* [PATCH AUTOSEL 5.4 002/130] locks: Fix UBSAN undefined behaviour in flock64_to_posix_lock
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 003/130] tomoyo: fix clang pointer arithmetic warning Sasha Levin
` (127 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Luo Meng, Jeff Layton, Sasha Levin, linux-fsdevel
From: Luo Meng <luomeng12@huawei.com>
[ Upstream commit 16238415eb9886328a89fe7a3cb0b88c7335fe16 ]
When the sum of fl->fl_start and l->l_len overflows,
UBSAN shows the following warning:
UBSAN: Undefined behaviour in fs/locks.c:482:29
signed integer overflow: 2 + 9223372036854775806
cannot be represented in type 'long long int'
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xe4/0x14e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x81 lib/ubsan.c:161
handle_overflow+0x193/0x1e2 lib/ubsan.c:192
flock64_to_posix_lock fs/locks.c:482 [inline]
flock_to_posix_lock+0x595/0x690 fs/locks.c:515
fcntl_setlk+0xf3/0xa90 fs/locks.c:2262
do_fcntl+0x456/0xf60 fs/fcntl.c:387
__do_sys_fcntl fs/fcntl.c:483 [inline]
__se_sys_fcntl fs/fcntl.c:468 [inline]
__x64_sys_fcntl+0x12d/0x180 fs/fcntl.c:468
do_syscall_64+0xc8/0x5a0 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fix it by parenthesizing 'l->l_len - 1'.
Signed-off-by: Luo Meng <luomeng12@huawei.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/locks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/locks.c b/fs/locks.c
index b8a31c1c4fff3..323e6ee6a6533 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -542,7 +542,7 @@ static int flock64_to_posix_lock(struct file *filp, struct file_lock *fl,
if (l->l_len > 0) {
if (l->l_len - 1 > OFFSET_MAX - fl->fl_start)
return -EOVERFLOW;
- fl->fl_end = fl->fl_start + l->l_len - 1;
+ fl->fl_end = fl->fl_start + (l->l_len - 1);
} else if (l->l_len < 0) {
if (fl->fl_start + l->l_len < 0)
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 003/130] tomoyo: fix clang pointer arithmetic warning
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 002/130] locks: Fix UBSAN undefined behaviour in flock64_to_posix_lock Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 004/130] HID: hid-input: occasionally report stylus battery even if not changed Sasha Levin
` (126 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Arnd Bergmann, Tetsuo Handa, Sasha Levin, linux-security-module,
clang-built-linux
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit d9594e0409651a237903a13c9718df889f43d43b ]
clang warns about additions on NULL pointers being undefined in C:
security/tomoyo/securityfs_if.c:226:59: warning: arithmetic on a null pointer treated as a cast from integer to pointer is a GNU extension [-Wnull-pointer-arithmetic]
securityfs_create_file(name, mode, parent, ((u8 *) NULL) + key,
Change the code to instead use a cast through uintptr_t to avoid
the warning.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/tomoyo/securityfs_if.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/security/tomoyo/securityfs_if.c b/security/tomoyo/securityfs_if.c
index 546281c5b233a..065f4941c4d8c 100644
--- a/security/tomoyo/securityfs_if.c
+++ b/security/tomoyo/securityfs_if.c
@@ -131,8 +131,8 @@ static const struct file_operations tomoyo_self_operations = {
*/
static int tomoyo_open(struct inode *inode, struct file *file)
{
- const int key = ((u8 *) file_inode(file)->i_private)
- - ((u8 *) NULL);
+ const u8 key = (uintptr_t) file_inode(file)->i_private;
+
return tomoyo_open_control(key, file);
}
@@ -223,7 +223,7 @@ static const struct file_operations tomoyo_operations = {
static void __init tomoyo_create_entry(const char *name, const umode_t mode,
struct dentry *parent, const u8 key)
{
- securityfs_create_file(name, mode, parent, ((u8 *) NULL) + key,
+ securityfs_create_file(name, mode, parent, (void *) (uintptr_t) key,
&tomoyo_operations);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 004/130] HID: hid-input: occasionally report stylus battery even if not changed
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 002/130] locks: Fix UBSAN undefined behaviour in flock64_to_posix_lock Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 003/130] tomoyo: fix clang pointer arithmetic warning Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 005/130] crypto: omap-aes - fix the reference count leak of omap device Sasha Levin
` (125 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: dmitry.torokhov, Jiri Kosina, Sasha Levin, linux-input
From: "dmitry.torokhov@gmail.com" <dmitry.torokhov@gmail.com>
[ Upstream commit c6838eeef2fbc7e3e1f83759aa016ae6b70c643e ]
There are styluses that only report their battery status when they are
touching the touchscreen; additionally we currently suppress battery
reports if capacity has not changed. To help userspace recognize how long
ago the device reported battery status, let's send the change event through
if either capacity has changed, or at least 30 seconds have passed since
last report we've let through.
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-input.c | 5 ++++-
include/linux/hid.h | 1 +
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index b2da8476d0d30..54ac835b72357 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -537,9 +537,12 @@ static void hidinput_update_battery(struct hid_device *dev, int value)
capacity = hidinput_scale_battery_capacity(dev, value);
if (dev->battery_status != HID_BATTERY_REPORTED ||
- capacity != dev->battery_capacity) {
+ capacity != dev->battery_capacity ||
+ ktime_after(ktime_get_coarse(), dev->battery_ratelimit_time)) {
dev->battery_capacity = capacity;
dev->battery_status = HID_BATTERY_REPORTED;
+ dev->battery_ratelimit_time =
+ ktime_add_ms(ktime_get_coarse(), 30 * 1000);
power_supply_changed(dev->battery);
}
}
diff --git a/include/linux/hid.h b/include/linux/hid.h
index c7044a14200ea..b05f194f30db0 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -583,6 +583,7 @@ struct hid_device { /* device report descriptor */
__s32 battery_report_id;
enum hid_battery_status battery_status;
bool battery_avoid_query;
+ ktime_t battery_ratelimit_time;
#endif
unsigned long status; /* see STAT flags above */
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 005/130] crypto: omap-aes - fix the reference count leak of omap device
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (2 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 004/130] HID: hid-input: occasionally report stylus battery even if not changed Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 006/130] drm/amd/display: Do not silently accept DCC for multiplane formats Sasha Levin
` (124 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Zhang Qilong, Herbert Xu, Sasha Levin, linux-crypto
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 383e8a823014532ffd81c787ef9009f1c2bd3b79 ]
pm_runtime_get_sync() will increment pm usage counter even
when it returns an error code. We should call put operation
in error handling paths of omap_aes_hw_init.
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/omap-aes.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
index 2f53fbb741001..2f81f347b8fe0 100644
--- a/drivers/crypto/omap-aes.c
+++ b/drivers/crypto/omap-aes.c
@@ -105,6 +105,7 @@ static int omap_aes_hw_init(struct omap_aes_dev *dd)
err = pm_runtime_get_sync(dd->dev);
if (err < 0) {
+ pm_runtime_put_noidle(dd->dev);
dev_err(dd->dev, "failed to get sync: %d\n", err);
return err;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 006/130] drm/amd/display: Do not silently accept DCC for multiplane formats.
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (3 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 005/130] crypto: omap-aes - fix the reference count leak of omap device Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
[not found] ` <MN2PR12MB448885CD6421AD53DCF46EE8F7D80@MN2PR12MB4488.namprd12.prod.outlook.com>
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 007/130] drm/msm: Fix race condition in msm driver with async layer updates Sasha Levin
` (123 subsequent siblings)
128 siblings, 1 reply; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bas Nieuwenhuizen, Alex Deucher, Nicholas Kazlauskas,
Sasha Levin, amd-gfx, dri-devel
From: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
[ Upstream commit b35ce7b364ec80b54f48a8fdf9fb74667774d2da ]
Silently accepting it could result in corruption.
Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index d2dd387c95d86..ce70c42a2c3ec 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2734,7 +2734,7 @@ fill_plane_dcc_attributes(struct amdgpu_device *adev,
return 0;
if (format >= SURFACE_PIXEL_FORMAT_VIDEO_BEGIN)
- return 0;
+ return -EINVAL;
if (!dc->cap_funcs.get_dcc_compression_cap)
return -EINVAL;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 007/130] drm/msm: Fix race condition in msm driver with async layer updates
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (4 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 006/130] drm/amd/display: Do not silently accept DCC for multiplane formats Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 008/130] staging: wimax: depends on NET Sasha Levin
` (122 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Krishna Manikandan, Rob Clark, Rob Clark, Sasha Levin,
linux-arm-msm, dri-devel, freedreno
From: Krishna Manikandan <mkrishn@codeaurora.org>
[ Upstream commit b3d91800d9ac35014e0349292273a6fa7938d402 ]
When there are back to back commits with async cursor update,
there is a case where second commit can program the DPU hw
blocks while first didn't complete flushing config to HW.
Synchronize the compositions such that second commit waits
until first commit flushes the composition.
This change also introduces per crtc commit lock, such that
commits on different crtcs are not blocked by each other.
Changes in v2:
- Use an array of mutexes in kms to handle commit
lock per crtc. (Rob Clark)
Changes in v3:
- Add wrapper functions to handle lock and unlock of
commit_lock for each crtc. (Rob Clark)
Signed-off-by: Krishna Manikandan <mkrishn@codeaurora.org>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_atomic.c | 37 +++++++++++++++++++++-----------
drivers/gpu/drm/msm/msm_kms.h | 6 ++++--
2 files changed, 28 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
index 561bfa48841c3..575e9af9b6fc9 100644
--- a/drivers/gpu/drm/msm/msm_atomic.c
+++ b/drivers/gpu/drm/msm/msm_atomic.c
@@ -55,16 +55,32 @@ static void vblank_put(struct msm_kms *kms, unsigned crtc_mask)
}
}
+static void lock_crtcs(struct msm_kms *kms, unsigned int crtc_mask)
+{
+ struct drm_crtc *crtc;
+
+ for_each_crtc_mask(kms->dev, crtc, crtc_mask)
+ mutex_lock(&kms->commit_lock[drm_crtc_index(crtc)]);
+}
+
+static void unlock_crtcs(struct msm_kms *kms, unsigned int crtc_mask)
+{
+ struct drm_crtc *crtc;
+
+ for_each_crtc_mask(kms->dev, crtc, crtc_mask)
+ mutex_unlock(&kms->commit_lock[drm_crtc_index(crtc)]);
+}
+
static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx)
{
unsigned crtc_mask = BIT(crtc_idx);
trace_msm_atomic_async_commit_start(crtc_mask);
- mutex_lock(&kms->commit_lock);
+ lock_crtcs(kms, crtc_mask);
if (!(kms->pending_crtc_mask & crtc_mask)) {
- mutex_unlock(&kms->commit_lock);
+ unlock_crtcs(kms, crtc_mask);
goto out;
}
@@ -79,7 +95,6 @@ static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx)
*/
trace_msm_atomic_flush_commit(crtc_mask);
kms->funcs->flush_commit(kms, crtc_mask);
- mutex_unlock(&kms->commit_lock);
/*
* Wait for flush to complete:
@@ -90,9 +105,8 @@ static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx)
vblank_put(kms, crtc_mask);
- mutex_lock(&kms->commit_lock);
kms->funcs->complete_commit(kms, crtc_mask);
- mutex_unlock(&kms->commit_lock);
+ unlock_crtcs(kms, crtc_mask);
kms->funcs->disable_commit(kms);
out:
@@ -189,12 +203,11 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state)
* Ensure any previous (potentially async) commit has
* completed:
*/
+ lock_crtcs(kms, crtc_mask);
trace_msm_atomic_wait_flush_start(crtc_mask);
kms->funcs->wait_flush(kms, crtc_mask);
trace_msm_atomic_wait_flush_finish(crtc_mask);
- mutex_lock(&kms->commit_lock);
-
/*
* Now that there is no in-progress flush, prepare the
* current update:
@@ -232,8 +245,7 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state)
}
kms->funcs->disable_commit(kms);
- mutex_unlock(&kms->commit_lock);
-
+ unlock_crtcs(kms, crtc_mask);
/*
* At this point, from drm core's perspective, we
* are done with the atomic update, so we can just
@@ -260,8 +272,7 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state)
*/
trace_msm_atomic_flush_commit(crtc_mask);
kms->funcs->flush_commit(kms, crtc_mask);
- mutex_unlock(&kms->commit_lock);
-
+ unlock_crtcs(kms, crtc_mask);
/*
* Wait for flush to complete:
*/
@@ -271,9 +282,9 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state)
vblank_put(kms, crtc_mask);
- mutex_lock(&kms->commit_lock);
+ lock_crtcs(kms, crtc_mask);
kms->funcs->complete_commit(kms, crtc_mask);
- mutex_unlock(&kms->commit_lock);
+ unlock_crtcs(kms, crtc_mask);
kms->funcs->disable_commit(kms);
drm_atomic_helper_commit_hw_done(state);
diff --git a/drivers/gpu/drm/msm/msm_kms.h b/drivers/gpu/drm/msm/msm_kms.h
index 1cbef6b200b70..2049847b66428 100644
--- a/drivers/gpu/drm/msm/msm_kms.h
+++ b/drivers/gpu/drm/msm/msm_kms.h
@@ -155,7 +155,7 @@ struct msm_kms {
* For async commit, where ->flush_commit() and later happens
* from the crtc's pending_timer close to end of the frame:
*/
- struct mutex commit_lock;
+ struct mutex commit_lock[MAX_CRTCS];
unsigned pending_crtc_mask;
struct msm_pending_timer pending_timers[MAX_CRTCS];
};
@@ -165,7 +165,9 @@ static inline void msm_kms_init(struct msm_kms *kms,
{
unsigned i;
- mutex_init(&kms->commit_lock);
+ for (i = 0; i < ARRAY_SIZE(kms->commit_lock); i++)
+ mutex_init(&kms->commit_lock[i]);
+
kms->funcs = funcs;
for (i = 0; i < ARRAY_SIZE(kms->pending_timers); i++)
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 008/130] staging: wimax: depends on NET
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (5 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 007/130] drm/msm: Fix race condition in msm driver with async layer updates Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 7:29 ` Greg Kroah-Hartman
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 009/130] RDMA/siw: Fix typo of EAGAIN not -EAGAIN in siw_cm_work_handler() Sasha Levin
` (121 subsequent siblings)
128 siblings, 1 reply; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Randy Dunlap, Greg Kroah-Hartman, Jakub Kicinski, Arnd Bergmann,
netdev, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 9364a2cf567187c0a075942c22d1f434c758de5d ]
Fix build errors when CONFIG_NET is not enabled. E.g. (trimmed):
ld: drivers/staging/wimax/op-msg.o: in function `wimax_msg_alloc':
op-msg.c:(.text+0xa9): undefined reference to `__alloc_skb'
ld: op-msg.c:(.text+0xcc): undefined reference to `genlmsg_put'
ld: op-msg.c:(.text+0xfc): undefined reference to `nla_put'
ld: op-msg.c:(.text+0x168): undefined reference to `kfree_skb'
ld: drivers/staging/wimax/op-msg.o: in function `wimax_msg_data_len':
op-msg.c:(.text+0x1ba): undefined reference to `nla_find'
ld: drivers/staging/wimax/op-msg.o: in function `wimax_msg_send':
op-msg.c:(.text+0x311): undefined reference to `init_net'
ld: op-msg.c:(.text+0x326): undefined reference to `netlink_broadcast'
ld: drivers/staging/wimax/stack.o: in function `__wimax_state_change':
stack.c:(.text+0x433): undefined reference to `netif_carrier_off'
ld: stack.c:(.text+0x46b): undefined reference to `netif_carrier_on'
ld: stack.c:(.text+0x478): undefined reference to `netif_tx_wake_queue'
ld: drivers/staging/wimax/stack.o: in function `wimax_subsys_exit':
stack.c:(.exit.text+0xe): undefined reference to `genl_unregister_family'
ld: drivers/staging/wimax/stack.o: in function `wimax_subsys_init':
stack.c:(.init.text+0x1a): undefined reference to `genl_register_family'
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: netdev@vger.kernel.org
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20201102072456.20303-1-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wimax/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/wimax/Kconfig b/net/wimax/Kconfig
index d13762bc4abca..4dcb5eba720a3 100644
--- a/net/wimax/Kconfig
+++ b/net/wimax/Kconfig
@@ -5,6 +5,7 @@
menuconfig WIMAX
tristate "WiMAX Wireless Broadband support"
+ depends on NET
depends on RFKILL || !RFKILL
help
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* Re: [PATCH AUTOSEL 5.4 008/130] staging: wimax: depends on NET
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 008/130] staging: wimax: depends on NET Sasha Levin
@ 2020-12-23 7:29 ` Greg Kroah-Hartman
2020-12-23 14:15 ` Sasha Levin
0 siblings, 1 reply; 139+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-23 7:29 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel, stable, Randy Dunlap, Jakub Kicinski,
Arnd Bergmann, netdev
On Tue, Dec 22, 2020 at 09:16:11PM -0500, Sasha Levin wrote:
> From: Randy Dunlap <rdunlap@infradead.org>
>
> [ Upstream commit 9364a2cf567187c0a075942c22d1f434c758de5d ]
>
> Fix build errors when CONFIG_NET is not enabled. E.g. (trimmed):
>
> ld: drivers/staging/wimax/op-msg.o: in function `wimax_msg_alloc':
> op-msg.c:(.text+0xa9): undefined reference to `__alloc_skb'
> ld: op-msg.c:(.text+0xcc): undefined reference to `genlmsg_put'
> ld: op-msg.c:(.text+0xfc): undefined reference to `nla_put'
> ld: op-msg.c:(.text+0x168): undefined reference to `kfree_skb'
> ld: drivers/staging/wimax/op-msg.o: in function `wimax_msg_data_len':
> op-msg.c:(.text+0x1ba): undefined reference to `nla_find'
> ld: drivers/staging/wimax/op-msg.o: in function `wimax_msg_send':
> op-msg.c:(.text+0x311): undefined reference to `init_net'
> ld: op-msg.c:(.text+0x326): undefined reference to `netlink_broadcast'
> ld: drivers/staging/wimax/stack.o: in function `__wimax_state_change':
> stack.c:(.text+0x433): undefined reference to `netif_carrier_off'
> ld: stack.c:(.text+0x46b): undefined reference to `netif_carrier_on'
> ld: stack.c:(.text+0x478): undefined reference to `netif_tx_wake_queue'
> ld: drivers/staging/wimax/stack.o: in function `wimax_subsys_exit':
> stack.c:(.exit.text+0xe): undefined reference to `genl_unregister_family'
> ld: drivers/staging/wimax/stack.o: in function `wimax_subsys_init':
> stack.c:(.init.text+0x1a): undefined reference to `genl_register_family'
>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Arnd Bergmann <arnd@arndb.de>
> Cc: netdev@vger.kernel.org
> Acked-by: Arnd Bergmann <arnd@arndb.de>
> Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
> Link: https://lore.kernel.org/r/20201102072456.20303-1-rdunlap@infradead.org
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> net/wimax/Kconfig | 1 +
> 1 file changed, 1 insertion(+)
This isn't needed in any backported kernel as it only is relevant when
the code moved to drivers/staging/
thanks,
greg k-h
^ permalink raw reply [flat|nested] 139+ messages in thread
* Re: [PATCH AUTOSEL 5.4 008/130] staging: wimax: depends on NET
2020-12-23 7:29 ` Greg Kroah-Hartman
@ 2020-12-23 14:15 ` Sasha Levin
0 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 14:15 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Randy Dunlap, Jakub Kicinski,
Arnd Bergmann, netdev
On Wed, Dec 23, 2020 at 08:29:39AM +0100, Greg Kroah-Hartman wrote:
>On Tue, Dec 22, 2020 at 09:16:11PM -0500, Sasha Levin wrote:
>> From: Randy Dunlap <rdunlap@infradead.org>
>>
>> [ Upstream commit 9364a2cf567187c0a075942c22d1f434c758de5d ]
>>
>> Fix build errors when CONFIG_NET is not enabled. E.g. (trimmed):
>>
>> ld: drivers/staging/wimax/op-msg.o: in function `wimax_msg_alloc':
>> op-msg.c:(.text+0xa9): undefined reference to `__alloc_skb'
>> ld: op-msg.c:(.text+0xcc): undefined reference to `genlmsg_put'
>> ld: op-msg.c:(.text+0xfc): undefined reference to `nla_put'
>> ld: op-msg.c:(.text+0x168): undefined reference to `kfree_skb'
>> ld: drivers/staging/wimax/op-msg.o: in function `wimax_msg_data_len':
>> op-msg.c:(.text+0x1ba): undefined reference to `nla_find'
>> ld: drivers/staging/wimax/op-msg.o: in function `wimax_msg_send':
>> op-msg.c:(.text+0x311): undefined reference to `init_net'
>> ld: op-msg.c:(.text+0x326): undefined reference to `netlink_broadcast'
>> ld: drivers/staging/wimax/stack.o: in function `__wimax_state_change':
>> stack.c:(.text+0x433): undefined reference to `netif_carrier_off'
>> ld: stack.c:(.text+0x46b): undefined reference to `netif_carrier_on'
>> ld: stack.c:(.text+0x478): undefined reference to `netif_tx_wake_queue'
>> ld: drivers/staging/wimax/stack.o: in function `wimax_subsys_exit':
>> stack.c:(.exit.text+0xe): undefined reference to `genl_unregister_family'
>> ld: drivers/staging/wimax/stack.o: in function `wimax_subsys_init':
>> stack.c:(.init.text+0x1a): undefined reference to `genl_register_family'
>>
>> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> Cc: Jakub Kicinski <kuba@kernel.org>
>> Cc: Arnd Bergmann <arnd@arndb.de>
>> Cc: netdev@vger.kernel.org
>> Acked-by: Arnd Bergmann <arnd@arndb.de>
>> Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
>> Link: https://lore.kernel.org/r/20201102072456.20303-1-rdunlap@infradead.org
>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>> ---
>> net/wimax/Kconfig | 1 +
>> 1 file changed, 1 insertion(+)
>
>This isn't needed in any backported kernel as it only is relevant when
>the code moved to drivers/staging/
I'll drop it, thanks.
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 139+ messages in thread
* [PATCH AUTOSEL 5.4 009/130] RDMA/siw: Fix typo of EAGAIN not -EAGAIN in siw_cm_work_handler()
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (6 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 008/130] staging: wimax: depends on NET Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 010/130] scsi: target: Fix cmd_count ref leak Sasha Levin
` (120 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhang Qilong, Bernard Metzler, Jason Gunthorpe, Sasha Levin, linux-rdma
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 856c2998999958761b6a52208b4edb4d352c4037 ]
The rv cannot be 'EAGAIN' in the previous path, we should use '-EAGAIN' to
check it. For example:
Call trace:
->siw_cm_work_handler
->siw_proc_mpareq
->siw_recv_mpa_rr
Link: https://lore.kernel.org/r/20201028122509.47074-1-zhangqilong3@huawei.com
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Reviewed-by: Bernard Metzler <bmt@zurich.ibm.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/siw/siw_cm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index e3bac1a877bb7..738855cffc18e 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -1055,7 +1055,7 @@ static void siw_cm_work_handler(struct work_struct *w)
cep->state);
}
}
- if (rv && rv != EAGAIN)
+ if (rv && rv != -EAGAIN)
release_cep = 1;
break;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 010/130] scsi: target: Fix cmd_count ref leak
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (7 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 009/130] RDMA/siw: Fix typo of EAGAIN not -EAGAIN in siw_cm_work_handler() Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 011/130] scsi: pm80xx: Make running_req atomic Sasha Levin
` (119 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mike Christie, Himanshu Madhani, Martin K . Petersen,
Sasha Levin, linux-scsi, target-devel
From: Mike Christie <michael.christie@oracle.com>
[ Upstream commit 02dd4914b0bcb8fd8f8cad9817f5715a17466261 ]
percpu_ref_init sets the refcount to 1 and percpu_ref_kill drops it.
Drivers like iSCSI and loop do not call target_sess_cmd_list_set_waiting
during session shutdown, though, so they have been calling percpu_ref_exit
with a refcount still taken and leaking the cmd_counts memory.
Link: https://lore.kernel.org/r/1604257174-4524-3-git-send-email-michael.christie@oracle.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/target_core_transport.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index b1f4be055f838..c43e907eeba8e 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -238,6 +238,14 @@ EXPORT_SYMBOL(transport_init_session);
void transport_uninit_session(struct se_session *se_sess)
{
+ /*
+ * Drivers like iscsi and loop do not call
+ * target_sess_cmd_list_set_waiting during session shutdown so we
+ * have to drop the ref taken at init time here.
+ */
+ if (!se_sess->sess_tearing_down)
+ percpu_ref_put(&se_sess->cmd_count);
+
percpu_ref_exit(&se_sess->cmd_count);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 011/130] scsi: pm80xx: Make running_req atomic
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (8 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 010/130] scsi: target: Fix cmd_count ref leak Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 012/130] scsi: pm80xx: Avoid busywait in FW ready check Sasha Levin
` (118 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Viswas G, Jack Wang, Ruksar Devadi, Martin K . Petersen,
Sasha Levin, linux-scsi
From: Viswas G <Viswas.G@microchip.com>
[ Upstream commit 4a2efd4b89fcaa6e9a7b4ce49a441afaacba00ea ]
Incorrect value of the running_req was causing the driver unload to be
stuck during the SAS lldd_dev_gone notification handling. During SATA I/O
completion, for some error status values, the driver schedules the event
handler and running_req is decremented from that. However, there are some
other error status values (like IO_DS_IN_RECOVERY,
IO_XFER_ERR_LAST_PIO_DATAIN_CRC_ERR) where the I/O has already been
completed by fw/driver so running_req is not decremented.
Also during NCQ error handling, driver itself will initiate READ_LOG_EXT
and ABORT_ALL. When libsas/libata initiate READ_LOG_EXT (0x2F), driver
increments running_req. This will be completed by the driver in
pm80xx_chip_sata_req(), but running_req was not decremented.
Link: https://lore.kernel.org/r/20201102165528.26510-3-Viswas.G@microchip.com.com
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Viswas G <Viswas.G@microchip.com>
Signed-off-by: Ruksar Devadi <Ruksar.devadi@microchip.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_hwi.c | 58 +++++++++++++----
drivers/scsi/pm8001/pm8001_init.c | 2 +-
drivers/scsi/pm8001/pm8001_sas.c | 11 ++--
drivers/scsi/pm8001/pm8001_sas.h | 2 +-
drivers/scsi/pm8001/pm80xx_hwi.c | 101 +++++++++++++++++++++++++++---
5 files changed, 147 insertions(+), 27 deletions(-)
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index 68a8217032d0f..f8e11f672d1e2 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -1558,7 +1558,7 @@ void pm8001_work_fn(struct work_struct *work)
ts->stat = SAS_QUEUE_FULL;
pm8001_dev = ccb->device;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
spin_lock_irqsave(&t->task_state_lock, flags1);
t->task_state_flags &= ~SAS_TASK_STATE_PENDING;
t->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
@@ -1905,7 +1905,7 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
sas_ssp_task_response(pm8001_ha->dev, t, iu);
}
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_ABORTED:
PM8001_IO_DBG(pm8001_ha,
@@ -1921,7 +1921,7 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->stat = SAS_DATA_UNDERRUN;
ts->residual = param;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_NO_DEVICE:
PM8001_IO_DBG(pm8001_ha,
@@ -2135,7 +2135,7 @@ static void mpi_ssp_event(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->stat = SAS_DATA_OVERRUN;
ts->residual = 0;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_BREAK:
PM8001_IO_DBG(pm8001_ha,
@@ -2444,7 +2444,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
pm8001_printk("response to large\n"));
}
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_ABORTED:
PM8001_IO_DBG(pm8001_ha,
@@ -2452,7 +2452,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_ABORTED_TASK;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
/* following cases are to do cases */
case IO_UNDERFLOW:
@@ -2463,19 +2463,23 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->stat = SAS_DATA_UNDERRUN;
ts->residual = param;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_NO_DEVICE:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_NO_DEVICE\n"));
ts->resp = SAS_TASK_UNDELIVERED;
ts->stat = SAS_PHY_DOWN;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_BREAK:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_BREAK\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_INTERRUPTED;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_PHY_NOT_READY:
PM8001_IO_DBG(pm8001_ha,
@@ -2483,6 +2487,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED:
PM8001_IO_DBG(pm8001_ha,
@@ -2491,6 +2497,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_EPROTO;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_ZONE_VIOLATION:
PM8001_IO_DBG(pm8001_ha,
@@ -2498,6 +2506,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_BREAK:
PM8001_IO_DBG(pm8001_ha,
@@ -2505,6 +2515,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_CONT0;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS:
PM8001_IO_DBG(pm8001_ha,
@@ -2544,6 +2556,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_CONN_RATE;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_STP_RESOURCES_BUSY:
PM8001_IO_DBG(pm8001_ha,
@@ -2567,48 +2581,64 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_WRONG_DEST;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_NAK_RECEIVED:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_NAK_RECEIVED\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_NAK_R_ERR;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_ACK_NAK_TIMEOUT:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_ACK_NAK_TIMEOUT\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_NAK_R_ERR;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_DMA:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_DMA\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_ABORTED_TASK;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_SATA_LINK_TIMEOUT:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_SATA_LINK_TIMEOUT\n"));
ts->resp = SAS_TASK_UNDELIVERED;
ts->stat = SAS_DEV_NO_RESPONSE;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_REJECTED_NCQ_MODE:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_REJECTED_NCQ_MODE\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_DATA_UNDERRUN;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_OPEN_RETRY_TIMEOUT:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_OPEN_RETRY_TIMEOUT\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_TO;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_PORT_IN_RESET:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_PORT_IN_RESET\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_DEV_NO_RESPONSE;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_DS_NON_OPERATIONAL:
PM8001_IO_DBG(pm8001_ha,
@@ -2629,6 +2659,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
pm8001_printk(" IO_DS_IN_RECOVERY\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_DEV_NO_RESPONSE;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_DS_IN_ERROR:
PM8001_IO_DBG(pm8001_ha,
@@ -2650,6 +2682,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
default:
PM8001_IO_DBG(pm8001_ha,
@@ -2657,6 +2691,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
/* not allowed case. Therefore, return failed status */
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_DEV_NO_RESPONSE;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
}
spin_lock_irqsave(&t->task_state_lock, flags);
@@ -2733,7 +2769,7 @@ static void mpi_sata_event(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->stat = SAS_DATA_OVERRUN;
ts->residual = 0;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_BREAK:
PM8001_IO_DBG(pm8001_ha,
@@ -2929,7 +2965,7 @@ mpi_smp_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAM_STAT_GOOD;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_ABORTED:
PM8001_IO_DBG(pm8001_ha,
@@ -2937,7 +2973,7 @@ mpi_smp_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_ABORTED_TASK;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OVERFLOW:
PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_UNDERFLOW\n"));
@@ -2945,7 +2981,7 @@ mpi_smp_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->stat = SAS_DATA_OVERRUN;
ts->residual = 0;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_NO_DEVICE:
PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_NO_DEVICE\n"));
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index 3374f553c617a..1fa9d68255686 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -368,7 +368,7 @@ static int pm8001_alloc(struct pm8001_hba_info *pm8001_ha,
pm8001_ha->devices[i].dev_type = SAS_PHY_UNUSED;
pm8001_ha->devices[i].id = i;
pm8001_ha->devices[i].device_id = PM8001_MAX_DEVICES;
- pm8001_ha->devices[i].running_req = 0;
+ atomic_set(&pm8001_ha->devices[i].running_req, 0);
}
pm8001_ha->ccb_info = pm8001_ha->memoryMap.region[CCB_MEM].virt_ptr;
for (i = 0; i < PM8001_MAX_CCB; i++) {
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 36f5bab09f73e..4d3015d49c872 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -454,9 +454,11 @@ static int pm8001_task_exec(struct sas_task *task,
ccb->device = pm8001_dev;
switch (t->task_proto) {
case SAS_PROTOCOL_SMP:
+ atomic_inc(&pm8001_dev->running_req);
rc = pm8001_task_prep_smp(pm8001_ha, ccb);
break;
case SAS_PROTOCOL_SSP:
+ atomic_inc(&pm8001_dev->running_req);
if (is_tmf)
rc = pm8001_task_prep_ssp_tm(pm8001_ha,
ccb, tmf);
@@ -465,6 +467,7 @@ static int pm8001_task_exec(struct sas_task *task,
break;
case SAS_PROTOCOL_SATA:
case SAS_PROTOCOL_STP:
+ atomic_inc(&pm8001_dev->running_req);
rc = pm8001_task_prep_ata(pm8001_ha, ccb);
break;
default:
@@ -478,13 +481,13 @@ static int pm8001_task_exec(struct sas_task *task,
if (rc) {
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("rc is %x\n", rc));
+ atomic_dec(&pm8001_dev->running_req);
goto err_out_tag;
}
/* TODO: select normal or high priority */
spin_lock(&t->task_state_lock);
t->task_state_flags |= SAS_TASK_AT_INITIATOR;
spin_unlock(&t->task_state_lock);
- pm8001_dev->running_req++;
} while (0);
rc = 0;
goto out_done;
@@ -884,11 +887,11 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
PM8001_DISC_DBG(pm8001_ha,
pm8001_printk("found dev[%d:%x] is gone.\n",
pm8001_dev->device_id, pm8001_dev->dev_type));
- if (pm8001_dev->running_req) {
+ if (atomic_read(&pm8001_dev->running_req)) {
spin_unlock_irqrestore(&pm8001_ha->lock, flags);
pm8001_exec_internal_task_abort(pm8001_ha, pm8001_dev ,
dev, 1, 0);
- while (pm8001_dev->running_req)
+ while (atomic_read(&pm8001_dev->running_req))
msleep(20);
spin_lock_irqsave(&pm8001_ha->lock, flags);
}
@@ -966,7 +969,7 @@ void pm8001_open_reject_retry(
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
spin_lock_irqsave(&task->task_state_lock, flags1);
task->task_state_flags &= ~SAS_TASK_STATE_PENDING;
task->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
index ff17c6aff63dc..161a12f884ad3 100644
--- a/drivers/scsi/pm8001/pm8001_sas.h
+++ b/drivers/scsi/pm8001/pm8001_sas.h
@@ -279,7 +279,7 @@ struct pm8001_device {
struct completion *dcompletion;
struct completion *setds_completion;
u32 device_id;
- u32 running_req;
+ atomic_t running_req;
};
struct pm8001_prd_imt {
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 161bf4760eac7..8756bbf2c3896 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -1593,13 +1593,15 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
sas_ssp_task_response(pm8001_ha->dev, t, iu);
}
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_ABORTED:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_ABORTED IOMB Tag\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_ABORTED_TASK;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_UNDERFLOW:
/* SSP Completion with error */
@@ -1610,13 +1612,15 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->stat = SAS_DATA_UNDERRUN;
ts->residual = param;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_NO_DEVICE:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_NO_DEVICE\n"));
ts->resp = SAS_TASK_UNDELIVERED;
ts->stat = SAS_PHY_DOWN;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_BREAK:
PM8001_IO_DBG(pm8001_ha,
@@ -1625,6 +1629,8 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->stat = SAS_OPEN_REJECT;
/* Force the midlayer to retry */
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_PHY_NOT_READY:
PM8001_IO_DBG(pm8001_ha,
@@ -1632,6 +1638,8 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_INVALID_SSP_RSP_FRAME:
PM8001_IO_DBG(pm8001_ha,
@@ -1639,6 +1647,8 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED:
PM8001_IO_DBG(pm8001_ha,
@@ -1646,6 +1656,8 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_EPROTO;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_ZONE_VIOLATION:
PM8001_IO_DBG(pm8001_ha,
@@ -1653,6 +1665,8 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_BREAK:
PM8001_IO_DBG(pm8001_ha,
@@ -1660,6 +1674,8 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS:
case IO_XFER_OPEN_RETRY_BACKOFF_THRESHOLD_REACHED:
@@ -1683,6 +1699,8 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_BAD_DEST;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_CONNECTION_RATE_NOT_SUPPORTED:
PM8001_IO_DBG(pm8001_ha, pm8001_printk(
@@ -1690,6 +1708,8 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_CONN_RATE;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_WRONG_DESTINATION:
PM8001_IO_DBG(pm8001_ha,
@@ -1697,6 +1717,8 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->resp = SAS_TASK_UNDELIVERED;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_WRONG_DEST;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_NAK_RECEIVED:
PM8001_IO_DBG(pm8001_ha,
@@ -1704,18 +1726,24 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_ACK_NAK_TIMEOUT:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_ACK_NAK_TIMEOUT\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_NAK_R_ERR;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_DMA:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_DMA\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_OPEN_RETRY_TIMEOUT:
PM8001_IO_DBG(pm8001_ha,
@@ -1723,18 +1751,24 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_OFFSET_MISMATCH:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_OFFSET_MISMATCH\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_PORT_IN_RESET:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_PORT_IN_RESET\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_DS_NON_OPERATIONAL:
PM8001_IO_DBG(pm8001_ha,
@@ -1751,18 +1785,24 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
pm8001_printk("IO_DS_IN_RECOVERY\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_TM_TAG_NOT_FOUND:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_TM_TAG_NOT_FOUND\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_SSP_EXT_IU_ZERO_LEN_ERROR:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_SSP_EXT_IU_ZERO_LEN_ERROR\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_HW_RESOURCE_BUSY:
PM8001_IO_DBG(pm8001_ha,
@@ -1770,6 +1810,8 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
default:
PM8001_IO_DBG(pm8001_ha,
@@ -1777,6 +1819,8 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
/* not allowed case. Therefore, return failed status */
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
}
PM8001_IO_DBG(pm8001_ha,
@@ -1836,7 +1880,7 @@ static void mpi_ssp_event(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->stat = SAS_DATA_OVERRUN;
ts->residual = 0;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_BREAK:
PM8001_IO_DBG(pm8001_ha,
@@ -2155,7 +2199,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
pm8001_printk("response to large\n"));
}
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_ABORTED:
PM8001_IO_DBG(pm8001_ha,
@@ -2163,7 +2207,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_ABORTED_TASK;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
/* following cases are to do cases */
case IO_UNDERFLOW:
@@ -2174,19 +2218,23 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->stat = SAS_DATA_UNDERRUN;
ts->residual = param;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_NO_DEVICE:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_NO_DEVICE\n"));
ts->resp = SAS_TASK_UNDELIVERED;
ts->stat = SAS_PHY_DOWN;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_BREAK:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_BREAK\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_INTERRUPTED;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_PHY_NOT_READY:
PM8001_IO_DBG(pm8001_ha,
@@ -2194,6 +2242,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED:
PM8001_IO_DBG(pm8001_ha, pm8001_printk(
@@ -2201,6 +2251,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_EPROTO;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_ZONE_VIOLATION:
PM8001_IO_DBG(pm8001_ha,
@@ -2208,6 +2260,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_BREAK:
PM8001_IO_DBG(pm8001_ha,
@@ -2215,6 +2269,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_CONT0;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS:
case IO_XFER_OPEN_RETRY_BACKOFF_THRESHOLD_REACHED:
@@ -2258,6 +2314,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_CONN_RATE;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OPEN_CNX_ERROR_STP_RESOURCES_BUSY:
PM8001_IO_DBG(pm8001_ha, pm8001_printk(
@@ -2280,48 +2338,64 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_WRONG_DEST;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_NAK_RECEIVED:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_NAK_RECEIVED\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_NAK_R_ERR;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_ACK_NAK_TIMEOUT:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_ACK_NAK_TIMEOUT\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_NAK_R_ERR;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_DMA:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_DMA\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_ABORTED_TASK;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_SATA_LINK_TIMEOUT:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_SATA_LINK_TIMEOUT\n"));
ts->resp = SAS_TASK_UNDELIVERED;
ts->stat = SAS_DEV_NO_RESPONSE;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_REJECTED_NCQ_MODE:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_ERROR_REJECTED_NCQ_MODE\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_DATA_UNDERRUN;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_OPEN_RETRY_TIMEOUT:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_XFER_OPEN_RETRY_TIMEOUT\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_TO;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_PORT_IN_RESET:
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("IO_PORT_IN_RESET\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_DEV_NO_RESPONSE;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_DS_NON_OPERATIONAL:
PM8001_IO_DBG(pm8001_ha,
@@ -2342,6 +2416,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
pm8001_printk("IO_DS_IN_RECOVERY\n"));
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_DEV_NO_RESPONSE;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_DS_IN_ERROR:
PM8001_IO_DBG(pm8001_ha,
@@ -2363,6 +2439,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
default:
PM8001_IO_DBG(pm8001_ha,
@@ -2370,6 +2448,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
/* not allowed case. Therefore, return failed status */
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_DEV_NO_RESPONSE;
+ if (pm8001_dev)
+ atomic_dec(&pm8001_dev->running_req);
break;
}
spin_lock_irqsave(&t->task_state_lock, flags);
@@ -2447,7 +2527,7 @@ static void mpi_sata_event(struct pm8001_hba_info *pm8001_ha , void *piomb)
ts->stat = SAS_DATA_OVERRUN;
ts->residual = 0;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_XFER_ERROR_BREAK:
PM8001_IO_DBG(pm8001_ha,
@@ -2664,7 +2744,7 @@ mpi_smp_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAM_STAT_GOOD;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
if (pm8001_ha->smp_exp_mode == SMP_DIRECT) {
PM8001_IO_DBG(pm8001_ha,
pm8001_printk("DIRECT RESPONSE Length:%d\n",
@@ -2687,7 +2767,7 @@ mpi_smp_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_ABORTED_TASK;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_OVERFLOW:
PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_UNDERFLOW\n"));
@@ -2695,7 +2775,7 @@ mpi_smp_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
ts->stat = SAS_DATA_OVERRUN;
ts->residual = 0;
if (pm8001_dev)
- pm8001_dev->running_req--;
+ atomic_dec(&pm8001_dev->running_req);
break;
case IO_NO_DEVICE:
PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_NO_DEVICE\n"));
@@ -4437,6 +4517,7 @@ static int pm80xx_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
flags);
pm8001_ccb_task_free_done(pm8001_ha, task,
ccb, tag);
+ atomic_dec(&pm8001_ha_dev->running_req);
return 0;
}
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 012/130] scsi: pm80xx: Avoid busywait in FW ready check
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (9 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 011/130] scsi: pm80xx: Make running_req atomic Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 013/130] scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition Sasha Levin
` (117 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akshatzen, Jack Wang, Viswas G, Ruksar Devadi,
Radha Ramachandran, Martin K . Petersen, Sasha Levin, linux-scsi
From: akshatzen <akshatzen@google.com>
[ Upstream commit 48cd6b38eb4f2874f091c4776ea1c26e7e4f967e ]
In function check_fw_ready() we busy wait using udelay. The CPU is not
released and we see need_resched failures.
Busy waiting is not necessary since we are in process context and we can
sleep instead. Replace udelay with msleep of 20 ms intervals while waiting
for firmware to become ready.
It has been verified that check_fw_ready is not being used in interrupt
context anywhere, hence it is safe to make this change.
Link: https://lore.kernel.org/r/20201102165528.26510-4-Viswas.G@microchip.com.com
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: akshatzen <akshatzen@google.com>
Signed-off-by: Viswas G <Viswas.G@microchip.com>
Signed-off-by: Ruksar Devadi <Ruksar.devadi@microchip.com>
Signed-off-by: Radha Ramachandran <radha@google.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm80xx_hwi.c | 21 +++++++++++----------
drivers/scsi/pm8001/pm80xx_hwi.h | 6 ++++++
2 files changed, 17 insertions(+), 10 deletions(-)
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 8756bbf2c3896..a3c58cf2d68c9 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -703,6 +703,7 @@ static int mpi_init_check(struct pm8001_hba_info *pm8001_ha)
/**
* check_fw_ready - The LLDD check if the FW is ready, if not, return error.
+ * This function sleeps hence it must not be used in atomic context.
* @pm8001_ha: our hba card information
*/
static int check_fw_ready(struct pm8001_hba_info *pm8001_ha)
@@ -713,16 +714,16 @@ static int check_fw_ready(struct pm8001_hba_info *pm8001_ha)
int ret = 0;
/* reset / PCIe ready */
- max_wait_time = max_wait_count = 100 * 1000; /* 100 milli sec */
+ max_wait_time = max_wait_count = 5; /* 100 milli sec */
do {
- udelay(1);
+ msleep(FW_READY_INTERVAL);
value = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
} while ((value == 0xFFFFFFFF) && (--max_wait_count));
/* check ila status */
- max_wait_time = max_wait_count = 1000 * 1000; /* 1000 milli sec */
+ max_wait_time = max_wait_count = 50; /* 1000 milli sec */
do {
- udelay(1);
+ msleep(FW_READY_INTERVAL);
value = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
} while (((value & SCRATCH_PAD_ILA_READY) !=
SCRATCH_PAD_ILA_READY) && (--max_wait_count));
@@ -735,9 +736,9 @@ static int check_fw_ready(struct pm8001_hba_info *pm8001_ha)
}
/* check RAAE status */
- max_wait_time = max_wait_count = 1800 * 1000; /* 1800 milli sec */
+ max_wait_time = max_wait_count = 90; /* 1800 milli sec */
do {
- udelay(1);
+ msleep(FW_READY_INTERVAL);
value = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
} while (((value & SCRATCH_PAD_RAAE_READY) !=
SCRATCH_PAD_RAAE_READY) && (--max_wait_count));
@@ -750,9 +751,9 @@ static int check_fw_ready(struct pm8001_hba_info *pm8001_ha)
}
/* check iop0 status */
- max_wait_time = max_wait_count = 600 * 1000; /* 600 milli sec */
+ max_wait_time = max_wait_count = 30; /* 600 milli sec */
do {
- udelay(1);
+ msleep(FW_READY_INTERVAL);
value = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
} while (((value & SCRATCH_PAD_IOP0_READY) != SCRATCH_PAD_IOP0_READY) &&
(--max_wait_count));
@@ -768,9 +769,9 @@ static int check_fw_ready(struct pm8001_hba_info *pm8001_ha)
if ((pm8001_ha->chip_id != chip_8008) &&
(pm8001_ha->chip_id != chip_8009)) {
/* 200 milli sec */
- max_wait_time = max_wait_count = 200 * 1000;
+ max_wait_time = max_wait_count = 10;
do {
- udelay(1);
+ msleep(FW_READY_INTERVAL);
value = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
} while (((value & SCRATCH_PAD_IOP1_READY) !=
SCRATCH_PAD_IOP1_READY) && (--max_wait_count));
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h
index dc9ab7689060b..806cf07eefff4 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.h
+++ b/drivers/scsi/pm8001/pm80xx_hwi.h
@@ -1636,3 +1636,9 @@ typedef struct SASProtocolTimerConfig SASProtocolTimerConfig_t;
#define MEMBASE_II_SHIFT_REGISTER 0x1010
#endif
+
+/**
+ * As we know sleep (1~20) ms may result in sleep longer than ~20 ms, hence we
+ * choose 20 ms interval.
+ */
+#define FW_READY_INTERVAL 20
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 013/130] scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (10 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 012/130] scsi: pm80xx: Avoid busywait in FW ready check Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 014/130] fcntl: Fix potential deadlock in send_sig{io, urg}() Sasha Levin
` (116 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: yuuzheng, Jack Wang, Viswas G, Ruksar Devadi, Radha Ramachandran,
Martin K . Petersen, Sasha Levin, linux-scsi
From: yuuzheng <yuuzheng@google.com>
[ Upstream commit 1f889b58716a5f5e3e4fe0e6742c1a4472f29ac1 ]
A use-after-free or null-pointer error occurs when the 251-byte response
data is copied from IOMB buffer to response message buffer in function
pm8001_mpi_get_nvmd_resp().
After sending the command get_nvmd_data(), the caller begins to sleep by
calling wait_for_complete() and waits for the wake-up from calling
complete() in pm8001_mpi_get_nvmd_resp(). Due to unexpected events (e.g.,
interrupt), if response buffer gets freed before memcpy(), a use-after-free
error will occur. To fix this, the complete() should be called after
memcpy().
Link: https://lore.kernel.org/r/20201102165528.26510-5-Viswas.G@microchip.com.com
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: yuuzheng <yuuzheng@google.com>
Signed-off-by: Viswas G <Viswas.G@microchip.com>
Signed-off-by: Ruksar Devadi <Ruksar.devadi@microchip.com>
Signed-off-by: Radha Ramachandran <radha@google.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_hwi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index f8e11f672d1e2..f6d4a7578c80f 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -3232,10 +3232,15 @@ pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
pm8001_ha->memoryMap.region[NVMD].virt_ptr,
fw_control_context->len);
kfree(ccb->fw_control_context);
+ /* To avoid race condition, complete should be
+ * called after the message is copied to
+ * fw_control_context->usrAddr
+ */
+ complete(pm8001_ha->nvmd_completion);
+ PM8001_MSG_DBG(pm8001_ha, pm8001_printk("Set nvm data complete!\n"));
ccb->task = NULL;
ccb->ccb_tag = 0xFFFFFFFF;
pm8001_tag_free(pm8001_ha, tag);
- complete(pm8001_ha->nvmd_completion);
}
int pm8001_mpi_local_phy_ctl(struct pm8001_hba_info *pm8001_ha, void *piomb)
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 014/130] fcntl: Fix potential deadlock in send_sig{io, urg}()
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (11 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 013/130] scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 015/130] mac80211: don't overwrite QoS TID of injected frames Sasha Levin
` (115 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Boqun Feng, syzbot+22e87cdf94021b984aa6,
syzbot+c5e32344981ad9f33750, Jeff Layton, Sasha Levin,
linux-fsdevel
From: Boqun Feng <boqun.feng@gmail.com>
[ Upstream commit 8d1ddb5e79374fb277985a6b3faa2ed8631c5b4c ]
Syzbot reports a potential deadlock found by the newly added recursive
read deadlock detection in lockdep:
[...] ========================================================
[...] WARNING: possible irq lock inversion dependency detected
[...] 5.9.0-rc2-syzkaller #0 Not tainted
[...] --------------------------------------------------------
[...] syz-executor.1/10214 just changed the state of lock:
[...] ffff88811f506338 (&f->f_owner.lock){.+..}-{2:2}, at: send_sigurg+0x1d/0x200
[...] but this lock was taken by another, HARDIRQ-safe lock in the past:
[...] (&dev->event_lock){-...}-{2:2}
[...]
[...]
[...] and interrupts could create inverse lock ordering between them.
[...]
[...]
[...] other info that might help us debug this:
[...] Chain exists of:
[...] &dev->event_lock --> &new->fa_lock --> &f->f_owner.lock
[...]
[...] Possible interrupt unsafe locking scenario:
[...]
[...] CPU0 CPU1
[...] ---- ----
[...] lock(&f->f_owner.lock);
[...] local_irq_disable();
[...] lock(&dev->event_lock);
[...] lock(&new->fa_lock);
[...] <Interrupt>
[...] lock(&dev->event_lock);
[...]
[...] *** DEADLOCK ***
The corresponding deadlock case is as followed:
CPU 0 CPU 1 CPU 2
read_lock(&fown->lock);
spin_lock_irqsave(&dev->event_lock, ...)
write_lock_irq(&filp->f_owner.lock); // wait for the lock
read_lock(&fown-lock); // have to wait until the writer release
// due to the fairness
<interrupted>
spin_lock_irqsave(&dev->event_lock); // wait for the lock
The lock dependency on CPU 1 happens if there exists a call sequence:
input_inject_event():
spin_lock_irqsave(&dev->event_lock,...);
input_handle_event():
input_pass_values():
input_to_handler():
handler->event(): // evdev_event()
evdev_pass_values():
spin_lock(&client->buffer_lock);
__pass_event():
kill_fasync():
kill_fasync_rcu():
read_lock(&fa->fa_lock);
send_sigio():
read_lock(&fown->lock);
To fix this, make the reader in send_sigurg() and send_sigio() use
read_lock_irqsave() and read_lock_irqrestore().
Reported-by: syzbot+22e87cdf94021b984aa6@syzkaller.appspotmail.com
Reported-by: syzbot+c5e32344981ad9f33750@syzkaller.appspotmail.com
Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fcntl.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 3d40771e8e7cf..3dc90e5293e65 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -779,9 +779,10 @@ void send_sigio(struct fown_struct *fown, int fd, int band)
{
struct task_struct *p;
enum pid_type type;
+ unsigned long flags;
struct pid *pid;
- read_lock(&fown->lock);
+ read_lock_irqsave(&fown->lock, flags);
type = fown->pid_type;
pid = fown->pid;
@@ -802,7 +803,7 @@ void send_sigio(struct fown_struct *fown, int fd, int band)
read_unlock(&tasklist_lock);
}
out_unlock_fown:
- read_unlock(&fown->lock);
+ read_unlock_irqrestore(&fown->lock, flags);
}
static void send_sigurg_to_task(struct task_struct *p,
@@ -817,9 +818,10 @@ int send_sigurg(struct fown_struct *fown)
struct task_struct *p;
enum pid_type type;
struct pid *pid;
+ unsigned long flags;
int ret = 0;
- read_lock(&fown->lock);
+ read_lock_irqsave(&fown->lock, flags);
type = fown->pid_type;
pid = fown->pid;
@@ -842,7 +844,7 @@ int send_sigurg(struct fown_struct *fown)
read_unlock(&tasklist_lock);
}
out_unlock_fown:
- read_unlock(&fown->lock);
+ read_unlock_irqrestore(&fown->lock, flags);
return ret;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 015/130] mac80211: don't overwrite QoS TID of injected frames
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (12 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 014/130] fcntl: Fix potential deadlock in send_sig{io, urg}() Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 016/130] staging: ks7010: fix missing destroy_workqueue() on error in ks7010_sdio_probe Sasha Levin
` (114 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mathy Vanhoef, Johannes Berg, Sasha Levin, linux-wireless, netdev
From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
[ Upstream commit 527d675969a1dff17baa270d4447ac1c87058299 ]
Currently ieee80211_set_qos_hdr sets the QoS TID of all frames based
on the value assigned to skb->priority. This means it will also
overwrite the QoS TID of injected frames. The commit 753ffad3d624
("mac80211: fix TID field in monitor mode transmit") prevented
injected frames from being modified because of this by setting
skb->priority to the TID of the injected frame, which assured the
QoS TID will not be changed to a different value. Unfortunately,
this workaround complicates the handling of injected frames because
we can't set skb->priority without affecting the TID value in the
QoS field of injected frames.
To avoid this, and to simplify the next patch, detect if a frame is
injected in ieee80211_set_qos_hdr and if so do not change its QoS
field.
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Link: https://lore.kernel.org/r/20201104061823.197407-4-Mathy.Vanhoef@kuleuven.be
[fix typos in commit message]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/tx.c | 5 +----
net/mac80211/wme.c | 8 ++++++++
2 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 30a0c7c6224b3..11085a4b5ee3a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2280,10 +2280,7 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
payload[7]);
}
- /*
- * Initialize skb->priority for QoS frames. This is put in the TID field
- * of the frame before passing it to the driver.
- */
+ /* Initialize skb->priority for QoS frames */
if (ieee80211_is_data_qos(hdr->frame_control)) {
u8 *p = ieee80211_get_qos_ctl(hdr);
skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 72920d82928c4..8cd157e67fc77 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -249,6 +249,14 @@ void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
p = ieee80211_get_qos_ctl(hdr);
+ /* don't overwrite the QoS field of injected frames */
+ if (info->flags & IEEE80211_TX_CTL_INJECTED) {
+ /* do take into account Ack policy of injected frames */
+ if (*p & IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
+ info->flags |= IEEE80211_TX_CTL_NO_ACK;
+ return;
+ }
+
/* set up the first byte */
/*
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 016/130] staging: ks7010: fix missing destroy_workqueue() on error in ks7010_sdio_probe
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (13 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 015/130] mac80211: don't overwrite QoS TID of injected frames Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 017/130] staging: rtl8192u: fix wrong judgement in rtl8192_rx_isr Sasha Levin
` (113 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Qinglang Miao, Greg Kroah-Hartman, Sasha Levin, devel
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit d1e7550ad081fa5e9260f636dd51e1c496e0fd5f ]
Add the missing destroy_workqueue() before return from
ks7010_sdio_probe in the error handling case.
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201028091552.136445-1-miaoqinglang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/ks7010/ks7010_sdio.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/ks7010/ks7010_sdio.c b/drivers/staging/ks7010/ks7010_sdio.c
index 4b379542ecd50..bd864f9ce37ac 100644
--- a/drivers/staging/ks7010/ks7010_sdio.c
+++ b/drivers/staging/ks7010/ks7010_sdio.c
@@ -1028,10 +1028,12 @@ static int ks7010_sdio_probe(struct sdio_func *func,
ret = register_netdev(priv->net_dev);
if (ret)
- goto err_free_netdev;
+ goto err_destroy_wq;
return 0;
+ err_destroy_wq:
+ destroy_workqueue(priv->wq);
err_free_netdev:
free_netdev(netdev);
err_release_irq:
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 017/130] staging: rtl8192u: fix wrong judgement in rtl8192_rx_isr
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (14 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 016/130] staging: ks7010: fix missing destroy_workqueue() on error in ks7010_sdio_probe Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 018/130] mips: ar7: add missing iounmap() on error in ar7_gpio_init Sasha Levin
` (112 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Zhang Qilong, Greg Kroah-Hartman, Sasha Levin, devel
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 071dc1787a2f8bb636f864c1f306280deea3b1d5 ]
The 'EPERM' cannot appear in the previous path, we
should use '-EPERM' to check it. For example:
Call trace:
->rtl8192_rx_isr
->usb_submit_urb
->usb_hcd_submit_urb
->rh_urb_enqueue
->rh_queue_status
->usb_hcd_link_urb_to_ep
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201028122648.47959-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8192u/r8192U_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index ddc09616248a5..56655a0b16906 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -883,7 +883,7 @@ static void rtl8192_rx_isr(struct urb *urb)
urb->context = skb;
skb_queue_tail(&priv->rx_queue, skb);
err = usb_submit_urb(urb, GFP_ATOMIC);
- if (err && err != EPERM)
+ if (err && err != -EPERM)
netdev_err(dev,
"can not submit rxurb, err is %x, URB status is %x\n",
err, urb->status);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 018/130] mips: ar7: add missing iounmap() on error in ar7_gpio_init
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (15 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 017/130] staging: rtl8192u: fix wrong judgement in rtl8192_rx_isr Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 019/130] mips: cm: add missing iounmap() on error in mips_cm_probe() Sasha Levin
` (111 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Qinglang Miao, Thomas Bogendoerfer, Sasha Levin, linux-mips
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit 5a5aa912f687204d50455d0db36f94dd8de601c2 ]
Add the missing iounmap() of gpch->regs before return from
ar7_gpio_init() in the error handling case.
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/ar7/gpio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/mips/ar7/gpio.c b/arch/mips/ar7/gpio.c
index 2292e55c12e23..b7ad7a3ecb6d7 100644
--- a/arch/mips/ar7/gpio.c
+++ b/arch/mips/ar7/gpio.c
@@ -319,6 +319,7 @@ int __init ar7_gpio_init(void)
if (ret) {
printk(KERN_ERR "%s: failed to add gpiochip\n",
gpch->chip.label);
+ iounmap(gpch->regs);
return ret;
}
printk(KERN_INFO "%s: registered %d GPIOs\n",
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 019/130] mips: cm: add missing iounmap() on error in mips_cm_probe()
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (16 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 018/130] mips: ar7: add missing iounmap() on error in ar7_gpio_init Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 020/130] locktorture: Prevent hangs for invalid arguments Sasha Levin
` (110 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Qinglang Miao, Thomas Bogendoerfer, Sasha Levin, linux-mips
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit 2673ecf9586551c5bcee499c1cc1949f6f7cc9a1 ]
Add the missing iounmap() of iounmap(mips_gcr_base) before
return from mips_cm_probe() in the error handling case.
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/kernel/mips-cm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
index a9eab83d9148d..f6a82ad010603 100644
--- a/arch/mips/kernel/mips-cm.c
+++ b/arch/mips/kernel/mips-cm.c
@@ -224,6 +224,7 @@ int mips_cm_probe(void)
if ((base_reg & CM_GCR_BASE_GCRBASE) != addr) {
pr_err("GCRs appear to have been moved (expected them at 0x%08lx)!\n",
(unsigned long)addr);
+ iounmap(mips_gcr_base);
mips_gcr_base = NULL;
return -ENODEV;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 020/130] locktorture: Prevent hangs for invalid arguments
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (17 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 019/130] mips: cm: add missing iounmap() on error in mips_cm_probe() Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 021/130] torture: Prevent jitter processes from delaying failed run Sasha Levin
` (109 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Paul E. McKenney, Sasha Levin
From: "Paul E. McKenney" <paulmck@kernel.org>
[ Upstream commit 6b74fa0a776e3715d385b23d29db469179c825b0 ]
If an locktorture torture-test run is given a bad kvm.sh argument, the
test will complain to the console, which is good. What is bad is that
from the user's perspective, it will just hang for the time specified
by the --duration argument. This commit therefore forces an immediate
kernel shutdown if a lock_torture_init()-time error occurs, thus avoiding
the appearance of a hang. It also forces a console splat in this case
to clearly indicate the presence of an error.
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/locking/locktorture.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c
index e09562818bb74..410b0c586ba83 100644
--- a/kernel/locking/locktorture.c
+++ b/kernel/locking/locktorture.c
@@ -30,6 +30,7 @@
#include <linux/slab.h>
#include <linux/percpu-rwsem.h>
#include <linux/torture.h>
+#include <linux/reboot.h>
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Paul E. McKenney <paulmck@linux.ibm.com>");
@@ -1044,6 +1045,10 @@ static int __init lock_torture_init(void)
unwind:
torture_init_end();
lock_torture_cleanup();
+ if (shutdown_secs) {
+ WARN_ON(!IS_MODULE(CONFIG_LOCK_TORTURE_TEST));
+ kernel_power_off();
+ }
return firsterr;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 021/130] torture: Prevent jitter processes from delaying failed run
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (18 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 020/130] locktorture: Prevent hangs for invalid arguments Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 022/130] rcutorture: Prevent hangs for invalid arguments Sasha Levin
` (108 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Paul E. McKenney, Sasha Levin, rcu, linux-kselftest
From: "Paul E. McKenney" <paulmck@kernel.org>
[ Upstream commit c64659ef29e3901be0900ec6fb0485fa3dbdcfd8 ]
Even when the kernel panics and qemu dies, runs with jitter enabled will
continue uselessly until the jitter.sh processes terminate. This can
be annoying if a planned one-hour run instead dies during boot.
This commit therefore kills the jitter.sh processes when the run ends
more than one minute prior to the termination time specified by the
kvm.sh --duration argument or its default.
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/rcutorture/bin/kvm-test-1-run.sh | 14 ++++++++++++++
tools/testing/selftests/rcutorture/bin/kvm.sh | 5 ++++-
2 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh b/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
index 33c6696197364..a0e01a69d0d25 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
@@ -197,6 +197,20 @@ do
echo "ps -fp $killpid" >> $resdir/Warnings 2>&1
ps -fp $killpid >> $resdir/Warnings 2>&1
fi
+ # Reduce probability of PID reuse by allowing a one-minute buffer
+ if test $((kruntime + 60)) -lt $seconds && test -s "$resdir/../jitter_pids"
+ then
+ awk < "$resdir/../jitter_pids" '
+ NF > 0 {
+ pidlist = pidlist " " $1;
+ n++;
+ }
+ END {
+ if (n > 0) {
+ print "kill " pidlist;
+ }
+ }' | sh
+ fi
else
echo ' ---' `date`: "Kernel done"
fi
diff --git a/tools/testing/selftests/rcutorture/bin/kvm.sh b/tools/testing/selftests/rcutorture/bin/kvm.sh
index 72518580df236..a9a6f81d9564c 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm.sh
@@ -404,8 +404,11 @@ function dump(first, pastlast, batchnum)
print "if test -n \"$needqemurun\""
print "then"
print "\techo ---- Starting kernels. `date` | tee -a " rd "log";
- for (j = 0; j < njitter; j++)
+ print "\techo > " rd "jitter_pids"
+ for (j = 0; j < njitter; j++) {
print "\tjitter.sh " j " " dur " " ja[2] " " ja[3] "&"
+ print "\techo $! >> " rd "jitter_pids"
+ }
print "\twait"
print "\techo ---- All kernel runs complete. `date` | tee -a " rd "log";
print "else"
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 022/130] rcutorture: Prevent hangs for invalid arguments
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (19 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 021/130] torture: Prevent jitter processes from delaying failed run Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 023/130] rsi: Fix TX EAPOL packet handling against iwlwifi AP Sasha Levin
` (107 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Paul E. McKenney, Sasha Levin, rcu
From: "Paul E. McKenney" <paulmck@kernel.org>
[ Upstream commit 4994684ce10924a0302567c315c91b0a64eeef46 ]
If an rcutorture torture-test run is given a bad kvm.sh argument, the
test will complain to the console, which is good. What is bad is that
from the user's perspective, it will just hang for the time specified
by the --duration argument. This commit therefore forces an immediate
kernel shutdown if a rcu_torture_init()-time error occurs, thus avoiding
the appearance of a hang. It also forces a console splat in this case
to clearly indicate the presence of an error.
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/rcutorture.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 3c9feca1eab17..27f0c48f46f4e 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -2347,7 +2347,6 @@ rcu_torture_init(void)
for (i = 0; i < ARRAY_SIZE(torture_ops); i++)
pr_cont(" %s", torture_ops[i]->name);
pr_cont("\n");
- WARN_ON(!IS_MODULE(CONFIG_RCU_TORTURE_TEST));
firsterr = -EINVAL;
cur_ops = NULL;
goto unwind;
@@ -2507,6 +2506,10 @@ rcu_torture_init(void)
unwind:
torture_init_end();
rcu_torture_cleanup();
+ if (shutdown_secs) {
+ WARN_ON(!IS_MODULE(CONFIG_RCU_TORTURE_TEST));
+ kernel_power_off();
+ }
return firsterr;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 023/130] rsi: Fix TX EAPOL packet handling against iwlwifi AP
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (20 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 022/130] rcutorture: Prevent hangs for invalid arguments Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 024/130] drm: panel: simple: add missing platform_driver_unregister() in panel_simple_init Sasha Levin
` (106 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Marek Vasut, Angus Ainslie, David S . Miller, Jakub Kicinski,
Kalle Valo, Lee Jones, Martin Kepplinger, Sebastian Krzyszkowiak,
Siva Rebbagondla, linux-wireless, netdev, Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit 65277100caa2f2c62b6f3c4648b90d6f0435f3bc ]
In case RSI9116 SDIO WiFi operates in STA mode against Intel 9260 in AP mode,
the association fails. The former is using wpa_supplicant during association,
the later is set up using hostapd:
iwl$ cat hostapd.conf
interface=wlp1s0
ssid=test
country_code=DE
hw_mode=g
channel=1
wpa=2
wpa_passphrase=test
wpa_key_mgmt=WPA-PSK
iwl$ hostapd -d hostapd.conf
rsi$ wpa_supplicant -i wlan0 -c <(wpa_passphrase test test)
The problem is that the TX EAPOL data descriptor RSI_DESC_REQUIRE_CFM_TO_HOST
flag and extended descriptor EAPOL4_CONFIRM frame type are not set in case the
AP is iwlwifi, because in that case the TX EAPOL packet is 2 bytes shorter.
The downstream vendor driver has this change in place already [1], however
there is no explanation for it, neither is there any commit history from which
such explanation could be obtained.
[1] https://github.com/SiliconLabs/RS911X-nLink-OSD/blob/master/rsi/rsi_91x_hal.c#L238
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Angus Ainslie <angus@akkea.ca>
Cc: David S. Miller <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Lee Jones <lee.jones@linaro.org>
Cc: Martin Kepplinger <martink@posteo.de>
Cc: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Cc: Siva Rebbagondla <siva8118@gmail.com>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201015111616.429220-1-marex@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/rsi/rsi_91x_hal.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
index 6f8d5f9a9f7e6..a07304405b2cc 100644
--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -248,7 +248,8 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb)
rsi_set_len_qno(&data_desc->len_qno,
(skb->len - FRAME_DESC_SZ),
RSI_WIFI_MGMT_Q);
- if ((skb->len - header_size) == EAPOL4_PACKET_LEN) {
+ if (((skb->len - header_size) == EAPOL4_PACKET_LEN) ||
+ ((skb->len - header_size) == EAPOL4_PACKET_LEN - 2)) {
data_desc->misc_flags |=
RSI_DESC_REQUIRE_CFM_TO_HOST;
xtend_desc->confirm_frame_type = EAPOL4_CONFIRM;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 024/130] drm: panel: simple: add missing platform_driver_unregister() in panel_simple_init
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (21 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 023/130] rsi: Fix TX EAPOL packet handling against iwlwifi AP Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 025/130] drm/ast: Fixed 1920x1080 sync. polarity issue Sasha Levin
` (105 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Qinglang Miao, Sam Ravnborg, Sasha Levin, dri-devel
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit f2e66f212a9de04afc2caa5ec79057c0ac75c728 ]
Add the missing platform_driver_unregister() before return
from panel_simple_init in the error handling case when failed
to register panel_simple_dsi_driver with CONFIG_DRM_MIPI_DSI
enabled.
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20201031011856.137307-1-miaoqinglang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-simple.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index f0ea782df836d..579d53e9a769c 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -3777,8 +3777,10 @@ static int __init panel_simple_init(void)
if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) {
err = mipi_dsi_driver_register(&panel_simple_dsi_driver);
- if (err < 0)
+ if (err < 0) {
+ platform_driver_unregister(&panel_simple_platform_driver);
return err;
+ }
}
return 0;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 025/130] drm/ast: Fixed 1920x1080 sync. polarity issue
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (22 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 024/130] drm: panel: simple: add missing platform_driver_unregister() in panel_simple_init Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 026/130] s390/trng: set quality to 1024 Sasha Levin
` (104 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: KuoHsiang Chou, Thomas Zimmermann, Sasha Levin, dri-devel
From: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>
[ Upstream commit 2d26123dd9075df82f217364f585a3a6aab5412d ]
[Bug] Change the vertical synchroous polary of 1920x1080 @60Hz
from Negtive to Positive
Signed-off-by: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20201105094729.106059-1-kuohsiang_chou@aspeedtech.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/ast/ast_tables.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/ast/ast_tables.h b/drivers/gpu/drm/ast/ast_tables.h
index d665dd5af5dd8..dbe1cc620f6e6 100644
--- a/drivers/gpu/drm/ast/ast_tables.h
+++ b/drivers/gpu/drm/ast/ast_tables.h
@@ -293,10 +293,10 @@ static const struct ast_vbios_enhtable res_1600x900[] = {
static const struct ast_vbios_enhtable res_1920x1080[] = {
{2200, 1920, 88, 44, 1125, 1080, 4, 5, VCLK148_5, /* 60Hz */
- (SyncNP | Charx8Dot | LineCompareOff | WideScreenMode | NewModeInfo |
+ (SyncPP | Charx8Dot | LineCompareOff | WideScreenMode | NewModeInfo |
AST2500PreCatchCRT), 60, 1, 0x38 },
{2200, 1920, 88, 44, 1125, 1080, 4, 5, VCLK148_5, /* 60Hz */
- (SyncNP | Charx8Dot | LineCompareOff | WideScreenMode | NewModeInfo |
+ (SyncPP | Charx8Dot | LineCompareOff | WideScreenMode | NewModeInfo |
AST2500PreCatchCRT), 0xFF, 1, 0x38 },
};
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 026/130] s390/trng: set quality to 1024
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (23 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 025/130] drm/ast: Fixed 1920x1080 sync. polarity issue Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 027/130] Bluetooth: hidp: use correct wait queue when removing ctrl_wait Sasha Levin
` (103 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Christian Borntraeger, Harald Freudenberger, Heiko Carstens,
Sasha Levin, linux-crypto
From: Christian Borntraeger <borntraeger@de.ibm.com>
[ Upstream commit d041315ef75cf52df19613f56a2da2c5911c163c ]
The s390-trng does provide 100% entropy. The quality value is supported
to be between 1 and 1024 and not 1..1000. Use 1024 to make this driver
the preferred one. If we ever have a better driver that has the same
quality but is faster we can change this again when merging the new
driver. No need to be conservative.
This makes sure that the hw variant is preferred over things like
virtio-rng, where the hypervisor has a potential to be misconfigured
and thus should have a slightly lower confidence.
Cc: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/s390-trng.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/char/hw_random/s390-trng.c b/drivers/char/hw_random/s390-trng.c
index 413cacbb08e26..7c673afd72419 100644
--- a/drivers/char/hw_random/s390-trng.c
+++ b/drivers/char/hw_random/s390-trng.c
@@ -192,14 +192,15 @@ static int trng_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait)
/*
* hwrng register struct
- * The trng is suppost to have 100% entropy, and thus
- * we register with a very high quality value.
+ * The trng is supposed to have 100% entropy, and thus we register with a very
+ * high quality value. If we ever have a better driver in the future, we should
+ * change this value again when we merge this driver.
*/
static struct hwrng trng_hwrng_dev = {
.name = "s390-trng",
.data_read = trng_hwrng_data_read,
.read = trng_hwrng_read,
- .quality = 999,
+ .quality = 1024,
};
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 027/130] Bluetooth: hidp: use correct wait queue when removing ctrl_wait
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (24 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 026/130] s390/trng: set quality to 1024 Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 028/130] binder: change error code from postive to negative in binder_transaction Sasha Levin
` (102 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ole Bjørn Midtbø,
Marcel Holtmann, Sasha Levin, linux-bluetooth, netdev
From: Ole Bjørn Midtbø <omidtbo@cisco.com>
[ Upstream commit cca342d98bef68151a80b024f7bf5f388d1fbdea ]
A different wait queue was used when removing ctrl_wait than when adding
it. This effectively made the remove operation without locking compared
to other operations on the wait queue ctrl_wait was part of. This caused
issues like below where dead000000000100 is LIST_POISON1 and
dead000000000200 is LIST_POISON2.
list_add corruption. next->prev should be prev (ffffffc1b0a33a08), \
but was dead000000000200. (next=ffffffc03ac77de0).
------------[ cut here ]------------
CPU: 3 PID: 2138 Comm: bluetoothd Tainted: G O 4.4.238+ #9
...
---[ end trace 0adc2158f0646eac ]---
Call trace:
[<ffffffc000443f78>] __list_add+0x38/0xb0
[<ffffffc0000f0d04>] add_wait_queue+0x4c/0x68
[<ffffffc00020eecc>] __pollwait+0xec/0x100
[<ffffffc000d1556c>] bt_sock_poll+0x74/0x200
[<ffffffc000bdb8a8>] sock_poll+0x110/0x128
[<ffffffc000210378>] do_sys_poll+0x220/0x480
[<ffffffc0002106f0>] SyS_poll+0x80/0x138
[<ffffffc00008510c>] __sys_trace_return+0x0/0x4
Unable to handle kernel paging request at virtual address dead000000000100
...
CPU: 4 PID: 5387 Comm: kworker/u15:3 Tainted: G W O 4.4.238+ #9
...
Call trace:
[<ffffffc0000f079c>] __wake_up_common+0x7c/0xa8
[<ffffffc0000f0818>] __wake_up+0x50/0x70
[<ffffffc000be11b0>] sock_def_wakeup+0x58/0x60
[<ffffffc000de5e10>] l2cap_sock_teardown_cb+0x200/0x224
[<ffffffc000d3f2ac>] l2cap_chan_del+0xa4/0x298
[<ffffffc000d45ea0>] l2cap_conn_del+0x118/0x198
[<ffffffc000d45f8c>] l2cap_disconn_cfm+0x6c/0x78
[<ffffffc000d29934>] hci_event_packet+0x564/0x2e30
[<ffffffc000d19b0c>] hci_rx_work+0x10c/0x360
[<ffffffc0000c2218>] process_one_work+0x268/0x460
[<ffffffc0000c2678>] worker_thread+0x268/0x480
[<ffffffc0000c94e0>] kthread+0x118/0x128
[<ffffffc000085070>] ret_from_fork+0x10/0x20
---[ end trace 0adc2158f0646ead ]---
Signed-off-by: Ole Bjørn Midtbø <omidtbo@cisco.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hidp/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index bef84b95e2c47..ac98e3b37ab47 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -1290,7 +1290,7 @@ static int hidp_session_thread(void *arg)
/* cleanup runtime environment */
remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
- remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait);
+ remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait);
wake_up_interruptible(&session->report_queue);
hidp_del_timer(session);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 028/130] binder: change error code from postive to negative in binder_transaction
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (25 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 027/130] Bluetooth: hidp: use correct wait queue when removing ctrl_wait Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 029/130] net: skb_vlan_untag(): don't reset transport offset if set by GRO layer Sasha Levin
` (101 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhang Qilong, Martijn Coenen, Christian Brauner,
Greg Kroah-Hartman, Sasha Levin, devel
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 88f6c77927e4aee04e0193fd94e13a55753a72b0 ]
Depending on the context, the error return value
here (extra_buffers_size < added_size) should be
negative.
Acked-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201026110314.135481-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/android/binder.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index b62b1ab6bb699..6091a3e20506d 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3107,7 +3107,7 @@ static void binder_transaction(struct binder_proc *proc,
if (extra_buffers_size < added_size) {
/* integer overflow of extra_buffers_size */
return_error = BR_FAILED_REPLY;
- return_error_param = EINVAL;
+ return_error_param = -EINVAL;
return_error_line = __LINE__;
goto err_bad_extra_size;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 029/130] net: skb_vlan_untag(): don't reset transport offset if set by GRO layer
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (26 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 028/130] binder: change error code from postive to negative in binder_transaction Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 030/130] drm/omap: Fix runtime PM imbalance on error Sasha Levin
` (100 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alexander Lobakin, Jakub Kicinski, Sasha Levin, netdev
From: Alexander Lobakin <alobakin@pm.me>
[ Upstream commit 8be33ecfc1ffd2da20cc29e957e4cb6eb99310cb ]
Similar to commit fda55eca5a33f
("net: introduce skb_transport_header_was_set()"), avoid resetting
transport offsets that were already set by GRO layer. This not only
mirrors the behavior of __netif_receive_skb_core(), but also makes
sense when it comes to UDP GSO fraglists forwarding: transport offset
of such skbs is set only once by GRO receive callback and remains
untouched and correct up to the xmitting driver in 1:1 case, but
becomes junk after untagging in ingress VLAN case and breaks UDP
GSO offload. This does not happen after this change, and all types
of forwarding of UDP GSO fraglists work as expected.
Since v1 [1]:
- keep the code 1:1 with __netif_receive_skb_core() (Jakub).
[1] https://lore.kernel.org/netdev/zYurwsZRN7BkqSoikWQLVqHyxz18h4LhHU4NFa2Vw@cp4-web-038.plabs.ch
Signed-off-by: Alexander Lobakin <alobakin@pm.me>
Link: https://lore.kernel.org/r/7JgIkgEztzt0W6ZtC9V9Cnk5qfkrUFYcpN871syCi8@cp4-web-040.plabs.ch
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/skbuff.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a0486dcf5425b..5f9035f462445 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5333,7 +5333,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb)
goto err_free;
skb_reset_network_header(skb);
- skb_reset_transport_header(skb);
+ if (!skb_transport_header_was_set(skb))
+ skb_reset_transport_header(skb);
skb_reset_mac_len(skb);
return skb;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 030/130] drm/omap: Fix runtime PM imbalance on error
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (27 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 029/130] net: skb_vlan_untag(): don't reset transport offset if set by GRO layer Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 031/130] mwifiex: pcie: skip cancel_work_sync() on reset failure path Sasha Levin
` (99 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Dinghao Liu, Tomi Valkeinen, Sasha Levin, dri-devel
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
[ Upstream commit a5d704d33245b0799947a3008f9f376dba4d5c91 ]
pm_runtime_get_sync() increments the runtime PM usage counter
even when it returns an error code. However, users of its
direct wrappers in omapdrm assume that PM usage counter will
not change on error. Thus a pairing decrement is needed on
the error handling path for these wrappers to keep the counter
balanced.
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200822065743.13671-1-dinghao.liu@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/omapdrm/dss/dispc.c | 7 +++++--
drivers/gpu/drm/omapdrm/dss/dsi.c | 7 +++++--
drivers/gpu/drm/omapdrm/dss/dss.c | 7 +++++--
drivers/gpu/drm/omapdrm/dss/hdmi4.c | 6 +++---
drivers/gpu/drm/omapdrm/dss/hdmi5.c | 6 +++---
drivers/gpu/drm/omapdrm/dss/venc.c | 7 +++++--
6 files changed, 26 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/omapdrm/dss/dispc.c b/drivers/gpu/drm/omapdrm/dss/dispc.c
index ed0ccbeed70f2..d31ce81f03e7c 100644
--- a/drivers/gpu/drm/omapdrm/dss/dispc.c
+++ b/drivers/gpu/drm/omapdrm/dss/dispc.c
@@ -664,8 +664,11 @@ int dispc_runtime_get(struct dispc_device *dispc)
DSSDBG("dispc_runtime_get\n");
r = pm_runtime_get_sync(&dispc->pdev->dev);
- WARN_ON(r < 0);
- return r < 0 ? r : 0;
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_noidle(&dispc->pdev->dev);
+ return r;
+ }
+ return 0;
}
void dispc_runtime_put(struct dispc_device *dispc)
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index b30fcaa2d0f55..a821359879922 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -1112,8 +1112,11 @@ static int dsi_runtime_get(struct dsi_data *dsi)
DSSDBG("dsi_runtime_get\n");
r = pm_runtime_get_sync(dsi->dev);
- WARN_ON(r < 0);
- return r < 0 ? r : 0;
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_noidle(dsi->dev);
+ return r;
+ }
+ return 0;
}
static void dsi_runtime_put(struct dsi_data *dsi)
diff --git a/drivers/gpu/drm/omapdrm/dss/dss.c b/drivers/gpu/drm/omapdrm/dss/dss.c
index ac93dae2a9c84..f4fedaa7b6b33 100644
--- a/drivers/gpu/drm/omapdrm/dss/dss.c
+++ b/drivers/gpu/drm/omapdrm/dss/dss.c
@@ -858,8 +858,11 @@ int dss_runtime_get(struct dss_device *dss)
DSSDBG("dss_runtime_get\n");
r = pm_runtime_get_sync(&dss->pdev->dev);
- WARN_ON(r < 0);
- return r < 0 ? r : 0;
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_noidle(&dss->pdev->dev);
+ return r;
+ }
+ return 0;
}
void dss_runtime_put(struct dss_device *dss)
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4.c b/drivers/gpu/drm/omapdrm/dss/hdmi4.c
index 0f557fad4513f..6564285a4a2f7 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi4.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi4.c
@@ -41,10 +41,10 @@ static int hdmi_runtime_get(struct omap_hdmi *hdmi)
DSSDBG("hdmi_runtime_get\n");
r = pm_runtime_get_sync(&hdmi->pdev->dev);
- WARN_ON(r < 0);
- if (r < 0)
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_noidle(&hdmi->pdev->dev);
return r;
-
+ }
return 0;
}
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi5.c b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
index d9463b3325543..0d7267e25681e 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi5.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
@@ -42,10 +42,10 @@ static int hdmi_runtime_get(struct omap_hdmi *hdmi)
DSSDBG("hdmi_runtime_get\n");
r = pm_runtime_get_sync(&hdmi->pdev->dev);
- WARN_ON(r < 0);
- if (r < 0)
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_noidle(&hdmi->pdev->dev);
return r;
-
+ }
return 0;
}
diff --git a/drivers/gpu/drm/omapdrm/dss/venc.c b/drivers/gpu/drm/omapdrm/dss/venc.c
index 596a297d58139..301c7c4b2ed2e 100644
--- a/drivers/gpu/drm/omapdrm/dss/venc.c
+++ b/drivers/gpu/drm/omapdrm/dss/venc.c
@@ -403,8 +403,11 @@ static int venc_runtime_get(struct venc_device *venc)
DSSDBG("venc_runtime_get\n");
r = pm_runtime_get_sync(&venc->pdev->dev);
- WARN_ON(r < 0);
- return r < 0 ? r : 0;
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_noidle(&venc->pdev->dev);
+ return r;
+ }
+ return 0;
}
static void venc_runtime_put(struct venc_device *venc)
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 031/130] mwifiex: pcie: skip cancel_work_sync() on reset failure path
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (28 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 030/130] drm/omap: Fix runtime PM imbalance on error Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 032/130] drm/amd/amdgpu: Add rev_id workaround logic for SRIOV setup Sasha Levin
` (98 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tsuchiya Yuto, Maximilian Luz, Kalle Valo, Sasha Levin,
linux-wireless, netdev
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit 4add4d988f95f47493500a7a19c623827061589b ]
If a reset is performed, but even the reset fails for some reasons (e.g.,
on Surface devices, the fw reset requires another quirks),
cancel_work_sync() hangs in mwifiex_cleanup_pcie().
# firmware went into a bad state
[...]
[ 1608.281690] mwifiex_pcie 0000:03:00.0: info: shutdown mwifiex...
[ 1608.282724] mwifiex_pcie 0000:03:00.0: rx_pending=0, tx_pending=1, cmd_pending=0
[ 1608.292400] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
[ 1608.292405] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
# reset performed after firmware went into a bad state
[ 1609.394320] mwifiex_pcie 0000:03:00.0: WLAN FW already running! Skip FW dnld
[ 1609.394335] mwifiex_pcie 0000:03:00.0: WLAN FW is active
# but even the reset failed
[ 1619.499049] mwifiex_pcie 0000:03:00.0: mwifiex_cmd_timeout_func: Timeout cmd id = 0xfa, act = 0xe000
[ 1619.499094] mwifiex_pcie 0000:03:00.0: num_data_h2c_failure = 0
[ 1619.499103] mwifiex_pcie 0000:03:00.0: num_cmd_h2c_failure = 0
[ 1619.499110] mwifiex_pcie 0000:03:00.0: is_cmd_timedout = 1
[ 1619.499117] mwifiex_pcie 0000:03:00.0: num_tx_timeout = 0
[ 1619.499124] mwifiex_pcie 0000:03:00.0: last_cmd_index = 0
[ 1619.499133] mwifiex_pcie 0000:03:00.0: last_cmd_id: fa 00 07 01 07 01 07 01 07 01
[ 1619.499140] mwifiex_pcie 0000:03:00.0: last_cmd_act: 00 e0 00 00 00 00 00 00 00 00
[ 1619.499147] mwifiex_pcie 0000:03:00.0: last_cmd_resp_index = 3
[ 1619.499155] mwifiex_pcie 0000:03:00.0: last_cmd_resp_id: 07 81 07 81 07 81 07 81 07 81
[ 1619.499162] mwifiex_pcie 0000:03:00.0: last_event_index = 2
[ 1619.499169] mwifiex_pcie 0000:03:00.0: last_event: 58 00 58 00 58 00 58 00 58 00
[ 1619.499177] mwifiex_pcie 0000:03:00.0: data_sent=0 cmd_sent=1
[ 1619.499185] mwifiex_pcie 0000:03:00.0: ps_mode=0 ps_state=0
[ 1619.499215] mwifiex_pcie 0000:03:00.0: info: _mwifiex_fw_dpc: unregister device
# mwifiex_pcie_work hang happening
[ 1823.233923] INFO: task kworker/3:1:44 blocked for more than 122 seconds.
[ 1823.233932] Tainted: G WC OE 5.10.0-rc1-1-mainline #1
[ 1823.233935] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 1823.233940] task:kworker/3:1 state:D stack: 0 pid: 44 ppid: 2 flags:0x00004000
[ 1823.233960] Workqueue: events mwifiex_pcie_work [mwifiex_pcie]
[ 1823.233965] Call Trace:
[ 1823.233981] __schedule+0x292/0x820
[ 1823.233990] schedule+0x45/0xe0
[ 1823.233995] schedule_timeout+0x11c/0x160
[ 1823.234003] wait_for_completion+0x9e/0x100
[ 1823.234012] __flush_work.isra.0+0x156/0x210
[ 1823.234018] ? flush_workqueue_prep_pwqs+0x130/0x130
[ 1823.234026] __cancel_work_timer+0x11e/0x1a0
[ 1823.234035] mwifiex_cleanup_pcie+0x28/0xd0 [mwifiex_pcie]
[ 1823.234049] mwifiex_free_adapter+0x24/0xe0 [mwifiex]
[ 1823.234060] _mwifiex_fw_dpc+0x294/0x560 [mwifiex]
[ 1823.234074] mwifiex_reinit_sw+0x15d/0x300 [mwifiex]
[ 1823.234080] mwifiex_pcie_reset_done+0x50/0x80 [mwifiex_pcie]
[ 1823.234087] pci_try_reset_function+0x5c/0x90
[ 1823.234094] process_one_work+0x1d6/0x3a0
[ 1823.234100] worker_thread+0x4d/0x3d0
[ 1823.234107] ? rescuer_thread+0x410/0x410
[ 1823.234112] kthread+0x142/0x160
[ 1823.234117] ? __kthread_bind_mask+0x60/0x60
[ 1823.234124] ret_from_fork+0x22/0x30
[...]
This is a deadlock caused by calling cancel_work_sync() in
mwifiex_cleanup_pcie():
- Device resets are done via mwifiex_pcie_card_reset()
- which schedules card->work to call mwifiex_pcie_card_reset_work()
- which calls pci_try_reset_function().
- This leads to mwifiex_pcie_reset_done() be called on the same workqueue,
which in turn calls
- mwifiex_reinit_sw() and that calls
- _mwifiex_fw_dpc().
The problem is now that _mwifiex_fw_dpc() calls mwifiex_free_adapter()
in case firmware initialization fails. That ends up calling
mwifiex_cleanup_pcie().
Note that all those calls are still running on the workqueue. So when
mwifiex_cleanup_pcie() now calls cancel_work_sync(), it's really waiting
on itself to complete, causing a deadlock.
This commit fixes the deadlock by skipping cancel_work_sync() on a reset
failure path.
After this commit, when reset fails, the following output is
expected to be shown:
kernel: mwifiex_pcie 0000:03:00.0: info: _mwifiex_fw_dpc: unregister device
kernel: mwifiex: Failed to bring up adapter: -5
kernel: mwifiex_pcie 0000:03:00.0: reinit failed: -5
To reproduce this issue, for example, try putting the root port of wifi
into D3 (replace "00:1d.3" with your setup).
# put into D3 (root port)
sudo setpci -v -s 00:1d.3 CAP_PM+4.b=0b
Cc: Maximilian Luz <luzmaximilian@gmail.com>
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201028142346.18355-1-kitakar@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/pcie.c | 18 +++++++++++++++++-
drivers/net/wireless/marvell/mwifiex/pcie.h | 2 ++
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index fc1706d0647d7..58c9623c3a916 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -377,6 +377,8 @@ static void mwifiex_pcie_reset_prepare(struct pci_dev *pdev)
clear_bit(MWIFIEX_IFACE_WORK_DEVICE_DUMP, &card->work_flags);
clear_bit(MWIFIEX_IFACE_WORK_CARD_RESET, &card->work_flags);
mwifiex_dbg(adapter, INFO, "%s, successful\n", __func__);
+
+ card->pci_reset_ongoing = true;
}
/*
@@ -405,6 +407,8 @@ static void mwifiex_pcie_reset_done(struct pci_dev *pdev)
dev_err(&pdev->dev, "reinit failed: %d\n", ret);
else
mwifiex_dbg(adapter, INFO, "%s, successful\n", __func__);
+
+ card->pci_reset_ongoing = false;
}
static const struct pci_error_handlers mwifiex_pcie_err_handler = {
@@ -2995,7 +2999,19 @@ static void mwifiex_cleanup_pcie(struct mwifiex_adapter *adapter)
int ret;
u32 fw_status;
- cancel_work_sync(&card->work);
+ /* Perform the cancel_work_sync() only when we're not resetting
+ * the card. It's because that function never returns if we're
+ * in reset path. If we're here when resetting the card, it means
+ * that we failed to reset the card (reset failure path).
+ */
+ if (!card->pci_reset_ongoing) {
+ mwifiex_dbg(adapter, MSG, "performing cancel_work_sync()...\n");
+ cancel_work_sync(&card->work);
+ mwifiex_dbg(adapter, MSG, "cancel_work_sync() done\n");
+ } else {
+ mwifiex_dbg(adapter, MSG,
+ "skipped cancel_work_sync() because we're in card reset failure path\n");
+ }
ret = mwifiex_read_reg(adapter, reg->fw_status, &fw_status);
if (fw_status == FIRMWARE_READY_PCIE) {
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.h b/drivers/net/wireless/marvell/mwifiex/pcie.h
index f7ce9b6db6b41..72d0c01ff3592 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.h
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.h
@@ -391,6 +391,8 @@ struct pcie_service_card {
struct mwifiex_msix_context share_irq_ctx;
struct work_struct work;
unsigned long work_flags;
+
+ bool pci_reset_ongoing;
};
static inline int
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 032/130] drm/amd/amdgpu: Add rev_id workaround logic for SRIOV setup
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (29 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 031/130] mwifiex: pcie: skip cancel_work_sync() on reset failure path Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 033/130] MIPS: BMC47xx: fix kconfig dependency bug for BCM47XX_SSB Sasha Levin
` (97 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bokun Zhang, Monk Liu, Alex Deucher, Sasha Levin, amd-gfx, dri-devel
From: Bokun Zhang <Bokun.Zhang@amd.com>
[ Upstream commit de21e4aeb2b26128dcc5be1bcb2fafa73d041e51 ]
- When we are under SRIOV setup, the rev_id cannot be read
properly. Therefore, we will return default value for it
Signed-off-by: Bokun Zhang <Bokun.Zhang@amd.com>
Reviewed-by: Monk Liu <monk.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c b/drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c
index c05d78d4efc66..56887affc13be 100644
--- a/drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c
@@ -34,8 +34,17 @@
static u32 nbio_v2_3_get_rev_id(struct amdgpu_device *adev)
{
- u32 tmp = RREG32_SOC15(NBIO, 0, mmRCC_DEV0_EPF0_STRAP0);
+ u32 tmp;
+ /*
+ * guest vm gets 0xffffffff when reading RCC_DEV0_EPF0_STRAP0,
+ * therefore we force rev_id to 0 (which is the default value)
+ */
+ if (amdgpu_sriov_vf(adev)) {
+ return 0;
+ }
+
+ tmp = RREG32_SOC15(NBIO, 0, mmRCC_DEV0_EPF0_STRAP0);
tmp &= RCC_DEV0_EPF0_STRAP0__STRAP_ATI_REV_ID_DEV0_F0_MASK;
tmp >>= RCC_DEV0_EPF0_STRAP0__STRAP_ATI_REV_ID_DEV0_F0__SHIFT;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 033/130] MIPS: BMC47xx: fix kconfig dependency bug for BCM47XX_SSB
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (30 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 032/130] drm/amd/amdgpu: Add rev_id workaround logic for SRIOV setup Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 034/130] net: ipconfig: Avoid spurious blank lines in boot log Sasha Levin
` (96 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Necip Fazil Yildiran, Thomas Bogendoerfer, Sasha Levin, linux-mips
From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
[ Upstream commit 09a48cbcd7af9203296938044f1100bb113ce01a ]
When BCM47XX_SSB is enabled and SSB_PCIHOST is disabled, it results in the
following Kbuild warning:
WARNING: unmet direct dependencies detected for SSB_B43_PCI_BRIDGE
Depends on [n]: SSB [=y] && SSB_PCIHOST [=n]
Selected by [y]:
- BCM47XX_SSB [=y] && BCM47XX [=y] && PCI [=y]
The reason is that BCM47XX_SSB selects SSB_B43_PCI_BRIDGE without
depending on or selecting SSB_PCIHOST while SSB_B43_PCI_BRIDGE depends on
SSB_PCIHOST. This can also fail building the kernel as demonstrated in a
bug report.
Honor the kconfig dependency to remove unmet direct dependency warnings
and avoid any potential build failures.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=210051
Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/bcm47xx/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
index 6889f74e06f54..40876654423c6 100644
--- a/arch/mips/bcm47xx/Kconfig
+++ b/arch/mips/bcm47xx/Kconfig
@@ -9,6 +9,7 @@ config BCM47XX_SSB
select SSB_DRIVER_MIPS
select SSB_DRIVER_EXTIF
select SSB_EMBEDDED
+ select SSB_PCIHOST if PCI
select SSB_B43_PCI_BRIDGE if PCI
select SSB_DRIVER_PCICORE if PCI
select SSB_PCICORE_HOSTMODE if PCI
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 034/130] net: ipconfig: Avoid spurious blank lines in boot log
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (31 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 033/130] MIPS: BMC47xx: fix kconfig dependency bug for BCM47XX_SSB Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 035/130] jfs: Fix memleak in dbAdjCtl Sasha Levin
` (95 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thierry Reding, Jon Hunter, Jakub Kicinski, Sasha Levin, netdev
From: Thierry Reding <treding@nvidia.com>
[ Upstream commit c9f64d1fc101c64ea2be1b2e562b4395127befc9 ]
When dumping the name and NTP servers advertised by DHCP, a blank line
is emitted if either of the lists is empty. This can lead to confusing
issues such as the blank line getting flagged as warning. This happens
because the blank line is the result of pr_cont("\n") and that may see
its level corrupted by some other driver concurrently writing to the
console.
Fix this by making sure that the terminating newline is only emitted
if at least one entry in the lists was printed before.
Reported-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20201110073757.1284594-1-thierry.reding@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/ipconfig.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 9bcca08efec9e..a268e056f01bd 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1438,7 +1438,7 @@ static int __init ip_auto_config(void)
int retries = CONF_OPEN_RETRIES;
#endif
int err;
- unsigned int i;
+ unsigned int i, count;
/* Initialise all name servers and NTP servers to NONE (but only if the
* "ip=" or "nfsaddrs=" kernel command line parameters weren't decoded,
@@ -1566,7 +1566,7 @@ static int __init ip_auto_config(void)
if (ic_dev_mtu)
pr_cont(", mtu=%d", ic_dev_mtu);
/* Name servers (if any): */
- for (i = 0; i < CONF_NAMESERVERS_MAX; i++) {
+ for (i = 0, count = 0; i < CONF_NAMESERVERS_MAX; i++) {
if (ic_nameservers[i] != NONE) {
if (i == 0)
pr_info(" nameserver%u=%pI4",
@@ -1574,12 +1574,14 @@ static int __init ip_auto_config(void)
else
pr_cont(", nameserver%u=%pI4",
i, &ic_nameservers[i]);
+
+ count++;
}
- if (i + 1 == CONF_NAMESERVERS_MAX)
+ if ((i + 1 == CONF_NAMESERVERS_MAX) && count > 0)
pr_cont("\n");
}
/* NTP servers (if any): */
- for (i = 0; i < CONF_NTP_SERVERS_MAX; i++) {
+ for (i = 0, count = 0; i < CONF_NTP_SERVERS_MAX; i++) {
if (ic_ntp_servers[i] != NONE) {
if (i == 0)
pr_info(" ntpserver%u=%pI4",
@@ -1587,8 +1589,10 @@ static int __init ip_auto_config(void)
else
pr_cont(", ntpserver%u=%pI4",
i, &ic_ntp_servers[i]);
+
+ count++;
}
- if (i + 1 == CONF_NTP_SERVERS_MAX)
+ if ((i + 1 == CONF_NTP_SERVERS_MAX) && count > 0)
pr_cont("\n");
}
#endif /* !SILENT */
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 035/130] jfs: Fix memleak in dbAdjCtl
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (32 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 034/130] net: ipconfig: Avoid spurious blank lines in boot log Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 036/130] r8169: use READ_ONCE in rtl_tx_slots_avail Sasha Levin
` (94 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dinghao Liu, Dave Kleikamp, Sasha Levin, jfs-discussion
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
[ Upstream commit 751341b4d7841e2b76e78eec382c2e119165497f ]
When dbBackSplit() fails, mp should be released to
prevent memleak. It's the same when dbJoin() fails.
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/jfs_dmap.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index caade185e568d..51b2c8f6ef35d 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -2549,15 +2549,19 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
*/
if (oldval == NOFREE) {
rc = dbBackSplit((dmtree_t *) dcp, leafno);
- if (rc)
+ if (rc) {
+ release_metapage(mp);
return rc;
+ }
oldval = dcp->stree[ti];
}
dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval);
} else {
rc = dbJoin((dmtree_t *) dcp, leafno, newval);
- if (rc)
+ if (rc) {
+ release_metapage(mp);
return rc;
+ }
}
/* check if the root of the current dmap control page changed due
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 036/130] r8169: use READ_ONCE in rtl_tx_slots_avail
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (33 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 035/130] jfs: Fix memleak in dbAdjCtl Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 037/130] media: zr364xx: propagate errors from zr364xx_start_readpipe() Sasha Levin
` (93 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Heiner Kallweit, Jakub Kicinski, Sasha Levin, netdev
From: Heiner Kallweit <hkallweit1@gmail.com>
[ Upstream commit 95f3c5458dfa5856bb110e31d156e00d894d0134 ]
tp->dirty_tx and tp->cur_tx may be changed by a racing rtl_tx() or
rtl8169_start_xmit(). Use READ_ONCE() to annotate the races and ensure
that the compiler doesn't use cached values.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/5676fee3-f6b4-84f2-eba5-c64949a371ad@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/realtek/r8169_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index fd5adb0c54d29..fca8252b4f21d 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -5856,7 +5856,8 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp,
static bool rtl_tx_slots_avail(struct rtl8169_private *tp,
unsigned int nr_frags)
{
- unsigned int slots_avail = tp->dirty_tx + NUM_TX_DESC - tp->cur_tx;
+ unsigned int slots_avail = READ_ONCE(tp->dirty_tx) + NUM_TX_DESC
+ - READ_ONCE(tp->cur_tx);
/* A skbuff with nr_frags needs nr_frags+1 entries in the tx queue */
return slots_avail > nr_frags;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 037/130] media: zr364xx: propagate errors from zr364xx_start_readpipe()
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (34 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 036/130] r8169: use READ_ONCE in rtl_tx_slots_avail Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 038/130] media: cec-core: first mark device unregistered, then wake up fhs Sasha Levin
` (92 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Evgeny Novikov, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin,
linux-usb, linux-media
From: Evgeny Novikov <novikov@ispras.ru>
[ Upstream commit af0321a5be3e5647441eb6b79355beaa592df97a ]
zr364xx_start_readpipe() can fail but callers do not care about that.
This can result in various negative consequences. The patch adds missed
error handling.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/zr364xx/zr364xx.c | 31 ++++++++++++++++++++++-------
1 file changed, 24 insertions(+), 7 deletions(-)
diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c
index 637962825d7a8..32f463f05eacd 100644
--- a/drivers/media/usb/zr364xx/zr364xx.c
+++ b/drivers/media/usb/zr364xx/zr364xx.c
@@ -1330,6 +1330,7 @@ static int zr364xx_board_init(struct zr364xx_camera *cam)
{
struct zr364xx_pipeinfo *pipe = cam->pipe;
unsigned long i;
+ int err;
DBG("board init: %p\n", cam);
memset(pipe, 0, sizeof(*pipe));
@@ -1362,9 +1363,8 @@ static int zr364xx_board_init(struct zr364xx_camera *cam)
if (i == 0) {
printk(KERN_INFO KBUILD_MODNAME ": out of memory. Aborting\n");
- kfree(cam->pipe->transfer_buffer);
- cam->pipe->transfer_buffer = NULL;
- return -ENOMEM;
+ err = -ENOMEM;
+ goto err_free;
} else
cam->buffer.dwFrames = i;
@@ -1379,9 +1379,17 @@ static int zr364xx_board_init(struct zr364xx_camera *cam)
/*** end create system buffers ***/
/* start read pipe */
- zr364xx_start_readpipe(cam);
+ err = zr364xx_start_readpipe(cam);
+ if (err)
+ goto err_free;
+
DBG(": board initialized\n");
return 0;
+
+err_free:
+ kfree(cam->pipe->transfer_buffer);
+ cam->pipe->transfer_buffer = NULL;
+ return err;
}
static int zr364xx_probe(struct usb_interface *intf,
@@ -1578,10 +1586,19 @@ static int zr364xx_resume(struct usb_interface *intf)
if (!cam->was_streaming)
return 0;
- zr364xx_start_readpipe(cam);
+ res = zr364xx_start_readpipe(cam);
+ if (res)
+ return res;
+
res = zr364xx_prepare(cam);
- if (!res)
- zr364xx_start_acquire(cam);
+ if (res)
+ goto err_prepare;
+
+ zr364xx_start_acquire(cam);
+ return 0;
+
+err_prepare:
+ zr364xx_stop_readpipe(cam);
return res;
}
#endif
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 038/130] media: cec-core: first mark device unregistered, then wake up fhs
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (35 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 037/130] media: zr364xx: propagate errors from zr364xx_start_readpipe() Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 039/130] media: isif: reset global state Sasha Levin
` (91 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin, linux-media
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit e91c255733d9bbb4978a372f44fb5ed689ccdbd1 ]
If a CEC device node is unregistered, then it should be marked as
unregistered before waking up any filehandles that are waiting for
an event.
This ensures that there is no race condition where an application can
call CEC_DQEVENT and have the ioctl return 0 instead of ENODEV.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/cec/cec-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/cec/cec-core.c b/drivers/media/cec/cec-core.c
index 9c610e1e99b84..76b78fb627e83 100644
--- a/drivers/media/cec/cec-core.c
+++ b/drivers/media/cec/cec-core.c
@@ -166,12 +166,12 @@ static void cec_devnode_unregister(struct cec_adapter *adap)
mutex_unlock(&devnode->lock);
return;
}
+ devnode->registered = false;
+ devnode->unregistered = true;
list_for_each_entry(fh, &devnode->fhs, list)
wake_up_interruptible(&fh->wait);
- devnode->registered = false;
- devnode->unregistered = true;
mutex_unlock(&devnode->lock);
mutex_lock(&adap->lock);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 039/130] media: isif: reset global state
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (36 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 038/130] media: cec-core: first mark device unregistered, then wake up fhs Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 040/130] s390/dasd: Fix operational path inconsistency Sasha Levin
` (90 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Evgeny Novikov, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin,
linux-media
From: Evgeny Novikov <novikov@ispras.ru>
[ Upstream commit 6651dba2bd838f34cf5a1e84229aaa579b1a94fe ]
isif_probe() invokes iounmap() on error handling paths, but it does not
reset the global state. So, later it can invoke iounmap() even when
ioremap() fails. This is the case also for isif_remove(). The patch
resets the global state after invoking iounmap() to avoid this.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/davinci/isif.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
index e2e7ab7b7f45b..29434f076c047 100644
--- a/drivers/media/platform/davinci/isif.c
+++ b/drivers/media/platform/davinci/isif.c
@@ -1075,10 +1075,14 @@ static int isif_probe(struct platform_device *pdev)
release_mem_region(res->start, resource_size(res));
i--;
fail_nobase_res:
- if (isif_cfg.base_addr)
+ if (isif_cfg.base_addr) {
iounmap(isif_cfg.base_addr);
- if (isif_cfg.linear_tbl0_addr)
+ isif_cfg.base_addr = NULL;
+ }
+ if (isif_cfg.linear_tbl0_addr) {
iounmap(isif_cfg.linear_tbl0_addr);
+ isif_cfg.linear_tbl0_addr = NULL;
+ }
while (i >= 0) {
res = platform_get_resource(pdev, IORESOURCE_MEM, i);
@@ -1096,8 +1100,11 @@ static int isif_remove(struct platform_device *pdev)
int i = 0;
iounmap(isif_cfg.base_addr);
+ isif_cfg.base_addr = NULL;
iounmap(isif_cfg.linear_tbl0_addr);
+ isif_cfg.linear_tbl0_addr = NULL;
iounmap(isif_cfg.linear_tbl1_addr);
+ isif_cfg.linear_tbl1_addr = NULL;
while (i < 3) {
res = platform_get_resource(pdev, IORESOURCE_MEM, i);
if (res)
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 040/130] s390/dasd: Fix operational path inconsistency
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (37 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 039/130] media: isif: reset global state Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 041/130] scsi: smartpqi: Correct driver removal with HBA disks Sasha Levin
` (89 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jan Höppner, Stefan Haberland, Cornelia Huck, Jens Axboe,
Sasha Levin, linux-s390
From: Jan Höppner <hoeppner@linux.ibm.com>
[ Upstream commit 9e34c8ba91697cb7441805c36d92ab3e695df6e0 ]
During online processing and setting up a DASD device, the configuration
data for operational paths is read and validated two times
(dasd_eckd_read_conf()). The first time to provide information that are
necessary for the LCU setup. A second time after the LCU setup as a
device might report different configuration data then.
When the configuration setup for each operational path is being
validated, an initial call to dasd_eckd_clear_conf_data() is issued.
This call wipes all previously available configuration data and path
information for each path.
However, the operational path mask is not updated during this process.
As a result, the stored operational path mask might no longer correspond
to the operational paths mask reported by the CIO layer, as several
paths might be gone between the two dasd_eckd_read_conf() calls.
This inconsistency leads to more severe issues in later path handling
changes. Fix this by removing the channel paths from the operational
path mask during the dasd_eckd_clear_conf_data() call.
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/block/dasd_eckd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index ad44d22e88591..b2964c204fefb 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -1013,6 +1013,7 @@ static void dasd_eckd_clear_conf_data(struct dasd_device *device)
device->path[i].cssid = 0;
device->path[i].ssid = 0;
device->path[i].chpid = 0;
+ dasd_path_notoper(device, i);
}
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 041/130] scsi: smartpqi: Correct driver removal with HBA disks
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (38 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 040/130] s390/dasd: Fix operational path inconsistency Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 042/130] media: venus: handle use after free for iommu_map/iommu_unmap Sasha Levin
` (88 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Don Brace, Scott Benesh, Scott Teel, Martin K . Petersen,
Sasha Levin, storagedev, linux-scsi
From: Don Brace <don.brace@microchip.com>
[ Upstream commit 1bdf6e9343877030640336d93da08321719bca43 ]
Correct rmmod hangs when using HBA disks with write cache enabled.
Do not set controller flag "in_shutdown" during rmmod. SCSI SYNCHRONIZE
CACHE(10) and SCSI SYNCHRONIZE CACHE(16) requests were blocked with
SCSI_MLQUEUE_HOST_BUSY.
Link: https://lore.kernel.org/r/160512627928.2359.10698615071827614781.stgit@brunhilda
Reviewed-by: Scott Benesh <scott.benesh@microchip.com>
Reviewed-by: Scott Teel <scott.teel@microchip.com>
Signed-off-by: Don Brace <don.brace@microchip.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/smartpqi/smartpqi_init.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 093ed5d1eef20..d80cb2a6e11a2 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -330,10 +330,9 @@ static inline void pqi_device_remove_start(struct pqi_scsi_dev *device)
device->in_remove = true;
}
-static inline bool pqi_device_in_remove(struct pqi_ctrl_info *ctrl_info,
- struct pqi_scsi_dev *device)
+static inline bool pqi_device_in_remove(struct pqi_scsi_dev *device)
{
- return device->in_remove && !ctrl_info->in_shutdown;
+ return device->in_remove;
}
static inline void pqi_ctrl_shutdown_start(struct pqi_ctrl_info *ctrl_info)
@@ -5368,8 +5367,7 @@ static int pqi_scsi_queue_command(struct Scsi_Host *shost,
atomic_inc(&device->scsi_cmds_outstanding);
- if (pqi_ctrl_offline(ctrl_info) || pqi_device_in_remove(ctrl_info,
- device)) {
+ if (pqi_ctrl_offline(ctrl_info) || pqi_device_in_remove(device)) {
set_host_byte(scmd, DID_NO_CONNECT);
pqi_scsi_done(scmd);
return 0;
@@ -7951,8 +7949,6 @@ static void pqi_pci_remove(struct pci_dev *pci_dev)
if (!ctrl_info)
return;
- ctrl_info->in_shutdown = true;
-
pqi_remove_ctrl(ctrl_info);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 042/130] media: venus: handle use after free for iommu_map/iommu_unmap
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (39 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 041/130] scsi: smartpqi: Correct driver removal with HBA disks Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 043/130] media: usb: dvb-usb-v2: zd1301: fix missing platform_device_unregister() Sasha Levin
` (87 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mansur Alisha Shaik, Stanimir Varbanov, Mauro Carvalho Chehab,
Sasha Levin, linux-media, linux-arm-msm
From: Mansur Alisha Shaik <mansur@codeaurora.org>
[ Upstream commit de15e6231e6a3ca58d58d7e2c614a76c940dbb38 ]
In concurrency usecase and reboot scenario we are seeing muliple
crashes related to iommu_map/iommu_unamp of core->fw.iommu_domain.
In one case we are seeing "Unable to handle kernel NULL pointer
dereference at virtual address 0000000000000008" crash, this is
because of core->fw.iommu_domain in venus_firmware_deinit() and
trying to map in venus_boot() during venus_sys_error_handler()
Call trace:
__iommu_map+0x4c/0x348
iommu_map+0x5c/0x70
venus_boot+0x184/0x230 [venus_core]
venus_sys_error_handler+0xa0/0x14c [venus_core]
process_one_work+0x210/0x3d0
worker_thread+0x248/0x3f4
kthread+0x11c/0x12c
ret_from_fork+0x10/0x18
In second case we are seeing "Unable to handle kernel paging request
at virtual address 006b6b6b6b6b6b9b" crash, this is because of
unmapping iommu domain which is already unmapped.
Call trace:
venus_remove+0xf8/0x108 [venus_core]
venus_core_shutdown+0x1c/0x34 [venus_core]
platform_drv_shutdown+0x28/0x34
device_shutdown+0x154/0x1fc
kernel_restart_prepare+0x40/0x4c
kernel_restart+0x1c/0x64
__arm64_sys_reboot+0x190/0x238
el0_svc_common+0xa4/0x154
el0_svc_compat_handler+0x2c/0x38
el0_svc_compat+0x8/0x10
Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/firmware.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/firmware.c b/drivers/media/platform/qcom/venus/firmware.c
index 33f70e1def943..9a9c0979e7bbb 100644
--- a/drivers/media/platform/qcom/venus/firmware.c
+++ b/drivers/media/platform/qcom/venus/firmware.c
@@ -172,9 +172,14 @@ static int venus_shutdown_no_tz(struct venus_core *core)
iommu = core->fw.iommu_domain;
- unmapped = iommu_unmap(iommu, VENUS_FW_START_ADDR, mapped);
- if (unmapped != mapped)
- dev_err(dev, "failed to unmap firmware\n");
+ if (core->fw.mapped_mem_size && iommu) {
+ unmapped = iommu_unmap(iommu, VENUS_FW_START_ADDR, mapped);
+
+ if (unmapped != mapped)
+ dev_err(dev, "failed to unmap firmware\n");
+ else
+ core->fw.mapped_mem_size = 0;
+ }
return 0;
}
@@ -289,7 +294,11 @@ void venus_firmware_deinit(struct venus_core *core)
iommu = core->fw.iommu_domain;
iommu_detach_device(iommu, core->fw.dev);
- iommu_domain_free(iommu);
+
+ if (core->fw.iommu_domain) {
+ iommu_domain_free(iommu);
+ core->fw.iommu_domain = NULL;
+ }
platform_device_unregister(to_platform_device(core->fw.dev));
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 043/130] media: usb: dvb-usb-v2: zd1301: fix missing platform_device_unregister()
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (40 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 042/130] media: venus: handle use after free for iommu_map/iommu_unmap Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 044/130] media: dvbdev: Fix memleak in dvb_register_device Sasha Levin
` (86 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Qinglang Miao, Sean Young, Mauro Carvalho Chehab, Sasha Levin,
linux-media
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit ee50d6e60d9a8e110e984cdd9e788d93eff540ba ]
Add the missing platform_device_unregister() before return
from zd1301_frontend_attach in the error handling case when
pdev->dev.driver is empty.
There's an error handling route named err_platform_device_unregister,
so just reuse it.
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/zd1301.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb-v2/zd1301.c b/drivers/media/usb/dvb-usb-v2/zd1301.c
index 63b66b207b64d..815ae1e8dc03e 100644
--- a/drivers/media/usb/dvb-usb-v2/zd1301.c
+++ b/drivers/media/usb/dvb-usb-v2/zd1301.c
@@ -150,7 +150,7 @@ static int zd1301_frontend_attach(struct dvb_usb_adapter *adap)
}
if (!pdev->dev.driver) {
ret = -ENODEV;
- goto err;
+ goto err_platform_device_unregister;
}
if (!try_module_get(pdev->dev.driver->owner)) {
ret = -ENODEV;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 044/130] media: dvbdev: Fix memleak in dvb_register_device
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (41 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 043/130] media: usb: dvb-usb-v2: zd1301: fix missing platform_device_unregister() Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 045/130] mmc: mediatek: fix mem leak in msdc_drv_probe Sasha Levin
` (85 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dinghao Liu, Sean Young, Mauro Carvalho Chehab, Sasha Levin, linux-media
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
[ Upstream commit 167faadfcf9339088910e9e85a1b711fcbbef8e9 ]
When device_create() fails, dvbdev and dvbdevfops should
be freed just like when dvb_register_media_device() fails.
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dvbdev.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
index 032b6d7dd5821..cfe983e78102f 100644
--- a/drivers/media/dvb-core/dvbdev.c
+++ b/drivers/media/dvb-core/dvbdev.c
@@ -539,6 +539,9 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
if (IS_ERR(clsdev)) {
pr_err("%s: failed to create device dvb%d.%s%d (%ld)\n",
__func__, adap->num, dnames[type], id, PTR_ERR(clsdev));
+ dvb_media_device_free(dvbdev);
+ kfree(dvbdevfops);
+ kfree(dvbdev);
return PTR_ERR(clsdev);
}
dprintk("DVB: register adapter%d/%s%d @ minor: %i (0x%02x)\n",
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 045/130] mmc: mediatek: fix mem leak in msdc_drv_probe
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (42 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 044/130] media: dvbdev: Fix memleak in dvb_register_device Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 046/130] mmc: tmio: do not print real IOMEM pointer Sasha Levin
` (84 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zheng Liang, Hulk Robot, Chaotian Jing, Ulf Hansson, Sasha Levin,
linux-mmc, linux-arm-kernel, linux-mediatek
From: Zheng Liang <zhengliang6@huawei.com>
[ Upstream commit bbba85fae44134e00c493705bd5604fd63958315 ]
It should use mmc_free_host to free mem in error patch of
msdc_drv_probe.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
Reviewed-by: Chaotian Jing <chaotian.jing@mediatek.com>
Link: https://lore.kernel.org/r/20201112092530.32446-1-zhengliang6@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/mtk-sd.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 9d47a2bd2546b..3c11bd5a3b86c 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -2242,8 +2242,10 @@ static int msdc_drv_probe(struct platform_device *pdev)
host->reset = devm_reset_control_get_optional_exclusive(&pdev->dev,
"hrst");
- if (IS_ERR(host->reset))
- return PTR_ERR(host->reset);
+ if (IS_ERR(host->reset)) {
+ ret = PTR_ERR(host->reset);
+ goto host_free;
+ }
host->irq = platform_get_irq(pdev, 0);
if (host->irq < 0) {
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 046/130] mmc: tmio: do not print real IOMEM pointer
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (43 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 045/130] mmc: mediatek: fix mem leak in msdc_drv_probe Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 047/130] ARM: OMAP2+: Fix memleak in omap2xxx_clkt_vps_init Sasha Levin
` (83 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Krzysztof Kozlowski, kernel test robot, Dan Carpenter,
Ulf Hansson, Sasha Levin, linux-mmc
From: Krzysztof Kozlowski <krzk@kernel.org>
[ Upstream commit ade8e9d3fb9232ddfb87a4bc641b35b988d9757b ]
Printing kernel pointers is discouraged because they might leak kernel
memory layout. This fixes smatch warning:
drivers/mmc/host/tmio_mmc.c:177 tmio_mmc_probe() warn: argument 3 to %08lx specifier is cast from pointer
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201116164252.44078-1-krzk@kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/tmio_mmc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c
index 93e83ad25976e..dedfad7a2fcb1 100644
--- a/drivers/mmc/host/tmio_mmc.c
+++ b/drivers/mmc/host/tmio_mmc.c
@@ -182,8 +182,7 @@ static int tmio_mmc_probe(struct platform_device *pdev)
if (ret)
goto host_remove;
- pr_info("%s at 0x%08lx irq %d\n", mmc_hostname(host->mmc),
- (unsigned long)host->ctl, irq);
+ pr_info("%s at 0x%p irq %d\n", mmc_hostname(host->mmc), host->ctl, irq);
return 0;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 047/130] ARM: OMAP2+: Fix memleak in omap2xxx_clkt_vps_init
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (44 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 046/130] mmc: tmio: do not print real IOMEM pointer Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 048/130] MIPS: vdso: Use vma page protection for remapping Sasha Levin
` (82 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Youling Tang, Tony Lindgren, Sasha Levin, linux-omap, linux-arm-kernel
From: Youling Tang <tangyouling@loongson.cn>
[ Upstream commit 3c5902d270edb6ccc3049acfe5d3e96653c87dcd ]
If the clk_register fails, we should free hw before function returns to
prevent memleak.
Signed-off-by: Youling Tang <tangyouling@loongson.cn>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c b/arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c
index 2a3e72286d3ab..70892b3da28d3 100644
--- a/arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c
+++ b/arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c
@@ -244,6 +244,12 @@ void omap2xxx_clkt_vps_init(void)
hw->hw.init = &init;
clk = clk_register(NULL, &hw->hw);
+ if (IS_ERR(clk)) {
+ printk(KERN_ERR "Failed to register clock\n");
+ kfree(hw);
+ return;
+ }
+
clkdev_create(clk, "cpufreq_ck", NULL);
return;
cleanup:
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 048/130] MIPS: vdso: Use vma page protection for remapping
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (45 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 047/130] ARM: OMAP2+: Fix memleak in omap2xxx_clkt_vps_init Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 049/130] MIPS: kvm: Use vm_get_page_prot to get protection bits Sasha Levin
` (81 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Thomas Bogendoerfer, Sasha Levin, linux-mips
From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
[ Upstream commit 724d554a117a0552c2c982f0b5cd1d685274d678 ]
MIPS protection bits are setup during runtime so using defines like
PAGE_READONLY ignores these runtime changes. To fix this we simply
use the page protection of the setup vma.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/kernel/vdso.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c
index bc35f8499111b..cea83d2866e34 100644
--- a/arch/mips/kernel/vdso.c
+++ b/arch/mips/kernel/vdso.c
@@ -157,7 +157,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
gic_pfn = virt_to_phys(mips_gic_base + MIPS_GIC_USER_OFS) >> PAGE_SHIFT;
ret = io_remap_pfn_range(vma, base, gic_pfn, gic_size,
- pgprot_noncached(PAGE_READONLY));
+ pgprot_noncached(vma->vm_page_prot));
if (ret)
goto out;
}
@@ -165,7 +165,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
/* Map data page. */
ret = remap_pfn_range(vma, data_addr,
virt_to_phys(vdso_data) >> PAGE_SHIFT,
- PAGE_SIZE, PAGE_READONLY);
+ PAGE_SIZE, vma->vm_page_prot);
if (ret)
goto out;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 049/130] MIPS: kvm: Use vm_get_page_prot to get protection bits
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (46 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 048/130] MIPS: vdso: Use vma page protection for remapping Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 050/130] scsi: ufs: Atomic update for clkgating_enable Sasha Levin
` (80 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Thomas Bogendoerfer, Sasha Levin, linux-mips, kvm
From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
[ Upstream commit 411406a8c758d9ad6f908fab3a6cf1d3d89e1d08 ]
MIPS protection bits are setup during runtime so using defines like
PAGE_SHARED ignores this runtime changes. Using vm_get_page_prot
to get correct page protection fixes this.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/kvm/mmu.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c
index 97f63a84aa51f..b5974ff2d9162 100644
--- a/arch/mips/kvm/mmu.c
+++ b/arch/mips/kvm/mmu.c
@@ -1100,6 +1100,7 @@ int kvm_mips_handle_commpage_tlb_fault(unsigned long badvaddr,
{
kvm_pfn_t pfn;
pte_t *ptep;
+ pgprot_t prot;
ptep = kvm_trap_emul_pte_for_gva(vcpu, badvaddr);
if (!ptep) {
@@ -1109,7 +1110,8 @@ int kvm_mips_handle_commpage_tlb_fault(unsigned long badvaddr,
pfn = PFN_DOWN(virt_to_phys(vcpu->arch.kseg0_commpage));
/* Also set valid and dirty, so refill handler doesn't have to */
- *ptep = pte_mkyoung(pte_mkdirty(pfn_pte(pfn, PAGE_SHARED)));
+ prot = vm_get_page_prot(VM_READ|VM_WRITE|VM_SHARED);
+ *ptep = pte_mkyoung(pte_mkdirty(pfn_pte(pfn, prot)));
/* Invalidate this entry in the TLB, guest kernel ASID only */
kvm_mips_host_tlb_inv(vcpu, badvaddr, false, true);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 050/130] scsi: ufs: Atomic update for clkgating_enable
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (47 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 049/130] MIPS: kvm: Use vm_get_page_prot to get protection bits Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 051/130] ASoC: SOF: IPC: fix implicit type overflow Sasha Levin
` (79 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jaegeuk Kim, Can Guo, Martin K . Petersen, Sasha Levin, linux-scsi
From: Jaegeuk Kim <jaegeuk@google.com>
[ Upstream commit b664511297644eac34038df877b3ad7bcaa81913 ]
While running a stress test which enables/disables clkgating, we
occasionally hit device timeout. This patch avoids a subtle race condition
to address it.
Link: https://lore.kernel.org/r/20201117165839.1643377-3-jaegeuk@kernel.org
Reviewed-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/ufs/ufshcd.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 675e16e61ebdd..ed07e52fa861b 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -1751,19 +1751,19 @@ static ssize_t ufshcd_clkgate_enable_store(struct device *dev,
return -EINVAL;
value = !!value;
+
+ spin_lock_irqsave(hba->host->host_lock, flags);
if (value == hba->clk_gating.is_enabled)
goto out;
- if (value) {
- ufshcd_release(hba);
- } else {
- spin_lock_irqsave(hba->host->host_lock, flags);
+ if (value)
+ __ufshcd_release(hba);
+ else
hba->clk_gating.active_reqs++;
- spin_unlock_irqrestore(hba->host->host_lock, flags);
- }
hba->clk_gating.is_enabled = value;
out:
+ spin_unlock_irqrestore(hba->host->host_lock, flags);
return count;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 051/130] ASoC: SOF: IPC: fix implicit type overflow
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (48 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 050/130] scsi: ufs: Atomic update for clkgating_enable Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 052/130] net: dsa: avoid potential use-after-free error Sasha Levin
` (78 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Curtis Malainey, Guennadi Liakhovetski, Kai Vehmanen, Mark Brown,
Sasha Levin, alsa-devel
From: Curtis Malainey <cujomalainey@chromium.org>
[ Upstream commit 7c1d0e554a359cca77bfabd2a29b06f5322d172d ]
Implicit values may have a length of 15bits (s16) so we need to declare
the proper size so we don't get undefined behaviour. This appears to be
arch and compiler dependent. This commit is to keep the headers aligned
between the firmware and kernel. UBSan discovered this bug in the
firmware.
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://lore.kernel.org/r/20201120144025.2166023-1-kai.vehmanen@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--git a/include/sound/sof/header.h b/include/sound/sof/header.h
index 10f00c08dbb7a..aae673b2bb5e2 100644
--- a/include/sound/sof/header.h
+++ b/include/sound/sof/header.h
@@ -30,12 +30,12 @@
/* Global Message - Generic */
#define SOF_GLB_TYPE_SHIFT 28
-#define SOF_GLB_TYPE_MASK (0xf << SOF_GLB_TYPE_SHIFT)
+#define SOF_GLB_TYPE_MASK (0xfL << SOF_GLB_TYPE_SHIFT)
#define SOF_GLB_TYPE(x) ((x) << SOF_GLB_TYPE_SHIFT)
/* Command Message - Generic */
#define SOF_CMD_TYPE_SHIFT 16
-#define SOF_CMD_TYPE_MASK (0xfff << SOF_CMD_TYPE_SHIFT)
+#define SOF_CMD_TYPE_MASK (0xfffL << SOF_CMD_TYPE_SHIFT)
#define SOF_CMD_TYPE(x) ((x) << SOF_CMD_TYPE_SHIFT)
/* Global Message Types */
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 052/130] net: dsa: avoid potential use-after-free error
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (49 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 051/130] ASoC: SOF: IPC: fix implicit type overflow Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 053/130] ARM: dts: NSP: Fix Ethernet switch SGMII register name Sasha Levin
` (77 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Christian Eggers, Vladimir Oltean, Florian Fainelli,
Jakub Kicinski, Sasha Levin, netdev
From: Christian Eggers <ceggers@arri.de>
[ Upstream commit 30abc9cd9c6bdd44d23fc49a9c2526a86fba4305 ]
If dsa_switch_ops::port_txtstamp() returns false, clone will be freed
immediately. Shouldn't store a pointer to freed memory.
Signed-off-by: Christian Eggers <ceggers@arri.de>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Tested-by: Vladimir Oltean <olteanv@gmail.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201119110906.25558-1-ceggers@arri.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/dsa/slave.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index f734ce0bcb56e..2b657e88d8017 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -476,10 +476,10 @@ static void dsa_skb_tx_timestamp(struct dsa_slave_priv *p,
if (!clone)
return;
- DSA_SKB_CB(skb)->clone = clone;
-
- if (ds->ops->port_txtstamp(ds, p->dp->index, clone, type))
+ if (ds->ops->port_txtstamp(ds, p->dp->index, clone, type)) {
+ DSA_SKB_CB(skb)->clone = clone;
return;
+ }
kfree_skb(clone);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 053/130] ARM: dts: NSP: Fix Ethernet switch SGMII register name
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (50 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 052/130] net: dsa: avoid potential use-after-free error Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 054/130] Bluetooth: hci_h5: Add OBDA0623 ACPI HID Sasha Levin
` (76 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Florian Fainelli, Vladimir Oltean, Sasha Levin, devicetree,
linux-arm-kernel
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit 8b0235d1deace8f1bd8cdd149d698fee3974fdf4 ]
The register name should be "sgmii_config", not "sgmii", this is not a
functional change since no code is currently looking for that register
by name (or at all).
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm-nsp.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
index 8615d89fa4690..eff99bd44b38e 100644
--- a/arch/arm/boot/dts/bcm-nsp.dtsi
+++ b/arch/arm/boot/dts/bcm-nsp.dtsi
@@ -388,7 +388,7 @@ srab: srab@36000 {
reg = <0x36000 0x1000>,
<0x3f308 0x8>,
<0x3f410 0xc>;
- reg-names = "srab", "mux_config", "sgmii";
+ reg-names = "srab", "mux_config", "sgmii_config";
interrupts = <GIC_SPI 95 IRQ_TYPE_LEVEL_HIGH>,
<GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>,
<GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>,
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 054/130] Bluetooth: hci_h5: Add OBDA0623 ACPI HID
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (51 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 053/130] ARM: dts: NSP: Fix Ethernet switch SGMII register name Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 055/130] ALSA: usb-audio: Handle discrete rates properly in hw constraints Sasha Levin
` (75 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans de Goede, Marcel Holtmann, Sasha Levin, linux-bluetooth
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit e524f252c42fc4f2bc4a2c3f99fe8659af5576a8 ]
Add OBDA0623 ACPI HID to the acpi_device_id table. This HID is used
for the RTL8723BS Bluetooth part on the Acer Switch 10E SW3-016.
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1665610
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_h5.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index 5df0651b6cd55..ddee3d498a210 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -989,6 +989,7 @@ static struct h5_vnd rtl_vnd = {
#ifdef CONFIG_ACPI
static const struct acpi_device_id h5_acpi_match[] = {
#ifdef CONFIG_BT_HCIUART_RTL
+ { "OBDA0623", (kernel_ulong_t)&rtl_vnd },
{ "OBDA8723", (kernel_ulong_t)&rtl_vnd },
#endif
{ },
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 055/130] ALSA: usb-audio: Handle discrete rates properly in hw constraints
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (52 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 054/130] Bluetooth: hci_h5: Add OBDA0623 ACPI HID Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 056/130] ALSA: usb-audio: Don't call usb_set_interface() at trigger callback Sasha Levin
` (74 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, Keith Milner, Dylan Robinson, Sasha Levin, alsa-devel
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit bc4e94aa8e72e79598e63a0b73febdcd8aeb541f ]
In the current code, when the device provides the discrete sample rate
tables with unusual sample rates, the driver tries to gather the whole
values from the audioformat entries and create a hw-constraint rule to
restrict with this single rate list. This is rather inefficient and
may overlook the rates that are associated only with the certain
audioformat entries.
This patch improves the hw constraint setup by rewriting the existing
hw_rule_rate(). The discrete sample rates (identified by rate_table
and nr_rates of format entry) are checked in the existing
hw_rule_rate() instead of extra rules; in the case of discrete rates,
the function compares with each rate table entry and calculates the
min/max values from there. For the contiguous rates, the behavior
doesn't change.
Along with it, snd_usb_pcm_check_knot() and snb_usb_substream
rate_list field become superfluous, thus those are dropped.
Tested-by: Keith Milner <kamilner@superlative.org>
Tested-by: Dylan Robinson <dylan_robinson@motu.com>
Link: https://lore.kernel.org/r/20201123085347.19667-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/card.h | 1 -
sound/usb/pcm.c | 73 ++++++++++------------------------------------
sound/usb/stream.c | 1 -
3 files changed, 15 insertions(+), 60 deletions(-)
diff --git a/sound/usb/card.h b/sound/usb/card.h
index d8ec5caf464de..d619e5e77a305 100644
--- a/sound/usb/card.h
+++ b/sound/usb/card.h
@@ -153,7 +153,6 @@ struct snd_usb_substream {
u64 formats; /* format bitmasks (all or'ed) */
unsigned int num_formats; /* number of supported audio formats (list) */
struct list_head fmt_list; /* format list */
- struct snd_pcm_hw_constraint_list rate_list; /* limited rates */
spinlock_t lock;
int last_frame_number; /* stored frame number */
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 1a5e555002b2b..49ad4e7bb70b5 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1034,27 +1034,31 @@ static int hw_rule_rate(struct snd_pcm_hw_params *params,
struct snd_usb_substream *subs = rule->private;
struct audioformat *fp;
struct snd_interval *it = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE);
- unsigned int rmin, rmax;
+ unsigned int rmin, rmax, r;
int changed;
+ int i;
hwc_debug("hw_rule_rate: (%d,%d)\n", it->min, it->max);
- changed = 0;
- rmin = rmax = 0;
+ rmin = UINT_MAX;
+ rmax = 0;
list_for_each_entry(fp, &subs->fmt_list, list) {
if (!hw_check_valid_format(subs, params, fp))
continue;
- if (changed++) {
- if (rmin > fp->rate_min)
- rmin = fp->rate_min;
- if (rmax < fp->rate_max)
- rmax = fp->rate_max;
+ if (fp->rate_table && fp->nr_rates) {
+ for (i = 0; i < fp->nr_rates; i++) {
+ r = fp->rate_table[i];
+ if (!snd_interval_test(it, r))
+ continue;
+ rmin = min(rmin, r);
+ rmax = max(rmax, r);
+ }
} else {
- rmin = fp->rate_min;
- rmax = fp->rate_max;
+ rmin = min(rmin, fp->rate_min);
+ rmax = max(rmax, fp->rate_max);
}
}
- if (!changed) {
+ if (rmin > rmax) {
hwc_debug(" --> get empty\n");
it->empty = 1;
return -EINVAL;
@@ -1200,50 +1204,6 @@ static int hw_rule_period_time(struct snd_pcm_hw_params *params,
return changed;
}
-/*
- * If the device supports unusual bit rates, does the request meet these?
- */
-static int snd_usb_pcm_check_knot(struct snd_pcm_runtime *runtime,
- struct snd_usb_substream *subs)
-{
- struct audioformat *fp;
- int *rate_list;
- int count = 0, needs_knot = 0;
- int err;
-
- kfree(subs->rate_list.list);
- subs->rate_list.list = NULL;
-
- list_for_each_entry(fp, &subs->fmt_list, list) {
- if (fp->rates & SNDRV_PCM_RATE_CONTINUOUS)
- return 0;
- count += fp->nr_rates;
- if (fp->rates & SNDRV_PCM_RATE_KNOT)
- needs_knot = 1;
- }
- if (!needs_knot)
- return 0;
-
- subs->rate_list.list = rate_list =
- kmalloc_array(count, sizeof(int), GFP_KERNEL);
- if (!subs->rate_list.list)
- return -ENOMEM;
- subs->rate_list.count = count;
- subs->rate_list.mask = 0;
- count = 0;
- list_for_each_entry(fp, &subs->fmt_list, list) {
- int i;
- for (i = 0; i < fp->nr_rates; i++)
- rate_list[count++] = fp->rate_table[i];
- }
- err = snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_RATE,
- &subs->rate_list);
- if (err < 0)
- return err;
-
- return 0;
-}
-
/*
* set up the runtime hardware information.
@@ -1333,9 +1293,6 @@ static int setup_hw_info(struct snd_pcm_runtime *runtime, struct snd_usb_substre
if (err < 0)
return err;
}
- err = snd_usb_pcm_check_knot(runtime, subs);
- if (err < 0)
- return err;
return snd_usb_autoresume(subs->stream->chip);
}
diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index d01edd5da6cf8..49c1b8a208582 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -47,7 +47,6 @@ static void free_substream(struct snd_usb_substream *subs)
return; /* not initialized */
list_for_each_entry_safe(fp, n, &subs->fmt_list, list)
audioformat_free(fp);
- kfree(subs->rate_list.list);
kfree(subs->str_pd);
snd_media_stream_delete(subs);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 056/130] ALSA: usb-audio: Don't call usb_set_interface() at trigger callback
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (53 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 055/130] ALSA: usb-audio: Handle discrete rates properly in hw constraints Sasha Levin
@ 2020-12-23 2:16 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 057/130] ALSA: usb-audio: Check valid altsetting at parsing rates for UAC2/3 Sasha Levin
` (73 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:16 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, Keith Milner, Dylan Robinson, Sasha Levin, alsa-devel
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 4974b7950929e4a28d4eaee48e4ad07f168ac132 ]
The PCM trigger callback is atomic, hence we must not call a function
like usb_set_interface() there. Calling it from there would lead to a
kernel Oops.
Fix it by moving the usb_set_interface() call to set_sync_endpoint().
Also, apply the snd_usb_set_interface_quirk() for consistency, too.
Tested-by: Keith Milner <kamilner@superlative.org>
Tested-by: Dylan Robinson <dylan_robinson@motu.com>
Link: https://lore.kernel.org/r/20201123085347.19667-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/pcm.c | 28 +++++++++++++---------------
1 file changed, 13 insertions(+), 15 deletions(-)
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 49ad4e7bb70b5..87389ab69b5ee 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -232,21 +232,6 @@ static int start_endpoints(struct snd_usb_substream *subs)
!test_and_set_bit(SUBSTREAM_FLAG_SYNC_EP_STARTED, &subs->flags)) {
struct snd_usb_endpoint *ep = subs->sync_endpoint;
- if (subs->data_endpoint->iface != subs->sync_endpoint->iface ||
- subs->data_endpoint->altsetting != subs->sync_endpoint->altsetting) {
- err = usb_set_interface(subs->dev,
- subs->sync_endpoint->iface,
- subs->sync_endpoint->altsetting);
- if (err < 0) {
- clear_bit(SUBSTREAM_FLAG_SYNC_EP_STARTED, &subs->flags);
- dev_err(&subs->dev->dev,
- "%d:%d: cannot set interface (%d)\n",
- subs->sync_endpoint->iface,
- subs->sync_endpoint->altsetting, err);
- return -EIO;
- }
- }
-
dev_dbg(&subs->dev->dev, "Starting sync EP @%p\n", ep);
ep->sync_slave = subs->data_endpoint;
@@ -512,6 +497,19 @@ static int set_sync_endpoint(struct snd_usb_substream *subs,
subs->data_endpoint->sync_master = subs->sync_endpoint;
+ if (subs->data_endpoint->iface != subs->sync_endpoint->iface ||
+ subs->data_endpoint->altsetting != subs->sync_endpoint->altsetting) {
+ err = usb_set_interface(subs->dev,
+ subs->sync_endpoint->iface,
+ subs->sync_endpoint->altsetting);
+ if (err < 0)
+ return err;
+ dev_dbg(&dev->dev, "setting usb interface %d:%d\n",
+ subs->sync_endpoint->iface,
+ subs->sync_endpoint->altsetting);
+ snd_usb_set_interface_quirk(dev);
+ }
+
return 0;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 057/130] ALSA: usb-audio: Check valid altsetting at parsing rates for UAC2/3
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (54 preceding siblings ...)
2020-12-23 2:16 ` [PATCH AUTOSEL 5.4 056/130] ALSA: usb-audio: Don't call usb_set_interface() at trigger callback Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 7:09 ` Takashi Iwai
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 058/130] rxrpc: Don't leak the service-side session key to userspace Sasha Levin
` (72 subsequent siblings)
128 siblings, 1 reply; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, Dylan Robinson, Keith Milner, Sasha Levin, alsa-devel
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 93db51d06b32227319dae2ac289029ccf1b33181 ]
The current driver code assumes blindly that all found sample rates for
the same endpoint from the UAC2 and UAC3 descriptors can be used no
matter which altsetting, but actually this was wrong: some devices
accept only limited sample rates in each altsetting. For determining
which altsetting supports which rate, we need to verify each sample rate
and check the validity via UAC2_AS_VAL_ALT_SETTINGS. This control
reports back the available altsettings as a bitmap.
This patch implements the missing piece above, the verification and
reconstructs the sample rate tables based on the result.
An open question is how to deal with the altsettings that ended up
with no valid sample rates after verification. At least, there is a
device that showed this problem although the sample rates did work in
the later usage (see bug link). For now, we accept such an altset as
is, assuming that it's a firmware bug.
Reported-by: Dylan Robinson <dylan_robinson@motu.com>
Tested-by: Keith Milner <kamilner@superlative.org>
Tested-by: Dylan Robinson <dylan_robinson@motu.com>
BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1178203
Link: https://lore.kernel.org/r/20201123085347.19667-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/clock.c | 106 ++++++++++++++++++++++++++-------------------
sound/usb/clock.h | 4 ++
sound/usb/format.c | 93 +++++++++++++++++++++++++++++++++++++++
3 files changed, 158 insertions(+), 45 deletions(-)
diff --git a/sound/usb/clock.c b/sound/usb/clock.c
index b118cf97607f3..960174485a531 100644
--- a/sound/usb/clock.c
+++ b/sound/usb/clock.c
@@ -560,16 +560,60 @@ static int get_sample_rate_v2v3(struct snd_usb_audio *chip, int iface,
return le32_to_cpu(data);
}
+/*
+ * Try to set the given sample rate:
+ *
+ * Return 0 if the clock source is read-only, the actual rate on success,
+ * or a negative error code.
+ *
+ * This function gets called from format.c to validate each sample rate, too.
+ * Hence no message is shown upon error
+ */
+int snd_usb_set_sample_rate_v2v3(struct snd_usb_audio *chip,
+ const struct audioformat *fmt,
+ int clock, int rate)
+{
+ bool writeable;
+ u32 bmControls;
+ __le32 data;
+ int err;
+
+ if (fmt->protocol == UAC_VERSION_3) {
+ struct uac3_clock_source_descriptor *cs_desc;
+
+ cs_desc = snd_usb_find_clock_source_v3(chip->ctrl_intf, clock);
+ bmControls = le32_to_cpu(cs_desc->bmControls);
+ } else {
+ struct uac_clock_source_descriptor *cs_desc;
+
+ cs_desc = snd_usb_find_clock_source(chip->ctrl_intf, clock);
+ bmControls = cs_desc->bmControls;
+ }
+
+ writeable = uac_v2v3_control_is_writeable(bmControls,
+ UAC2_CS_CONTROL_SAM_FREQ);
+ if (!writeable)
+ return 0;
+
+ data = cpu_to_le32(rate);
+ err = snd_usb_ctl_msg(chip->dev, usb_sndctrlpipe(chip->dev, 0), UAC2_CS_CUR,
+ USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_OUT,
+ UAC2_CS_CONTROL_SAM_FREQ << 8,
+ snd_usb_ctrl_intf(chip) | (clock << 8),
+ &data, sizeof(data));
+ if (err < 0)
+ return err;
+
+ return get_sample_rate_v2v3(chip, fmt->iface, fmt->altsetting, clock);
+}
+
static int set_sample_rate_v2v3(struct snd_usb_audio *chip, int iface,
- struct usb_host_interface *alts,
- struct audioformat *fmt, int rate)
+ struct usb_host_interface *alts,
+ struct audioformat *fmt, int rate)
{
struct usb_device *dev = chip->dev;
- __le32 data;
- int err, cur_rate, prev_rate;
+ int cur_rate, prev_rate;
int clock;
- bool writeable;
- u32 bmControls;
/* First, try to find a valid clock. This may trigger
* automatic clock selection if the current clock is not
@@ -592,50 +636,22 @@ static int set_sample_rate_v2v3(struct snd_usb_audio *chip, int iface,
if (prev_rate == rate)
goto validation;
- if (fmt->protocol == UAC_VERSION_3) {
- struct uac3_clock_source_descriptor *cs_desc;
-
- cs_desc = snd_usb_find_clock_source_v3(chip->ctrl_intf, clock);
- bmControls = le32_to_cpu(cs_desc->bmControls);
- } else {
- struct uac_clock_source_descriptor *cs_desc;
-
- cs_desc = snd_usb_find_clock_source(chip->ctrl_intf, clock);
- bmControls = cs_desc->bmControls;
+ cur_rate = snd_usb_set_sample_rate_v2v3(chip, fmt, clock, rate);
+ if (cur_rate < 0) {
+ usb_audio_err(chip,
+ "%d:%d: cannot set freq %d (v2/v3): err %d\n",
+ iface, fmt->altsetting, rate, cur_rate);
+ return cur_rate;
}
- writeable = uac_v2v3_control_is_writeable(bmControls,
- UAC2_CS_CONTROL_SAM_FREQ);
- if (writeable) {
- data = cpu_to_le32(rate);
- err = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), UAC2_CS_CUR,
- USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_OUT,
- UAC2_CS_CONTROL_SAM_FREQ << 8,
- snd_usb_ctrl_intf(chip) | (clock << 8),
- &data, sizeof(data));
- if (err < 0) {
- usb_audio_err(chip,
- "%d:%d: cannot set freq %d (v2/v3): err %d\n",
- iface, fmt->altsetting, rate, err);
- return err;
- }
-
- cur_rate = get_sample_rate_v2v3(chip, iface,
- fmt->altsetting, clock);
- } else {
+ if (!cur_rate)
cur_rate = prev_rate;
- }
if (cur_rate != rate) {
- if (!writeable) {
- usb_audio_warn(chip,
- "%d:%d: freq mismatch (RO clock): req %d, clock runs @%d\n",
- iface, fmt->altsetting, rate, cur_rate);
- return -ENXIO;
- }
- usb_audio_dbg(chip,
- "current rate %d is different from the runtime rate %d\n",
- cur_rate, rate);
+ usb_audio_warn(chip,
+ "%d:%d: freq mismatch (RO clock): req %d, clock runs @%d\n",
+ fmt->iface, fmt->altsetting, rate, cur_rate);
+ return -ENXIO;
}
/* Some devices doesn't respond to sample rate changes while the
diff --git a/sound/usb/clock.h b/sound/usb/clock.h
index 68df0fbe09d00..97597f5a3c18a 100644
--- a/sound/usb/clock.h
+++ b/sound/usb/clock.h
@@ -9,4 +9,8 @@ int snd_usb_init_sample_rate(struct snd_usb_audio *chip, int iface,
int snd_usb_clock_find_source(struct snd_usb_audio *chip,
struct audioformat *fmt, bool validate);
+int snd_usb_set_sample_rate_v2v3(struct snd_usb_audio *chip,
+ const struct audioformat *fmt,
+ int clock, int rate);
+
#endif /* __USBAUDIO_CLOCK_H */
diff --git a/sound/usb/format.c b/sound/usb/format.c
index 1f9ea513230a6..442df4578182d 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -367,6 +367,97 @@ static int line6_parse_audio_format_rates_quirk(struct snd_usb_audio *chip,
return -ENODEV;
}
+/* check whether the given altsetting is supported for the already set rate */
+static bool check_valid_altsetting_v2v3(struct snd_usb_audio *chip, int iface,
+ int altsetting)
+{
+ struct usb_device *dev = chip->dev;
+ __le64 raw_data = 0;
+ u64 data;
+ int err;
+
+ /* we assume 64bit is enough for any altsettings */
+ if (snd_BUG_ON(altsetting >= 64 - 8))
+ return false;
+
+ err = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), UAC2_CS_CUR,
+ USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN,
+ UAC2_AS_VAL_ALT_SETTINGS << 8,
+ iface, &raw_data, sizeof(raw_data));
+ if (err < 0)
+ return false;
+
+ data = le64_to_cpu(raw_data);
+ /* first byte contains the bitmap size */
+ if ((data & 0xff) * 8 < altsetting)
+ return false;
+ if (data & (1ULL << (altsetting + 8)))
+ return true;
+
+ return false;
+}
+
+/*
+ * Validate each sample rate with the altsetting
+ * Rebuild the rate table if only partial values are valid
+ */
+static int validate_sample_rate_table_v2v3(struct snd_usb_audio *chip,
+ struct audioformat *fp,
+ int clock)
+{
+ struct usb_device *dev = chip->dev;
+ unsigned int *table;
+ unsigned int nr_rates;
+ unsigned int rate_min = 0x7fffffff;
+ unsigned int rate_max = 0;
+ unsigned int rates = 0;
+ int i, err;
+
+ table = kcalloc(fp->nr_rates, sizeof(*table), GFP_KERNEL);
+ if (!table)
+ return -ENOMEM;
+
+ /* clear the interface altsetting at first */
+ usb_set_interface(dev, fp->iface, 0);
+
+ nr_rates = 0;
+ for (i = 0; i < fp->nr_rates; i++) {
+ err = snd_usb_set_sample_rate_v2v3(chip, fp, clock,
+ fp->rate_table[i]);
+ if (err < 0)
+ continue;
+
+ if (check_valid_altsetting_v2v3(chip, fp->iface, fp->altsetting)) {
+ table[nr_rates++] = fp->rate_table[i];
+ if (rate_min > fp->rate_table[i])
+ rate_min = fp->rate_table[i];
+ if (rate_max < fp->rate_table[i])
+ rate_max = fp->rate_table[i];
+ rates |= snd_pcm_rate_to_rate_bit(fp->rate_table[i]);
+ }
+ }
+
+ if (!nr_rates) {
+ usb_audio_dbg(chip,
+ "No valid sample rate available for %d:%d, assuming a firmware bug\n",
+ fp->iface, fp->altsetting);
+ nr_rates = fp->nr_rates; /* continue as is */
+ }
+
+ if (fp->nr_rates == nr_rates) {
+ kfree(table);
+ return 0;
+ }
+
+ kfree(fp->rate_table);
+ fp->rate_table = table;
+ fp->nr_rates = nr_rates;
+ fp->rate_min = rate_min;
+ fp->rate_max = rate_max;
+ fp->rates = rates;
+ return 0;
+}
+
/*
* parse the format descriptor and stores the possible sample rates
* on the audioformat table (audio class v2 and v3).
@@ -459,6 +550,8 @@ static int parse_audio_format_rates_v2v3(struct snd_usb_audio *chip,
* allocated, so the rates will be stored */
parse_uac2_sample_rate_range(chip, fp, nr_triplets, data);
+ ret = validate_sample_rate_table_v2v3(chip, fp, clock);
+
err_free:
kfree(data);
err:
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* Re: [PATCH AUTOSEL 5.4 057/130] ALSA: usb-audio: Check valid altsetting at parsing rates for UAC2/3
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 057/130] ALSA: usb-audio: Check valid altsetting at parsing rates for UAC2/3 Sasha Levin
@ 2020-12-23 7:09 ` Takashi Iwai
2020-12-23 14:15 ` Sasha Levin
0 siblings, 1 reply; 139+ messages in thread
From: Takashi Iwai @ 2020-12-23 7:09 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel, stable, Dylan Robinson, Keith Milner, alsa-devel
On Wed, 23 Dec 2020 03:17:00 +0100,
Sasha Levin wrote:
>
> From: Takashi Iwai <tiwai@suse.de>
>
> [ Upstream commit 93db51d06b32227319dae2ac289029ccf1b33181 ]
>
> The current driver code assumes blindly that all found sample rates for
> the same endpoint from the UAC2 and UAC3 descriptors can be used no
> matter which altsetting, but actually this was wrong: some devices
> accept only limited sample rates in each altsetting. For determining
> which altsetting supports which rate, we need to verify each sample rate
> and check the validity via UAC2_AS_VAL_ALT_SETTINGS. This control
> reports back the available altsettings as a bitmap.
>
> This patch implements the missing piece above, the verification and
> reconstructs the sample rate tables based on the result.
>
> An open question is how to deal with the altsettings that ended up
> with no valid sample rates after verification. At least, there is a
> device that showed this problem although the sample rates did work in
> the later usage (see bug link). For now, we accept such an altset as
> is, assuming that it's a firmware bug.
>
> Reported-by: Dylan Robinson <dylan_robinson@motu.com>
> Tested-by: Keith Milner <kamilner@superlative.org>
> Tested-by: Dylan Robinson <dylan_robinson@motu.com>
> BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1178203
> Link: https://lore.kernel.org/r/20201123085347.19667-4-tiwai@suse.de
> Signed-off-by: Takashi Iwai <tiwai@suse.de>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
Please drop this for 5.4 or older. At least this caused some problem
on 5.3 kernel that confused USB core by some reason while it works
fine with the recent upstream.
thanks,
Takashi
^ permalink raw reply [flat|nested] 139+ messages in thread
* Re: [PATCH AUTOSEL 5.4 057/130] ALSA: usb-audio: Check valid altsetting at parsing rates for UAC2/3
2020-12-23 7:09 ` Takashi Iwai
@ 2020-12-23 14:15 ` Sasha Levin
0 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 14:15 UTC (permalink / raw)
To: Takashi Iwai
Cc: linux-kernel, stable, Dylan Robinson, Keith Milner, alsa-devel
On Wed, Dec 23, 2020 at 08:09:41AM +0100, Takashi Iwai wrote:
>On Wed, 23 Dec 2020 03:17:00 +0100,
>Sasha Levin wrote:
>>
>> From: Takashi Iwai <tiwai@suse.de>
>>
>> [ Upstream commit 93db51d06b32227319dae2ac289029ccf1b33181 ]
>>
>> The current driver code assumes blindly that all found sample rates for
>> the same endpoint from the UAC2 and UAC3 descriptors can be used no
>> matter which altsetting, but actually this was wrong: some devices
>> accept only limited sample rates in each altsetting. For determining
>> which altsetting supports which rate, we need to verify each sample rate
>> and check the validity via UAC2_AS_VAL_ALT_SETTINGS. This control
>> reports back the available altsettings as a bitmap.
>>
>> This patch implements the missing piece above, the verification and
>> reconstructs the sample rate tables based on the result.
>>
>> An open question is how to deal with the altsettings that ended up
>> with no valid sample rates after verification. At least, there is a
>> device that showed this problem although the sample rates did work in
>> the later usage (see bug link). For now, we accept such an altset as
>> is, assuming that it's a firmware bug.
>>
>> Reported-by: Dylan Robinson <dylan_robinson@motu.com>
>> Tested-by: Keith Milner <kamilner@superlative.org>
>> Tested-by: Dylan Robinson <dylan_robinson@motu.com>
>> BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1178203
>> Link: https://lore.kernel.org/r/20201123085347.19667-4-tiwai@suse.de
>> Signed-off-by: Takashi Iwai <tiwai@suse.de>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>
>Please drop this for 5.4 or older. At least this caused some problem
>on 5.3 kernel that confused USB core by some reason while it works
>fine with the recent upstream.
Will do, thanks.
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 139+ messages in thread
* [PATCH AUTOSEL 5.4 058/130] rxrpc: Don't leak the service-side session key to userspace
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (55 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 057/130] ALSA: usb-audio: Check valid altsetting at parsing rates for UAC2/3 Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 059/130] scsi: atari_scsi: Fix race condition between .queuecommand and EH Sasha Levin
` (71 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: David Howells, Sasha Levin, linux-afs, keyrings, netdev
From: David Howells <dhowells@redhat.com>
[ Upstream commit d2ae4e918218f543214fbd906db68a6c580efbbb ]
Don't let someone reading a service-side rxrpc-type key get access to the
session key that was exchanged with the client. The server application
will, at some point, need to be able to read the information in the ticket,
but this probably shouldn't include the key material.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/keys/rxrpc-type.h | 1 +
net/rxrpc/key.c | 8 ++++++--
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/include/keys/rxrpc-type.h b/include/keys/rxrpc-type.h
index a183278c3e9ef..63dc02507b8f3 100644
--- a/include/keys/rxrpc-type.h
+++ b/include/keys/rxrpc-type.h
@@ -84,6 +84,7 @@ struct rxk5_key {
*/
struct rxrpc_key_token {
u16 security_index; /* RxRPC header security index */
+ bool no_leak_key; /* Don't copy the key to userspace */
struct rxrpc_key_token *next; /* the next token in the list */
union {
struct rxkad_key *kad;
diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index 85a9ff8cd236a..131fd90638248 100644
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -1075,7 +1075,8 @@ static long rxrpc_read(const struct key *key,
case RXRPC_SECURITY_RXKAD:
toksize += 8 * 4; /* viceid, kvno, key*2, begin,
* end, primary, tktlen */
- toksize += RND(token->kad->ticket_len);
+ if (!token->no_leak_key)
+ toksize += RND(token->kad->ticket_len);
break;
case RXRPC_SECURITY_RXK5:
@@ -1179,7 +1180,10 @@ static long rxrpc_read(const struct key *key,
ENCODE(token->kad->start);
ENCODE(token->kad->expiry);
ENCODE(token->kad->primary_flag);
- ENCODE_DATA(token->kad->ticket_len, token->kad->ticket);
+ if (token->no_leak_key)
+ ENCODE(0);
+ else
+ ENCODE_DATA(token->kad->ticket_len, token->kad->ticket);
break;
case RXRPC_SECURITY_RXK5:
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 059/130] scsi: atari_scsi: Fix race condition between .queuecommand and EH
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (56 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 058/130] rxrpc: Don't leak the service-side session key to userspace Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 060/130] rtw88: coex: change the decode method from firmware Sasha Levin
` (70 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Finn Thain, Michael Schmitz, Martin K . Petersen, Sasha Levin,
linux-scsi
From: Finn Thain <fthain@telegraphics.com.au>
[ Upstream commit 03fe6a640a05c5dc04b6bcdddfb981d015e84ed4 ]
It is possible that bus_reset_cleanup() or .eh_abort_handler could be
invoked during NCR5380_queuecommand(). If that takes place before the new
command is enqueued and after the ST-DMA "lock" has been acquired, the
ST-DMA "lock" will be released again. This will result in a lost DMA
interrupt and a command timeout. Fix this by excluding EH and interrupt
handlers while the new command is enqueued.
Link: https://lore.kernel.org/r/af25163257796b50bb99d4ede4025cea55787b8f.1605847196.git.fthain@telegraphics.com.au
Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Reviewed-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/NCR5380.c | 9 ++++++---
drivers/scsi/atari_scsi.c | 10 +++-------
2 files changed, 9 insertions(+), 10 deletions(-)
diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
index d4401c768a0c7..5db10a16a743a 100644
--- a/drivers/scsi/NCR5380.c
+++ b/drivers/scsi/NCR5380.c
@@ -567,11 +567,14 @@ static int NCR5380_queue_command(struct Scsi_Host *instance,
cmd->result = 0;
- if (!NCR5380_acquire_dma_irq(instance))
- return SCSI_MLQUEUE_HOST_BUSY;
-
spin_lock_irqsave(&hostdata->lock, flags);
+ if (!NCR5380_acquire_dma_irq(instance)) {
+ spin_unlock_irqrestore(&hostdata->lock, flags);
+
+ return SCSI_MLQUEUE_HOST_BUSY;
+ }
+
/*
* Insert the cmd into the issue queue. Note that REQUEST SENSE
* commands are added to the head of the queue since any command will
diff --git a/drivers/scsi/atari_scsi.c b/drivers/scsi/atari_scsi.c
index a82b63a666356..95d7a35860836 100644
--- a/drivers/scsi/atari_scsi.c
+++ b/drivers/scsi/atari_scsi.c
@@ -376,15 +376,11 @@ static int falcon_get_lock(struct Scsi_Host *instance)
if (IS_A_TT())
return 1;
- if (stdma_is_locked_by(scsi_falcon_intr) &&
- instance->hostt->can_queue > 1)
+ if (stdma_is_locked_by(scsi_falcon_intr))
return 1;
- if (in_interrupt())
- return stdma_try_lock(scsi_falcon_intr, instance);
-
- stdma_lock(scsi_falcon_intr, instance);
- return 1;
+ /* stdma_lock() may sleep which means it can't be used here */
+ return stdma_try_lock(scsi_falcon_intr, instance);
}
#ifndef MODULE
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 060/130] rtw88: coex: change the decode method from firmware
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (57 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 059/130] scsi: atari_scsi: Fix race condition between .queuecommand and EH Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 061/130] ARM: dts: hisilicon: fix errors detected by snps-dw-apb-uart.yaml Sasha Levin
` (69 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ching-Te Ku, Ping-Ke Shih, Kalle Valo, Sasha Levin,
linux-wireless, netdev
From: Ching-Te Ku <ku920601@realtek.com>
[ Upstream commit 362c4a5cc886e9c369bf2106ab648c2ad076abb6 ]
Fix sometimes FW information will be parsed as wrong value,
do a correction of sign bit to show the correct information.
(Ex, Value should be 20, but it shows 236.)
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201112031430.4846-12-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/coex.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c
index 853ac1c2ed73c..634044a14bb78 100644
--- a/drivers/net/wireless/realtek/rtw88/coex.c
+++ b/drivers/net/wireless/realtek/rtw88/coex.c
@@ -2451,7 +2451,7 @@ void rtw_coex_wl_fwdbginfo_notify(struct rtw_dev *rtwdev, u8 *buf, u8 length)
if (buf[i] >= val)
coex_stat->wl_fw_dbg_info[i] = buf[i] - val;
else
- coex_stat->wl_fw_dbg_info[i] = val - buf[i];
+ coex_stat->wl_fw_dbg_info[i] = 255 - val + buf[i];
coex_stat->wl_fw_dbg_info_pre[i] = buf[i];
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 061/130] ARM: dts: hisilicon: fix errors detected by snps-dw-apb-uart.yaml
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (58 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 060/130] rtw88: coex: change the decode method from firmware Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 062/130] ARM: dts: hisilicon: fix errors detected by pl011.yaml Sasha Levin
` (68 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhen Lei, Wei Xu, Sasha Levin, linux-arm-kernel, devicetree
From: Zhen Lei <thunder.leizhen@huawei.com>
[ Upstream commit 30ea026e33c6dda48849d9fe0d15c1d280a92d53 ]
1. Change node name to match '^serial(@[0-9a-f,]+)*$'
2. Change clock-names to "baudclk", "apb_pclk". Both of them use the same
clock.
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/hip01.dtsi | 24 ++++++++++++------------
arch/arm/boot/dts/hip04-d01.dts | 2 +-
arch/arm/boot/dts/hip04.dtsi | 6 +++---
3 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/arch/arm/boot/dts/hip01.dtsi b/arch/arm/boot/dts/hip01.dtsi
index 975d39828405f..fd09e6d9309c7 100644
--- a/arch/arm/boot/dts/hip01.dtsi
+++ b/arch/arm/boot/dts/hip01.dtsi
@@ -41,41 +41,41 @@ amba {
compatible = "simple-bus";
ranges;
- uart0: uart@10001000 {
+ uart0: serial@10001000 {
compatible = "snps,dw-apb-uart";
reg = <0x10001000 0x1000>;
- clocks = <&hisi_refclk144mhz>;
- clock-names = "apb_pclk";
+ clocks = <&hisi_refclk144mhz>, <&hisi_refclk144mhz>;
+ clock-names = "baudclk", "apb_pclk";
reg-shift = <2>;
interrupts = <0 32 4>;
status = "disabled";
};
- uart1: uart@10002000 {
+ uart1: serial@10002000 {
compatible = "snps,dw-apb-uart";
reg = <0x10002000 0x1000>;
- clocks = <&hisi_refclk144mhz>;
- clock-names = "apb_pclk";
+ clocks = <&hisi_refclk144mhz>, <&hisi_refclk144mhz>;
+ clock-names = "baudclk", "apb_pclk";
reg-shift = <2>;
interrupts = <0 33 4>;
status = "disabled";
};
- uart2: uart@10003000 {
+ uart2: serial@10003000 {
compatible = "snps,dw-apb-uart";
reg = <0x10003000 0x1000>;
- clocks = <&hisi_refclk144mhz>;
- clock-names = "apb_pclk";
+ clocks = <&hisi_refclk144mhz>, <&hisi_refclk144mhz>;
+ clock-names = "baudclk", "apb_pclk";
reg-shift = <2>;
interrupts = <0 34 4>;
status = "disabled";
};
- uart3: uart@10006000 {
+ uart3: serial@10006000 {
compatible = "snps,dw-apb-uart";
reg = <0x10006000 0x1000>;
- clocks = <&hisi_refclk144mhz>;
- clock-names = "apb_pclk";
+ clocks = <&hisi_refclk144mhz>, <&hisi_refclk144mhz>;
+ clock-names = "baudclk", "apb_pclk";
reg-shift = <2>;
interrupts = <0 4 4>;
status = "disabled";
diff --git a/arch/arm/boot/dts/hip04-d01.dts b/arch/arm/boot/dts/hip04-d01.dts
index 9019e0d2ef60b..f5691dbc26d24 100644
--- a/arch/arm/boot/dts/hip04-d01.dts
+++ b/arch/arm/boot/dts/hip04-d01.dts
@@ -22,7 +22,7 @@ memory@0,10000000 {
};
soc {
- uart0: uart@4007000 {
+ uart0: serial@4007000 {
status = "ok";
};
};
diff --git a/arch/arm/boot/dts/hip04.dtsi b/arch/arm/boot/dts/hip04.dtsi
index 4263a9339c2e5..c12ded274c755 100644
--- a/arch/arm/boot/dts/hip04.dtsi
+++ b/arch/arm/boot/dts/hip04.dtsi
@@ -250,12 +250,12 @@ arm-pmu {
<0 79 4>;
};
- uart0: uart@4007000 {
+ uart0: serial@4007000 {
compatible = "snps,dw-apb-uart";
reg = <0x4007000 0x1000>;
interrupts = <0 381 4>;
- clocks = <&clk_168m>;
- clock-names = "uartclk";
+ clocks = <&clk_168m>, <&clk_168m>;
+ clock-names = "baudclk", "apb_pclk";
reg-shift = <2>;
status = "disabled";
};
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 062/130] ARM: dts: hisilicon: fix errors detected by pl011.yaml
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (59 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 061/130] ARM: dts: hisilicon: fix errors detected by snps-dw-apb-uart.yaml Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 063/130] ARM: dts: hisilicon: fix errors detected by usb yaml Sasha Levin
` (67 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhen Lei, Wei Xu, Sasha Levin, linux-arm-kernel, devicetree
From: Zhen Lei <thunder.leizhen@huawei.com>
[ Upstream commit e5e225fd495ef1dffc64b81b2094e427f9cc4016 ]
1. Change node name to match '^serial(@[0-9a-f,]+)*$'
2. Change clock-names to "uartclk", "apb_pclk". Both of them use the same
clock.
3. Change pinctrl-names to "default", "sleep".
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/hi3519.dtsi | 20 +++++++++----------
arch/arm/boot/dts/hi3620-hi4511.dts | 20 +++++++++----------
arch/arm/boot/dts/hi3620.dtsi | 30 ++++++++++++++---------------
arch/arm/boot/dts/hisi-x5hd2.dtsi | 30 ++++++++++++++---------------
4 files changed, 50 insertions(+), 50 deletions(-)
diff --git a/arch/arm/boot/dts/hi3519.dtsi b/arch/arm/boot/dts/hi3519.dtsi
index 410409a0ed662..630753c0d7044 100644
--- a/arch/arm/boot/dts/hi3519.dtsi
+++ b/arch/arm/boot/dts/hi3519.dtsi
@@ -52,8 +52,8 @@ uart0: serial@12100000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x12100000 0x1000>;
interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&crg HI3519_UART0_CLK>;
- clock-names = "apb_pclk";
+ clocks = <&crg HI3519_UART0_CLK>, <&crg HI3519_UART0_CLK>;
+ clock-names = "uartclk", "apb_pclk";
status = "disable";
};
@@ -61,8 +61,8 @@ uart1: serial@12101000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x12101000 0x1000>;
interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&crg HI3519_UART1_CLK>;
- clock-names = "apb_pclk";
+ clocks = <&crg HI3519_UART1_CLK>, <&crg HI3519_UART1_CLK>;
+ clock-names = "uartclk", "apb_pclk";
status = "disable";
};
@@ -70,8 +70,8 @@ uart2: serial@12102000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x12102000 0x1000>;
interrupts = <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&crg HI3519_UART2_CLK>;
- clock-names = "apb_pclk";
+ clocks = <&crg HI3519_UART2_CLK>, <&crg HI3519_UART2_CLK>;
+ clock-names = "uartclk", "apb_pclk";
status = "disable";
};
@@ -79,8 +79,8 @@ uart3: serial@12103000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x12103000 0x1000>;
interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&crg HI3519_UART3_CLK>;
- clock-names = "apb_pclk";
+ clocks = <&crg HI3519_UART3_CLK>, <&crg HI3519_UART3_CLK>;
+ clock-names = "uartclk", "apb_pclk";
status = "disable";
};
@@ -88,8 +88,8 @@ uart4: serial@12104000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x12104000 0x1000>;
interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&crg HI3519_UART4_CLK>;
- clock-names = "apb_pclk";
+ clocks = <&crg HI3519_UART4_CLK>, <&crg HI3519_UART4_CLK>;
+ clock-names = "uartclk", "apb_pclk";
status = "disable";
};
diff --git a/arch/arm/boot/dts/hi3620-hi4511.dts b/arch/arm/boot/dts/hi3620-hi4511.dts
index 8c703c3f2fe09..1c62bdcca647a 100644
--- a/arch/arm/boot/dts/hi3620-hi4511.dts
+++ b/arch/arm/boot/dts/hi3620-hi4511.dts
@@ -27,36 +27,36 @@ dual_timer0: dual_timer@800000 {
status = "ok";
};
- uart0: uart@b00000 { /* console */
- pinctrl-names = "default", "idle";
+ uart0: serial@b00000 { /* console */
+ pinctrl-names = "default", "sleep";
pinctrl-0 = <&uart0_pmx_func &uart0_cfg_func>;
pinctrl-1 = <&uart0_pmx_idle &uart0_cfg_idle>;
status = "ok";
};
- uart1: uart@b01000 { /* modem */
- pinctrl-names = "default", "idle";
+ uart1: serial@b01000 { /* modem */
+ pinctrl-names = "default", "sleep";
pinctrl-0 = <&uart1_pmx_func &uart1_cfg_func>;
pinctrl-1 = <&uart1_pmx_idle &uart1_cfg_idle>;
status = "ok";
};
- uart2: uart@b02000 { /* audience */
- pinctrl-names = "default", "idle";
+ uart2: serial@b02000 { /* audience */
+ pinctrl-names = "default", "sleep";
pinctrl-0 = <&uart2_pmx_func &uart2_cfg_func>;
pinctrl-1 = <&uart2_pmx_idle &uart2_cfg_idle>;
status = "ok";
};
- uart3: uart@b03000 {
- pinctrl-names = "default", "idle";
+ uart3: serial@b03000 {
+ pinctrl-names = "default", "sleep";
pinctrl-0 = <&uart3_pmx_func &uart3_cfg_func>;
pinctrl-1 = <&uart3_pmx_idle &uart3_cfg_idle>;
status = "ok";
};
- uart4: uart@b04000 {
- pinctrl-names = "default", "idle";
+ uart4: serial@b04000 {
+ pinctrl-names = "default", "sleep";
pinctrl-0 = <&uart4_pmx_func &uart4_cfg_func>;
pinctrl-1 = <&uart4_pmx_idle &uart4_cfg_func>;
status = "ok";
diff --git a/arch/arm/boot/dts/hi3620.dtsi b/arch/arm/boot/dts/hi3620.dtsi
index 9c207a690df50..cb7e932e094f6 100644
--- a/arch/arm/boot/dts/hi3620.dtsi
+++ b/arch/arm/boot/dts/hi3620.dtsi
@@ -162,48 +162,48 @@ timer5: timer@600 {
interrupts = <1 13 0xf01>;
};
- uart0: uart@b00000 {
+ uart0: serial@b00000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0xb00000 0x1000>;
interrupts = <0 20 4>;
- clocks = <&clock HI3620_UARTCLK0>;
- clock-names = "apb_pclk";
+ clocks = <&clock HI3620_UARTCLK0>, <&clock HI3620_UARTCLK0>;
+ clock-names = "uartclk", "apb_pclk";
status = "disabled";
};
- uart1: uart@b01000 {
+ uart1: serial@b01000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0xb01000 0x1000>;
interrupts = <0 21 4>;
- clocks = <&clock HI3620_UARTCLK1>;
- clock-names = "apb_pclk";
+ clocks = <&clock HI3620_UARTCLK1>, <&clock HI3620_UARTCLK1>;
+ clock-names = "uartclk", "apb_pclk";
status = "disabled";
};
- uart2: uart@b02000 {
+ uart2: serial@b02000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0xb02000 0x1000>;
interrupts = <0 22 4>;
- clocks = <&clock HI3620_UARTCLK2>;
- clock-names = "apb_pclk";
+ clocks = <&clock HI3620_UARTCLK2>, <&clock HI3620_UARTCLK2>;
+ clock-names = "uartclk", "apb_pclk";
status = "disabled";
};
- uart3: uart@b03000 {
+ uart3: serial@b03000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0xb03000 0x1000>;
interrupts = <0 23 4>;
- clocks = <&clock HI3620_UARTCLK3>;
- clock-names = "apb_pclk";
+ clocks = <&clock HI3620_UARTCLK3>, <&clock HI3620_UARTCLK3>;
+ clock-names = "uartclk", "apb_pclk";
status = "disabled";
};
- uart4: uart@b04000 {
+ uart4: serial@b04000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0xb04000 0x1000>;
interrupts = <0 24 4>;
- clocks = <&clock HI3620_UARTCLK4>;
- clock-names = "apb_pclk";
+ clocks = <&clock HI3620_UARTCLK4>, <&clock HI3620_UARTCLK4>;
+ clock-names = "uartclk", "apb_pclk";
status = "disabled";
};
diff --git a/arch/arm/boot/dts/hisi-x5hd2.dtsi b/arch/arm/boot/dts/hisi-x5hd2.dtsi
index 696e6982a688b..d8800992b4d0c 100644
--- a/arch/arm/boot/dts/hisi-x5hd2.dtsi
+++ b/arch/arm/boot/dts/hisi-x5hd2.dtsi
@@ -86,48 +86,48 @@ timer4: timer@a81000 {
status = "disabled";
};
- uart0: uart@b00000 {
+ uart0: serial@b00000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x00b00000 0x1000>;
interrupts = <0 49 4>;
- clocks = <&clock HIX5HD2_FIXED_83M>;
- clock-names = "apb_pclk";
+ clocks = <&clock HIX5HD2_FIXED_83M>, <&clock HIX5HD2_FIXED_83M>;
+ clock-names = "uartclk", "apb_pclk";
status = "disabled";
};
- uart1: uart@6000 {
+ uart1: serial@6000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x00006000 0x1000>;
interrupts = <0 50 4>;
- clocks = <&clock HIX5HD2_FIXED_83M>;
- clock-names = "apb_pclk";
+ clocks = <&clock HIX5HD2_FIXED_83M>, <&clock HIX5HD2_FIXED_83M>;
+ clock-names = "uartclk", "apb_pclk";
status = "disabled";
};
- uart2: uart@b02000 {
+ uart2: serial@b02000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x00b02000 0x1000>;
interrupts = <0 51 4>;
- clocks = <&clock HIX5HD2_FIXED_83M>;
- clock-names = "apb_pclk";
+ clocks = <&clock HIX5HD2_FIXED_83M>, <&clock HIX5HD2_FIXED_83M>;
+ clock-names = "uartclk", "apb_pclk";
status = "disabled";
};
- uart3: uart@b03000 {
+ uart3: serial@b03000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x00b03000 0x1000>;
interrupts = <0 52 4>;
- clocks = <&clock HIX5HD2_FIXED_83M>;
- clock-names = "apb_pclk";
+ clocks = <&clock HIX5HD2_FIXED_83M>, <&clock HIX5HD2_FIXED_83M>;
+ clock-names = "uartclk", "apb_pclk";
status = "disabled";
};
- uart4: uart@b04000 {
+ uart4: serial@b04000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0xb04000 0x1000>;
interrupts = <0 53 4>;
- clocks = <&clock HIX5HD2_FIXED_83M>;
- clock-names = "apb_pclk";
+ clocks = <&clock HIX5HD2_FIXED_83M>, <&clock HIX5HD2_FIXED_83M>;
+ clock-names = "uartclk", "apb_pclk";
status = "disabled";
};
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 063/130] ARM: dts: hisilicon: fix errors detected by usb yaml
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (60 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 062/130] ARM: dts: hisilicon: fix errors detected by pl011.yaml Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 064/130] ARM: dts: hisilicon: fix errors detected by simple-bus.yaml Sasha Levin
` (66 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhen Lei, Wei Xu, Sasha Levin, linux-arm-kernel, devicetree
From: Zhen Lei <thunder.leizhen@huawei.com>
[ Upstream commit 64f5b52554a1de47a53972a47b9b58d8d66ee5aa ]
1. Change node name to match '^usb(@.*)?'
These errors are detected by generic-ehci.yaml and generic-ohci.yaml.
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/hisi-x5hd2.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/hisi-x5hd2.dtsi b/arch/arm/boot/dts/hisi-x5hd2.dtsi
index d8800992b4d0c..da42b9400759b 100644
--- a/arch/arm/boot/dts/hisi-x5hd2.dtsi
+++ b/arch/arm/boot/dts/hisi-x5hd2.dtsi
@@ -452,14 +452,14 @@ gmac1: ethernet@1841000 {
status = "disabled";
};
- usb0: ehci@1890000 {
+ usb0: usb@1890000 {
compatible = "generic-ehci";
reg = <0x1890000 0x1000>;
interrupts = <0 66 4>;
clocks = <&clock HIX5HD2_USB_CLK>;
};
- usb1: ohci@1880000 {
+ usb1: usb@1880000 {
compatible = "generic-ohci";
reg = <0x1880000 0x1000>;
interrupts = <0 67 4>;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 064/130] ARM: dts: hisilicon: fix errors detected by simple-bus.yaml
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (61 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 063/130] ARM: dts: hisilicon: fix errors detected by usb yaml Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 065/130] ARM: dts: hisilicon: fix errors detected by spi-pl022.yaml Sasha Levin
` (65 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhen Lei, Wei Xu, Sasha Levin, linux-arm-kernel, devicetree
From: Zhen Lei <thunder.leizhen@huawei.com>
[ Upstream commit 8e9e8dd7ce093344a89792deaeb6caedde636dcf ]
Change bus node name from "amba" to "amba-bus" to match
'^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/hi3620-hi4511.dts | 2 +-
arch/arm/boot/dts/hi3620.dtsi | 2 +-
arch/arm/boot/dts/hip01.dtsi | 2 +-
arch/arm/boot/dts/hisi-x5hd2.dtsi | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm/boot/dts/hi3620-hi4511.dts b/arch/arm/boot/dts/hi3620-hi4511.dts
index 1c62bdcca647a..29eedc7fef986 100644
--- a/arch/arm/boot/dts/hi3620-hi4511.dts
+++ b/arch/arm/boot/dts/hi3620-hi4511.dts
@@ -22,7 +22,7 @@ memory {
reg = <0x40000000 0x20000000>;
};
- amba {
+ amba-bus {
dual_timer0: dual_timer@800000 {
status = "ok";
};
diff --git a/arch/arm/boot/dts/hi3620.dtsi b/arch/arm/boot/dts/hi3620.dtsi
index cb7e932e094f6..fa3a287c50b5a 100644
--- a/arch/arm/boot/dts/hi3620.dtsi
+++ b/arch/arm/boot/dts/hi3620.dtsi
@@ -63,7 +63,7 @@ cpu@3 {
};
};
- amba {
+ amba-bus {
#address-cells = <1>;
#size-cells = <1>;
diff --git a/arch/arm/boot/dts/hip01.dtsi b/arch/arm/boot/dts/hip01.dtsi
index fd09e6d9309c7..2a79636053900 100644
--- a/arch/arm/boot/dts/hip01.dtsi
+++ b/arch/arm/boot/dts/hip01.dtsi
@@ -35,7 +35,7 @@ soc {
interrupt-parent = <&gic>;
ranges = <0 0x10000000 0x20000000>;
- amba {
+ amba-bus {
#address-cells = <1>;
#size-cells = <1>;
compatible = "simple-bus";
diff --git a/arch/arm/boot/dts/hisi-x5hd2.dtsi b/arch/arm/boot/dts/hisi-x5hd2.dtsi
index da42b9400759b..f9daee9392506 100644
--- a/arch/arm/boot/dts/hisi-x5hd2.dtsi
+++ b/arch/arm/boot/dts/hisi-x5hd2.dtsi
@@ -30,7 +30,7 @@ soc {
interrupt-parent = <&gic>;
ranges = <0 0xf8000000 0x8000000>;
- amba {
+ amba-bus {
#address-cells = <1>;
#size-cells = <1>;
compatible = "simple-bus";
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 065/130] ARM: dts: hisilicon: fix errors detected by spi-pl022.yaml
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (62 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 064/130] ARM: dts: hisilicon: fix errors detected by simple-bus.yaml Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 066/130] selftests/x86/fsgsbase: Fix GS == 1, 2, and 3 tests Sasha Levin
` (64 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhen Lei, Wei Xu, Sasha Levin, linux-arm-kernel, devicetree
From: Zhen Lei <thunder.leizhen@huawei.com>
[ Upstream commit 4c246408f0bdbc4100c95a5dad9e0688b4a3cfd0 ]
1. Change clock-names to "sspclk", "apb_pclk". Both of them use the same
clock.
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/hi3519.dtsi | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/arm/boot/dts/hi3519.dtsi b/arch/arm/boot/dts/hi3519.dtsi
index 630753c0d7044..c524c854d3192 100644
--- a/arch/arm/boot/dts/hi3519.dtsi
+++ b/arch/arm/boot/dts/hi3519.dtsi
@@ -127,8 +127,8 @@ spi_bus0: spi@12120000 {
compatible = "arm,pl022", "arm,primecell";
reg = <0x12120000 0x1000>;
interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&crg HI3519_SPI0_CLK>;
- clock-names = "apb_pclk";
+ clocks = <&crg HI3519_SPI0_CLK>, <&crg HI3519_SPI0_CLK>;
+ clock-names = "sspclk", "apb_pclk";
num-cs = <1>;
#address-cells = <1>;
#size-cells = <0>;
@@ -139,8 +139,8 @@ spi_bus1: spi@12121000 {
compatible = "arm,pl022", "arm,primecell";
reg = <0x12121000 0x1000>;
interrupts = <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&crg HI3519_SPI1_CLK>;
- clock-names = "apb_pclk";
+ clocks = <&crg HI3519_SPI1_CLK>, <&crg HI3519_SPI1_CLK>;
+ clock-names = "sspclk", "apb_pclk";
num-cs = <1>;
#address-cells = <1>;
#size-cells = <0>;
@@ -151,8 +151,8 @@ spi_bus2: spi@12122000 {
compatible = "arm,pl022", "arm,primecell";
reg = <0x12122000 0x1000>;
interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&crg HI3519_SPI2_CLK>;
- clock-names = "apb_pclk";
+ clocks = <&crg HI3519_SPI2_CLK>, <&crg HI3519_SPI2_CLK>;
+ clock-names = "sspclk", "apb_pclk";
num-cs = <1>;
#address-cells = <1>;
#size-cells = <0>;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 066/130] selftests/x86/fsgsbase: Fix GS == 1, 2, and 3 tests
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (63 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 065/130] ARM: dts: hisilicon: fix errors detected by spi-pl022.yaml Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 067/130] brcmsmac: ampdu: Check BA window size before checking block ack Sasha Levin
` (63 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Andy Lutomirski, Borislav Petkov, Sasha Levin, linux-kselftest
From: Andy Lutomirski <luto@kernel.org>
[ Upstream commit 716572b0003ef67a4889bd7d85baf5099c5a0248 ]
Setting GS to 1, 2, or 3 causes a nonsensical part of the IRET microcode
to change GS back to zero on a return from kernel mode to user mode. The
result is that these tests fail randomly depending on when interrupts
happen. Detect when this happens and let the test pass.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/7567fd44a1d60a9424f25b19a998f12149993b0d.1604346596.git.luto@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/x86/fsgsbase.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/x86/fsgsbase.c b/tools/testing/selftests/x86/fsgsbase.c
index 757bdb218a661..f2916838a7eb5 100644
--- a/tools/testing/selftests/x86/fsgsbase.c
+++ b/tools/testing/selftests/x86/fsgsbase.c
@@ -391,8 +391,8 @@ static void set_gs_and_switch_to(unsigned long local,
local = read_base(GS);
/*
- * Signal delivery seems to mess up weird selectors. Put it
- * back.
+ * Signal delivery is quite likely to change a selector
+ * of 1, 2, or 3 back to 0 due to IRET being defective.
*/
asm volatile ("mov %0, %%gs" : : "rm" (force_sel));
} else {
@@ -410,6 +410,14 @@ static void set_gs_and_switch_to(unsigned long local,
if (base == local && sel_pre_sched == sel_post_sched) {
printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n",
sel_pre_sched, local);
+ } else if (base == local && sel_pre_sched >= 1 && sel_pre_sched <= 3 &&
+ sel_post_sched == 0) {
+ /*
+ * IRET is misdesigned and will squash selectors 1, 2, or 3
+ * to zero. Don't fail the test just because this happened.
+ */
+ printf("[OK]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx because IRET is defective\n",
+ sel_pre_sched, local, sel_post_sched, base);
} else {
nerrs++;
printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n",
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 067/130] brcmsmac: ampdu: Check BA window size before checking block ack
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (64 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 066/130] selftests/x86/fsgsbase: Fix GS == 1, 2, and 3 tests Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 068/130] i40e: report correct VF link speed when link state is set to enable Sasha Levin
` (62 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dmitry Safonov, Yuji Nakao, Kalle Valo, Sasha Levin,
linux-wireless, brcm80211-dev-list.pdl, SHA-cyfmac-dev-list,
netdev
From: Dmitry Safonov <dima@arista.com>
[ Upstream commit 01c195de620bb6c3ecda0dbf295fe685d8232e10 ]
bindex can be out of BA window (64):
tid 0 seq 2983, start_seq 2915, bindex 68, index 39
tid 0 seq 2984, start_seq 2915, bindex 69, index 40
tid 0 seq 2985, start_seq 2915, bindex 70, index 41
tid 0 seq 2986, start_seq 2915, bindex 71, index 42
tid 0 seq 2879, start_seq 2915, bindex 4060, index 63
tid 0 seq 2854, start_seq 2915, bindex 4035, index 38
tid 0 seq 2795, start_seq 2915, bindex 3976, index 43
tid 0 seq 2989, start_seq 2924, bindex 65, index 45
tid 0 seq 2992, start_seq 2924, bindex 68, index 48
tid 0 seq 2993, start_seq 2924, bindex 69, index 49
tid 0 seq 2994, start_seq 2924, bindex 70, index 50
tid 0 seq 2997, start_seq 2924, bindex 73, index 53
tid 0 seq 2795, start_seq 2941, bindex 3950, index 43
tid 0 seq 2921, start_seq 2941, bindex 4076, index 41
tid 0 seq 2929, start_seq 2941, bindex 4084, index 49
tid 0 seq 3011, start_seq 2946, bindex 65, index 3
tid 0 seq 3012, start_seq 2946, bindex 66, index 4
tid 0 seq 3013, start_seq 2946, bindex 67, index 5
In result isset() will try to dereference something on the stack,
causing panics:
BUG: unable to handle page fault for address: ffffa742800ed01f
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 6a4e9067 P4D 6a4e9067 PUD 6a4ec067 PMD 6a4ed067 PTE 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Not tainted 5.8.5-arch1-1-kdump #1
Hardware name: Apple Inc. MacBookAir3,1/Mac-942452F5819B1C1B, BIOS MBA31.88Z.0061.B07.1201241641 01/24/12
RIP: 0010:brcms_c_ampdu_dotxstatus+0x343/0x9f0 [brcmsmac]
Code: 54 24 20 66 81 e2 ff 0f 41 83 e4 07 89 d1 0f b7 d2 66 c1 e9 03 0f b7 c9 4c 8d 5c 0c 48 49 8b 4d 10 48 8b 79 68 41 57 44 89 e1 <41> 0f b6 33 41 d3 e0 48 c7 c1 38 e0 ea c0 48 83 c7 10 44 21 c6 4c
RSP: 0018:ffffa742800ecdd0 EFLAGS: 00010207
RAX: 0000000000000019 RBX: 000000000000000b RCX: 0000000000000006
RDX: 0000000000000ffe RSI: 0000000000000004 RDI: ffff8fc6ad776800
RBP: ffff8fc6855acb00 R08: 0000000000000001 R09: 00000000000005d9
R10: 00000000fffffffe R11: ffffa742800ed01f R12: 0000000000000006
R13: ffff8fc68d75a000 R14: 00000000000005db R15: 0000000000000019
FS: 0000000000000000(0000) GS:ffff8fc6aad00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffa742800ed01f CR3: 000000002480a000 CR4: 00000000000406e0
Call Trace:
<IRQ>
brcms_c_dpc+0xb46/0x1020 [brcmsmac]
? wlc_intstatus+0xc8/0x180 [brcmsmac]
? __raise_softirq_irqoff+0x1a/0x80
brcms_dpc+0x37/0xd0 [brcmsmac]
tasklet_action_common.constprop.0+0x51/0xb0
__do_softirq+0xff/0x340
? handle_level_irq+0x1a0/0x1a0
asm_call_on_stack+0x12/0x20
</IRQ>
do_softirq_own_stack+0x5f/0x80
irq_exit_rcu+0xcb/0x120
common_interrupt+0xd1/0x200
asm_common_interrupt+0x1e/0x40
RIP: 0010:cpuidle_enter_state+0xb3/0x420
Check if the block is within BA window and only then check block's
status. Otherwise as Behan wrote: "When I came back to Dublin I
was courtmartialed in my absence and sentenced to death in my absence,
so I said they could shoot me in my absence."
Also reported:
https://bbs.archlinux.org/viewtopic.php?id=258428
https://lore.kernel.org/linux-wireless/87tuwgi92n.fsf@yujinakao.com/
Reported-by: Yuji Nakao <contact@yujinakao.com>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201116030635.645811-1-dima@arista.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c
index fa391e4eb0989..44f65b8bff9e0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c
@@ -953,14 +953,19 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
index = TX_SEQ_TO_INDEX(seq);
ack_recd = false;
if (ba_recd) {
+ int block_acked;
+
bindex = MODSUB_POW2(seq, start_seq, SEQNUM_MAX);
+ if (bindex < AMPDU_TX_BA_MAX_WSIZE)
+ block_acked = isset(bitmap, bindex);
+ else
+ block_acked = 0;
brcms_dbg_ht(wlc->hw->d11core,
"tid %d seq %d, start_seq %d, bindex %d set %d, index %d\n",
tid, seq, start_seq, bindex,
- isset(bitmap, bindex), index);
+ block_acked, index);
/* if acked then clear bit and free packet */
- if ((bindex < AMPDU_TX_BA_MAX_WSIZE)
- && isset(bitmap, bindex)) {
+ if (block_acked) {
ini->txretry[index] = 0;
/*
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 068/130] i40e: report correct VF link speed when link state is set to enable
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (65 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 067/130] brcmsmac: ampdu: Check BA window size before checking block ack Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 069/130] hv_netvsc: Validate number of allocated sub-channels Sasha Levin
` (61 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Stefan Assmann, Aaron Brown, Tony Nguyen, Sasha Levin,
intel-wired-lan, netdev
From: Stefan Assmann <sassmann@kpanic.de>
[ Upstream commit 6ec12e1e9404acb27a7434220bbe5f75e7bb2859 ]
When the virtual link state was set to "enable" ethtool would report
link speed as 40000Mb/s regardless of the underlying device.
Report the correct link speed.
Example from a XXV710 NIC.
Before:
$ ip link set ens3f0 vf 0 state auto
$ ethtool enp8s2 | grep Speed
Speed: 25000Mb/s
$ ip link set ens3f0 vf 0 state enable
$ ethtool enp8s2 | grep Speed
Speed: 40000Mb/s
After:
$ ip link set ens3f0 vf 0 state auto
$ ethtool enp8s2 | grep Speed
Speed: 25000Mb/s
$ ip link set ens3f0 vf 0 state enable
$ ethtool enp8s2 | grep Speed
Speed: 25000Mb/s
Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 09ff3f335ffa6..7e93ff0a31344 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -63,7 +63,7 @@ static void i40e_vc_notify_vf_link_state(struct i40e_vf *vf)
} else if (vf->link_forced) {
pfe.event_data.link_event.link_status = vf->link_up;
pfe.event_data.link_event.link_speed =
- (vf->link_up ? VIRTCHNL_LINK_SPEED_40GB : 0);
+ (vf->link_up ? i40e_virtchnl_link_speed(ls->link_speed) : 0);
} else {
pfe.event_data.link_event.link_status =
ls->link_info & I40E_AQ_LINK_UP;
@@ -4375,6 +4375,7 @@ int i40e_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link)
{
struct i40e_netdev_priv *np = netdev_priv(netdev);
struct i40e_pf *pf = np->vsi->back;
+ struct i40e_link_status *ls = &pf->hw.phy.link_info;
struct virtchnl_pf_event pfe;
struct i40e_hw *hw = &pf->hw;
struct i40e_vf *vf;
@@ -4412,7 +4413,7 @@ int i40e_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link)
vf->link_forced = true;
vf->link_up = true;
pfe.event_data.link_event.link_status = true;
- pfe.event_data.link_event.link_speed = VIRTCHNL_LINK_SPEED_40GB;
+ pfe.event_data.link_event.link_speed = i40e_virtchnl_link_speed(ls->link_speed);
break;
case IFLA_VF_LINK_STATE_DISABLE:
vf->link_forced = true;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 069/130] hv_netvsc: Validate number of allocated sub-channels
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (66 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 068/130] i40e: report correct VF link speed when link state is set to enable Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 070/130] iommu/tegra-smmu: Expand mutex protection range Sasha Levin
` (60 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Andrea Parri (Microsoft),
Saruhan Karademir, Haiyang Zhang, Jakub Kicinski,
David S. Miller, netdev, Wei Liu, Sasha Levin, linux-hyperv
From: "Andrea Parri (Microsoft)" <parri.andrea@gmail.com>
[ Upstream commit 206ad34d52a2f1205c84d08c12fc116aad0eb407 ]
Lack of validation could lead to out-of-bound reads and information
leaks (cf. usage of nvdev->chan_table[]). Check that the number of
allocated sub-channels fits into the expected range.
Suggested-by: Saruhan Karademir <skarade@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Link: https://lore.kernel.org/r/20201118153310.112404-1-parri.andrea@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/hyperv/rndis_filter.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index b9e44bb22289c..90d81dc6a1221 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -1159,6 +1159,11 @@ int rndis_set_subchannel(struct net_device *ndev,
return -EIO;
}
+ /* Check that number of allocated sub channel is within the expected range */
+ if (init_packet->msg.v5_msg.subchn_comp.num_subchannels > nvdev->num_chn - 1) {
+ netdev_err(ndev, "invalid number of allocated sub channel\n");
+ return -EINVAL;
+ }
nvdev->num_chn = 1 +
init_packet->msg.v5_msg.subchn_comp.num_subchannels;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 070/130] iommu/tegra-smmu: Expand mutex protection range
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (67 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 069/130] hv_netvsc: Validate number of allocated sub-channels Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 071/130] HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube Adapter Sasha Levin
` (59 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nicolin Chen, Dmitry Osipenko, Thierry Reding, Will Deacon,
Sasha Levin, linux-tegra, iommu
From: Nicolin Chen <nicoleotsuka@gmail.com>
[ Upstream commit d5f583bf8654c231b781096bc1a186065cda72b3 ]
This is used to protect potential race condition at use_count.
since probes of client drivers, calling attach_dev(), may run
concurrently.
Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
Tested-by: Dmitry Osipenko <digetx@gmail.com>
Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20201125101013.14953-3-nicoleotsuka@gmail.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/tegra-smmu.c | 34 +++++++++++++++++++++-------------
1 file changed, 21 insertions(+), 13 deletions(-)
diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
index dd486233e2828..41be3e2202971 100644
--- a/drivers/iommu/tegra-smmu.c
+++ b/drivers/iommu/tegra-smmu.c
@@ -247,26 +247,19 @@ static int tegra_smmu_alloc_asid(struct tegra_smmu *smmu, unsigned int *idp)
{
unsigned long id;
- mutex_lock(&smmu->lock);
-
id = find_first_zero_bit(smmu->asids, smmu->soc->num_asids);
- if (id >= smmu->soc->num_asids) {
- mutex_unlock(&smmu->lock);
+ if (id >= smmu->soc->num_asids)
return -ENOSPC;
- }
set_bit(id, smmu->asids);
*idp = id;
- mutex_unlock(&smmu->lock);
return 0;
}
static void tegra_smmu_free_asid(struct tegra_smmu *smmu, unsigned int id)
{
- mutex_lock(&smmu->lock);
clear_bit(id, smmu->asids);
- mutex_unlock(&smmu->lock);
}
static bool tegra_smmu_capable(enum iommu_cap cap)
@@ -404,17 +397,21 @@ static int tegra_smmu_as_prepare(struct tegra_smmu *smmu,
struct tegra_smmu_as *as)
{
u32 value;
- int err;
+ int err = 0;
+
+ mutex_lock(&smmu->lock);
if (as->use_count > 0) {
as->use_count++;
- return 0;
+ goto unlock;
}
as->pd_dma = dma_map_page(smmu->dev, as->pd, 0, SMMU_SIZE_PD,
DMA_TO_DEVICE);
- if (dma_mapping_error(smmu->dev, as->pd_dma))
- return -ENOMEM;
+ if (dma_mapping_error(smmu->dev, as->pd_dma)) {
+ err = -ENOMEM;
+ goto unlock;
+ }
/* We can't handle 64-bit DMA addresses */
if (!smmu_dma_addr_valid(smmu, as->pd_dma)) {
@@ -437,24 +434,35 @@ static int tegra_smmu_as_prepare(struct tegra_smmu *smmu,
as->smmu = smmu;
as->use_count++;
+ mutex_unlock(&smmu->lock);
+
return 0;
err_unmap:
dma_unmap_page(smmu->dev, as->pd_dma, SMMU_SIZE_PD, DMA_TO_DEVICE);
+unlock:
+ mutex_unlock(&smmu->lock);
+
return err;
}
static void tegra_smmu_as_unprepare(struct tegra_smmu *smmu,
struct tegra_smmu_as *as)
{
- if (--as->use_count > 0)
+ mutex_lock(&smmu->lock);
+
+ if (--as->use_count > 0) {
+ mutex_unlock(&smmu->lock);
return;
+ }
tegra_smmu_free_asid(smmu, as->id);
dma_unmap_page(smmu->dev, as->pd_dma, SMMU_SIZE_PD, DMA_TO_DEVICE);
as->smmu = NULL;
+
+ mutex_unlock(&smmu->lock);
}
static int tegra_smmu_attach_dev(struct iommu_domain *domain,
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 071/130] HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube Adapter
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (68 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 070/130] iommu/tegra-smmu: Expand mutex protection range Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 072/130] arm64: tegra: Fix GIC400 missing GICH/GICV register regions Sasha Levin
` (58 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ethan Warth, Wladimir J . van der Laan, Jiri Kosina, Sasha Levin,
linux-input
From: Ethan Warth <redyoshi49q@gmail.com>
[ Upstream commit 1008230f2abeb624f6d71b2e1c424fa4eeebbf84 ]
Mayflash/Dragonrise seems to have yet another device ID for one of their
Gamecube controller adapters. Previous to this commit, the adapter
registered only one /dev/input/js* device, and all controller inputs (from
any controller) were mapped to this device. This patch defines the 1846
USB device ID and enables the HID_QUIRK_MULTI_INPUT quirk for it, which
fixes that (with the patch, four /dev/input/js* devices are created, one
for each of the four controller ports).
Signed-off-by: Ethan Warth <redyoshi49q@gmail.com>
Tested-by: Wladimir J. van der Laan <laanwj@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-mf.c | 2 ++
drivers/hid/hid-quirks.c | 2 ++
3 files changed, 5 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 2aa810665a78c..d28b9ac8b9959 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -365,6 +365,7 @@
#define USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR 0x1803
#define USB_DEVICE_ID_DRAGONRISE_GAMECUBE1 0x1843
#define USB_DEVICE_ID_DRAGONRISE_GAMECUBE2 0x1844
+#define USB_DEVICE_ID_DRAGONRISE_GAMECUBE3 0x1846
#define USB_VENDOR_ID_DWAV 0x0eef
#define USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER 0x0001
diff --git a/drivers/hid/hid-mf.c b/drivers/hid/hid-mf.c
index fc75f30f537c9..92d7ecd41a78f 100644
--- a/drivers/hid/hid-mf.c
+++ b/drivers/hid/hid-mf.c
@@ -153,6 +153,8 @@ static const struct hid_device_id mf_devices[] = {
.driver_data = HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2),
.driver_data = 0 }, /* No quirk required */
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE3),
+ .driver_data = HID_QUIRK_MULTI_INPUT },
{ }
};
MODULE_DEVICE_TABLE(hid, mf_devices);
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 60d188a704e5e..f35d919c4ebab 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -72,6 +72,7 @@ static const struct hid_device_id hid_quirks[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_REDRAGON_SEYMUR2), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR), HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE3), HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3), HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU), HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER), HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET },
@@ -491,6 +492,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR) },
{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1) },
{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE3) },
#endif
#if IS_ENABLED(CONFIG_HID_MICROSOFT)
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500) },
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 072/130] arm64: tegra: Fix GIC400 missing GICH/GICV register regions
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (69 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 071/130] HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube Adapter Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 073/130] crypto: qce - Fix SHA result buffer corruption issues Sasha Levin
` (57 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Marc Zyngier, Thierry Reding, Sasha Levin, devicetree, linux-tegra
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit 776a3c04da9fa144241476f4a0d263899d6cad26 ]
GIC400 has full support for virtualization, and yet the tegra186
DT doesn't expose the GICH/GICV regions (despite exposing the
maintenance interrupt that only makes sense for virtualization).
Add the missing regions, based on the hunch that the HW doesn't
use the CPU build-in interfaces, but instead the external ones
provided by the GIC. KVM's virtual GIC now works with this change.
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/nvidia/tegra186.dtsi | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/nvidia/tegra186.dtsi b/arch/arm64/boot/dts/nvidia/tegra186.dtsi
index 9abf0cb1dd67f..f72c97fe4afc8 100644
--- a/arch/arm64/boot/dts/nvidia/tegra186.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra186.dtsi
@@ -569,7 +569,9 @@ gic: interrupt-controller@3881000 {
#interrupt-cells = <3>;
interrupt-controller;
reg = <0x0 0x03881000 0x0 0x1000>,
- <0x0 0x03882000 0x0 0x2000>;
+ <0x0 0x03882000 0x0 0x2000>,
+ <0x0 0x03884000 0x0 0x2000>,
+ <0x0 0x03886000 0x0 0x2000>;
interrupts = <GIC_PPI 9
(GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
interrupt-parent = <&gic>;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 073/130] crypto: qce - Fix SHA result buffer corruption issues
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (70 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 072/130] arm64: tegra: Fix GIC400 missing GICH/GICV register regions Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 074/130] media: gp8psk: initialize stats at power control logic Sasha Levin
` (56 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thara Gopinath, Bjorn Andersson, Herbert Xu, Sasha Levin, linux-crypto
From: Thara Gopinath <thara.gopinath@linaro.org>
[ Upstream commit 1148a9654b5a69611d33e14719251c6ec20f5f2c ]
Partial hash was being copied into the final result buffer without the
entire message block processed. Depending on how the end user processes
this result buffer, errors vary from result buffer corruption to result
buffer poisoing. Fix this issue by ensuring that only the final hash value
is copied into the result buffer.
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Thara Gopinath <thara.gopinath@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qce/sha.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c
index 0853e74583ade..981957e9db592 100644
--- a/drivers/crypto/qce/sha.c
+++ b/drivers/crypto/qce/sha.c
@@ -47,7 +47,7 @@ static void qce_ahash_done(void *data)
dma_unmap_sg(qce->dev, &rctx->result_sg, 1, DMA_FROM_DEVICE);
memcpy(rctx->digest, result->auth_iv, digestsize);
- if (req->result)
+ if (req->result && rctx->last_blk)
memcpy(req->result, result->auth_iv, digestsize);
rctx->byte_count[0] = cpu_to_be32(result->auth_byte_count[0]);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 074/130] media: gp8psk: initialize stats at power control logic
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (71 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 073/130] crypto: qce - Fix SHA result buffer corruption issues Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 075/130] net/lapb: fix t1 timer handling for LAPB_STATE_0 Sasha Levin
` (55 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mauro Carvalho Chehab, syzbot, Willem de Bruijn, Sasha Levin,
linux-media
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit d0ac1a26ed5943127cb0156148735f5f52a07075 ]
As reported on:
https://lore.kernel.org/linux-media/20190627222020.45909-1-willemdebruijn.kernel@gmail.com/
if gp8psk_usb_in_op() returns an error, the status var is not
initialized. Yet, this var is used later on, in order to
identify:
- if the device was already started;
- if firmware has loaded;
- if the LNBf was powered on.
Using status = 0 seems to ensure that everything will be
properly powered up.
So, instead of the proposed solution, let's just set
status = 0.
Reported-by: syzbot <syzkaller@googlegroups.com>
Reported-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb/gp8psk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb/gp8psk.c b/drivers/media/usb/dvb-usb/gp8psk.c
index 1282f701f1857..ac8b8bf6ee1d3 100644
--- a/drivers/media/usb/dvb-usb/gp8psk.c
+++ b/drivers/media/usb/dvb-usb/gp8psk.c
@@ -182,7 +182,7 @@ static int gp8psk_load_bcm4500fw(struct dvb_usb_device *d)
static int gp8psk_power_ctrl(struct dvb_usb_device *d, int onoff)
{
- u8 status, buf;
+ u8 status = 0, buf;
int gp_product_id = le16_to_cpu(d->udev->descriptor.idProduct);
if (onoff) {
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 075/130] net/lapb: fix t1 timer handling for LAPB_STATE_0
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (72 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 074/130] media: gp8psk: initialize stats at power control logic Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 17:01 ` Xie He
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 076/130] reset: socfpga: add error handling and release mem-region Sasha Levin
` (54 subsequent siblings)
128 siblings, 1 reply; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Martin Schiller, Jakub Kicinski, Sasha Levin, linux-x25, netdev
From: Martin Schiller <ms@dev.tdt.de>
[ Upstream commit 62480b992ba3fb1d7260b11293aed9d6557831c7 ]
1. DTE interface changes immediately to LAPB_STATE_1 and start sending
SABM(E).
2. DCE interface sends N2-times DM and changes to LAPB_STATE_1
afterwards if there is no response in the meantime.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/lapb/lapb_timer.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/lapb/lapb_timer.c b/net/lapb/lapb_timer.c
index 8f5b17001a076..baa247fe4ed05 100644
--- a/net/lapb/lapb_timer.c
+++ b/net/lapb/lapb_timer.c
@@ -85,11 +85,18 @@ static void lapb_t1timer_expiry(struct timer_list *t)
switch (lapb->state) {
/*
- * If we are a DCE, keep going DM .. DM .. DM
+ * If we are a DCE, send DM up to N2 times, then switch to
+ * STATE_1 and send SABM(E).
*/
case LAPB_STATE_0:
- if (lapb->mode & LAPB_DCE)
+ if (lapb->mode & LAPB_DCE &&
+ lapb->n2count != lapb->n2) {
+ lapb->n2count++;
lapb_send_control(lapb, LAPB_DM, LAPB_POLLOFF, LAPB_RESPONSE);
+ } else {
+ lapb->state = LAPB_STATE_1;
+ lapb_establish_data_link(lapb);
+ }
break;
/*
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* Re: [PATCH AUTOSEL 5.4 075/130] net/lapb: fix t1 timer handling for LAPB_STATE_0
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 075/130] net/lapb: fix t1 timer handling for LAPB_STATE_0 Sasha Levin
@ 2020-12-23 17:01 ` Xie He
2020-12-24 9:49 ` Xie He
0 siblings, 1 reply; 139+ messages in thread
From: Xie He @ 2020-12-23 17:01 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel, stable, Martin Schiller, Jakub Kicinski, linux-x25, netdev
> From: Martin Schiller <ms@dev.tdt.de>
>
> [ Upstream commit 62480b992ba3fb1d7260b11293aed9d6557831c7 ]
>
> 1. DTE interface changes immediately to LAPB_STATE_1 and start sending
> SABM(E).
>
> 2. DCE interface sends N2-times DM and changes to LAPB_STATE_1
> afterwards if there is no response in the meantime.
I don't think this patch is suitable for stable branches. This patch is
part of a patch series that changes the lapb module from "establishing the
L2 connection only when needed by L3", to "establishing the L2 connection
automatically whenever we are able to". This is a behavioral change. It
should be seen as a new feature. It is not a bug fix.
^ permalink raw reply [flat|nested] 139+ messages in thread
* Re: [PATCH AUTOSEL 5.4 075/130] net/lapb: fix t1 timer handling for LAPB_STATE_0
2020-12-23 17:01 ` Xie He
@ 2020-12-24 9:49 ` Xie He
2020-12-27 21:27 ` Sasha Levin
2021-01-06 7:33 ` Martin Schiller
0 siblings, 2 replies; 139+ messages in thread
From: Xie He @ 2020-12-24 9:49 UTC (permalink / raw)
To: Sasha Levin
Cc: LKML, stable, Martin Schiller, Jakub Kicinski, Linux X25,
Linux Kernel Network Developers
On Wed, Dec 23, 2020 at 9:01 AM Xie He <xie.he.0141@gmail.com> wrote:
>
> I don't think this patch is suitable for stable branches. This patch is
> part of a patch series that changes the lapb module from "establishing the
> L2 connection only when needed by L3", to "establishing the L2 connection
> automatically whenever we are able to". This is a behavioral change. It
> should be seen as a new feature. It is not a bug fix.
Applying this patch without other patches in the same series will also
introduce problems, because this patch relies on part of the changes
in the subsequent patch in the same series to be correct.
Hi Martin,
It's better that we avoid using words like "fix" in non-bug-fix
patches, and make every patch work on its own without subsequent
patches. Otherwise we'll make people confused.
^ permalink raw reply [flat|nested] 139+ messages in thread
* Re: [PATCH AUTOSEL 5.4 075/130] net/lapb: fix t1 timer handling for LAPB_STATE_0
2020-12-24 9:49 ` Xie He
@ 2020-12-27 21:27 ` Sasha Levin
2021-01-06 7:33 ` Martin Schiller
1 sibling, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-27 21:27 UTC (permalink / raw)
To: Xie He
Cc: LKML, stable, Martin Schiller, Jakub Kicinski, Linux X25,
Linux Kernel Network Developers
On Thu, Dec 24, 2020 at 01:49:47AM -0800, Xie He wrote:
>On Wed, Dec 23, 2020 at 9:01 AM Xie He <xie.he.0141@gmail.com> wrote:
>>
>> I don't think this patch is suitable for stable branches. This patch is
>> part of a patch series that changes the lapb module from "establishing the
>> L2 connection only when needed by L3", to "establishing the L2 connection
>> automatically whenever we are able to". This is a behavioral change. It
>> should be seen as a new feature. It is not a bug fix.
>
>Applying this patch without other patches in the same series will also
>introduce problems, because this patch relies on part of the changes
>in the subsequent patch in the same series to be correct.
I'll drop it, thanks!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 139+ messages in thread
* Re: [PATCH AUTOSEL 5.4 075/130] net/lapb: fix t1 timer handling for LAPB_STATE_0
2020-12-24 9:49 ` Xie He
2020-12-27 21:27 ` Sasha Levin
@ 2021-01-06 7:33 ` Martin Schiller
1 sibling, 0 replies; 139+ messages in thread
From: Martin Schiller @ 2021-01-06 7:33 UTC (permalink / raw)
To: Xie He
Cc: Sasha Levin, LKML, stable, Jakub Kicinski, Linux X25,
Linux Kernel Network Developers
On 2020-12-24 10:49, Xie He wrote:
> On Wed, Dec 23, 2020 at 9:01 AM Xie He <xie.he.0141@gmail.com> wrote:
>>
>> I don't think this patch is suitable for stable branches. This patch
>> is
>> part of a patch series that changes the lapb module from "establishing
>> the
>> L2 connection only when needed by L3", to "establishing the L2
>> connection
>> automatically whenever we are able to". This is a behavioral change.
>> It
>> should be seen as a new feature. It is not a bug fix.
>
> Applying this patch without other patches in the same series will also
> introduce problems, because this patch relies on part of the changes
> in the subsequent patch in the same series to be correct.
>
> Hi Martin,
>
> It's better that we avoid using words like "fix" in non-bug-fix
> patches, and make every patch work on its own without subsequent
> patches. Otherwise we'll make people confused.
Yes, you are right.
^ permalink raw reply [flat|nested] 139+ messages in thread
* [PATCH AUTOSEL 5.4 076/130] reset: socfpga: add error handling and release mem-region
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (73 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 075/130] net/lapb: fix t1 timer handling for LAPB_STATE_0 Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 077/130] x86/pci: Fix the function type for check_reserved_t Sasha Levin
` (53 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dinh Nguyen, kernel test robot, Dan Carpenter, Philipp Zabel,
Sasha Levin
From: Dinh Nguyen <dinguyen@kernel.org>
[ Upstream commit 0d625a167b169f0bfdfd2e4dc05b9c89b81efe98 ]
In case of an error, call release_mem_region when an error happens
during allocation of resources. Also add error handling for the case
that reset_controller_register fails.
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/reset/reset-socfpga.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/reset/reset-socfpga.c b/drivers/reset/reset-socfpga.c
index 96953992c2bb5..c78c7425195e2 100644
--- a/drivers/reset/reset-socfpga.c
+++ b/drivers/reset/reset-socfpga.c
@@ -45,7 +45,7 @@ static int a10_reset_init(struct device_node *np)
data->membase = ioremap(res.start, size);
if (!data->membase) {
ret = -ENOMEM;
- goto err_alloc;
+ goto release_region;
}
if (of_property_read_u32(np, "altr,modrst-offset", ®_offset))
@@ -60,7 +60,14 @@ static int a10_reset_init(struct device_node *np)
data->rcdev.of_node = np;
data->status_active_low = true;
- return reset_controller_register(&data->rcdev);
+ ret = reset_controller_register(&data->rcdev);
+ if (ret)
+ pr_err("unable to register device\n");
+
+ return ret;
+
+release_region:
+ release_mem_region(res.start, size);
err_alloc:
kfree(data);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 077/130] x86/pci: Fix the function type for check_reserved_t
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (74 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 076/130] reset: socfpga: add error handling and release mem-region Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 078/130] x86/mce: Move the mce_panic() call and 'kill_it' assignments to the right places Sasha Levin
` (52 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sami Tolvanen, Sedat Dilek, Borislav Petkov, Borislav Petkov,
Sasha Levin, linux-pci, clang-built-linux
From: Sami Tolvanen <samitolvanen@google.com>
[ Upstream commit 83321c335dccba262a57378361d63da96b8166d6 ]
e820__mapped_all() is passed as a callback to is_mmconf_reserved(),
which expects a function of type:
typedef bool (*check_reserved_t)(u64 start, u64 end, unsigned type);
However, e820__mapped_all() accepts enum e820_type as the last argument
and this type mismatch trips indirect call checking with Clang's
Control-Flow Integrity (CFI).
As is_mmconf_reserved() only passes enum e820_type values for the
type argument, change the typedef and the unused type argument in
is_acpi_reserved() to enum e820_type to fix the type mismatch.
Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
Suggested-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20201130193900.456726-1-samitolvanen@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/pci/mmconfig-shared.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
index 6fa42e9c4e6fa..234998f196d4d 100644
--- a/arch/x86/pci/mmconfig-shared.c
+++ b/arch/x86/pci/mmconfig-shared.c
@@ -425,7 +425,7 @@ static acpi_status find_mboard_resource(acpi_handle handle, u32 lvl,
return AE_OK;
}
-static bool is_acpi_reserved(u64 start, u64 end, unsigned not_used)
+static bool is_acpi_reserved(u64 start, u64 end, enum e820_type not_used)
{
struct resource mcfg_res;
@@ -442,7 +442,7 @@ static bool is_acpi_reserved(u64 start, u64 end, unsigned not_used)
return mcfg_res.flags;
}
-typedef bool (*check_reserved_t)(u64 start, u64 end, unsigned type);
+typedef bool (*check_reserved_t)(u64 start, u64 end, enum e820_type type);
static bool __ref is_mmconf_reserved(check_reserved_t is_reserved,
struct pci_mmcfg_region *cfg,
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 078/130] x86/mce: Move the mce_panic() call and 'kill_it' assignments to the right places
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (75 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 077/130] x86/pci: Fix the function type for check_reserved_t Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 079/130] x86/mce: Panic for LMCE only if mca_cfg.tolerant < 3 Sasha Levin
` (51 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Gabriele Paoloni, Borislav Petkov, Tony Luck, Sasha Levin, linux-edac
From: Gabriele Paoloni <gabriele.paoloni@intel.com>
[ Upstream commit e273e6e12ab1db3eb57712bd60655744d0091fa3 ]
Right now, for local MCEs the machine calls panic(), if needed, right
after lmce is set. For MCE broadcasting, mce_reign() takes care of
calling mce_panic().
Hence:
- improve readability by moving the conditional evaluation of
tolerant up to when kill_it is set first;
- move the mce_panic() call up into the statement where mce_end()
fails.
[ bp: Massage, remove comment in the mce_end() failure case because it
is superfluous; use local ptr 'cfg' in both tests. ]
Signed-off-by: Gabriele Paoloni <gabriele.paoloni@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Link: https://lkml.kernel.org/r/20201127161819.3106432-3-gabriele.paoloni@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/cpu/mce/core.c | 15 ++++-----------
1 file changed, 4 insertions(+), 11 deletions(-)
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index c2a9762d278dd..10f69e045d3ea 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -1328,8 +1328,7 @@ void do_machine_check(struct pt_regs *regs, long error_code)
* severity is MCE_AR_SEVERITY we have other options.
*/
if (!(m.mcgstatus & MCG_STATUS_RIPV))
- kill_it = 1;
-
+ kill_it = (cfg->tolerant == 3) ? 0 : 1;
/*
* Check if this MCE is signaled to only this logical processor,
* on Intel only.
@@ -1364,6 +1363,9 @@ void do_machine_check(struct pt_regs *regs, long error_code)
if (mce_end(order) < 0) {
if (!no_way_out)
no_way_out = worst >= MCE_PANIC_SEVERITY;
+
+ if (no_way_out && cfg->tolerant < 3)
+ mce_panic("Fatal machine check on current CPU", &m, msg);
}
} else {
/*
@@ -1380,15 +1382,6 @@ void do_machine_check(struct pt_regs *regs, long error_code)
}
}
- /*
- * If tolerant is at an insane level we drop requests to kill
- * processes and continue even when there is no way out.
- */
- if (cfg->tolerant == 3)
- kill_it = 0;
- else if (no_way_out)
- mce_panic("Fatal machine check on current CPU", &m, msg);
-
if (worst > 0)
irq_work_queue(&mce_irq_work);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 079/130] x86/mce: Panic for LMCE only if mca_cfg.tolerant < 3
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (76 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 078/130] x86/mce: Move the mce_panic() call and 'kill_it' assignments to the right places Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 080/130] drm/amd/display: Update dram_clock_change_latency for DCN2.1 Sasha Levin
` (50 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Gabriele Paoloni, Borislav Petkov, Tony Luck, Sasha Levin, linux-edac
From: Gabriele Paoloni <gabriele.paoloni@intel.com>
[ Upstream commit 3a866b16fd2360a9c4ebf71cfbf7ebfe968c1409 ]
Right now for LMCE, if no_way_out is set, mce_panic() is called
regardless of mca_cfg.tolerant. This is not correct as, if
mca_cfg.tolerant = 3, the code should never panic.
Add that check.
[ bp: use local ptr 'cfg'. ]
Signed-off-by: Gabriele Paoloni <gabriele.paoloni@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Link: https://lkml.kernel.org/r/20201127161819.3106432-4-gabriele.paoloni@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/cpu/mce/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index 10f69e045d3ea..344fe08779824 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -1344,7 +1344,7 @@ void do_machine_check(struct pt_regs *regs, long error_code)
* to see it will clear it.
*/
if (lmce) {
- if (no_way_out)
+ if (no_way_out && cfg->tolerant < 3)
mce_panic("Fatal local machine check", &m, msg);
} else {
order = mce_start(&no_way_out);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 080/130] drm/amd/display: Update dram_clock_change_latency for DCN2.1
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (77 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 079/130] x86/mce: Panic for LMCE only if mca_cfg.tolerant < 3 Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 081/130] bridge: switchdev: Notify about VLAN protocol changes Sasha Levin
` (49 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sung Lee, Tony Cheng, Aurabindo Pillai, Alex Deucher,
Sasha Levin, amd-gfx, dri-devel
From: Sung Lee <sung.lee@amd.com>
[ Upstream commit 901c1ec05ef277ce9d43cb806a225b28b3efe89a ]
[WHY]
dram clock change latencies get updated using ddr4 latency table, but
does that update does not happen before validation. This value
should not be the default and should be number received from
df for better mode support.
This may cause a PState hang on high refresh panels with short vblanks
such as on 1080p 360hz or 300hz panels.
[HOW]
Update latency from 23.84 to 11.72.
Signed-off-by: Sung Lee <sung.lee@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
index bb7add5ea2273..a6d5beada6634 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
@@ -257,7 +257,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = {
.num_banks = 8,
.num_chans = 4,
.vmm_page_size_bytes = 4096,
- .dram_clock_change_latency_us = 23.84,
+ .dram_clock_change_latency_us = 11.72,
.return_bus_width_bytes = 64,
.dispclk_dppclk_vco_speed_mhz = 3600,
.xfc_bus_transport_time_us = 4,
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 081/130] bridge: switchdev: Notify about VLAN protocol changes
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (78 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 080/130] drm/amd/display: Update dram_clock_change_latency for DCN2.1 Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 082/130] media: cx23885: add more quirks for reset DMA on some AMD IOMMU Sasha Levin
` (48 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Danielle Ratson, Petr Machata, Nikolay Aleksandrov, Ido Schimmel,
Ivan Vecera, Jakub Kicinski, Sasha Levin, netdev, bridge
From: Danielle Ratson <danieller@nvidia.com>
[ Upstream commit 22ec19f3aee327806c37c9fa1188741574bc6445 ]
Drivers that support bridge offload need to be notified about changes to
the bridge's VLAN protocol so that they could react accordingly and
potentially veto the change.
Add a new switchdev attribute to communicate the change to drivers.
Signed-off-by: Danielle Ratson <danieller@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Ivan Vecera <ivecera@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/switchdev.h | 2 ++
net/bridge/br_vlan.c | 16 ++++++++++++++--
2 files changed, 16 insertions(+), 2 deletions(-)
diff --git a/include/net/switchdev.h b/include/net/switchdev.h
index aee86a1894327..1d54d468934ac 100644
--- a/include/net/switchdev.h
+++ b/include/net/switchdev.h
@@ -38,6 +38,7 @@ enum switchdev_attr_id {
SWITCHDEV_ATTR_ID_PORT_MROUTER,
SWITCHDEV_ATTR_ID_BRIDGE_AGEING_TIME,
SWITCHDEV_ATTR_ID_BRIDGE_VLAN_FILTERING,
+ SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL,
SWITCHDEV_ATTR_ID_BRIDGE_MC_DISABLED,
SWITCHDEV_ATTR_ID_BRIDGE_MROUTER,
};
@@ -54,6 +55,7 @@ struct switchdev_attr {
bool mrouter; /* PORT_MROUTER */
clock_t ageing_time; /* BRIDGE_AGEING_TIME */
bool vlan_filtering; /* BRIDGE_VLAN_FILTERING */
+ u16 vlan_protocol; /* BRIDGE_VLAN_PROTOCOL */
bool mc_disabled; /* MC_DISABLED */
} u;
};
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 48413b5eb61fc..5536e1c9d5537 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -809,15 +809,25 @@ EXPORT_SYMBOL_GPL(br_vlan_get_proto);
int __br_vlan_set_proto(struct net_bridge *br, __be16 proto)
{
+ struct switchdev_attr attr = {
+ .orig_dev = br->dev,
+ .id = SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL,
+ .flags = SWITCHDEV_F_SKIP_EOPNOTSUPP,
+ .u.vlan_protocol = ntohs(proto),
+ };
int err = 0;
struct net_bridge_port *p;
struct net_bridge_vlan *vlan;
struct net_bridge_vlan_group *vg;
- __be16 oldproto;
+ __be16 oldproto = br->vlan_proto;
if (br->vlan_proto == proto)
return 0;
+ err = switchdev_port_attr_set(br->dev, &attr);
+ if (err && err != -EOPNOTSUPP)
+ return err;
+
/* Add VLANs for the new proto to the device filter. */
list_for_each_entry(p, &br->port_list, list) {
vg = nbp_vlan_group(p);
@@ -828,7 +838,6 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto)
}
}
- oldproto = br->vlan_proto;
br->vlan_proto = proto;
recalculate_group_addr(br);
@@ -844,6 +853,9 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto)
return 0;
err_filt:
+ attr.u.vlan_protocol = ntohs(oldproto);
+ switchdev_port_attr_set(br->dev, &attr);
+
list_for_each_entry_continue_reverse(vlan, &vg->vlan_list, vlist)
vlan_vid_del(p->dev, proto, vlan->vid);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 082/130] media: cx23885: add more quirks for reset DMA on some AMD IOMMU
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (79 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 081/130] bridge: switchdev: Notify about VLAN protocol changes Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 083/130] iio: accel: bmc150: Check for a second ACPI device for BOSC0200 Sasha Levin
` (47 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Daniel Lee Kruse, Hans Verkuil, Mauro Carvalho Chehab,
Sasha Levin, linux-media
From: Daniel Lee Kruse <daniel.lee.kruse@protonmail.com>
[ Upstream commit dbf0b3a7b719eb3f72cb53c2ce7d34a012a9c261 ]
On AMD Family 15h (Models 30h-3fh), I/O Memory Management Unit
RiSC engine sometimes stalls, requiring a reset.
As result, MythTV and w-scan won't scan channels on the AMD Kaveri
APU with the Hauppauge QuadHD TV tuner card.
For the solution I added the Input/Output Memory Management Unit's PCI
Identity of 0x1423 to the broken_dev_id[] array, which is used by
a quirks logic meant to fix similar problems with other AMD
chipsets.
Signed-off-by: Daniel Lee Kruse <daniel.lee.kruse@protonmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx23885/cx23885-core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
index 7e0b0b7cc2a35..ead0acb7807c8 100644
--- a/drivers/media/pci/cx23885/cx23885-core.c
+++ b/drivers/media/pci/cx23885/cx23885-core.c
@@ -2074,6 +2074,10 @@ static struct {
* 0x1451 is PCI ID for the IOMMU found on Ryzen
*/
{ PCI_VENDOR_ID_AMD, 0x1451 },
+ /* According to sudo lspci -nn,
+ * 0x1423 is the PCI ID for the IOMMU found on Kaveri
+ */
+ { PCI_VENDOR_ID_AMD, 0x1423 },
};
static bool cx23885_does_need_dma_reset(void)
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 083/130] iio: accel: bmc150: Check for a second ACPI device for BOSC0200
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (80 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 082/130] media: cx23885: add more quirks for reset DMA on some AMD IOMMU Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 084/130] tty/serial/imx: Enable TXEN bit in imx_poll_init() Sasha Levin
` (46 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jeremy Cline, Hans de Goede, Andy Shevchenko, Jonathan Cameron,
Sasha Levin, linux-iio
From: Jeremy Cline <jeremy@jcline.org>
[ Upstream commit 5bfb3a4bd8f6b5329464edb9b772738708509d4a ]
Some BOSC0200 acpi_device-s describe two accelerometers in a single ACPI
device. Normally we would handle this by letting the special
drivers/platform/x86/i2c-multi-instantiate.c driver handle the BOSC0200
ACPI id and let it instantiate 2 bmc150_accel type i2c_client-s for us.
But doing so changes the modalias for the first accelerometer
(which is already supported and used on many devices) from
acpi:BOSC0200 to i2c:bmc150_accel. The modalias is not only used
to load the driver, but is also used by hwdb matches in
/lib/udev/hwdb.d/60-sensor.hwdb which provide a mountmatrix to
userspace by setting the ACCEL_MOUNT_MATRIX udev property.
Switching the handling of the BOSC0200 over to i2c-multi-instantiate.c
will break the hwdb matches causing the ACCEL_MOUNT_MATRIX udev prop
to no longer be set. So switching over to i2c-multi-instantiate.c is
not an option.
Changes by Hans de Goede:
-Add explanation to the commit message why i2c-multi-instantiate.c
cannot be used
-Also set the dev_name, fwnode and irq i2c_board_info struct members
for the 2nd client
Signed-off-by: Jeremy Cline <jeremy@jcline.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20201130141954.339805-2-hdegoede@redhat.com
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=198671
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/bmc150-accel-core.c | 21 ++++++++++++++
drivers/iio/accel/bmc150-accel-i2c.c | 41 +++++++++++++++++++++++++--
drivers/iio/accel/bmc150-accel.h | 2 ++
3 files changed, 62 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index bcdf25f32e220..f63743a62d2ed 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -204,6 +204,7 @@ struct bmc150_accel_data {
int ev_enable_state;
int64_t timestamp, old_timestamp; /* Only used in hw fifo mode. */
const struct bmc150_accel_chip_info *chip_info;
+ struct i2c_client *second_device;
struct iio_mount_matrix orientation;
};
@@ -1663,6 +1664,26 @@ int bmc150_accel_core_probe(struct device *dev, struct regmap *regmap, int irq,
}
EXPORT_SYMBOL_GPL(bmc150_accel_core_probe);
+struct i2c_client *bmc150_get_second_device(struct i2c_client *client)
+{
+ struct bmc150_accel_data *data = i2c_get_clientdata(client);
+
+ if (!data)
+ return NULL;
+
+ return data->second_device;
+}
+EXPORT_SYMBOL_GPL(bmc150_get_second_device);
+
+void bmc150_set_second_device(struct i2c_client *client)
+{
+ struct bmc150_accel_data *data = i2c_get_clientdata(client);
+
+ if (data)
+ data->second_device = client;
+}
+EXPORT_SYMBOL_GPL(bmc150_set_second_device);
+
int bmc150_accel_core_remove(struct device *dev)
{
struct iio_dev *indio_dev = dev_get_drvdata(dev);
diff --git a/drivers/iio/accel/bmc150-accel-i2c.c b/drivers/iio/accel/bmc150-accel-i2c.c
index 06021c8685a70..8c45963fe3cdb 100644
--- a/drivers/iio/accel/bmc150-accel-i2c.c
+++ b/drivers/iio/accel/bmc150-accel-i2c.c
@@ -29,6 +29,8 @@ static int bmc150_accel_probe(struct i2c_client *client,
i2c_check_functionality(client->adapter, I2C_FUNC_I2C) ||
i2c_check_functionality(client->adapter,
I2C_FUNC_SMBUS_READ_I2C_BLOCK);
+ struct acpi_device __maybe_unused *adev;
+ int ret;
regmap = devm_regmap_init_i2c(client, &bmc150_regmap_conf);
if (IS_ERR(regmap)) {
@@ -39,12 +41,47 @@ static int bmc150_accel_probe(struct i2c_client *client,
if (id)
name = id->name;
- return bmc150_accel_core_probe(&client->dev, regmap, client->irq, name,
- block_supported);
+ ret = bmc150_accel_core_probe(&client->dev, regmap, client->irq, name, block_supported);
+ if (ret)
+ return ret;
+
+ /*
+ * Some BOSC0200 acpi_devices describe 2 accelerometers in a single ACPI
+ * device, try instantiating a second i2c_client for an I2cSerialBusV2
+ * ACPI resource with index 1. The !id check avoids recursion when
+ * bmc150_accel_probe() gets called for the second client.
+ */
+#ifdef CONFIG_ACPI
+ adev = ACPI_COMPANION(&client->dev);
+ if (!id && adev && strcmp(acpi_device_hid(adev), "BOSC0200") == 0) {
+ struct i2c_board_info board_info = {
+ .type = "bmc150_accel",
+ /*
+ * The 2nd accel sits in the base of 2-in-1s. Note this
+ * name is static, as there should never be more then 1
+ * BOSC0200 ACPI node with 2 accelerometers in it.
+ */
+ .dev_name = "BOSC0200:base",
+ .fwnode = client->dev.fwnode,
+ .irq = -ENOENT,
+ };
+ struct i2c_client *second_dev;
+
+ second_dev = i2c_acpi_new_device(&client->dev, 1, &board_info);
+ if (!IS_ERR(second_dev))
+ bmc150_set_second_device(second_dev);
+ }
+#endif
+
+ return 0;
}
static int bmc150_accel_remove(struct i2c_client *client)
{
+ struct i2c_client *second_dev = bmc150_get_second_device(client);
+
+ i2c_unregister_device(second_dev);
+
return bmc150_accel_core_remove(&client->dev);
}
diff --git a/drivers/iio/accel/bmc150-accel.h b/drivers/iio/accel/bmc150-accel.h
index ae6118ae11b1d..6e965a3ca3226 100644
--- a/drivers/iio/accel/bmc150-accel.h
+++ b/drivers/iio/accel/bmc150-accel.h
@@ -16,6 +16,8 @@ enum {
int bmc150_accel_core_probe(struct device *dev, struct regmap *regmap, int irq,
const char *name, bool block_supported);
int bmc150_accel_core_remove(struct device *dev);
+struct i2c_client *bmc150_get_second_device(struct i2c_client *second_device);
+void bmc150_set_second_device(struct i2c_client *second_device);
extern const struct dev_pm_ops bmc150_accel_pm_ops;
extern const struct regmap_config bmc150_regmap_conf;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 084/130] tty/serial/imx: Enable TXEN bit in imx_poll_init().
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (81 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 083/130] iio: accel: bmc150: Check for a second ACPI device for BOSC0200 Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 085/130] MIPS: KASLR: Avoid endless loop in sync_icache if synci_step is zero Sasha Levin
` (45 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mingrui Ren, Greg Kroah-Hartman, Sasha Levin, linux-serial,
linux-arm-kernel
From: Mingrui Ren <jiladahe1997@gmail.com>
[ Upstream commit aef1b6a27970607721a618a0b990716ca8dbbf97 ]
As described in Documentation, poll_init() is called by kgdb to initialize
hardware which supports both poll_put_char() and poll_get_char().
It's necessary to enable TXEN bit, otherwise, it will cause hardware fault
and kernel panic when calling imx_poll_put_char().
Generally, if use /dev/ttymxc0 as kgdb console as well as system
console, ttymxc0 is initialized early by system console which does enable
TXEN bit.But when use /dev/ttymxc1 as kgbd console, ttymxc1 is only
initialized by imx_poll_init() cannot enable the TXEN bit, which will
cause kernel panic.
Signed-off-by: Mingrui Ren <jiladahe1997@gmail.com>
Link: https://lore.kernel.org/r/20201202072543.151-1-972931182@qq.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/imx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index e5ed4ab2b08df..982953db58e95 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -1811,7 +1811,7 @@ static int imx_uart_poll_init(struct uart_port *port)
ucr1 |= UCR1_UARTEN;
ucr1 &= ~(UCR1_TRDYEN | UCR1_RTSDEN | UCR1_RRDYEN);
- ucr2 |= UCR2_RXEN;
+ ucr2 |= UCR2_RXEN | UCR2_TXEN;
ucr2 &= ~UCR2_ATEN;
imx_uart_writel(sport, ucr1, UCR1);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 085/130] MIPS: KASLR: Avoid endless loop in sync_icache if synci_step is zero
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (82 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 084/130] tty/serial/imx: Enable TXEN bit in imx_poll_init() Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 086/130] clocksource/drivers/dw_apb_timer_of: Add error handling if no clock available Sasha Levin
` (44 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jinyang He, Thomas Bogendoerfer, Sasha Levin, linux-mips
From: Jinyang He <hejinyang@loongson.cn>
[ Upstream commit c0aac3a51cb6364bed367ee3e1a96ed414f386b4 ]
Most platforms do not need to do synci instruction operations when
synci_step is 0. But for example, the synci implementation on Loongson64
platform has some changes. On the one hand, it ensures that the memory
access instructions have been completed. On the other hand, it guarantees
that all prefetch instructions need to be fetched again. And its address
information is useless. Thus, only one synci operation is required when
synci_step is 0 on Loongson64 platform. I guess that some other platforms
have similar implementations on synci, so add judgment conditions in
`while` to ensure that at least all platforms perform synci operations
once. For those platforms that do not need synci, they just do one more
operation similar to nop.
Signed-off-by: Jinyang He <hejinyang@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/kernel/relocate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/kernel/relocate.c b/arch/mips/kernel/relocate.c
index 3d80a51256de6..cf92196ab6145 100644
--- a/arch/mips/kernel/relocate.c
+++ b/arch/mips/kernel/relocate.c
@@ -64,7 +64,7 @@ static void __init sync_icache(void *kbase, unsigned long kernel_length)
: "r" (kbase));
kbase += step;
- } while (kbase < kend);
+ } while (step && kbase < kend);
/* Completion barrier */
__sync();
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 086/130] clocksource/drivers/dw_apb_timer_of: Add error handling if no clock available
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (83 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 085/130] MIPS: KASLR: Avoid endless loop in sync_icache if synci_step is zero Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 087/130] ALSA: rawmidi: Access runtime->avail always in spinlock Sasha Levin
` (43 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Dinh Nguyen, Daniel Lezcano, Sasha Levin
From: Dinh Nguyen <dinguyen@kernel.org>
[ Upstream commit 5d9814df0aec56a638bbf20795abb4cfaf3cd331 ]
commit ("b0fc70ce1f02 arm64: berlin: Select DW_APB_TIMER_OF") added the
support for the dw_apb_timer into the arm64 defconfig. However, for some
platforms like the Intel Stratix10 and Agilex, the clock manager doesn't
get loaded until after the timer driver get loaded. Thus, the driver hits
the panic "No clock nor clock-frequency property for" because it cannot
properly get the clock.
This patch adds the error handling needed for the timer driver so that
the kernel can continue booting instead of just hitting the panic.
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201205105223.208604-1-dinguyen@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/dw_apb_timer_of.c | 57 ++++++++++++++++++---------
1 file changed, 39 insertions(+), 18 deletions(-)
diff --git a/drivers/clocksource/dw_apb_timer_of.c b/drivers/clocksource/dw_apb_timer_of.c
index 6921b91b61ef3..3e8ad6818ff3d 100644
--- a/drivers/clocksource/dw_apb_timer_of.c
+++ b/drivers/clocksource/dw_apb_timer_of.c
@@ -14,12 +14,13 @@
#include <linux/reset.h>
#include <linux/sched_clock.h>
-static void __init timer_get_base_and_rate(struct device_node *np,
+static int __init timer_get_base_and_rate(struct device_node *np,
void __iomem **base, u32 *rate)
{
struct clk *timer_clk;
struct clk *pclk;
struct reset_control *rstc;
+ int ret;
*base = of_iomap(np, 0);
@@ -46,55 +47,67 @@ static void __init timer_get_base_and_rate(struct device_node *np,
pr_warn("pclk for %pOFn is present, but could not be activated\n",
np);
+ if (!of_property_read_u32(np, "clock-freq", rate) &&
+ !of_property_read_u32(np, "clock-frequency", rate))
+ return 0;
+
timer_clk = of_clk_get_by_name(np, "timer");
if (IS_ERR(timer_clk))
- goto try_clock_freq;
+ return PTR_ERR(timer_clk);
- if (!clk_prepare_enable(timer_clk)) {
- *rate = clk_get_rate(timer_clk);
- return;
- }
+ ret = clk_prepare_enable(timer_clk);
+ if (ret)
+ return ret;
+
+ *rate = clk_get_rate(timer_clk);
+ if (!(*rate))
+ return -EINVAL;
-try_clock_freq:
- if (of_property_read_u32(np, "clock-freq", rate) &&
- of_property_read_u32(np, "clock-frequency", rate))
- panic("No clock nor clock-frequency property for %pOFn", np);
+ return 0;
}
-static void __init add_clockevent(struct device_node *event_timer)
+static int __init add_clockevent(struct device_node *event_timer)
{
void __iomem *iobase;
struct dw_apb_clock_event_device *ced;
u32 irq, rate;
+ int ret = 0;
irq = irq_of_parse_and_map(event_timer, 0);
if (irq == 0)
panic("No IRQ for clock event timer");
- timer_get_base_and_rate(event_timer, &iobase, &rate);
+ ret = timer_get_base_and_rate(event_timer, &iobase, &rate);
+ if (ret)
+ return ret;
ced = dw_apb_clockevent_init(0, event_timer->name, 300, iobase, irq,
rate);
if (!ced)
- panic("Unable to initialise clockevent device");
+ return -EINVAL;
dw_apb_clockevent_register(ced);
+
+ return 0;
}
static void __iomem *sched_io_base;
static u32 sched_rate;
-static void __init add_clocksource(struct device_node *source_timer)
+static int __init add_clocksource(struct device_node *source_timer)
{
void __iomem *iobase;
struct dw_apb_clocksource *cs;
u32 rate;
+ int ret;
- timer_get_base_and_rate(source_timer, &iobase, &rate);
+ ret = timer_get_base_and_rate(source_timer, &iobase, &rate);
+ if (ret)
+ return ret;
cs = dw_apb_clocksource_init(300, source_timer->name, iobase, rate);
if (!cs)
- panic("Unable to initialise clocksource device");
+ return -EINVAL;
dw_apb_clocksource_start(cs);
dw_apb_clocksource_register(cs);
@@ -106,6 +119,8 @@ static void __init add_clocksource(struct device_node *source_timer)
*/
sched_io_base = iobase + 0x04;
sched_rate = rate;
+
+ return 0;
}
static u64 notrace read_sched_clock(void)
@@ -146,10 +161,14 @@ static struct delay_timer dw_apb_delay_timer = {
static int num_called;
static int __init dw_apb_timer_init(struct device_node *timer)
{
+ int ret = 0;
+
switch (num_called) {
case 1:
pr_debug("%s: found clocksource timer\n", __func__);
- add_clocksource(timer);
+ ret = add_clocksource(timer);
+ if (ret)
+ return ret;
init_sched_clock();
#ifdef CONFIG_ARM
dw_apb_delay_timer.freq = sched_rate;
@@ -158,7 +177,9 @@ static int __init dw_apb_timer_init(struct device_node *timer)
break;
default:
pr_debug("%s: found clockevent timer\n", __func__);
- add_clockevent(timer);
+ ret = add_clockevent(timer);
+ if (ret)
+ return ret;
break;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 087/130] ALSA: rawmidi: Access runtime->avail always in spinlock
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (84 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 086/130] clocksource/drivers/dw_apb_timer_of: Add error handling if no clock available Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 088/130] cpufreq: sti-cpufreq: fix mem leak in sti_cpufreq_set_opp_info() Sasha Levin
` (42 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, syzbot+a23a6f1215c84756577c,
syzbot+3d367d1df1d2b67f5c19, Sasha Levin, alsa-devel
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 88a06d6fd6b369d88cec46c62db3e2604a2f50d5 ]
The runtime->avail field may be accessed concurrently while some
places refer to it without taking the runtime->lock spinlock, as
detected by KCSAN. Usually this isn't a big problem, but for
consistency and safety, we should take the spinlock at each place
referencing this field.
Reported-by: syzbot+a23a6f1215c84756577c@syzkaller.appspotmail.com
Reported-by: syzbot+3d367d1df1d2b67f5c19@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20201206083527.21163-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/rawmidi.c | 49 +++++++++++++++++++++++++++++++-------------
1 file changed, 35 insertions(+), 14 deletions(-)
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 94db4683cfaff..6a3543b8455fc 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -72,11 +72,21 @@ static inline unsigned short snd_rawmidi_file_flags(struct file *file)
}
}
-static inline int snd_rawmidi_ready(struct snd_rawmidi_substream *substream)
+static inline bool __snd_rawmidi_ready(struct snd_rawmidi_runtime *runtime)
+{
+ return runtime->avail >= runtime->avail_min;
+}
+
+static bool snd_rawmidi_ready(struct snd_rawmidi_substream *substream)
{
struct snd_rawmidi_runtime *runtime = substream->runtime;
+ unsigned long flags;
+ bool ready;
- return runtime->avail >= runtime->avail_min;
+ spin_lock_irqsave(&runtime->lock, flags);
+ ready = __snd_rawmidi_ready(runtime);
+ spin_unlock_irqrestore(&runtime->lock, flags);
+ return ready;
}
static inline int snd_rawmidi_ready_append(struct snd_rawmidi_substream *substream,
@@ -945,7 +955,7 @@ int snd_rawmidi_receive(struct snd_rawmidi_substream *substream,
if (result > 0) {
if (runtime->event)
schedule_work(&runtime->event_work);
- else if (snd_rawmidi_ready(substream))
+ else if (__snd_rawmidi_ready(runtime))
wake_up(&runtime->sleep);
}
spin_unlock_irqrestore(&runtime->lock, flags);
@@ -1024,7 +1034,7 @@ static ssize_t snd_rawmidi_read(struct file *file, char __user *buf, size_t coun
result = 0;
while (count > 0) {
spin_lock_irq(&runtime->lock);
- while (!snd_rawmidi_ready(substream)) {
+ while (!__snd_rawmidi_ready(runtime)) {
wait_queue_entry_t wait;
if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
@@ -1041,9 +1051,11 @@ static ssize_t snd_rawmidi_read(struct file *file, char __user *buf, size_t coun
return -ENODEV;
if (signal_pending(current))
return result > 0 ? result : -ERESTARTSYS;
- if (!runtime->avail)
- return result > 0 ? result : -EIO;
spin_lock_irq(&runtime->lock);
+ if (!runtime->avail) {
+ spin_unlock_irq(&runtime->lock);
+ return result > 0 ? result : -EIO;
+ }
}
spin_unlock_irq(&runtime->lock);
count1 = snd_rawmidi_kernel_read1(substream,
@@ -1181,7 +1193,7 @@ int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int coun
runtime->avail += count;
substream->bytes += count;
if (count > 0) {
- if (runtime->drain || snd_rawmidi_ready(substream))
+ if (runtime->drain || __snd_rawmidi_ready(runtime))
wake_up(&runtime->sleep);
}
return count;
@@ -1370,9 +1382,11 @@ static ssize_t snd_rawmidi_write(struct file *file, const char __user *buf,
return -ENODEV;
if (signal_pending(current))
return result > 0 ? result : -ERESTARTSYS;
- if (!runtime->avail && !timeout)
- return result > 0 ? result : -EIO;
spin_lock_irq(&runtime->lock);
+ if (!runtime->avail && !timeout) {
+ spin_unlock_irq(&runtime->lock);
+ return result > 0 ? result : -EIO;
+ }
}
spin_unlock_irq(&runtime->lock);
count1 = snd_rawmidi_kernel_write1(substream, buf, NULL, count);
@@ -1452,6 +1466,7 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry,
struct snd_rawmidi *rmidi;
struct snd_rawmidi_substream *substream;
struct snd_rawmidi_runtime *runtime;
+ unsigned long buffer_size, avail, xruns;
rmidi = entry->private_data;
snd_iprintf(buffer, "%s\n\n", rmidi->name);
@@ -1470,13 +1485,16 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry,
" Owner PID : %d\n",
pid_vnr(substream->pid));
runtime = substream->runtime;
+ spin_lock_irq(&runtime->lock);
+ buffer_size = runtime->buffer_size;
+ avail = runtime->avail;
+ spin_unlock_irq(&runtime->lock);
snd_iprintf(buffer,
" Mode : %s\n"
" Buffer size : %lu\n"
" Avail : %lu\n",
runtime->oss ? "OSS compatible" : "native",
- (unsigned long) runtime->buffer_size,
- (unsigned long) runtime->avail);
+ buffer_size, avail);
}
}
}
@@ -1494,13 +1512,16 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry,
" Owner PID : %d\n",
pid_vnr(substream->pid));
runtime = substream->runtime;
+ spin_lock_irq(&runtime->lock);
+ buffer_size = runtime->buffer_size;
+ avail = runtime->avail;
+ xruns = runtime->xruns;
+ spin_unlock_irq(&runtime->lock);
snd_iprintf(buffer,
" Buffer size : %lu\n"
" Avail : %lu\n"
" Overruns : %lu\n",
- (unsigned long) runtime->buffer_size,
- (unsigned long) runtime->avail,
- (unsigned long) runtime->xruns);
+ buffer_size, avail, xruns);
}
}
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 088/130] cpufreq: sti-cpufreq: fix mem leak in sti_cpufreq_set_opp_info()
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (85 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 087/130] ALSA: rawmidi: Access runtime->avail always in spinlock Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 089/130] cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init Sasha Levin
` (41 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Yangtao Li, Yangtao Li, Viresh Kumar, Sasha Levin,
linux-arm-kernel, linux-pm
From: Yangtao Li <tiny.windzz@gmail.com>
[ Upstream commit 3a5e6732a74c44d7c78a764b9a7701135565df8f ]
Use dev_pm_opp_put_prop_name() to avoid mem leak, which free opp_table.
Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Signed-off-by: Yangtao Li <frank@allwinnertech.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/sti-cpufreq.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c
index 2855b7878a204..858be66ee7d08 100644
--- a/drivers/cpufreq/sti-cpufreq.c
+++ b/drivers/cpufreq/sti-cpufreq.c
@@ -223,7 +223,8 @@ static int sti_cpufreq_set_opp_info(void)
opp_table = dev_pm_opp_set_supported_hw(dev, version, VERSION_ELEMENTS);
if (IS_ERR(opp_table)) {
dev_err(dev, "Failed to set supported hardware\n");
- return PTR_ERR(opp_table);
+ ret = PTR_ERR(opp_table);
+ goto err_put_prop_name;
}
dev_dbg(dev, "pcode: %d major: %d minor: %d substrate: %d\n",
@@ -232,6 +233,10 @@ static int sti_cpufreq_set_opp_info(void)
version[0], version[1], version[2]);
return 0;
+
+err_put_prop_name:
+ dev_pm_opp_put_prop_name(opp_table);
+ return ret;
}
static int sti_cpufreq_fetch_syscon_registers(void)
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 089/130] cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (86 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 088/130] cpufreq: sti-cpufreq: fix mem leak in sti_cpufreq_set_opp_info() Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 090/130] ACPI: video: Add DMI quirk for GIGABYTE GB-BXBT-2807 Sasha Levin
` (40 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Qinglang Miao, Viresh Kumar, Sasha Levin, linux-pm,
linux-arm-kernel, linux-mediatek
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit 2f05c19d9ef4f5a42634f83bdb0db596ffc0dd30 ]
Add the missing platform_driver_unregister() before return from
mtk_cpufreq_driver_init in the error handling case when failed
to register mtk-cpufreq platform device
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/mediatek-cpufreq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
index 0c98dd08273d0..253eece49148c 100644
--- a/drivers/cpufreq/mediatek-cpufreq.c
+++ b/drivers/cpufreq/mediatek-cpufreq.c
@@ -572,6 +572,7 @@ static int __init mtk_cpufreq_driver_init(void)
pdev = platform_device_register_simple("mtk-cpufreq", -1, NULL, 0);
if (IS_ERR(pdev)) {
pr_err("failed to register mtk-cpufreq platform device\n");
+ platform_driver_unregister(&mtk_cpufreq_platdrv);
return PTR_ERR(pdev);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 090/130] ACPI: video: Add DMI quirk for GIGABYTE GB-BXBT-2807
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (87 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 089/130] cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 091/130] media: rcar-vin: Mask VNCSI_IFMD register Sasha Levin
` (39 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jasper St. Pierre, Chris Chiu, Rafael J . Wysocki, Sasha Levin,
linux-acpi
From: "Jasper St. Pierre" <jstpierre@mecheye.net>
[ Upstream commit 25417185e9b5ff90746d50769d2a3fcd1629e254 ]
The GIGABYTE GB-BXBT-2807 is a mini-PC which uses off the shelf
components, like an Intel GPU which is meant for mobile systems.
As such, it, by default, has a backlight controller exposed.
Unfortunately, the backlight controller only confuses userspace, which
sees the existence of a backlight device node and has the unrealistic
belief that there is actually a backlight there!
Add a DMI quirk to force the backlight off on this system.
Signed-off-by: Jasper St. Pierre <jstpierre@mecheye.net>
Reviewed-by: Chris Chiu <chiu@endlessos.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/video_detect.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 55af78b55c513..301ffe5b8feb0 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -143,6 +143,13 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
},
{
.callback = video_detect_force_vendor,
+ .ident = "GIGABYTE GB-BXBT-2807",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "GB-BXBT-2807"),
+ },
+ },
+ {
.ident = "Sony VPCEH3U1E",
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 091/130] media: rcar-vin: Mask VNCSI_IFMD register
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (88 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 090/130] ACPI: video: Add DMI quirk for GIGABYTE GB-BXBT-2807 Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 092/130] clocksource/drivers/sh_cmt: Fix potential deadlock when calling runtime PM Sasha Levin
` (38 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jacopo Mondi, Niklas Söderlund, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin, linux-media,
linux-renesas-soc
From: Jacopo Mondi <jacopo+renesas@jmondi.org>
[ Upstream commit fb25ca37317200fa97ea6b8952e07958f06da7a6 ]
The VNCSI_IFMD register controls the data expansion mode and the
channel routing between the CSI-2 receivers and VIN instances.
According to the chip manual revision 2.20 not all fields are available
for all the SoCs:
- V3M, V3H and E3 do not support the DES1 field has they do not feature
a CSI20 receiver.
- D3 only supports parallel input, and the whole register shall always
be written as 0.
Inspect the per-SoC channel routing table where the available CSI-2
instances are reported and configure VNCSI_IFMD accordingly.
This patch supports this BSP change commit:
https://github.com/renesas-rcar/linux-bsp/commit/f54697394457
("media: rcar-vin: Fix VnCSI_IFMD register access for r8a77990")
[hverkuil: replace BSP commit ID with BSP URL]
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Suggested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/rcar-vin/rcar-dma.c | 25 +++++++++++++++++++---
1 file changed, 22 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/rcar-vin/rcar-dma.c b/drivers/media/platform/rcar-vin/rcar-dma.c
index e5f6360801082..5605a42f6de54 100644
--- a/drivers/media/platform/rcar-vin/rcar-dma.c
+++ b/drivers/media/platform/rcar-vin/rcar-dma.c
@@ -1330,7 +1330,9 @@ int rvin_dma_register(struct rvin_dev *vin, int irq)
*/
int rvin_set_channel_routing(struct rvin_dev *vin, u8 chsel)
{
- u32 ifmd, vnmc;
+ const struct rvin_group_route *route;
+ u32 ifmd = 0;
+ u32 vnmc;
int ret;
ret = pm_runtime_get_sync(vin->dev);
@@ -1343,9 +1345,26 @@ int rvin_set_channel_routing(struct rvin_dev *vin, u8 chsel)
vnmc = rvin_read(vin, VNMC_REG);
rvin_write(vin, vnmc & ~VNMC_VUP, VNMC_REG);
- ifmd = VNCSI_IFMD_DES1 | VNCSI_IFMD_DES0 | VNCSI_IFMD_CSI_CHSEL(chsel);
+ /*
+ * Set data expansion mode to "pad with 0s" by inspecting the routes
+ * table to find out which bit fields are available in the IFMD
+ * register. IFMD_DES1 controls data expansion mode for CSI20/21,
+ * IFMD_DES0 controls data expansion mode for CSI40/41.
+ */
+ for (route = vin->info->routes; route->mask; route++) {
+ if (route->csi == RVIN_CSI20 || route->csi == RVIN_CSI21)
+ ifmd |= VNCSI_IFMD_DES1;
+ else
+ ifmd |= VNCSI_IFMD_DES0;
- rvin_write(vin, ifmd, VNCSI_IFMD_REG);
+ if (ifmd == (VNCSI_IFMD_DES0 | VNCSI_IFMD_DES1))
+ break;
+ }
+
+ if (ifmd) {
+ ifmd |= VNCSI_IFMD_CSI_CHSEL(chsel);
+ rvin_write(vin, ifmd, VNCSI_IFMD_REG);
+ }
vin_dbg(vin, "Set IFMD 0x%x\n", ifmd);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 092/130] clocksource/drivers/sh_cmt: Fix potential deadlock when calling runtime PM
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (89 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 091/130] media: rcar-vin: Mask VNCSI_IFMD register Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 093/130] bcache: fix race between setting bdev state to none and new write request direct to backing Sasha Levin
` (37 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Söderlund, Geert Uytterhoeven, Daniel Lezcano, Sasha Levin
From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
[ Upstream commit 8ae954caf49ac403c177d117fb8e05cbc866aa3c ]
The ch->lock is used to protect the whole enable() and read() of
sh_cmt's implementation of struct clocksource. The enable()
implementation calls pm_runtime_get_sync() which may result in the clock
source to be read() triggering a cyclic lockdep warning for the
ch->lock.
The sh_cmt driver implement its own balancing of calls to
sh_cmt_{enable,disable}() with flags in sh_cmt_{start,stop}(). It does
this to deal with that start and stop are shared between the clock
source and clock event providers. While this could be improved on
verifying corner cases based on any substantial rework on all devices
this driver supports might prove hard.
As a first step separate the PM handling for clock event and clock
source. Always put/get the device when enabling/disabling the clock
source but keep the clock event logic unchanged. This allows the sh_cmt
implementation of struct clocksource to call PM without holding the
ch->lock and avoiding the deadlock.
Triggering and log of the deadlock warning,
# echo e60f0000.timer > /sys/devices/system/clocksource/clocksource0/current_clocksource
[ 46.948370] ======================================================
[ 46.954730] WARNING: possible circular locking dependency detected
[ 46.961094] 5.10.0-rc6-arm64-renesas-00001-g0e5fd7414e8b #36 Not tainted
[ 46.967985] ------------------------------------------------------
[ 46.974342] migration/0/11 is trying to acquire lock:
[ 46.979543] ffff0000403ed220 (&dev->power.lock){-...}-{2:2}, at: __pm_runtime_resume+0x40/0x74
[ 46.988445]
[ 46.988445] but task is already holding lock:
[ 46.994441] ffff000040ad0298 (&ch->lock){....}-{2:2}, at: sh_cmt_start+0x28/0x210
[ 47.002173]
[ 47.002173] which lock already depends on the new lock.
[ 47.002173]
[ 47.010573]
[ 47.010573] the existing dependency chain (in reverse order) is:
[ 47.018262]
[ 47.018262] -> #3 (&ch->lock){....}-{2:2}:
[ 47.024033] lock_acquire.part.0+0x120/0x330
[ 47.028970] lock_acquire+0x64/0x80
[ 47.033105] _raw_spin_lock_irqsave+0x7c/0xc4
[ 47.038130] sh_cmt_start+0x28/0x210
[ 47.042352] sh_cmt_clocksource_enable+0x28/0x50
[ 47.047644] change_clocksource+0x9c/0x160
[ 47.052402] multi_cpu_stop+0xa4/0x190
[ 47.056799] cpu_stopper_thread+0x90/0x154
[ 47.061557] smpboot_thread_fn+0x244/0x270
[ 47.066310] kthread+0x154/0x160
[ 47.070175] ret_from_fork+0x10/0x20
[ 47.074390]
[ 47.074390] -> #2 (tk_core.seq.seqcount){----}-{0:0}:
[ 47.081136] lock_acquire.part.0+0x120/0x330
[ 47.086070] lock_acquire+0x64/0x80
[ 47.090203] seqcount_lockdep_reader_access.constprop.0+0x74/0x100
[ 47.097096] ktime_get+0x28/0xa0
[ 47.100960] hrtimer_start_range_ns+0x210/0x2dc
[ 47.106164] generic_sched_clock_init+0x70/0x88
[ 47.111364] sched_clock_init+0x40/0x64
[ 47.115853] start_kernel+0x494/0x524
[ 47.120156]
[ 47.120156] -> #1 (hrtimer_bases.lock){-.-.}-{2:2}:
[ 47.126721] lock_acquire.part.0+0x120/0x330
[ 47.136042] lock_acquire+0x64/0x80
[ 47.144461] _raw_spin_lock_irqsave+0x7c/0xc4
[ 47.153721] hrtimer_start_range_ns+0x68/0x2dc
[ 47.163054] rpm_suspend+0x308/0x5dc
[ 47.171473] rpm_idle+0xc4/0x2a4
[ 47.179550] pm_runtime_work+0x98/0xc0
[ 47.188209] process_one_work+0x294/0x6f0
[ 47.197142] worker_thread+0x70/0x45c
[ 47.205661] kthread+0x154/0x160
[ 47.213673] ret_from_fork+0x10/0x20
[ 47.221957]
[ 47.221957] -> #0 (&dev->power.lock){-...}-{2:2}:
[ 47.236292] check_noncircular+0x128/0x140
[ 47.244907] __lock_acquire+0x13b0/0x204c
[ 47.253332] lock_acquire.part.0+0x120/0x330
[ 47.262033] lock_acquire+0x64/0x80
[ 47.269826] _raw_spin_lock_irqsave+0x7c/0xc4
[ 47.278430] __pm_runtime_resume+0x40/0x74
[ 47.286758] sh_cmt_start+0x84/0x210
[ 47.294537] sh_cmt_clocksource_enable+0x28/0x50
[ 47.303449] change_clocksource+0x9c/0x160
[ 47.311783] multi_cpu_stop+0xa4/0x190
[ 47.319720] cpu_stopper_thread+0x90/0x154
[ 47.328022] smpboot_thread_fn+0x244/0x270
[ 47.336298] kthread+0x154/0x160
[ 47.343708] ret_from_fork+0x10/0x20
[ 47.351445]
[ 47.351445] other info that might help us debug this:
[ 47.351445]
[ 47.370225] Chain exists of:
[ 47.370225] &dev->power.lock --> tk_core.seq.seqcount --> &ch->lock
[ 47.370225]
[ 47.392003] Possible unsafe locking scenario:
[ 47.392003]
[ 47.405314] CPU0 CPU1
[ 47.413569] ---- ----
[ 47.421768] lock(&ch->lock);
[ 47.428425] lock(tk_core.seq.seqcount);
[ 47.438701] lock(&ch->lock);
[ 47.447930] lock(&dev->power.lock);
[ 47.455172]
[ 47.455172] *** DEADLOCK ***
[ 47.455172]
[ 47.471433] 3 locks held by migration/0/11:
[ 47.479099] #0: ffff8000113c9278 (timekeeper_lock){-.-.}-{2:2}, at: change_clocksource+0x2c/0x160
[ 47.491834] #1: ffff8000113c8f88 (tk_core.seq.seqcount){----}-{0:0}, at: multi_cpu_stop+0xa4/0x190
[ 47.504727] #2: ffff000040ad0298 (&ch->lock){....}-{2:2}, at: sh_cmt_start+0x28/0x210
[ 47.516541]
[ 47.516541] stack backtrace:
[ 47.528480] CPU: 0 PID: 11 Comm: migration/0 Not tainted 5.10.0-rc6-arm64-renesas-00001-g0e5fd7414e8b #36
[ 47.542147] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
[ 47.554241] Call trace:
[ 47.560832] dump_backtrace+0x0/0x190
[ 47.568670] show_stack+0x14/0x30
[ 47.576144] dump_stack+0xe8/0x130
[ 47.583670] print_circular_bug+0x1f0/0x200
[ 47.592015] check_noncircular+0x128/0x140
[ 47.600289] __lock_acquire+0x13b0/0x204c
[ 47.608486] lock_acquire.part.0+0x120/0x330
[ 47.616953] lock_acquire+0x64/0x80
[ 47.624582] _raw_spin_lock_irqsave+0x7c/0xc4
[ 47.633114] __pm_runtime_resume+0x40/0x74
[ 47.641371] sh_cmt_start+0x84/0x210
[ 47.649115] sh_cmt_clocksource_enable+0x28/0x50
[ 47.657916] change_clocksource+0x9c/0x160
[ 47.666165] multi_cpu_stop+0xa4/0x190
[ 47.674056] cpu_stopper_thread+0x90/0x154
[ 47.682308] smpboot_thread_fn+0x244/0x270
[ 47.690560] kthread+0x154/0x160
[ 47.697927] ret_from_fork+0x10/0x20
[ 47.708447] clocksource: Switched to clocksource e60f0000.timer
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201205021921.1456190-2-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/sh_cmt.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index ef773db080e90..6ac5cdf3d8cac 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -315,7 +315,6 @@ static int sh_cmt_enable(struct sh_cmt_channel *ch)
{
int k, ret;
- pm_runtime_get_sync(&ch->cmt->pdev->dev);
dev_pm_syscore_device(&ch->cmt->pdev->dev, true);
/* enable clock */
@@ -390,7 +389,6 @@ static void sh_cmt_disable(struct sh_cmt_channel *ch)
clk_disable(ch->cmt->clk);
dev_pm_syscore_device(&ch->cmt->pdev->dev, false);
- pm_runtime_put(&ch->cmt->pdev->dev);
}
/* private flags */
@@ -558,10 +556,16 @@ static int sh_cmt_start(struct sh_cmt_channel *ch, unsigned long flag)
int ret = 0;
unsigned long flags;
+ if (flag & FLAG_CLOCKSOURCE)
+ pm_runtime_get_sync(&ch->cmt->pdev->dev);
+
raw_spin_lock_irqsave(&ch->lock, flags);
- if (!(ch->flags & (FLAG_CLOCKEVENT | FLAG_CLOCKSOURCE)))
+ if (!(ch->flags & (FLAG_CLOCKEVENT | FLAG_CLOCKSOURCE))) {
+ if (flag & FLAG_CLOCKEVENT)
+ pm_runtime_get_sync(&ch->cmt->pdev->dev);
ret = sh_cmt_enable(ch);
+ }
if (ret)
goto out;
@@ -586,14 +590,20 @@ static void sh_cmt_stop(struct sh_cmt_channel *ch, unsigned long flag)
f = ch->flags & (FLAG_CLOCKEVENT | FLAG_CLOCKSOURCE);
ch->flags &= ~flag;
- if (f && !(ch->flags & (FLAG_CLOCKEVENT | FLAG_CLOCKSOURCE)))
+ if (f && !(ch->flags & (FLAG_CLOCKEVENT | FLAG_CLOCKSOURCE))) {
sh_cmt_disable(ch);
+ if (flag & FLAG_CLOCKEVENT)
+ pm_runtime_put(&ch->cmt->pdev->dev);
+ }
/* adjust the timeout to maximum if only clocksource left */
if ((flag == FLAG_CLOCKEVENT) && (ch->flags & FLAG_CLOCKSOURCE))
__sh_cmt_set_next(ch, ch->max_match_value);
raw_spin_unlock_irqrestore(&ch->lock, flags);
+
+ if (flag & FLAG_CLOCKSOURCE)
+ pm_runtime_put(&ch->cmt->pdev->dev);
}
static struct sh_cmt_channel *cs_to_sh_cmt(struct clocksource *cs)
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 093/130] bcache: fix race between setting bdev state to none and new write request direct to backing
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (90 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 092/130] clocksource/drivers/sh_cmt: Fix potential deadlock when calling runtime PM Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 094/130] mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start Sasha Levin
` (36 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dongsheng Yang, Coly Li, Jens Axboe, Sasha Levin, linux-bcache
From: Dongsheng Yang <dongsheng.yang@easystack.cn>
[ Upstream commit df4ad53242158f9f1f97daf4feddbb4f8b77f080 ]
There is a race condition in detaching as below:
A. detaching B. Write request
(1) writing back
(2) write back done, set bdev
state to clean.
(3) cached_dev_put() and
schedule_work(&dc->detach);
(4) write data [0 - 4K] directly
into backing and ack to user.
(5) power-failure...
When we restart this bcache device, this bdev is clean but not detached,
and read [0 - 4K], we will get unexpected old data from cache device.
To fix this problem, set the bdev state to none when we writeback done
in detaching, and then if power-failure happened as above, the data in
cache will not be used in next bcache device starting, it's detached, we
will read the correct data from backing derectly.
Signed-off-by: Dongsheng Yang <dongsheng.yang@easystack.cn>
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/bcache/super.c | 9 ---------
drivers/md/bcache/writeback.c | 9 +++++++++
2 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 63f5ce18311bb..a251c1f35afa9 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1040,9 +1040,6 @@ static void cancel_writeback_rate_update_dwork(struct cached_dev *dc)
static void cached_dev_detach_finish(struct work_struct *w)
{
struct cached_dev *dc = container_of(w, struct cached_dev, detach);
- struct closure cl;
-
- closure_init_stack(&cl);
BUG_ON(!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags));
BUG_ON(refcount_read(&dc->count));
@@ -1056,12 +1053,6 @@ static void cached_dev_detach_finish(struct work_struct *w)
dc->writeback_thread = NULL;
}
- memset(&dc->sb.set_uuid, 0, 16);
- SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE);
-
- bch_write_bdev_super(dc, &cl);
- closure_sync(&cl);
-
mutex_lock(&bch_register_lock);
calc_cached_dev_sectors(dc->disk.c);
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 0b02210ab4355..38b5c6cc18c7b 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -703,6 +703,15 @@ static int bch_writeback_thread(void *arg)
* bch_cached_dev_detach().
*/
if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) {
+ struct closure cl;
+
+ closure_init_stack(&cl);
+ memset(&dc->sb.set_uuid, 0, 16);
+ SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE);
+
+ bch_write_bdev_super(dc, &cl);
+ closure_sync(&cl);
+
up_write(&dc->writeback_lock);
break;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 094/130] mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (91 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 093/130] bcache: fix race between setting bdev state to none and new write request direct to backing Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 095/130] ASoC: Intel: cht_bsw_nau8824: Change SSP2-Codec DAI id to 0 Sasha Levin
` (35 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhang Xiaohui, Kalle Valo, Sasha Levin, linux-wireless, netdev
From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
[ Upstream commit 5c455c5ab332773464d02ba17015acdca198f03d ]
mwifiex_cmd_802_11_ad_hoc_start() calls memcpy() without checking
the destination size may trigger a buffer overflower,
which a local user could use to cause denial of service
or the execution of arbitrary code.
Fix it by putting the length check before calling memcpy().
Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201206084801.26479-1-ruc_zhangxiaohui@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/join.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
index d87aeff70cefb..c2cb1e711c06e 100644
--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -877,6 +877,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);
+ if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN)
+ req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN;
memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);
mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 095/130] ASoC: Intel: cht_bsw_nau8824: Change SSP2-Codec DAI id to 0
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (92 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 094/130] mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 096/130] drm/amd/display: Revert DCN2.1 dram_clock_change_latency update Sasha Levin
` (34 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans de Goede, Pierre-Louis Bossart, Mark Brown, Sasha Levin, alsa-devel
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 748e72e869718db8d735d773040bce95158c98c6 ]
The snd-soc-sst-acpi driver does not care about the id specified for
the SSP2-Codec DAI, but it does matter for the snd-sof-acpi driver;
and when it is not 0 then the snd-sof-acpi driver does not work.
Set the SSP2-Codec DAI id to 0, fixing the snd-sof-acpi driver not
working on devices using the cht_bsw_nau8824 machine-driver.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20201206122436.13553-3-hdegoede@redhat.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/cht_bsw_nau8824.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/intel/boards/cht_bsw_nau8824.c b/sound/soc/intel/boards/cht_bsw_nau8824.c
index 501bad3976fbf..bea1372b416e2 100644
--- a/sound/soc/intel/boards/cht_bsw_nau8824.c
+++ b/sound/soc/intel/boards/cht_bsw_nau8824.c
@@ -218,7 +218,7 @@ static struct snd_soc_dai_link cht_dailink[] = {
{
/* SSP2 - Codec */
.name = "SSP2-Codec",
- .id = 1,
+ .id = 0,
.no_pcm = 1,
.dai_fmt = SND_SOC_DAIFMT_DSP_B | SND_SOC_DAIFMT_IB_NF
| SND_SOC_DAIFMT_CBS_CFS,
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 096/130] drm/amd/display: Revert DCN2.1 dram_clock_change_latency update
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (93 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 095/130] ASoC: Intel: cht_bsw_nau8824: Change SSP2-Codec DAI id to 0 Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 097/130] rtlwifi: rtl8192de: fix ofdm power compensation Sasha Levin
` (33 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Michael Strauss, Sung Lee, Yongqiang Sun, Eryk Brol,
Alex Deucher, Sasha Levin, amd-gfx, dri-devel
From: Michael Strauss <michael.strauss@amd.com>
[ Upstream commit 3abad347c432b9f5904cfad40f417d5cff90300c ]
[Why]
New value breaks VSR on high refresh panels, reverting until a fix is developed
Signed-off-by: Michael Strauss <michael.strauss@amd.com>
Signed-off-by: Sung Lee <sung.lee@amd.com>
Reviewed-by: Yongqiang Sun <yongqiang.sun@amd.com>
Acked-by: Eryk Brol <eryk.brol@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
index a6d5beada6634..bb7add5ea2273 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
@@ -257,7 +257,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = {
.num_banks = 8,
.num_chans = 4,
.vmm_page_size_bytes = 4096,
- .dram_clock_change_latency_us = 11.72,
+ .dram_clock_change_latency_us = 23.84,
.return_bus_width_bytes = 64,
.dispclk_dppclk_vco_speed_mhz = 3600,
.xfc_bus_transport_time_us = 4,
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 097/130] rtlwifi: rtl8192de: fix ofdm power compensation
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (94 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 096/130] drm/amd/display: Revert DCN2.1 dram_clock_change_latency update Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 098/130] ASoC: Intel: bytcr_rt5640: Add quirk for ARCHOS Cesium 140 Sasha Levin
` (32 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ping-Ke Shih, Dan Carpenter, Kalle Valo, Sasha Levin,
linux-wireless, netdev
From: Ping-Ke Shih <pkshih@realtek.com>
[ Upstream commit 3f79e541593fecc2a90687eb7162e15a499caa33 ]
ofdm_index[] is used to indicate how many power compensation is needed to
current thermal value. For internal PA module or 2.4G band, the min_index
is different from other cases.
This issue originally is reported by Dan. He found the size of ofdm_index[]
is 2, but access index 'i' may be equal to 2 if 'rf' is 2 in case of
'is2t'.
In fact, the chunk of code is added to wrong place, so move it back to
proper place, and then power compensation and buffer overflow are fixed.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201207031903.7599-1-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8192de/dm.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/dm.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/dm.c
index 71f3b6b5d7bd9..5baa1b127fff0 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/dm.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/dm.c
@@ -986,18 +986,19 @@ static void rtl92d_dm_txpower_tracking_callback_thermalmeter(
rtlpriv->dm.cck_index);
}
for (i = 0; i < rf; i++) {
- if (ofdm_index[i] > OFDM_TABLE_SIZE_92D - 1)
+ if (ofdm_index[i] > OFDM_TABLE_SIZE_92D - 1) {
ofdm_index[i] = OFDM_TABLE_SIZE_92D - 1;
- else if (ofdm_index[i] < ofdm_min_index)
+ } else if (internal_pa ||
+ rtlhal->current_bandtype == BAND_ON_2_4G) {
+ if (ofdm_index[i] < ofdm_min_index_internal_pa)
+ ofdm_index[i] = ofdm_min_index_internal_pa;
+ } else if (ofdm_index[i] < ofdm_min_index) {
ofdm_index[i] = ofdm_min_index;
+ }
}
if (rtlhal->current_bandtype == BAND_ON_2_4G) {
if (cck_index > CCK_TABLE_SIZE - 1) {
cck_index = CCK_TABLE_SIZE - 1;
- } else if (internal_pa ||
- rtlhal->current_bandtype == BAND_ON_2_4G) {
- if (ofdm_index[i] < ofdm_min_index_internal_pa)
- ofdm_index[i] = ofdm_min_index_internal_pa;
} else if (cck_index < 0) {
cck_index = 0;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 098/130] ASoC: Intel: bytcr_rt5640: Add quirk for ARCHOS Cesium 140
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (95 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 097/130] rtlwifi: rtl8192de: fix ofdm power compensation Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 099/130] ARM: zynq: Fix leds subnode name for zc702/zybo-z7 Sasha Levin
` (31 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Chris Chiu, Pierre-Louis Bossart, Mark Brown, Sasha Levin, alsa-devel
From: Chris Chiu <chiu@endlessos.org>
[ Upstream commit 1bea2256aa96a2d7b1b576eb74e29d79edc9bea8 ]
Tha ARCHOS Cesium 140 tablet has problem with the jack-sensing,
thus the heaset functions are not working.
Add quirk for this model to select the correct input map, jack-detect
options and channel map to enable jack sensing and headset microphone.
This device uses IN1 for its internal MIC and JD2 for jack-detect.
Signed-off-by: Chris Chiu <chiu@endlessos.org>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20201208060414.27646-1-chiu@endlessos.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index 6012367f6fe48..6b6749550fc4f 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -422,6 +422,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
BYT_RT5640_SSP0_AIF1 |
BYT_RT5640_MCLK_EN),
},
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ARCHOS 140 CESIUM"),
+ },
+ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
+ BYT_RT5640_JD_SRC_JD2_IN4N |
+ BYT_RT5640_OVCD_TH_2000UA |
+ BYT_RT5640_OVCD_SF_0P75 |
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
{
.matches = {
DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 099/130] ARM: zynq: Fix leds subnode name for zc702/zybo-z7
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (96 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 098/130] ASoC: Intel: bytcr_rt5640: Add quirk for ARCHOS Cesium 140 Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 100/130] btrfs: fix race that results in logging old extents during a fast fsync Sasha Levin
` (30 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Michal Simek, Sasha Levin, devicetree, linux-arm-kernel
From: Michal Simek <michal.simek@xilinx.com>
[ Upstream commit 38d1985fdfcf20dc246b552580479ae602f735d1 ]
Fix the leds subnode names to match (^led-[0-9a-f]$|led).
Similar change has been also done by commit 9a19a39ee48b ("arm64: dts:
zynqmp: Fix leds subnode name for zcu100/ultra96 v1").
The patch is fixing these warnings:
.../zynq-zc702.dt.yaml: leds: 'ds23' does not match any of the regexes:
'(^led-[0-9a-f]$|led)', 'pinctrl-[0-9]+'
>From schema: .../Documentation/devicetree/bindings/leds/leds-gpio.yaml
.../zynq-zybo-z7.dt.yaml: gpio-leds: 'ld4' does not match any of the
regexes: '(^led-[0-9a-f]$|led)', 'pinctrl-[0-9]+'
>From schema: .../Documentation/devicetree/bindings/leds/leds-gpio.yaml
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Link: https://lore.kernel.org/r/607a66783b129294364abf09a6fc8abd241ff4ee.1606397101.git.michal.simek@xilinx.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/zynq-zc702.dts | 2 +-
arch/arm/boot/dts/zynq-zybo-z7.dts | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/zynq-zc702.dts b/arch/arm/boot/dts/zynq-zc702.dts
index 27cd6cb52f1ba..10a7d0b8cf8b9 100644
--- a/arch/arm/boot/dts/zynq-zc702.dts
+++ b/arch/arm/boot/dts/zynq-zc702.dts
@@ -49,7 +49,7 @@ sw13 {
leds {
compatible = "gpio-leds";
- ds23 {
+ led-ds23 {
label = "ds23";
gpios = <&gpio0 10 0>;
linux,default-trigger = "heartbeat";
diff --git a/arch/arm/boot/dts/zynq-zybo-z7.dts b/arch/arm/boot/dts/zynq-zybo-z7.dts
index 357b78a5c11b1..7b87e10d3953b 100644
--- a/arch/arm/boot/dts/zynq-zybo-z7.dts
+++ b/arch/arm/boot/dts/zynq-zybo-z7.dts
@@ -25,7 +25,7 @@ chosen {
gpio-leds {
compatible = "gpio-leds";
- ld4 {
+ led-ld4 {
label = "zynq-zybo-z7:green:ld4";
gpios = <&gpio0 7 GPIO_ACTIVE_HIGH>;
};
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 100/130] btrfs: fix race that results in logging old extents during a fast fsync
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (97 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 099/130] ARM: zynq: Fix leds subnode name for zc702/zybo-z7 Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 101/130] btrfs: fix race that causes unnecessary logging of ancestor inodes Sasha Levin
` (29 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Filipe Manana, David Sterba, Sasha Levin, linux-btrfs
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 5f96bfb7633c55b578c6b32f32624061f25010db ]
When logging the extents of an inode during a fast fsync, we have a time
window where we can log extents that are from the previous transaction and
already persisted. This only makes us waste time unnecessarily.
The following sequence of steps shows how this can happen:
1) We are at transaction 1000;
2) An ordered extent E from inode I completes, that is it has gone through
btrfs_finish_ordered_io(), and it set the extent maps' generation to
1000 when we unpin the extent, which is the generation of the current
transaction;
3) The commit for transaction 1000 starts by task A;
4) The task committing transaction 1000 sets the transaction state to
unblocked, writes the dirty extent buffers and the super blocks, then
unlocks tree_log_mutex;
5) Some change is made to inode I, resulting in creation of a new
transaction with a generation of 1001;
6) The transaction 1000 commit starts unpinning extents. At this point
fs_info->last_trans_committed still has a value of 999;
7) Task B starts an fsync on inode I, and when it gets to
btrfs_log_changed_extents() sees the extent map for extent E in the
list of modified extents. It sees the extent map has a generation of
1000 and fs_info->last_trans_committed has a value of 999, so it
proceeds to logging the respective file extent item and all the
checksums covering its range.
So we end up wasting time since the extent was already persisted and
is reachable through the trees pointed to by the super block committed
by transaction 1000.
So just fix this by comparing the extent maps generation against the
generation of the transaction handle - if it is smaller then the id in the
handle, we know the extent was already persisted and we do not need to log
it.
This patch belongs to a patch set that is comprised of the following
patches:
btrfs: fix race causing unnecessary inode logging during link and rename
btrfs: fix race that results in logging old extents during a fast fsync
btrfs: fix race that causes unnecessary logging of ancestor inodes
btrfs: fix race that makes inode logging fallback to transaction commit
btrfs: fix race leading to unnecessary transaction commit when logging inode
btrfs: do not block inode logging for so long during transaction commit
Performance results are mentioned in the change log of the last patch.
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/tree-log.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index de53e51669976..12182db88222b 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -4372,14 +4372,12 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
struct extent_map *em, *n;
struct list_head extents;
struct extent_map_tree *tree = &inode->extent_tree;
- u64 test_gen;
int ret = 0;
int num = 0;
INIT_LIST_HEAD(&extents);
write_lock(&tree->lock);
- test_gen = root->fs_info->last_trans_committed;
list_for_each_entry_safe(em, n, &tree->modified_extents, list) {
/*
@@ -4412,7 +4410,7 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
goto process;
}
- if (em->generation <= test_gen)
+ if (em->generation < trans->transid)
continue;
/* We log prealloc extents beyond eof later. */
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 101/130] btrfs: fix race that causes unnecessary logging of ancestor inodes
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (98 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 100/130] btrfs: fix race that results in logging old extents during a fast fsync Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 102/130] btrfs: fix race that makes inode logging fallback to transaction commit Sasha Levin
` (28 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Filipe Manana, David Sterba, Sasha Levin, linux-btrfs
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 4d6221d7d83141d58ece6560e9cfd4cc92eab044 ]
When logging an inode and we are checking if we need to log ancestors that
are new, if the previous transaction is still committing we have a time
window where we can unnecessarily log ancestor inodes that were created in
the previous transaction.
The race is described by the following steps:
1) We are at transaction 1000;
2) Directory inode X is created, its generation is set to 1000;
3) The commit for transaction 1000 is started by task A;
4) The task committing transaction 1000 sets the transaction state to
unblocked, writes the dirty extent buffers and the super blocks, then
unlocks tree_log_mutex;
5) Inode Y, a regular file, is created under directory inode X, this
results in starting a new transaction with a generation of 1001;
6) The transaction 1000 commit is unpinning extents. At this point
fs_info->last_trans_committed still has a value of 999;
7) Task B calls fsync on inode Y and gets a handle for transaction 1001;
8) Task B ends up at log_all_new_ancestors() and then because inode Y has
only one hard link, ends up at log_new_ancestors_fast(). There it reads
a value of 999 from fs_info->last_trans_committed, and sees that the
parent inode X has a generation of 1000, so we end up logging inode X:
if (inode->generation > fs_info->last_trans_committed) {
ret = btrfs_log_inode(trans, root, inode,
LOG_INODE_EXISTS, ctx);
(...)
which is not necessary since it was created in the past transaction,
with a generation of 1000, and that transaction has already committed
its super blocks - it's still unpinning extents so it has not yet
updated fs_info->last_trans_committed from 999 to 1000.
So this just causes us to spend more time logging and allocating and
writing more tree blocks for the log tree.
So fix this by comparing an inode's generation with the generation of the
transaction our transaction handle refers to - if the inode's generation
matches the generation of the current transaction than we know it is a
new inode we need to log, otherwise don't log it.
This case is often hit when running dbench for a long enough duration.
This patch belongs to a patch set that is comprised of the following
patches:
btrfs: fix race causing unnecessary inode logging during link and rename
btrfs: fix race that results in logging old extents during a fast fsync
btrfs: fix race that causes unnecessary logging of ancestor inodes
btrfs: fix race that makes inode logging fallback to transaction commit
btrfs: fix race leading to unnecessary transaction commit when logging inode
btrfs: do not block inode logging for so long during transaction commit
Performance results are mentioned in the change log of the last patch.
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/tree-log.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 12182db88222b..72e0ff38646a7 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -5804,7 +5804,6 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans,
while (true) {
struct btrfs_fs_info *fs_info = root->fs_info;
- const u64 last_committed = fs_info->last_trans_committed;
struct extent_buffer *leaf = path->nodes[0];
int slot = path->slots[0];
struct btrfs_key search_key;
@@ -5820,7 +5819,7 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans,
if (IS_ERR(inode))
return PTR_ERR(inode);
- if (BTRFS_I(inode)->generation > last_committed)
+ if (BTRFS_I(inode)->generation >= trans->transid)
ret = btrfs_log_inode(trans, root, BTRFS_I(inode),
LOG_INODE_EXISTS,
0, LLONG_MAX, ctx);
@@ -5862,7 +5861,6 @@ static int log_new_ancestors_fast(struct btrfs_trans_handle *trans,
struct btrfs_log_ctx *ctx)
{
struct btrfs_root *root = inode->root;
- struct btrfs_fs_info *fs_info = root->fs_info;
struct dentry *old_parent = NULL;
struct super_block *sb = inode->vfs_inode.i_sb;
int ret = 0;
@@ -5876,7 +5874,7 @@ static int log_new_ancestors_fast(struct btrfs_trans_handle *trans,
if (root != inode->root)
break;
- if (inode->generation > fs_info->last_trans_committed) {
+ if (inode->generation >= trans->transid) {
ret = btrfs_log_inode(trans, root, inode,
LOG_INODE_EXISTS, 0, LLONG_MAX, ctx);
if (ret)
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 102/130] btrfs: fix race that makes inode logging fallback to transaction commit
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (99 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 101/130] btrfs: fix race that causes unnecessary logging of ancestor inodes Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 103/130] btrfs: fix race leading to unnecessary transaction commit when logging inode Sasha Levin
` (27 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Filipe Manana, David Sterba, Sasha Levin, linux-btrfs
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 47d3db41e190ca4a9c6e4a848052f4c5ca633db1 ]
When logging an inode and the previous transaction is still committing, we
have a time window where we can end up incorrectly think an inode has its
last_unlink_trans field with a value greater than the last transaction
committed, which results in the logging to fallback to a full transaction
commit, which is usually much more expensive than doing a log commit.
The race is described by the following steps:
1) We are at transaction 1000;
2) We modify an inode X (a directory) using transaction 1000 and set its
last_unlink_trans field to 1000, because for example we removed one
of its subdirectories;
3) We create a new inode Y with a dentry in inode X using transaction 1000,
so its generation field is set to 1000;
4) The commit for transaction 1000 is started by task A;
5) The task committing transaction 1000 sets the transaction state to
unblocked, writes the dirty extent buffers and the super blocks, then
unlocks tree_log_mutex;
6) Some task starts a new transaction with a generation of 1001;
7) We do some modification to inode Y (using transaction 1001);
8) The transaction 1000 commit starts unpinning extents. At this point
fs_info->last_trans_committed still has a value of 999;
9) Task B starts an fsync on inode Y, and gets a handle for transaction
1001. When it gets to check_parent_dirs_for_sync() it does the checking
of the ancestor dentries because the following check does not evaluate
to true:
if (S_ISREG(inode->vfs_inode.i_mode) &&
inode->generation <= last_committed &&
inode->last_unlink_trans <= last_committed)
goto out;
The generation value for inode Y is 1000 and last_committed, which has
the value read from fs_info->last_trans_committed, has a value of 999,
so that check evaluates to false and we proceed to check the ancestor
inodes.
Once we get to the first ancestor, inode X, we call
btrfs_must_commit_transaction() on it, which evaluates to true:
static bool btrfs_must_commit_transaction(...)
{
struct btrfs_fs_info *fs_info = inode->root->fs_info;
bool ret = false;
mutex_lock(&inode->log_mutex);
if (inode->last_unlink_trans > fs_info->last_trans_committed) {
/*
* Make sure any commits to the log are forced to be full
* commits.
*/
btrfs_set_log_full_commit(trans);
ret = true;
}
(...)
because inode's X last_unlink_trans has a value of 1000 and
fs_info->last_trans_committed still has a value of 999, it returns
true to check_parent_dirs_for_sync(), making it return 1 which is
propagated up to btrfs_sync_file(), causing it to fallback to a full
transaction commit of transaction 1001.
We should have not fallen back to commit transaction 1001, since inode
X had last_unlink_trans set to 1000 and the super blocks for
transaction 1000 were already written. So while not resulting in a
functional problem, it leads to a lot more work and higher latencies
for a fsync since committing a transaction is usually more expensive
than committing a log (if other filesystem changes happened under that
transaction).
Similar problem happens when logging directories, for the same reason as
btrfs_must_commit_transaction() returns true on an inode with its
last_unlink_trans having the generation of the previous transaction and
that transaction is still committing, unpinning its freed extents.
So fix this by comparing last_unlink_trans with the id of the current
transaction instead of fs_info->last_trans_committed.
This case is often hit when running dbench for a long enough duration, as
it does lots of rename and rmdir operations (both update the field
last_unlink_trans of an inode) and fsyncs of files and directories.
This patch belongs to a patch set that is comprised of the following
patches:
btrfs: fix race causing unnecessary inode logging during link and rename
btrfs: fix race that results in logging old extents during a fast fsync
btrfs: fix race that causes unnecessary logging of ancestor inodes
btrfs: fix race that makes inode logging fallback to transaction commit
btrfs: fix race leading to unnecessary transaction commit when logging inode
btrfs: do not block inode logging for so long during transaction commit
Performance results are mentioned in the change log of the last patch.
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/tree-log.c | 20 ++++++++------------
1 file changed, 8 insertions(+), 12 deletions(-)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 72e0ff38646a7..54095753f84f0 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -5418,11 +5418,10 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
static bool btrfs_must_commit_transaction(struct btrfs_trans_handle *trans,
struct btrfs_inode *inode)
{
- struct btrfs_fs_info *fs_info = inode->root->fs_info;
bool ret = false;
mutex_lock(&inode->log_mutex);
- if (inode->last_unlink_trans > fs_info->last_trans_committed) {
+ if (inode->last_unlink_trans >= trans->transid) {
/*
* Make sure any commits to the log are forced to be full
* commits.
@@ -5444,8 +5443,7 @@ static bool btrfs_must_commit_transaction(struct btrfs_trans_handle *trans,
static noinline int check_parent_dirs_for_sync(struct btrfs_trans_handle *trans,
struct btrfs_inode *inode,
struct dentry *parent,
- struct super_block *sb,
- u64 last_committed)
+ struct super_block *sb)
{
int ret = 0;
struct dentry *old_parent = NULL;
@@ -5457,8 +5455,8 @@ static noinline int check_parent_dirs_for_sync(struct btrfs_trans_handle *trans,
* and other fun in this file.
*/
if (S_ISREG(inode->vfs_inode.i_mode) &&
- inode->generation <= last_committed &&
- inode->last_unlink_trans <= last_committed)
+ inode->generation < trans->transid &&
+ inode->last_unlink_trans < trans->transid)
goto out;
if (!S_ISDIR(inode->vfs_inode.i_mode)) {
@@ -5993,7 +5991,6 @@ static int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
struct btrfs_fs_info *fs_info = root->fs_info;
struct super_block *sb;
int ret = 0;
- u64 last_committed = fs_info->last_trans_committed;
bool log_dentries = false;
sb = inode->vfs_inode.i_sb;
@@ -6018,8 +6015,7 @@ static int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
goto end_no_trans;
}
- ret = check_parent_dirs_for_sync(trans, inode, parent, sb,
- last_committed);
+ ret = check_parent_dirs_for_sync(trans, inode, parent, sb);
if (ret)
goto end_no_trans;
@@ -6049,8 +6045,8 @@ static int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
* and other fun in this file.
*/
if (S_ISREG(inode->vfs_inode.i_mode) &&
- inode->generation <= last_committed &&
- inode->last_unlink_trans <= last_committed) {
+ inode->generation < trans->transid &&
+ inode->last_unlink_trans < trans->transid) {
ret = 0;
goto end_trans;
}
@@ -6099,7 +6095,7 @@ static int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
* but the file inode does not have a matching BTRFS_INODE_REF_KEY item
* and has a link count of 2.
*/
- if (inode->last_unlink_trans > last_committed) {
+ if (inode->last_unlink_trans >= trans->transid) {
ret = btrfs_log_all_parents(trans, inode, ctx);
if (ret)
goto end_trans;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 103/130] btrfs: fix race leading to unnecessary transaction commit when logging inode
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (100 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 102/130] btrfs: fix race that makes inode logging fallback to transaction commit Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 104/130] driver core: Reorder devices on successful probe Sasha Levin
` (26 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Filipe Manana, David Sterba, Sasha Levin, linux-btrfs
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 639bd575b7c7fa326abadd2ef3e374a5a24eb40b ]
When logging an inode we may often have to fallback to a full transaction
commit, either because a new block group was allocated, there is some case
we can not deal with without a transaction commit or some error like an
ENOMEM happened. However after we fallback to a transaction commit, we
have a time window where we can make the next attempt to log any inode
commit the next transaction unnecessarily, adding additional overhead and
increasing latency.
A sequence of steps that leads to this issue is the following:
1) The current open transaction has a generation of 1000;
2) A new block group is allocated, and as a consequence we must make sure
any attempts to commit a log fallback to a transaction commit, so
btrfs_set_log_full_commit() is called from btrfs_make_block_group().
This sets fs_info->last_trans_log_full_commit to 1000;
3) Task A is holding a handle on transaction 1000 and tries to log inode X.
Once it gets to start_log_trans(), it calls btrfs_need_log_full_commit()
which returns true, since fs_info->last_trans_log_full_commit has a
value of 1000. So we end up returning EAGAIN and propagating it up to
btrfs_sync_file(), where we commit transaction 1000;
4) The transaction commit task (task A) sets the transaction state to
unblocked (TRANS_STATE_UNBLOCKED);
5) Some other task, task B, starts a new transaction with a generation of
1001;
6) Some stuff is done with transaction 1001, some btree blocks COWed, etc;
7) Transaction 1000 has not fully committed yet, we are still writing all
the extent buffers it created;
8) Some new task, task C, starts an fsync of inode Y, gets a handle for
transaction 1001, and it gets to btrfs_log_inode_parent() which does
the following check:
if (fs_info->last_trans_log_full_commit > last_committed) {
ret = 1;
goto end_no_trans;
}
At that point last_trans_log_full_commit has a value of 1000 and
last_committed (value of fs_info->last_trans_committed) has a value of
999, since transaction 1000 has not yet committed - it is either still
writing out dirty extent buffers, its super blocks or unpinning
extents.
As a consequence we return 1, which gets propagated up to
btrfs_sync_file(), which will then call btrfs_commit_transaction()
for transaction 1001.
As a consequence we have an unnecessary second transaction commit, we
previously committed transaction 1000 and now commit transaction 1001
as well, resulting in more overhead and increased latency.
So fix this double transaction commit issue simply by removing that check,
because all we need to do is wait for the previous transaction to finish
its commit, which we already do later when starting the log transaction at
start_log_trans(), because there we acquire the tree_log_mutex lock, which
is held by a transaction commit and only released after the transaction
commits its super blocks.
Another issue that check has is that it reads last_trans_log_full_commit
without using READ_ONCE(), which is incorrect since that member of
struct btrfs_fs_info is always updated with WRITE_ONCE() through the
helper btrfs_set_log_full_commit().
This double transaction commit issue can actually be triggered quite often
in long runs of dbench, since besides the creation of new block groups
that force inode logging to fallback to a transaction commit, there are
cases where dbench asks to fsync a directory which had files in it that
were previously renamed or subdirectories that were removed, resulting in
the inode logging to fallback to a full transaction commit.
This patch belongs to a patch set that is comprised of the following
patches:
btrfs: fix race causing unnecessary inode logging during link and rename
btrfs: fix race that results in logging old extents during a fast fsync
btrfs: fix race that causes unnecessary logging of ancestor inodes
btrfs: fix race that makes inode logging fallback to transaction commit
btrfs: fix race leading to unnecessary transaction commit when logging inode
btrfs: do not block inode logging for so long during transaction commit
Performance results are mentioned in the change log of the last patch.
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/tree-log.c | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 54095753f84f0..d0f4629bdfaf8 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -6000,16 +6000,6 @@ static int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
goto end_no_trans;
}
- /*
- * The prev transaction commit doesn't complete, we need do
- * full commit by ourselves.
- */
- if (fs_info->last_trans_log_full_commit >
- fs_info->last_trans_committed) {
- ret = 1;
- goto end_no_trans;
- }
-
if (btrfs_root_refs(&root->root_item) == 0) {
ret = 1;
goto end_no_trans;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 104/130] driver core: Reorder devices on successful probe
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (101 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 103/130] btrfs: fix race leading to unnecessary transaction commit when logging inode Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 105/130] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() Sasha Levin
` (25 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thierry Reding, Jonathan Hunter, Rafael . J . Wysocki,
Greg Kroah-Hartman, Sasha Levin
From: Thierry Reding <treding@nvidia.com>
[ Upstream commit 5b6164d3465fcc13b5679c860c452963443172a7 ]
Device drivers usually depend on the fact that the devices that they
control are suspended in the same order that they were probed in. In
most cases this is already guaranteed via deferred probe.
However, there's one case where this can still break: if a device is
instantiated before a dependency (for example if it appears before the
dependency in device tree) but gets probed only after the dependency is
probed. Instantiation order would cause the dependency to get probed
later, in which case probe of the original device would be deferred and
the suspend/resume queue would get reordered properly. However, if the
dependency is provided by a built-in driver and the device depending on
that driver is controlled by a loadable module, which may only get
loaded after the root filesystem has become available, we can be faced
with a situation where the probe order ends up being different from the
suspend/resume order.
One example where this happens is on Tegra186, where the ACONNECT is
listed very early in device tree (sorted by unit-address) and depends on
BPMP (listed very late because it has no unit-address) for power domains
and clocks/resets. If the ACONNECT driver is built-in, there is no
problem because it will be probed before BPMP, causing a probe deferral
and that in turn reorders the suspend/resume queue. However, if built as
a module, it will end up being probed after BPMP, and therefore not
result in a probe deferral, and therefore the suspend/resume queue will
stay in the instantiation order. This in turn causes problems because
ACONNECT will be resumed before BPMP, which will result in a hang
because the ACONNECT's power domain cannot be powered on as long as the
BPMP is still suspended.
Fix this by always reordering devices on successful probe. This ensures
that the suspend/resume queue is always in probe order and hence meets
the natural expectations of drivers vs. their dependencies.
Reported-by: Jonathan Hunter <jonathanh@nvidia.com>
Acked-by: Rafael. J. Wysocki <rafael@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20201203175756.1405564-1-thierry.reding@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/dd.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 32823f36cffd0..3a2b42c713da8 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -380,6 +380,13 @@ static void driver_bound(struct device *dev)
device_pm_check_callbacks(dev);
+ /*
+ * Reorder successfully probed devices to the end of the device list.
+ * This ensures that suspend/resume order matches probe order, which
+ * is usually what drivers rely on.
+ */
+ device_pm_move_to_tail(dev);
+
/*
* Make sure the device is no longer in one of the deferred lists and
* kick off retrying all pending devices
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 105/130] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells()
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (102 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 104/130] driver core: Reorder devices on successful probe Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 106/130] iwlwifi: avoid endless HW errors at assert time Sasha Levin
` (24 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Anant Thazhemadam, syzbot+a79e17c39564bedf0930,
Greg Kroah-Hartman, Sasha Levin
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
[ Upstream commit 31dcb6c30a26d32650ce134820f27de3c675a45a ]
A kernel-infoleak was reported by syzbot, which was caused because
dbells was left uninitialized.
Using kzalloc() instead of kmalloc() fixes this issue.
Reported-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com
Tested-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201122224534.333471-1-anant.thazhemadam@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/vmw_vmci/vmci_context.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/vmw_vmci/vmci_context.c b/drivers/misc/vmw_vmci/vmci_context.c
index 16695366ec926..26ff49fdf0f7d 100644
--- a/drivers/misc/vmw_vmci/vmci_context.c
+++ b/drivers/misc/vmw_vmci/vmci_context.c
@@ -743,7 +743,7 @@ static int vmci_ctx_get_chkpt_doorbells(struct vmci_ctx *context,
return VMCI_ERROR_MORE_DATA;
}
- dbells = kmalloc(data_size, GFP_ATOMIC);
+ dbells = kzalloc(data_size, GFP_ATOMIC);
if (!dbells)
return VMCI_ERROR_NO_MEM;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 106/130] iwlwifi: avoid endless HW errors at assert time
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (103 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 105/130] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 107/130] iwlwifi: validate MPDU length against notification length Sasha Levin
` (23 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mordechay Goodstein, Luca Coelho, Sasha Levin, linux-wireless, netdev
From: Mordechay Goodstein <mordechay.goodstein@intel.com>
[ Upstream commit 861bae42e1f125a5a255ace3ccd731e59f58ddec ]
Curretly we only mark HW error state "after" trying to collect HW data,
but if any HW error happens while colleting HW data we go into endless
loop. avoid this by setting HW error state "before" collecting HW data.
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.4c7e5a87da15.Ic35b2f28ff08f7ac23143c80f224d52eb97a0454@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 3acbd5b7ab4b2..87f53810fdac3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1291,6 +1291,12 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
} else if (mvm->fwrt.cur_fw_img == IWL_UCODE_REGULAR &&
mvm->hw_registered &&
!test_bit(STATUS_TRANS_DEAD, &mvm->trans->status)) {
+ /* This should be first thing before trying to collect any
+ * data to avoid endless loops if any HW error happens while
+ * collecting debug data.
+ */
+ set_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
+
if (mvm->fw->ucode_capa.error_log_size) {
u32 src_size = mvm->fw->ucode_capa.error_log_size;
u32 src_addr = mvm->fw->ucode_capa.error_log_addr;
@@ -1309,7 +1315,6 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
if (fw_error && mvm->fw_restart > 0)
mvm->fw_restart--;
- set_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
ieee80211_restart_hw(mvm->hw);
}
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 107/130] iwlwifi: validate MPDU length against notification length
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (104 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 106/130] iwlwifi: avoid endless HW errors at assert time Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 108/130] iwlwifi: pcie: validate RX descriptor length Sasha Levin
` (22 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Haggai Abramovsky, Luca Coelho, Sasha Levin,
linux-wireless, netdev
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit efc0ec5afb6e1488b3bdc4bbf85533d79d7e5f9f ]
The MPDU contained in a notification shouldn't be larger than the
notification size itself is, validate this.
Reported-by: Haggai Abramovsky <haggai.abramovsky@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.7c721ad37014.Id5746874ecfa208b60baa62691b2d9dc5dd4d89c@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/dvm/rx.c | 10 ++++++++--
drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 8 +++++++-
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 6 ++++++
3 files changed, 21 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/rx.c b/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
index 673d60784bfad..b930816ca5ca9 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
@@ -3,7 +3,7 @@
*
* Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
* Copyright(c) 2015 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018, 2020 Intel Corporation
*
* Portions of this file are derived from the ipw3945 project, as well
* as portionhelp of the ieee80211 subsystem header files.
@@ -786,7 +786,7 @@ static void iwlagn_rx_reply_rx(struct iwl_priv *priv,
struct iwl_rx_phy_res *phy_res;
__le32 rx_pkt_status;
struct iwl_rx_mpdu_res_start *amsdu;
- u32 len;
+ u32 len, pkt_len = iwl_rx_packet_len(pkt);
u32 ampdu_status;
u32 rate_n_flags;
@@ -798,6 +798,12 @@ static void iwlagn_rx_reply_rx(struct iwl_priv *priv,
amsdu = (struct iwl_rx_mpdu_res_start *)pkt->data;
header = (struct ieee80211_hdr *)(pkt->data + sizeof(*amsdu));
len = le16_to_cpu(amsdu->byte_count);
+
+ if (unlikely(len + sizeof(*amsdu) + sizeof(__le32) > pkt_len)) {
+ IWL_DEBUG_DROP(priv, "FW lied about packet len\n");
+ return;
+ }
+
rx_pkt_status = *(__le32 *)(pkt->data + sizeof(*amsdu) + len);
ampdu_status = iwlagn_translate_rx_status(priv,
le32_to_cpu(rx_pkt_status));
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 77b8def26edb2..47d38df78439b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -349,7 +349,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
struct iwl_rx_mpdu_res_start *rx_res;
struct ieee80211_sta *sta = NULL;
struct sk_buff *skb;
- u32 len;
+ u32 len, pkt_len = iwl_rx_packet_payload_len(pkt);
u32 rate_n_flags;
u32 rx_pkt_status;
u8 crypt_len = 0;
@@ -358,6 +358,12 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data;
hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res));
len = le16_to_cpu(rx_res->byte_count);
+
+ if (unlikely(len + sizeof(*rx_res) + sizeof(__le32) > pkt_len)) {
+ IWL_DEBUG_DROP(mvm, "FW lied about packet len\n");
+ return;
+ }
+
rx_pkt_status = get_unaligned_le32((__le32 *)
(pkt->data + sizeof(*rx_res) + len));
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index a6e2a30eb3109..d0bfcee59a3a7 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -1553,6 +1553,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
struct ieee80211_hdr *hdr;
u32 len = le16_to_cpu(desc->mpdu_len);
+ u32 pkt_len = iwl_rx_packet_payload_len(pkt);
u32 rate_n_flags, gp2_on_air_rise;
u16 phy_info = le16_to_cpu(desc->phy_info);
struct ieee80211_sta *sta = NULL;
@@ -1599,6 +1600,11 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
le32_get_bits(phy_data.d1,
IWL_RX_PHY_DATA1_INFO_TYPE_MASK);
+ if (len + desc_size > pkt_len) {
+ IWL_DEBUG_DROP(mvm, "FW lied about packet len\n");
+ return;
+ }
+
hdr = (void *)(pkt->data + desc_size);
/* Dont use dev_alloc_skb(), we'll have enough headroom once
* ieee80211_hdr pulled.
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 108/130] iwlwifi: pcie: validate RX descriptor length
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (105 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 107/130] iwlwifi: validate MPDU length against notification length Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 109/130] iwlwifi: mvm: fix 22000 series driver NMI Sasha Levin
` (21 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit df72138de4bc4e85e427aabc60fc51be6cc57fc7 ]
Validate the maximum RX descriptor length against the size
of the buffers we gave the device - if it doesn't fit then
the hardware messed up.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.6378fb435cc0.Ib07485f3dc5999c74b03f21e7a808c50a05e353c@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index 64c74acadb998..72ec2ddcaecd4 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -1292,6 +1292,13 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
len = iwl_rx_packet_len(pkt);
len += sizeof(u32); /* account for status word */
+
+ offset += ALIGN(len, FH_RSCSR_FRAME_ALIGN);
+
+ /* check that what the device tells us made sense */
+ if (offset > max_len)
+ break;
+
trace_iwlwifi_dev_rx(trans->dev, trans, pkt, len);
trace_iwlwifi_dev_rx_data(trans->dev, trans, pkt, len);
@@ -1349,7 +1356,6 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
page_stolen |= rxcb._page_stolen;
if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_22560)
break;
- offset += ALIGN(len, FH_RSCSR_FRAME_ALIGN);
}
/* page was stolen from us -- free our reference */
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 109/130] iwlwifi: mvm: fix 22000 series driver NMI
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (106 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 108/130] iwlwifi: pcie: validate RX descriptor length Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 110/130] iwlwifi: trans: consider firmware dead after errors Sasha Levin
` (20 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 9e8338ad17eb8976edd5d2def516e4b3346a4470 ]
For triggering an NMI in the firmware, we should only set BIT(24)
in the corresponding register, not the entire mask that's usable
by the driver.
This currently doesn't matter because the firmware only enables
BIT(24), but we'll start using BIT(25) for other purposes with an
upcoming API change.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.2f982365d085.Id09daabfd331ba9e120abcbbedd2ad6448902ed0@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/iwl-io.c | 2 +-
drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-io.c b/drivers/net/wireless/intel/iwlwifi/iwl-io.c
index 1b7414bf7bef2..2144c1f745337 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-io.c
@@ -309,7 +309,7 @@ void iwl_force_nmi(struct iwl_trans *trans)
DEVICE_SET_NMI_VAL_DRV);
else if (trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_AX210)
iwl_write_umac_prph(trans, UREG_NIC_SET_NMI_DRIVER,
- UREG_NIC_SET_NMI_DRIVER_NMI_FROM_DRIVER_MSK);
+ UREG_NIC_SET_NMI_DRIVER_NMI_FROM_DRIVER);
else
iwl_write_umac_prph(trans, UREG_DOORBELL_TO_ISR6,
UREG_DOORBELL_TO_ISR6_NMI_BIT);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index 23c25a7665f27..80b3fca8f2328 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -111,7 +111,7 @@
#define DEVICE_SET_NMI_VAL_DRV BIT(7)
/* Device NMI register and value for 9000 family and above hw's */
#define UREG_NIC_SET_NMI_DRIVER 0x00a05c10
-#define UREG_NIC_SET_NMI_DRIVER_NMI_FROM_DRIVER_MSK 0xff000000
+#define UREG_NIC_SET_NMI_DRIVER_NMI_FROM_DRIVER BIT(24)
/* Shared registers (0x0..0x3ff, via target indirect or periphery */
#define SHR_BASE 0x00a10000
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 110/130] iwlwifi: trans: consider firmware dead after errors
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (107 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 109/130] iwlwifi: mvm: fix 22000 series driver NMI Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 111/130] iwlwifi: mvm: validate firmware sync response size Sasha Levin
` (19 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 152fdc0f698896708f9d7889a4ba4da6944b74f7 ]
If we get an error, no longer consider the firmware to be
in IWL_TRANS_FW_ALIVE state.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.a9d01e79c1c7.Ib2deb076b392fb516a7230bac91d7ab8a9586d86@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
index 1e85d59b91613..b31bb56ca6591 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
@@ -1230,8 +1230,10 @@ static inline void iwl_trans_fw_error(struct iwl_trans *trans)
return;
/* prevent double restarts due to the same erroneous FW */
- if (!test_and_set_bit(STATUS_FW_ERROR, &trans->status))
+ if (!test_and_set_bit(STATUS_FW_ERROR, &trans->status)) {
iwl_op_mode_nic_error(trans->op_mode);
+ trans->state = IWL_TRANS_NO_FW;
+ }
}
static inline void iwl_trans_sync_nmi(struct iwl_trans *trans)
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 111/130] iwlwifi: mvm: validate firmware sync response size
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (108 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 110/130] iwlwifi: trans: consider firmware dead after errors Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 112/130] iwlwifi: add an extra firmware state in the transport Sasha Levin
` (18 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit b570e5b0592a56c5990ae3aa0fdb93dd9b545d43 ]
We send some data to the firmware and expect to get it back,
but we shouldn't really trust the firmware on this. Check the
size of all the data we send down to avoid using bad or just
uninitialized data when the firmware doesn't respond right.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.a5a8173f16c7.I4fa68bb2b1c7dcc52ddd381c4042722d27c4a34d@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index d0bfcee59a3a7..545a84e08816e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -763,10 +763,18 @@ void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct napi_struct *napi,
struct iwl_rx_packet *pkt = rxb_addr(rxb);
struct iwl_rxq_sync_notification *notif;
struct iwl_mvm_internal_rxq_notif *internal_notif;
+ u32 len = iwl_rx_packet_payload_len(pkt);
notif = (void *)pkt->data;
internal_notif = (void *)notif->payload;
+ if (WARN_ONCE(len < sizeof(*notif) + sizeof(*internal_notif),
+ "invalid notification size %d (%d)",
+ len, (int)(sizeof(*notif) + sizeof(*internal_notif))))
+ return;
+ /* remove only the firmware header, we want all of our payload below */
+ len -= sizeof(*notif);
+
if (internal_notif->sync &&
mvm->queue_sync_cookie != internal_notif->cookie) {
WARN_ONCE(1, "Received expired RX queue sync message\n");
@@ -775,11 +783,22 @@ void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct napi_struct *napi,
switch (internal_notif->type) {
case IWL_MVM_RXQ_EMPTY:
+ WARN_ONCE(len != sizeof(*internal_notif),
+ "invalid empty notification size %d (%d)",
+ len, (int)sizeof(*internal_notif));
break;
case IWL_MVM_RXQ_NOTIF_DEL_BA:
+ if (WARN_ONCE(len != sizeof(struct iwl_mvm_rss_sync_notif),
+ "invalid delba notification size %d (%d)",
+ len, (int)sizeof(struct iwl_mvm_rss_sync_notif)))
+ break;
iwl_mvm_del_ba(mvm, queue, (void *)internal_notif->data);
break;
case IWL_MVM_RXQ_NSSN_SYNC:
+ if (WARN_ONCE(len != sizeof(struct iwl_mvm_rss_sync_notif),
+ "invalid nssn sync notification size %d (%d)",
+ len, (int)sizeof(struct iwl_mvm_rss_sync_notif)))
+ break;
iwl_mvm_nssn_sync(mvm, napi, queue,
(void *)internal_notif->data);
break;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 112/130] iwlwifi: add an extra firmware state in the transport
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (109 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 111/130] iwlwifi: mvm: validate firmware sync response size Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 113/130] iwlwifi: mvm: disconnect if channel switch delay is too long Sasha Levin
` (17 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit b2ed841ed070ccbe908016537f429a3a8f0221bf ]
Start tracking not just if the firmware is dead or alive,
but also if it's starting.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.33e50d40b688.I8bbd41af7aa5e769273a6fc1c06fbf548dd2eb26@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
index b31bb56ca6591..cb67b9a4ab088 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
@@ -615,12 +615,14 @@ struct iwl_trans_ops {
/**
* enum iwl_trans_state - state of the transport layer
*
- * @IWL_TRANS_NO_FW: no fw has sent an alive response
- * @IWL_TRANS_FW_ALIVE: a fw has sent an alive response
+ * @IWL_TRANS_NO_FW: firmware wasn't started yet, or crashed
+ * @IWL_TRANS_FW_STARTED: FW was started, but not alive yet
+ * @IWL_TRANS_FW_ALIVE: FW has sent an alive response
*/
enum iwl_trans_state {
- IWL_TRANS_NO_FW = 0,
- IWL_TRANS_FW_ALIVE = 1,
+ IWL_TRANS_NO_FW,
+ IWL_TRANS_FW_STARTED,
+ IWL_TRANS_FW_ALIVE,
};
/**
@@ -873,12 +875,18 @@ static inline int iwl_trans_start_fw(struct iwl_trans *trans,
const struct fw_img *fw,
bool run_in_rfkill)
{
+ int ret;
+
might_sleep();
WARN_ON_ONCE(!trans->rx_mpdu_cmd);
clear_bit(STATUS_FW_ERROR, &trans->status);
- return trans->ops->start_fw(trans, fw, run_in_rfkill);
+ ret = trans->ops->start_fw(trans, fw, run_in_rfkill);
+ if (ret == 0)
+ trans->state = IWL_TRANS_FW_STARTED;
+
+ return ret;
}
static inline void iwl_trans_stop_device(struct iwl_trans *trans)
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 113/130] iwlwifi: mvm: disconnect if channel switch delay is too long
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (110 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 112/130] iwlwifi: add an extra firmware state in the transport Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 114/130] USB: typec: tcpm: Fix PR_SWAP error handling Sasha Levin
` (16 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 87d9564e14cf5d05e4f1fa4eb7c55d798427f1dd ]
If the channel switch delay that we would incur after the channel
switch actually happens is longer than the quiet time we're willing
to tolerate, disconnect as well.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.3bc3449922da.Ib0255deb67b2fc21317e274adcacb545bb1dc669@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index daae86cd61140..366dc2d756bfb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -4523,6 +4523,9 @@ static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
break;
case NL80211_IFTYPE_STATION:
+ if (chsw->delay > IWL_MAX_CSA_BLOCK_TX)
+ schedule_delayed_work(&mvmvif->csa_work, 0);
+
if (chsw->block_tx) {
/*
* In case of undetermined / long time with immediate
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 114/130] USB: typec: tcpm: Fix PR_SWAP error handling
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (111 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 113/130] iwlwifi: mvm: disconnect if channel switch delay is too long Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 115/130] USB: typec: tcpm: Add a 30ms room for tPSSourceOn in PR_SWAP Sasha Levin
` (15 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kyle Tso, Guenter Roeck, Heikki Krogerus, Badhri Jagan Sridharan,
Will McVicker, Greg Kroah-Hartman, Sasha Levin, linux-usb
From: Kyle Tso <kyletso@google.com>
[ Upstream commit 301a633c1b5b2caa4c4b97a83270d4a1d60c53bf ]
PD rev3.0 8.3.3.16.3.6 PE_PRS_SRC_SNK_Wait_Source_on State
The Policy Enging Shall transition to the ErrorRecovery state when the
PSSourceOnTimer times out ...
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: Badhri Jagan Sridharan <badhri@google.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Kyle Tso <kyletso@google.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20201210160521.3417426-4-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/tcpm/tcpm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index 5bb84cb4876a9..0c0f251ab8a51 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -3451,7 +3451,7 @@ static void run_state_machine(struct tcpm_port *port)
tcpm_set_state(port, ERROR_RECOVERY, 0);
break;
}
- tcpm_set_state_cond(port, SNK_UNATTACHED, PD_T_PS_SOURCE_ON);
+ tcpm_set_state(port, ERROR_RECOVERY, PD_T_PS_SOURCE_ON);
break;
case PR_SWAP_SRC_SNK_SINK_ON:
tcpm_set_state(port, SNK_STARTUP, 0);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 115/130] USB: typec: tcpm: Add a 30ms room for tPSSourceOn in PR_SWAP
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (112 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 114/130] USB: typec: tcpm: Fix PR_SWAP error handling Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 116/130] cfg80211: Update TSF and TSF BSSID for multi BSS Sasha Levin
` (14 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kyle Tso, Guenter Roeck, Heikki Krogerus, Badhri Jagan Sridharan,
Will McVicker, Greg Kroah-Hartman, Sasha Levin, linux-usb
From: Kyle Tso <kyletso@google.com>
[ Upstream commit fe79d5de77204dd946cfad76a9bec23354b1a500 ]
TCPM state machine needs 20-25ms to enter the ErrorRecovery state after
tPSSourceOn timer timeouts. Change the timer from max 480ms to 450ms to
ensure that the timer complies with the Spec. In order to keep the
flexibility for other usecases using tPSSourceOn, add another timer only
for PR_SWAP.
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: Badhri Jagan Sridharan <badhri@google.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Kyle Tso <kyletso@google.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20201210160521.3417426-5-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/tcpm/tcpm.c | 2 +-
include/linux/usb/pd.h | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index 0c0f251ab8a51..77a49e16e285e 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -3451,7 +3451,7 @@ static void run_state_machine(struct tcpm_port *port)
tcpm_set_state(port, ERROR_RECOVERY, 0);
break;
}
- tcpm_set_state(port, ERROR_RECOVERY, PD_T_PS_SOURCE_ON);
+ tcpm_set_state(port, ERROR_RECOVERY, PD_T_PS_SOURCE_ON_PRS);
break;
case PR_SWAP_SRC_SNK_SINK_ON:
tcpm_set_state(port, SNK_STARTUP, 0);
diff --git a/include/linux/usb/pd.h b/include/linux/usb/pd.h
index 6655ce32feff1..203fca353fdce 100644
--- a/include/linux/usb/pd.h
+++ b/include/linux/usb/pd.h
@@ -432,6 +432,7 @@ static inline unsigned int rdo_max_power(u32 rdo)
#define PD_T_DRP_SRC 30
#define PD_T_PS_SOURCE_OFF 920
#define PD_T_PS_SOURCE_ON 480
+#define PD_T_PS_SOURCE_ON_PRS 450 /* 390 - 480ms */
#define PD_T_PS_HARD_RESET 30
#define PD_T_SRC_RECOVER 760
#define PD_T_SRC_RECOVER_MAX 1000
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 116/130] cfg80211: Update TSF and TSF BSSID for multi BSS
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (113 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 115/130] USB: typec: tcpm: Add a 30ms room for tPSSourceOn in PR_SWAP Sasha Levin
@ 2020-12-23 2:17 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 117/130] nl80211: always accept scan request with the duration set Sasha Levin
` (13 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:17 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilan Peer, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit b45a19dd7e46462d0f34fcc05e5b1871d4c415ec ]
When a new BSS entry is created based on multi BSS IE, the
TSF and the TSF BSSID were not updated. Fix it.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201129172929.8377d5063827.I6f2011b6017c2ad507c61a3f1ca03b7177a46e32@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/scan.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 328402ab64a3f..a86721f5c0a26 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1396,6 +1396,9 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy,
tmp.pub.beacon_interval = beacon_interval;
tmp.pub.capability = capability;
tmp.ts_boottime = data->boottime_ns;
+ tmp.parent_tsf = data->parent_tsf;
+ ether_addr_copy(tmp.parent_bssid, data->parent_bssid);
+
if (non_tx_data) {
tmp.pub.transmitted_bss = non_tx_data->tx_bss;
ts = bss_from_pub(non_tx_data->tx_bss)->ts;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 117/130] nl80211: always accept scan request with the duration set
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (114 preceding siblings ...)
2020-12-23 2:17 ` [PATCH AUTOSEL 5.4 116/130] cfg80211: Update TSF and TSF BSSID for multi BSS Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 118/130] cfg80211: Save the regulatory domain when setting custom regulatory Sasha Levin
` (12 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Avraham Stern, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
From: Avraham Stern <avraham.stern@intel.com>
[ Upstream commit c837cbad40d949feaff86734d637c7602ae0b56b ]
Accept a scan request with the duration set even if the driver
does not support setting the scan dwell. The duration can be used
as a hint to the driver, but the driver may use its internal logic
for setting the scan dwell.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201129172929.9491a12f9226.Ia9c5b24fcefc5ce5592537507243391633a27e5f@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/nl80211.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index dbac5c0995a0f..881bc49a67e45 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7694,12 +7694,6 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
}
if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
- if (!wiphy_ext_feature_isset(wiphy,
- NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
- err = -EOPNOTSUPP;
- goto out_free;
- }
-
request->duration =
nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
request->duration_mandatory =
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 118/130] cfg80211: Save the regulatory domain when setting custom regulatory
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (115 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 117/130] nl80211: always accept scan request with the duration set Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 119/130] mac80211: disallow band-switch during CSA Sasha Levin
` (11 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilan Peer, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit beee246951571cc5452176f3dbfe9aa5a10ba2b9 ]
When custom regulatory was set, only the channels setting was updated, but
the regulatory domain was not saved. Fix it by saving it.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201129172929.290fa5c5568a.Ic5732aa64de6ee97ae3578bd5779fc723ba489d1@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/reg.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 0f3b57a73670b..e79d45f0ec232 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2339,6 +2339,7 @@ static void handle_band_custom(struct wiphy *wiphy,
void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
const struct ieee80211_regdomain *regd)
{
+ const struct ieee80211_regdomain *new_regd, *tmp;
enum nl80211_band band;
unsigned int bands_set = 0;
@@ -2358,6 +2359,13 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
* on your device's supported bands.
*/
WARN_ON(!bands_set);
+ new_regd = reg_copy_regd(regd);
+ if (IS_ERR(new_regd))
+ return;
+
+ tmp = get_wiphy_regdom(wiphy);
+ rcu_assign_pointer(wiphy->regd, new_regd);
+ rcu_free_regdom(tmp);
}
EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 119/130] mac80211: disallow band-switch during CSA
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (116 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 118/130] cfg80211: Save the regulatory domain when setting custom regulatory Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 120/130] mac80211: support Rx timestamp calculation for all preamble types Sasha Levin
` (10 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 3660944a37ce73890292571f44f04891834f9044 ]
If the AP advertises a band switch during CSA, we will not have
the right information to continue working with it, since it will
likely (have to) change its capabilities and we don't track any
capability changes at all. Additionally, we store e.g. supported
rates per band, and that information would become invalid.
Since this is a fringe scenario, just disconnect explicitly.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201129172929.0e2327107c06.I461adb07704e056b054a4a7c29b80c95a9f56637@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mlme.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 17a3a1c938beb..236ddc6b891c2 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1334,6 +1334,17 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
return;
}
+ if (sdata->vif.bss_conf.chandef.chan->band !=
+ csa_ie.chandef.chan->band) {
+ sdata_info(sdata,
+ "AP %pM switches to different band (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
+ ifmgd->associated->bssid,
+ csa_ie.chandef.chan->center_freq,
+ csa_ie.chandef.width, csa_ie.chandef.center_freq1,
+ csa_ie.chandef.center_freq2);
+ goto lock_and_drop_connection;
+ }
+
if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
IEEE80211_CHAN_DISABLED)) {
sdata_info(sdata,
@@ -1342,9 +1353,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
csa_ie.chandef.chan->center_freq,
csa_ie.chandef.width, csa_ie.chandef.center_freq1,
csa_ie.chandef.center_freq2);
- ieee80211_queue_work(&local->hw,
- &ifmgd->csa_connection_drop_work);
- return;
+ goto lock_and_drop_connection;
}
if (cfg80211_chandef_identical(&csa_ie.chandef,
@@ -1429,6 +1438,9 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
TU_TO_EXP_TIME((csa_ie.count - 1) *
cbss->beacon_interval));
return;
+ lock_and_drop_connection:
+ mutex_lock(&local->mtx);
+ mutex_lock(&local->chanctx_mtx);
drop_connection:
/*
* This is just so that the disconnect flow will know that
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 120/130] mac80211: support Rx timestamp calculation for all preamble types
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (117 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 119/130] mac80211: disallow band-switch during CSA Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 121/130] mac80211: use bitfield helpers for BA session action frames Sasha Levin
` (9 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Avraham Stern, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
From: Avraham Stern <avraham.stern@intel.com>
[ Upstream commit da3882331a55ba8c8eda0cfc077ad3b88c257e22 ]
Add support for calculating the Rx timestamp for HE frames.
Since now all frame types are supported, allow setting the Rx
timestamp regardless of the frame type.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201206145305.4786559af475.Ia54486bb0a12e5351f9d5c60ef6fcda7c9e7141c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/ieee80211_i.h | 9 ++----
net/mac80211/util.c | 66 +++++++++++++++++++++++++++++++++++++-
2 files changed, 67 insertions(+), 8 deletions(-)
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 05406e9c05b32..7ad21d041f063 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1561,13 +1561,8 @@ ieee80211_have_rx_timestamp(struct ieee80211_rx_status *status)
{
WARN_ON_ONCE(status->flag & RX_FLAG_MACTIME_START &&
status->flag & RX_FLAG_MACTIME_END);
- if (status->flag & (RX_FLAG_MACTIME_START | RX_FLAG_MACTIME_END))
- return true;
- /* can't handle non-legacy preamble yet */
- if (status->flag & RX_FLAG_MACTIME_PLCP_START &&
- status->encoding == RX_ENC_LEGACY)
- return true;
- return false;
+ return !!(status->flag & (RX_FLAG_MACTIME_START | RX_FLAG_MACTIME_END |
+ RX_FLAG_MACTIME_PLCP_START));
}
void ieee80211_vif_inc_num_mcast(struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index decd46b383938..9f05336509210 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -3238,6 +3238,7 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
u64 ts = status->mactime;
struct rate_info ri;
u16 rate;
+ u8 n_ltf;
if (WARN_ON(!ieee80211_have_rx_timestamp(status)))
return 0;
@@ -3248,11 +3249,58 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
/* Fill cfg80211 rate info */
switch (status->encoding) {
+ case RX_ENC_HE:
+ ri.flags |= RATE_INFO_FLAGS_HE_MCS;
+ ri.mcs = status->rate_idx;
+ ri.nss = status->nss;
+ ri.he_ru_alloc = status->he_ru;
+ if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
+ ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
+
+ /*
+ * See P802.11ax_D6.0, section 27.3.4 for
+ * VHT PPDU format.
+ */
+ if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
+ mpdu_offset += 2;
+ ts += 36;
+
+ /*
+ * TODO:
+ * For HE MU PPDU, add the HE-SIG-B.
+ * For HE ER PPDU, add 8us for the HE-SIG-A.
+ * For HE TB PPDU, add 4us for the HE-STF.
+ * Add the HE-LTF durations - variable.
+ */
+ }
+
+ break;
case RX_ENC_HT:
ri.mcs = status->rate_idx;
ri.flags |= RATE_INFO_FLAGS_MCS;
if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
+
+ /*
+ * See P802.11REVmd_D3.0, section 19.3.2 for
+ * HT PPDU format.
+ */
+ if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
+ mpdu_offset += 2;
+ if (status->enc_flags & RX_ENC_FLAG_HT_GF)
+ ts += 24;
+ else
+ ts += 32;
+
+ /*
+ * Add Data HT-LTFs per streams
+ * TODO: add Extension HT-LTFs, 4us per LTF
+ */
+ n_ltf = ((ri.mcs >> 3) & 3) + 1;
+ n_ltf = n_ltf == 3 ? 4 : n_ltf;
+ ts += n_ltf * 4;
+ }
+
break;
case RX_ENC_VHT:
ri.flags |= RATE_INFO_FLAGS_VHT_MCS;
@@ -3260,6 +3308,23 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
ri.nss = status->nss;
if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
+
+ /*
+ * See P802.11REVmd_D3.0, section 21.3.2 for
+ * VHT PPDU format.
+ */
+ if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
+ mpdu_offset += 2;
+ ts += 36;
+
+ /*
+ * Add VHT-LTFs per streams
+ */
+ n_ltf = (ri.nss != 1) && (ri.nss % 2) ?
+ ri.nss + 1 : ri.nss;
+ ts += 4 * n_ltf;
+ }
+
break;
default:
WARN_ON(1);
@@ -3283,7 +3348,6 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
ri.legacy = DIV_ROUND_UP(bitrate, (1 << shift));
if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
- /* TODO: handle HT/VHT preambles */
if (status->band == NL80211_BAND_5GHZ) {
ts += 20 << shift;
mpdu_offset += 2;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 121/130] mac80211: use bitfield helpers for BA session action frames
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (118 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 120/130] mac80211: support Rx timestamp calculation for all preamble types Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 122/130] mac80211: ignore country element TX power on 6 GHz Sasha Levin
` (8 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit db8ebd06ccb87b7bea8e50f3d4ba5dc0142093b8 ]
Use the appropriate bitfield helpers for encoding and decoding
the capability field in the BA session action frames instead of
open-coding the shifts/masks.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201206145305.0c46e5097cc0.I06e75706770c40b9ba1cabd1f8a78ab7a05c5b73@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/agg-rx.c | 8 ++++----
net/mac80211/agg-tx.c | 12 ++++++------
2 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 4d1c335e06e57..93285f9a2bbd5 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -250,10 +250,10 @@ static void ieee80211_send_addba_resp(struct sta_info *sta, u8 *da, u16 tid,
mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
- capab = (u16)(amsdu << 0); /* bit 0 A-MSDU support */
- capab |= (u16)(policy << 1); /* bit 1 aggregation policy */
- capab |= (u16)(tid << 2); /* bit 5:2 TID number */
- capab |= (u16)(buf_size << 6); /* bit 15:6 max size of aggregation */
+ capab = u16_encode_bits(amsdu, IEEE80211_ADDBA_PARAM_AMSDU_MASK);
+ capab |= u16_encode_bits(policy, IEEE80211_ADDBA_PARAM_POLICY_MASK);
+ capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK);
+ capab |= u16_encode_bits(buf_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index b11883d268759..ea6bc02c900bf 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -95,10 +95,10 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
mgmt->u.action.u.addba_req.dialog_token = dialog_token;
- capab = (u16)(1 << 0); /* bit 0 A-MSDU support */
- capab |= (u16)(1 << 1); /* bit 1 aggregation policy */
- capab |= (u16)(tid << 2); /* bit 5:2 TID number */
- capab |= (u16)(agg_size << 6); /* bit 15:6 max size of aggergation */
+ capab = IEEE80211_ADDBA_PARAM_AMSDU_MASK;
+ capab |= IEEE80211_ADDBA_PARAM_POLICY_MASK;
+ capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK);
+ capab |= u16_encode_bits(agg_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
@@ -921,8 +921,8 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
amsdu = capab & IEEE80211_ADDBA_PARAM_AMSDU_MASK;
- tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
- buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
+ tid = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_TID_MASK);
+ buf_size = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes);
txq = sta->sta.txq[tid];
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 122/130] mac80211: ignore country element TX power on 6 GHz
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (119 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 121/130] mac80211: use bitfield helpers for BA session action frames Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 123/130] mac80211: Fix calculation of minimal channel width Sasha Levin
` (7 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 2dedfe1dbdf27ac344584ed03c3876c85d2779fb ]
Updates to the 802.11ax draft are coming that deprecate the
country element in favour of the transmit power envelope
element, and make the maximum transmit power level field in
the triplets reserved, so if we parse them we'd use 0 dBm
transmit power.
Follow suit and completely ignore the element on 6 GHz for
purposes of determining TX power.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201206145305.9abf9f6b4f88.Icb6e52af586edcc74f1f0360e8f6fc9ef2bfe8f5@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mlme.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 236ddc6b891c2..ba1e5cac32adb 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1487,6 +1487,15 @@ ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
case NL80211_BAND_5GHZ:
chan_increment = 4;
break;
+ case NL80211_BAND_6GHZ:
+ /*
+ * In the 6 GHz band, the "maximum transmit power level"
+ * field in the triplets is reserved, and thus will be
+ * zero and we shouldn't use it to control TX power.
+ * The actual TX power will be given in the transmit
+ * power envelope element instead.
+ */
+ return false;
}
/* find channel */
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 123/130] mac80211: Fix calculation of minimal channel width
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (120 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 122/130] mac80211: ignore country element TX power on 6 GHz Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 124/130] mac80211: don't filter out beacons once we start CSA Sasha Levin
` (6 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilan Peer, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit bbf31e88df2f5da20ce613c340ce508d732046b3 ]
When calculating the minimal channel width for channel context,
the current operation Rx channel width of a station was used and not
the overall channel width capability of the station, i.e., both for
Tx and Rx.
Fix ieee80211_get_sta_bw() to use the maximal channel width the
station is capable. While at it make the function static.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201206145305.4387040b99a0.I74bcf19238f75a5960c4098b10e355123d933281@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/chan.c | 10 ++++++----
net/mac80211/ieee80211_i.h | 1 -
2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 9c94baaf693cb..aae4b36dd78d1 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -191,11 +191,13 @@ ieee80211_find_reservation_chanctx(struct ieee80211_local *local,
return NULL;
}
-enum nl80211_chan_width ieee80211_get_sta_bw(struct ieee80211_sta *sta)
+static enum nl80211_chan_width ieee80211_get_sta_bw(struct sta_info *sta)
{
- switch (sta->bandwidth) {
+ enum ieee80211_sta_rx_bandwidth width = ieee80211_sta_cap_rx_bw(sta);
+
+ switch (width) {
case IEEE80211_STA_RX_BW_20:
- if (sta->ht_cap.ht_supported)
+ if (sta->sta.ht_cap.ht_supported)
return NL80211_CHAN_WIDTH_20;
else
return NL80211_CHAN_WIDTH_20_NOHT;
@@ -232,7 +234,7 @@ ieee80211_get_max_required_bw(struct ieee80211_sub_if_data *sdata)
!(sta->sdata->bss && sta->sdata->bss == sdata->bss))
continue;
- max_bw = max(max_bw, ieee80211_get_sta_bw(&sta->sta));
+ max_bw = max(max_bw, ieee80211_get_sta_bw(sta));
}
rcu_read_unlock();
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 7ad21d041f063..7445c12acf2c4 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -2217,7 +2217,6 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
enum ieee80211_chanctx_mode chanmode,
u8 radar_detect);
int ieee80211_max_num_channels(struct ieee80211_local *local);
-enum nl80211_chan_width ieee80211_get_sta_bw(struct ieee80211_sta *sta);
void ieee80211_recalc_chanctx_chantype(struct ieee80211_local *local,
struct ieee80211_chanctx *ctx);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 124/130] mac80211: don't filter out beacons once we start CSA
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (121 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 123/130] mac80211: Fix calculation of minimal channel width Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 125/130] mac80211: Update rate control on channel change Sasha Levin
` (5 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Emmanuel Grumbach, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
[ Upstream commit 189a164d0fc6c59a22c4486d641d0a0a0d33387a ]
I hit a bug in which we started a CSA with an action frame,
but the AP changed its mind and didn't change the beacon.
The CSA wasn't cancelled and we lost the connection.
The beacons were ignored because they never changed: they
never contained any CSA IE. Because they never changed, the
CRC of the beacon didn't change either which made us ignore
the beacons instead of processing them.
Now what happens is:
1) beacon has CRC X and it is valid. No CSA IE in the beacon
2) as long as beacon's CRC X, don't process their IEs
3) rx action frame with CSA
4) invalidate the beacon's CRC
5) rx beacon, CRC is still X, but now it is invalid
6) process the beacon, detect there is no CSA IE
7) abort CSA
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201206145305.83470b8407e6.I739b907598001362744692744be15335436b8351@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mlme.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ba1e5cac32adb..ed12519e3a634 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1415,6 +1415,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
sdata->csa_chandef = csa_ie.chandef;
sdata->csa_block_tx = csa_ie.mode;
ifmgd->csa_ignored_same_chan = false;
+ ifmgd->beacon_crc_valid = false;
if (sdata->csa_block_tx)
ieee80211_stop_vif_queues(local, sdata,
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 125/130] mac80211: Update rate control on channel change
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (122 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 124/130] mac80211: don't filter out beacons once we start CSA Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 126/130] ALSA: hda/hdmi: packet buffer index must be set before reading value Sasha Levin
` (4 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilan Peer, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit 44b72ca8163b8cf94384a11fdec716f5478411bf ]
A channel change or a channel bandwidth change can impact the
rate control logic. However, the rate control logic was not updated
before/after such a change, which might result in unexpected
behavior.
Fix this by updating the stations rate control logic when the
corresponding channel context changes.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201206145305.600d967fe3c9.I48305f25cfcc9c032c77c51396e9e9b882748a86@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/chan.c | 61 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 61 insertions(+)
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index aae4b36dd78d1..4f0d676e6e2c1 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -9,6 +9,7 @@
#include <net/cfg80211.h>
#include "ieee80211_i.h"
#include "driver-ops.h"
+#include "rate.h"
static int ieee80211_chanctx_num_assigned(struct ieee80211_local *local,
struct ieee80211_chanctx *ctx)
@@ -340,10 +341,42 @@ void ieee80211_recalc_chanctx_min_def(struct ieee80211_local *local,
drv_change_chanctx(local, ctx, IEEE80211_CHANCTX_CHANGE_MIN_WIDTH);
}
+static void ieee80211_chan_bw_change(struct ieee80211_local *local,
+ struct ieee80211_chanctx *ctx)
+{
+ struct sta_info *sta;
+ struct ieee80211_supported_band *sband =
+ local->hw.wiphy->bands[ctx->conf.def.chan->band];
+
+ rcu_read_lock();
+ list_for_each_entry_rcu(sta, &local->sta_list,
+ list) {
+ enum ieee80211_sta_rx_bandwidth new_sta_bw;
+
+ if (!ieee80211_sdata_running(sta->sdata))
+ continue;
+
+ if (rcu_access_pointer(sta->sdata->vif.chanctx_conf) !=
+ &ctx->conf)
+ continue;
+
+ new_sta_bw = ieee80211_sta_cur_vht_bw(sta);
+ if (new_sta_bw == sta->sta.bandwidth)
+ continue;
+
+ sta->sta.bandwidth = new_sta_bw;
+ rate_control_rate_update(local, sband, sta,
+ IEEE80211_RC_BW_CHANGED);
+ }
+ rcu_read_unlock();
+}
+
static void ieee80211_change_chanctx(struct ieee80211_local *local,
struct ieee80211_chanctx *ctx,
const struct cfg80211_chan_def *chandef)
{
+ enum nl80211_chan_width width;
+
if (cfg80211_chandef_identical(&ctx->conf.def, chandef)) {
ieee80211_recalc_chanctx_min_def(local, ctx);
return;
@@ -351,7 +384,25 @@ static void ieee80211_change_chanctx(struct ieee80211_local *local,
WARN_ON(!cfg80211_chandef_compatible(&ctx->conf.def, chandef));
+ width = ctx->conf.def.width;
ctx->conf.def = *chandef;
+
+ /* expected to handle only 20/40/80/160 channel widths */
+ switch (chandef->width) {
+ case NL80211_CHAN_WIDTH_20_NOHT:
+ case NL80211_CHAN_WIDTH_20:
+ case NL80211_CHAN_WIDTH_40:
+ case NL80211_CHAN_WIDTH_80:
+ case NL80211_CHAN_WIDTH_80P80:
+ case NL80211_CHAN_WIDTH_160:
+ break;
+ default:
+ WARN_ON(1);
+ }
+
+ if (chandef->width < width)
+ ieee80211_chan_bw_change(local, ctx);
+
drv_change_chanctx(local, ctx, IEEE80211_CHANCTX_CHANGE_WIDTH);
ieee80211_recalc_chanctx_min_def(local, ctx);
@@ -359,6 +410,9 @@ static void ieee80211_change_chanctx(struct ieee80211_local *local,
local->_oper_chandef = *chandef;
ieee80211_hw_config(local, 0);
}
+
+ if (chandef->width > width)
+ ieee80211_chan_bw_change(local, ctx);
}
static struct ieee80211_chanctx *
@@ -1041,8 +1095,14 @@ ieee80211_vif_use_reserved_reassign(struct ieee80211_sub_if_data *sdata)
if (WARN_ON(!chandef))
return -EINVAL;
+ if (old_ctx->conf.def.width > new_ctx->conf.def.width)
+ ieee80211_chan_bw_change(local, new_ctx);
+
ieee80211_change_chanctx(local, new_ctx, chandef);
+ if (old_ctx->conf.def.width < new_ctx->conf.def.width)
+ ieee80211_chan_bw_change(local, new_ctx);
+
vif_chsw[0].vif = &sdata->vif;
vif_chsw[0].old_ctx = &old_ctx->conf;
vif_chsw[0].new_ctx = &new_ctx->conf;
@@ -1433,6 +1493,7 @@ static int ieee80211_vif_use_reserved_switch(struct ieee80211_local *local)
ieee80211_recalc_smps_chanctx(local, ctx);
ieee80211_recalc_radar_chanctx(local, ctx);
ieee80211_recalc_chanctx_min_def(local, ctx);
+ ieee80211_chan_bw_change(local, ctx);
list_for_each_entry_safe(sdata, sdata_tmp, &ctx->reserved_vifs,
reserved_chanctx_list) {
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 126/130] ALSA: hda/hdmi: packet buffer index must be set before reading value
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (123 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 125/130] mac80211: Update rate control on channel change Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 127/130] cpufreq: Fix cpufreq_online() return value on errors Sasha Levin
` (3 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Kai Vehmanen, Takashi Iwai, Sasha Levin, alsa-devel
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
[ Upstream commit 46c3bbd9827952f92e250fa6ee30a797a4c4e17e ]
The check for infoframe transmit status in hdmi_infoframe_uptodate()
makes the assumption that packet buffer index is set to zero.
Align code with specification and explicitly set the index before
AC_VERB_GET_HDMI_DIP_XMIT. The packet index setting affects both
DIP-Data and DIP-XmitCtrl verbs.
There are no known cases where the old implementation has caused driver
to work incorrectly. This change is purely based on code review against
the specification (HDA spec rev1.0a).
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://lore.kernel.org/r/20201211131613.3271407-1-kai.vehmanen@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_hdmi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index df4771b9eff24..0faee80e28b66 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -645,11 +645,11 @@ static bool hdmi_infoframe_uptodate(struct hda_codec *codec, hda_nid_t pin_nid,
u8 val;
int i;
+ hdmi_set_dip_index(codec, pin_nid, 0x0, 0x0);
if (snd_hda_codec_read(codec, pin_nid, 0, AC_VERB_GET_HDMI_DIP_XMIT, 0)
!= AC_DIPXMIT_BEST)
return false;
- hdmi_set_dip_index(codec, pin_nid, 0x0, 0x0);
for (i = 0; i < size; i++) {
val = snd_hda_codec_read(codec, pin_nid, 0,
AC_VERB_GET_HDMI_DIP_DATA, 0);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 127/130] cpufreq: Fix cpufreq_online() return value on errors
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (124 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 126/130] ALSA: hda/hdmi: packet buffer index must be set before reading value Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 128/130] x86,swiotlb: Adjust SWIOTLB bounce buffer size for SEV guests Sasha Levin
` (2 subsequent siblings)
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Wang ShaoBo, Rafael J . Wysocki, Sasha Levin, linux-pm
From: Wang ShaoBo <bobo.shaobowang@huawei.com>
[ Upstream commit b96f038432362a20b96d4c52cefeb2936e2cfd2f ]
Make cpufreq_online() return negative error codes on all errors that
cause the policy to be destroyed, as appropriate.
Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/cpufreq.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 194a6587a1de1..1178ac323a9e0 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1384,8 +1384,10 @@ static int cpufreq_online(unsigned int cpu)
policy->min_freq_req = kzalloc(2 * sizeof(*policy->min_freq_req),
GFP_KERNEL);
- if (!policy->min_freq_req)
+ if (!policy->min_freq_req) {
+ ret = -ENOMEM;
goto out_destroy_policy;
+ }
ret = freq_qos_add_request(&policy->constraints,
policy->min_freq_req, FREQ_QOS_MIN,
@@ -1422,6 +1424,7 @@ static int cpufreq_online(unsigned int cpu)
if (cpufreq_driver->get && has_target()) {
policy->cur = cpufreq_driver->get(policy->cpu);
if (!policy->cur) {
+ ret = -EIO;
pr_err("%s: ->get() failed\n", __func__);
goto out_destroy_policy;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 128/130] x86,swiotlb: Adjust SWIOTLB bounce buffer size for SEV guests
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (125 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 127/130] cpufreq: Fix cpufreq_online() return value on errors Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 129/130] cdrom: Reset sector_size back it is not 2048 Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 130/130] PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller Sasha Levin
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ashish Kalra, kbuild test robot, Borislav Petkov,
Konrad Rzeszutek Wilk, Sasha Levin, iommu
From: Ashish Kalra <ashish.kalra@amd.com>
[ Upstream commit e998879d4fb7991856916972168cf27c0d86ed12 ]
For SEV, all DMA to and from guest has to use shared (un-encrypted) pages.
SEV uses SWIOTLB to make this happen without requiring changes to device
drivers. However, depending on the workload being run, the default 64MB
of it might not be enough and it may run out of buffers to use for DMA,
resulting in I/O errors and/or performance degradation for high
I/O workloads.
Adjust the default size of SWIOTLB for SEV guests using a
percentage of the total memory available to guest for the SWIOTLB buffers.
Adds a new sev_setup_arch() function which is invoked from setup_arch()
and it calls into a new swiotlb generic code function swiotlb_adjust_size()
to do the SWIOTLB buffer adjustment.
v5 fixed build errors and warnings as
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
Co-developed-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/mem_encrypt.h | 2 ++
arch/x86/kernel/setup.c | 6 ++++++
arch/x86/mm/mem_encrypt.c | 31 ++++++++++++++++++++++++++++++
include/linux/swiotlb.h | 8 ++++++++
kernel/dma/swiotlb.c | 20 +++++++++++++++++--
5 files changed, 65 insertions(+), 2 deletions(-)
diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h
index 848ce43b9040d..6c36956452ca6 100644
--- a/arch/x86/include/asm/mem_encrypt.h
+++ b/arch/x86/include/asm/mem_encrypt.h
@@ -36,6 +36,7 @@ void __init sme_map_bootdata(char *real_mode_data);
void __init sme_unmap_bootdata(char *real_mode_data);
void __init sme_early_init(void);
+void __init sev_setup_arch(void);
void __init sme_encrypt_kernel(struct boot_params *bp);
void __init sme_enable(struct boot_params *bp);
@@ -65,6 +66,7 @@ static inline void __init sme_map_bootdata(char *real_mode_data) { }
static inline void __init sme_unmap_bootdata(char *real_mode_data) { }
static inline void __init sme_early_init(void) { }
+static inline void __init sev_setup_arch(void) { }
static inline void __init sme_encrypt_kernel(struct boot_params *bp) { }
static inline void __init sme_enable(struct boot_params *bp) { }
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 77ea96b794bd1..9dc0c94e1544f 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1120,6 +1120,12 @@ void __init setup_arch(char **cmdline_p)
memblock_set_current_limit(ISA_END_ADDRESS);
e820__memblock_setup();
+ /*
+ * Needs to run after memblock setup because it needs the physical
+ * memory size.
+ */
+ sev_setup_arch();
+
reserve_bios_regions();
if (efi_enabled(EFI_MEMMAP)) {
diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
index 9268c12458c84..5911cfa31bc6d 100644
--- a/arch/x86/mm/mem_encrypt.c
+++ b/arch/x86/mm/mem_encrypt.c
@@ -196,6 +196,37 @@ void __init sme_early_init(void)
swiotlb_force = SWIOTLB_FORCE;
}
+void __init sev_setup_arch(void)
+{
+ phys_addr_t total_mem = memblock_phys_mem_size();
+ unsigned long size;
+
+ if (!sev_active())
+ return;
+
+ /*
+ * For SEV, all DMA has to occur via shared/unencrypted pages.
+ * SEV uses SWIOTLB to make this happen without changing device
+ * drivers. However, depending on the workload being run, the
+ * default 64MB of SWIOTLB may not be enough and SWIOTLB may
+ * run out of buffers for DMA, resulting in I/O errors and/or
+ * performance degradation especially with high I/O workloads.
+ *
+ * Adjust the default size of SWIOTLB for SEV guests using
+ * a percentage of guest memory for SWIOTLB buffers.
+ * Also, as the SWIOTLB bounce buffer memory is allocated
+ * from low memory, ensure that the adjusted size is within
+ * the limits of low available memory.
+ *
+ * The percentage of guest memory used here for SWIOTLB buffers
+ * is more of an approximation of the static adjustment which
+ * 64MB for <1G, and ~128M to 256M for 1G-to-4G, i.e., the 6%
+ */
+ size = total_mem * 6 / 100;
+ size = clamp_val(size, IO_TLB_DEFAULT_SIZE, SZ_1G);
+ swiotlb_adjust_size(size);
+}
+
static void __init __set_clr_pte_enc(pte_t *kpte, int level, bool enc)
{
pgprot_t old_prot, new_prot;
diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h
index 0a8fced6aaec4..522a0942114ad 100644
--- a/include/linux/swiotlb.h
+++ b/include/linux/swiotlb.h
@@ -30,6 +30,9 @@ enum swiotlb_force {
*/
#define IO_TLB_SHIFT 11
+/* default to 64MB */
+#define IO_TLB_DEFAULT_SIZE (64UL<<20)
+
extern void swiotlb_init(int verbose);
int swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose);
extern unsigned long swiotlb_nr_tbl(void);
@@ -80,6 +83,7 @@ void __init swiotlb_exit(void);
unsigned int swiotlb_max_segment(void);
size_t swiotlb_max_mapping_size(struct device *dev);
bool is_swiotlb_active(void);
+void __init swiotlb_adjust_size(unsigned long new_size);
#else
#define swiotlb_force SWIOTLB_NO_FORCE
static inline bool is_swiotlb_buffer(phys_addr_t paddr)
@@ -108,6 +112,10 @@ static inline bool is_swiotlb_active(void)
{
return false;
}
+
+static inline void swiotlb_adjust_size(unsigned long new_size)
+{
+}
#endif /* CONFIG_SWIOTLB */
extern void swiotlb_print_info(void);
diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index f99b79d7e1235..4c35ad1577e8d 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -151,8 +151,6 @@ void swiotlb_set_max_segment(unsigned int val)
max_segment = rounddown(val, PAGE_SIZE);
}
-/* default to 64MB */
-#define IO_TLB_DEFAULT_SIZE (64UL<<20)
unsigned long swiotlb_size_or_default(void)
{
unsigned long size;
@@ -162,6 +160,24 @@ unsigned long swiotlb_size_or_default(void)
return size ? size : (IO_TLB_DEFAULT_SIZE);
}
+void __init swiotlb_adjust_size(unsigned long new_size)
+{
+ unsigned long size;
+
+ /*
+ * If swiotlb parameter has not been specified, give a chance to
+ * architectures such as those supporting memory encryption to
+ * adjust/expand SWIOTLB size for their use.
+ */
+ if (!io_tlb_nslabs) {
+ size = ALIGN(new_size, 1 << IO_TLB_SHIFT);
+ io_tlb_nslabs = size >> IO_TLB_SHIFT;
+ io_tlb_nslabs = ALIGN(io_tlb_nslabs, IO_TLB_SEGSIZE);
+
+ pr_info("SWIOTLB bounce buffer size adjusted to %luMB", size >> 20);
+ }
+}
+
void swiotlb_print_info(void)
{
unsigned long bytes = io_tlb_nslabs << IO_TLB_SHIFT;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 129/130] cdrom: Reset sector_size back it is not 2048.
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (126 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 128/130] x86,swiotlb: Adjust SWIOTLB bounce buffer size for SEV guests Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 130/130] PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller Sasha Levin
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sebastian Andrzej Siewior, Jens Axboe, Sasha Levin
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit b5f32555567cfe0a5d5dbe7c1e85ebe37b3f545a ]
In v2.4.0-test2pre2 mmc_ioctl_cdrom_read_data() was extended by issuing
a MODE_SELECT opcode to change the sector size and READ_10 to perform
the actual read if the READ_CD opcode is not support.
The sector size is never changed back to the previous value of 2048
bytes which is however denoted by the comment for version 3.09 of the
cdrom.c file.
Use cdrom_switch_blocksize() to change the sector size only if the
requested size deviates from 2048. Change it back to 2048 after the read
operation if a change was mode.
Link: https://lkml.kernel.org/r/20201204164803.ovwurzs3257em2rp@linutronix.de
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cdrom/cdrom.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index eebdcbef0578f..f2e82390ef70c 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2996,13 +2996,15 @@ static noinline int mmc_ioctl_cdrom_read_data(struct cdrom_device_info *cdi,
* SCSI-II devices are not required to support
* READ_CD, so let's try switching block size
*/
- /* FIXME: switch back again... */
- ret = cdrom_switch_blocksize(cdi, blocksize);
- if (ret)
- goto out;
+ if (blocksize != CD_FRAMESIZE) {
+ ret = cdrom_switch_blocksize(cdi, blocksize);
+ if (ret)
+ goto out;
+ }
cgc->sshdr = NULL;
ret = cdrom_read_cd(cdi, cgc, lba, blocksize, 1);
- ret |= cdrom_switch_blocksize(cdi, blocksize);
+ if (blocksize != CD_FRAMESIZE)
+ ret |= cdrom_switch_blocksize(cdi, CD_FRAMESIZE);
}
if (!ret && copy_to_user(arg, cgc->buffer, blocksize))
ret = -EFAULT;
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread* [PATCH AUTOSEL 5.4 130/130] PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller
2020-12-23 2:16 [PATCH AUTOSEL 5.4 001/130] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
` (127 preceding siblings ...)
2020-12-23 2:18 ` [PATCH AUTOSEL 5.4 129/130] cdrom: Reset sector_size back it is not 2048 Sasha Levin
@ 2020-12-23 2:18 ` Sasha Levin
128 siblings, 0 replies; 139+ messages in thread
From: Sasha Levin @ 2020-12-23 2:18 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bjorn Helgaas, John Smith, Sasha Levin, linux-pci
From: Bjorn Helgaas <bhelgaas@google.com>
[ Upstream commit 059983790a4c963d92943e55a61fca55be427d55 ]
Add function 1 DMA alias quirk for Marvell 88SS9215 PCIe SSD Controller.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=42679#c135
Link: https://lore.kernel.org/r/20201110220516.697934-1-helgaas@kernel.org
Reported-by: John Smith <LK7S2ED64JHGLKj75shg9klejHWG49h5hk@protonmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index c98067579e9f3..53376bcda1f3f 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4055,6 +4055,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9183,
/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c46 */
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x91a0,
quirk_dma_func1_alias);
+/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c135 */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9215,
+ quirk_dma_func1_alias);
/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c127 */
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9220,
quirk_dma_func1_alias);
--
2.27.0
^ permalink raw reply related [flat|nested] 139+ messages in thread