] drm/amdgpu/discovery: enable soc21 common for GC 11.0.4 Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 163/193] drm/amdgpu/discovery: enable gfx " Greg Kroah-Hartman
` (39 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit d5fd8c89ed206b2df3933bc4ea129401b2b60869 upstream.
Enable gmc (graphic memory controller) v11 for GC 11.0.4.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1552,6 +1552,7 @@ static int amdgpu_discovery_set_gmc_ip_b
case IP_VERSION(11, 0, 1):
case IP_VERSION(11, 0, 2):
case IP_VERSION(11, 0, 3):
+ case IP_VERSION(11, 0, 4):
amdgpu_device_ip_block_add(adev, &gmc_v11_0_ip_block);
break;
default:
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 163/193] drm/amdgpu/discovery: enable gfx v11 for GC 11.0.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 162/193] drm/amdgpu/discovery: enable gmc v11 " Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 164/193] drm/amdgpu/discovery: enable mes support for GC v11.0.4 Greg Kroah-Hartman
` (38 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit b952d6b3d3ff3c1570fab77f2137d5e5280a0e57 upstream.
Enable gfx v11 for GC 11.0.4.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1787,6 +1787,7 @@ static int amdgpu_discovery_set_gc_ip_bl
case IP_VERSION(11, 0, 1):
case IP_VERSION(11, 0, 2):
case IP_VERSION(11, 0, 3):
+ case IP_VERSION(11, 0, 4):
amdgpu_device_ip_block_add(adev, &gfx_v11_0_ip_block);
break;
default:
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 164/193] drm/amdgpu/discovery: enable mes support for GC v11.0.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 163/193] drm/amdgpu/discovery: enable gfx " Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 165/193] drm/amdgpu: set GC 11.0.4 family Greg Kroah-Hartman
` (37 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit 6a6af77570add4e58721386be429dbd02cd4b9dd upstream.
this patch is to enable mes for GC 11.0.4.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1951,6 +1951,7 @@ static int amdgpu_discovery_set_mes_ip_b
case IP_VERSION(11, 0, 1):
case IP_VERSION(11, 0, 2):
case IP_VERSION(11, 0, 3):
+ case IP_VERSION(11, 0, 4):
amdgpu_device_ip_block_add(adev, &mes_v11_0_ip_block);
adev->enable_mes = true;
adev->enable_mes_kiq = true;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 165/193] drm/amdgpu: set GC 11.0.4 family
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 164/193] drm/amdgpu/discovery: enable mes support for GC v11.0.4 Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 166/193] drm/amdgpu/discovery: set the APU flag for GC 11.0.4 Greg Kroah-Hartman
` (36 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit 94ab70685844227b5c9cb9027a5c4acd3b0e4564 upstream.
this patch is to set GC 11.0.4 family.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -2181,6 +2181,7 @@ int amdgpu_discovery_set_ip_blocks(struc
adev->family = AMDGPU_FAMILY_GC_11_0_0;
break;
case IP_VERSION(11, 0, 1):
+ case IP_VERSION(11, 0, 4):
adev->family = AMDGPU_FAMILY_GC_11_0_1;
break;
default:
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 166/193] drm/amdgpu/discovery: set the APU flag for GC 11.0.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 165/193] drm/amdgpu: set GC 11.0.4 family Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 167/193] drm/amdgpu: add gfx support " Greg Kroah-Hartman
` (35 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit dd2d9c7fd7716838d477e257f43facd68c53d3a9 upstream.
Set the APU flag appropriately for GC 11.0.4.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -2199,6 +2199,7 @@ int amdgpu_discovery_set_ip_blocks(struc
case IP_VERSION(10, 3, 6):
case IP_VERSION(10, 3, 7):
case IP_VERSION(11, 0, 1):
+ case IP_VERSION(11, 0, 4):
adev->flags |= AMD_IS_APU;
break;
default:
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 167/193] drm/amdgpu: add gfx support for GC 11.0.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 166/193] drm/amdgpu/discovery: set the APU flag for GC 11.0.4 Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 168/193] drm/amdgpu: add gmc v11 " Greg Kroah-Hartman
` (34 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit 1763cb65e870e783e26d2dc9def4edbeadcb1050 upstream.
this patch to add GC 11.0.4 gfx support to gfx11 implementation.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -77,6 +77,10 @@ MODULE_FIRMWARE("amdgpu/gc_11_0_3_pfp.bi
MODULE_FIRMWARE("amdgpu/gc_11_0_3_me.bin");
MODULE_FIRMWARE("amdgpu/gc_11_0_3_mec.bin");
MODULE_FIRMWARE("amdgpu/gc_11_0_3_rlc.bin");
+MODULE_FIRMWARE("amdgpu/gc_11_0_4_pfp.bin");
+MODULE_FIRMWARE("amdgpu/gc_11_0_4_me.bin");
+MODULE_FIRMWARE("amdgpu/gc_11_0_4_mec.bin");
+MODULE_FIRMWARE("amdgpu/gc_11_0_4_rlc.bin");
static const struct soc15_reg_golden golden_settings_gc_11_0_1[] =
{
@@ -262,6 +266,7 @@ static void gfx_v11_0_init_golden_regist
{
switch (adev->ip_versions[GC_HWIP][0]) {
case IP_VERSION(11, 0, 1):
+ case IP_VERSION(11, 0, 4):
soc15_program_register_sequence(adev,
golden_settings_gc_11_0_1,
(const u32)ARRAY_SIZE(golden_settings_gc_11_0_1));
@@ -856,6 +861,7 @@ static int gfx_v11_0_gpu_early_init(stru
adev->gfx.config.sc_earlyz_tile_fifo_size = 0x4C0;
break;
case IP_VERSION(11, 0, 1):
+ case IP_VERSION(11, 0, 4):
adev->gfx.config.max_hw_contexts = 8;
adev->gfx.config.sc_prim_fifo_size_frontend = 0x20;
adev->gfx.config.sc_prim_fifo_size_backend = 0x100;
@@ -1285,6 +1291,7 @@ static int gfx_v11_0_sw_init(void *handl
case IP_VERSION(11, 0, 1):
case IP_VERSION(11, 0, 2):
case IP_VERSION(11, 0, 3):
+ case IP_VERSION(11, 0, 4):
adev->gfx.me.num_me = 1;
adev->gfx.me.num_pipe_per_me = 1;
adev->gfx.me.num_queue_per_pipe = 1;
@@ -2486,7 +2493,8 @@ static int gfx_v11_0_wait_for_rlc_autolo
for (i = 0; i < adev->usec_timeout; i++) {
cp_status = RREG32_SOC15(GC, 0, regCP_STAT);
- if (adev->ip_versions[GC_HWIP][0] == IP_VERSION(11, 0, 1))
+ if (adev->ip_versions[GC_HWIP][0] == IP_VERSION(11, 0, 1) ||
+ adev->ip_versions[GC_HWIP][0] == IP_VERSION(11, 0, 4))
bootload_status = RREG32_SOC15(GC, 0,
regRLC_RLCS_BOOTLOAD_STATUS_gc_11_0_1);
else
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 168/193] drm/amdgpu: add gmc v11 support for GC 11.0.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 167/193] drm/amdgpu: add gfx support " Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 169/193] drm/amdgpu/discovery: add PSP IP v13.0.11 support Greg Kroah-Hartman
` (33 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit d0ca8248999e4c5b02ac64f40536ff46dc14dda7 upstream.
Add gmc v11 support for GC 11.0.4.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c
@@ -749,6 +749,7 @@ static int gmc_v11_0_sw_init(void *handl
case IP_VERSION(11, 0, 1):
case IP_VERSION(11, 0, 2):
case IP_VERSION(11, 0, 3):
+ case IP_VERSION(11, 0, 4):
adev->num_vmhubs = 2;
/*
* To fulfill 4-level page support,
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 169/193] drm/amdgpu/discovery: add PSP IP v13.0.11 support
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 168/193] drm/amdgpu: add gmc v11 " Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:04 ` [PATCH 6.1 170/193] drm/amdgpu/pm: enable swsmu for SMU IP v13.0.11 Greg Kroah-Hartman
` (32 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Huang, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Tim Huang <tim.huang@amd.com>
commit 7c1389f1b1228b96e621815e63eaa2e89b9f7511 upstream.
Add PSP IP v13.0.11 ip discovery support.
Signed-off-by: Tim Huang <tim.huang@amd.com>
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1638,6 +1638,7 @@ static int amdgpu_discovery_set_psp_ip_b
case IP_VERSION(13, 0, 7):
case IP_VERSION(13, 0, 8):
case IP_VERSION(13, 0, 10):
+ case IP_VERSION(13, 0, 11):
amdgpu_device_ip_block_add(adev, &psp_v13_0_ip_block);
break;
case IP_VERSION(13, 0, 4):
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 170/193] drm/amdgpu/pm: enable swsmu for SMU IP v13.0.11
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 169/193] drm/amdgpu/discovery: add PSP IP v13.0.11 support Greg Kroah-Hartman
@ 2023-01-22 15:04 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 171/193] drm/amdgpu: add smu 13 support for smu 13.0.11 Greg Kroah-Hartman
` (31 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit 16412a94364d1dcebded9217ecb693c9659eaabc upstream.
Add the entry to set the ppt functions for SMU IP v13.0.11.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -585,6 +585,7 @@ static int smu_set_funcs(struct amdgpu_d
yellow_carp_set_ppt_funcs(smu);
break;
case IP_VERSION(13, 0, 4):
+ case IP_VERSION(13, 0, 11):
smu_v13_0_4_set_ppt_funcs(smu);
break;
case IP_VERSION(13, 0, 5):
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 171/193] drm/amdgpu: add smu 13 support for smu 13.0.11
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2023-01-22 15:04 ` [PATCH 6.1 170/193] drm/amdgpu/pm: enable swsmu for SMU IP v13.0.11 Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 172/193] drm/amdgpu/pm: add GFXOFF control IP version check for SMU IP v13.0.11 Greg Kroah-Hartman
` (30 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit 51e7a2168769c2f46edd93a18d4cba4a6d4adb13 upstream.
this patch to add smu 13 support for smu 13.0.11.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 ++
2 files changed, 3 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1689,6 +1689,7 @@ static int amdgpu_discovery_set_smu_ip_b
case IP_VERSION(13, 0, 7):
case IP_VERSION(13, 0, 8):
case IP_VERSION(13, 0, 10):
+ case IP_VERSION(13, 0, 11):
amdgpu_device_ip_block_add(adev, &smu_v13_0_ip_block);
break;
default:
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -250,6 +250,7 @@ int smu_v13_0_check_fw_status(struct smu
switch (adev->ip_versions[MP1_HWIP][0]) {
case IP_VERSION(13, 0, 4):
+ case IP_VERSION(13, 0, 11):
mp1_fw_flags = RREG32_PCIE(MP1_Public |
(smnMP1_V13_0_4_FIRMWARE_FLAGS & 0xffffffff));
break;
@@ -303,6 +304,7 @@ int smu_v13_0_check_fw_version(struct sm
smu->smc_driver_if_version = SMU13_DRIVER_IF_VERSION_YELLOW_CARP;
break;
case IP_VERSION(13, 0, 4):
+ case IP_VERSION(13, 0, 11):
smu->smc_driver_if_version = SMU13_DRIVER_IF_VERSION_SMU_V13_0_4;
break;
case IP_VERSION(13, 0, 5):
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 172/193] drm/amdgpu/pm: add GFXOFF control IP version check for SMU IP v13.0.11
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 171/193] drm/amdgpu: add smu 13 support for smu 13.0.11 Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 173/193] drm/amdgpu/soc21: add mode2 asic reset " Greg Kroah-Hartman
` (29 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit 9f83e61201bb21957e4993736532edad7a11c7fa upstream.
Enable the SMU IP v13.0.11 GFXOFF control
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -845,6 +845,7 @@ int smu_v13_0_gfx_off_control(struct smu
case IP_VERSION(13, 0, 7):
case IP_VERSION(13, 0, 8):
case IP_VERSION(13, 0, 10):
+ case IP_VERSION(13, 0, 11):
if (!(adev->pm.pp_feature & PP_GFXOFF_MASK))
return 0;
if (enable)
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 173/193] drm/amdgpu/soc21: add mode2 asic reset for SMU IP v13.0.11
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 172/193] drm/amdgpu/pm: add GFXOFF control IP version check for SMU IP v13.0.11 Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 174/193] drm/amdgpu/pm: use the specific mailbox registers only for SMU IP v13.0.4 Greg Kroah-Hartman
` (28 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Huang, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Tim Huang <tim.huang@amd.com>
commit 18ad18853cf2d8b94cef0112ba94f7a7535a9e89 upstream.
Set the default reset method to mode2 for SMU IP v13.0.11
Signed-off-by: Tim Huang <tim.huang@amd.com>
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/soc21.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/soc21.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc21.c
@@ -325,6 +325,7 @@ soc21_asic_reset_method(struct amdgpu_de
case IP_VERSION(13, 0, 10):
return AMD_RESET_METHOD_MODE1;
case IP_VERSION(13, 0, 4):
+ case IP_VERSION(13, 0, 11):
return AMD_RESET_METHOD_MODE2;
default:
if (amdgpu_dpm_is_baco_supported(adev))
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 174/193] drm/amdgpu/pm: use the specific mailbox registers only for SMU IP v13.0.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 173/193] drm/amdgpu/soc21: add mode2 asic reset " Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 175/193] drm/amdgpu/discovery: enable nbio support for NBIO v7.7.1 Greg Kroah-Hartman
` (27 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Huang, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Tim Huang <tim.huang@amd.com>
commit 069a5af97ce3a1448a3566ce8b63b60e51e19958 upstream.
The SMU IP v13.0.4 ppt interface is shared by IP v13.0.11, they use
the different mailbox register offset. So use the specific mailbox
registers offset for v13.0.4.
Signed-off-by: Tim Huang <tim.huang@amd.com>
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
@@ -1026,6 +1026,15 @@ static const struct pptable_funcs smu_v1
.set_gfx_power_up_by_imu = smu_v13_0_set_gfx_power_up_by_imu,
};
+static void smu_v13_0_4_set_smu_mailbox_registers(struct smu_context *smu)
+{
+ struct amdgpu_device *adev = smu->adev;
+
+ smu->param_reg = SOC15_REG_OFFSET(MP1, 0, mmMP1_SMN_C2PMSG_82);
+ smu->msg_reg = SOC15_REG_OFFSET(MP1, 0, mmMP1_SMN_C2PMSG_66);
+ smu->resp_reg = SOC15_REG_OFFSET(MP1, 0, mmMP1_SMN_C2PMSG_90);
+}
+
void smu_v13_0_4_set_ppt_funcs(struct smu_context *smu)
{
struct amdgpu_device *adev = smu->adev;
@@ -1035,7 +1044,9 @@ void smu_v13_0_4_set_ppt_funcs(struct sm
smu->feature_map = smu_v13_0_4_feature_mask_map;
smu->table_map = smu_v13_0_4_table_map;
smu->is_apu = true;
- smu->param_reg = SOC15_REG_OFFSET(MP1, 0, mmMP1_SMN_C2PMSG_82);
- smu->msg_reg = SOC15_REG_OFFSET(MP1, 0, mmMP1_SMN_C2PMSG_66);
- smu->resp_reg = SOC15_REG_OFFSET(MP1, 0, mmMP1_SMN_C2PMSG_90);
+
+ if (adev->ip_versions[MP1_HWIP][0] == IP_VERSION(13, 0, 4))
+ smu_v13_0_4_set_smu_mailbox_registers(smu);
+ else
+ smu_v13_0_set_smu_mailbox_registers(smu);
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 175/193] drm/amdgpu/discovery: enable nbio support for NBIO v7.7.1
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 174/193] drm/amdgpu/pm: use the specific mailbox registers only for SMU IP v13.0.4 Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 176/193] drm/amdgpu: enable PSP IP v13.0.11 support Greg Kroah-Hartman
` (26 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit 7308ceb44663f40bf9e7373c3b1aa4f7f433d625 upstream.
this patch is to enable nbio support for NBIO v7.7.1.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -2258,6 +2258,7 @@ int amdgpu_discovery_set_ip_blocks(struc
adev->nbio.hdp_flush_reg = &nbio_v4_3_hdp_flush_reg;
break;
case IP_VERSION(7, 7, 0):
+ case IP_VERSION(7, 7, 1):
adev->nbio.funcs = &nbio_v7_7_funcs;
adev->nbio.hdp_flush_reg = &nbio_v7_7_hdp_flush_reg;
break;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 176/193] drm/amdgpu: enable PSP IP v13.0.11 support
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 175/193] drm/amdgpu/discovery: enable nbio support for NBIO v7.7.1 Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 177/193] drm/amdgpu: enable GFX IP v11.0.4 CG support Greg Kroah-Hartman
` (25 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Huang, Yifan Zhang, Aaron Liu,
Alex Deucher, Limonciello, Mario
From: Tim Huang <tim.huang@amd.com>
commit 2c83e3fd928b9cb1e35340e58d4b1bd2eea23ed6 upstream.
Enable PSP FW loading for PSP IP v13.0.11
Signed-off-by: Tim Huang <tim.huang@amd.com>
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 1 +
drivers/gpu/drm/amd/amdgpu/psp_v13_0.c | 3 +++
2 files changed, 4 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -139,6 +139,7 @@ static int psp_early_init(void *handle)
case IP_VERSION(13, 0, 5):
case IP_VERSION(13, 0, 8):
case IP_VERSION(13, 0, 10):
+ case IP_VERSION(13, 0, 11):
psp_v13_0_set_psp_funcs(psp);
psp->autoload_supported = true;
break;
--- a/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c
@@ -46,6 +46,8 @@ MODULE_FIRMWARE("amdgpu/psp_13_0_7_sos.b
MODULE_FIRMWARE("amdgpu/psp_13_0_7_ta.bin");
MODULE_FIRMWARE("amdgpu/psp_13_0_10_sos.bin");
MODULE_FIRMWARE("amdgpu/psp_13_0_10_ta.bin");
+MODULE_FIRMWARE("amdgpu/psp_13_0_11_toc.bin");
+MODULE_FIRMWARE("amdgpu/psp_13_0_11_ta.bin");
/* For large FW files the time to complete can be very long */
#define USBC_PD_POLLING_LIMIT_S 240
@@ -102,6 +104,7 @@ static int psp_v13_0_init_microcode(stru
case IP_VERSION(13, 0, 3):
case IP_VERSION(13, 0, 5):
case IP_VERSION(13, 0, 8):
+ case IP_VERSION(13, 0, 11):
err = psp_init_toc_microcode(psp, chip_name);
if (err)
return err;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 177/193] drm/amdgpu: enable GFX IP v11.0.4 CG support
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 176/193] drm/amdgpu: enable PSP IP v13.0.11 support Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 178/193] drm/amdgpu: enable GFX Power Gating for GC IP v11.0.4 Greg Kroah-Hartman
` (24 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Huang, Alex Deucher, Limonciello, Mario
From: Tim Huang <tim.huang@amd.com>
commit f2b91e5a7cc0368709964994ca253781b51a486a upstream.
Add CG support for GFX/MC/HDP/ATHUB/IH/BIF.
Signed-off-by: Tim Huang <tim.huang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/soc21.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/soc21.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc21.c
@@ -655,7 +655,23 @@ static int soc21_common_early_init(void
adev->external_rev_id = adev->rev_id + 0x20;
break;
case IP_VERSION(11, 0, 4):
- adev->cg_flags = AMD_CG_SUPPORT_VCN_MGCG |
+ adev->cg_flags =
+ AMD_CG_SUPPORT_GFX_CGCG |
+ AMD_CG_SUPPORT_GFX_CGLS |
+ AMD_CG_SUPPORT_GFX_MGCG |
+ AMD_CG_SUPPORT_GFX_FGCG |
+ AMD_CG_SUPPORT_REPEATER_FGCG |
+ AMD_CG_SUPPORT_GFX_PERF_CLK |
+ AMD_CG_SUPPORT_MC_MGCG |
+ AMD_CG_SUPPORT_MC_LS |
+ AMD_CG_SUPPORT_HDP_MGCG |
+ AMD_CG_SUPPORT_HDP_LS |
+ AMD_CG_SUPPORT_ATHUB_MGCG |
+ AMD_CG_SUPPORT_ATHUB_LS |
+ AMD_CG_SUPPORT_IH_CG |
+ AMD_CG_SUPPORT_BIF_MGCG |
+ AMD_CG_SUPPORT_BIF_LS |
+ AMD_CG_SUPPORT_VCN_MGCG |
AMD_CG_SUPPORT_JPEG_MGCG;
adev->pg_flags = AMD_PG_SUPPORT_VCN |
AMD_PG_SUPPORT_VCN_DPG |
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 178/193] drm/amdgpu: enable GFX Power Gating for GC IP v11.0.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 177/193] drm/amdgpu: enable GFX IP v11.0.4 CG support Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 179/193] drm/amdgpu: enable GFX Clock Gating control " Greg Kroah-Hartman
` (23 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Huang, Alex Deucher, Limonciello, Mario
From: Tim Huang <tim.huang@amd.com>
commit a89e2965da6e644729a8ee9c318b7fa9a2990353 upstream.
Enable GFX Power Gating control for GC IP v11.0.4.
Signed-off-by: Tim Huang <tim.huang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -5030,6 +5030,7 @@ static void gfx_v11_cntl_power_gating(st
if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG)) {
switch (adev->ip_versions[GC_HWIP][0]) {
case IP_VERSION(11, 0, 1):
+ case IP_VERSION(11, 0, 4):
WREG32_SOC15(GC, 0, regRLC_PG_DELAY_3, RLC_PG_DELAY_3_DEFAULT_GC_11_0_1);
break;
default:
@@ -5063,6 +5064,7 @@ static int gfx_v11_0_set_powergating_sta
amdgpu_gfx_off_ctrl(adev, enable);
break;
case IP_VERSION(11, 0, 1):
+ case IP_VERSION(11, 0, 4):
gfx_v11_cntl_pg(adev, enable);
amdgpu_gfx_off_ctrl(adev, enable);
break;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 179/193] drm/amdgpu: enable GFX Clock Gating control for GC IP v11.0.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 178/193] drm/amdgpu: enable GFX Power Gating for GC IP v11.0.4 Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 180/193] drm/amdgpu: add tmz support for GC 11.0.1 Greg Kroah-Hartman
` (22 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Huang, Alex Deucher, Limonciello, Mario
From: Tim Huang <tim.huang@amd.com>
commit f9caa237372b106b5e70ba1a4bfd4222eb79ec71 upstream.
Enable GFX IP v11.0.4 CG gate/ungate control.
Signed-off-by: Tim Huang <tim.huang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -5088,6 +5088,7 @@ static int gfx_v11_0_set_clockgating_sta
case IP_VERSION(11, 0, 1):
case IP_VERSION(11, 0, 2):
case IP_VERSION(11, 0, 3):
+ case IP_VERSION(11, 0, 4):
gfx_v11_0_update_gfx_clock_gating(adev,
state == AMD_CG_STATE_GATE);
break;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 180/193] drm/amdgpu: add tmz support for GC 11.0.1
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 179/193] drm/amdgpu: enable GFX Clock Gating control " Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 181/193] drm/amdgpu: add tmz support for GC IP v11.0.4 Greg Kroah-Hartman
` (21 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Tim Huang,
Alex Deucher, Limonciello, Mario
From: Yifan Zhang <yifan1.zhang@amd.com>
commit 97074216917b4188f0af3e52cc5b3f2b277bbbca upstream.
this patch to add tmz support for GC 11.0.1.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Tim Huang <Tim.Huang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
@@ -548,6 +548,7 @@ void amdgpu_gmc_tmz_set(struct amdgpu_de
case IP_VERSION(10, 3, 1):
/* YELLOW_CARP*/
case IP_VERSION(10, 3, 3):
+ case IP_VERSION(11, 0, 1):
/* Don't enable it by default yet.
*/
if (amdgpu_tmz < 1) {
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 181/193] drm/amdgpu: add tmz support for GC IP v11.0.4
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 180/193] drm/amdgpu: add tmz support for GC 11.0.1 Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 182/193] drm/amdgpu: correct MEC number for gfx11 APUs Greg Kroah-Hartman
` (20 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Huang, Alex Deucher, Limonciello, Mario
From: Tim Huang <tim.huang@amd.com>
commit 2aecbe492a3c0bf4c21f78c099a6f6c205fab0c7 upstream.
Add tmz support for GC 11.0.4.
Signed-off-by: Tim Huang <tim.huang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
@@ -549,6 +549,7 @@ void amdgpu_gmc_tmz_set(struct amdgpu_de
/* YELLOW_CARP*/
case IP_VERSION(10, 3, 3):
case IP_VERSION(11, 0, 1):
+ case IP_VERSION(11, 0, 4):
/* Don't enable it by default yet.
*/
if (amdgpu_tmz < 1) {
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 182/193] drm/amdgpu: correct MEC number for gfx11 APUs
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 181/193] drm/amdgpu: add tmz support for GC IP v11.0.4 Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 183/193] s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 Greg Kroah-Hartman
` (19 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lang Yu, Aaron Liu, Yifan Zhang,
Alex Deucher
From: Lang Yu <Lang.Yu@amd.com>
commit 0ddadc3a2208aedb1b27dbb76d0b4e722b5b527a upstream.
There is only one MEC on these APUs.
Signed-off-by: Lang Yu <Lang.Yu@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.1.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -1288,10 +1288,8 @@ static int gfx_v11_0_sw_init(void *handl
switch (adev->ip_versions[GC_HWIP][0]) {
case IP_VERSION(11, 0, 0):
- case IP_VERSION(11, 0, 1):
case IP_VERSION(11, 0, 2):
case IP_VERSION(11, 0, 3):
- case IP_VERSION(11, 0, 4):
adev->gfx.me.num_me = 1;
adev->gfx.me.num_pipe_per_me = 1;
adev->gfx.me.num_queue_per_pipe = 1;
@@ -1299,6 +1297,15 @@ static int gfx_v11_0_sw_init(void *handl
adev->gfx.mec.num_pipe_per_mec = 4;
adev->gfx.mec.num_queue_per_pipe = 4;
break;
+ case IP_VERSION(11, 0, 1):
+ case IP_VERSION(11, 0, 4):
+ adev->gfx.me.num_me = 1;
+ adev->gfx.me.num_pipe_per_me = 1;
+ adev->gfx.me.num_queue_per_pipe = 1;
+ adev->gfx.mec.num_mec = 1;
+ adev->gfx.mec.num_pipe_per_mec = 4;
+ adev->gfx.mec.num_queue_per_pipe = 4;
+ break;
default:
adev->gfx.me.num_me = 1;
adev->gfx.me.num_pipe_per_me = 1;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 183/193] s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 182/193] drm/amdgpu: correct MEC number for gfx11 APUs Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 184/193] powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT Greg Kroah-Hartman
` (18 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Masahiro Yamada,
Heiko Carstens
From: Masahiro Yamada <masahiroy@kernel.org>
commit a494398bde273143c2352dd373cad8211f7d94b2 upstream.
Nathan Chancellor reports that the s390 vmlinux fails to link with
GNU ld < 2.36 since commit 99cb0d917ffa ("arch: fix broken BuildID
for arm64 and riscv").
It happens for defconfig, or more specifically for CONFIG_EXPOLINE=y.
$ s390x-linux-gnu-ld --version | head -n1
GNU ld (GNU Binutils for Debian) 2.35.2
$ make -s ARCH=s390 CROSS_COMPILE=s390x-linux-gnu- allnoconfig
$ ./scripts/config -e CONFIG_EXPOLINE
$ make -s ARCH=s390 CROSS_COMPILE=s390x-linux-gnu- olddefconfig
$ make -s ARCH=s390 CROSS_COMPILE=s390x-linux-gnu-
`.exit.text' referenced in section `.s390_return_reg' of drivers/base/dd.o: defined in discarded section `.exit.text' of drivers/base/dd.o
make[1]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1
make: *** [Makefile:1252: vmlinux] Error 2
arch/s390/kernel/vmlinux.lds.S wants to keep EXIT_TEXT:
.exit.text : {
EXIT_TEXT
}
But, at the same time, EXIT_TEXT is thrown away by DISCARD because
s390 does not define RUNTIME_DISCARD_EXIT.
I still do not understand why the latter wins after 99cb0d917ffa,
but defining RUNTIME_DISCARD_EXIT seems correct because the comment
line in arch/s390/kernel/vmlinux.lds.S says:
/*
* .exit.text is discarded at runtime, not link time,
* to deal with references from __bug_table
*/
Nathan also found that binutils commit 21401fc7bf67 ("Duplicate output
sections in scripts") cured this issue, so we cannot reproduce it with
binutils 2.36+, but it is better to not rely on it.
Fixes: 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv")
Link: https://lore.kernel.org/all/Y7Jal56f6UBh1abE@dev-arch.thelio-3990X/
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Link: https://lore.kernel.org/r/20230105031306.1455409-1-masahiroy@kernel.org
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/vmlinux.lds.S | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -17,6 +17,8 @@
/* Handle ro_after_init data on our own. */
#define RO_AFTER_INIT_DATA
+#define RUNTIME_DISCARD_EXIT
+
#define EMITS_PT_NOTE
#include <asm-generic/vmlinux.lds.h>
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 184/193] powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 183/193] s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 185/193] powerpc/vmlinux.lds: Dont discard .rela* for relocatable builds Greg Kroah-Hartman
` (17 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Ellerman
From: Michael Ellerman <mpe@ellerman.id.au>
commit 4b9880dbf3bdba3a7c56445137c3d0e30aaa0a40 upstream.
The powerpc linker script explicitly includes .exit.text, because
otherwise the link fails due to references from __bug_table and
__ex_table. The code is freed (discarded) at runtime along with
.init.text and data.
That has worked in the past despite powerpc not defining
RUNTIME_DISCARD_EXIT because DISCARDS appears late in the powerpc linker
script (line 410), and the explicit inclusion of .exit.text
earlier (line 280) supersedes the discard.
However commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and
riscv") introduced an earlier use of DISCARD as part of the RO_DATA
macro (line 136). With binutils < 2.36 that causes the DISCARD
directives later in the script to be applied earlier [1], causing
.exit.text to actually be discarded at link time, leading to build
errors:
'.exit.text' referenced in section '__bug_table' of crypto/algboss.o: defined in
discarded section '.exit.text' of crypto/algboss.o
'.exit.text' referenced in section '__ex_table' of drivers/nvdimm/core.o: defined in
discarded section '.exit.text' of drivers/nvdimm/core.o
Fix it by defining RUNTIME_DISCARD_EXIT, which causes the generic
DISCARDS macro to not include .exit.text at all.
1: https://lore.kernel.org/lkml/87fscp2v7k.fsf@igel.home/
Fixes: 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20230105132349.384666-1-mpe@ellerman.id.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/vmlinux.lds.S | 1 +
1 file changed, 1 insertion(+)
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -8,6 +8,7 @@
#define BSS_FIRST_SECTIONS *(.bss.prominit)
#define EMITS_PT_NOTE
#define RO_EXCEPTION_TABLE_ALIGN 0
+#define RUNTIME_DISCARD_EXIT
#define SOFT_MASK_TABLE(align) \
. = ALIGN(align); \
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 185/193] powerpc/vmlinux.lds: Dont discard .rela* for relocatable builds
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 184/193] powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 186/193] powerpc/vmlinux.lds: Dont discard .comment Greg Kroah-Hartman
` (16 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Ellerman
From: Michael Ellerman <mpe@ellerman.id.au>
commit 07b050f9290ee012a407a0f64151db902a1520f5 upstream.
Relocatable kernels must not discard relocations, they need to be
processed at runtime. As such they are included for CONFIG_RELOCATABLE
builds in the powerpc linker script (line 340).
However they are also unconditionally discarded later in the
script (line 414). Previously that worked because the earlier inclusion
superseded the discard.
However commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and
riscv") introduced an earlier use of DISCARD as part of the RO_DATA
macro (line 137). With binutils < 2.36 that causes the DISCARD
directives later in the script to be applied earlier, causing .rela* to
actually be discarded at link time, leading to build warnings and a
kernel that doesn't boot:
ld: warning: discarding dynamic section .rela.init.rodata
Fix it by conditionally discarding .rela* only when CONFIG_RELOCATABLE
is disabled.
Fixes: 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20230105132349.384666-2-mpe@ellerman.id.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/vmlinux.lds.S | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -411,9 +411,12 @@ SECTIONS
DISCARDS
/DISCARD/ : {
*(*.EMB.apuinfo)
- *(.glink .iplt .plt .rela* .comment)
+ *(.glink .iplt .plt .comment)
*(.gnu.version*)
*(.gnu.attributes)
*(.eh_frame)
+#ifndef CONFIG_RELOCATABLE
+ *(.rela*)
+#endif
}
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 186/193] powerpc/vmlinux.lds: Dont discard .comment
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 185/193] powerpc/vmlinux.lds: Dont discard .rela* for relocatable builds Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 187/193] octeontx2-pf: Avoid use of GFP_KERNEL in atomic context Greg Kroah-Hartman
` (15 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Ellerman
From: Michael Ellerman <mpe@ellerman.id.au>
commit be5f95c8779e19779dd81927c8574fec5aaba36c upstream.
Although the powerpc linker script mentions .comment in the DISCARD
section, that has never actually caused it to be discarded, because the
earlier ELF_DETAILS macro (previously STABS_DEBUG) explicitly includes
.comment.
However commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and
riscv") introduced an earlier use of DISCARD as part of the RO_DATA
macro. With binutils < 2.36 that causes the DISCARD directives later in
the script to be applied earlier, causing .comment to actually be
discarded.
It's confusing to explicitly include and discard .comment, and even more
so if the behaviour depends on the toolchain version. So don't discard
.comment in order to maintain the existing behaviour in all cases.
Fixes: 83a092cf95f2 ("powerpc: Link warning for orphan sections")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20230105132349.384666-3-mpe@ellerman.id.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/vmlinux.lds.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -411,7 +411,7 @@ SECTIONS
DISCARDS
/DISCARD/ : {
*(*.EMB.apuinfo)
- *(.glink .iplt .plt .comment)
+ *(.glink .iplt .plt)
*(.gnu.version*)
*(.gnu.attributes)
*(.eh_frame)
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 187/193] octeontx2-pf: Avoid use of GFP_KERNEL in atomic context
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 186/193] powerpc/vmlinux.lds: Dont discard .comment Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 188/193] net/ulp: use consistent error code when blocking ULP Greg Kroah-Hartman
` (14 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geetha sowjanya,
Sunil Kovvuri Goutham, Leon Romanovsky, David S. Miller
From: Geetha sowjanya <gakula@marvell.com>
commit 87b93b678e95c7d93fe6a55b0e0fbda26d8c7760 upstream.
Using GFP_KERNEL in preemption disable context, causing below warning
when CONFIG_DEBUG_ATOMIC_SLEEP is enabled.
[ 32.542271] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274
[ 32.550883] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0
[ 32.558707] preempt_count: 1, expected: 0
[ 32.562710] RCU nest depth: 0, expected: 0
[ 32.566800] CPU: 3 PID: 1 Comm: swapper/0 Tainted: G W 6.2.0-rc2-00269-gae9dcb91c606 #7
[ 32.576188] Hardware name: Marvell CN106XX board (DT)
[ 32.581232] Call trace:
[ 32.583670] dump_backtrace.part.0+0xe0/0xf0
[ 32.587937] show_stack+0x18/0x30
[ 32.591245] dump_stack_lvl+0x68/0x84
[ 32.594900] dump_stack+0x18/0x34
[ 32.598206] __might_resched+0x12c/0x160
[ 32.602122] __might_sleep+0x48/0xa0
[ 32.605689] __kmem_cache_alloc_node+0x2b8/0x2e0
[ 32.610301] __kmalloc+0x58/0x190
[ 32.613610] otx2_sq_aura_pool_init+0x1a8/0x314
[ 32.618134] otx2_open+0x1d4/0x9d0
To avoid use of GFP_ATOMIC for memory allocation, disable preemption
after all memory allocation is done.
Fixes: 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura free")
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
@@ -1370,7 +1370,6 @@ int otx2_sq_aura_pool_init(struct otx2_n
if (err)
goto fail;
- get_cpu();
/* Allocate pointers and free them to aura/pool */
for (qidx = 0; qidx < hw->tot_tx_queues; qidx++) {
pool_id = otx2_get_pool_idx(pfvf, AURA_NIX_SQ, qidx);
@@ -1388,13 +1387,14 @@ int otx2_sq_aura_pool_init(struct otx2_n
err = otx2_alloc_rbuf(pfvf, pool, &bufptr);
if (err)
goto err_mem;
+ get_cpu();
pfvf->hw_ops->aura_freeptr(pfvf, pool_id, bufptr);
+ put_cpu();
sq->sqb_ptrs[sq->sqb_count++] = (u64)bufptr;
}
}
err_mem:
- put_cpu();
return err ? -ENOMEM : 0;
fail:
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 188/193] net/ulp: use consistent error code when blocking ULP
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 187/193] octeontx2-pf: Avoid use of GFP_KERNEL in atomic context Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 189/193] octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt Greg Kroah-Hartman
` (13 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sabrina Dubroca, Paolo Abeni,
Jakub Kicinski
From: Paolo Abeni <pabeni@redhat.com>
commit 8ccc99362b60c6f27bb46f36fdaaccf4ef0303de upstream.
The referenced commit changed the error code returned by the kernel
when preventing a non-established socket from attaching the ktls
ULP. Before to such a commit, the user-space got ENOTCONN instead
of EINVAL.
The existing self-tests depend on such error code, and the change
caused a failure:
RUN global.non_established ...
tls.c:1673:non_established:Expected errno (22) == ENOTCONN (107)
non_established: Test failed at step #3
FAIL global.non_established
In the unlikely event existing applications do the same, address
the issue by restoring the prior error code in the above scenario.
Note that the only other ULP performing similar checks at init
time - smc_ulp_ops - also fails with ENOTCONN when trying to attach
the ULP to a non-established socket.
Reported-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2c02d41d71f9 ("net/ulp: prevent ULP without clone op from entering the LISTEN status")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://lore.kernel.org/r/7bb199e7a93317fb6f8bf8b9b2dc71c18f337cde.1674042685.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_ulp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/tcp_ulp.c
+++ b/net/ipv4/tcp_ulp.c
@@ -139,7 +139,7 @@ static int __tcp_set_ulp(struct sock *sk
if (sk->sk_socket)
clear_bit(SOCK_SUPPORT_ZC, &sk->sk_socket->flags);
- err = -EINVAL;
+ err = -ENOTCONN;
if (!ulp_ops->clone && sk->sk_state == TCP_LISTEN)
goto out_err;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 189/193] octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 188/193] net/ulp: use consistent error code when blocking ULP Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 190/193] net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work() Greg Kroah-Hartman
` (12 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kevin Hao, Paolo Abeni
From: Kevin Hao <haokexin@gmail.com>
commit 55ba18dc62deff5910c0fa64486dea1ff20832ff upstream.
The commit 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura
free") uses the get/put_cpu() to protect the usage of percpu pointer
in ->aura_freeptr() callback, but it also unnecessarily disable the
preemption for the blockable memory allocation. The commit 87b93b678e95
("octeontx2-pf: Avoid use of GFP_KERNEL in atomic context") tried to
fix these sleep inside atomic warnings. But it only fix the one for
the non-rt kernel. For the rt kernel, we still get the similar warnings
like below.
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
3 locks held by swapper/0/1:
#0: ffff800009fc5fe8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x24/0x30
#1: ffff000100c276c0 (&mbox->lock){+.+.}-{3:3}, at: otx2_init_hw_resources+0x8c/0x3a4
#2: ffffffbfef6537e0 (&cpu_rcache->lock){+.+.}-{2:2}, at: alloc_iova_fast+0x1ac/0x2ac
Preemption disabled at:
[<ffff800008b1908c>] otx2_rq_aura_pool_init+0x14c/0x284
CPU: 20 PID: 1 Comm: swapper/0 Tainted: G W 6.2.0-rc3-rt1-yocto-preempt-rt #1
Hardware name: Marvell OcteonTX CN96XX board (DT)
Call trace:
dump_backtrace.part.0+0xe8/0xf4
show_stack+0x20/0x30
dump_stack_lvl+0x9c/0xd8
dump_stack+0x18/0x34
__might_resched+0x188/0x224
rt_spin_lock+0x64/0x110
alloc_iova_fast+0x1ac/0x2ac
iommu_dma_alloc_iova+0xd4/0x110
__iommu_dma_map+0x80/0x144
iommu_dma_map_page+0xe8/0x260
dma_map_page_attrs+0xb4/0xc0
__otx2_alloc_rbuf+0x90/0x150
otx2_rq_aura_pool_init+0x1c8/0x284
otx2_init_hw_resources+0xe4/0x3a4
otx2_open+0xf0/0x610
__dev_open+0x104/0x224
__dev_change_flags+0x1e4/0x274
dev_change_flags+0x2c/0x7c
ic_open_devs+0x124/0x2f8
ip_auto_config+0x180/0x42c
do_one_initcall+0x90/0x4dc
do_basic_setup+0x10c/0x14c
kernel_init_freeable+0x10c/0x13c
kernel_init+0x2c/0x140
ret_from_fork+0x10/0x20
Of course, we can shuffle the get/put_cpu() to only wrap the invocation
of ->aura_freeptr() as what commit 87b93b678e95 does. But there are only
two ->aura_freeptr() callbacks, otx2_aura_freeptr() and
cn10k_aura_freeptr(). There is no usage of perpcu variable in the
otx2_aura_freeptr() at all, so the get/put_cpu() seems redundant to it.
We can move the get/put_cpu() into the corresponding callback which
really has the percpu variable usage and avoid the sprinkling of
get/put_cpu() in several places.
Fixes: 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura free")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Link: https://lore.kernel.org/r/20230118071300.3271125-1-haokexin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 11 ++---------
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 2 ++
2 files changed, 4 insertions(+), 9 deletions(-)
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
@@ -1012,7 +1012,6 @@ static void otx2_pool_refill_task(struct
rbpool = cq->rbpool;
free_ptrs = cq->pool_ptrs;
- get_cpu();
while (cq->pool_ptrs) {
if (otx2_alloc_rbuf(pfvf, rbpool, &bufptr)) {
/* Schedule a WQ if we fails to free atleast half of the
@@ -1032,7 +1031,6 @@ static void otx2_pool_refill_task(struct
pfvf->hw_ops->aura_freeptr(pfvf, qidx, bufptr + OTX2_HEAD_ROOM);
cq->pool_ptrs--;
}
- put_cpu();
cq->refill_task_sched = false;
}
@@ -1387,9 +1385,7 @@ int otx2_sq_aura_pool_init(struct otx2_n
err = otx2_alloc_rbuf(pfvf, pool, &bufptr);
if (err)
goto err_mem;
- get_cpu();
pfvf->hw_ops->aura_freeptr(pfvf, pool_id, bufptr);
- put_cpu();
sq->sqb_ptrs[sq->sqb_count++] = (u64)bufptr;
}
}
@@ -1435,21 +1431,18 @@ int otx2_rq_aura_pool_init(struct otx2_n
if (err)
goto fail;
- get_cpu();
/* Allocate pointers and free them to aura/pool */
for (pool_id = 0; pool_id < hw->rqpool_cnt; pool_id++) {
pool = &pfvf->qset.pool[pool_id];
for (ptr = 0; ptr < num_ptrs; ptr++) {
err = otx2_alloc_rbuf(pfvf, pool, &bufptr);
if (err)
- goto err_mem;
+ return -ENOMEM;
pfvf->hw_ops->aura_freeptr(pfvf, pool_id,
bufptr + OTX2_HEAD_ROOM);
}
}
-err_mem:
- put_cpu();
- return err ? -ENOMEM : 0;
+ return 0;
fail:
otx2_mbox_reset(&pfvf->mbox.mbox, 0);
otx2_aura_pool_free(pfvf);
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
@@ -733,8 +733,10 @@ static inline void cn10k_aura_freeptr(vo
u64 ptrs[2];
ptrs[1] = buf;
+ get_cpu();
/* Free only one buffer at time during init and teardown */
__cn10k_aura_freeptr(pfvf, aura, ptrs, 2);
+ put_cpu();
}
/* Alloc pointer from pool/aura */
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 190/193] net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 189/193] octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 191/193] block: mq-deadline: Rename deadline_is_seq_writes() Greg Kroah-Hartman
` (11 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Yang Yingliang, Shay Drory, Saeed Mahameed
From: Yang Yingliang <yangyingliang@huawei.com>
commit 90e7cb78b81543998217b0eb446c067ce2191a79 upstream.
Add missing mutex_unlock() before returning from
mlx5_fw_fatal_reporter_err_work().
Fixes: 9078e843efec ("net/mlx5: Avoid recovery in probe flows")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/health.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -677,6 +677,7 @@ static void mlx5_fw_fatal_reporter_err_w
mutex_lock(&dev->intf_state_mutex);
if (test_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags)) {
mlx5_core_err(dev, "health works are not permitted at this stage\n");
+ mutex_unlock(&dev->intf_state_mutex);
return;
}
mutex_unlock(&dev->intf_state_mutex);
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 191/193] block: mq-deadline: Rename deadline_is_seq_writes()
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 190/193] net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work() Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 192/193] Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" Greg Kroah-Hartman
` (10 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Jens Axboe
From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
commit 3692fec8bb476e8583e559ff5783a6adef306cf2 upstream.
Rename deadline_is_seq_writes() to deadline_is_seq_write() (remove the
"s" plural) to more correctly reflect the fact that this function tests
a single request, not multiple requests.
Fixes: 015d02f48537 ("block: mq-deadline: Do not break sequential write streams to zoned HDDs")
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Link: https://lore.kernel.org/r/20221126025550.967914-2-damien.lemoal@opensource.wdc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/mq-deadline.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -294,7 +294,7 @@ static inline int deadline_check_fifo(st
/*
* Check if rq has a sequential request preceding it.
*/
-static bool deadline_is_seq_writes(struct deadline_data *dd, struct request *rq)
+static bool deadline_is_seq_write(struct deadline_data *dd, struct request *rq)
{
struct request *prev = deadline_earlier_request(rq);
@@ -353,7 +353,7 @@ deadline_fifo_request(struct deadline_da
list_for_each_entry(rq, &per_prio->fifo_list[DD_WRITE], queuelist) {
if (blk_req_can_dispatch_to_zone(rq) &&
(blk_queue_nonrot(rq->q) ||
- !deadline_is_seq_writes(dd, rq)))
+ !deadline_is_seq_write(dd, rq)))
goto out;
}
rq = NULL;
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 192/193] Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 191/193] block: mq-deadline: Rename deadline_is_seq_writes() Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 15:05 ` [PATCH 6.1 193/193] soc: qcom: apr: Make qcom,protection-domain optional again Greg Kroah-Hartman
` (9 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Zhengchao Shao, Johannes Berg, Kalle Valo
From: Eric Dumazet <edumazet@google.com>
commit 80f8a66dede0a4b4e9e846765a97809c6fe49ce5 upstream.
This reverts commit 13e5afd3d773c6fc6ca2b89027befaaaa1ea7293.
ieee80211_if_free() is already called from free_netdev(ndev)
because ndev->priv_destructor == ieee80211_if_free
syzbot reported:
general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 0 PID: 10041 Comm: syz-executor.0 Not tainted 6.2.0-rc2-syzkaller-00388-g55b98837e37d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:pcpu_get_page_chunk mm/percpu.c:262 [inline]
RIP: 0010:pcpu_chunk_addr_search mm/percpu.c:1619 [inline]
RIP: 0010:free_percpu mm/percpu.c:2271 [inline]
RIP: 0010:free_percpu+0x186/0x10f0 mm/percpu.c:2254
Code: 80 3c 02 00 0f 85 f5 0e 00 00 48 8b 3b 48 01 ef e8 cf b3 0b 00 48 ba 00 00 00 00 00 fc ff df 48 8d 78 20 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 3b 0e 00 00 48 8b 58 20 48 b8 00 00 00 00 00 fc
RSP: 0018:ffffc90004ba7068 EFLAGS: 00010002
RAX: 0000000000000000 RBX: ffff88823ffe2b80 RCX: 0000000000000004
RDX: dffffc0000000000 RSI: ffffffff81c1f4e7 RDI: 0000000000000020
RBP: ffffe8fffe8fc220 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 1ffffffff2179ab2 R12: ffff8880b983d000
R13: 0000000000000003 R14: 0000607f450fc220 R15: ffff88823ffe2988
FS: 00007fcb349de700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32220000 CR3: 000000004914f000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
netdev_run_todo+0x6bf/0x1100 net/core/dev.c:10352
ieee80211_register_hw+0x2663/0x4040 net/mac80211/main.c:1411
mac80211_hwsim_new_radio+0x2537/0x4d80 drivers/net/wireless/mac80211_hwsim.c:4583
hwsim_new_radio_nl+0xa09/0x10f0 drivers/net/wireless/mac80211_hwsim.c:5176
genl_family_rcv_msg_doit.isra.0+0x1e6/0x2d0 net/netlink/genetlink.c:968
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x4ff/0x7e0 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2564
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]
netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1356
netlink_sendmsg+0x91b/0xe10 net/netlink/af_netlink.c:1932
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xd3/0x120 net/socket.c:734
____sys_sendmsg+0x712/0x8c0 net/socket.c:2476
___sys_sendmsg+0x110/0x1b0 net/socket.c:2530
__sys_sendmsg+0xf7/0x1c0 net/socket.c:2559
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Reported-by: syzbot <syzkaller@googlegroups.com>
Fixes: 13e5afd3d773 ("wifi: mac80211: fix memory leak in ieee80211_if_add()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Zhengchao Shao <shaozhengchao@huawei.com>
Cc: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230113124326.3533978-1-edumazet@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/iface.c | 1 -
1 file changed, 1 deletion(-)
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -2260,7 +2260,6 @@ int ieee80211_if_add(struct ieee80211_lo
ret = cfg80211_register_netdevice(ndev);
if (ret) {
- ieee80211_if_free(ndev);
free_netdev(ndev);
return ret;
}
^ permalink raw reply [flat|nested] 210+ messages in thread* [PATCH 6.1 193/193] soc: qcom: apr: Make qcom,protection-domain optional again
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 192/193] Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" Greg Kroah-Hartman
@ 2023-01-22 15:05 ` Greg Kroah-Hartman
2023-01-22 22:54 ` [PATCH 6.1 000/193] 6.1.8-rc1 review ogasawara takeshi
` (8 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-01-22 15:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stephan Gerhold, Bjorn Andersson
From: Stephan Gerhold <stephan@gerhold.net>
commit 599d41fb8ea8bd2a99ca9525dd69405020e43dda upstream.
APR should not fail if the service device tree node does not have
the qcom,protection-domain property, since this functionality does
not exist on older platforms such as MSM8916 and MSM8996.
Ignore -EINVAL (returned when the property does not exist) to fix
a regression on 6.2-rc1 that prevents audio from working:
qcom,apr remoteproc0:smd-edge.apr_audio_svc.-1.-1:
Failed to read second value of qcom,protection-domain
qcom,apr remoteproc0:smd-edge.apr_audio_svc.-1.-1:
Failed to add apr 3 svc
Fixes: 6d7860f5750d ("soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221229151648.19839-3-stephan@gerhold.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/qcom/apr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/soc/qcom/apr.c
+++ b/drivers/soc/qcom/apr.c
@@ -461,9 +461,10 @@ static int apr_add_device(struct device
goto out;
}
+ /* Protection domain is optional, it does not exist on older platforms */
ret = of_property_read_string_index(np, "qcom,protection-domain",
1, &adev->service_path);
- if (ret < 0) {
+ if (ret < 0 && ret != -EINVAL) {
dev_err(dev, "Failed to read second value of qcom,protection-domain\n");
goto out;
}
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2023-01-22 15:05 ` [PATCH 6.1 193/193] soc: qcom: apr: Make qcom,protection-domain optional again Greg Kroah-Hartman
@ 2023-01-22 22:54 ` ogasawara takeshi
2023-01-23 4:09 ` Joel Fernandes
` (7 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: ogasawara takeshi @ 2023-01-22 22:54 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow
Hi Greg
On Mon, Jan 23, 2023 at 12:22 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.1.8 release.
> There are 193 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 24 Jan 2023 15:02:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.8-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
6.1.8-rc1 tested.
x86_64
build successfully completed.
boot successfully completed.
No dmesg regressions.
Lenovo ThinkPad X1 Nano Gen1(Intel i5-1130G7, arch linux)
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2023-01-22 22:54 ` [PATCH 6.1 000/193] 6.1.8-rc1 review ogasawara takeshi
@ 2023-01-23 4:09 ` Joel Fernandes
2023-01-23 7:42 ` Rudi Heitbaum
` (6 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Joel Fernandes @ 2023-01-23 4:09 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow
On Sun, Jan 22, 2023 at 04:02:09PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.8 release.
> There are 193 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 24 Jan 2023 15:02:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.8-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
Passes all 19 rcutorture scenarios, each tested for 1 hour.
Tested-by: Joel Fernandes (Google) <joel@joelfernandes.org>
thanks,
- Joel
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 6.1.8-rc1
>
> Stephan Gerhold <stephan@gerhold.net>
> soc: qcom: apr: Make qcom,protection-domain optional again
>
> Eric Dumazet <edumazet@google.com>
> Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
>
> Damien Le Moal <damien.lemoal@opensource.wdc.com>
> block: mq-deadline: Rename deadline_is_seq_writes()
>
> Yang Yingliang <yangyingliang@huawei.com>
> net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
>
> Kevin Hao <haokexin@gmail.com>
> octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt
>
> Paolo Abeni <pabeni@redhat.com>
> net/ulp: use consistent error code when blocking ULP
>
> Geetha sowjanya <gakula@marvell.com>
> octeontx2-pf: Avoid use of GFP_KERNEL in atomic context
>
> Michael Ellerman <mpe@ellerman.id.au>
> powerpc/vmlinux.lds: Don't discard .comment
>
> Michael Ellerman <mpe@ellerman.id.au>
> powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds
>
> Michael Ellerman <mpe@ellerman.id.au>
> powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
>
> Masahiro Yamada <masahiroy@kernel.org>
> s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
>
> Lang Yu <Lang.Yu@amd.com>
> drm/amdgpu: correct MEC number for gfx11 APUs
>
> Tim Huang <tim.huang@amd.com>
> drm/amdgpu: add tmz support for GC IP v11.0.4
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu: add tmz support for GC 11.0.1
>
> Tim Huang <tim.huang@amd.com>
> drm/amdgpu: enable GFX Clock Gating control for GC IP v11.0.4
>
> Tim Huang <tim.huang@amd.com>
> drm/amdgpu: enable GFX Power Gating for GC IP v11.0.4
>
> Tim Huang <tim.huang@amd.com>
> drm/amdgpu: enable GFX IP v11.0.4 CG support
>
> Tim Huang <tim.huang@amd.com>
> drm/amdgpu: enable PSP IP v13.0.11 support
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu/discovery: enable nbio support for NBIO v7.7.1
>
> Tim Huang <tim.huang@amd.com>
> drm/amdgpu/pm: use the specific mailbox registers only for SMU IP v13.0.4
>
> Tim Huang <tim.huang@amd.com>
> drm/amdgpu/soc21: add mode2 asic reset for SMU IP v13.0.11
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu/pm: add GFXOFF control IP version check for SMU IP v13.0.11
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu: add smu 13 support for smu 13.0.11
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu/pm: enable swsmu for SMU IP v13.0.11
>
> Tim Huang <tim.huang@amd.com>
> drm/amdgpu/discovery: add PSP IP v13.0.11 support
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu: add gmc v11 support for GC 11.0.4
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu: add gfx support for GC 11.0.4
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu/discovery: set the APU flag for GC 11.0.4
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu: set GC 11.0.4 family
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu/discovery: enable mes support for GC v11.0.4
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu/discovery: enable gfx v11 for GC 11.0.4
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu/discovery: enable gmc v11 for GC 11.0.4
>
> Yifan Zhang <yifan1.zhang@amd.com>
> drm/amdgpu/discovery: enable soc21 common for GC 11.0.4
>
> Masahiro Yamada <masahiroy@kernel.org>
> arch: fix broken BuildID for arm64 and riscv
>
> YingChi Long <me@inclyc.cn>
> x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
>
> Kees Cook <keescook@chromium.org>
> exit: Use READ_ONCE() for all oops/warn limit reads
>
> Kees Cook <keescook@chromium.org>
> docs: Fix path paste-o for /sys/kernel/warn_count
>
> Kees Cook <keescook@chromium.org>
> panic: Expose "warn_count" to sysfs
>
> Kees Cook <keescook@chromium.org>
> panic: Introduce warn_limit
>
> Kees Cook <keescook@chromium.org>
> panic: Consolidate open-coded panic_on_warn checks
>
> Kees Cook <keescook@chromium.org>
> exit: Allow oops_limit to be disabled
>
> Kees Cook <keescook@chromium.org>
> exit: Expose "oops_count" to sysfs
>
> Jann Horn <jannh@google.com>
> exit: Put an upper limit on how often we can oops
>
> Kees Cook <keescook@chromium.org>
> panic: Separate sysctl logic from CONFIG_SMP
>
> Ard Biesheuvel <ardb@kernel.org>
> efi: rt-wrapper: Add missing include
>
> Ard Biesheuvel <ardb@kernel.org>
> arm64: efi: Execute runtime services from a dedicated stack
>
> Alon Zahavi <zahavi.alon@gmail.com>
> fs/ntfs3: Fix attr_punch_hole() null pointer derenference
>
> Paulo Alcantara <pc@cjr.nz>
> cifs: reduce roundtrips on create/qinfo requests
>
> Alex Deucher <alexander.deucher@amd.com>
> drm/amd/display: disable S/G display on DCN 3.1.4
>
> Alex Deucher <alexander.deucher@amd.com>
> drm/amd/display: disable S/G display on DCN 3.1.5
>
> Joshua Ashton <joshua@froggi.es>
> drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
>
> Joshua Ashton <joshua@froggi.es>
> drm/amd/display: Calculate output_color_space after pixel encoding adjustment
>
> hongao <hongao@uniontech.com>
> drm/amd/display: Fix set scaling doesn's work
>
> Nirmoy Das <nirmoy.das@intel.com>
> drm/i915: Remove unused variable
>
> Thomas Zimmermann <tzimmermann@suse.de>
> drm/i915: Allow switching away via vga-switcheroo if uninitialized
>
> Drew Davenport <ddavenport@chromium.org>
> drm/i915/display: Check source height is > 0
>
> Sasa Dragic <sasa.dragic@gmail.com>
> drm/i915: re-disable RC6p on Sandy Bridge
>
> jie1zhan <jesse.zhang@amd.com>
> drm/amdgpu: Correct the power calcultion for Renior/Cezanne.
>
> Lang Yu <Lang.Yu@amd.com>
> drm/amdgpu: allow multipipe policy on ASICs with one MEC
>
> Christian König <christian.koenig@amd.com>
> drm/amdgpu: fix amdgpu_job_free_resources v2
>
> Arnd Bergmann <arnd@arndb.de>
> ARM: omap1: fix !ARCH_OMAP1_ANY link failures
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI
>
> Vishnu Dasa <vdasa@vmware.com>
> VMCI: Use threaded irqs instead of tasklets
>
> Alexander Usyskin <alexander.usyskin@intel.com>
> mei: me: add meteor lake point M DID
>
> Alexander Usyskin <alexander.usyskin@intel.com>
> mei: bus: fix unlink on bus in error path
>
> Khazhismel Kumykov <khazhy@chromium.org>
> gsmi: fix null-deref in gsmi_get_variable
>
> Matthew Howell <matthew.howell@sealevel.com>
> serial: exar: Add support for Sealevel 7xxxC serial cards
>
> Tobias Schramm <t.schramm@manjaro.org>
> serial: atmel: fix incorrect baudrate setup
>
> Lino Sanfilippo <l.sanfilippo@kunbus.com>
> serial: amba-pl011: fix high priority character transmission in rs486 mode
>
> Reinette Chatre <reinette.chatre@intel.com>
> dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable
>
> Reinette Chatre <reinette.chatre@intel.com>
> dmaengine: idxd: Prevent use after free on completion memory
>
> Reinette Chatre <reinette.chatre@intel.com>
> dmaengine: idxd: Let probe fail when workqueue cannot be enabled
>
> Mohan Kumar <mkumard@nvidia.com>
> dmaengine: tegra210-adma: fix global intr clear
>
> Peter Harliman Liem <pliem@maxlinear.com>
> dmaengine: lgm: Move DT parsing after initialization
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> serial: pch_uart: Pass correct sg to dma_unmap_sg()
>
> Heiner Kallweit <hkallweit1@gmail.com>
> dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
>
> Heiner Kallweit <hkallweit1@gmail.com>
> dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
>
> Li Jun <jun.li@nxp.com>
> arm64: dts: imx8mp: correct usb clocks
>
> Juhyung Park <qkrwngud825@gmail.com>
> usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
>
> Maciej Żenczykowski <maze@google.com>
> usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
>
> Chanh Nguyen <chanh@os.amperecomputing.com>
> USB: gadget: Add ID numbers to configfs-gadget driver names
>
> Daniel Scally <dan.scally@ideasonboard.com>
> usb: gadget: g_webcam: Send color matching descriptor per frame
>
> Prashant Malani <pmalani@chromium.org>
> usb: typec: altmodes/displayport: Fix pin assignment calculation
>
> Prashant Malani <pmalani@chromium.org>
> usb: typec: altmodes/displayport: Add pin assignment helper
>
> ChiYuan Huang <cy_huang@richtek.com>
> usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail
>
> Yang Yingliang <yangyingliang@huawei.com>
> usb: musb: fix error return code in omap2430_probe()
>
> Alexander Stein <alexander.stein@ew.tq-group.com>
> usb: host: ehci-fsl: Fix module alias
>
> Pawel Laszczak <pawell@cadence.com>
> usb: cdns3: remove fetched trb from cache before dequeuing
>
> Michael Adler <michael.adler@siemens.com>
> USB: serial: cp210x: add SCALANCE LPE-9000 device id
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: gadgetfs: Fix race between mounting and unmounting
>
> Matthieu Baerts <matthieu.baerts@tessares.net>
> selftests: mptcp: userspace: validate v4-v6 subflows mix
>
> Matthieu Baerts <matthieu.baerts@tessares.net>
> mptcp: netlink: respect v4/v6-only sockets
>
> Paolo Abeni <pabeni@redhat.com>
> mptcp: explicitly specify sock family at subflow creation time
>
> Jens Axboe <axboe@kernel.dk>
> io_uring/poll: don't reissue in case of poll race on multishot request
>
> Jens Axboe <axboe@kernel.dk>
> pktcdvd: check for NULL returna fter calling bio_split_to_limits()
>
> Gaosheng Cui <cuigaosheng1@huawei.com>
> tty: fix possible null-ptr-defer in spk_ttyio_release
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
>
> Paul Moore <paul@paul-moore.com>
> bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD
>
> Ben Dooks <ben.dooks@codethink.co.uk>
> riscv: dts: sifive: fu740: fix size of pcie 32bit memory
>
> Mika Westerberg <mika.westerberg@linux.intel.com>
> thunderbolt: Do not call PM runtime functions in tb_retimer_scan()
>
> Utkarsh Patel <utkarsh.h.patel@intel.com>
> thunderbolt: Do not report errors if on-board retimers are found
>
> Mika Westerberg <mika.westerberg@linux.intel.com>
> thunderbolt: Use correct function to calculate maximum USB3 link rate
>
> Mika Westerberg <mika.westerberg@linux.intel.com>
> thunderbolt: Disable XDomain lane 1 only in software connection manager
>
> Enzo Matsumiya <ematsumiya@suse.de>
> cifs: do not include page data when checking signature
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix race between quota rescan and disable leading to NULL pointer deref
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix invalid leaf access due to inline extent during lseek
>
> Qu Wenruo <wqu@suse.com>
> btrfs: qgroup: do not warn on record without old_roots populated
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: do not abort transaction on failure to update log root
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: do not abort transaction on failure to write log tree when syncing log
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: add missing setup of log for full commit at add_conflicting_inode()
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix directory logging due to race with concurrent index key deletion
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix missing error handling when logging directory items
>
> Qu Wenruo <wqu@suse.com>
> btrfs: add extra error messages to cover non-ENOMEM errors from device_add_list()
>
> Zach O'Keefe <zokeefe@google.com>
> mm/MADV_COLLAPSE: don't expand collapse when vm_end is past requested end
>
> David Hildenbrand <david@redhat.com>
> mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a VMA
>
> Peter Xu <peterx@redhat.com>
> mm/hugetlb: pre-allocate pgtable pages for uffd wr-protects
>
> David Hildenbrand <david@redhat.com>
> mm/hugetlb: fix uffd-wp handling for migration entries in hugetlb_change_protection()
>
> David Hildenbrand <david@redhat.com>
> mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()
>
> Haibo Chen <haibo.chen@nxp.com>
> mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
>
> Samuel Holland <samuel@sholland.org>
> mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
>
> Ard Biesheuvel <ardb@kernel.org>
> ACPI: PRM: Check whether EFI runtime is available
>
> Ian Abbott <abbotti@mev.co.uk>
> comedi: adv_pci1760: Fix PWM instruction handling
>
> Flavio Suligoi <f.suligoi@asem.it>
> usb: core: hub: disable autosuspend for TI TUSB8041
>
> Ola Jeppsson <ola@snap.com>
> misc: fastrpc: Fix use-after-free race condition for maps
>
> Abel Vesa <abel.vesa@linaro.org>
> misc: fastrpc: Don't remove map on creater_process and device_release
>
> Abel Vesa <abel.vesa@linaro.org>
> misc: fastrpc: Fix use-after-free and race in fastrpc_map_find
>
> Matthias Kaehlcke <mka@chromium.org>
> usb: misc: onboard_hub: Move 'attach' work to the driver
>
> Matthias Kaehlcke <mka@chromium.org>
> usb: misc: onboard_hub: Invert driver registration order
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
>
> Arnd Bergmann <arnd@arndb.de>
> staging: vchiq_arm: fix enum vchiq_status return types
>
> Duke Xin(辛安文) <duke_xinanwen@163.com>
> USB: serial: option: add Quectel EM05CN modem
>
> Duke Xin(辛安文) <duke_xinanwen@163.com>
> USB: serial: option: add Quectel EM05CN (SG) modem
>
> Ali Mirghasemi <ali.mirghasemi1376@gmail.com>
> USB: serial: option: add Quectel EC200U modem
>
> Duke Xin(辛安文) <duke_xinanwen@163.com>
> USB: serial: option: add Quectel EM05-G (RS) modem
>
> Duke Xin(辛安文) <duke_xinanwen@163.com>
> USB: serial: option: add Quectel EM05-G (CS) modem
>
> Duke Xin(辛安文) <duke_xinanwen@163.com>
> USB: serial: option: add Quectel EM05-G (GR) modem
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> prlimit: do_prlimit needs to have a speculation check
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> usb: acpi: add helper to check port lpm capability using acpi _DSM
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> xhci: Add a flag to disable USB3 lpm on a xhci root port level.
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> xhci: Add update_hub_device override for PCI xHCI hosts
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> xhci: Fix null pointer dereference when host dies
>
> Jimmy Hu <hhhuuu@google.com>
> usb: xhci: Check endpoint is valid before dereferencing it
>
> Ricardo Ribalda <ribalda@chromium.org>
> xhci-pci: set the dma max_seg_size
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler"
>
> Marek Vasut <marex@denx.de>
> serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler
>
> Hugh Dickins <hughd@google.com>
> mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
>
> James Houghton <jthoughton@google.com>
> hugetlb: unshare some PMDs when splitting VMAs
>
> Zach O'Keefe <zokeefe@google.com>
> mm/shmem: restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE
>
> Ryusuke Konishi <konishi.ryusuke@gmail.com>
> nilfs2: fix general protection fault in nilfs_btree_insert()
>
> Damien Le Moal <damien.lemoal@opensource.wdc.com>
> zonefs: Detect append writes at invalid locations
>
> Huacai Chen <chenhuacai@kernel.org>
> LoongArch: Add HWCAP_LOONGARCH_CPUCFG to elf_hwcap
>
> Shawn.Shao <shawn.shao@jaguarmicro.com>
> Add exception protection processing for vd in axi_chan_handle_err function
>
> Alexey Dobriyan <adobriyan@gmail.com>
> proc: fix PIE proc-empty-vm, proc-pid-vm tests
>
> Liam Howlett <liam.howlett@oracle.com>
> nommu: fix split_vma() map_count error
>
> Liam Howlett <liam.howlett@oracle.com>
> nommu: fix do_munmap() error path
>
> Liam Howlett <liam.howlett@oracle.com>
> nommu: fix memory leak in do_mmap() error path
>
> Felix Fietkau <nbd@nbd.name>
> wifi: mac80211: fix initialization of rx->link and rx->link_sta
>
> Alexander Wetzel <alexander@wetzel-home.de>
> wifi: mac80211: sdata can be NULL during AMPDU start
>
> Aloka Dixit <quic_alokad@quicinc.com>
> wifi: mac80211: reset multiple BSSID options in stop_ap()
>
> Felix Fietkau <nbd@nbd.name>
> wifi: mac80211: fix MLO + AP_VLAN check
>
> Arend van Spriel <arend.vanspriel@broadcom.com>
> wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> Bluetooth: hci_qca: Fix driver shutdown on closed serdev
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2
>
> Arnd Bergmann <arnd@arndb.de>
> fbdev: omapfb: avoid stack overflow warning
>
> Rob Herring <robh@kernel.org>
> of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2
>
> Zhang Rui <rui.zhang@intel.com>
> perf/x86/rapl: Add support for Intel Emerald Rapids
>
> Zhang Rui <rui.zhang@intel.com>
> perf/x86/rapl: Add support for Intel Meteor Lake
>
> Aaron Thompson <dev@aaront.org>
> memblock tests: Fix compilation error.
>
> Paulo Alcantara <pc@cjr.nz>
> cifs: fix race in assemble_neg_contexts()
>
> Chris Wilson <chris@chris-wilson.co.uk>
> perf/x86/rapl: Treat Tigerlake like Icelake
>
> Jaegeuk Kim <jaegeuk@kernel.org>
> f2fs: let's avoid panic if extent_tree is not created
>
> Mikulas Patocka <mpatocka@redhat.com>
> x86/asm: Fix an assembler warning with current binutils
>
> Qu Wenruo <wqu@suse.com>
> btrfs: always report error in run_one_delayed_ref()
>
> Po-Hsu Lin <po-hsu.lin@canonical.com>
> selftests: net: fix cmsg_so_mark.sh test hang
>
> Jiri Slaby (SUSE) <jirislaby@kernel.org>
> RDMA/srp: Move large values to a new enum for gcc13
>
> Kui-Feng Lee <kuifeng@meta.com>
> bpf: keep a reference to the mm, in case the task is dead.
>
> Chunhao Lin <hau@realtek.com>
> r8169: fix dmar pte write access is not set error
>
> Chunhao Lin <hau@realtek.com>
> r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down()
>
> Daniil Tatianin <d-tatianin@yandex-team.ru>
> net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
>
> Cindy Lu <lulu@redhat.com>
> vdpa_sim_net: should not drop the multicast/broadcast packet
>
> Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
> vduse: Validate vq_num in vduse_validate_config()
>
> Angus Chen <angus.chen@jaguarmicro.com>
> virtio_pci: modify ENOENT to EINVAL
>
> Eli Cohen <elic@nvidia.com>
> vdpa/mlx5: Avoid overwriting CVQ iotlb
>
> Eli Cohen <elic@nvidia.com>
> vdpa/mlx5: Avoid using reslock in event_handler
>
> Eli Cohen <elic@nvidia.com>
> vdpa/mlx5: Return error on vlan ctrl commands if not supported
>
> Ricardo Cañuelo <ricardo.canuelo@collabora.com>
> tools/virtio: initialize spinlocks in vring_test.c
>
> Anuradha Weeraman <anuradha@debian.org>
> net: ethernet: marvell: octeontx2: Fix uninitialized variable warning
>
> Hao Sun <sunhao.th@gmail.com>
> selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID
>
> Olga Kornievskaia <olga.kornievskaia@gmail.com>
> pNFS/filelayout: Fix coalescing test for single DS
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: iwlwifi: fw: skip PPAG for JF
>
> Naohiro Aota <naohiro.aota@wdc.com>
> btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
>
> Christian König <christian.koenig@amd.com>
> dma-buf: fix dma_buf_export init order v2
>
>
> -------------
>
> Diffstat:
>
> Documentation/ABI/testing/sysfs-kernel-oops_count | 6 +
> Documentation/ABI/testing/sysfs-kernel-warn_count | 6 +
> Documentation/admin-guide/sysctl/kernel.rst | 19 ++
> ...2a-usb2-phy.yaml => amlogic,g12a-usb2-phy.yaml} | 8 +-
> ...ie-phy.yaml => amlogic,g12a-usb3-pcie-phy.yaml} | 6 +-
> MAINTAINERS | 2 +
> Makefile | 4 +-
> arch/arm/boot/dts/qcom-apq8084-ifc6540.dts | 20 +-
> arch/arm/boot/dts/qcom-apq8084.dtsi | 4 +-
> arch/arm/mach-omap1/Kconfig | 5 +-
> arch/arm/mach-omap1/Makefile | 4 -
> arch/arm/mach-omap1/io.c | 32 ++-
> arch/arm/mach-omap1/mcbsp.c | 21 --
> arch/arm/mach-omap1/pm.h | 7 -
> arch/arm64/boot/dts/freescale/imx8mp.dtsi | 12 +-
> arch/arm64/include/asm/efi.h | 3 +
> arch/arm64/kernel/efi-rt-wrapper.S | 14 +-
> arch/arm64/kernel/efi.c | 27 +++
> arch/loongarch/kernel/cpu-probe.c | 2 +-
> arch/powerpc/kernel/vmlinux.lds.S | 6 +-
> arch/riscv/boot/dts/sifive/fu740-c000.dtsi | 2 +-
> arch/s390/kernel/vmlinux.lds.S | 2 +
> arch/x86/events/rapl.c | 5 +
> arch/x86/kernel/fpu/init.c | 7 +-
> arch/x86/lib/iomap_copy_64.S | 2 +-
> block/mq-deadline.c | 4 +-
> drivers/accessibility/speakup/spk_ttyio.c | 3 +
> drivers/acpi/prmt.c | 10 +
> drivers/block/pktcdvd.c | 2 +
> drivers/bluetooth/hci_qca.c | 7 +
> drivers/comedi/drivers/adv_pci1760.c | 2 +-
> drivers/dma-buf/dma-buf-sysfs-stats.c | 7 +-
> drivers/dma-buf/dma-buf-sysfs-stats.h | 4 +-
> drivers/dma-buf/dma-buf.c | 84 ++++----
> drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 +
> drivers/dma/idxd/device.c | 16 +-
> drivers/dma/lgm/lgm-dma.c | 10 +-
> drivers/dma/tegra210-adma.c | 2 +-
> drivers/firmware/google/gsmi.c | 7 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 9 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 10 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 1 +
> drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 22 +-
> drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 1 +
> drivers/gpu/drm/amd/amdgpu/psp_v13_0.c | 3 +
> drivers/gpu/drm/amd/amdgpu/soc21.c | 19 +-
> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +-
> .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 4 +-
> drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 1 +
> drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 7 +-
> drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 3 +
> .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 17 +-
> drivers/gpu/drm/i915/display/skl_universal_plane.c | 2 +-
> drivers/gpu/drm/i915/i915_driver.c | 5 +-
> drivers/gpu/drm/i915/i915_pci.c | 3 +-
> drivers/gpu/drm/i915/i915_switcheroo.c | 6 +-
> drivers/infiniband/ulp/srp/ib_srp.h | 8 +-
> drivers/misc/fastrpc.c | 67 ++++---
> drivers/misc/mei/bus.c | 12 +-
> drivers/misc/mei/hw-me-regs.h | 2 +
> drivers/misc/mei/pci-me.c | 2 +
> drivers/misc/vmw_vmci/vmci_guest.c | 49 ++---
> drivers/mmc/host/sdhci-esdhc-imx.c | 22 +-
> drivers/mmc/host/sunxi-mmc.c | 8 +-
> .../net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c | 2 +-
> .../ethernet/marvell/octeontx2/nic/otx2_common.c | 11 +-
> .../ethernet/marvell/octeontx2/nic/otx2_common.h | 2 +
> drivers/net/ethernet/mellanox/mlx5/core/health.c | 1 +
> drivers/net/ethernet/realtek/r8169_main.c | 58 +++---
> .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 +-
> drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 +
> drivers/of/fdt.c | 28 +--
> drivers/soc/qcom/apr.c | 3 +-
> .../include/linux/raspberrypi/vchiq.h | 2 +-
> .../vc04_services/interface/vchiq_arm/vchiq_arm.h | 4 +-
> drivers/thunderbolt/retimer.c | 20 +-
> drivers/thunderbolt/tb.c | 20 +-
> drivers/thunderbolt/tunnel.c | 2 +-
> drivers/thunderbolt/xdomain.c | 17 +-
> drivers/tty/serial/8250/8250_exar.c | 14 ++
> drivers/tty/serial/amba-pl011.c | 8 +-
> drivers/tty/serial/atmel_serial.c | 8 +-
> drivers/tty/serial/pch_uart.c | 2 +-
> drivers/tty/serial/qcom_geni_serial.c | 18 +-
> drivers/usb/cdns3/cdns3-gadget.c | 12 ++
> drivers/usb/core/hub.c | 13 ++
> drivers/usb/core/usb-acpi.c | 65 ++++++
> drivers/usb/gadget/configfs.c | 12 +-
> drivers/usb/gadget/function/f_ncm.c | 4 +-
> drivers/usb/gadget/legacy/inode.c | 28 ++-
> drivers/usb/gadget/legacy/webcam.c | 3 +
> drivers/usb/host/ehci-fsl.c | 2 +-
> drivers/usb/host/xhci-pci.c | 45 +++++
> drivers/usb/host/xhci-ring.c | 5 +-
> drivers/usb/host/xhci.c | 18 +-
> drivers/usb/host/xhci.h | 5 +
> drivers/usb/misc/iowarrior.c | 2 +-
> drivers/usb/misc/onboard_usb_hub.c | 18 +-
> drivers/usb/musb/omap2430.c | 4 +-
> drivers/usb/serial/cp210x.c | 1 +
> drivers/usb/serial/option.c | 17 ++
> drivers/usb/storage/uas-detect.h | 13 ++
> drivers/usb/storage/unusual_uas.h | 7 -
> drivers/usb/typec/altmodes/displayport.c | 22 +-
> drivers/usb/typec/tcpm/tcpm.c | 7 +-
> drivers/vdpa/mlx5/core/mlx5_vdpa.h | 5 +-
> drivers/vdpa/mlx5/core/mr.c | 44 ++--
> drivers/vdpa/mlx5/net/mlx5_vnet.c | 68 ++-----
> drivers/vdpa/vdpa_sim/vdpa_sim_net.c | 3 +
> drivers/vdpa/vdpa_user/vduse_dev.c | 3 +
> drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 28 ++-
> drivers/virtio/virtio_pci_modern.c | 2 +-
> fs/btrfs/disk-io.c | 9 +-
> fs/btrfs/extent-tree.c | 7 +-
> fs/btrfs/file.c | 13 +-
> fs/btrfs/qgroup.c | 39 +++-
> fs/btrfs/tree-log.c | 47 +++--
> fs/btrfs/volumes.c | 11 +-
> fs/cifs/connect.c | 16 --
> fs/cifs/inode.c | 6 -
> fs/cifs/misc.c | 45 -----
> fs/cifs/smb2inode.c | 45 +++--
> fs/cifs/smb2ops.c | 28 ++-
> fs/cifs/smb2pdu.c | 26 ++-
> fs/f2fs/extent_cache.c | 3 +-
> fs/nfs/filelayout/filelayout.c | 8 +
> fs/nilfs2/btree.c | 15 +-
> fs/ntfs3/attrib.c | 2 +-
> fs/userfaultfd.c | 28 ++-
> fs/zonefs/super.c | 22 ++
> include/asm-generic/vmlinux.lds.h | 5 +
> include/linux/panic.h | 1 +
> include/linux/soc/ti/omap1-io.h | 4 +-
> include/linux/usb.h | 3 +
> include/trace/events/btrfs.h | 2 +-
> io_uring/poll.c | 6 +-
> kernel/bpf/offload.c | 3 -
> kernel/bpf/syscall.c | 6 +-
> kernel/bpf/task_iter.c | 39 ++--
> kernel/exit.c | 62 ++++++
> kernel/kcsan/report.c | 3 +-
> kernel/panic.c | 48 ++++-
> kernel/sched/core.c | 3 +-
> kernel/sys.c | 2 +
> lib/ubsan.c | 3 +-
> mm/hugetlb.c | 95 ++++++---
> mm/kasan/report.c | 4 +-
> mm/kfence/report.c | 3 +-
> mm/khugepaged.c | 16 +-
> mm/mmap.c | 4 +
> mm/nommu.c | 9 +-
> mm/shmem.c | 6 +-
> net/bluetooth/hci_sync.c | 6 +-
> net/ethtool/ioctl.c | 3 +-
> net/ipv4/tcp_ulp.c | 2 +-
> net/mac80211/agg-tx.c | 6 +-
> net/mac80211/cfg.c | 7 +
> net/mac80211/driver-ops.c | 3 +
> net/mac80211/iface.c | 5 +-
> net/mac80211/rx.c | 222 +++++++++------------
> net/mptcp/pm.c | 25 +++
> net/mptcp/pm_userspace.c | 7 +
> net/mptcp/protocol.c | 2 +-
> net/mptcp/protocol.h | 6 +-
> net/mptcp/subflow.c | 9 +-
> tools/testing/memblock/.gitignore | 1 +
> tools/testing/memblock/Makefile | 3 +-
> .../selftests/bpf/prog_tests/jeq_infer_not_null.c | 9 +
> .../selftests/bpf/progs/jeq_infer_not_null_fail.c | 42 ++++
> tools/testing/selftests/net/cmsg_sender.c | 2 +-
> tools/testing/selftests/net/mptcp/userspace_pm.sh | 47 +++++
> tools/testing/selftests/proc/proc-empty-vm.c | 12 +-
> tools/testing/selftests/proc/proc-pid-vm.c | 9 +-
> tools/virtio/vringh_test.c | 2 +
> 176 files changed, 1644 insertions(+), 854 deletions(-)
>
>
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2023-01-23 4:09 ` Joel Fernandes
@ 2023-01-23 7:42 ` Rudi Heitbaum
2023-01-23 8:03 ` Conor Dooley
` (5 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Rudi Heitbaum @ 2023-01-23 7:42 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow
On Sun, Jan 22, 2023 at 04:02:09PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.8 release.
> There are 193 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Hi Greg,
6.1.8-rc1 tested.
Run tested on:
- Allwinner H6 (Tanix TX6)
- Intel Alder Lake x86_64 (nuc12 i7-1260P)
In addition - build tested for:
- Allwinner A64
- Allwinner H3
- Allwinner H5
- NXP iMX6
- NXP iMX8
- Qualcomm Dragonboard
- Rockchip RK3288
- Rockchip RK3328
- Rockchip RK3399pro
- Samsung Exynos
Tested-by: Rudi Heitbaum <rudi@heitbaum.com>
--
Rudi
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2023-01-23 7:42 ` Rudi Heitbaum
@ 2023-01-23 8:03 ` Conor Dooley
2023-01-23 8:09 ` Naresh Kamboju
` (4 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Conor Dooley @ 2023-01-23 8:03 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow
[-- Attachment #1: Type: text/plain, Size: 858 bytes --]
Hey Greg,
On Sun, Jan 22, 2023 at 04:02:09PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.8 release.
> There are 193 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 24 Jan 2023 15:02:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.8-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
For our RISC-V stuff, LGTM.
Tested-by: Conor Dooley <conor.dooley@microchip.com>
Thanks,
Conor.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2023-01-23 8:03 ` Conor Dooley
@ 2023-01-23 8:09 ` Naresh Kamboju
2023-01-23 19:11 ` Tom Saeger
2023-01-23 9:03 ` Bagas Sanjaya
` (3 subsequent siblings)
201 siblings, 1 reply; 210+ messages in thread
From: Naresh Kamboju @ 2023-01-23 8:09 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, Masahiro Yamada, Ard Biesheuvel,
Nathan Chancellor, Dennis Gilmore, Palmer Dabbelt, Arnd Bergmann,
tom.saeger
On Sun, 22 Jan 2023 at 20:51, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.1.8 release.
> There are 193 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 24 Jan 2023 15:02:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.8-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
* sh, build
- gcc-8-dreamcast_defconfig
- gcc-8-microdev_defconfig
Build error logs:
`.exit.text' referenced in section `__bug_table' of crypto/algboss.o:
defined in discarded section `.exit.text' of crypto/algboss.o
`.exit.text' referenced in section `__bug_table' of
drivers/char/hw_random/core.o: defined in discarded section
`.exit.text' of drivers/char/hw_random/core.o
make[2]: *** [/builds/linux/scripts/Makefile.vmlinux:34: vmlinux] Error 1
Bisection points to this commit,
arch: fix broken BuildID for arm64 and riscv
commit 99cb0d917ffa1ab628bb67364ca9b162c07699b1 upstream.
Ref:
upstream discussion thread,
https://lore.kernel.org/all/Y7Jal56f6UBh1abE@dev-arch.thelio-3990X/
Steps to reproduce:
# To install tuxmake on your system globally:
# sudo pip3 install -U tuxmake
#
# See https://docs.tuxmake.org/ for complete documentation.
# Original tuxmake command with fragments listed below.
tuxmake --runtime podman --target-arch sh --toolchain gcc-8 --kconfig
microdev_defconfig
Build log links,
https://storage.tuxsuite.com/public/linaro/lkft/builds/2KgeCQc3ZdltaEFoi0CwyJlUcuk/
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-23 8:09 ` Naresh Kamboju
@ 2023-01-23 19:11 ` Tom Saeger
2023-01-23 19:42 ` Tom Saeger
2023-01-24 11:48 ` Naresh Kamboju
0 siblings, 2 replies; 210+ messages in thread
From: Tom Saeger @ 2023-01-23 19:11 UTC (permalink / raw)
To: Naresh Kamboju
Cc: Greg Kroah-Hartman, stable, patches, linux-kernel, torvalds,
akpm, linux, shuah, patches, lkft-triage, pavel, jonathanh,
f.fainelli, sudipm.mukherjee, srw, rwarsow, Masahiro Yamada,
Ard Biesheuvel, Nathan Chancellor, Dennis Gilmore,
Palmer Dabbelt, Arnd Bergmann
On Mon, Jan 23, 2023 at 01:39:11PM +0530, Naresh Kamboju wrote:
> On Sun, 22 Jan 2023 at 20:51, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > This is the start of the stable review cycle for the 6.1.8 release.
> > There are 193 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Tue, 24 Jan 2023 15:02:08 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.8-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
>
> Results from Linaro’s test farm.
>
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
>
> * sh, build
> - gcc-8-dreamcast_defconfig
> - gcc-8-microdev_defconfig
Naresh, any chance you could test again adding the following:
diff --git a/arch/sh/kernel/vmlinux.lds.S b/arch/sh/kernel/vmlinux.lds.S
index 3161b9ccd2a5..b6276a3521d7 100644
--- a/arch/sh/kernel/vmlinux.lds.S
+++ b/arch/sh/kernel/vmlinux.lds.S
@@ -4,6 +4,7 @@
* Written by Niibe Yutaka and Paul Mundt
*/
OUTPUT_ARCH(sh)
+#define RUNTIME_DISCARD_EXIT
#include <asm/thread_info.h>
#include <asm/cache.h>
#include <asm/vmlinux.lds.h>
My guess is build environment is using ld < 2.36??
and this is probably similar to:
a494398bde27 ("s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36")
4b9880dbf3bd ("powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT")
Regards,
--Tom
>
>
> Build error logs:
> `.exit.text' referenced in section `__bug_table' of crypto/algboss.o:
> defined in discarded section `.exit.text' of crypto/algboss.o
> `.exit.text' referenced in section `__bug_table' of
> drivers/char/hw_random/core.o: defined in discarded section
> `.exit.text' of drivers/char/hw_random/core.o
> make[2]: *** [/builds/linux/scripts/Makefile.vmlinux:34: vmlinux] Error 1
>
> Bisection points to this commit,
> arch: fix broken BuildID for arm64 and riscv
> commit 99cb0d917ffa1ab628bb67364ca9b162c07699b1 upstream.
>
> Ref:
> upstream discussion thread,
> https://lore.kernel.org/all/Y7Jal56f6UBh1abE@dev-arch.thelio-3990X/
>
> Steps to reproduce:
> # To install tuxmake on your system globally:
> # sudo pip3 install -U tuxmake
> #
> # See https://docs.tuxmake.org/ for complete documentation.
> # Original tuxmake command with fragments listed below.
>
> tuxmake --runtime podman --target-arch sh --toolchain gcc-8 --kconfig
> microdev_defconfig
>
> Build log links,
> https://storage.tuxsuite.com/public/linaro/lkft/builds/2KgeCQc3ZdltaEFoi0CwyJlUcuk/
>
> --
> Linaro LKFT
> https://lkft.linaro.org
^ permalink raw reply related [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-23 19:11 ` Tom Saeger
@ 2023-01-23 19:42 ` Tom Saeger
2023-01-24 12:11 ` Naresh Kamboju
2023-01-24 11:48 ` Naresh Kamboju
1 sibling, 1 reply; 210+ messages in thread
From: Tom Saeger @ 2023-01-23 19:42 UTC (permalink / raw)
To: Naresh Kamboju, Rich Felker
Cc: Greg Kroah-Hartman, stable, patches, linux-kernel, torvalds,
akpm, linux, shuah, patches, lkft-triage, pavel, jonathanh,
f.fainelli, sudipm.mukherjee, srw, rwarsow, Masahiro Yamada,
Ard Biesheuvel, Nathan Chancellor, Dennis Gilmore,
Palmer Dabbelt, Arnd Bergmann, linux-sh
On Mon, Jan 23, 2023 at 01:11:32PM -0600, Tom Saeger wrote:
> On Mon, Jan 23, 2023 at 01:39:11PM +0530, Naresh Kamboju wrote:
> > On Sun, 22 Jan 2023 at 20:51, Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > This is the start of the stable review cycle for the 6.1.8 release.
> > > There are 193 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Tue, 24 Jan 2023 15:02:08 +0000.
> > > Anything received after that time might be too late.
> > >
> > > The whole patch series can be found in one patch at:
> > > https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.8-rc1.gz
> > > or in the git tree and branch at:
> > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> > > and the diffstat can be found below.
> > >
> > > thanks,
> > >
> > > greg k-h
> >
> >
> > Results from Linaro’s test farm.
> >
> > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> >
> > * sh, build
> > - gcc-8-dreamcast_defconfig
> > - gcc-8-microdev_defconfig
>
> Naresh, any chance you could test again adding the following:
>
> diff --git a/arch/sh/kernel/vmlinux.lds.S b/arch/sh/kernel/vmlinux.lds.S
> index 3161b9ccd2a5..b6276a3521d7 100644
> --- a/arch/sh/kernel/vmlinux.lds.S
> +++ b/arch/sh/kernel/vmlinux.lds.S
> @@ -4,6 +4,7 @@
> * Written by Niibe Yutaka and Paul Mundt
> */
> OUTPUT_ARCH(sh)
> +#define RUNTIME_DISCARD_EXIT
> #include <asm/thread_info.h>
> #include <asm/cache.h>
> #include <asm/vmlinux.lds.h>
>
>
> My guess is build environment is using ld < 2.36??
> and this is probably similar to:
> a494398bde27 ("s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36")
> 4b9880dbf3bd ("powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT")
>
>
> Regards,
>
> --Tom
>
> >
> >
> > Build error logs:
> > `.exit.text' referenced in section `__bug_table' of crypto/algboss.o:
> > defined in discarded section `.exit.text' of crypto/algboss.o
> > `.exit.text' referenced in section `__bug_table' of
> > drivers/char/hw_random/core.o: defined in discarded section
> > `.exit.text' of drivers/char/hw_random/core.o
> > make[2]: *** [/builds/linux/scripts/Makefile.vmlinux:34: vmlinux] Error 1
This is also occurring in latest upstream:
❯ git describe HEAD
v6.2-rc5-13-g2475bf0250de
❯ tuxmake --runtime podman --target-arch sh --toolchain gcc-8 --kconfig microdev_defconfig
`.exit.text' referenced in section `__bug_table' of crypto/algboss.o: defined in discarded section `.exit.text' of crypto/algboss.o
`.exit.text' referenced in section `__bug_table' of drivers/char/hw_random/core.o: defined in discarded section `.exit.text' of drivers/char/hw_random/core.o
make[2]: *** [/home2/tsaeger/linux/linux-upstream/scripts/Makefile.vmlinux:35: vmlinux] Error 1
make[2]: Target '__default' not remade because of errors.
make[1]: *** [/home2/tsaeger/linux/linux-upstream/Makefile:1264: vmlinux] Error 2
make[1]: Target '__all' not remade because of errors.
make: *** [Makefile:242: __sub-make] Error 2
make: Target '__all' not remade because of errors.
FWIW, the above patch resolves this.
How many more architectures need something similar?
> >
> > Bisection points to this commit,
> > arch: fix broken BuildID for arm64 and riscv
> > commit 99cb0d917ffa1ab628bb67364ca9b162c07699b1 upstream.
> >
> > Ref:
> > upstream discussion thread,
> > https://lore.kernel.org/all/Y7Jal56f6UBh1abE@dev-arch.thelio-3990X/
> >
> > Steps to reproduce:
> > # To install tuxmake on your system globally:
> > # sudo pip3 install -U tuxmake
> > #
> > # See https://docs.tuxmake.org/ for complete documentation.
> > # Original tuxmake command with fragments listed below.
> >
> > tuxmake --runtime podman --target-arch sh --toolchain gcc-8 --kconfig
> > microdev_defconfig
> >
> > Build log links,
> > https://storage.tuxsuite.com/public/linaro/lkft/builds/2KgeCQc3ZdltaEFoi0CwyJlUcuk/
> >
> > --
> > Linaro LKFT
> > https://lkft.linaro.org
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-23 19:42 ` Tom Saeger
@ 2023-01-24 12:11 ` Naresh Kamboju
2023-01-24 12:54 ` Tom Saeger
0 siblings, 1 reply; 210+ messages in thread
From: Naresh Kamboju @ 2023-01-24 12:11 UTC (permalink / raw)
To: Tom Saeger
Cc: Rich Felker, Greg Kroah-Hartman, stable, patches, linux-kernel,
torvalds, akpm, linux, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, sudipm.mukherjee, srw, rwarsow,
Masahiro Yamada, Ard Biesheuvel, Nathan Chancellor,
Dennis Gilmore, Palmer Dabbelt, Arnd Bergmann, linux-sh
Hi Tom,
On Tue, 24 Jan 2023 at 01:12, Tom Saeger <tom.saeger@oracle.com> wrote:
>
> On Mon, Jan 23, 2023 at 01:11:32PM -0600, Tom Saeger wrote:
> > On Mon, Jan 23, 2023 at 01:39:11PM +0530, Naresh Kamboju wrote:
> > > On Sun, 22 Jan 2023 at 20:51, Greg Kroah-Hartman
> > >
> > > Results from Linaro’s test farm.
> > >
> > > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> > >
> > > * sh, build
> > > - gcc-8-dreamcast_defconfig
> > > - gcc-8-microdev_defconfig
> >
> > Naresh, any chance you could test again adding the following:
> >
> > diff --git a/arch/sh/kernel/vmlinux.lds.S b/arch/sh/kernel/vmlinux.lds.S
> > index 3161b9ccd2a5..b6276a3521d7 100644
> > --- a/arch/sh/kernel/vmlinux.lds.S
> > +++ b/arch/sh/kernel/vmlinux.lds.S
> > @@ -4,6 +4,7 @@
> > * Written by Niibe Yutaka and Paul Mundt
> > */
> > OUTPUT_ARCH(sh)
> > +#define RUNTIME_DISCARD_EXIT
> > #include <asm/thread_info.h>
> > #include <asm/cache.h>
> > #include <asm/vmlinux.lds.h>
> >
> >
> > My guess is build environment is using ld < 2.36??
> > and this is probably similar to:
> > a494398bde27 ("s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36")
> > 4b9880dbf3bd ("powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT")
> >
> >
> > Regards,
> >
> > --Tom
> >
> > >
> > >
> > > Build error logs:
> > > `.exit.text' referenced in section `__bug_table' of crypto/algboss.o:
> > > defined in discarded section `.exit.text' of crypto/algboss.o
> > > `.exit.text' referenced in section `__bug_table' of
> > > drivers/char/hw_random/core.o: defined in discarded section
> > > `.exit.text' of drivers/char/hw_random/core.o
> > > make[2]: *** [/builds/linux/scripts/Makefile.vmlinux:34: vmlinux] Error 1
>
>
> This is also occurring in latest upstream:
Right !
build/gcc-8-dreamcast_defconfig
build/gcc-8-microdev_defconfig
These build errors started from v6.2-rc2 on the mainline [1] & [2].
>
> ❯ git describe HEAD
> v6.2-rc5-13-g2475bf0250de
>
> ❯ tuxmake --runtime podman --target-arch sh --toolchain gcc-8 --kconfig microdev_defconfig
>
> `.exit.text' referenced in section `__bug_table' of crypto/algboss.o: defined in discarded section `.exit.text' of crypto/algboss.o
> `.exit.text' referenced in section `__bug_table' of drivers/char/hw_random/core.o: defined in discarded section `.exit.text' of drivers/char/hw_random/core.o
> make[2]: *** [/home2/tsaeger/linux/linux-upstream/scripts/Makefile.vmlinux:35: vmlinux] Error 1
> make[2]: Target '__default' not remade because of errors.
> make[1]: *** [/home2/tsaeger/linux/linux-upstream/Makefile:1264: vmlinux] Error 2
> make[1]: Target '__all' not remade because of errors.
> make: *** [Makefile:242: __sub-make] Error 2
> make: Target '__all' not remade because of errors.
>
>
> FWIW, the above patch resolves this.
Yes. Tested and confirmed it fixes the reported problem.
> How many more architectures need something similar?
Now I see it on sh with gcc-8 only on the mainline.
OTOH,
It was noticed on earlier stable-rc 5.4 for x86, i386, powerpc, sh and s390.
git_describe : v5.4.228-679-g79cbaf4448f3
kernel_version: 5.4.230-rc1
Regressions found on sh: [1] & [2] mainline and below
- build/gcc-8-dreamcast_defconfig
- build/gcc-8-microdev_defconfig
Regressions found on i386: [3]
- build/gcc-8-i386_defconfig
Regressions found on powerpc: [4]
- build/gcc-8-mpc83xx_defconfig
- build/gcc-8-ppc64e_defconfig
- build/gcc-8-maple_defconfig
- build/gcc-8-ppc6xx_defconfig
- build/gcc-8-defconfig
- build/gcc-8-tqm8xx_defconfig
- build/gcc-8-cell_defconfig
Regressions found on s390: [5]
- build/gcc-8-defconfig-fe40093d
Regressions found on x86_64: [6]
- build/gcc-8-x86_64_defconfig
[1] https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2-rc5-20-g7bf70dbb1882/testrun/14340424/suite/build/test/gcc-8-microdev_defconfig/history/?page=3
[2] https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2-rc5-20-g7bf70dbb1882/testrun/14340393/suite/build/test/gcc-8-dreamcast_defconfig/history/?page=3
[3] https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.228-679-g79cbaf4448f3/testrun/14304065/suite/build/test/gcc-8-i386_defconfig/history/
[4] https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.228-679-g79cbaf4448f3/testrun/14304362/suite/build/tests/
[5] https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.228-679-g79cbaf4448f3/testrun/14304530/suite/build/tests/
[6] https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.228-679-g79cbaf4448f3/testrun/14304610/suite/build/test/gcc-8-x86_64_defconfig/history/
stable-rc report on 5.4:
https://lore.kernel.org/stable/Y85tO%2FmJOxIaWH4c@debian/T/#m6b1fdc9bcfc15944e26e3cdd6b1310c878251999
Best regards
Naresh Kamboju
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-24 12:11 ` Naresh Kamboju
@ 2023-01-24 12:54 ` Tom Saeger
2023-01-24 15:57 ` Naresh Kamboju
0 siblings, 1 reply; 210+ messages in thread
From: Tom Saeger @ 2023-01-24 12:54 UTC (permalink / raw)
To: Naresh Kamboju
Cc: Rich Felker, Greg Kroah-Hartman, stable, patches, linux-kernel,
torvalds, akpm, linux, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, sudipm.mukherjee, srw, rwarsow,
Masahiro Yamada, Ard Biesheuvel, Nathan Chancellor,
Dennis Gilmore, Palmer Dabbelt, Arnd Bergmann, linux-sh
On Tue, Jan 24, 2023 at 05:41:22PM +0530, Naresh Kamboju wrote:
> Hi Tom,
>
> On Tue, 24 Jan 2023 at 01:12, Tom Saeger <tom.saeger@oracle.com> wrote:
> >
> > On Mon, Jan 23, 2023 at 01:11:32PM -0600, Tom Saeger wrote:
> > > On Mon, Jan 23, 2023 at 01:39:11PM +0530, Naresh Kamboju wrote:
> > > > On Sun, 22 Jan 2023 at 20:51, Greg Kroah-Hartman
> > > >
> > > > Results from Linaro’s test farm.
> > > >
> > > > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> > > >
> > > > * sh, build
> > > > - gcc-8-dreamcast_defconfig
> > > > - gcc-8-microdev_defconfig
> > >
> > > Naresh, any chance you could test again adding the following:
> > >
> > > diff --git a/arch/sh/kernel/vmlinux.lds.S b/arch/sh/kernel/vmlinux.lds.S
> > > index 3161b9ccd2a5..b6276a3521d7 100644
> > > --- a/arch/sh/kernel/vmlinux.lds.S
> > > +++ b/arch/sh/kernel/vmlinux.lds.S
> > > @@ -4,6 +4,7 @@
> > > * Written by Niibe Yutaka and Paul Mundt
> > > */
> > > OUTPUT_ARCH(sh)
> > > +#define RUNTIME_DISCARD_EXIT
> > > #include <asm/thread_info.h>
> > > #include <asm/cache.h>
> > > #include <asm/vmlinux.lds.h>
> > >
> > >
> > > My guess is build environment is using ld < 2.36??
> > > and this is probably similar to:
> > > a494398bde27 ("s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36")
> > > 4b9880dbf3bd ("powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT")
> > >
> > >
> > > Regards,
> > >
> > > --Tom
> > >
> > > >
> > > >
> > > > Build error logs:
> > > > `.exit.text' referenced in section `__bug_table' of crypto/algboss.o:
> > > > defined in discarded section `.exit.text' of crypto/algboss.o
> > > > `.exit.text' referenced in section `__bug_table' of
> > > > drivers/char/hw_random/core.o: defined in discarded section
> > > > `.exit.text' of drivers/char/hw_random/core.o
> > > > make[2]: *** [/builds/linux/scripts/Makefile.vmlinux:34: vmlinux] Error 1
> >
> >
> > This is also occurring in latest upstream:
>
> Right !
> build/gcc-8-dreamcast_defconfig
> build/gcc-8-microdev_defconfig
>
> These build errors started from v6.2-rc2 on the mainline [1] & [2].
>
> >
> > ❯ git describe HEAD
> > v6.2-rc5-13-g2475bf0250de
> >
> > ❯ tuxmake --runtime podman --target-arch sh --toolchain gcc-8 --kconfig microdev_defconfig
> >
> > `.exit.text' referenced in section `__bug_table' of crypto/algboss.o: defined in discarded section `.exit.text' of crypto/algboss.o
> > `.exit.text' referenced in section `__bug_table' of drivers/char/hw_random/core.o: defined in discarded section `.exit.text' of drivers/char/hw_random/core.o
> > make[2]: *** [/home2/tsaeger/linux/linux-upstream/scripts/Makefile.vmlinux:35: vmlinux] Error 1
> > make[2]: Target '__default' not remade because of errors.
> > make[1]: *** [/home2/tsaeger/linux/linux-upstream/Makefile:1264: vmlinux] Error 2
> > make[1]: Target '__all' not remade because of errors.
> > make: *** [Makefile:242: __sub-make] Error 2
> > make: Target '__all' not remade because of errors.
> >
> >
> > FWIW, the above patch resolves this.
> Yes. Tested and confirmed it fixes the reported problem.
>
> > How many more architectures need something similar?
> Now I see it on sh with gcc-8 only on the mainline.
>
> OTOH,
> It was noticed on earlier stable-rc 5.4 for x86, i386, powerpc, sh and s390.
>
> git_describe : v5.4.228-679-g79cbaf4448f3
> kernel_version: 5.4.230-rc1
>
> Regressions found on sh: [1] & [2] mainline and below
> - build/gcc-8-dreamcast_defconfig
> - build/gcc-8-microdev_defconfig
>
> Regressions found on i386: [3]
> - build/gcc-8-i386_defconfig
>
> Regressions found on powerpc: [4]
> - build/gcc-8-mpc83xx_defconfig
> - build/gcc-8-ppc64e_defconfig
> - build/gcc-8-maple_defconfig
> - build/gcc-8-ppc6xx_defconfig
> - build/gcc-8-defconfig
> - build/gcc-8-tqm8xx_defconfig
> - build/gcc-8-cell_defconfig
>
> Regressions found on s390: [5]
> - build/gcc-8-defconfig-fe40093d
>
> Regressions found on x86_64: [6]
> - build/gcc-8-x86_64_defconfig
v5.4 needs:
84d5f77fc2ee ("x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS")
which didn't hit Linus's tree until: v5.7-rc1~164^2~1
This explains why v5.4 blew-up and v5.10 didn't.
I'm testing the following for v5.4
84d5f77fc2ee ("x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS")
This needed a little massaging to apply.
99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv")
4b9880dbf3bd ("powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT")
07b050f9290e ("powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds")
a494398bde27 ("s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36")
+ the arch/sh patch https://lore.kernel.org/all/9166a8abdc0f979e50377e61780a4bba1dfa2f52.1674518464.git.tom.saeger@oracle.com/
I'd be grateful if you could confirm - so I can send this full series to
Greg.
If you'd rather - I can send the patch-series now for testing?
Regards,
--Tom
>
>
> [1] https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2-rc5-20-g7bf70dbb1882/testrun/14340424/suite/build/test/gcc-8-microdev_defconfig/history/?page=3
> [2] https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2-rc5-20-g7bf70dbb1882/testrun/14340393/suite/build/test/gcc-8-dreamcast_defconfig/history/?page=3
>
> [3] https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.228-679-g79cbaf4448f3/testrun/14304065/suite/build/test/gcc-8-i386_defconfig/history/
> [4] https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.228-679-g79cbaf4448f3/testrun/14304362/suite/build/tests/
> [5] https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.228-679-g79cbaf4448f3/testrun/14304530/suite/build/tests/
> [6] https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.228-679-g79cbaf4448f3/testrun/14304610/suite/build/test/gcc-8-x86_64_defconfig/history/
>
> stable-rc report on 5.4:
> https://lore.kernel.org/stable/Y85tO%2FmJOxIaWH4c@debian/T/#m6b1fdc9bcfc15944e26e3cdd6b1310c878251999
>
> Best regards
> Naresh Kamboju
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-24 12:54 ` Tom Saeger
@ 2023-01-24 15:57 ` Naresh Kamboju
0 siblings, 0 replies; 210+ messages in thread
From: Naresh Kamboju @ 2023-01-24 15:57 UTC (permalink / raw)
To: Tom Saeger
Cc: Rich Felker, Greg Kroah-Hartman, stable, patches, linux-kernel,
torvalds, akpm, linux, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, sudipm.mukherjee, srw, rwarsow,
Masahiro Yamada, Ard Biesheuvel, Nathan Chancellor,
Dennis Gilmore, Palmer Dabbelt, Arnd Bergmann, linux-sh
On Tue, 24 Jan 2023 at 18:25, Tom Saeger <tom.saeger@oracle.com> wrote:
>
> On Tue, Jan 24, 2023 at 05:41:22PM +0530, Naresh Kamboju wrote:
> > Hi Tom,
> >
> > On Tue, 24 Jan 2023 at 01:12, Tom Saeger <tom.saeger@oracle.com> wrote:
> > >
> > > On Mon, Jan 23, 2023 at 01:11:32PM -0600, Tom Saeger wrote:
> > > > On Mon, Jan 23, 2023 at 01:39:11PM +0530, Naresh Kamboju wrote:
> > > > > On Sun, 22 Jan 2023 at 20:51, Greg Kroah-Hartman
> > > > >
> > > > > Results from Linaro’s test farm.
> > > > >
> > > > > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> > > > >
> > > > > * sh, build
> > > > > - gcc-8-dreamcast_defconfig
> > > > > - gcc-8-microdev_defconfig
> > > >
> > > > Naresh, any chance you could test again adding the following:
> > > >
> > > > diff --git a/arch/sh/kernel/vmlinux.lds.S b/arch/sh/kernel/vmlinux.lds.S
> > > > index 3161b9ccd2a5..b6276a3521d7 100644
> > > > --- a/arch/sh/kernel/vmlinux.lds.S
> > > > +++ b/arch/sh/kernel/vmlinux.lds.S
> > > > @@ -4,6 +4,7 @@
> > > > * Written by Niibe Yutaka and Paul Mundt
> > > > */
> > > > OUTPUT_ARCH(sh)
> > > > +#define RUNTIME_DISCARD_EXIT
> > > > #include <asm/thread_info.h>
> > > > #include <asm/cache.h>
> > > > #include <asm/vmlinux.lds.h>
> > > >
> > > >
> > > > My guess is build environment is using ld < 2.36??
> > > > and this is probably similar to:
> > > > a494398bde27 ("s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36")
> > > > 4b9880dbf3bd ("powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT")
> > > >
> > > >
> > > > Regards,
> > > >
> > > > --Tom
> > > >
> > > > >
> > > > >
> > > > > Build error logs:
> > > > > `.exit.text' referenced in section `__bug_table' of crypto/algboss.o:
> > > > > defined in discarded section `.exit.text' of crypto/algboss.o
> > > > > `.exit.text' referenced in section `__bug_table' of
> > > > > drivers/char/hw_random/core.o: defined in discarded section
> > > > > `.exit.text' of drivers/char/hw_random/core.o
> > > > > make[2]: *** [/builds/linux/scripts/Makefile.vmlinux:34: vmlinux] Error 1
> > >
> > >
> > > This is also occurring in latest upstream:
> >
> > Right !
> > build/gcc-8-dreamcast_defconfig
> > build/gcc-8-microdev_defconfig
> >
> > These build errors started from v6.2-rc2 on the mainline [1] & [2].
> >
> > >
> > > ❯ git describe HEAD
> > > v6.2-rc5-13-g2475bf0250de
> > >
> > > ❯ tuxmake --runtime podman --target-arch sh --toolchain gcc-8 --kconfig microdev_defconfig
> > >
> > > `.exit.text' referenced in section `__bug_table' of crypto/algboss.o: defined in discarded section `.exit.text' of crypto/algboss.o
> > > `.exit.text' referenced in section `__bug_table' of drivers/char/hw_random/core.o: defined in discarded section `.exit.text' of drivers/char/hw_random/core.o
> > > make[2]: *** [/home2/tsaeger/linux/linux-upstream/scripts/Makefile.vmlinux:35: vmlinux] Error 1
> > > make[2]: Target '__default' not remade because of errors.
> > > make[1]: *** [/home2/tsaeger/linux/linux-upstream/Makefile:1264: vmlinux] Error 2
> > > make[1]: Target '__all' not remade because of errors.
> > > make: *** [Makefile:242: __sub-make] Error 2
> > > make: Target '__all' not remade because of errors.
> > >
> > >
> > > FWIW, the above patch resolves this.
> > Yes. Tested and confirmed it fixes the reported problem.
> >
> > > How many more architectures need something similar?
> > Now I see it on sh with gcc-8 only on the mainline.
> >
> > OTOH,
> > It was noticed on earlier stable-rc 5.4 for x86, i386, powerpc, sh and s390.
> >
> > git_describe : v5.4.228-679-g79cbaf4448f3
> > kernel_version: 5.4.230-rc1
> >
> > Regressions found on sh: [1] & [2] mainline and below
> > - build/gcc-8-dreamcast_defconfig
> > - build/gcc-8-microdev_defconfig
> >
> > Regressions found on i386: [3]
> > - build/gcc-8-i386_defconfig
> >
> > Regressions found on powerpc: [4]
> > - build/gcc-8-mpc83xx_defconfig
> > - build/gcc-8-ppc64e_defconfig
> > - build/gcc-8-maple_defconfig
> > - build/gcc-8-ppc6xx_defconfig
> > - build/gcc-8-defconfig
> > - build/gcc-8-tqm8xx_defconfig
> > - build/gcc-8-cell_defconfig
> >
> > Regressions found on s390: [5]
> > - build/gcc-8-defconfig-fe40093d
> >
> > Regressions found on x86_64: [6]
> > - build/gcc-8-x86_64_defconfig
>
> v5.4 needs:
> 84d5f77fc2ee ("x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS")
>
> which didn't hit Linus's tree until: v5.7-rc1~164^2~1
> This explains why v5.4 blew-up and v5.10 didn't.
>
> I'm testing the following for v5.4
>
> 84d5f77fc2ee ("x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS")
> This needed a little massaging to apply.
>
> 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv")
> 4b9880dbf3bd ("powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT")
> 07b050f9290e ("powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds")
> a494398bde27 ("s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36")
> + the arch/sh patch https://lore.kernel.org/all/9166a8abdc0f979e50377e61780a4bba1dfa2f52.1674518464.git.tom.saeger@oracle.com/
>
>
> I'd be grateful if you could confirm - so I can send this full series to
> Greg.
>
> If you'd rather - I can send the patch-series now for testing?
Please send your repo and branch. I will pick up and run tests on it.
- Naresh
^ permalink raw reply [flat|nested] 210+ messages in thread
* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-23 19:11 ` Tom Saeger
2023-01-23 19:42 ` Tom Saeger
@ 2023-01-24 11:48 ` Naresh Kamboju
1 sibling, 0 replies; 210+ messages in thread
From: Naresh Kamboju @ 2023-01-24 11:48 UTC (permalink / raw)
To: Tom Saeger
Cc: Greg Kroah-Hartman, stable, patches, linux-kernel, torvalds,
akpm, linux, shuah, patches, lkft-triage, pavel, jonathanh,
f.fainelli, sudipm.mukherjee, srw, rwarsow, Masahiro Yamada,
Ard Biesheuvel, Nathan Chancellor, Dennis Gilmore,
Palmer Dabbelt, Arnd Bergmann
On Tue, 24 Jan 2023 at 00:41, Tom Saeger <tom.saeger@oracle.com> wrote:
>
> On Mon, Jan 23, 2023 at 01:39:11PM +0530, Naresh Kamboju wrote:
> > On Sun, 22 Jan 2023 at 20:51, Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > This is the start of the stable review cycle for the 6.1.8 release.
> > > There are 193 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Tue, 24 Jan 2023 15:02:08 +0000.
> > > Anything received after that time might be too late.
> > >
> > > The whole patch series can be found in one patch at:
> > > https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.8-rc1.gz
> > > or in the git tree and branch at:
> > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> > > and the diffstat can be found below.
> > >
> > > thanks,
> > >
> > > greg k-h
> >
> >
> > Results from Linaro’s test farm.
> >
> > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> >
> > * sh, build
> > - gcc-8-dreamcast_defconfig
> > - gcc-8-microdev_defconfig
>
> Naresh, any chance you could test again adding the following:
>
> diff --git a/arch/sh/kernel/vmlinux.lds.S b/arch/sh/kernel/vmlinux.lds.S
> index 3161b9ccd2a5..b6276a3521d7 100644
> --- a/arch/sh/kernel/vmlinux.lds.S
> +++ b/arch/sh/kernel/vmlinux.lds.S
> @@ -4,6 +4,7 @@
> * Written by Niibe Yutaka and Paul Mundt
> */
> OUTPUT_ARCH(sh)
> +#define RUNTIME_DISCARD_EXIT
> #include <asm/thread_info.h>
> #include <asm/cache.h>
> #include <asm/vmlinux.lds.h>
Above patch fixes the reported problem.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
>
> My guess is build environment is using ld < 2.36??
"ld": "GNU ld (GNU Binutils for Debian) 2.31.1",
However, we have been building with gcc-8, gcc-10, gcc-11 and gcc-10.
> and this is probably similar to:
> a494398bde27 ("s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36")
> 4b9880dbf3bd ("powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT")
>
>
> Regards,
>
> --Tom
Best regards
Naresh Kamboju
^ permalink raw reply [flat|nested] 210+ messages in thread
* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2023-01-23 8:09 ` Naresh Kamboju
@ 2023-01-23 9:03 ` Bagas Sanjaya
2023-01-23 9:07 ` Fenil Jain
` (2 subsequent siblings)
201 siblings, 0 replies; 210+ messages in thread
From: Bagas Sanjaya @ 2023-01-23 9:03 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow
[-- Attachment #1: Type: text/plain, Size: 538 bytes --]
On Sun, Jan 22, 2023 at 04:02:09PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.8 release.
> There are 193 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
Successfully cross-compiled for arm64 (bcm2711_defconfig, GCC 10.2.0) and
powerpc (ps3_defconfig, GCC 12.2.0).
Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
--
An old man doll... just what I always wanted! - Clara
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2023-01-23 9:03 ` Bagas Sanjaya
@ 2023-01-23 9:07 ` Fenil Jain
2023-01-23 9:07 ` Ron Economos
2023-01-23 11:15 ` Sudip Mukherjee
201 siblings, 0 replies; 210+ messages in thread
From: Fenil Jain @ 2023-01-23 9:07 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: stable
Hey Greg,
Ran tests and boot tested on my system, no regressions found
Tested-by: Fenil Jain <fkjainco@gmail.com>
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2023-01-23 9:07 ` Fenil Jain
@ 2023-01-23 9:07 ` Ron Economos
2023-01-23 11:15 ` Sudip Mukherjee
201 siblings, 0 replies; 210+ messages in thread
From: Ron Economos @ 2023-01-23 9:07 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow
On 1/22/23 7:02 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.8 release.
> There are 193 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 24 Jan 2023 15:02:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.8-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 210+ messages in thread* Re: [PATCH 6.1 000/193] 6.1.8-rc1 review
2023-01-22 15:02 [PATCH 6.1 000/193] 6.1.8-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2023-01-23 9:07 ` Ron Economos
@ 2023-01-23 11:15 ` Sudip Mukherjee
201 siblings, 0 replies; 210+ messages in thread
From: Sudip Mukherjee @ 2023-01-23 11:15 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli, srw, rwarsow
Hi Greg,
On Sun, Jan 22, 2023 at 04:02:09PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.8 release.
> There are 193 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 24 Jan 2023 15:02:08 +0000.
> Anything received after that time might be too late.
Build test (gcc version 12.2.1 20230113):
mips: 52 configs -> no failure
arm: 100 configs -> no failure
arm64: 3 configs -> no failure
x86_64: 4 configs -> no failure
alpha allmodconfig -> no failure
csky allmodconfig -> no failure
powerpc allmodconfig -> no failure
riscv allmodconfig -> no failure
s390 allmodconfig -> no failure
xtensa allmodconfig -> no failure
Boot test:
x86_64: Booted on my test laptop. No regression.
x86_64: Booted on qemu. No regression. [1]
arm64: Booted on rpi4b (4GB model). No regression. [2]
mips: Booted on ci20 board. No regression. [3]
[1]. https://openqa.qa.codethink.co.uk/tests/2705
[2]. https://openqa.qa.codethink.co.uk/tests/2700
[3]. https://openqa.qa.codethink.co.uk/tests/2706
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
--
Regards
Sudip
^ permalink raw reply [flat|nested] 210+ messages in thread