* [PATCH 5.10 01/70] MIPS: Fix CP0 counter erratum detection for R4k CPUs
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 02/70] parisc: Merge model and model name into one line in /proc/cpuinfo Greg Kroah-Hartman
` (77 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maciej W. Rozycki,
Philippe Mathieu-Daudé,
Thomas Bogendoerfer
From: Maciej W. Rozycki <macro@orcam.me.uk>
commit f0a6c68f69981214cb7858738dd2bc81475111f7 upstream.
Fix the discrepancy between the two places we check for the CP0 counter
erratum in along with the incorrect comparison of the R4400 revision
number against 0x30 which matches none and consistently consider all
R4000 and R4400 processors affected, as documented in processor errata
publications[1][2][3], following the mapping between CP0 PRId register
values and processor models:
PRId | Processor Model
---------+--------------------
00000422 | R4000 Revision 2.2
00000430 | R4000 Revision 3.0
00000440 | R4400 Revision 1.0
00000450 | R4400 Revision 2.0
00000460 | R4400 Revision 3.0
No other revision of either processor has ever been spotted.
Contrary to what has been stated in commit ce202cbb9e0b ("[MIPS] Assume
R4000/R4400 newer than 3.0 don't have the mfc0 count bug") marking the
CP0 counter as buggy does not preclude it from being used as either a
clock event or a clock source device. It just cannot be used as both at
a time, because in that case clock event interrupts will be occasionally
lost, and the use as a clock event device takes precedence.
Compare against 0x4ff in `can_use_mips_counter' so that a single machine
instruction is produced.
[1] "MIPS R4000PC/SC Errata, Processor Revision 2.2 and 3.0", MIPS
Technologies Inc., May 10, 1994, Erratum 53, p.13
[2] "MIPS R4400PC/SC Errata, Processor Revision 1.0", MIPS Technologies
Inc., February 9, 1994, Erratum 21, p.4
[3] "MIPS R4400PC/SC Errata, Processor Revision 2.0 & 3.0", MIPS
Technologies Inc., January 24, 1995, Erratum 14, p.3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: ce202cbb9e0b ("[MIPS] Assume R4000/R4400 newer than 3.0 don't have the mfc0 count bug")
Cc: stable@vger.kernel.org # v2.6.24+
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/include/asm/timex.h | 8 ++++----
arch/mips/kernel/time.c | 11 +++--------
2 files changed, 7 insertions(+), 12 deletions(-)
--- a/arch/mips/include/asm/timex.h
+++ b/arch/mips/include/asm/timex.h
@@ -40,9 +40,9 @@
typedef unsigned int cycles_t;
/*
- * On R4000/R4400 before version 5.0 an erratum exists such that if the
- * cycle counter is read in the exact moment that it is matching the
- * compare register, no interrupt will be generated.
+ * On R4000/R4400 an erratum exists such that if the cycle counter is
+ * read in the exact moment that it is matching the compare register,
+ * no interrupt will be generated.
*
* There is a suggested workaround and also the erratum can't strike if
* the compare interrupt isn't being used as the clock source device.
@@ -63,7 +63,7 @@ static inline int can_use_mips_counter(u
if (!__builtin_constant_p(cpu_has_counter))
asm volatile("" : "=m" (cpu_data[0].options));
if (likely(cpu_has_counter &&
- prid >= (PRID_IMP_R4000 | PRID_REV_ENCODE_44(5, 0))))
+ prid > (PRID_IMP_R4000 | PRID_REV_ENCODE_44(15, 15))))
return 1;
else
return 0;
--- a/arch/mips/kernel/time.c
+++ b/arch/mips/kernel/time.c
@@ -141,15 +141,10 @@ static __init int cpu_has_mfc0_count_bug
case CPU_R4400MC:
/*
* The published errata for the R4400 up to 3.0 say the CPU
- * has the mfc0 from count bug.
+ * has the mfc0 from count bug. This seems the last version
+ * produced.
*/
- if ((current_cpu_data.processor_id & 0xff) <= 0x30)
- return 1;
-
- /*
- * we assume newer revisions are ok
- */
- return 0;
+ return 1;
}
return 0;
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 02/70] parisc: Merge model and model name into one line in /proc/cpuinfo
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 01/70] MIPS: Fix CP0 counter erratum detection for R4k CPUs Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 03/70] ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers Greg Kroah-Hartman
` (76 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Helge Deller
From: Helge Deller <deller@gmx.de>
commit 5b89966bc96a06f6ad65f64ae4b0461918fcc9d3 upstream.
The Linux tool "lscpu" shows the double amount of CPUs if we have
"model" and "model name" in two different lines in /proc/cpuinfo.
This change combines the model and the model name into one line.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/kernel/processor.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/parisc/kernel/processor.c
+++ b/arch/parisc/kernel/processor.c
@@ -419,8 +419,7 @@ show_cpuinfo (struct seq_file *m, void *
}
seq_printf(m, " (0x%02lx)\n", boot_cpu_data.pdc.capabilities);
- seq_printf(m, "model\t\t: %s\n"
- "model name\t: %s\n",
+ seq_printf(m, "model\t\t: %s - %s\n",
boot_cpu_data.pdc.sys_model_name,
cpuinfo->dev ?
cpuinfo->dev->name : "Unknown");
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 03/70] ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 01/70] MIPS: Fix CP0 counter erratum detection for R4k CPUs Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 02/70] parisc: Merge model and model name into one line in /proc/cpuinfo Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 04/70] ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes Greg Kroah-Hartman
` (75 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zihao Wang, Takashi Iwai
From: Zihao Wang <wzhd@ustc.edu>
commit 3b79954fd00d540677c97a560622b73f3a1f4e28 upstream.
Lenovo Yoga Duet 7 13ITL6 has Realtek ALC287 and built-in
speakers do not work out of the box. The fix developed for
Yoga 7i 14ITL5 also enables speaker output for this model.
Signed-off-by: Zihao Wang <wzhd@ustc.edu>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220424084120.74125-1-wzhd@ustc.edu
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8969,6 +8969,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x17aa, 0x3813, "Legion 7i 15IMHG05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS),
SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940", ALC298_FIXUP_LENOVO_SPK_VOLUME),
SND_PCI_QUIRK(0x17aa, 0x3819, "Lenovo 13s Gen2 ITL", ALC287_FIXUP_13S_GEN2_SPEAKERS),
+ SND_PCI_QUIRK(0x17aa, 0x3820, "Yoga Duet 7 13ITL6", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
SND_PCI_QUIRK(0x17aa, 0x3824, "Legion Y9000X 2020", ALC285_FIXUP_LEGION_Y9000X_SPEAKERS),
SND_PCI_QUIRK(0x17aa, 0x3827, "Ideapad S740", ALC285_FIXUP_IDEAPAD_S740_COEF),
SND_PCI_QUIRK(0x17aa, 0x3834, "Lenovo IdeaPad Slim 9i 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 04/70] ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 03/70] ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 05/70] mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC Greg Kroah-Hartman
` (74 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Sakamoto, Takashi Iwai
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
commit eb9d84b0ffe39893cb23b0b6712bbe3637fa25fa upstream.
ALSA fireworks driver has a bug in its initial state to return count
shorter than expected by 4 bytes to userspace applications when handling
response frame for Echo Audio Fireworks transaction. It's due to missing
addition of the size for the type of event in ALSA firewire stack.
Fixes: 555e8a8f7f14 ("ALSA: fireworks: Add command/response functionality into hwdep interface")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20220424102428.21109-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/firewire/fireworks/fireworks_hwdep.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/firewire/fireworks/fireworks_hwdep.c
+++ b/sound/firewire/fireworks/fireworks_hwdep.c
@@ -34,6 +34,7 @@ hwdep_read_resp_buf(struct snd_efw *efw,
type = SNDRV_FIREWIRE_EVENT_EFW_RESPONSE;
if (copy_to_user(buf, &type, sizeof(type)))
return -EFAULT;
+ count += sizeof(type);
remained -= sizeof(type);
buf += sizeof(type);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 05/70] mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 04/70] ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 06/70] mmc: core: Set HS clock speed before sending HS CMD13 Greg Kroah-Hartman
` (73 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shaik Sajida Bhanu, Adrian Hunter,
Philipp Zabel, Konrad Dybcio, Ulf Hansson
From: Shaik Sajida Bhanu <quic_c_sbhanu@quicinc.com>
commit 3e5a8e8494a8122fe4eb3f167662f406cab753b9 upstream.
Reset GCC_SDCC_BCR register before every fresh initilazation. This will
reset whole SDHC-msm controller, clears the previous power control
states and avoids, software reset timeout issues as below.
[ 5.458061][ T262] mmc1: Reset 0x1 never completed.
[ 5.462454][ T262] mmc1: sdhci: ============ SDHCI REGISTER DUMP ===========
[ 5.469065][ T262] mmc1: sdhci: Sys addr: 0x00000000 | Version: 0x00007202
[ 5.475688][ T262] mmc1: sdhci: Blk size: 0x00000000 | Blk cnt: 0x00000000
[ 5.482315][ T262] mmc1: sdhci: Argument: 0x00000000 | Trn mode: 0x00000000
[ 5.488927][ T262] mmc1: sdhci: Present: 0x01f800f0 | Host ctl: 0x00000000
[ 5.495539][ T262] mmc1: sdhci: Power: 0x00000000 | Blk gap: 0x00000000
[ 5.502162][ T262] mmc1: sdhci: Wake-up: 0x00000000 | Clock: 0x00000003
[ 5.508768][ T262] mmc1: sdhci: Timeout: 0x00000000 | Int stat: 0x00000000
[ 5.515381][ T262] mmc1: sdhci: Int enab: 0x00000000 | Sig enab: 0x00000000
[ 5.521996][ T262] mmc1: sdhci: ACmd stat: 0x00000000 | Slot int: 0x00000000
[ 5.528607][ T262] mmc1: sdhci: Caps: 0x362dc8b2 | Caps_1: 0x0000808f
[ 5.535227][ T262] mmc1: sdhci: Cmd: 0x00000000 | Max curr: 0x00000000
[ 5.541841][ T262] mmc1: sdhci: Resp[0]: 0x00000000 | Resp[1]: 0x00000000
[ 5.548454][ T262] mmc1: sdhci: Resp[2]: 0x00000000 | Resp[3]: 0x00000000
[ 5.555079][ T262] mmc1: sdhci: Host ctl2: 0x00000000
[ 5.559651][ T262] mmc1: sdhci_msm: ----------- VENDOR REGISTER DUMP-----------
[ 5.566621][ T262] mmc1: sdhci_msm: DLL sts: 0x00000000 | DLL cfg: 0x6000642c | DLL cfg2: 0x0020a000
[ 5.575465][ T262] mmc1: sdhci_msm: DLL cfg3: 0x00000000 | DLL usr ctl: 0x00010800 | DDR cfg: 0x80040873
[ 5.584658][ T262] mmc1: sdhci_msm: Vndr func: 0x00018a9c | Vndr func2 : 0xf88218a8 Vndr func3: 0x02626040
Fixes: 0eb0d9f4de34 ("mmc: sdhci-msm: Initial support for Qualcomm chipsets")
Signed-off-by: Shaik Sajida Bhanu <quic_c_sbhanu@quicinc.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Tested-by: Konrad Dybcio <konrad.dybcio@somainline.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1650816153-23797-1-git-send-email-quic_c_sbhanu@quicinc.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci-msm.c | 42 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)
--- a/drivers/mmc/host/sdhci-msm.c
+++ b/drivers/mmc/host/sdhci-msm.c
@@ -16,6 +16,7 @@
#include <linux/regulator/consumer.h>
#include <linux/interconnect.h>
#include <linux/pinctrl/consumer.h>
+#include <linux/reset.h>
#include "sdhci-pltfm.h"
#include "cqhci.h"
@@ -2228,6 +2229,43 @@ static inline void sdhci_msm_get_of_prop
of_property_read_u32(node, "qcom,dll-config", &msm_host->dll_config);
}
+static int sdhci_msm_gcc_reset(struct device *dev, struct sdhci_host *host)
+{
+ struct reset_control *reset;
+ int ret = 0;
+
+ reset = reset_control_get_optional_exclusive(dev, NULL);
+ if (IS_ERR(reset))
+ return dev_err_probe(dev, PTR_ERR(reset),
+ "unable to acquire core_reset\n");
+
+ if (!reset)
+ return ret;
+
+ ret = reset_control_assert(reset);
+ if (ret) {
+ reset_control_put(reset);
+ return dev_err_probe(dev, ret, "core_reset assert failed\n");
+ }
+
+ /*
+ * The hardware requirement for delay between assert/deassert
+ * is at least 3-4 sleep clock (32.7KHz) cycles, which comes to
+ * ~125us (4/32768). To be on the safe side add 200us delay.
+ */
+ usleep_range(200, 210);
+
+ ret = reset_control_deassert(reset);
+ if (ret) {
+ reset_control_put(reset);
+ return dev_err_probe(dev, ret, "core_reset deassert failed\n");
+ }
+
+ usleep_range(200, 210);
+ reset_control_put(reset);
+
+ return ret;
+}
static int sdhci_msm_probe(struct platform_device *pdev)
{
@@ -2276,6 +2314,10 @@ static int sdhci_msm_probe(struct platfo
msm_host->saved_tuning_phase = INVALID_TUNING_PHASE;
+ ret = sdhci_msm_gcc_reset(&pdev->dev, host);
+ if (ret)
+ goto pltfm_free;
+
/* Setup SDCC bus voter clock. */
msm_host->bus_clk = devm_clk_get(&pdev->dev, "bus");
if (!IS_ERR(msm_host->bus_clk)) {
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 06/70] mmc: core: Set HS clock speed before sending HS CMD13
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 05/70] mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 07/70] gpiolib: of: fix bounds check for gpio-reserved-ranges Greg Kroah-Hartman
` (72 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shawn Lin, Luca Weiss, Brian Norris,
Ulf Hansson
From: Brian Norris <briannorris@chromium.org>
commit 4bc31edebde51fcf8ad0794763b8679a7ecb5ec0 upstream.
Way back in commit 4f25580fb84d ("mmc: core: changes frequency to
hs_max_dtr when selecting hs400es"), Rockchip engineers noticed that
some eMMC don't respond to SEND_STATUS commands very reliably if they're
still running at a low initial frequency. As mentioned in that commit,
JESD84-B51 P49 suggests a sequence in which the host:
1. sets HS_TIMING
2. bumps the clock ("<= 52 MHz")
3. sends further commands
It doesn't exactly require that we don't use a lower-than-52MHz
frequency, but in practice, these eMMC don't like it.
The aforementioned commit tried to get that right for HS400ES, although
it's unclear whether this ever truly worked as committed into mainline,
as other changes/refactoring adjusted the sequence in conflicting ways:
08573eaf1a70 ("mmc: mmc: do not use CMD13 to get status after speed mode
switch")
53e60650f74e ("mmc: core: Allow CMD13 polling when switching to HS mode
for mmc")
In any case, today we do step 3 before step 2. Let's fix that, and also
apply the same logic to HS200/400, where this eMMC has problems too.
Resolves errors like this seen when booting some RK3399 Gru/Scarlet
systems:
[ 2.058881] mmc1: CQHCI version 5.10
[ 2.097545] mmc1: SDHCI controller on fe330000.mmc [fe330000.mmc] using ADMA
[ 2.209804] mmc1: mmc_select_hs400es failed, error -84
[ 2.215597] mmc1: error -84 whilst initialising MMC card
[ 2.417514] mmc1: mmc_select_hs400es failed, error -110
[ 2.423373] mmc1: error -110 whilst initialising MMC card
[ 2.605052] mmc1: mmc_select_hs400es failed, error -110
[ 2.617944] mmc1: error -110 whilst initialising MMC card
[ 2.835884] mmc1: mmc_select_hs400es failed, error -110
[ 2.841751] mmc1: error -110 whilst initialising MMC card
Ealier versions of this patch bumped to 200MHz/HS200 speeds too early,
which caused issues on, e.g., qcom-msm8974-fairphone-fp2. (Thanks for
the report Luca!) After a second look, it appears that aligns with
JESD84 / page 45 / table 28, so we need to keep to lower (HS / 52 MHz)
rates first.
Fixes: 08573eaf1a70 ("mmc: mmc: do not use CMD13 to get status after speed mode switch")
Fixes: 53e60650f74e ("mmc: core: Allow CMD13 polling when switching to HS mode for mmc")
Fixes: 4f25580fb84d ("mmc: core: changes frequency to hs_max_dtr when selecting hs400es")
Cc: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://lore.kernel.org/linux-mmc/11962455.O9o76ZdvQC@g550jk/
Reported-by: Luca Weiss <luca@z3ntu.xyz>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Tested-by: Luca Weiss <luca@z3ntu.xyz>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20220422100824.v4.1.I484f4ee35609f78b932bd50feed639c29e64997e@changeid
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/mmc.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1378,13 +1378,17 @@ static int mmc_select_hs400es(struct mmc
goto out_err;
}
+ /*
+ * Bump to HS timing and frequency. Some cards don't handle
+ * SEND_STATUS reliably at the initial frequency.
+ */
mmc_set_timing(host, MMC_TIMING_MMC_HS);
+ mmc_set_bus_speed(card);
+
err = mmc_switch_status(card, true);
if (err)
goto out_err;
- mmc_set_clock(host, card->ext_csd.hs_max_dtr);
-
/* Switch card to DDR with strobe bit */
val = EXT_CSD_DDR_BUS_WIDTH_8 | EXT_CSD_BUS_WIDTH_STROBE;
err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
@@ -1442,7 +1446,7 @@ out_err:
static int mmc_select_hs200(struct mmc_card *card)
{
struct mmc_host *host = card->host;
- unsigned int old_timing, old_signal_voltage;
+ unsigned int old_timing, old_signal_voltage, old_clock;
int err = -EINVAL;
u8 val;
@@ -1473,8 +1477,17 @@ static int mmc_select_hs200(struct mmc_c
false, true);
if (err)
goto err;
+
+ /*
+ * Bump to HS timing and frequency. Some cards don't handle
+ * SEND_STATUS reliably at the initial frequency.
+ * NB: We can't move to full (HS200) speeds until after we've
+ * successfully switched over.
+ */
old_timing = host->ios.timing;
+ old_clock = host->ios.clock;
mmc_set_timing(host, MMC_TIMING_MMC_HS200);
+ mmc_set_clock(card->host, card->ext_csd.hs_max_dtr);
/*
* For HS200, CRC errors are not a reliable way to know the
@@ -1487,8 +1500,10 @@ static int mmc_select_hs200(struct mmc_c
* mmc_select_timing() assumes timing has not changed if
* it is a switch error.
*/
- if (err == -EBADMSG)
+ if (err == -EBADMSG) {
+ mmc_set_clock(host, old_clock);
mmc_set_timing(host, old_timing);
+ }
}
err:
if (err) {
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 07/70] gpiolib: of: fix bounds check for gpio-reserved-ranges
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 06/70] mmc: core: Set HS clock speed before sending HS CMD13 Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 08/70] KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id Greg Kroah-Hartman
` (71 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrei Lalaev, Andy Shevchenko,
Linus Walleij, Bartosz Golaszewski
From: Andrei Lalaev <andrei.lalaev@emlid.com>
commit e75f88efac05bf4e107e4171d8db6d8c3937252d upstream.
Gpiolib interprets the elements of "gpio-reserved-ranges" as "start,size"
because it clears "size" bits starting from the "start" bit in the according
bitmap. So it has to use "greater" instead of "greater or equal" when performs
bounds check to make sure that GPIOs are in the available range.
Previous implementation skipped ranges that include the last GPIO in
the range.
I wrote the mail to the maintainers
(https://lore.kernel.org/linux-gpio/20220412115554.159435-1-andrei.lalaev@emlid.com/T/#u)
of the questioned DTSes (because I couldn't understand how the maintainers
interpreted this property), but I haven't received a response.
Since the questioned DTSes use "gpio-reserved-ranges = <0 4>"
(i.e., the beginning of the range), this patch doesn't affect these DTSes at all.
TBH this patch doesn't break any existing DTSes because none of them
reserve gpios at the end of range.
Fixes: 726cb3ba4969 ("gpiolib: Support 'gpio-reserved-ranges' property")
Signed-off-by: Andrei Lalaev <andrei.lalaev@emlid.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpiolib-of.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -912,7 +912,7 @@ static void of_gpiochip_init_valid_mask(
i, &start);
of_property_read_u32_index(np, "gpio-reserved-ranges",
i + 1, &count);
- if (start >= chip->ngpio || start + count >= chip->ngpio)
+ if (start >= chip->ngpio || start + count > chip->ngpio)
continue;
bitmap_clear(chip->valid_mask, start, count);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 08/70] KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 07/70] gpiolib: of: fix bounds check for gpio-reserved-ranges Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 09/70] iommu/vt-d: Calculate mask for non-aligned flushes Greg Kroah-Hartman
` (70 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kyle Huey, Paolo Bonzini
From: Kyle Huey <me@kylehuey.com>
commit 5eb849322d7f7ae9d5c587c7bc3b4f7c6872cd2f upstream.
Zen renumbered some of the performance counters that correspond to the
well known events in perf_hw_id. This code in KVM was never updated for
that, so guest that attempt to use counters on Zen that correspond to the
pre-Zen perf_hw_id values will silently receive the wrong values.
This has been observed in the wild with rr[0] when running in Zen 3
guests. rr uses the retired conditional branch counter 00d1 which is
incorrectly recognized by KVM as PERF_COUNT_HW_STALLED_CYCLES_BACKEND.
[0] https://rr-project.org/
Signed-off-by: Kyle Huey <me@kylehuey.com>
Message-Id: <20220503050136.86298-1-khuey@kylehuey.com>
Cc: stable@vger.kernel.org
[Check guest family, not host. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/svm/pmu.c | 28 +++++++++++++++++++++++++---
1 file changed, 25 insertions(+), 3 deletions(-)
--- a/arch/x86/kvm/svm/pmu.c
+++ b/arch/x86/kvm/svm/pmu.c
@@ -44,6 +44,22 @@ static struct kvm_event_hw_type_mapping
[7] = { 0xd1, 0x00, PERF_COUNT_HW_STALLED_CYCLES_BACKEND },
};
+/* duplicated from amd_f17h_perfmon_event_map. */
+static struct kvm_event_hw_type_mapping amd_f17h_event_mapping[] = {
+ [0] = { 0x76, 0x00, PERF_COUNT_HW_CPU_CYCLES },
+ [1] = { 0xc0, 0x00, PERF_COUNT_HW_INSTRUCTIONS },
+ [2] = { 0x60, 0xff, PERF_COUNT_HW_CACHE_REFERENCES },
+ [3] = { 0x64, 0x09, PERF_COUNT_HW_CACHE_MISSES },
+ [4] = { 0xc2, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS },
+ [5] = { 0xc3, 0x00, PERF_COUNT_HW_BRANCH_MISSES },
+ [6] = { 0x87, 0x02, PERF_COUNT_HW_STALLED_CYCLES_FRONTEND },
+ [7] = { 0x87, 0x01, PERF_COUNT_HW_STALLED_CYCLES_BACKEND },
+};
+
+/* amd_pmc_perf_hw_id depends on these being the same size */
+static_assert(ARRAY_SIZE(amd_event_mapping) ==
+ ARRAY_SIZE(amd_f17h_event_mapping));
+
static unsigned int get_msr_base(struct kvm_pmu *pmu, enum pmu_type type)
{
struct kvm_vcpu *vcpu = pmu_to_vcpu(pmu);
@@ -128,19 +144,25 @@ static inline struct kvm_pmc *get_gp_pmc
static unsigned int amd_pmc_perf_hw_id(struct kvm_pmc *pmc)
{
+ struct kvm_event_hw_type_mapping *event_mapping;
u8 event_select = pmc->eventsel & ARCH_PERFMON_EVENTSEL_EVENT;
u8 unit_mask = (pmc->eventsel & ARCH_PERFMON_EVENTSEL_UMASK) >> 8;
int i;
+ if (guest_cpuid_family(pmc->vcpu) >= 0x17)
+ event_mapping = amd_f17h_event_mapping;
+ else
+ event_mapping = amd_event_mapping;
+
for (i = 0; i < ARRAY_SIZE(amd_event_mapping); i++)
- if (amd_event_mapping[i].eventsel == event_select
- && amd_event_mapping[i].unit_mask == unit_mask)
+ if (event_mapping[i].eventsel == event_select
+ && event_mapping[i].unit_mask == unit_mask)
break;
if (i == ARRAY_SIZE(amd_event_mapping))
return PERF_COUNT_HW_MAX;
- return amd_event_mapping[i].event_type;
+ return event_mapping[i].event_type;
}
/* return PERF_COUNT_HW_MAX as AMD doesn't have fixed events */
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 09/70] iommu/vt-d: Calculate mask for non-aligned flushes
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 08/70] KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 10/70] drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT Greg Kroah-Hartman
` (69 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Stevens, Kevin Tian, Lu Baolu,
Joerg Roedel
From: David Stevens <stevensd@chromium.org>
commit 59bf3557cf2f8a469a554aea1e3d2c8e72a579f7 upstream.
Calculate the appropriate mask for non-size-aligned page selective
invalidation. Since psi uses the mask value to mask out the lower order
bits of the target address, properly flushing the iotlb requires using a
mask value such that [pfn, pfn+pages) all lie within the flushed
size-aligned region. This is not normally an issue because iova.c
always allocates iovas that are aligned to their size. However, iovas
which come from other sources (e.g. userspace via VFIO) may not be
aligned.
To properly flush the IOTLB, both the start and end pfns need to be
equal after applying the mask. That means that the most efficient mask
to use is the index of the lowest bit that is equal where all higher
bits are also equal. For example, if pfn=0x17f and pages=3, then
end_pfn=0x181, so the smallest mask we can use is 8. Any differences
above the highest bit of pages are due to carrying, so by xnor'ing pfn
and end_pfn and then masking out the lower order bits based on pages, we
get 0xffffff00, where the first set bit is the mask we want to use.
Fixes: 6fe1010d6d9c ("vfio/type1: DMA unmap chunking")
Cc: stable@vger.kernel.org
Signed-off-by: David Stevens <stevensd@chromium.org>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20220401022430.1262215-1-stevensd@google.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/20220410013533.3959168-2-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel/iommu.c | 27 ++++++++++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -1626,7 +1626,8 @@ static void iommu_flush_iotlb_psi(struct
unsigned long pfn, unsigned int pages,
int ih, int map)
{
- unsigned int mask = ilog2(__roundup_pow_of_two(pages));
+ unsigned int aligned_pages = __roundup_pow_of_two(pages);
+ unsigned int mask = ilog2(aligned_pages);
uint64_t addr = (uint64_t)pfn << VTD_PAGE_SHIFT;
u16 did = domain->iommu_did[iommu->seq_id];
@@ -1638,10 +1639,30 @@ static void iommu_flush_iotlb_psi(struct
if (domain_use_first_level(domain)) {
domain_flush_piotlb(iommu, domain, addr, pages, ih);
} else {
+ unsigned long bitmask = aligned_pages - 1;
+
+ /*
+ * PSI masks the low order bits of the base address. If the
+ * address isn't aligned to the mask, then compute a mask value
+ * needed to ensure the target range is flushed.
+ */
+ if (unlikely(bitmask & pfn)) {
+ unsigned long end_pfn = pfn + pages - 1, shared_bits;
+
+ /*
+ * Since end_pfn <= pfn + bitmask, the only way bits
+ * higher than bitmask can differ in pfn and end_pfn is
+ * by carrying. This means after masking out bitmask,
+ * high bits starting with the first set bit in
+ * shared_bits are all equal in both pfn and end_pfn.
+ */
+ shared_bits = ~(pfn ^ end_pfn) & ~bitmask;
+ mask = shared_bits ? __ffs(shared_bits) : BITS_PER_LONG;
+ }
+
/*
* Fallback to domain selective flush if no PSI support or
- * the size is too big. PSI requires page size to be 2 ^ x,
- * and the base address is naturally aligned to the size.
+ * the size is too big.
*/
if (!cap_pgsel_inv(iommu->cap) ||
mask > cap_max_amask_val(iommu->cap))
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 10/70] drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 09/70] iommu/vt-d: Calculate mask for non-aligned flushes Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 11/70] Revert "SUNRPC: attempt AF_LOCAL connect on setup" Greg Kroah-Hartman
` (68 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Harry Wentland, Alex Deucher
From: Harry Wentland <harry.wentland@amd.com>
commit 3dfe85fa87b2a26bdbd292b66653bba065cf9941 upstream.
A faulty receiver might report an erroneous channel count. We
should guard against reading beyond AUDIO_CHANNELS_COUNT as
that would overflow the dpcd_pattern_period array.
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -2822,7 +2822,7 @@ static void dp_test_get_audio_test_data(
&dpcd_pattern_type.value,
sizeof(dpcd_pattern_type));
- channel_count = dpcd_test_mode.bits.channel_count + 1;
+ channel_count = min(dpcd_test_mode.bits.channel_count + 1, AUDIO_CHANNELS_COUNT);
// read pattern periods for requested channels when sawTooth pattern is requested
if (dpcd_pattern_type.value == AUDIO_TEST_PATTERN_SAWTOOTH ||
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 11/70] Revert "SUNRPC: attempt AF_LOCAL connect on setup"
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 10/70] drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 12/70] firewire: fix potential uaf in outbound_phy_packet_callback() Greg Kroah-Hartman
` (67 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, wanghai (M), Trond Myklebust
From: Trond Myklebust <trond.myklebust@hammerspace.com>
commit a3d0562d4dc039bca39445e1cddde7951662e17d upstream.
This reverts commit 7073ea8799a8cf73db60270986f14e4aae20fa80.
We must not try to connect the socket while the transport is under
construction, because the mechanisms to safely tear it down are not in
place. As the code stands, we end up leaking the sockets on a connection
error.
Reported-by: wanghai (M) <wanghai38@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xprtsock.c | 3 ---
1 file changed, 3 deletions(-)
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2826,9 +2826,6 @@ static struct rpc_xprt *xs_setup_local(s
}
xprt_set_bound(xprt);
xs_format_peer_addresses(xprt, "local", RPCBIND_NETID_LOCAL);
- ret = ERR_PTR(xs_local_setup_socket(transport));
- if (ret)
- goto out_err;
break;
default:
ret = ERR_PTR(-EAFNOSUPPORT);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 12/70] firewire: fix potential uaf in outbound_phy_packet_callback()
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 11/70] Revert "SUNRPC: attempt AF_LOCAL connect on setup" Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 13/70] firewire: remove check of list iterator against head past the loop body Greg Kroah-Hartman
` (66 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chengfeng Ye, Takashi Sakamoto, Takashi Iwai
From: Chengfeng Ye <cyeaa@connect.ust.hk>
commit b7c81f80246fac44077166f3e07103affe6db8ff upstream.
&e->event and e point to the same address, and &e->event could
be freed in queue_event. So there is a potential uaf issue if
we dereference e after calling queue_event(). Fix this by adding
a temporary variable to maintain e->client in advance, this can
avoid the potential uaf issue.
Cc: <stable@vger.kernel.org>
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20220409041243.603210-2-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firewire/core-cdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -1480,6 +1480,7 @@ static void outbound_phy_packet_callback
{
struct outbound_phy_packet_event *e =
container_of(packet, struct outbound_phy_packet_event, p);
+ struct client *e_client;
switch (status) {
/* expected: */
@@ -1496,9 +1497,10 @@ static void outbound_phy_packet_callback
}
e->phy_packet.data[0] = packet->timestamp;
+ e_client = e->client;
queue_event(e->client, &e->event, &e->phy_packet,
sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0);
- client_put(e->client);
+ client_put(e_client);
}
static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *arg)
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 13/70] firewire: remove check of list iterator against head past the loop body
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 12/70] firewire: fix potential uaf in outbound_phy_packet_callback() Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 14/70] firewire: core: extend card->lock in fw_core_handle_bus_reset Greg Kroah-Hartman
` (65 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jakob Koschel, Takashi Sakamoto,
Takashi Iwai
From: Jakob Koschel <jakobkoschel@gmail.com>
commit 9423973869bd4632ffe669f950510c49296656e0 upstream.
When list_for_each_entry() completes the iteration over the whole list
without breaking the loop, the iterator value will be a bogus pointer
computed based on the head element.
While it is safe to use the pointer to determine if it was computed
based on the head element, either with list_entry_is_head() or
&pos->member == head, using the iterator variable after the loop should
be avoided.
In preparation to limit the scope of a list iterator to the list
traversal loop, use a dedicated pointer to point to the found element [1].
Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1]
Cc: <stable@vger.kernel.org>
Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20220409041243.603210-3-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firewire/core-transaction.c | 30 ++++++++++++++++--------------
drivers/firewire/sbp2.c | 13 +++++++------
2 files changed, 23 insertions(+), 20 deletions(-)
--- a/drivers/firewire/core-transaction.c
+++ b/drivers/firewire/core-transaction.c
@@ -73,24 +73,25 @@ static int try_cancel_split_timeout(stru
static int close_transaction(struct fw_transaction *transaction,
struct fw_card *card, int rcode)
{
- struct fw_transaction *t;
+ struct fw_transaction *t = NULL, *iter;
unsigned long flags;
spin_lock_irqsave(&card->lock, flags);
- list_for_each_entry(t, &card->transaction_list, link) {
- if (t == transaction) {
- if (!try_cancel_split_timeout(t)) {
+ list_for_each_entry(iter, &card->transaction_list, link) {
+ if (iter == transaction) {
+ if (!try_cancel_split_timeout(iter)) {
spin_unlock_irqrestore(&card->lock, flags);
goto timed_out;
}
- list_del_init(&t->link);
- card->tlabel_mask &= ~(1ULL << t->tlabel);
+ list_del_init(&iter->link);
+ card->tlabel_mask &= ~(1ULL << iter->tlabel);
+ t = iter;
break;
}
}
spin_unlock_irqrestore(&card->lock, flags);
- if (&t->link != &card->transaction_list) {
+ if (t) {
t->callback(card, rcode, NULL, 0, t->callback_data);
return 0;
}
@@ -935,7 +936,7 @@ EXPORT_SYMBOL(fw_core_handle_request);
void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
{
- struct fw_transaction *t;
+ struct fw_transaction *t = NULL, *iter;
unsigned long flags;
u32 *data;
size_t data_length;
@@ -947,20 +948,21 @@ void fw_core_handle_response(struct fw_c
rcode = HEADER_GET_RCODE(p->header[1]);
spin_lock_irqsave(&card->lock, flags);
- list_for_each_entry(t, &card->transaction_list, link) {
- if (t->node_id == source && t->tlabel == tlabel) {
- if (!try_cancel_split_timeout(t)) {
+ list_for_each_entry(iter, &card->transaction_list, link) {
+ if (iter->node_id == source && iter->tlabel == tlabel) {
+ if (!try_cancel_split_timeout(iter)) {
spin_unlock_irqrestore(&card->lock, flags);
goto timed_out;
}
- list_del_init(&t->link);
- card->tlabel_mask &= ~(1ULL << t->tlabel);
+ list_del_init(&iter->link);
+ card->tlabel_mask &= ~(1ULL << iter->tlabel);
+ t = iter;
break;
}
}
spin_unlock_irqrestore(&card->lock, flags);
- if (&t->link == &card->transaction_list) {
+ if (!t) {
timed_out:
fw_notice(card, "unsolicited response (source %x, tlabel %x)\n",
source, tlabel);
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -408,7 +408,7 @@ static void sbp2_status_write(struct fw_
void *payload, size_t length, void *callback_data)
{
struct sbp2_logical_unit *lu = callback_data;
- struct sbp2_orb *orb;
+ struct sbp2_orb *orb = NULL, *iter;
struct sbp2_status status;
unsigned long flags;
@@ -433,17 +433,18 @@ static void sbp2_status_write(struct fw_
/* Lookup the orb corresponding to this status write. */
spin_lock_irqsave(&lu->tgt->lock, flags);
- list_for_each_entry(orb, &lu->orb_list, link) {
+ list_for_each_entry(iter, &lu->orb_list, link) {
if (STATUS_GET_ORB_HIGH(status) == 0 &&
- STATUS_GET_ORB_LOW(status) == orb->request_bus) {
- orb->rcode = RCODE_COMPLETE;
- list_del(&orb->link);
+ STATUS_GET_ORB_LOW(status) == iter->request_bus) {
+ iter->rcode = RCODE_COMPLETE;
+ list_del(&iter->link);
+ orb = iter;
break;
}
}
spin_unlock_irqrestore(&lu->tgt->lock, flags);
- if (&orb->link != &lu->orb_list) {
+ if (orb) {
orb->callback(orb, &status);
kref_put(&orb->kref, free_orb); /* orb callback reference */
} else {
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 14/70] firewire: core: extend card->lock in fw_core_handle_bus_reset
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 13/70] firewire: remove check of list iterator against head past the loop body Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 15/70] net: stmmac: disable Split Header (SPH) for Intel platforms Greg Kroah-Hartman
` (64 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Niels Dossche, Takashi Sakamoto,
Takashi Iwai
From: Niels Dossche <dossche.niels@gmail.com>
commit a7ecbe92b9243edbe94772f6f2c854e4142a3345 upstream.
card->local_node and card->bm_retries are both always accessed under
card->lock.
fw_core_handle_bus_reset has a check whose condition depends on
card->local_node and whose body writes to card->bm_retries.
Both of these accesses are not under card->lock. Move the lock acquiring
of card->lock to before this check such that these accesses do happen
when card->lock is held.
fw_destroy_nodes is called inside the check.
Since fw_destroy_nodes already acquires card->lock inside its function
body, move this out to the callsites of fw_destroy_nodes.
Also add a comment to indicate which locking is necessary when calling
fw_destroy_nodes.
Cc: <stable@vger.kernel.org>
Signed-off-by: Niels Dossche <dossche.niels@gmail.com>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20220409041243.603210-4-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firewire/core-card.c | 3 +++
drivers/firewire/core-topology.c | 9 +++------
2 files changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/firewire/core-card.c
+++ b/drivers/firewire/core-card.c
@@ -668,6 +668,7 @@ EXPORT_SYMBOL_GPL(fw_card_release);
void fw_core_remove_card(struct fw_card *card)
{
struct fw_card_driver dummy_driver = dummy_driver_template;
+ unsigned long flags;
card->driver->update_phy_reg(card, 4,
PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
@@ -682,7 +683,9 @@ void fw_core_remove_card(struct fw_card
dummy_driver.stop_iso = card->driver->stop_iso;
card->driver = &dummy_driver;
+ spin_lock_irqsave(&card->lock, flags);
fw_destroy_nodes(card);
+ spin_unlock_irqrestore(&card->lock, flags);
/* Wait for all users, especially device workqueue jobs, to finish. */
fw_card_put(card);
--- a/drivers/firewire/core-topology.c
+++ b/drivers/firewire/core-topology.c
@@ -374,16 +374,13 @@ static void report_found_node(struct fw_
card->bm_retries = 0;
}
+/* Must be called with card->lock held */
void fw_destroy_nodes(struct fw_card *card)
{
- unsigned long flags;
-
- spin_lock_irqsave(&card->lock, flags);
card->color++;
if (card->local_node != NULL)
for_each_fw_node(card, card->local_node, report_lost_node);
card->local_node = NULL;
- spin_unlock_irqrestore(&card->lock, flags);
}
static void move_tree(struct fw_node *node0, struct fw_node *node1, int port)
@@ -509,6 +506,8 @@ void fw_core_handle_bus_reset(struct fw_
struct fw_node *local_node;
unsigned long flags;
+ spin_lock_irqsave(&card->lock, flags);
+
/*
* If the selfID buffer is not the immediate successor of the
* previously processed one, we cannot reliably compare the
@@ -520,8 +519,6 @@ void fw_core_handle_bus_reset(struct fw_
card->bm_retries = 0;
}
- spin_lock_irqsave(&card->lock, flags);
-
card->broadcast_channel_allocated = card->broadcast_channel_auto_allocated;
card->node_id = node_id;
/*
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 15/70] net: stmmac: disable Split Header (SPH) for Intel platforms
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 14/70] firewire: core: extend card->lock in fw_core_handle_bus_reset Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 16/70] genirq: Synchronize interrupt thread startup Greg Kroah-Hartman
` (63 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ong, Boon Leong,
Mohammad Athari Bin Ismail, Wong Vee Khee, Tan Tee Min,
David S. Miller, Ong
From: Tan Tee Min <tee.min.tan@linux.intel.com>
commit 47f753c1108e287edb3e27fad8a7511a9d55578e upstream.
Based on DesignWare Ethernet QoS datasheet, we are seeing the limitation
of Split Header (SPH) feature is not supported for Ipv4 fragmented packet.
This SPH limitation will cause ping failure when the packets size exceed
the MTU size. For example, the issue happens once the basic ping packet
size is larger than the configured MTU size and the data is lost inside
the fragmented packet, replaced by zeros/corrupted values, and leads to
ping fail.
So, disable the Split Header for Intel platforms.
v2: Add fixes tag in commit message.
Fixes: 67afd6d1cfdf("net: stmmac: Add Split Header support and enable it in XGMAC cores")
Cc: <stable@vger.kernel.org> # 5.10.x
Suggested-by: Ong, Boon Leong <boon.leong.ong@intel.com>
Signed-off-by: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
Signed-off-by: Wong Vee Khee <vee.khee.wong@linux.intel.com>
Signed-off-by: Tan Tee Min <tee.min.tan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 +
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
include/linux/stmmac.h | 1 +
3 files changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c
@@ -243,6 +243,7 @@ static int intel_mgbe_common_data(struct
plat->has_gmac4 = 1;
plat->force_sf_dma_mode = 0;
plat->tso_en = 1;
+ plat->sph_disable = 1;
plat->rx_sched_algorithm = MTL_RX_ALGORITHM_SP;
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5046,7 +5046,7 @@ int stmmac_dvr_probe(struct device *devi
dev_info(priv->device, "TSO feature enabled\n");
}
- if (priv->dma_cap.sphen) {
+ if (priv->dma_cap.sphen && !priv->plat->sph_disable) {
ndev->hw_features |= NETIF_F_GRO;
priv->sph = true;
dev_info(priv->device, "SPH feature enabled\n");
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -203,5 +203,6 @@ struct plat_stmmacenet_data {
bool vlan_fail_q_en;
u8 vlan_fail_q;
unsigned int eee_usecs_rate;
+ bool sph_disable;
};
#endif
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 16/70] genirq: Synchronize interrupt thread startup
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 15/70] net: stmmac: disable Split Header (SPH) for Intel platforms Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 17/70] ASoC: da7219: Fix change notifications for tone generator frequency Greg Kroah-Hartman
` (62 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Pfaff, Thomas Gleixner, Marc Zyngier
From: Thomas Pfaff <tpfaff@pcs.com>
commit 8707898e22fd665bc1d7b18b809be4b56ce25bdd upstream.
A kernel hang can be observed when running setserial in a loop on a kernel
with force threaded interrupts. The sequence of events is:
setserial
open("/dev/ttyXXX")
request_irq()
do_stuff()
-> serial interrupt
-> wake(irq_thread)
desc->threads_active++;
close()
free_irq()
kthread_stop(irq_thread)
synchronize_irq() <- hangs because desc->threads_active != 0
The thread is created in request_irq() and woken up, but does not get on a
CPU to reach the actual thread function, which would handle the pending
wake-up. kthread_stop() sets the should stop condition which makes the
thread immediately exit, which in turn leaves the stale threads_active
count around.
This problem was introduced with commit 519cc8652b3a, which addressed a
interrupt sharing issue in the PCIe code.
Before that commit free_irq() invoked synchronize_irq(), which waits for
the hard interrupt handler and also for associated threads to complete.
To address the PCIe issue synchronize_irq() was replaced with
__synchronize_hardirq(), which only waits for the hard interrupt handler to
complete, but not for threaded handlers.
This was done under the assumption, that the interrupt thread already
reached the thread function and waits for a wake-up, which is guaranteed to
be handled before acting on the stop condition. The problematic case, that
the thread would not reach the thread function, was obviously overlooked.
Make sure that the interrupt thread is really started and reaches
thread_fn() before returning from __setup_irq().
This utilizes the existing wait queue in the interrupt descriptor. The
wait queue is unused for non-shared interrupts. For shared interrupts the
usage might cause a spurious wake-up of a waiter in synchronize_irq() or the
completion of a threaded handler might cause a spurious wake-up of the
waiter for the ready flag. Both are harmless and have no functional impact.
[ tglx: Amended changelog ]
Fixes: 519cc8652b3a ("genirq: Synchronize only with single thread on free_irq()")
Signed-off-by: Thomas Pfaff <tpfaff@pcs.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/552fe7b4-9224-b183-bb87-a8f36d335690@pcs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/irq/internals.h | 2 ++
kernel/irq/irqdesc.c | 2 ++
kernel/irq/manage.c | 39 +++++++++++++++++++++++++++++----------
3 files changed, 33 insertions(+), 10 deletions(-)
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -29,12 +29,14 @@ extern struct irqaction chained_action;
* IRQTF_WARNED - warning "IRQ_WAKE_THREAD w/o thread_fn" has been printed
* IRQTF_AFFINITY - irq thread is requested to adjust affinity
* IRQTF_FORCED_THREAD - irq action is force threaded
+ * IRQTF_READY - signals that irq thread is ready
*/
enum {
IRQTF_RUNTHREAD,
IRQTF_WARNED,
IRQTF_AFFINITY,
IRQTF_FORCED_THREAD,
+ IRQTF_READY,
};
/*
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -405,6 +405,7 @@ static struct irq_desc *alloc_desc(int i
lockdep_set_class(&desc->lock, &irq_desc_lock_class);
mutex_init(&desc->request_mutex);
init_rcu_head(&desc->rcu);
+ init_waitqueue_head(&desc->wait_for_threads);
desc_set_defaults(irq, desc, node, affinity, owner);
irqd_set(&desc->irq_data, flags);
@@ -573,6 +574,7 @@ int __init early_irq_init(void)
raw_spin_lock_init(&desc[i].lock);
lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
mutex_init(&desc[i].request_mutex);
+ init_waitqueue_head(&desc[i].wait_for_threads);
desc_set_defaults(i, &desc[i], node, NULL, NULL);
}
return arch_early_irq_init();
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1149,6 +1149,31 @@ static void irq_wake_secondary(struct ir
}
/*
+ * Internal function to notify that a interrupt thread is ready.
+ */
+static void irq_thread_set_ready(struct irq_desc *desc,
+ struct irqaction *action)
+{
+ set_bit(IRQTF_READY, &action->thread_flags);
+ wake_up(&desc->wait_for_threads);
+}
+
+/*
+ * Internal function to wake up a interrupt thread and wait until it is
+ * ready.
+ */
+static void wake_up_and_wait_for_irq_thread_ready(struct irq_desc *desc,
+ struct irqaction *action)
+{
+ if (!action || !action->thread)
+ return;
+
+ wake_up_process(action->thread);
+ wait_event(desc->wait_for_threads,
+ test_bit(IRQTF_READY, &action->thread_flags));
+}
+
+/*
* Interrupt handler thread
*/
static int irq_thread(void *data)
@@ -1159,6 +1184,8 @@ static int irq_thread(void *data)
irqreturn_t (*handler_fn)(struct irq_desc *desc,
struct irqaction *action);
+ irq_thread_set_ready(desc, action);
+
if (force_irqthreads && test_bit(IRQTF_FORCED_THREAD,
&action->thread_flags))
handler_fn = irq_forced_thread_fn;
@@ -1583,8 +1610,6 @@ __setup_irq(unsigned int irq, struct irq
}
if (!shared) {
- init_waitqueue_head(&desc->wait_for_threads);
-
/* Setup the type (level, edge polarity) if configured: */
if (new->flags & IRQF_TRIGGER_MASK) {
ret = __irq_set_trigger(desc,
@@ -1674,14 +1699,8 @@ __setup_irq(unsigned int irq, struct irq
irq_setup_timings(desc, new);
- /*
- * Strictly no need to wake it up, but hung_task complains
- * when no hard interrupt wakes the thread up.
- */
- if (new->thread)
- wake_up_process(new->thread);
- if (new->secondary)
- wake_up_process(new->secondary->thread);
+ wake_up_and_wait_for_irq_thread_ready(desc, new);
+ wake_up_and_wait_for_irq_thread_ready(desc, new->secondary);
register_irq_proc(irq, desc);
new->dir = NULL;
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 17/70] ASoC: da7219: Fix change notifications for tone generator frequency
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 16/70] genirq: Synchronize interrupt thread startup Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 18/70] ASoC: wm8958: Fix change notifications for DSP controls Greg Kroah-Hartman
` (61 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Brown, Adam Thomson
From: Mark Brown <broonie@kernel.org>
commit 08ef48404965cfef99343d6bbbcf75b88c74aa0e upstream.
The tone generator frequency control just returns 0 on successful write,
not a boolean value indicating if there was a change or not. Compare
what was written with the value that was there previously so that
notifications are generated appropriately when the value changes.
Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20220420133437.569229-1-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/da7219.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/sound/soc/codecs/da7219.c
+++ b/sound/soc/codecs/da7219.c
@@ -446,7 +446,7 @@ static int da7219_tonegen_freq_put(struc
struct soc_mixer_control *mixer_ctrl =
(struct soc_mixer_control *) kcontrol->private_value;
unsigned int reg = mixer_ctrl->reg;
- __le16 val;
+ __le16 val_new, val_old;
int ret;
/*
@@ -454,13 +454,19 @@ static int da7219_tonegen_freq_put(struc
* Therefore we need to convert to little endian here to align with
* HW registers.
*/
- val = cpu_to_le16(ucontrol->value.integer.value[0]);
+ val_new = cpu_to_le16(ucontrol->value.integer.value[0]);
mutex_lock(&da7219->ctrl_lock);
- ret = regmap_raw_write(da7219->regmap, reg, &val, sizeof(val));
+ ret = regmap_raw_read(da7219->regmap, reg, &val_old, sizeof(val_old));
+ if (ret == 0 && (val_old != val_new))
+ ret = regmap_raw_write(da7219->regmap, reg,
+ &val_new, sizeof(val_new));
mutex_unlock(&da7219->ctrl_lock);
- return ret;
+ if (ret < 0)
+ return ret;
+
+ return val_old != val_new;
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 18/70] ASoC: wm8958: Fix change notifications for DSP controls
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 17/70] ASoC: da7219: Fix change notifications for tone generator frequency Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 19/70] ASoC: meson: Fix event generation for AUI ACODEC mux Greg Kroah-Hartman
` (60 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Brown, Charles Keepax
From: Mark Brown <broonie@kernel.org>
commit b4f5c6b2e52b27462c0599e64e96e53b58438de1 upstream.
The WM8958 DSP controls all return 0 on successful write, not a boolean
value indicating if the write changed the value of the control. Fix this
by returning 1 after a change, there is already a check at the start of
each put() that skips the function in the case that there is no change.
Signed-off-by: Mark Brown <broonie@kernel.org>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20220416125408.197440-1-broonie@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wm8958-dsp2.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/sound/soc/codecs/wm8958-dsp2.c
+++ b/sound/soc/codecs/wm8958-dsp2.c
@@ -530,7 +530,7 @@ static int wm8958_mbc_put(struct snd_kco
wm8958_dsp_apply(component, mbc, wm8994->mbc_ena[mbc]);
- return 0;
+ return 1;
}
#define WM8958_MBC_SWITCH(xname, xval) {\
@@ -656,7 +656,7 @@ static int wm8958_vss_put(struct snd_kco
wm8958_dsp_apply(component, vss, wm8994->vss_ena[vss]);
- return 0;
+ return 1;
}
@@ -730,7 +730,7 @@ static int wm8958_hpf_put(struct snd_kco
wm8958_dsp_apply(component, hpf % 3, ucontrol->value.integer.value[0]);
- return 0;
+ return 1;
}
#define WM8958_HPF_SWITCH(xname, xval) {\
@@ -824,7 +824,7 @@ static int wm8958_enh_eq_put(struct snd_
wm8958_dsp_apply(component, eq, ucontrol->value.integer.value[0]);
- return 0;
+ return 1;
}
#define WM8958_ENH_EQ_SWITCH(xname, xval) {\
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 19/70] ASoC: meson: Fix event generation for AUI ACODEC mux
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 18/70] ASoC: wm8958: Fix change notifications for DSP controls Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 20/70] ASoC: meson: Fix event generation for G12A tohdmi mux Greg Kroah-Hartman
` (59 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Brown, Jerome Brunet
From: Mark Brown <broonie@kernel.org>
commit 2e3a0d1bfa95b54333f7add3e50e288769373873 upstream.
The AIU ACODEC has a custom put() operation which returns 0 when the value
of the mux changes, meaning that events are not generated for userspace.
Change to return 1 in this case, the function returns early in the case
where there is no change.
Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20220421123803.292063-2-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/meson/aiu-acodec-ctrl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/meson/aiu-acodec-ctrl.c
+++ b/sound/soc/meson/aiu-acodec-ctrl.c
@@ -58,7 +58,7 @@ static int aiu_acodec_ctrl_mux_put_enum(
snd_soc_dapm_mux_update_power(dapm, kcontrol, mux, e, NULL);
- return 0;
+ return 1;
}
static SOC_ENUM_SINGLE_DECL(aiu_acodec_ctrl_mux_enum, AIU_ACODEC_CTRL,
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 20/70] ASoC: meson: Fix event generation for G12A tohdmi mux
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 19/70] ASoC: meson: Fix event generation for AUI ACODEC mux Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 21/70] ASoC: meson: Fix event generation for AUI CODEC mux Greg Kroah-Hartman
` (58 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Brown, Jerome Brunet
From: Mark Brown <broonie@kernel.org>
commit 12131008fc13ff7f7690d170b7a8f72d24fd7d1e upstream.
The G12A tohdmi has a custom put() operation which returns 0 when the value
of the mux changes, meaning that events are not generated for userspace.
Change to return 1 in this case, the function returns early in the case
where there is no change.
Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20220421123803.292063-4-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/meson/g12a-tohdmitx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/meson/g12a-tohdmitx.c
+++ b/sound/soc/meson/g12a-tohdmitx.c
@@ -67,7 +67,7 @@ static int g12a_tohdmitx_i2s_mux_put_enu
snd_soc_dapm_mux_update_power(dapm, kcontrol, mux, e, NULL);
- return 0;
+ return 1;
}
static SOC_ENUM_SINGLE_DECL(g12a_tohdmitx_i2s_mux_enum, TOHDMITX_CTRL0,
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 21/70] ASoC: meson: Fix event generation for AUI CODEC mux
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 20/70] ASoC: meson: Fix event generation for G12A tohdmi mux Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 22/70] s390/dasd: fix data corruption for ESE devices Greg Kroah-Hartman
` (57 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Brown, Jerome Brunet
From: Mark Brown <broonie@kernel.org>
commit fce49921a22262736cdc3cc74fa67915b75e9363 upstream.
The AIU CODEC has a custom put() operation which returns 0 when the value
of the mux changes, meaning that events are not generated for userspace.
Change to return 1 in this case, the function returns early in the case
where there is no change.
Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20220421123803.292063-3-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/meson/aiu-codec-ctrl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/meson/aiu-codec-ctrl.c
+++ b/sound/soc/meson/aiu-codec-ctrl.c
@@ -57,7 +57,7 @@ static int aiu_codec_ctrl_mux_put_enum(s
snd_soc_dapm_mux_update_power(dapm, kcontrol, mux, e, NULL);
- return 0;
+ return 1;
}
static SOC_ENUM_SINGLE_DECL(aiu_hdmi_ctrl_mux_enum, AIU_HDMI_CLK_DATA_CTRL,
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 22/70] s390/dasd: fix data corruption for ESE devices
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 21/70] ASoC: meson: Fix event generation for AUI CODEC mux Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 23/70] s390/dasd: prevent double format of tracks " Greg Kroah-Hartman
` (56 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe
From: Stefan Haberland <sth@linux.ibm.com>
commit 5b53a405e4658580e1faf7c217db3f55a21ba849 upstream.
For ESE devices we get an error when accessing an unformatted track.
The handling of this error will return zero data for read requests and
format the track on demand before writing to it. To do this the code needs
to distinguish between read and write requests. This is done with data from
the blocklayer request. A pointer to the blocklayer request is stored in
the CQR.
If there is an error on the device an ERP request is built to do error
recovery. While the ERP request is mostly a copy of the original CQR the
pointer to the blocklayer request is not copied to not accidentally pass
it back to the blocklayer without cleanup.
This leads to the error that during ESE handling after an ERP request was
built it is not possible to determine the IO direction. This leads to the
formatting of a track for read requests which might in turn lead to data
corruption.
Fixes: 5e2b17e712cf ("s390/dasd: Add dynamic formatting support for ESE volumes")
Cc: stable@vger.kernel.org # 5.3+
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Link: https://lore.kernel.org/r/20220505141733.1989450-2-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/block/dasd.c | 8 +++++++-
drivers/s390/block/dasd_eckd.c | 2 +-
drivers/s390/block/dasd_int.h | 12 ++++++++++++
3 files changed, 20 insertions(+), 2 deletions(-)
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1680,6 +1680,7 @@ void dasd_int_handler(struct ccw_device
unsigned long now;
int nrf_suppressed = 0;
int fp_suppressed = 0;
+ struct request *req;
u8 *sense = NULL;
int expires;
@@ -1780,7 +1781,12 @@ void dasd_int_handler(struct ccw_device
}
if (dasd_ese_needs_format(cqr->block, irb)) {
- if (rq_data_dir((struct request *)cqr->callback_data) == READ) {
+ req = dasd_get_callback_data(cqr);
+ if (!req) {
+ cqr->status = DASD_CQR_ERROR;
+ return;
+ }
+ if (rq_data_dir(req) == READ) {
device->discipline->ese_read(cqr, irb);
cqr->status = DASD_CQR_SUCCESS;
cqr->stopclk = now;
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -3088,7 +3088,7 @@ dasd_eckd_ese_format(struct dasd_device
sector_t curr_trk;
int rc;
- req = cqr->callback_data;
+ req = dasd_get_callback_data(cqr);
block = cqr->block;
base = block->base;
private = base->private;
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -723,6 +723,18 @@ dasd_check_blocksize(int bsize)
return 0;
}
+/*
+ * return the callback data of the original request in case there are
+ * ERP requests build on top of it
+ */
+static inline void *dasd_get_callback_data(struct dasd_ccw_req *cqr)
+{
+ while (cqr->refers)
+ cqr = cqr->refers;
+
+ return cqr->callback_data;
+}
+
/* externals in dasd.c */
#define DASD_PROFILE_OFF 0
#define DASD_PROFILE_ON 1
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 23/70] s390/dasd: prevent double format of tracks for ESE devices
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 22/70] s390/dasd: fix data corruption for ESE devices Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 24/70] s390/dasd: Fix read for ESE with blksize < 4k Greg Kroah-Hartman
` (55 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe
From: Stefan Haberland <sth@linux.ibm.com>
commit 71f3871657370dbbaf942a1c758f64e49a36c70f upstream.
For ESE devices we get an error for write operations on an unformatted
track. Afterwards the track will be formatted and the IO operation
restarted.
When using alias devices a track might be accessed by multiple requests
simultaneously and there is a race window that a track gets formatted
twice resulting in data loss.
Prevent this by remembering the amount of formatted tracks when starting
a request and comparing this number before actually formatting a track
on the fly. If the number has changed there is a chance that the current
track was finally formatted in between. As a result do not format the
track and restart the current IO to check.
The number of formatted tracks does not match the overall number of
formatted tracks on the device and it might wrap around but this is no
problem. It is only needed to recognize that a track has been formatted at
all in between.
Fixes: 5e2b17e712cf ("s390/dasd: Add dynamic formatting support for ESE volumes")
Cc: stable@vger.kernel.org # 5.3+
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Link: https://lore.kernel.org/r/20220505141733.1989450-3-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/block/dasd.c | 7 +++++++
drivers/s390/block/dasd_eckd.c | 19 +++++++++++++++++--
drivers/s390/block/dasd_int.h | 2 ++
3 files changed, 26 insertions(+), 2 deletions(-)
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1462,6 +1462,13 @@ int dasd_start_IO(struct dasd_ccw_req *c
if (!cqr->lpm)
cqr->lpm = dasd_path_get_opm(device);
}
+ /*
+ * remember the amount of formatted tracks to prevent double format on
+ * ESE devices
+ */
+ if (cqr->block)
+ cqr->trkcount = atomic_read(&cqr->block->trkcount);
+
if (cqr->cpmode == 1) {
rc = ccw_device_tm_start(device->cdev, cqr->cpaddr,
(long) cqr, cqr->lpm);
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -3026,13 +3026,24 @@ static int dasd_eckd_format_device(struc
}
static bool test_and_set_format_track(struct dasd_format_entry *to_format,
- struct dasd_block *block)
+ struct dasd_ccw_req *cqr)
{
+ struct dasd_block *block = cqr->block;
struct dasd_format_entry *format;
unsigned long flags;
bool rc = false;
spin_lock_irqsave(&block->format_lock, flags);
+ if (cqr->trkcount != atomic_read(&block->trkcount)) {
+ /*
+ * The number of formatted tracks has changed after request
+ * start and we can not tell if the current track was involved.
+ * To avoid data corruption treat it as if the current track is
+ * involved
+ */
+ rc = true;
+ goto out;
+ }
list_for_each_entry(format, &block->format_list, list) {
if (format->track == to_format->track) {
rc = true;
@@ -3052,6 +3063,7 @@ static void clear_format_track(struct da
unsigned long flags;
spin_lock_irqsave(&block->format_lock, flags);
+ atomic_inc(&block->trkcount);
list_del_init(&format->list);
spin_unlock_irqrestore(&block->format_lock, flags);
}
@@ -3113,8 +3125,11 @@ dasd_eckd_ese_format(struct dasd_device
}
format->track = curr_trk;
/* test if track is already in formatting by another thread */
- if (test_and_set_format_track(format, block))
+ if (test_and_set_format_track(format, cqr)) {
+ /* this is no real error so do not count down retries */
+ cqr->retries++;
return ERR_PTR(-EEXIST);
+ }
fdata.start_unit = curr_trk;
fdata.stop_unit = curr_trk;
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -188,6 +188,7 @@ struct dasd_ccw_req {
void (*callback)(struct dasd_ccw_req *, void *data);
void *callback_data;
unsigned int proc_bytes; /* bytes for partial completion */
+ unsigned int trkcount; /* count formatted tracks */
};
/*
@@ -575,6 +576,7 @@ struct dasd_block {
struct list_head format_list;
spinlock_t format_lock;
+ atomic_t trkcount;
};
struct dasd_attention_data {
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 24/70] s390/dasd: Fix read for ESE with blksize < 4k
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 23/70] s390/dasd: prevent double format of tracks " Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 25/70] s390/dasd: Fix read inconsistency for ESE DASD devices Greg Kroah-Hartman
` (54 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Höppner, Stefan Haberland,
Jens Axboe
From: Jan Höppner <hoeppner@linux.ibm.com>
commit cd68c48ea15c85f1577a442dc4c285e112ff1b37 upstream.
When reading unformatted tracks on ESE devices, the corresponding memory
areas are simply set to zero for each segment. This is done incorrectly
for blocksizes < 4096.
There are two problems. First, the increment of dst is done using the
counter of the loop (off), which is increased by blksize every
iteration. This leads to a much bigger increment for dst as actually
intended. Second, the increment of dst is done before the memory area
is set to 0, skipping a significant amount of bytes of memory.
This leads to illegal overwriting of memory and ultimately to a kernel
panic.
This is not a problem with 4k blocksize because
blk_queue_max_segment_size is set to PAGE_SIZE, always resulting in a
single iteration for the inner segment loop (bv.bv_len == blksize). The
incorrectly used 'off' value to increment dst is 0 and the correct
memory area is used.
In order to fix this for blksize < 4k, increment dst correctly using the
blksize and only do it at the end of the loop.
Fixes: 5e2b17e712cf ("s390/dasd: Add dynamic formatting support for ESE volumes")
Cc: stable@vger.kernel.org # v5.3+
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://lore.kernel.org/r/20220505141733.1989450-4-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/block/dasd_eckd.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -3228,12 +3228,11 @@ static int dasd_eckd_ese_read(struct das
cqr->proc_bytes = blk_count * blksize;
return 0;
}
- if (dst && !skip_block) {
- dst += off;
+ if (dst && !skip_block)
memset(dst, 0, blksize);
- } else {
+ else
skip_block--;
- }
+ dst += blksize;
blk_count++;
}
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 25/70] s390/dasd: Fix read inconsistency for ESE DASD devices
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 24/70] s390/dasd: Fix read for ESE with blksize < 4k Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 26/70] can: grcan: grcan_close(): fix deadlock Greg Kroah-Hartman
` (53 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Höppner, Stefan Haberland,
Jens Axboe
From: Jan Höppner <hoeppner@linux.ibm.com>
commit b9c10f68e23c13f56685559a0d6fdaca9f838324 upstream.
Read requests that return with NRF error are partially completed in
dasd_eckd_ese_read(). The function keeps track of the amount of
processed bytes and the driver will eventually return this information
back to the block layer for further processing via __dasd_cleanup_cqr()
when the request is in the final stage of processing (from the driver's
perspective).
For this, blk_update_request() is used which requires the number of
bytes to complete the request. As per documentation the nr_bytes
parameter is described as follows:
"number of bytes to complete for @req".
This was mistakenly interpreted as "number of bytes _left_ for @req"
leading to new requests with incorrect data length. The consequence are
inconsistent and completely wrong read requests as data from random
memory areas are read back.
Fix this by correctly specifying the amount of bytes that should be used
to complete the request.
Fixes: 5e6bdd37c552 ("s390/dasd: fix data corruption for thin provisioned devices")
Cc: stable@vger.kernel.org # 5.3+
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://lore.kernel.org/r/20220505141733.1989450-5-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/block/dasd.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2812,8 +2812,7 @@ static void __dasd_cleanup_cqr(struct da
* complete a request partially.
*/
if (proc_bytes) {
- blk_update_request(req, BLK_STS_OK,
- blk_rq_bytes(req) - proc_bytes);
+ blk_update_request(req, BLK_STS_OK, proc_bytes);
blk_mq_requeue_request(req, true);
} else if (likely(!blk_should_fake_timeout(req->q))) {
blk_mq_complete_request(req);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 26/70] can: grcan: grcan_close(): fix deadlock
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 25/70] s390/dasd: Fix read inconsistency for ESE DASD devices Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 27/70] can: isotp: remove re-binding of bound socket Greg Kroah-Hartman
` (52 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Duoming Zhou, Andreas Larsson,
Marc Kleine-Budde
From: Duoming Zhou <duoming@zju.edu.cn>
commit 47f070a63e735bcc8d481de31be1b5a1aa62b31c upstream.
There are deadlocks caused by del_timer_sync(&priv->hang_timer) and
del_timer_sync(&priv->rr_timer) in grcan_close(), one of the deadlocks
are shown below:
(Thread 1) | (Thread 2)
| grcan_reset_timer()
grcan_close() | mod_timer()
spin_lock_irqsave() //(1) | (wait a time)
... | grcan_initiate_running_reset()
del_timer_sync() | spin_lock_irqsave() //(2)
(wait timer to stop) | ...
We hold priv->lock in position (1) of thread 1 and use
del_timer_sync() to wait timer to stop, but timer handler also need
priv->lock in position (2) of thread 2. As a result, grcan_close()
will block forever.
This patch extracts del_timer_sync() from the protection of
spin_lock_irqsave(), which could let timer handler to obtain the
needed lock.
Link: https://lore.kernel.org/all/20220425042400.66517-1-duoming@zju.edu.cn
Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN cores")
Cc: stable@vger.kernel.org
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/grcan.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/can/grcan.c
+++ b/drivers/net/can/grcan.c
@@ -1113,8 +1113,10 @@ static int grcan_close(struct net_device
priv->closing = true;
if (priv->need_txbug_workaround) {
+ spin_unlock_irqrestore(&priv->lock, flags);
del_timer_sync(&priv->hang_timer);
del_timer_sync(&priv->rr_timer);
+ spin_lock_irqsave(&priv->lock, flags);
}
netif_stop_queue(dev);
grcan_stop_hardware(dev);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 27/70] can: isotp: remove re-binding of bound socket
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 26/70] can: grcan: grcan_close(): fix deadlock Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 28/70] can: grcan: use ofdev->dev when allocating DMA memory Greg Kroah-Hartman
` (51 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oliver Hartkopp, Marc Kleine-Budde
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 72ed3ee9fa0b461ad086403a8b5336154bd82234 upstream.
As a carry over from the CAN_RAW socket (which allows to change the CAN
interface while mantaining the filter setup) the re-binding of the
CAN_ISOTP socket needs to take care about CAN ID address information and
subscriptions. It turned out that this feature is so limited (e.g. the
sockopts remain fix) that it finally has never been needed/used.
In opposite to the stateless CAN_RAW socket the switching of the CAN ID
subscriptions might additionally lead to an interrupted ongoing PDU
reception. So better remove this unneeded complexity.
Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Link: https://lore.kernel.org/all/20220422082337.1676-1-socketcan@hartkopp.net
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/can/isotp.c | 22 +++++-----------------
1 file changed, 5 insertions(+), 17 deletions(-)
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1144,6 +1144,11 @@ static int isotp_bind(struct socket *soc
lock_sock(sk);
+ if (so->bound) {
+ err = -EINVAL;
+ goto out;
+ }
+
/* do not register frame reception for functional addressing */
if (so->opt.flags & CAN_ISOTP_SF_BROADCAST)
do_rx_reg = 0;
@@ -1154,10 +1159,6 @@ static int isotp_bind(struct socket *soc
goto out;
}
- if (so->bound && addr->can_ifindex == so->ifindex &&
- rx_id == so->rxid && tx_id == so->txid)
- goto out;
-
dev = dev_get_by_index(net, addr->can_ifindex);
if (!dev) {
err = -ENODEV;
@@ -1184,19 +1185,6 @@ static int isotp_bind(struct socket *soc
dev_put(dev);
- if (so->bound && do_rx_reg) {
- /* unregister old filter */
- if (so->ifindex) {
- dev = dev_get_by_index(net, so->ifindex);
- if (dev) {
- can_rx_unregister(net, dev, so->rxid,
- SINGLE_MASK(so->rxid),
- isotp_rcv, sk);
- dev_put(dev);
- }
- }
- }
-
/* switch to new settings */
so->ifindex = ifindex;
so->rxid = rx_id;
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 28/70] can: grcan: use ofdev->dev when allocating DMA memory
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 27/70] can: isotp: remove re-binding of bound socket Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 29/70] can: grcan: grcan_probe(): fix broken system id check for errata workaround needs Greg Kroah-Hartman
` (50 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Hellstrom, Andreas Larsson,
Marc Kleine-Budde
From: Daniel Hellstrom <daniel@gaisler.com>
commit 101da4268626b00d16356a6bf284d66e44c46ff9 upstream.
Use the device of the device tree node should be rather than the
device of the struct net_device when allocating DMA buffers.
The driver got away with it on sparc32 until commit 53b7670e5735
("sparc: factor the dma coherent mapping into helper") after which the
driver oopses.
Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN cores")
Link: https://lore.kernel.org/all/20220429084656.29788-2-andreas@gaisler.com
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Hellstrom <daniel@gaisler.com>
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/grcan.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/net/can/grcan.c
+++ b/drivers/net/can/grcan.c
@@ -248,6 +248,7 @@ struct grcan_device_config {
struct grcan_priv {
struct can_priv can; /* must be the first member */
struct net_device *dev;
+ struct device *ofdev_dev;
struct napi_struct napi;
struct grcan_registers __iomem *regs; /* ioremap'ed registers */
@@ -924,7 +925,7 @@ static void grcan_free_dma_buffers(struc
struct grcan_priv *priv = netdev_priv(dev);
struct grcan_dma *dma = &priv->dma;
- dma_free_coherent(&dev->dev, dma->base_size, dma->base_buf,
+ dma_free_coherent(priv->ofdev_dev, dma->base_size, dma->base_buf,
dma->base_handle);
memset(dma, 0, sizeof(*dma));
}
@@ -949,7 +950,7 @@ static int grcan_allocate_dma_buffers(st
/* Extra GRCAN_BUFFER_ALIGNMENT to allow for alignment */
dma->base_size = lsize + ssize + GRCAN_BUFFER_ALIGNMENT;
- dma->base_buf = dma_alloc_coherent(&dev->dev,
+ dma->base_buf = dma_alloc_coherent(priv->ofdev_dev,
dma->base_size,
&dma->base_handle,
GFP_KERNEL);
@@ -1602,6 +1603,7 @@ static int grcan_setup_netdev(struct pla
memcpy(&priv->config, &grcan_module_config,
sizeof(struct grcan_device_config));
priv->dev = dev;
+ priv->ofdev_dev = &ofdev->dev;
priv->regs = base;
priv->can.bittiming_const = &grcan_bittiming_const;
priv->can.do_set_bittiming = grcan_set_bittiming;
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 29/70] can: grcan: grcan_probe(): fix broken system id check for errata workaround needs
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 28/70] can: grcan: use ofdev->dev when allocating DMA memory Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 30/70] can: grcan: only use the NAPI poll budget for RX Greg Kroah-Hartman
` (49 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Larsson, Marc Kleine-Budde
From: Andreas Larsson <andreas@gaisler.com>
commit 1e93ed26acf03fe6c97c6d573a10178596aadd43 upstream.
The systemid property was checked for in the wrong place of the device
tree and compared to the wrong value.
Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN cores")
Link: https://lore.kernel.org/all/20220429084656.29788-3-andreas@gaisler.com
Cc: stable@vger.kernel.org
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/grcan.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
--- a/drivers/net/can/grcan.c
+++ b/drivers/net/can/grcan.c
@@ -241,7 +241,7 @@ struct grcan_device_config {
.rxsize = GRCAN_DEFAULT_BUFFER_SIZE, \
}
-#define GRCAN_TXBUG_SAFE_GRLIB_VERSION 0x4100
+#define GRCAN_TXBUG_SAFE_GRLIB_VERSION 4100
#define GRLIB_VERSION_MASK 0xffff
/* GRCAN private data structure */
@@ -1656,6 +1656,7 @@ exit_free_candev:
static int grcan_probe(struct platform_device *ofdev)
{
struct device_node *np = ofdev->dev.of_node;
+ struct device_node *sysid_parent;
u32 sysid, ambafreq;
int irq, err;
void __iomem *base;
@@ -1664,10 +1665,15 @@ static int grcan_probe(struct platform_d
/* Compare GRLIB version number with the first that does not
* have the tx bug (see start_xmit)
*/
- err = of_property_read_u32(np, "systemid", &sysid);
- if (!err && ((sysid & GRLIB_VERSION_MASK)
- >= GRCAN_TXBUG_SAFE_GRLIB_VERSION))
- txbug = false;
+ sysid_parent = of_find_node_by_path("/ambapp0");
+ if (sysid_parent) {
+ of_node_get(sysid_parent);
+ err = of_property_read_u32(sysid_parent, "systemid", &sysid);
+ if (!err && ((sysid & GRLIB_VERSION_MASK) >=
+ GRCAN_TXBUG_SAFE_GRLIB_VERSION))
+ txbug = false;
+ of_node_put(sysid_parent);
+ }
err = of_property_read_u32(np, "freq", &ambafreq);
if (err) {
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 30/70] can: grcan: only use the NAPI poll budget for RX
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 29/70] can: grcan: grcan_probe(): fix broken system id check for errata workaround needs Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 31/70] nfc: replace improper check device_is_registered() in netlink related functions Greg Kroah-Hartman
` (48 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Larsson, Marc Kleine-Budde
From: Andreas Larsson <andreas@gaisler.com>
commit 2873d4d52f7c52d60b316ba6c47bd7122b5a9861 upstream.
The previous split budget between TX and RX made it return not using
the entire budget but at the same time not having calling called
napi_complete. This sometimes led to the poll to not be called, and at
the same time having TX and RX interrupts disabled resulting in the
driver getting stuck.
Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN cores")
Link: https://lore.kernel.org/all/20220429084656.29788-4-andreas@gaisler.com
Cc: stable@vger.kernel.org
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/grcan.c | 22 +++++++---------------
1 file changed, 7 insertions(+), 15 deletions(-)
--- a/drivers/net/can/grcan.c
+++ b/drivers/net/can/grcan.c
@@ -1137,7 +1137,7 @@ static int grcan_close(struct net_device
return 0;
}
-static int grcan_transmit_catch_up(struct net_device *dev, int budget)
+static void grcan_transmit_catch_up(struct net_device *dev)
{
struct grcan_priv *priv = netdev_priv(dev);
unsigned long flags;
@@ -1145,7 +1145,7 @@ static int grcan_transmit_catch_up(struc
spin_lock_irqsave(&priv->lock, flags);
- work_done = catch_up_echo_skb(dev, budget, true);
+ work_done = catch_up_echo_skb(dev, -1, true);
if (work_done) {
if (!priv->resetting && !priv->closing &&
!(priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY))
@@ -1159,8 +1159,6 @@ static int grcan_transmit_catch_up(struc
}
spin_unlock_irqrestore(&priv->lock, flags);
-
- return work_done;
}
static int grcan_receive(struct net_device *dev, int budget)
@@ -1242,19 +1240,13 @@ static int grcan_poll(struct napi_struct
struct net_device *dev = priv->dev;
struct grcan_registers __iomem *regs = priv->regs;
unsigned long flags;
- int tx_work_done, rx_work_done;
- int rx_budget = budget / 2;
- int tx_budget = budget - rx_budget;
+ int work_done;
- /* Half of the budget for receiving messages */
- rx_work_done = grcan_receive(dev, rx_budget);
+ work_done = grcan_receive(dev, budget);
- /* Half of the budget for transmitting messages as that can trigger echo
- * frames being received
- */
- tx_work_done = grcan_transmit_catch_up(dev, tx_budget);
+ grcan_transmit_catch_up(dev);
- if (rx_work_done < rx_budget && tx_work_done < tx_budget) {
+ if (work_done < budget) {
napi_complete(napi);
/* Guarantee no interference with a running reset that otherwise
@@ -1271,7 +1263,7 @@ static int grcan_poll(struct napi_struct
spin_unlock_irqrestore(&priv->lock, flags);
}
- return rx_work_done + tx_work_done;
+ return work_done;
}
/* Work tx bug by waiting while for the risky situation to clear. If that fails,
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 31/70] nfc: replace improper check device_is_registered() in netlink related functions
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 30/70] can: grcan: only use the NAPI poll budget for RX Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 32/70] nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs Greg Kroah-Hartman
` (47 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Duoming Zhou, David S. Miller
From: Duoming Zhou <duoming@zju.edu.cn>
commit da5c0f119203ad9728920456a0f52a6d850c01cd upstream.
The device_is_registered() in nfc core is used to check whether
nfc device is registered in netlink related functions such as
nfc_fw_download(), nfc_dev_up() and so on. Although device_is_registered()
is protected by device_lock, there is still a race condition between
device_del() and device_is_registered(). The root cause is that
kobject_del() in device_del() is not protected by device_lock.
(cleanup task) | (netlink task)
|
nfc_unregister_device | nfc_fw_download
device_del | device_lock
... | if (!device_is_registered)//(1)
kobject_del//(2) | ...
... | device_unlock
The device_is_registered() returns the value of state_in_sysfs and
the state_in_sysfs is set to zero in kobject_del(). If we pass check in
position (1), then set zero in position (2). As a result, the check
in position (1) is useless.
This patch uses bool variable instead of device_is_registered() to judge
whether the nfc device is registered, which is well synchronized.
Fixes: 3e256b8f8dfa ("NFC: add nfc subsystem core")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/core.c | 29 ++++++++++++++---------------
1 file changed, 14 insertions(+), 15 deletions(-)
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -38,7 +38,7 @@ int nfc_fw_download(struct nfc_dev *dev,
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
goto error;
}
@@ -94,7 +94,7 @@ int nfc_dev_up(struct nfc_dev *dev)
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
goto error;
}
@@ -142,7 +142,7 @@ int nfc_dev_down(struct nfc_dev *dev)
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
goto error;
}
@@ -206,7 +206,7 @@ int nfc_start_poll(struct nfc_dev *dev,
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
goto error;
}
@@ -245,7 +245,7 @@ int nfc_stop_poll(struct nfc_dev *dev)
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
goto error;
}
@@ -290,7 +290,7 @@ int nfc_dep_link_up(struct nfc_dev *dev,
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
goto error;
}
@@ -334,7 +334,7 @@ int nfc_dep_link_down(struct nfc_dev *de
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
goto error;
}
@@ -400,7 +400,7 @@ int nfc_activate_target(struct nfc_dev *
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
goto error;
}
@@ -446,7 +446,7 @@ int nfc_deactivate_target(struct nfc_dev
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
goto error;
}
@@ -493,7 +493,7 @@ int nfc_data_exchange(struct nfc_dev *de
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
kfree_skb(skb);
goto error;
@@ -550,7 +550,7 @@ int nfc_enable_se(struct nfc_dev *dev, u
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
goto error;
}
@@ -599,7 +599,7 @@ int nfc_disable_se(struct nfc_dev *dev,
device_lock(&dev->dev);
- if (!device_is_registered(&dev->dev)) {
+ if (dev->shutting_down) {
rc = -ENODEV;
goto error;
}
@@ -1126,6 +1126,7 @@ int nfc_register_device(struct nfc_dev *
dev->rfkill = NULL;
}
}
+ dev->shutting_down = false;
device_unlock(&dev->dev);
rc = nfc_genl_device_added(dev);
@@ -1158,12 +1159,10 @@ void nfc_unregister_device(struct nfc_de
rfkill_unregister(dev->rfkill);
rfkill_destroy(dev->rfkill);
}
+ dev->shutting_down = true;
device_unlock(&dev->dev);
if (dev->ops->check_presence) {
- device_lock(&dev->dev);
- dev->shutting_down = true;
- device_unlock(&dev->dev);
del_timer_sync(&dev->check_pres_timer);
cancel_work_sync(&dev->check_pres_work);
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 32/70] nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 31/70] nfc: replace improper check device_is_registered() in netlink related functions Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 33/70] NFC: netlink: fix sleep in atomic bug when firmware download timeout Greg Kroah-Hartman
` (46 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Duoming Zhou, David S. Miller
From: Duoming Zhou <duoming@zju.edu.cn>
commit d270453a0d9ec10bb8a802a142fb1b3601a83098 upstream.
There are destructive operations such as nfcmrvl_fw_dnld_abort and
gpio_free in nfcmrvl_nci_unregister_dev. The resources such as firmware,
gpio and so on could be destructed while the upper layer functions such as
nfcmrvl_fw_dnld_start and nfcmrvl_nci_recv_frame is executing, which leads
to double-free, use-after-free and null-ptr-deref bugs.
There are three situations that could lead to double-free bugs.
The first situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_fw_dnld_start |
... | nfcmrvl_nci_unregister_dev
release_firmware() | nfcmrvl_fw_dnld_abort
kfree(fw) //(1) | fw_dnld_over
| release_firmware
... | kfree(fw) //(2)
| ...
The second situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_fw_dnld_start |
... |
mod_timer |
(wait a time) |
fw_dnld_timeout | nfcmrvl_nci_unregister_dev
fw_dnld_over | nfcmrvl_fw_dnld_abort
release_firmware | fw_dnld_over
kfree(fw) //(1) | release_firmware
... | kfree(fw) //(2)
The third situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_nci_recv_frame |
if(..->fw_download_in_progress)|
nfcmrvl_fw_dnld_recv_frame |
queue_work |
|
fw_dnld_rx_work | nfcmrvl_nci_unregister_dev
fw_dnld_over | nfcmrvl_fw_dnld_abort
release_firmware | fw_dnld_over
kfree(fw) //(1) | release_firmware
| kfree(fw) //(2)
The firmware struct is deallocated in position (1) and deallocated
in position (2) again.
The crash trace triggered by POC is like below:
BUG: KASAN: double-free or invalid-free in fw_dnld_over
Call Trace:
kfree
fw_dnld_over
nfcmrvl_nci_unregister_dev
nci_uart_tty_close
tty_ldisc_kill
tty_ldisc_hangup
__tty_hangup.part.0
tty_release
...
What's more, there are also use-after-free and null-ptr-deref bugs
in nfcmrvl_fw_dnld_start. If we deallocate firmware struct, gpio or
set null to the members of priv->fw_dnld in nfcmrvl_nci_unregister_dev,
then, we dereference firmware, gpio or the members of priv->fw_dnld in
nfcmrvl_fw_dnld_start, the UAF or NPD bugs will happen.
This patch reorders destructive operations after nci_unregister_device
in order to synchronize between cleanup routine and firmware download
routine.
The nci_unregister_device is well synchronized. If the device is
detaching, the firmware download routine will goto error. If firmware
download routine is executing, nci_unregister_device will wait until
firmware download routine is finished.
Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nfc/nfcmrvl/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nfc/nfcmrvl/main.c
+++ b/drivers/nfc/nfcmrvl/main.c
@@ -194,6 +194,7 @@ void nfcmrvl_nci_unregister_dev(struct n
{
struct nci_dev *ndev = priv->ndev;
+ nci_unregister_device(ndev);
if (priv->ndev->nfc_dev->fw_download_in_progress)
nfcmrvl_fw_dnld_abort(priv);
@@ -202,7 +203,6 @@ void nfcmrvl_nci_unregister_dev(struct n
if (gpio_is_valid(priv->config.reset_n_io))
gpio_free(priv->config.reset_n_io);
- nci_unregister_device(ndev);
nci_free_device(ndev);
kfree(priv);
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 33/70] NFC: netlink: fix sleep in atomic bug when firmware download timeout
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 32/70] nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 34/70] gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set) Greg Kroah-Hartman
` (45 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Duoming Zhou, Krzysztof Kozlowski,
Paolo Abeni
From: Duoming Zhou <duoming@zju.edu.cn>
commit 4071bf121d59944d5cd2238de0642f3d7995a997 upstream.
There are sleep in atomic bug that could cause kernel panic during
firmware download process. The root cause is that nlmsg_new with
GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer
handler. The call trace is shown below:
BUG: sleeping function called from invalid context at include/linux/sched/mm.h:265
Call Trace:
kmem_cache_alloc_node
__alloc_skb
nfc_genl_fw_download_done
call_timer_fn
__run_timers.part.0
run_timer_softirq
__do_softirq
...
The nlmsg_new with GFP_KERNEL parameter may sleep during memory
allocation process, and the timer handler is run as the result of
a "software interrupt" that should not call any other function
that could sleep.
This patch changes allocation mode of netlink message from GFP_KERNEL
to GFP_ATOMIC in order to prevent sleep in atomic bug. The GFP_ATOMIC
flag makes memory allocation operation could be used in atomic context.
Fixes: 9674da8759df ("NFC: Add firmware upload netlink command")
Fixes: 9ea7187c53f6 ("NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20220504055847.38026-1-duoming@zju.edu.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/netlink.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1244,7 +1244,7 @@ int nfc_genl_fw_download_done(struct nfc
struct sk_buff *msg;
void *hdr;
- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+ msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
if (!msg)
return -ENOMEM;
@@ -1260,7 +1260,7 @@ int nfc_genl_fw_download_done(struct nfc
genlmsg_end(msg, hdr);
- genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
+ genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC);
return 0;
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 34/70] gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set)
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 33/70] NFC: netlink: fix sleep in atomic bug when firmware download timeout Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 35/70] hwmon: (adt7470) Fix warning on module removal Greg Kroah-Hartman
` (44 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Puyou Lu, Bartosz Golaszewski
From: Puyou Lu <puyou.lu@gmail.com>
commit dba785798526a3282cc4d0f0ea751883715dbbb4 upstream.
When one port's input state get inverted (eg. from low to hight) after
pca953x_irq_setup but before setting irq_mask (by some other driver such as
"gpio-keys"), the next inversion of this port (eg. from hight to low) will not
be triggered any more (because irq_stat is not updated at the first time). Issue
should be fixed after this commit.
Fixes: 89ea8bbe9c3e ("gpio: pca953x.c: add interrupt handling capability")
Signed-off-by: Puyou Lu <puyou.lu@gmail.com>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-pca953x.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -761,11 +761,11 @@ static bool pca953x_irq_pending(struct p
bitmap_xor(cur_stat, new_stat, old_stat, gc->ngpio);
bitmap_and(trigger, cur_stat, chip->irq_mask, gc->ngpio);
+ bitmap_copy(chip->irq_stat, new_stat, gc->ngpio);
+
if (bitmap_empty(trigger, gc->ngpio))
return false;
- bitmap_copy(chip->irq_stat, new_stat, gc->ngpio);
-
bitmap_and(cur_stat, chip->irq_trig_fall, old_stat, gc->ngpio);
bitmap_and(old_stat, chip->irq_trig_raise, new_stat, gc->ngpio);
bitmap_or(new_stat, old_stat, cur_stat, gc->ngpio);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 35/70] hwmon: (adt7470) Fix warning on module removal
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 34/70] gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set) Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 36/70] ASoC: dmaengine: Restore NULL prepare_slave_config() callback Greg Kroah-Hartman
` (43 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zheyu Ma, Armin Wolf, Guenter Roeck
From: Armin Wolf <W_Armin@gmx.de>
commit 7b2666ce445c700b8dcee994da44ddcf050a0842 upstream.
When removing the adt7470 module, a warning might be printed:
do not call blocking ops when !TASK_RUNNING; state=1
set at [<ffffffffa006052b>] adt7470_update_thread+0x7b/0x130 [adt7470]
This happens because adt7470_update_thread() can leave the kthread in
TASK_INTERRUPTIBLE state when the kthread is being stopped before
the call of set_current_state(). Since kthread_exit() might sleep in
exit_signals(), the warning is printed.
Fix that by using schedule_timeout_interruptible() and removing
the call of set_current_state().
This causes TASK_INTERRUPTIBLE to be set after kthread_should_stop()
which might cause the kthread to exit.
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Fixes: 93cacfd41f82 (hwmon: (adt7470) Allow faster removal)
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Tested-by: Zheyu Ma <zheyuma97@gmail.com>
Link: https://lore.kernel.org/r/20220407101312.13331-1-W_Armin@gmx.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/adt7470.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -20,6 +20,7 @@
#include <linux/kthread.h>
#include <linux/slab.h>
#include <linux/util_macros.h>
+#include <linux/sched.h>
/* Addresses to scan */
static const unsigned short normal_i2c[] = { 0x2C, 0x2E, 0x2F, I2C_CLIENT_END };
@@ -260,11 +261,10 @@ static int adt7470_update_thread(void *p
adt7470_read_temperatures(client, data);
mutex_unlock(&data->lock);
- set_current_state(TASK_INTERRUPTIBLE);
if (kthread_should_stop())
break;
- schedule_timeout(msecs_to_jiffies(data->auto_update_interval));
+ schedule_timeout_interruptible(msecs_to_jiffies(data->auto_update_interval));
}
return 0;
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 36/70] ASoC: dmaengine: Restore NULL prepare_slave_config() callback
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 35/70] hwmon: (adt7470) Fix warning on module removal Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 37/70] net/mlx5e: Fix trust state reset in reload Greg Kroah-Hartman
` (42 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sascha Hauer, Codrin Ciubotariu, Mark Brown
From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
commit 660564fc9a92a893a14f255be434f7ea0b967901 upstream.
As pointed out by Sascha Hauer, this patch changes:
if (pmc->config && !pcm->config->prepare_slave_config)
<do nothing>
to:
if (pmc->config && !pcm->config->prepare_slave_config)
snd_dmaengine_pcm_prepare_slave_config()
This breaks the drivers that do not need a call to
dmaengine_slave_config(). Drivers that still need to call
snd_dmaengine_pcm_prepare_slave_config(), but have a NULL
pcm->config->prepare_slave_config should use
snd_dmaengine_pcm_prepare_slave_config() as their prepare_slave_config
callback.
Fixes: 9a1e13440a4f ("ASoC: dmaengine: do not use a NULL prepare_slave_config() callback")
Reported-by: Sascha Hauer <sha@pengutronix.de>
Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Link: https://lore.kernel.org/r/20220421125403.2180824-1-codrin.ciubotariu@microchip.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/soc-generic-dmaengine-pcm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/sound/soc/soc-generic-dmaengine-pcm.c
+++ b/sound/soc/soc-generic-dmaengine-pcm.c
@@ -83,10 +83,10 @@ static int dmaengine_pcm_hw_params(struc
memset(&slave_config, 0, sizeof(slave_config));
- if (pcm->config && pcm->config->prepare_slave_config)
- prepare_slave_config = pcm->config->prepare_slave_config;
- else
+ if (!pcm->config)
prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config;
+ else
+ prepare_slave_config = pcm->config->prepare_slave_config;
if (prepare_slave_config) {
ret = prepare_slave_config(substream, params, &slave_config);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 37/70] net/mlx5e: Fix trust state reset in reload
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 36/70] ASoC: dmaengine: Restore NULL prepare_slave_config() callback Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 38/70] net/mlx5e: Dont match double-vlan packets if cvlan is not set Greg Kroah-Hartman
` (41 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Moshe Tal, Saeed Mahameed
From: Moshe Tal <moshet@nvidia.com>
commit b781bff882d16175277ca129c382886cb4c74a2c upstream.
Setting dscp2prio during the driver reload can cause dcb ieee app list to
be not empty after the reload finish and as a result to a conflict between
the priority trust state reported by the app and the state in the device
register.
Reset the dcb ieee app list on initialization in case this is
conflicting with the register status.
Fixes: 2a5e7a1344f4 ("net/mlx5e: Add dcbnl dscp to priority support")
Signed-off-by: Moshe Tal <moshet@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -1210,6 +1210,16 @@ static int mlx5e_trust_initialize(struct
if (err)
return err;
+ if (priv->dcbx_dp.trust_state == MLX5_QPTS_TRUST_PCP && priv->dcbx.dscp_app_cnt) {
+ /*
+ * Align the driver state with the register state.
+ * Temporary state change is required to enable the app list reset.
+ */
+ priv->dcbx_dp.trust_state = MLX5_QPTS_TRUST_DSCP;
+ mlx5e_dcbnl_delete_app(priv);
+ priv->dcbx_dp.trust_state = MLX5_QPTS_TRUST_PCP;
+ }
+
mlx5e_params_calc_trust_tx_min_inline_mode(priv->mdev, &priv->channels.params,
priv->dcbx_dp.trust_state);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 38/70] net/mlx5e: Dont match double-vlan packets if cvlan is not set
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 37/70] net/mlx5e: Fix trust state reset in reload Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 39/70] net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release Greg Kroah-Hartman
` (40 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vlad Buslov, Maor Dickman, Saeed Mahameed
From: Vlad Buslov <vladbu@nvidia.com>
commit ada09af92e621ab500dd80a16d1d0299a18a1180 upstream.
Currently, match VLAN rule also matches packets that have multiple VLAN
headers. This behavior is similar to buggy flower classifier behavior that
has recently been fixed. Fix the issue by matching on
outer_second_cvlan_tag with value 0 which will cause the HW to verify the
packet doesn't contain second vlan header.
Fixes: 699e96ddf47f ("net/mlx5e: Support offloading tc double vlan headers match")
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Reviewed-by: Maor Dickman <maord@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -2396,6 +2396,17 @@ static int __parse_cls_flower(struct mlx
match.key->vlan_priority);
*match_level = MLX5_MATCH_L2;
+
+ if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CVLAN) &&
+ match.mask->vlan_eth_type &&
+ MLX5_CAP_FLOWTABLE_TYPE(priv->mdev,
+ ft_field_support.outer_second_vid,
+ fs_type)) {
+ MLX5_SET(fte_match_set_misc, misc_c,
+ outer_second_cvlan_tag, 1);
+ spec->match_criteria_enable |=
+ MLX5_MATCH_MISC_PARAMETERS;
+ }
}
} else if (*match_level != MLX5_MATCH_NONE) {
/* cvlan_tag enabled in match criteria and
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 39/70] net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 38/70] net/mlx5e: Dont match double-vlan packets if cvlan is not set Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:07 ` [PATCH 5.10 40/70] net/mlx5e: Fix the calling of update_buffer_lossy() API Greg Kroah-Hartman
` (39 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oz Shlomo, Paul Blakey, Saeed Mahameed
From: Paul Blakey <paulb@nvidia.com>
commit b069e14fff46c8da9fcc79957f8acaa3e2dfdb6b upstream.
__mlx5_tc_ct_entry_put() queues release of tuple related to some ct FT,
if that is the last reference to that tuple, the actual deletion of
the tuple can happen after the FT is already destroyed and freed.
Flush the used workqueue before destroying the ct FT.
Fixes: a2173131526d ("net/mlx5e: CT: manage the lifetime of the ct entry object")
Reviewed-by: Oz Shlomo <ozsh@nvidia.com>
Signed-off-by: Paul Blakey <paulb@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
@@ -1629,6 +1629,8 @@ mlx5_tc_ct_flush_ft_entry(void *ptr, voi
static void
mlx5_tc_ct_del_ft_cb(struct mlx5_tc_ct_priv *ct_priv, struct mlx5_ct_ft *ft)
{
+ struct mlx5e_priv *priv;
+
if (!refcount_dec_and_test(&ft->refcount))
return;
@@ -1638,6 +1640,8 @@ mlx5_tc_ct_del_ft_cb(struct mlx5_tc_ct_p
rhashtable_free_and_destroy(&ft->ct_entries_ht,
mlx5_tc_ct_flush_ft_entry,
ct_priv);
+ priv = netdev_priv(ct_priv->netdev);
+ flush_workqueue(priv->wq);
mlx5_tc_ct_free_pre_ct_tables(ft);
mapping_remove(ct_priv->zone_mapping, ft->zone_restore_id);
kfree(ft);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 40/70] net/mlx5e: Fix the calling of update_buffer_lossy() API
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 39/70] net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release Greg Kroah-Hartman
@ 2022-05-10 13:07 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 41/70] net/mlx5: Avoid double clear or set of sync reset requested Greg Kroah-Hartman
` (38 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Zhang, Maor Gottlieb, Saeed Mahameed
From: Mark Zhang <markzhang@nvidia.com>
commit c4d963a588a6e7c4ef31160e80697ae8e5a47746 upstream.
The arguments of update_buffer_lossy() is in a wrong order. Fix it.
Fixes: 88b3d5c90e96 ("net/mlx5e: Fix port buffers cell size value")
Signed-off-by: Mark Zhang <markzhang@nvidia.com>
Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -309,8 +309,8 @@ int mlx5e_port_manual_buffer_config(stru
if (err)
return err;
- err = update_buffer_lossy(max_mtu, curr_pfc_en, prio2buffer, port_buff_cell_sz,
- xoff, &port_buffer, &update_buffer);
+ err = update_buffer_lossy(max_mtu, curr_pfc_en, prio2buffer, xoff,
+ port_buff_cell_sz, &port_buffer, &update_buffer);
if (err)
return err;
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 41/70] net/mlx5: Avoid double clear or set of sync reset requested
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2022-05-10 13:07 ` [PATCH 5.10 40/70] net/mlx5e: Fix the calling of update_buffer_lossy() API Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 42/70] selftests/seccomp: Dont call read() on TTY from background pgrp Greg Kroah-Hartman
` (37 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Moshe Shemesh, Maher Sanalla,
Shay Drory, Saeed Mahameed
From: Moshe Shemesh <moshe@nvidia.com>
commit fc3d3db07b35885f238e1fa06b9f04a8fa7a62d0 upstream.
Double clear of reset requested state can lead to NULL pointer as it
will try to delete the timer twice. This can happen for example on a
race between abort from FW and pci error or reset. Avoid such case using
test_and_clear_bit() to verify only one time reset requested state clear
flow. Similarly use test_and_set_bit() to verify only one time reset
requested state set flow.
Fixes: 7dd6df329d4c ("net/mlx5: Handle sync reset abort event")
Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 28 ++++++++++++++-------
1 file changed, 19 insertions(+), 9 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
@@ -134,14 +134,19 @@ static void mlx5_stop_sync_reset_poll(st
del_timer_sync(&fw_reset->timer);
}
-static void mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool poll_health)
+static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool poll_health)
{
struct mlx5_fw_reset *fw_reset = dev->priv.fw_reset;
+ if (!test_and_clear_bit(MLX5_FW_RESET_FLAGS_RESET_REQUESTED, &fw_reset->reset_flags)) {
+ mlx5_core_warn(dev, "Reset request was already cleared\n");
+ return -EALREADY;
+ }
+
mlx5_stop_sync_reset_poll(dev);
- clear_bit(MLX5_FW_RESET_FLAGS_RESET_REQUESTED, &fw_reset->reset_flags);
if (poll_health)
mlx5_start_health_poll(dev);
+ return 0;
}
#define MLX5_RESET_POLL_INTERVAL (HZ / 10)
@@ -185,13 +190,17 @@ static int mlx5_fw_reset_set_reset_sync_
return mlx5_reg_mfrl_set(dev, MLX5_MFRL_REG_RESET_LEVEL3, 0, 2, false);
}
-static void mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev)
+static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev)
{
struct mlx5_fw_reset *fw_reset = dev->priv.fw_reset;
+ if (test_and_set_bit(MLX5_FW_RESET_FLAGS_RESET_REQUESTED, &fw_reset->reset_flags)) {
+ mlx5_core_warn(dev, "Reset request was already set\n");
+ return -EALREADY;
+ }
mlx5_stop_health_poll(dev, true);
- set_bit(MLX5_FW_RESET_FLAGS_RESET_REQUESTED, &fw_reset->reset_flags);
mlx5_start_sync_reset_poll(dev);
+ return 0;
}
static void mlx5_fw_live_patch_event(struct work_struct *work)
@@ -225,7 +234,9 @@ static void mlx5_sync_reset_request_even
err ? "Failed" : "Sent");
return;
}
- mlx5_sync_reset_set_reset_requested(dev);
+ if (mlx5_sync_reset_set_reset_requested(dev))
+ return;
+
err = mlx5_fw_reset_set_reset_sync_ack(dev);
if (err)
mlx5_core_warn(dev, "PCI Sync FW Update Reset Ack Failed. Error code: %d\n", err);
@@ -325,7 +336,8 @@ static void mlx5_sync_reset_now_event(st
struct mlx5_core_dev *dev = fw_reset->dev;
int err;
- mlx5_sync_reset_clear_reset_requested(dev, false);
+ if (mlx5_sync_reset_clear_reset_requested(dev, false))
+ return;
mlx5_core_warn(dev, "Sync Reset now. Device is going to reset.\n");
@@ -354,10 +366,8 @@ static void mlx5_sync_reset_abort_event(
reset_abort_work);
struct mlx5_core_dev *dev = fw_reset->dev;
- if (!test_bit(MLX5_FW_RESET_FLAGS_RESET_REQUESTED, &fw_reset->reset_flags))
+ if (mlx5_sync_reset_clear_reset_requested(dev, true))
return;
-
- mlx5_sync_reset_clear_reset_requested(dev, true);
mlx5_core_warn(dev, "PCI Sync FW Update Reset Aborted.\n");
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 42/70] selftests/seccomp: Dont call read() on TTY from background pgrp
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 41/70] net/mlx5: Avoid double clear or set of sync reset requested Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 43/70] RDMA/siw: Fix a condition race issue in MPA request processing Greg Kroah-Hartman
` (36 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jann Horn, Kees Cook
From: Jann Horn <jannh@google.com>
commit 2bfed7d2ffa5d86c462d3e2067f2832eaf8c04c7 upstream.
Since commit 92d25637a3a4 ("kselftest: signal all child processes"), tests
are executed in background process groups. This means that trying to read
from stdin now throws SIGTTIN when stdin is a TTY, which breaks some
seccomp selftests that try to use read(0, NULL, 0) as a dummy syscall.
The simplest way to fix that is probably to just use -1 instead of 0 as
the dummy read()'s FD.
Fixes: 92d25637a3a4 ("kselftest: signal all child processes")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220319010011.1374622-1-jannh@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/seccomp/seccomp_bpf.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -951,7 +951,7 @@ TEST(ERRNO_valid)
ASSERT_EQ(0, ret);
EXPECT_EQ(parent, syscall(__NR_getppid));
- EXPECT_EQ(-1, read(0, NULL, 0));
+ EXPECT_EQ(-1, read(-1, NULL, 0));
EXPECT_EQ(E2BIG, errno);
}
@@ -970,7 +970,7 @@ TEST(ERRNO_zero)
EXPECT_EQ(parent, syscall(__NR_getppid));
/* "errno" of 0 is ok. */
- EXPECT_EQ(0, read(0, NULL, 0));
+ EXPECT_EQ(0, read(-1, NULL, 0));
}
/*
@@ -991,7 +991,7 @@ TEST(ERRNO_capped)
ASSERT_EQ(0, ret);
EXPECT_EQ(parent, syscall(__NR_getppid));
- EXPECT_EQ(-1, read(0, NULL, 0));
+ EXPECT_EQ(-1, read(-1, NULL, 0));
EXPECT_EQ(4095, errno);
}
@@ -1022,7 +1022,7 @@ TEST(ERRNO_order)
ASSERT_EQ(0, ret);
EXPECT_EQ(parent, syscall(__NR_getppid));
- EXPECT_EQ(-1, read(0, NULL, 0));
+ EXPECT_EQ(-1, read(-1, NULL, 0));
EXPECT_EQ(12, errno);
}
@@ -2575,7 +2575,7 @@ void *tsync_sibling(void *data)
ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
if (!ret)
return (void *)SIBLING_EXIT_NEWPRIVS;
- read(0, NULL, 0);
+ read(-1, NULL, 0);
return (void *)SIBLING_EXIT_UNKILLED;
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 43/70] RDMA/siw: Fix a condition race issue in MPA request processing
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 42/70] selftests/seccomp: Dont call read() on TTY from background pgrp Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 44/70] NFSv4: Dont invalidate inode attributes on delegation return Greg Kroah-Hartman
` (35 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Luis Chamberlain, Bernard Metzler,
Cheng Xu, Jason Gunthorpe
From: Cheng Xu <chengyou@linux.alibaba.com>
commit ef91271c65c12d36e4c2b61c61d4849fb6d11aa0 upstream.
The calling of siw_cm_upcall and detaching new_cep with its listen_cep
should be atomistic semantics. Otherwise siw_reject may be called in a
temporary state, e,g, siw_cm_upcall is called but the new_cep->listen_cep
has not being cleared.
This fixes a WARN:
WARNING: CPU: 7 PID: 201 at drivers/infiniband/sw/siw/siw_cm.c:255 siw_cep_put+0x125/0x130 [siw]
CPU: 2 PID: 201 Comm: kworker/u16:22 Kdump: loaded Tainted: G E 5.17.0-rc7 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: iw_cm_wq cm_work_handler [iw_cm]
RIP: 0010:siw_cep_put+0x125/0x130 [siw]
Call Trace:
<TASK>
siw_reject+0xac/0x180 [siw]
iw_cm_reject+0x68/0xc0 [iw_cm]
cm_work_handler+0x59d/0xe20 [iw_cm]
process_one_work+0x1e2/0x3b0
worker_thread+0x50/0x3a0
? rescuer_thread+0x390/0x390
kthread+0xe5/0x110
? kthread_complete_and_exit+0x20/0x20
ret_from_fork+0x1f/0x30
</TASK>
Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
Link: https://lore.kernel.org/r/d528d83466c44687f3872eadcb8c184528b2e2d4.1650526554.git.chengyou@linux.alibaba.com
Reported-by: Luis Chamberlain <mcgrof@kernel.org>
Reviewed-by: Bernard Metzler <bmt@zurich.ibm.com>
Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/sw/siw/siw_cm.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -968,14 +968,15 @@ static void siw_accept_newconn(struct si
siw_cep_set_inuse(new_cep);
rv = siw_proc_mpareq(new_cep);
- siw_cep_set_free(new_cep);
-
if (rv != -EAGAIN) {
siw_cep_put(cep);
new_cep->listen_cep = NULL;
- if (rv)
+ if (rv) {
+ siw_cep_set_free(new_cep);
goto error;
+ }
}
+ siw_cep_set_free(new_cep);
}
return;
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 44/70] NFSv4: Dont invalidate inode attributes on delegation return
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 43/70] RDMA/siw: Fix a condition race issue in MPA request processing Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 45/70] net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init() Greg Kroah-Hartman
` (34 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust
From: Trond Myklebust <trond.myklebust@hammerspace.com>
commit 00c94ebec5925593c0377b941289224469e72ac7 upstream.
There is no need to declare attributes such as the ctime, mtime and
block size invalid when we're just returning a delegation, so it is
inappropriate to call nfs_post_op_update_inode_force_wcc().
Instead, just call nfs_refresh_inode() after faking up the change
attribute. We know that the GETATTR op occurs before the DELEGRETURN, so
we are safe when doing this.
Fixes: 0bc2c9b4dca9 ("NFSv4: Don't discard the attributes returned by asynchronous DELEGRETURN")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -369,6 +369,14 @@ static void nfs4_setup_readdir(u64 cooki
kunmap_atomic(start);
}
+static void nfs4_fattr_set_prechange(struct nfs_fattr *fattr, u64 version)
+{
+ if (!(fattr->valid & NFS_ATTR_FATTR_PRECHANGE)) {
+ fattr->pre_change_attr = version;
+ fattr->valid |= NFS_ATTR_FATTR_PRECHANGE;
+ }
+}
+
static void nfs4_test_and_free_stateid(struct nfs_server *server,
nfs4_stateid *stateid,
const struct cred *cred)
@@ -6464,7 +6472,9 @@ static void nfs4_delegreturn_release(voi
pnfs_roc_release(&data->lr.arg, &data->lr.res,
data->res.lr_ret);
if (inode) {
- nfs_post_op_update_inode_force_wcc(inode, &data->fattr);
+ nfs4_fattr_set_prechange(&data->fattr,
+ inode_peek_iversion_raw(inode));
+ nfs_refresh_inode(inode, &data->fattr);
nfs_iput_and_deactive(inode);
}
kfree(calldata);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 45/70] net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init()
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 44/70] NFSv4: Dont invalidate inode attributes on delegation return Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 46/70] net: dsa: mt7530: add missing of_node_put() in mt7530_setup() Greg Kroah-Hartman
` (33 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yang Yingliang, Jakub Kicinski
From: Yang Yingliang <yangyingliang@huawei.com>
commit ff5265d45345d01fefc98fcb9ae891b59633c919 upstream.
The node pointer returned by of_parse_phandle() with refcount incremented,
so add of_node_put() after using it in mtk_sgmii_init().
Fixes: 9ffee4a8276c ("net: ethernet: mediatek: Extend SGMII related functions")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20220428062543.64883-1-yangyingliang@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mediatek/mtk_sgmii.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/ethernet/mediatek/mtk_sgmii.c
+++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c
@@ -26,6 +26,7 @@ int mtk_sgmii_init(struct mtk_sgmii *ss,
break;
ss->regmap[i] = syscon_node_to_regmap(np);
+ of_node_put(np);
if (IS_ERR(ss->regmap[i]))
return PTR_ERR(ss->regmap[i]);
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 46/70] net: dsa: mt7530: add missing of_node_put() in mt7530_setup()
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 45/70] net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init() Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 47/70] net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux() Greg Kroah-Hartman
` (32 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang, Jakub Kicinski
From: Yang Yingliang <yangyingliang@huawei.com>
commit a9e9b091a1c14ecd8bd9d3214a62142a1786fe30 upstream.
Add of_node_put() if of_get_phy_mode() fails in mt7530_setup()
Fixes: 0c65b2b90d13 ("net: of_get_phy_mode: Change API to solve int/unit warnings")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20220428095317.538829-1-yangyingliang@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/dsa/mt7530.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -1663,6 +1663,7 @@ mt7530_setup(struct dsa_switch *ds)
ret = of_get_phy_mode(mac_np, &interface);
if (ret && ret != -ENODEV) {
of_node_put(mac_np);
+ of_node_put(phy_node);
return ret;
}
id = of_mdio_parse_addr(ds->dev, phy_node);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 47/70] net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux()
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 46/70] net: dsa: mt7530: add missing of_node_put() in mt7530_setup() Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 48/70] net: cpsw: add missing of_node_put() in cpsw_probe_dt() Greg Kroah-Hartman
` (31 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang, Jakub Kicinski
From: Yang Yingliang <yangyingliang@huawei.com>
commit 1a15267b7be77e0792cf0c7b36ca65c8eb2df0d8 upstream.
The node pointer returned by of_get_child_by_name() with refcount incremented,
so add of_node_put() after using it.
Fixes: 634db83b8265 ("net: stmmac: dwmac-sun8i: Handle integrated/external MDIOs")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20220428095716.540452-1-yangyingliang@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -895,6 +895,7 @@ static int sun8i_dwmac_register_mdio_mux
ret = mdio_mux_init(priv->device, mdio_mux, mdio_mux_syscon_switch_fn,
&gmac->mux_handle, priv, priv->mii);
+ of_node_put(mdio_mux);
return ret;
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 48/70] net: cpsw: add missing of_node_put() in cpsw_probe_dt()
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 47/70] net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux() Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 49/70] net: emaclite: Add error handling for of_address_to_resource() Greg Kroah-Hartman
` (30 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yang Yingliang, David S. Miller
From: Yang Yingliang <yangyingliang@huawei.com>
commit 95098d5ac2551769807031444e55a0da5d4f0952 upstream.
'tmp_node' need be put before returning from cpsw_probe_dt(),
so add missing of_node_put() in error path.
Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/ti/cpsw_new.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/ti/cpsw_new.c
+++ b/drivers/net/ethernet/ti/cpsw_new.c
@@ -1255,8 +1255,10 @@ static int cpsw_probe_dt(struct cpsw_com
data->slave_data = devm_kcalloc(dev, CPSW_SLAVE_PORTS_NUM,
sizeof(struct cpsw_slave_data),
GFP_KERNEL);
- if (!data->slave_data)
+ if (!data->slave_data) {
+ of_node_put(tmp_node);
return -ENOMEM;
+ }
/* Populate all the child nodes here...
*/
@@ -1353,6 +1355,7 @@ static int cpsw_probe_dt(struct cpsw_com
err_node_put:
of_node_put(port_np);
+ of_node_put(tmp_node);
return ret;
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 49/70] net: emaclite: Add error handling for of_address_to_resource()
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 48/70] net: cpsw: add missing of_node_put() in cpsw_probe_dt() Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 50/70] hinic: fix bug of wq out of bound access Greg Kroah-Hartman
` (29 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shravya Kumbham, Radhey Shyam Pandey,
Paolo Abeni
From: Shravya Kumbham <shravya.kumbham@xilinx.com>
commit 7a6bc33ab54923d325d9a1747ec9652c4361ebd1 upstream.
check the return value of of_address_to_resource() and also add
missing of_node_put() for np and npp nodes.
Fixes: e0a3bc65448c ("net: emaclite: Support multiple phys connected to one MDIO bus")
Addresses-Coverity: Event check_return value.
Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com>
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -820,10 +820,10 @@ static int xemaclite_mdio_write(struct m
static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev)
{
struct mii_bus *bus;
- int rc;
struct resource res;
struct device_node *np = of_get_parent(lp->phy_node);
struct device_node *npp;
+ int rc, ret;
/* Don't register the MDIO bus if the phy_node or its parent node
* can't be found.
@@ -833,8 +833,14 @@ static int xemaclite_mdio_setup(struct n
return -ENODEV;
}
npp = of_get_parent(np);
-
- of_address_to_resource(npp, 0, &res);
+ ret = of_address_to_resource(npp, 0, &res);
+ of_node_put(npp);
+ if (ret) {
+ dev_err(dev, "%s resource error!\n",
+ dev->of_node->full_name);
+ of_node_put(np);
+ return ret;
+ }
if (lp->ndev->mem_start != res.start) {
struct phy_device *phydev;
phydev = of_phy_find_device(lp->phy_node);
@@ -843,6 +849,7 @@ static int xemaclite_mdio_setup(struct n
"MDIO of the phy is not registered yet\n");
else
put_device(&phydev->mdio.dev);
+ of_node_put(np);
return 0;
}
@@ -855,6 +862,7 @@ static int xemaclite_mdio_setup(struct n
bus = mdiobus_alloc();
if (!bus) {
dev_err(dev, "Failed to allocate mdiobus\n");
+ of_node_put(np);
return -ENOMEM;
}
@@ -867,6 +875,7 @@ static int xemaclite_mdio_setup(struct n
bus->parent = dev;
rc = of_mdiobus_register(bus, np);
+ of_node_put(np);
if (rc) {
dev_err(dev, "Failed to register mdio bus.\n");
goto err_register;
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 50/70] hinic: fix bug of wq out of bound access
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 49/70] net: emaclite: Add error handling for of_address_to_resource() Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 51/70] selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational Greg Kroah-Hartman
` (28 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qiao Ma, Xunlei Pang, Jakub Kicinski
From: Qiao Ma <mqaio@linux.alibaba.com>
commit 52b2abef450a78e25d485ac61e32f4ce86a87701 upstream.
If wq has only one page, we need to check wqe rolling over page by
compare end_idx and curr_idx, and then copy wqe to shadow wqe to
avoid out of bound access.
This work has been done in hinic_get_wqe, but missed for hinic_read_wqe.
This patch fixes it, and removes unnecessary MASKED_WQE_IDX().
Fixes: 7dd29ee12865 ("hinic: add sriov feature support")
Signed-off-by: Qiao Ma <mqaio@linux.alibaba.com>
Reviewed-by: Xunlei Pang <xlpang@linux.alibaba.com>
Link: https://lore.kernel.org/r/282817b0e1ae2e28fdf3ed8271a04e77f57bf42e.1651148587.git.mqaio@linux.alibaba.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c
@@ -771,7 +771,7 @@ struct hinic_hw_wqe *hinic_get_wqe(struc
/* If we only have one page, still need to get shadown wqe when
* wqe rolling-over page
*/
- if (curr_pg != end_pg || MASKED_WQE_IDX(wq, end_prod_idx) < *prod_idx) {
+ if (curr_pg != end_pg || end_prod_idx < *prod_idx) {
void *shadow_addr = &wq->shadow_wqe[curr_pg * wq->max_wqe_size];
copy_wqe_to_shadow(wq, shadow_addr, num_wqebbs, *prod_idx);
@@ -841,7 +841,10 @@ struct hinic_hw_wqe *hinic_read_wqe(stru
*cons_idx = curr_cons_idx;
- if (curr_pg != end_pg) {
+ /* If we only have one page, still need to get shadown wqe when
+ * wqe rolling-over page
+ */
+ if (curr_pg != end_pg || end_cons_idx < curr_cons_idx) {
void *shadow_addr = &wq->shadow_wqe[curr_pg * wq->max_wqe_size];
copy_wqe_to_shadow(wq, shadow_addr, num_wqebbs, *cons_idx);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 51/70] selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 50/70] hinic: fix bug of wq out of bound access Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 52/70] bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag Greg Kroah-Hartman
` (27 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ido Schimmel, Petr Machata, Paolo Abeni
From: Ido Schimmel <idosch@nvidia.com>
commit 3122257c02afd9f199a8fc84ae981e1fc4958532 upstream.
In emulated environments, the bridge ports enslaved to br1 get a carrier
before changing br1's PVID. This means that by the time the PVID is
changed, br1 is already operational and configured with an IPv6
link-local address.
When the test is run with netdevs registered by mlxsw, changing the PVID
is vetoed, as changing the VID associated with an existing L3 interface
is forbidden. This restriction is similar to the 8021q driver's
restriction of changing the VID of an existing interface.
Fix this by taking br1 down and bringing it back up when it is fully
configured.
With this fix, the test reliably passes on top of both the SW and HW
data paths (emulated or not).
Fixes: 239e754af854 ("selftests: forwarding: Test mirror-to-gretap w/ UL 802.1q")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Link: https://lore.kernel.org/r/20220502084507.364774-1-idosch@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh | 3 +++
1 file changed, 3 insertions(+)
--- a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh
+++ b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh
@@ -61,9 +61,12 @@ setup_prepare()
vrf_prepare
mirror_gre_topo_create
+ # Avoid changing br1's PVID while it is operational as a L3 interface.
+ ip link set dev br1 down
ip link set dev $swp3 master br1
bridge vlan add dev br1 vid 555 pvid untagged self
+ ip link set dev br1 up
ip address add dev br1 192.0.2.129/28
ip address add dev br1 2001:db8:2::1/64
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 52/70] bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 51/70] selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 53/70] bnxt_en: Fix unnecessary dropping of RX packets Greg Kroah-Hartman
` (26 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Somnath Kotur, Michael Chan, Jakub Kicinski
From: Somnath Kotur <somnath.kotur@broadcom.com>
commit 13ba794397e45e52893cfc21d7a69cb5f341b407 upstream.
bnxt_open() can fail in this code path, especially on a VF when
it fails to reserve default rings:
bnxt_open()
__bnxt_open_nic()
bnxt_clear_int_mode()
bnxt_init_dflt_ring_mode()
RX rings would be set to 0 when we hit this error path.
It is possible for a subsequent bnxt_open() call to potentially succeed
with a code path like this:
bnxt_open()
bnxt_hwrm_if_change()
bnxt_fw_init_one()
bnxt_fw_init_one_p3()
bnxt_set_dflt_rfs()
bnxt_rfs_capable()
bnxt_hwrm_reserve_rings()
On older chips, RFS is capable if we can reserve the number of vnics that
is equal to RX rings + 1. But since RX rings is still set to 0 in this
code path, we may mistakenly think that RFS is supported for 0 RX rings.
Later, when the default RX rings are reserved and we try to enable
RFS, it would fail and cause bnxt_open() to fail unnecessarily.
We fix this in 2 places. bnxt_rfs_capable() will always return false if
RX rings is not yet set. bnxt_init_dflt_ring_mode() will call
bnxt_set_dflt_rfs() which will always clear the RFS flags if RFS is not
supported.
Fixes: 20d7d1c5c9b1 ("bnxt_en: reliably allocate IRQ table on reset to avoid crash")
Signed-off-by: Somnath Kotur <somnath.kotur@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -10453,7 +10453,7 @@ static bool bnxt_rfs_capable(struct bnxt
if (bp->flags & BNXT_FLAG_CHIP_P5)
return bnxt_rfs_supported(bp);
- if (!(bp->flags & BNXT_FLAG_MSIX_CAP) || !bnxt_can_reserve_rings(bp))
+ if (!(bp->flags & BNXT_FLAG_MSIX_CAP) || !bnxt_can_reserve_rings(bp) || !bp->rx_nr_rings)
return false;
vnics = 1 + bp->rx_nr_rings;
@@ -12481,10 +12481,9 @@ static int bnxt_init_dflt_ring_mode(stru
goto init_dflt_ring_err;
bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
- if (bnxt_rfs_supported(bp) && bnxt_rfs_capable(bp)) {
- bp->flags |= BNXT_FLAG_RFS;
- bp->dev->features |= NETIF_F_NTUPLE;
- }
+
+ bnxt_set_dflt_rfs(bp);
+
init_dflt_ring_err:
bnxt_ulp_irq_restart(bp, rc);
return rc;
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 53/70] bnxt_en: Fix unnecessary dropping of RX packets
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 52/70] bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 54/70] selftests: ocelot: tc_flower_chains: specify conform-exceed action for policer Greg Kroah-Hartman
` (25 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Gospodarek, Michael Chan,
Jakub Kicinski
From: Michael Chan <michael.chan@broadcom.com>
commit 195af57914d15229186658ed26dab24b9ada4122 upstream.
In bnxt_poll_p5(), we first check cpr->has_more_work. If it is true,
we are in NAPI polling mode and we will call __bnxt_poll_cqs() to
continue polling. It is possible to exhanust the budget again when
__bnxt_poll_cqs() returns.
We then enter the main while loop to check for new entries in the NQ.
If we had previously exhausted the NAPI budget, we may call
__bnxt_poll_work() to process an RX entry with zero budget. This will
cause packets to be dropped unnecessarily, thinking that we are in the
netpoll path. Fix it by breaking out of the while loop if we need
to process an RX NQ entry with no budget left. We will then exit
NAPI and stay in polling mode.
Fixes: 389a877a3b20 ("bnxt_en: Process the NQ under NAPI continuous polling.")
Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -2575,6 +2575,10 @@ static int bnxt_poll_p5(struct napi_stru
u32 idx = le32_to_cpu(nqcmp->cq_handle_low);
struct bnxt_cp_ring_info *cpr2;
+ /* No more budget for RX work */
+ if (budget && work_done >= budget && idx == BNXT_RX_HDL)
+ break;
+
cpr2 = cpr->cp_ring_arr[idx];
work_done += __bnxt_poll_work(bp, cpr2,
budget - work_done);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 54/70] selftests: ocelot: tc_flower_chains: specify conform-exceed action for policer
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 53/70] bnxt_en: Fix unnecessary dropping of RX packets Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 55/70] smsc911x: allow using IRQ0 Greg Kroah-Hartman
` (24 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, Ido Schimmel,
Jakub Kicinski
From: Vladimir Oltean <vladimir.oltean@nxp.com>
commit 5a7c5f70c743c6cf32b44b05bd6b19d4ad82f49d upstream.
As discussed here with Ido Schimmel:
https://patchwork.kernel.org/project/netdevbpf/patch/20220224102908.5255-2-jianbol@nvidia.com/
the default conform-exceed action is "reclassify", for a reason we don't
really understand.
The point is that hardware can't offload that police action, so not
specifying "conform-exceed" was always wrong, even though the command
used to work in hardware (but not in software) until the kernel started
adding validation for it.
Fix the command used by the selftest by making the policer drop on
exceed, and pass the packet to the next action (goto) on conform.
Fixes: 8cd6b020b644 ("selftests: ocelot: add some example VCAP IS1, IS2 and ES0 tc offloads")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://lore.kernel.org/r/20220503121428.842906-1-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh
+++ b/tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh
@@ -185,7 +185,7 @@ setup_prepare()
tc filter add dev $eth0 ingress chain $(IS2 0 0) pref 1 \
protocol ipv4 flower skip_sw ip_proto udp dst_port 5201 \
- action police rate 50mbit burst 64k \
+ action police rate 50mbit burst 64k conform-exceed drop/pipe \
action goto chain $(IS2 1 0)
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 55/70] smsc911x: allow using IRQ0
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 54/70] selftests: ocelot: tc_flower_chains: specify conform-exceed action for policer Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 56/70] btrfs: always log symlinks in full mode Greg Kroah-Hartman
` (23 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sergey Shtylyov, Jakub Kicinski
From: Sergey Shtylyov <s.shtylyov@omp.ru>
commit 5ef9b803a4af0f5e42012176889b40bb2a978b18 upstream.
The AlphaProject AP-SH4A-3A/AP-SH4AD-0A SH boards use IRQ0 for their SMSC
LAN911x Ethernet chip, so the networking on them must have been broken by
commit 965b2aa78fbc ("net/smsc911x: fix irq resource allocation failure")
which filtered out 0 as well as the negative error codes -- it was kinda
correct at the time, as platform_get_irq() could return 0 on of_irq_get()
failure and on the actual 0 in an IRQ resource. This issue was fixed by
me (back in 2016!), so we should be able to fix this driver to allow IRQ0
usage again...
When merging this to the stable kernels, make sure you also merge commit
e330b9a6bb35 ("platform: don't return 0 from platform_get_irq[_byname]()
on error") -- that's my fix to platform_get_irq() for the DT platforms...
Fixes: 965b2aa78fbc ("net/smsc911x: fix irq resource allocation failure")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/656036e4-6387-38df-b8a7-6ba683b16e63@omp.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/smsc/smsc911x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -2422,7 +2422,7 @@ static int smsc911x_drv_probe(struct pla
if (irq == -EPROBE_DEFER) {
retval = -EPROBE_DEFER;
goto out_0;
- } else if (irq <= 0) {
+ } else if (irq < 0) {
pr_warn("Could not allocate irq resource\n");
retval = -ENODEV;
goto out_0;
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 56/70] btrfs: always log symlinks in full mode
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 55/70] smsc911x: allow using IRQ0 Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 57/70] net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() Greg Kroah-Hartman
` (22 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Filipe Manana, David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit d0e64a981fd841cb0f28fcd6afcac55e6f1e6994 upstream.
On Linux, empty symlinks are invalid, and attempting to create one with
the system call symlink(2) results in an -ENOENT error and this is
explicitly documented in the man page.
If we rename a symlink that was created in the current transaction and its
parent directory was logged before, we actually end up logging the symlink
without logging its content, which is stored in an inline extent. That
means that after a power failure we can end up with an empty symlink,
having no content and an i_size of 0 bytes.
It can be easily reproduced like this:
$ mkfs.btrfs -f /dev/sdc
$ mount /dev/sdc /mnt
$ mkdir /mnt/testdir
$ sync
# Create a file inside the directory and fsync the directory.
$ touch /mnt/testdir/foo
$ xfs_io -c "fsync" /mnt/testdir
# Create a symlink inside the directory and then rename the symlink.
$ ln -s /mnt/testdir/foo /mnt/testdir/bar
$ mv /mnt/testdir/bar /mnt/testdir/baz
# Now fsync again the directory, this persist the log tree.
$ xfs_io -c "fsync" /mnt/testdir
<power failure>
$ mount /dev/sdc /mnt
$ stat -c %s /mnt/testdir/baz
0
$ readlink /mnt/testdir/baz
$
Fix this by always logging symlinks in full mode (LOG_INODE_ALL), so that
their content is also logged.
A test case for fstests will follow.
CC: stable@vger.kernel.org # 4.9+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/tree-log.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -5335,6 +5335,18 @@ static int btrfs_log_inode(struct btrfs_
}
/*
+ * For symlinks, we must always log their content, which is stored in an
+ * inline extent, otherwise we could end up with an empty symlink after
+ * log replay, which is invalid on linux (symlink(2) returns -ENOENT if
+ * one attempts to create an empty symlink).
+ * We don't need to worry about flushing delalloc, because when we create
+ * the inline extent when the symlink is created (we never have delalloc
+ * for symlinks).
+ */
+ if (S_ISLNK(inode->vfs_inode.i_mode))
+ inode_only = LOG_INODE_ALL;
+
+ /*
* a brute force approach to making sure we get the most uptodate
* copies of everything.
*/
@@ -5724,7 +5736,7 @@ process_leaf:
}
ctx->log_new_dentries = false;
- if (type == BTRFS_FT_DIR || type == BTRFS_FT_SYMLINK)
+ if (type == BTRFS_FT_DIR)
log_mode = LOG_INODE_ALL;
ret = btrfs_log_inode(trans, root, BTRFS_I(di_inode),
log_mode, ctx);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 57/70] net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 56/70] btrfs: always log symlinks in full mode Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 58/70] kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU Greg Kroah-Hartman
` (21 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzbot, Flavio Leitner,
David S. Miller
From: Eric Dumazet <edumazet@google.com>
commit dba5bdd57bea587ea4f0b79b03c71135f84a7e8b upstream.
syzbot reported an UAF in ip_mc_sf_allow() [1]
Whenever RCU protected list replaces an object,
the pointer to the new object needs to be updated
_before_ the call to kfree_rcu() or call_rcu()
Because kfree_rcu(ptr, rcu) got support for NULL ptr
only recently in commit 12edff045bc6 ("rcu: Make kfree_rcu()
ignore NULL pointers"), I chose to use the conditional
to make sure stable backports won't miss this detail.
if (psl)
kfree_rcu(psl, rcu);
net/ipv6/mcast.c has similar issues, addressed in a separate patch.
[1]
BUG: KASAN: use-after-free in ip_mc_sf_allow+0x6bb/0x6d0 net/ipv4/igmp.c:2655
Read of size 4 at addr ffff88807d37b904 by task syz-executor.5/908
CPU: 0 PID: 908 Comm: syz-executor.5 Not tainted 5.18.0-rc4-syzkaller-00064-g8f4dd16603ce #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
ip_mc_sf_allow+0x6bb/0x6d0 net/ipv4/igmp.c:2655
raw_v4_input net/ipv4/raw.c:190 [inline]
raw_local_deliver+0x4d1/0xbe0 net/ipv4/raw.c:218
ip_protocol_deliver_rcu+0xcf/0xb30 net/ipv4/ip_input.c:193
ip_local_deliver_finish+0x2ee/0x4c0 net/ipv4/ip_input.c:233
NF_HOOK include/linux/netfilter.h:307 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
ip_local_deliver+0x1b3/0x200 net/ipv4/ip_input.c:254
dst_input include/net/dst.h:461 [inline]
ip_rcv_finish+0x1cb/0x2f0 net/ipv4/ip_input.c:437
NF_HOOK include/linux/netfilter.h:307 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
ip_rcv+0xaa/0xd0 net/ipv4/ip_input.c:556
__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405
__netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519
netif_receive_skb_internal net/core/dev.c:5605 [inline]
netif_receive_skb+0x13e/0x8e0 net/core/dev.c:5664
tun_rx_batched.isra.0+0x460/0x720 drivers/net/tun.c:1534
tun_get_user+0x28b7/0x3e30 drivers/net/tun.c:1985
tun_chr_write_iter+0xdb/0x200 drivers/net/tun.c:2015
call_write_iter include/linux/fs.h:2050 [inline]
new_sync_write+0x38a/0x560 fs/read_write.c:504
vfs_write+0x7c0/0xac0 fs/read_write.c:591
ksys_write+0x127/0x250 fs/read_write.c:644
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f3f12c3bbff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48
RSP: 002b:00007f3f13ea9130 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3f12d9bf60 RCX: 00007f3f12c3bbff
RDX: 0000000000000036 RSI: 0000000020002ac0 RDI: 00000000000000c8
RBP: 00007f3f12ce308d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000036 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fffb68dd79f R14: 00007f3f13ea9300 R15: 0000000000022000
</TASK>
Allocated by task 908:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524
kasan_kmalloc include/linux/kasan.h:234 [inline]
__do_kmalloc mm/slab.c:3710 [inline]
__kmalloc+0x209/0x4d0 mm/slab.c:3719
kmalloc include/linux/slab.h:586 [inline]
sock_kmalloc net/core/sock.c:2501 [inline]
sock_kmalloc+0xb5/0x100 net/core/sock.c:2492
ip_mc_source+0xba2/0x1100 net/ipv4/igmp.c:2392
do_ip_setsockopt net/ipv4/ip_sockglue.c:1296 [inline]
ip_setsockopt+0x2312/0x3ab0 net/ipv4/ip_sockglue.c:1432
raw_setsockopt+0x274/0x2c0 net/ipv4/raw.c:861
__sys_setsockopt+0x2db/0x6a0 net/socket.c:2180
__do_sys_setsockopt net/socket.c:2191 [inline]
__se_sys_setsockopt net/socket.c:2188 [inline]
__x64_sys_setsockopt+0xba/0x150 net/socket.c:2188
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Freed by task 753:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free+0x13d/0x180 mm/kasan/common.c:328
kasan_slab_free include/linux/kasan.h:200 [inline]
__cache_free mm/slab.c:3439 [inline]
kmem_cache_free_bulk+0x69/0x460 mm/slab.c:3774
kfree_bulk include/linux/slab.h:437 [inline]
kfree_rcu_work+0x51c/0xa10 kernel/rcu/tree.c:3318
process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348
kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3595
ip_mc_msfilter+0x712/0xb60 net/ipv4/igmp.c:2510
do_ip_setsockopt net/ipv4/ip_sockglue.c:1257 [inline]
ip_setsockopt+0x32e1/0x3ab0 net/ipv4/ip_sockglue.c:1432
raw_setsockopt+0x274/0x2c0 net/ipv4/raw.c:861
__sys_setsockopt+0x2db/0x6a0 net/socket.c:2180
__do_sys_setsockopt net/socket.c:2191 [inline]
__se_sys_setsockopt net/socket.c:2188 [inline]
__x64_sys_setsockopt+0xba/0x150 net/socket.c:2188
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:3074
mpls_dev_notify+0x552/0x8a0 net/mpls/af_mpls.c:1656
notifier_call_chain+0xb5/0x200 kernel/notifier.c:84
call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1938
call_netdevice_notifiers_extack net/core/dev.c:1976 [inline]
call_netdevice_notifiers net/core/dev.c:1990 [inline]
unregister_netdevice_many+0x92e/0x1890 net/core/dev.c:10751
default_device_exit_batch+0x449/0x590 net/core/dev.c:11245
ops_exit_list+0x125/0x170 net/core/net_namespace.c:167
cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594
process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
The buggy address belongs to the object at ffff88807d37b900
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 4 bytes inside of
64-byte region [ffff88807d37b900, ffff88807d37b940)
The buggy address belongs to the physical page:
page:ffffea0001f4dec0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88807d37b180 pfn:0x7d37b
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff888010c41340 ffffea0001c795c8 ffff888010c40200
raw: ffff88807d37b180 ffff88807d37b000 000000010000001f 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x342040(__GFP_IO|__GFP_NOWARN|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 2963, tgid 2963 (udevd), ts 139732238007, free_ts 139730893262
prep_new_page mm/page_alloc.c:2441 [inline]
get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182
__alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408
__alloc_pages_node include/linux/gfp.h:587 [inline]
kmem_getpages mm/slab.c:1378 [inline]
cache_grow_begin+0x75/0x350 mm/slab.c:2584
cache_alloc_refill+0x27f/0x380 mm/slab.c:2957
____cache_alloc mm/slab.c:3040 [inline]
____cache_alloc mm/slab.c:3023 [inline]
__do_cache_alloc mm/slab.c:3267 [inline]
slab_alloc mm/slab.c:3309 [inline]
__do_kmalloc mm/slab.c:3708 [inline]
__kmalloc+0x3b3/0x4d0 mm/slab.c:3719
kmalloc include/linux/slab.h:586 [inline]
kzalloc include/linux/slab.h:714 [inline]
tomoyo_encode2.part.0+0xe9/0x3a0 security/tomoyo/realpath.c:45
tomoyo_encode2 security/tomoyo/realpath.c:31 [inline]
tomoyo_encode+0x28/0x50 security/tomoyo/realpath.c:80
tomoyo_realpath_from_path+0x186/0x620 security/tomoyo/realpath.c:288
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x21b/0x400 security/tomoyo/file.c:822
security_inode_getattr+0xcf/0x140 security/security.c:1350
vfs_getattr fs/stat.c:157 [inline]
vfs_statx+0x16a/0x390 fs/stat.c:232
vfs_fstatat+0x8c/0xb0 fs/stat.c:255
__do_sys_newfstatat+0x91/0x110 fs/stat.c:425
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1356 [inline]
free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1406
free_unref_page_prepare mm/page_alloc.c:3328 [inline]
free_unref_page+0x19/0x6a0 mm/page_alloc.c:3423
__vunmap+0x85d/0xd30 mm/vmalloc.c:2667
__vfree+0x3c/0xd0 mm/vmalloc.c:2715
vfree+0x5a/0x90 mm/vmalloc.c:2746
__do_replace+0x16b/0x890 net/ipv6/netfilter/ip6_tables.c:1117
do_replace net/ipv6/netfilter/ip6_tables.c:1157 [inline]
do_ip6t_set_ctl+0x90d/0xb90 net/ipv6/netfilter/ip6_tables.c:1639
nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101
ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1026
tcp_setsockopt+0x136/0x2520 net/ipv4/tcp.c:3696
__sys_setsockopt+0x2db/0x6a0 net/socket.c:2180
__do_sys_setsockopt net/socket.c:2191 [inline]
__se_sys_setsockopt net/socket.c:2188 [inline]
__x64_sys_setsockopt+0xba/0x150 net/socket.c:2188
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Memory state around the buggy address:
ffff88807d37b800: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
ffff88807d37b880: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
>ffff88807d37b900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff88807d37b980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88807d37ba00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
Fixes: c85bb41e9318 ("igmp: fix ip_mc_sf_allow race [v5]")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Flavio Leitner <fbl@sysclose.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/igmp.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2401,9 +2401,10 @@ int ip_mc_source(int add, int omode, str
newpsl->sl_addr[i] = psl->sl_addr[i];
/* decrease mem now to avoid the memleak warning */
atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
- kfree_rcu(psl, rcu);
}
rcu_assign_pointer(pmc->sflist, newpsl);
+ if (psl)
+ kfree_rcu(psl, rcu);
psl = newpsl;
}
rv = 1; /* > 0 for insert logic below if sl_count is 0 */
@@ -2501,11 +2502,13 @@ int ip_mc_msfilter(struct sock *sk, stru
psl->sl_count, psl->sl_addr, 0);
/* decrease mem now to avoid the memleak warning */
atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
- kfree_rcu(psl, rcu);
- } else
+ } else {
(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
0, NULL, 0);
+ }
rcu_assign_pointer(pmc->sflist, newpsl);
+ if (psl)
+ kfree_rcu(psl, rcu);
pmc->sfmode = msf->imsf_fmode;
err = 0;
done:
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 58/70] kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 57/70] net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 59/70] net/mlx5: Fix slab-out-of-bounds while reading resource dump menu Greg Kroah-Hartman
` (20 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vasant Hegde, Sandipan Das,
Paolo Bonzini, Sasha Levin
From: Sandipan Das <sandipan.das@amd.com>
[ Upstream commit 5a1bde46f98b893cda6122b00e94c0c40a6ead3c ]
On some x86 processors, CPUID leaf 0xA provides information
on Architectural Performance Monitoring features. It
advertises a PMU version which Qemu uses to determine the
availability of additional MSRs to manage the PMCs.
Upon receiving a KVM_GET_SUPPORTED_CPUID ioctl request for
the same, the kernel constructs return values based on the
x86_pmu_capability irrespective of the vendor.
This leaf and the additional MSRs are not supported on AMD
and Hygon processors. If AMD PerfMonV2 is detected, the PMU
version is set to 2 and guest startup breaks because of an
attempt to access a non-existent MSR. Return zeros to avoid
this.
Fixes: a6c06ed1a60a ("KVM: Expose the architectural performance monitoring CPUID leaf")
Reported-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Message-Id: <3fef83d9c2b2f7516e8ff50d60851f29a4bcb716.1651058600.git.sandipan.das@amd.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/cpuid.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 41b0dc37720e..6e1ea5e85e59 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -668,6 +668,11 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function)
union cpuid10_eax eax;
union cpuid10_edx edx;
+ if (!static_cpu_has(X86_FEATURE_ARCH_PERFMON)) {
+ entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
+ break;
+ }
+
perf_get_x86_pmu_capability(&cap);
/*
--
2.35.1
^ permalink raw reply related [flat|nested] 81+ messages in thread* [PATCH 5.10 59/70] net/mlx5: Fix slab-out-of-bounds while reading resource dump menu
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 58/70] kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 60/70] x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume Greg Kroah-Hartman
` (19 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aya Levin, Moshe Shemesh,
Saeed Mahameed, Sasha Levin
From: Aya Levin <ayal@nvidia.com>
[ Upstream commit 7ba2d9d8de96696c1451fee1b01da11f45bdc2b9 ]
Resource dump menu may span over more than a single page, support it.
Otherwise, menu read may result in a memory access violation: reading
outside of the allocated page.
Note that page format of the first menu page contains menu headers while
the proceeding menu pages contain only records.
The KASAN logs are as follows:
BUG: KASAN: slab-out-of-bounds in strcmp+0x9b/0xb0
Read of size 1 at addr ffff88812b2e1fd0 by task systemd-udevd/496
CPU: 5 PID: 496 Comm: systemd-udevd Tainted: G B 5.16.0_for_upstream_debug_2022_01_10_23_12 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x57/0x7d
print_address_description.constprop.0+0x1f/0x140
? strcmp+0x9b/0xb0
? strcmp+0x9b/0xb0
kasan_report.cold+0x83/0xdf
? strcmp+0x9b/0xb0
strcmp+0x9b/0xb0
mlx5_rsc_dump_init+0x4ab/0x780 [mlx5_core]
? mlx5_rsc_dump_destroy+0x80/0x80 [mlx5_core]
? lockdep_hardirqs_on_prepare+0x286/0x400
? raw_spin_unlock_irqrestore+0x47/0x50
? aomic_notifier_chain_register+0x32/0x40
mlx5_load+0x104/0x2e0 [mlx5_core]
mlx5_init_one+0x41b/0x610 [mlx5_core]
....
The buggy address belongs to the object at ffff88812b2e0000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 4048 bytes to the right of
4096-byte region [ffff88812b2e0000, ffff88812b2e1000)
The buggy address belongs to the page:
page:000000009d69807a refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88812b2e6000 pfn:0x12b2e0
head:000000009d69807a order:3 compound_mapcount:0 compound_pincount:0
flags: 0x8000000000010200(slab|head|zone=2)
raw: 8000000000010200 0000000000000000 dead000000000001 ffff888100043040
raw: ffff88812b2e6000 0000000080040000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88812b2e1e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88812b2e1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88812b2e1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88812b2e2000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88812b2e2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Fixes: 12206b17235a ("net/mlx5: Add support for resource dump")
Signed-off-by: Aya Levin <ayal@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/diag/rsc_dump.c | 31 +++++++++++++++----
1 file changed, 25 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/rsc_dump.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/rsc_dump.c
index ed4fb79b4db7..75b6060f7a9a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/rsc_dump.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/rsc_dump.c
@@ -31,6 +31,7 @@ static const char *const mlx5_rsc_sgmt_name[] = {
struct mlx5_rsc_dump {
u32 pdn;
struct mlx5_core_mkey mkey;
+ u32 number_of_menu_items;
u16 fw_segment_type[MLX5_SGMT_TYPE_NUM];
};
@@ -50,21 +51,37 @@ static int mlx5_rsc_dump_sgmt_get_by_name(char *name)
return -EINVAL;
}
-static void mlx5_rsc_dump_read_menu_sgmt(struct mlx5_rsc_dump *rsc_dump, struct page *page)
+#define MLX5_RSC_DUMP_MENU_HEADER_SIZE (MLX5_ST_SZ_BYTES(resource_dump_info_segment) + \
+ MLX5_ST_SZ_BYTES(resource_dump_command_segment) + \
+ MLX5_ST_SZ_BYTES(resource_dump_menu_segment))
+
+static int mlx5_rsc_dump_read_menu_sgmt(struct mlx5_rsc_dump *rsc_dump, struct page *page,
+ int read_size, int start_idx)
{
void *data = page_address(page);
enum mlx5_sgmt_type sgmt_idx;
int num_of_items;
char *sgmt_name;
void *member;
+ int size = 0;
void *menu;
int i;
- menu = MLX5_ADDR_OF(menu_resource_dump_response, data, menu);
- num_of_items = MLX5_GET(resource_dump_menu_segment, menu, num_of_records);
+ if (!start_idx) {
+ menu = MLX5_ADDR_OF(menu_resource_dump_response, data, menu);
+ rsc_dump->number_of_menu_items = MLX5_GET(resource_dump_menu_segment, menu,
+ num_of_records);
+ size = MLX5_RSC_DUMP_MENU_HEADER_SIZE;
+ data += size;
+ }
+ num_of_items = rsc_dump->number_of_menu_items;
+
+ for (i = 0; start_idx + i < num_of_items; i++) {
+ size += MLX5_ST_SZ_BYTES(resource_dump_menu_record);
+ if (size >= read_size)
+ return start_idx + i;
- for (i = 0; i < num_of_items; i++) {
- member = MLX5_ADDR_OF(resource_dump_menu_segment, menu, record[i]);
+ member = data + MLX5_ST_SZ_BYTES(resource_dump_menu_record) * i;
sgmt_name = MLX5_ADDR_OF(resource_dump_menu_record, member, segment_name);
sgmt_idx = mlx5_rsc_dump_sgmt_get_by_name(sgmt_name);
if (sgmt_idx == -EINVAL)
@@ -72,6 +89,7 @@ static void mlx5_rsc_dump_read_menu_sgmt(struct mlx5_rsc_dump *rsc_dump, struct
rsc_dump->fw_segment_type[sgmt_idx] = MLX5_GET(resource_dump_menu_record,
member, segment_type);
}
+ return 0;
}
static int mlx5_rsc_dump_trigger(struct mlx5_core_dev *dev, struct mlx5_rsc_dump_cmd *cmd,
@@ -168,6 +186,7 @@ static int mlx5_rsc_dump_menu(struct mlx5_core_dev *dev)
struct mlx5_rsc_dump_cmd *cmd = NULL;
struct mlx5_rsc_key key = {};
struct page *page;
+ int start_idx = 0;
int size;
int err;
@@ -189,7 +208,7 @@ static int mlx5_rsc_dump_menu(struct mlx5_core_dev *dev)
if (err < 0)
goto destroy_cmd;
- mlx5_rsc_dump_read_menu_sgmt(dev->rsc_dump, page);
+ start_idx = mlx5_rsc_dump_read_menu_sgmt(dev->rsc_dump, page, size, start_idx);
} while (err > 0);
--
2.35.1
^ permalink raw reply related [flat|nested] 81+ messages in thread* [PATCH 5.10 60/70] x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 59/70] net/mlx5: Fix slab-out-of-bounds while reading resource dump menu Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 61/70] KVM: x86: Do not change ICR on write to APIC_SELF_IPI Greg Kroah-Hartman
` (18 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marcelo Tosatti, Wanpeng Li,
Paolo Bonzini, Sasha Levin
From: Wanpeng Li <wanpengli@tencent.com>
[ Upstream commit 0361bdfddca20c8855ea3bdbbbc9c999912b10ff ]
MSR_KVM_POLL_CONTROL is cleared on reset, thus reverting guests to
host-side polling after suspend/resume. Non-bootstrap CPUs are
restored correctly by the haltpoll driver because they are hot-unplugged
during suspend and hot-plugged during resume; however, the BSP
is not hotpluggable and remains in host-sde polling mode after
the guest resume. The makes the guest pay for the cost of vmexits
every time the guest enters idle.
Fix it by recording BSP's haltpoll state and resuming it during guest
resume.
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
Message-Id: <1650267752-46796-1-git-send-email-wanpengli@tencent.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/kvm.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 18e952fed021..6c3d38b5a8ad 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -66,6 +66,7 @@ static DEFINE_PER_CPU_DECRYPTED(struct kvm_vcpu_pv_apf_data, apf_reason) __align
DEFINE_PER_CPU_DECRYPTED(struct kvm_steal_time, steal_time) __aligned(64) __visible;
static int has_steal_clock = 0;
+static int has_guest_poll = 0;
/*
* No need for any "IO delay" on KVM
*/
@@ -624,14 +625,26 @@ static int kvm_cpu_down_prepare(unsigned int cpu)
static int kvm_suspend(void)
{
+ u64 val = 0;
+
kvm_guest_cpu_offline(false);
+#ifdef CONFIG_ARCH_CPUIDLE_HALTPOLL
+ if (kvm_para_has_feature(KVM_FEATURE_POLL_CONTROL))
+ rdmsrl(MSR_KVM_POLL_CONTROL, val);
+ has_guest_poll = !(val & 1);
+#endif
return 0;
}
static void kvm_resume(void)
{
kvm_cpu_online(raw_smp_processor_id());
+
+#ifdef CONFIG_ARCH_CPUIDLE_HALTPOLL
+ if (kvm_para_has_feature(KVM_FEATURE_POLL_CONTROL) && has_guest_poll)
+ wrmsrl(MSR_KVM_POLL_CONTROL, 0);
+#endif
}
static struct syscore_ops kvm_syscore_ops = {
--
2.35.1
^ permalink raw reply related [flat|nested] 81+ messages in thread* [PATCH 5.10 61/70] KVM: x86: Do not change ICR on write to APIC_SELF_IPI
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 60/70] x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 62/70] KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs Greg Kroah-Hartman
` (17 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chao Gao, Sean Christopherson,
Paolo Bonzini, Sasha Levin
From: Paolo Bonzini <pbonzini@redhat.com>
[ Upstream commit d22a81b304a27fca6124174a8e842e826c193466 ]
Emulating writes to SELF_IPI with a write to ICR has an unwanted side effect:
the value of ICR in vAPIC page gets changed. The lists SELF_IPI as write-only,
with no associated MMIO offset, so any write should have no visible side
effect in the vAPIC page.
Reported-by: Chao Gao <chao.gao@intel.com>
Reviewed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/lapic.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index de11149e28e0..e45ebf0870b6 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2106,10 +2106,9 @@ int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
break;
case APIC_SELF_IPI:
- if (apic_x2apic_mode(apic)) {
- kvm_lapic_reg_write(apic, APIC_ICR,
- APIC_DEST_SELF | (val & APIC_VECTOR_MASK));
- } else
+ if (apic_x2apic_mode(apic))
+ kvm_apic_send_ipi(apic, APIC_DEST_SELF | (val & APIC_VECTOR_MASK), 0);
+ else
ret = 1;
break;
default:
--
2.35.1
^ permalink raw reply related [flat|nested] 81+ messages in thread* [PATCH 5.10 62/70] KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 61/70] KVM: x86: Do not change ICR on write to APIC_SELF_IPI Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 63/70] KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised Greg Kroah-Hartman
` (16 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sean Christopherson, Paolo Bonzini,
Sasha Levin
From: Paolo Bonzini <pbonzini@redhat.com>
[ Upstream commit 9191b8f0745e63edf519e4a54a4aaae1d3d46fbd ]
WARN and bail if KVM attempts to free a root that isn't backed by a shadow
page. KVM allocates a bare page for "special" roots, e.g. when using PAE
paging or shadowing 2/3/4-level page tables with 4/5-level, and so root_hpa
will be valid but won't be backed by a shadow page. It's all too easy to
blindly call mmu_free_root_page() on root_hpa, be nice and WARN instead of
crashing KVM and possibly the kernel.
Reviewed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/mmu/mmu.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 99ea1ec12ffe..70ef5b542681 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -3140,6 +3140,8 @@ static void mmu_free_root_page(struct kvm *kvm, hpa_t *root_hpa,
return;
sp = to_shadow_page(*root_hpa & PT64_BASE_ADDR_MASK);
+ if (WARN_ON(!sp))
+ return;
if (kvm_mmu_put_root(kvm, sp)) {
if (sp->tdp_mmu_page)
--
2.35.1
^ permalink raw reply related [flat|nested] 81+ messages in thread* [PATCH 5.10 63/70] KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 62/70] KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 64/70] rcu: Fix callbacks processing time limit retaining cond_resched() Greg Kroah-Hartman
` (15 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aili Yao, Sean Christopherson,
Wanpeng Li, Paolo Bonzini, Sasha Levin
From: Wanpeng Li <wanpengli@tencent.com>
[ Upstream commit 1714a4eb6fb0cb79f182873cd011a8ed60ac65e8 ]
As commit 0c5f81dad46 ("KVM: LAPIC: Inject timer interrupt via posted
interrupt") mentioned that the host admin should well tune the guest
setup, so that vCPUs are placed on isolated pCPUs, and with several pCPUs
surplus for *busy* housekeeping. In this setup, it is preferrable to
disable mwait/hlt/pause vmexits to keep the vCPUs in non-root mode.
However, if only some guests isolated and others not, they would not
have any benefit from posted timer interrupts, and at the same time lose
VMX preemption timer fast paths because kvm_can_post_timer_interrupt()
returns true and therefore forces kvm_can_use_hv_timer() to false.
By guaranteeing that posted-interrupt timer is only used if MWAIT or
HLT are done without vmexit, KVM can make a better choice and use the
VMX preemption timer and the corresponding fast paths.
Reported-by: Aili Yao <yaoaili@kingsoft.com>
Reviewed-by: Sean Christopherson <seanjc@google.com>
Cc: Aili Yao <yaoaili@kingsoft.com>
Cc: Sean Christopherson <seanjc@google.com>
Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
Message-Id: <1643112538-36743-1-git-send-email-wanpengli@tencent.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/lapic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index e45ebf0870b6..a3ef793fce5f 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -113,7 +113,8 @@ static inline u32 kvm_x2apic_id(struct kvm_lapic *apic)
static bool kvm_can_post_timer_interrupt(struct kvm_vcpu *vcpu)
{
- return pi_inject_timer && kvm_vcpu_apicv_active(vcpu);
+ return pi_inject_timer && kvm_vcpu_apicv_active(vcpu) &&
+ (kvm_mwait_in_guest(vcpu->kvm) || kvm_hlt_in_guest(vcpu->kvm));
}
bool kvm_can_use_hv_timer(struct kvm_vcpu *vcpu)
--
2.35.1
^ permalink raw reply related [flat|nested] 81+ messages in thread* [PATCH 5.10 64/70] rcu: Fix callbacks processing time limit retaining cond_resched()
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 63/70] KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 65/70] rcu: Apply callbacks processing time limit only on softirq Greg Kroah-Hartman
` (14 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Valentin Schneider,
Sebastian Andrzej Siewior, Frederic Weisbecker, Peter Zijlstra,
Josh Triplett, Joel Fernandes, Boqun Feng, Neeraj Upadhyay,
Uladzislau Rezki, Thomas Gleixner, Paul E. McKenney
From: Frederic Weisbecker <frederic@kernel.org>
commit 3e61e95e2d095e308616cba4ffb640f95a480e01 upstream.
The callbacks processing time limit makes sure we are not exceeding a
given amount of time executing the queue.
However its "continue" clause bypasses the cond_resched() call on
rcuc and NOCB kthreads, delaying it until we reach the limit, which can
be very long...
Make sure the scheduler has a higher priority than the time limit.
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Tested-by: Valentin Schneider <valentin.schneider@arm.com>
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Cc: Valentin Schneider <valentin.schneider@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Josh Triplett <josh@joshtriplett.org>
Cc: Joel Fernandes <joel@joelfernandes.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Neeraj Upadhyay <neeraju@codeaurora.org>
Cc: Uladzislau Rezki <urezki@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
[UR: backport to 5.10-stable + commit update]
Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/rcu/tree.c | 28 ++++++++++++++++------------
1 file changed, 16 insertions(+), 12 deletions(-)
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -2490,10 +2490,22 @@ static void rcu_do_batch(struct rcu_data
* Stop only if limit reached and CPU has something to do.
* Note: The rcl structure counts down from zero.
*/
- if (-rcl.len >= bl && !offloaded &&
- (need_resched() ||
- (!is_idle_task(current) && !rcu_is_callbacks_kthread())))
- break;
+ if (in_serving_softirq()) {
+ if (-rcl.len >= bl && (need_resched() ||
+ (!is_idle_task(current) && !rcu_is_callbacks_kthread())))
+ break;
+ } else {
+ local_bh_enable();
+ lockdep_assert_irqs_enabled();
+ cond_resched_tasks_rcu_qs();
+ lockdep_assert_irqs_enabled();
+ local_bh_disable();
+ }
+
+ /*
+ * Make sure we don't spend too much time here and deprive other
+ * softirq vectors of CPU cycles.
+ */
if (unlikely(tlimit)) {
/* only call local_clock() every 32 callbacks */
if (likely((-rcl.len & 31) || local_clock() < tlimit))
@@ -2501,14 +2513,6 @@ static void rcu_do_batch(struct rcu_data
/* Exceeded the time limit, so leave. */
break;
}
- if (offloaded) {
- WARN_ON_ONCE(in_serving_softirq());
- local_bh_enable();
- lockdep_assert_irqs_enabled();
- cond_resched_tasks_rcu_qs();
- lockdep_assert_irqs_enabled();
- local_bh_disable();
- }
}
local_irq_save(flags);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 65/70] rcu: Apply callbacks processing time limit only on softirq
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 64/70] rcu: Fix callbacks processing time limit retaining cond_resched() Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 66/70] block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern Greg Kroah-Hartman
` (13 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Valentin Schneider,
Sebastian Andrzej Siewior, Frederic Weisbecker, Peter Zijlstra,
Josh Triplett, Joel Fernandes, Boqun Feng, Neeraj Upadhyay,
Uladzislau Rezki, Thomas Gleixner, Paul E. McKenney
From: Frederic Weisbecker <frederic@kernel.org>
commit a554ba288845fd3f6f12311fd76a51694233458a upstream.
Time limit only makes sense when callbacks are serviced in softirq mode
because:
_ In case we need to get back to the scheduler,
cond_resched_tasks_rcu_qs() is called after each callback.
_ In case some other softirq vector needs the CPU, the call to
local_bh_enable() before cond_resched_tasks_rcu_qs() takes care about
them via a call to do_softirq().
Therefore, make sure the time limit only applies to softirq mode.
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Tested-by: Valentin Schneider <valentin.schneider@arm.com>
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Cc: Valentin Schneider <valentin.schneider@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Josh Triplett <josh@joshtriplett.org>
Cc: Joel Fernandes <joel@joelfernandes.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Neeraj Upadhyay <neeraju@codeaurora.org>
Cc: Uladzislau Rezki <urezki@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
[UR: backport to 5.10-stable]
Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/rcu/tree.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -2456,7 +2456,7 @@ static void rcu_do_batch(struct rcu_data
div = READ_ONCE(rcu_divisor);
div = div < 0 ? 7 : div > sizeof(long) * 8 - 2 ? sizeof(long) * 8 - 2 : div;
bl = max(rdp->blimit, pending >> div);
- if (unlikely(bl > 100)) {
+ if (in_serving_softirq() && unlikely(bl > 100)) {
long rrn = READ_ONCE(rcu_resched_ns);
rrn = rrn < NSEC_PER_MSEC ? NSEC_PER_MSEC : rrn > NSEC_PER_SEC ? NSEC_PER_SEC : rrn;
@@ -2494,6 +2494,18 @@ static void rcu_do_batch(struct rcu_data
if (-rcl.len >= bl && (need_resched() ||
(!is_idle_task(current) && !rcu_is_callbacks_kthread())))
break;
+
+ /*
+ * Make sure we don't spend too much time here and deprive other
+ * softirq vectors of CPU cycles.
+ */
+ if (unlikely(tlimit)) {
+ /* only call local_clock() every 32 callbacks */
+ if (likely((-rcl.len & 31) || local_clock() < tlimit))
+ continue;
+ /* Exceeded the time limit, so leave. */
+ break;
+ }
} else {
local_bh_enable();
lockdep_assert_irqs_enabled();
@@ -2501,18 +2513,6 @@ static void rcu_do_batch(struct rcu_data
lockdep_assert_irqs_enabled();
local_bh_disable();
}
-
- /*
- * Make sure we don't spend too much time here and deprive other
- * softirq vectors of CPU cycles.
- */
- if (unlikely(tlimit)) {
- /* only call local_clock() every 32 callbacks */
- if (likely((-rcl.len & 31) || local_clock() < tlimit))
- continue;
- /* Exceeded the time limit, so leave. */
- break;
- }
}
local_irq_save(flags);
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 66/70] block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 65/70] rcu: Apply callbacks processing time limit only on softirq Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 67/70] dm: interlock pending dm_io and dm_wait_for_bios_completion Greg Kroah-Hartman
` (12 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Haimin Zhang, Chaitanya Kulkarni,
Christoph Hellwig, Jens Axboe, Nobel Barakat
From: Haimin Zhang <tcs.kernel@gmail.com>
commit cc8f7fe1f5eab010191aa4570f27641876fa1267 upstream.
Add __GFP_ZERO flag for alloc_page in function bio_copy_kern to initialize
the buffer of a bio.
Signed-off-by: Haimin Zhang <tcs.kernel@gmail.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20220216084038.15635-1-tcs.kernel@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[nobelbarakat: Backported to 5.10: Manually added flag]
Signed-off-by: Nobel Barakat <nobelbarakat@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-map.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -488,7 +488,7 @@ static struct bio *bio_copy_kern(struct
if (bytes > len)
bytes = len;
- page = alloc_page(q->bounce_gfp | gfp_mask);
+ page = alloc_page(q->bounce_gfp | __GFP_ZERO | gfp_mask);
if (!page)
goto cleanup;
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 67/70] dm: interlock pending dm_io and dm_wait_for_bios_completion
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 66/70] block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 68/70] PCI: aardvark: Clear all MSIs at setup Greg Kroah-Hartman
` (11 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer
From: Mike Snitzer <snitzer@redhat.com>
commit 9f6dc633761006f974701d4c88da71ab68670749 upstream.
Commit d208b89401e0 ("dm: fix mempool NULL pointer race when
completing IO") didn't go far enough.
When bio_end_io_acct ends the count of in-flight I/Os may reach zero
and the DM device may be suspended. There is a possibility that the
suspend races with dm_stats_account_io.
Fix this by adding percpu "pending_io" counters to track outstanding
dm_io. Move kicking of suspend queue to dm_io_dec_pending(). Also,
rename md_in_flight_bios() to dm_in_flight_bios() and update it to
iterate all pending_io counters.
Fixes: d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO")
Cc: stable@vger.kernel.org
Co-developed-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -612,13 +612,15 @@ static void end_io_acct(struct mapped_de
{
unsigned long duration = jiffies - start_time;
- bio_end_io_acct(bio, start_time);
-
if (unlikely(dm_stats_used(&md->stats)))
dm_stats_account_io(&md->stats, bio_data_dir(bio),
bio->bi_iter.bi_sector, bio_sectors(bio),
true, duration, stats_aux);
+ smp_wmb();
+
+ bio_end_io_acct(bio, start_time);
+
/* nudge anyone waiting on suspend queue */
if (unlikely(wq_has_sleeper(&md->wait)))
wake_up(&md->wait);
@@ -2348,6 +2350,8 @@ static int dm_wait_for_bios_completion(s
}
finish_wait(&md->wait, &wait);
+ smp_rmb();
+
return r;
}
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 68/70] PCI: aardvark: Clear all MSIs at setup
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 67/70] dm: interlock pending dm_io and dm_wait_for_bios_completion Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 69/70] PCI: aardvark: Fix reading MSI interrupt number Greg Kroah-Hartman
` (10 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Marek Behún,
Lorenzo Pieralisi
From: Pali Rohár <pali@kernel.org>
commit 7d8dc1f7cd007a7ce94c5b4c20d63a8b8d6d7751 upstream.
We already clear all the other interrupts (ISR0, ISR1, HOST_CTRL_INT).
Define a new macro PCIE_MSI_ALL_MASK and do the same clearing for MSIs,
to ensure that we don't start receiving spurious interrupts.
Use this new mask in advk_pcie_handle_msi();
Link: https://lore.kernel.org/r/20211130172913.9727-5-kabel@kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pci-aardvark.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -114,6 +114,7 @@
#define PCIE_MSI_ADDR_HIGH_REG (CONTROL_BASE_ADDR + 0x54)
#define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58)
#define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C)
+#define PCIE_MSI_ALL_MASK GENMASK(31, 0)
#define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C)
#define PCIE_MSI_DATA_MASK GENMASK(15, 0)
@@ -577,6 +578,7 @@ static void advk_pcie_setup_hw(struct ad
advk_writel(pcie, reg, PCIE_CORE_CTRL2_REG);
/* Clear all interrupts */
+ advk_writel(pcie, PCIE_MSI_ALL_MASK, PCIE_MSI_STATUS_REG);
advk_writel(pcie, PCIE_ISR0_ALL_MASK, PCIE_ISR0_REG);
advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_REG);
advk_writel(pcie, PCIE_IRQ_ALL_MASK, HOST_CTRL_INT_STATUS_REG);
@@ -589,7 +591,7 @@ static void advk_pcie_setup_hw(struct ad
advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_MASK_REG);
/* Unmask all MSIs */
- advk_writel(pcie, 0, PCIE_MSI_MASK_REG);
+ advk_writel(pcie, ~(u32)PCIE_MSI_ALL_MASK, PCIE_MSI_MASK_REG);
/* Enable summary interrupt for GIC SPI source */
reg = PCIE_IRQ_ALL_MASK & (~PCIE_IRQ_ENABLE_INTS_MASK);
@@ -1390,7 +1392,7 @@ static void advk_pcie_handle_msi(struct
msi_mask = advk_readl(pcie, PCIE_MSI_MASK_REG);
msi_val = advk_readl(pcie, PCIE_MSI_STATUS_REG);
- msi_status = msi_val & ~msi_mask;
+ msi_status = msi_val & ((~msi_mask) & PCIE_MSI_ALL_MASK);
for (msi_idx = 0; msi_idx < MSI_IRQ_NUM; msi_idx++) {
if (!(BIT(msi_idx) & msi_status))
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 69/70] PCI: aardvark: Fix reading MSI interrupt number
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 68/70] PCI: aardvark: Clear all MSIs at setup Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 13:08 ` [PATCH 5.10 70/70] mmc: rtsx: add 74 Clocks in power on flow Greg Kroah-Hartman
` (9 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Marek Behún,
Lorenzo Pieralisi
From: Pali Rohár <pali@kernel.org>
commit 805dfc18dd3d4dd97a987d4406593b5a225b1253 upstream.
In advk_pcie_handle_msi() it is expected that when bit i in the W1C
register PCIE_MSI_STATUS_REG is cleared, the PCIE_MSI_PAYLOAD_REG is
updated to contain the MSI number corresponding to index i.
Experiments show that this is not so, and instead PCIE_MSI_PAYLOAD_REG
always contains the number of the last received MSI, overall.
Do not read PCIE_MSI_PAYLOAD_REG register for determining MSI interrupt
number. Since Aardvark already forbids more than 32 interrupts and uses
own allocated hwirq numbers, the msi_idx already corresponds to the
received MSI number.
Link: https://lore.kernel.org/r/20220110015018.26359-3-kabel@kernel.org
Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pci-aardvark.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -1388,7 +1388,7 @@ static void advk_pcie_remove_irq_domain(
static void advk_pcie_handle_msi(struct advk_pcie *pcie)
{
u32 msi_val, msi_mask, msi_status, msi_idx;
- u16 msi_data;
+ int virq;
msi_mask = advk_readl(pcie, PCIE_MSI_MASK_REG);
msi_val = advk_readl(pcie, PCIE_MSI_STATUS_REG);
@@ -1398,13 +1398,9 @@ static void advk_pcie_handle_msi(struct
if (!(BIT(msi_idx) & msi_status))
continue;
- /*
- * msi_idx contains bits [4:0] of the msi_data and msi_data
- * contains 16bit MSI interrupt number
- */
advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG);
- msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK;
- generic_handle_irq(msi_data);
+ virq = irq_find_mapping(pcie->msi_inner_domain, msi_idx);
+ generic_handle_irq(virq);
}
advk_writel(pcie, PCIE_ISR0_MSI_INT_PENDING,
^ permalink raw reply [flat|nested] 81+ messages in thread* [PATCH 5.10 70/70] mmc: rtsx: add 74 Clocks in power on flow
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 69/70] PCI: aardvark: Fix reading MSI interrupt number Greg Kroah-Hartman
@ 2022-05-10 13:08 ` Greg Kroah-Hartman
2022-05-10 17:25 ` [PATCH 5.10 00/70] 5.10.115-rc1 review Florian Fainelli
` (8 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-10 13:08 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ricky Wu, Ulf Hansson, Christian Loehle
From: Ricky WU <ricky_wu@realtek.com>
commit 1f311c94aabdb419c28e3147bcc8ab89269f1a7e upstream.
SD spec definition:
"Host provides at least 74 Clocks before issuing first command"
After 1ms for the voltage stable then start issuing the Clock signals
if POWER STATE is
MMC_POWER_OFF to MMC_POWER_UP to issue Clock signal to card
MMC_POWER_UP to MMC_POWER_ON to stop issuing signal to card
Signed-off-by: Ricky Wu <ricky_wu@realtek.com>
Link: https://lore.kernel.org/r/1badf10aba764191a1a752edcbf90389@realtek.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Christian Loehle <cloehle@hyperstone.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/rtsx_pci_sdmmc.c | 31 +++++++++++++++++++++----------
1 file changed, 21 insertions(+), 10 deletions(-)
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -37,10 +37,7 @@ struct realtek_pci_sdmmc {
bool double_clk;
bool eject;
bool initial_mode;
- int power_state;
-#define SDMMC_POWER_ON 1
-#define SDMMC_POWER_OFF 0
-
+ int prev_power_state;
int sg_count;
s32 cookie;
int cookie_sg_count;
@@ -902,14 +899,21 @@ static int sd_set_bus_width(struct realt
return err;
}
-static int sd_power_on(struct realtek_pci_sdmmc *host)
+static int sd_power_on(struct realtek_pci_sdmmc *host, unsigned char power_mode)
{
struct rtsx_pcr *pcr = host->pcr;
int err;
- if (host->power_state == SDMMC_POWER_ON)
+ if (host->prev_power_state == MMC_POWER_ON)
return 0;
+ if (host->prev_power_state == MMC_POWER_UP) {
+ rtsx_pci_write_register(pcr, SD_BUS_STAT, SD_CLK_TOGGLE_EN, 0);
+ goto finish;
+ }
+
+ msleep(100);
+
rtsx_pci_init_cmd(pcr);
rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, CARD_SELECT, 0x07, SD_MOD_SEL);
rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, CARD_SHARE_MODE,
@@ -928,11 +932,17 @@ static int sd_power_on(struct realtek_pc
if (err < 0)
return err;
+ mdelay(1);
+
err = rtsx_pci_write_register(pcr, CARD_OE, SD_OUTPUT_EN, SD_OUTPUT_EN);
if (err < 0)
return err;
- host->power_state = SDMMC_POWER_ON;
+ /* send at least 74 clocks */
+ rtsx_pci_write_register(pcr, SD_BUS_STAT, SD_CLK_TOGGLE_EN, SD_CLK_TOGGLE_EN);
+
+finish:
+ host->prev_power_state = power_mode;
return 0;
}
@@ -941,7 +951,7 @@ static int sd_power_off(struct realtek_p
struct rtsx_pcr *pcr = host->pcr;
int err;
- host->power_state = SDMMC_POWER_OFF;
+ host->prev_power_state = MMC_POWER_OFF;
rtsx_pci_init_cmd(pcr);
@@ -967,7 +977,7 @@ static int sd_set_power_mode(struct real
if (power_mode == MMC_POWER_OFF)
err = sd_power_off(host);
else
- err = sd_power_on(host);
+ err = sd_power_on(host, power_mode);
return err;
}
@@ -1404,10 +1414,11 @@ static int rtsx_pci_sdmmc_drv_probe(stru
host = mmc_priv(mmc);
host->pcr = pcr;
+ mmc->ios.power_delay_ms = 5;
host->mmc = mmc;
host->pdev = pdev;
host->cookie = -1;
- host->power_state = SDMMC_POWER_OFF;
+ host->prev_power_state = MMC_POWER_OFF;
INIT_WORK(&host->work, sd_request);
platform_set_drvdata(pdev, host);
pcr->slots[RTSX_SD_CARD].p_dev = pdev;
^ permalink raw reply [flat|nested] 81+ messages in thread* Re: [PATCH 5.10 00/70] 5.10.115-rc1 review
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2022-05-10 13:08 ` [PATCH 5.10 70/70] mmc: rtsx: add 74 Clocks in power on flow Greg Kroah-Hartman
@ 2022-05-10 17:25 ` Florian Fainelli
2022-05-10 18:06 ` Pavel Machek
` (7 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Florian Fainelli @ 2022-05-10 17:25 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, torvalds, akpm, linux, shuah, patches, lkft-triage,
pavel, jonathanh, sudipm.mukherjee, slade
On 5/10/22 06:07, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.115 release.
> There are 70 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 12 May 2022 13:07:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.115-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 5.10.115-rc1
>
> Ricky WU <ricky_wu@realtek.com>
> mmc: rtsx: add 74 Clocks in power on flow
>
> Pali Rohár <pali@kernel.org>
> PCI: aardvark: Fix reading MSI interrupt number
>
> Pali Rohár <pali@kernel.org>
> PCI: aardvark: Clear all MSIs at setup
>
> Mike Snitzer <snitzer@redhat.com>
> dm: interlock pending dm_io and dm_wait_for_bios_completion
>
> Haimin Zhang <tcs.kernel@gmail.com>
> block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
>
> Frederic Weisbecker <frederic@kernel.org>
> rcu: Apply callbacks processing time limit only on softirq
>
> Frederic Weisbecker <frederic@kernel.org>
> rcu: Fix callbacks processing time limit retaining cond_resched()
>
> Wanpeng Li <wanpengli@tencent.com>
> KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised
>
> Paolo Bonzini <pbonzini@redhat.com>
> KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs
>
> Paolo Bonzini <pbonzini@redhat.com>
> KVM: x86: Do not change ICR on write to APIC_SELF_IPI
>
> Wanpeng Li <wanpengli@tencent.com>
> x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume
>
> Aya Levin <ayal@nvidia.com>
> net/mlx5: Fix slab-out-of-bounds while reading resource dump menu
>
> Sandipan Das <sandipan.das@amd.com>
> kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
>
> Eric Dumazet <edumazet@google.com>
> net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: always log symlinks in full mode
>
> Sergey Shtylyov <s.shtylyov@omp.ru>
> smsc911x: allow using IRQ0
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> selftests: ocelot: tc_flower_chains: specify conform-exceed action for policer
>
> Michael Chan <michael.chan@broadcom.com>
> bnxt_en: Fix unnecessary dropping of RX packets
>
> Somnath Kotur <somnath.kotur@broadcom.com>
> bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational
>
> Qiao Ma <mqaio@linux.alibaba.com>
> hinic: fix bug of wq out of bound access
>
> Shravya Kumbham <shravya.kumbham@xilinx.com>
> net: emaclite: Add error handling for of_address_to_resource()
>
> Yang Yingliang <yangyingliang@huawei.com>
> net: cpsw: add missing of_node_put() in cpsw_probe_dt()
>
> Yang Yingliang <yangyingliang@huawei.com>
> net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux()
>
> Yang Yingliang <yangyingliang@huawei.com>
> net: dsa: mt7530: add missing of_node_put() in mt7530_setup()
>
> Yang Yingliang <yangyingliang@huawei.com>
> net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init()
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> NFSv4: Don't invalidate inode attributes on delegation return
>
> Cheng Xu <chengyou@linux.alibaba.com>
> RDMA/siw: Fix a condition race issue in MPA request processing
>
> Jann Horn <jannh@google.com>
> selftests/seccomp: Don't call read() on TTY from background pgrp
>
> Moshe Shemesh <moshe@nvidia.com>
> net/mlx5: Avoid double clear or set of sync reset requested
>
> Mark Zhang <markzhang@nvidia.com>
> net/mlx5e: Fix the calling of update_buffer_lossy() API
>
> Paul Blakey <paulb@nvidia.com>
> net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release
>
> Vlad Buslov <vladbu@nvidia.com>
> net/mlx5e: Don't match double-vlan packets if cvlan is not set
>
> Moshe Tal <moshet@nvidia.com>
> net/mlx5e: Fix trust state reset in reload
>
> Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
> ASoC: dmaengine: Restore NULL prepare_slave_config() callback
>
> Armin Wolf <W_Armin@gmx.de>
> hwmon: (adt7470) Fix warning on module removal
>
> Puyou Lu <puyou.lu@gmail.com>
> gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set)
>
> Duoming Zhou <duoming@zju.edu.cn>
> NFC: netlink: fix sleep in atomic bug when firmware download timeout
>
> Duoming Zhou <duoming@zju.edu.cn>
> nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
>
> Duoming Zhou <duoming@zju.edu.cn>
> nfc: replace improper check device_is_registered() in netlink related functions
>
> Andreas Larsson <andreas@gaisler.com>
> can: grcan: only use the NAPI poll budget for RX
>
> Andreas Larsson <andreas@gaisler.com>
> can: grcan: grcan_probe(): fix broken system id check for errata workaround needs
>
> Daniel Hellstrom <daniel@gaisler.com>
> can: grcan: use ofdev->dev when allocating DMA memory
>
> Oliver Hartkopp <socketcan@hartkopp.net>
> can: isotp: remove re-binding of bound socket
>
> Duoming Zhou <duoming@zju.edu.cn>
> can: grcan: grcan_close(): fix deadlock
>
> Jan Höppner <hoeppner@linux.ibm.com>
> s390/dasd: Fix read inconsistency for ESE DASD devices
>
> Jan Höppner <hoeppner@linux.ibm.com>
> s390/dasd: Fix read for ESE with blksize < 4k
>
> Stefan Haberland <sth@linux.ibm.com>
> s390/dasd: prevent double format of tracks for ESE devices
>
> Stefan Haberland <sth@linux.ibm.com>
> s390/dasd: fix data corruption for ESE devices
>
> Mark Brown <broonie@kernel.org>
> ASoC: meson: Fix event generation for AUI CODEC mux
>
> Mark Brown <broonie@kernel.org>
> ASoC: meson: Fix event generation for G12A tohdmi mux
>
> Mark Brown <broonie@kernel.org>
> ASoC: meson: Fix event generation for AUI ACODEC mux
>
> Mark Brown <broonie@kernel.org>
> ASoC: wm8958: Fix change notifications for DSP controls
>
> Mark Brown <broonie@kernel.org>
> ASoC: da7219: Fix change notifications for tone generator frequency
>
> Thomas Pfaff <tpfaff@pcs.com>
> genirq: Synchronize interrupt thread startup
>
> Tan Tee Min <tee.min.tan@linux.intel.com>
> net: stmmac: disable Split Header (SPH) for Intel platforms
>
> Niels Dossche <dossche.niels@gmail.com>
> firewire: core: extend card->lock in fw_core_handle_bus_reset
>
> Jakob Koschel <jakobkoschel@gmail.com>
> firewire: remove check of list iterator against head past the loop body
>
> Chengfeng Ye <cyeaa@connect.ust.hk>
> firewire: fix potential uaf in outbound_phy_packet_callback()
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> Revert "SUNRPC: attempt AF_LOCAL connect on setup"
>
> Harry Wentland <harry.wentland@amd.com>
> drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT
>
> David Stevens <stevensd@chromium.org>
> iommu/vt-d: Calculate mask for non-aligned flushes
>
> Kyle Huey <me@kylehuey.com>
> KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id
>
> Andrei Lalaev <andrei.lalaev@emlid.com>
> gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
>
> Brian Norris <briannorris@chromium.org>
> mmc: core: Set HS clock speed before sending HS CMD13
>
> Shaik Sajida Bhanu <quic_c_sbhanu@quicinc.com>
> mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC
>
> Takashi Sakamoto <o-takashi@sakamocchi.jp>
> ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
>
> Zihao Wang <wzhd@ustc.edu>
> ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers
>
> Helge Deller <deller@gmx.de>
> parisc: Merge model and model name into one line in /proc/cpuinfo
>
> Maciej W. Rozycki <macro@orcam.me.uk>
> MIPS: Fix CP0 counter erratum detection for R4k CPUs
>
>
> -------------
>
> Diffstat:
>
> Makefile | 4 +-
> arch/mips/include/asm/timex.h | 8 ++--
> arch/mips/kernel/time.c | 11 ++----
> arch/parisc/kernel/processor.c | 3 +-
> arch/x86/kernel/kvm.c | 13 ++++++
> arch/x86/kvm/cpuid.c | 5 +++
> arch/x86/kvm/lapic.c | 10 ++---
> arch/x86/kvm/mmu/mmu.c | 2 +
> arch/x86/kvm/svm/pmu.c | 28 +++++++++++--
> block/blk-map.c | 2 +-
> drivers/firewire/core-card.c | 3 ++
> drivers/firewire/core-cdev.c | 4 +-
> drivers/firewire/core-topology.c | 9 ++---
> drivers/firewire/core-transaction.c | 30 +++++++-------
> drivers/firewire/sbp2.c | 13 +++---
> drivers/gpio/gpio-pca953x.c | 4 +-
> drivers/gpio/gpiolib-of.c | 2 +-
> drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 2 +-
> drivers/hwmon/adt7470.c | 4 +-
> drivers/infiniband/sw/siw/siw_cm.c | 7 ++--
> drivers/iommu/intel/iommu.c | 27 +++++++++++--
> drivers/md/dm.c | 8 +++-
> drivers/mmc/core/mmc.c | 23 +++++++++--
> drivers/mmc/host/rtsx_pci_sdmmc.c | 31 ++++++++++-----
> drivers/mmc/host/sdhci-msm.c | 42 ++++++++++++++++++++
> drivers/net/can/grcan.c | 46 +++++++++++-----------
> drivers/net/dsa/mt7530.c | 1 +
> drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 +++---
> drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c | 7 +++-
> drivers/net/ethernet/mediatek/mtk_sgmii.c | 1 +
> .../ethernet/mellanox/mlx5/core/diag/rsc_dump.c | 31 ++++++++++++---
> .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 4 +-
> drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 4 ++
> drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 +++++
> drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 11 ++++++
> drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 28 ++++++++-----
> drivers/net/ethernet/smsc/smsc911x.c | 2 +-
> drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 +
> drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 1 +
> drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
> drivers/net/ethernet/ti/cpsw_new.c | 5 ++-
> drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 +++++--
> drivers/nfc/nfcmrvl/main.c | 2 +-
> drivers/pci/controller/pci-aardvark.c | 16 ++++----
> drivers/s390/block/dasd.c | 18 +++++++--
> drivers/s390/block/dasd_eckd.c | 28 +++++++++----
> drivers/s390/block/dasd_int.h | 14 +++++++
> fs/btrfs/tree-log.c | 14 ++++++-
> fs/nfs/nfs4proc.c | 12 +++++-
> include/linux/stmmac.h | 1 +
> kernel/irq/internals.h | 2 +
> kernel/irq/irqdesc.c | 2 +
> kernel/irq/manage.c | 39 +++++++++++++-----
> kernel/rcu/tree.c | 32 ++++++++-------
> net/can/isotp.c | 22 +++--------
> net/ipv4/igmp.c | 9 +++--
> net/nfc/core.c | 29 +++++++-------
> net/nfc/netlink.c | 4 +-
> net/sunrpc/xprtsock.c | 3 --
> sound/firewire/fireworks/fireworks_hwdep.c | 1 +
> sound/pci/hda/patch_realtek.c | 1 +
> sound/soc/codecs/da7219.c | 14 +++++--
> sound/soc/codecs/wm8958-dsp2.c | 8 ++--
> sound/soc/meson/aiu-acodec-ctrl.c | 2 +-
> sound/soc/meson/aiu-codec-ctrl.c | 2 +-
> sound/soc/meson/g12a-tohdmitx.c | 2 +-
> sound/soc/soc-generic-dmaengine-pcm.c | 6 +--
> .../drivers/net/ocelot/tc_flower_chains.sh | 2 +-
> .../net/forwarding/mirror_gre_bridge_1q.sh | 3 ++
> tools/testing/selftests/seccomp/seccomp_bpf.c | 10 ++---
> 70 files changed, 537 insertions(+), 238 deletions(-)
>
>
--
Florian
^ permalink raw reply [flat|nested] 81+ messages in thread* Re: [PATCH 5.10 00/70] 5.10.115-rc1 review
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2022-05-10 17:25 ` [PATCH 5.10 00/70] 5.10.115-rc1 review Florian Fainelli
@ 2022-05-10 18:06 ` Pavel Machek
2022-05-10 18:38 ` Fox Chen
` (6 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Pavel Machek @ 2022-05-10 18:06 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
slade
[-- Attachment #1: Type: text/plain, Size: 661 bytes --]
Hi!
> This is the start of the stable review cycle for the 5.10.115 release.
> There are 70 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
^ permalink raw reply [flat|nested] 81+ messages in thread* RE: [PATCH 5.10 00/70] 5.10.115-rc1 review
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2022-05-10 18:06 ` Pavel Machek
@ 2022-05-10 18:38 ` Fox Chen
2022-05-10 20:44 ` Sudip Mukherjee
` (5 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Fox Chen @ 2022-05-10 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, slade, Fox Chen
On Tue, 10 May 2022 15:07:19 +0200, Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 5.10.115 release.
> There are 70 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 12 May 2022 13:07:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.115-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
5.10.115-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
Tested-by: Fox Chen <foxhlchen@gmail.com>
^ permalink raw reply [flat|nested] 81+ messages in thread* Re: [PATCH 5.10 00/70] 5.10.115-rc1 review
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2022-05-10 18:38 ` Fox Chen
@ 2022-05-10 20:44 ` Sudip Mukherjee
2022-05-12 13:32 ` Greg Kroah-Hartman
2022-05-10 22:43 ` Shuah Khan
` (4 subsequent siblings)
78 siblings, 1 reply; 81+ messages in thread
From: Sudip Mukherjee @ 2022-05-10 20:44 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, Stable, Linus Torvalds, Andrew Morton,
Guenter Roeck, Shuah Khan, patches, lkft-triage, Pavel Machek,
Jonathan Hunter, Florian Fainelli, slade
Hi Greg,
On Tue, May 10, 2022 at 2:25 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 5.10.115 release.
> There are 70 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 12 May 2022 13:07:16 +0000.
> Anything received after that time might be too late.
Just some initial report for you.
As mentioned in the mail for 4.19-stable, it will also need
d422c6c0644b ("MIPS: Use address-of operator on section symbols").
But apart from that, there is also another failure.
drivers/usb/phy/phy-generic.c: In function 'usb_phy_gen_create_phy':
drivers/usb/phy/phy-generic.c:271:26: error: implicit declaration of
function 'devm_regulator_get_exclusive'; did you mean
'regulator_get_exclusive'? [-Werror=implicit-function-declaration]
271 | nop->vbus_draw = devm_regulator_get_exclusive(dev, "vbus");
This was introduced in v5.10.114 by d22d92230ffb ("usb: phy: generic:
Get the vbus supply") but I missed testing that release. :(
--
Regards
Sudip
^ permalink raw reply [flat|nested] 81+ messages in thread* Re: [PATCH 5.10 00/70] 5.10.115-rc1 review
2022-05-10 20:44 ` Sudip Mukherjee
@ 2022-05-12 13:32 ` Greg Kroah-Hartman
0 siblings, 0 replies; 81+ messages in thread
From: Greg Kroah-Hartman @ 2022-05-12 13:32 UTC (permalink / raw)
To: Sudip Mukherjee
Cc: linux-kernel, Stable, Linus Torvalds, Andrew Morton,
Guenter Roeck, Shuah Khan, patches, lkft-triage, Pavel Machek,
Jonathan Hunter, Florian Fainelli, slade
On Tue, May 10, 2022 at 09:44:26PM +0100, Sudip Mukherjee wrote:
> Hi Greg,
>
> On Tue, May 10, 2022 at 2:25 PM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > This is the start of the stable review cycle for the 5.10.115 release.
> > There are 70 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu, 12 May 2022 13:07:16 +0000.
> > Anything received after that time might be too late.
>
> Just some initial report for you.
> As mentioned in the mail for 4.19-stable, it will also need
> d422c6c0644b ("MIPS: Use address-of operator on section symbols").
>
> But apart from that, there is also another failure.
> drivers/usb/phy/phy-generic.c: In function 'usb_phy_gen_create_phy':
> drivers/usb/phy/phy-generic.c:271:26: error: implicit declaration of
> function 'devm_regulator_get_exclusive'; did you mean
> 'regulator_get_exclusive'? [-Werror=implicit-function-declaration]
> 271 | nop->vbus_draw = devm_regulator_get_exclusive(dev, "vbus");
>
> This was introduced in v5.10.114 by d22d92230ffb ("usb: phy: generic:
> Get the vbus supply") but I missed testing that release. :(
Should now be fixed, thanks.
greg k-h
^ permalink raw reply [flat|nested] 81+ messages in thread
* Re: [PATCH 5.10 00/70] 5.10.115-rc1 review
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2022-05-10 20:44 ` Sudip Mukherjee
@ 2022-05-10 22:43 ` Shuah Khan
2022-05-11 1:12 ` Guenter Roeck
` (3 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Shuah Khan @ 2022-05-10 22:43 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, torvalds, akpm, linux, shuah, patches, lkft-triage,
pavel, jonathanh, f.fainelli, sudipm.mukherjee, slade,
Shuah Khan
On 5/10/22 7:07 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.115 release.
> There are 70 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 12 May 2022 13:07:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.115-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 81+ messages in thread* Re: [PATCH 5.10 00/70] 5.10.115-rc1 review
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2022-05-10 22:43 ` Shuah Khan
@ 2022-05-11 1:12 ` Guenter Roeck
2022-05-11 1:57 ` Samuel Zou
` (2 subsequent siblings)
78 siblings, 0 replies; 81+ messages in thread
From: Guenter Roeck @ 2022-05-11 1:12 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
slade
On Tue, May 10, 2022 at 03:07:19PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.115 release.
> There are 70 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 12 May 2022 13:07:16 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 161 pass: 161 fail: 0
Qemu test results:
total: 477 pass: 477 fail: 0
Tested-by: Guenter Roeck <linux@roeck-us.net>
Guenter
^ permalink raw reply [flat|nested] 81+ messages in thread* Re: [PATCH 5.10 00/70] 5.10.115-rc1 review
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2022-05-11 1:12 ` Guenter Roeck
@ 2022-05-11 1:57 ` Samuel Zou
2022-05-11 5:50 ` Naresh Kamboju
2022-05-11 10:05 ` Sudip Mukherjee
78 siblings, 0 replies; 81+ messages in thread
From: Samuel Zou @ 2022-05-11 1:57 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, torvalds, akpm, linux, shuah, patches, lkft-triage,
pavel, jonathanh, f.fainelli, sudipm.mukherjee, slade
On 2022/5/10 21:07, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.115 release.
> There are 70 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 12 May 2022 13:07:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.115-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Tested on arm64 and x86 for 5.10.115-rc1,
Kernel repo:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.115-rc1
Commit: b2286cf7a6972650a6163f327d11695fa11ef6c9
Compiler: gcc version 7.3.0 (GCC)
arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 9033
passed: 9033
failed: 0
timeout: 0
--------------------------------------------------------------------
x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 9033
passed: 9033
failed: 0
timeout: 0
--------------------------------------------------------------------
Tested-by: Hulk Robot <hulkrobot@huawei.com>
^ permalink raw reply [flat|nested] 81+ messages in thread* Re: [PATCH 5.10 00/70] 5.10.115-rc1 review
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2022-05-11 1:57 ` Samuel Zou
@ 2022-05-11 5:50 ` Naresh Kamboju
2022-05-11 10:05 ` Sudip Mukherjee
78 siblings, 0 replies; 81+ messages in thread
From: Naresh Kamboju @ 2022-05-11 5:50 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
slade
On Tue, 10 May 2022 at 18:56, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 5.10.115 release.
> There are 70 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 12 May 2022 13:07:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.115-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
## Build
* kernel: 5.10.115-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.10.y
* git commit: b2286cf7a6972650a6163f327d11695fa11ef6c9
* git describe: v5.10.113-201-gb2286cf7a697
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.113-201-gb2286cf7a697
## Test Regressions (compared to v5.10.113-3-gbc311a966773)
No test regressions found.
## Metric Regressions (compared to v5.10.113-3-gbc311a966773)
No metric regressions found.
## Test Fixes (compared to v5.10.113-3-gbc311a966773)
No test fixes found.
## Metric Fixes (compared to v5.10.113-3-gbc311a966773)
No metric fixes found.
## Test result summary
total: 97056, pass: 82218, fail: 649, skip: 13165, xfail: 1024
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 291 total, 291 passed, 0 failed
* arm64: 41 total, 41 passed, 0 failed
* i386: 39 total, 39 passed, 0 failed
* mips: 37 total, 37 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 60 total, 51 passed, 9 failed
* riscv: 27 total, 27 passed, 0 failed
* s390: 21 total, 21 passed, 0 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x86_64: 41 total, 41 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* ssuite
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 81+ messages in thread* Re: [PATCH 5.10 00/70] 5.10.115-rc1 review
2022-05-10 13:07 [PATCH 5.10 00/70] 5.10.115-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2022-05-11 5:50 ` Naresh Kamboju
@ 2022-05-11 10:05 ` Sudip Mukherjee
78 siblings, 0 replies; 81+ messages in thread
From: Sudip Mukherjee @ 2022-05-11 10:05 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, slade
Hi Greg,
On Tue, May 10, 2022 at 03:07:19PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.115 release.
> There are 70 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 12 May 2022 13:07:16 +0000.
> Anything received after that time might be too late.
Build test (gcc-11):
mips (gcc version 11.2.1 20220408): 63 configs -> 1 new failure
arm (gcc version 11.2.1 20220408): 105 configs -> 1 new failure
arm64 (gcc version 11.2.1 20220408): 3 configs -> no failure
x86_64 (gcc version 11.2.1 20220408): 4 configs -> no failure
mips xway_defconfig and arm hisi_defconfig both failed with:
drivers/usb/phy/phy-generic.c: In function 'usb_phy_gen_create_phy':
drivers/usb/phy/phy-generic.c:271:26: error: implicit declaration of function 'devm_regulator_get_exclusive'; did you mean 'regulator_get_exclusive'? [-Werror=implicit-function-declaration]
271 | nop->vbus_draw = devm_regulator_get_exclusive(dev, "vbus");
It was introduced in v5.10.114 by d22d92230ffb ("usb: phy: generic: Get the vbus supply")
Build test (gcc-12):
Mips builds are failing. Needs d422c6c0644b ("MIPS: Use address-of operator on section
symbols")
arm64 allmodconfig failed. Will check later what is needed for arm64.
Boot test:
x86_64: Booted on my test laptop. No regression.
x86_64: Booted on qemu. No regression. [1]
arm64: Booted on rpi4b (4GB model). No regression. [2]
[1]. https://openqa.qa.codethink.co.uk/tests/1123
[2]. https://openqa.qa.codethink.co.uk/tests/1125
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
--
Regards
Sudip
^ permalink raw reply [flat|nested] 81+ messages in thread