April 2019 - Linux-stable-mirror

[4.20 PATCH] Revert "mwifiex: restructure rx_reorder_tbl_lock usage"

by Brian Norris

This reverts commit 5188d5453bc9380ccd4ae1086138dd485d13aef2, because it introduced lock recursion: BUG: spinlock recursion on CPU#2, kworker/u13:1/395 lock: 0xffffffc0e28a47f0, .magic: dead4ead, .owner: kworker/u13:1/395, .owner_cpu: 2 CPU: 2 PID: 395 Comm: kworker/u13:1 Not tainted 4.20.0-rc4+ #2 Hardware name: Google Kevin (DT) Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex] Call trace: dump_backtrace+0x0/0x140 show_stack+0x20/0x28 dump_stack+0x84/0xa4 spin_bug+0x98/0xa4 do_raw_spin_lock+0x5c/0xdc _raw_spin_lock_irqsave+0x38/0x48 mwifiex_flush_data+0x2c/0xa4 [mwifiex] call_timer_fn+0xcc/0x1c4 run_timer_softirq+0x264/0x4f0 __do_softirq+0x1a8/0x35c do_softirq+0x54/0x64 netif_rx_ni+0xe8/0x120 mwifiex_recv_packet+0xfc/0x10c [mwifiex] mwifiex_process_rx_packet+0x1d4/0x238 [mwifiex] mwifiex_11n_dispatch_pkt+0x190/0x1ac [mwifiex] mwifiex_11n_rx_reorder_pkt+0x28c/0x354 [mwifiex] mwifiex_process_sta_rx_packet+0x204/0x26c [mwifiex] mwifiex_handle_rx_packet+0x15c/0x16c [mwifiex] mwifiex_rx_work_queue+0x104/0x134 [mwifiex] worker_thread+0x4cc/0x72c kthread+0x134/0x13c ret_from_fork+0x10/0x18 This was clearly not tested well at all. I simply performed 'wget' in a loop and it fell over within a few seconds. Fixes: 5188d5453bc9 ("mwifiex: restructure rx_reorder_tbl_lock usage") Cc: <stable(a)vger.kernel.org> Cc: Ganapathi Bhat <gbhat(a)marvell.com> Signed-off-by: Brian Norris <briannorris(a)chromium.org> --- This is a 4.19 regression, but IMO the revert should be merged ASAP. drivers/net/wireless/marvell/mwifiex/11n.c | 5 +- .../wireless/marvell/mwifiex/11n_rxreorder.c | 96 ++++++++++--------- .../net/wireless/marvell/mwifiex/uap_txrx.c | 3 - 3 files changed, 51 insertions(+), 53 deletions(-) diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c index e2addd8b878b..5d75c971004b 100644 --- a/drivers/net/wireless/marvell/mwifiex/11n.c +++ b/drivers/net/wireless/marvell/mwifiex/11n.c @@ -696,11 +696,10 @@ void mwifiex_11n_delba(struct mwifiex_private *priv, int tid) "Send delba to tid=%d, %pM\n", tid, rx_reor_tbl_ptr->ta); mwifiex_send_delba(priv, tid, rx_reor_tbl_ptr->ta, 0); - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, - flags); - return; + goto exit; } } +exit: spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); } diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c index 8e63d14c1e1c..5380fba652cc 100644 --- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c +++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c @@ -103,8 +103,6 @@ static int mwifiex_11n_dispatch_pkt(struct mwifiex_private *priv, void *payload) * There could be holes in the buffer, which are skipped by the function. * Since the buffer is linear, the function uses rotation to simulate * circular buffer. - * - * The caller must hold rx_reorder_tbl_lock spinlock. */ static void mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv, @@ -113,21 +111,25 @@ mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv, { int pkt_to_send, i; void *rx_tmp_ptr; + unsigned long flags; pkt_to_send = (start_win > tbl->start_win) ? min((start_win - tbl->start_win), tbl->win_size) : tbl->win_size; for (i = 0; i < pkt_to_send; ++i) { + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); rx_tmp_ptr = NULL; if (tbl->rx_reorder_ptr[i]) { rx_tmp_ptr = tbl->rx_reorder_ptr[i]; tbl->rx_reorder_ptr[i] = NULL; } + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); if (rx_tmp_ptr) mwifiex_11n_dispatch_pkt(priv, rx_tmp_ptr); } + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); /* * We don't have a circular buffer, hence use rotation to simulate * circular buffer @@ -138,6 +140,7 @@ mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv, } tbl->start_win = start_win; + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); } /* @@ -147,8 +150,6 @@ mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv, * The start window is adjusted automatically when a hole is located. * Since the buffer is linear, the function uses rotation to simulate * circular buffer. - * - * The caller must hold rx_reorder_tbl_lock spinlock. */ static void mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv, @@ -156,15 +157,22 @@ mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv, { int i, j, xchg; void *rx_tmp_ptr; + unsigned long flags; for (i = 0; i < tbl->win_size; ++i) { - if (!tbl->rx_reorder_ptr[i]) + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); + if (!tbl->rx_reorder_ptr[i]) { + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, + flags); break; + } rx_tmp_ptr = tbl->rx_reorder_ptr[i]; tbl->rx_reorder_ptr[i] = NULL; + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); mwifiex_11n_dispatch_pkt(priv, rx_tmp_ptr); } + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); /* * We don't have a circular buffer, hence use rotation to simulate * circular buffer @@ -177,6 +185,7 @@ mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv, } } tbl->start_win = (tbl->start_win + i) & (MAX_TID_VALUE - 1); + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); } /* @@ -184,8 +193,6 @@ mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv, * * The function stops the associated timer and dispatches all the * pending packets in the Rx reorder table before deletion. - * - * The caller must hold rx_reorder_tbl_lock spinlock. */ static void mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv, @@ -211,7 +218,11 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv, del_timer_sync(&tbl->timer_context.timer); tbl->timer_context.timer_is_set = false; + + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); list_del(&tbl->list); + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); + kfree(tbl->rx_reorder_ptr); kfree(tbl); @@ -224,17 +235,22 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv, /* * This function returns the pointer to an entry in Rx reordering * table which matches the given TA/TID pair. - * - * The caller must hold rx_reorder_tbl_lock spinlock. */ struct mwifiex_rx_reorder_tbl * mwifiex_11n_get_rx_reorder_tbl(struct mwifiex_private *priv, int tid, u8 *ta) { struct mwifiex_rx_reorder_tbl *tbl; + unsigned long flags; - list_for_each_entry(tbl, &priv->rx_reorder_tbl_ptr, list) - if (!memcmp(tbl->ta, ta, ETH_ALEN) && tbl->tid == tid) + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); + list_for_each_entry(tbl, &priv->rx_reorder_tbl_ptr, list) { + if (!memcmp(tbl->ta, ta, ETH_ALEN) && tbl->tid == tid) { + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, + flags); return tbl; + } + } + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); return NULL; } @@ -251,9 +267,14 @@ void mwifiex_11n_del_rx_reorder_tbl_by_ta(struct mwifiex_private *priv, u8 *ta) return; spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); - list_for_each_entry_safe(tbl, tmp, &priv->rx_reorder_tbl_ptr, list) - if (!memcmp(tbl->ta, ta, ETH_ALEN)) + list_for_each_entry_safe(tbl, tmp, &priv->rx_reorder_tbl_ptr, list) { + if (!memcmp(tbl->ta, ta, ETH_ALEN)) { + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, + flags); mwifiex_del_rx_reorder_entry(priv, tbl); + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); + } + } spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); return; @@ -262,18 +283,24 @@ void mwifiex_11n_del_rx_reorder_tbl_by_ta(struct mwifiex_private *priv, u8 *ta) /* * This function finds the last sequence number used in the packets * buffered in Rx reordering table. - * - * The caller must hold rx_reorder_tbl_lock spinlock. */ static int mwifiex_11n_find_last_seq_num(struct reorder_tmr_cnxt *ctx) { struct mwifiex_rx_reorder_tbl *rx_reorder_tbl_ptr = ctx->ptr; + struct mwifiex_private *priv = ctx->priv; + unsigned long flags; int i; - for (i = rx_reorder_tbl_ptr->win_size - 1; i >= 0; --i) - if (rx_reorder_tbl_ptr->rx_reorder_ptr[i]) + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); + for (i = rx_reorder_tbl_ptr->win_size - 1; i >= 0; --i) { + if (rx_reorder_tbl_ptr->rx_reorder_ptr[i]) { + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, + flags); return i; + } + } + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); return -1; } @@ -291,22 +318,17 @@ mwifiex_flush_data(struct timer_list *t) struct reorder_tmr_cnxt *ctx = from_timer(ctx, t, timer); int start_win, seq_num; - unsigned long flags; ctx->timer_is_set = false; - spin_lock_irqsave(&ctx->priv->rx_reorder_tbl_lock, flags); seq_num = mwifiex_11n_find_last_seq_num(ctx); - if (seq_num < 0) { - spin_unlock_irqrestore(&ctx->priv->rx_reorder_tbl_lock, flags); + if (seq_num < 0) return; - } mwifiex_dbg(ctx->priv->adapter, INFO, "info: flush data %d\n", seq_num); start_win = (ctx->ptr->start_win + seq_num + 1) & (MAX_TID_VALUE - 1); mwifiex_11n_dispatch_pkt_until_start_win(ctx->priv, ctx->ptr, start_win); - spin_unlock_irqrestore(&ctx->priv->rx_reorder_tbl_lock, flags); } /* @@ -333,14 +355,11 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta, * If we get a TID, ta pair which is already present dispatch all the * the packets and move the window size until the ssn */ - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta); if (tbl) { mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, seq_num); - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); return; } - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); /* if !tbl then create one */ new_node = kzalloc(sizeof(struct mwifiex_rx_reorder_tbl), GFP_KERNEL); if (!new_node) @@ -551,20 +570,16 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv, int prev_start_win, start_win, end_win, win_size; u16 pkt_index; bool init_window_shift = false; - unsigned long flags; int ret = 0; - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta); if (!tbl) { - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); if (pkt_type != PKT_TYPE_BAR) mwifiex_11n_dispatch_pkt(priv, payload); return ret; } if ((pkt_type == PKT_TYPE_AMSDU) && !tbl->amsdu) { - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); mwifiex_11n_dispatch_pkt(priv, payload); return ret; } @@ -651,8 +666,6 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv, if (!tbl->timer_context.timer_is_set || prev_start_win != tbl->start_win) mwifiex_11n_rxreorder_timer_restart(tbl); - - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); return ret; } @@ -681,18 +694,14 @@ mwifiex_del_ba_tbl(struct mwifiex_private *priv, int tid, u8 *peer_mac, peer_mac, tid, initiator); if (cleanup_rx_reorder_tbl) { - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, peer_mac); if (!tbl) { - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, - flags); mwifiex_dbg(priv->adapter, EVENT, "event: TID, TA not found in table\n"); return; } mwifiex_del_rx_reorder_entry(priv, tbl); - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); } else { ptx_tbl = mwifiex_get_ba_tbl(priv, tid, peer_mac); if (!ptx_tbl) { @@ -726,7 +735,6 @@ int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv, int tid, win_size; struct mwifiex_rx_reorder_tbl *tbl; uint16_t block_ack_param_set; - unsigned long flags; block_ack_param_set = le16_to_cpu(add_ba_rsp->block_ack_param_set); @@ -740,20 +748,17 @@ int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv, mwifiex_dbg(priv->adapter, ERROR, "ADDBA RSP: failed %pM tid=%d)\n", add_ba_rsp->peer_mac_addr, tid); - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, add_ba_rsp->peer_mac_addr); if (tbl) mwifiex_del_rx_reorder_entry(priv, tbl); - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); return 0; } win_size = (block_ack_param_set & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> BLOCKACKPARAM_WINSIZE_POS; - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, add_ba_rsp->peer_mac_addr); if (tbl) { @@ -764,7 +769,6 @@ int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv, else tbl->amsdu = false; } - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); mwifiex_dbg(priv->adapter, CMD, "cmd: ADDBA RSP: %pM tid=%d ssn=%d win_size=%d\n", @@ -804,8 +808,11 @@ void mwifiex_11n_cleanup_reorder_tbl(struct mwifiex_private *priv) spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); list_for_each_entry_safe(del_tbl_ptr, tmp_node, - &priv->rx_reorder_tbl_ptr, list) + &priv->rx_reorder_tbl_ptr, list) { + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); mwifiex_del_rx_reorder_entry(priv, del_tbl_ptr); + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); + } INIT_LIST_HEAD(&priv->rx_reorder_tbl_ptr); spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); @@ -929,7 +936,6 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv, int tlv_buf_left = len; int ret; u8 *tmp; - unsigned long flags; mwifiex_dbg_dump(priv->adapter, EVT_D, "RXBA_SYNC event:", event_buf, len); @@ -949,18 +955,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv, tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num, tlv_bitmap_len); - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); rx_reor_tbl_ptr = mwifiex_11n_get_rx_reorder_tbl(priv, tlv_rxba->tid, tlv_rxba->mac); if (!rx_reor_tbl_ptr) { - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, - flags); mwifiex_dbg(priv->adapter, ERROR, "Can not find rx_reorder_tbl!"); return; } - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); for (i = 0; i < tlv_bitmap_len; i++) { for (j = 0 ; j < 8; j++) { diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c index a83c5afc256a..5ce85d5727e4 100644 --- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c @@ -421,15 +421,12 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv, spin_unlock_irqrestore(&priv->sta_list_spinlock, flags); } - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); if (!priv->ap_11n_enabled || (!mwifiex_11n_get_rx_reorder_tbl(priv, uap_rx_pd->priority, ta) && (le16_to_cpu(uap_rx_pd->rx_pkt_type) != PKT_TYPE_AMSDU))) { ret = mwifiex_handle_uap_rx_forward(priv, skb); - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); return ret; } - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); /* Reorder and send to kernel */ pkt_type = (u8)le16_to_cpu(uap_rx_pd->rx_pkt_type); -- 2.20.0.rc1.387.gf8505762e3-goog

4 years, 10 months

3
7
0 0

[PATCH v2] mmc: dw_mmc: Disable SDIO interrupts while suspended to fix suspend/resume

by Douglas Anderson

Processing SDIO interrupts while dw_mmc is suspended (or partly suspended) seems like a bad idea. We really don't want to be processing them until we've gotten ourselves fully powered up. You might be wondering how it's even possible to become suspended when an SDIO interrupt is active. As can be seen in dw_mci_enable_sdio_irq(), we explicitly keep dw_mmc out of runtime suspend when the SDIO interrupt is enabled. ...but even though we stop normal runtime suspend transitions when SDIO interrupts are enabled, the dw_mci_runtime_suspend() can still get called for a full system suspend. Let's handle all this by explicitly masking SDIO interrupts in the suspend call and unmasking them later in the resume call. To do this cleanly I'll keep track of whether the client requested that SDIO interrupts be enabled so that we can reliably restore them regardless of whether we're masking them for one reason or another. It should be noted that if dw_mci_enable_sdio_irq() is never called (for instance, if we don't have an SDIO card plugged in) that "client_sdio_enb" will always be false. In those cases this patch adds a tiny bit of overhead to suspend/resume (a spinlock and a read/write of INTMASK) but other than that is a no-op. The SDMMC_INT_SDIO bit should always be clear and clearing it again won't hurt. Without this fix it can be seen that rk3288-veyron Chromebooks with Marvell WiFi would sometimes fail to resume WiFi even after picking my recent mwifiex patch [1]. Specifically you'd see messages like this: mwifiex_sdio mmc1:0001:1: Firmware wakeup failed mwifiex_sdio mmc1:0001:1: PREP_CMD: FW in reset state ...and tracing through the resume code in the failing cases showed that we were processing a SDIO interrupt really early in the resume call. NOTE: downstream in Chrome OS 3.14 and 3.18 kernels (both of which support the Marvell SDIO WiFi card) we had a patch ("CHROMIUM: sdio: Defer SDIO interrupt handling until after resume") [2]. Presumably this is the same problem that was solved by that patch. [1] https://lkml.kernel.org/r/20190404040106.40519-1-dianders@chromium.org [2] https://crrev.com/c/230765 Cc: <stable(a)vger.kernel.org> # 4.14.x Signed-off-by: Douglas Anderson <dianders(a)chromium.org> --- I didn't put any "Fixes" tag here, but presumably this could be backported to whichever kernels folks found it useful for. I have at least confirmed that kernels v4.14 and v4.19 (as well as v5.1-rc2) show the problem. It is very easy to pick this to v4.19 and it definitely fixes the problem there. I haven't spent the time to pick this to 4.14 myself, but presumably it wouldn't be too hard to backport this as far as v4.13 since that contains commit 32dba73772f8 ("mmc: dw_mmc: Convert to use MMC_CAP2_SDIO_IRQ_NOTHREAD for SDIO IRQs"). Prior to that it might make sense for anyone experiencing this problem to just pick the old CHROMIUM patch to fix them. Changes in v2: - Suggested 4.14+ in the stable tag (Sasha-bot) - Extra note that this is a noop on non-SDIO (Shawn / Emil) - Make boolean logic cleaner as per https://crrev.com/c/1586207/1 - Hopefully clear comments as per https://crrev.com/c/1586207/1 drivers/mmc/host/dw_mmc.c | 27 +++++++++++++++++++++++---- drivers/mmc/host/dw_mmc.h | 3 +++ 2 files changed, 26 insertions(+), 4 deletions(-) diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c index 80dc2fd6576c..480067b87a94 100644 --- a/drivers/mmc/host/dw_mmc.c +++ b/drivers/mmc/host/dw_mmc.c @@ -1664,7 +1664,8 @@ static void dw_mci_init_card(struct mmc_host *mmc, struct mmc_card *card) } } -static void __dw_mci_enable_sdio_irq(struct dw_mci_slot *slot, int enb) +static void __dw_mci_enable_sdio_irq(struct dw_mci_slot *slot, bool enb, + bool client_requested) { struct dw_mci *host = slot->host; unsigned long irqflags; @@ -1672,6 +1673,20 @@ static void __dw_mci_enable_sdio_irq(struct dw_mci_slot *slot, int enb) spin_lock_irqsave(&host->irq_lock, irqflags); + /* + * If we're being called directly from dw_mci_enable_sdio_irq() + * (which means that the client driver actually wants to enable or + * disable interrupts) then save the request. Otherwise this + * wasn't directly requested by the client and we should logically + * AND it with the client request since we want to disable if + * _either_ the client disabled OR we have some other reason to + * disable temporarily. + */ + if (client_requested) + host->client_sdio_enb = enb; + else + enb &= host->client_sdio_enb; + /* Enable/disable Slot Specific SDIO interrupt */ int_mask = mci_readl(host, INTMASK); if (enb) @@ -1688,7 +1703,7 @@ static void dw_mci_enable_sdio_irq(struct mmc_host *mmc, int enb) struct dw_mci_slot *slot = mmc_priv(mmc); struct dw_mci *host = slot->host; - __dw_mci_enable_sdio_irq(slot, enb); + __dw_mci_enable_sdio_irq(slot, enb, true); /* Avoid runtime suspending the device when SDIO IRQ is enabled */ if (enb) @@ -1701,7 +1716,7 @@ static void dw_mci_ack_sdio_irq(struct mmc_host *mmc) { struct dw_mci_slot *slot = mmc_priv(mmc); - __dw_mci_enable_sdio_irq(slot, 1); + __dw_mci_enable_sdio_irq(slot, true, false); } static int dw_mci_execute_tuning(struct mmc_host *mmc, u32 opcode) @@ -2734,7 +2749,7 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id) if (pending & SDMMC_INT_SDIO(slot->sdio_id)) { mci_writel(host, RINTSTS, SDMMC_INT_SDIO(slot->sdio_id)); - __dw_mci_enable_sdio_irq(slot, 0); + __dw_mci_enable_sdio_irq(slot, false, false); sdio_signal_irq(slot->mmc); } @@ -3424,6 +3439,8 @@ int dw_mci_runtime_suspend(struct device *dev) { struct dw_mci *host = dev_get_drvdata(dev); + __dw_mci_enable_sdio_irq(host->slot, false, false); + if (host->use_dma && host->dma_ops->exit) host->dma_ops->exit(host); @@ -3490,6 +3507,8 @@ int dw_mci_runtime_resume(struct device *dev) /* Now that slots are all setup, we can enable card detect */ dw_mci_enable_cd(host); + __dw_mci_enable_sdio_irq(host->slot, true, false); + return 0; err: diff --git a/drivers/mmc/host/dw_mmc.h b/drivers/mmc/host/dw_mmc.h index 46e9f8ec5398..dfbace0f5043 100644 --- a/drivers/mmc/host/dw_mmc.h +++ b/drivers/mmc/host/dw_mmc.h @@ -127,6 +127,7 @@ struct dw_mci_dma_slave { * @cmd11_timer: Timer for SD3.0 voltage switch over scheme. * @cto_timer: Timer for broken command transfer over scheme. * @dto_timer: Timer for broken data transfer over scheme. + * @client_sdio_enb: The value last passed to enable_sdio_irq. * * Locking * ======= @@ -234,6 +235,8 @@ struct dw_mci { struct timer_list cmd11_timer; struct timer_list cto_timer; struct timer_list dto_timer; + + bool client_sdio_enb; }; /* DMA ops for Internal/External DMAC interface */ -- 2.21.0.593.g511ec345e18-goog

4 years, 10 months

5
9
0 0

[PATCH v3 5/5] drm: don't block fb changes for async plane updates

by Helen Koike

In the case of a normal sync update, the preparation of framebuffers (be it calling drm_atomic_helper_prepare_planes() or doing setups with drm_framebuffer_get()) are performed in the new_state and the respective cleanups are performed in the old_state. In the case of async updates, the preparation is also done in the new_state but the cleanups are done in the new_state (because updates are performed in place, i.e. in the current state). The current code blocks async udpates when the fb is changed, turning async updates into sync updates, slowing down cursor updates and introducing regressions in igt tests with errors of type: "CRITICAL: completed 97 cursor updated in a period of 30 flips, we expect to complete approximately 15360 updates, with the threshold set at 7680" Fb changes in async updates were prevented to avoid the following scenario: - Async update, oldfb = NULL, newfb = fb1, prepare fb1, cleanup fb1 - Async update, oldfb = fb1, newfb = fb2, prepare fb2, cleanup fb2 - Non-async commit, oldfb = fb2, newfb = fb1, prepare fb1, cleanup fb2 (wrong) Where we have a single call to prepare fb2 but double cleanup call to fb2. To solve the above problems, instead of blocking async fb changes, we place the old framebuffer in the new_state object, so when the code performs cleanups in the new_state it will cleanup the old_fb and we will have the following scenario instead: - Async update, oldfb = NULL, newfb = fb1, prepare fb1, no cleanup - Async update, oldfb = fb1, newfb = fb2, prepare fb2, cleanup fb1 - Non-async commit, oldfb = fb2, newfb = fb1, prepare fb1, cleanup fb2 Where calls to prepare/cleanup are balanced. Cc: <stable(a)vger.kernel.org> # v4.14+ Fixes: 25dc194b34dd ("drm: Block fb changes for async plane updates") Suggested-by: Boris Brezillon <boris.brezillon(a)collabora.com> Signed-off-by: Helen Koike <helen.koike(a)collabora.com> Reviewed-by: Boris Brezillon <boris.brezillon(a)collabora.com> Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> --- Hello, I added a TODO in drm_atomic_helper_async_commit() regarding doing a full state swap(), Boris and Nicholas, let me know if this is ok and if I can keep your Reviewed-by tags) As mentioned in the cover letter, I tested in almost all platforms with igt plane_cursor_legacy and kms_cursor_legacy and I didn't see any regressions. But I couldn't test on MSM and AMD because I don't have the hardware I would appreciate if anyone could help me testing those. Thanks! Helen Changes in v3: - Add Reviewed-by tags - Add TODO in drm_atomic_helper_async_commit() Changes in v2: - Change the order of the patch in the series, add this as the last one. - Add documentation - s/ballanced/balanced drivers/gpu/drm/drm_atomic_helper.c | 22 ++++++++++++---------- include/drm/drm_modeset_helper_vtables.h | 5 +++++ 2 files changed, 17 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 2453678d1186..de5812c362b5 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1608,15 +1608,6 @@ int drm_atomic_helper_async_check(struct drm_device *dev, old_plane_state->crtc != new_plane_state->crtc) return -EINVAL; - /* - * FIXME: Since prepare_fb and cleanup_fb are always called on - * the new_plane_state for async updates we need to block framebuffer - * changes. This prevents use of a fb that's been cleaned up and - * double cleanups from occuring. - */ - if (old_plane_state->fb != new_plane_state->fb) - return -EINVAL; - funcs = plane->helper_private; if (!funcs->atomic_async_update) return -EINVAL; @@ -1647,6 +1638,8 @@ EXPORT_SYMBOL(drm_atomic_helper_async_check); * drm_atomic_async_check() succeeds. Async commits are not supposed to swap * the states like normal sync commits, but just do in-place changes on the * current state. + * + * TODO: Implement full swap instead of doing in-place changes. */ void drm_atomic_helper_async_commit(struct drm_device *dev, struct drm_atomic_state *state) @@ -1657,6 +1650,9 @@ void drm_atomic_helper_async_commit(struct drm_device *dev, int i; for_each_new_plane_in_state(state, plane, plane_state, i) { + struct drm_framebuffer *new_fb = plane_state->fb; + struct drm_framebuffer *old_fb = plane->state->fb; + funcs = plane->helper_private; funcs->atomic_async_update(plane, plane_state); @@ -1665,11 +1661,17 @@ void drm_atomic_helper_async_commit(struct drm_device *dev, * plane->state in-place, make sure at least common * properties have been properly updated. */ - WARN_ON_ONCE(plane->state->fb != plane_state->fb); + WARN_ON_ONCE(plane->state->fb != new_fb); WARN_ON_ONCE(plane->state->crtc_x != plane_state->crtc_x); WARN_ON_ONCE(plane->state->crtc_y != plane_state->crtc_y); WARN_ON_ONCE(plane->state->src_x != plane_state->src_x); WARN_ON_ONCE(plane->state->src_y != plane_state->src_y); + + /* + * Make sure the FBs have been swapped so that cleanups in the + * new_state performs a cleanup in the old FB. + */ + WARN_ON_ONCE(plane_state->fb != old_fb); } } EXPORT_SYMBOL(drm_atomic_helper_async_commit); diff --git a/include/drm/drm_modeset_helper_vtables.h b/include/drm/drm_modeset_helper_vtables.h index cfb7be40bed7..ce582e8e8f2f 100644 --- a/include/drm/drm_modeset_helper_vtables.h +++ b/include/drm/drm_modeset_helper_vtables.h @@ -1174,6 +1174,11 @@ struct drm_plane_helper_funcs { * current one with the new plane configurations in the new * plane_state. * + * Drivers should also swap the framebuffers between plane state + * and new_state. This is required because prepare and cleanup calls + * are performed on the new_state object, then to cleanup the old + * framebuffer, it needs to be placed inside the new_state object. + * * FIXME: * - It only works for single plane updates * - Async Pageflips are not supported yet -- 2.20.1

4 years, 10 months

2
2
0 0

[PATCH v3 3/5] drm/msm: fix fb references in async update

by Helen Koike

Async update callbacks are expected to set the old_fb in the new_state so prepare/cleanup framebuffers are balanced. Cc: <stable(a)vger.kernel.org> # v4.14+ Fixes: 224a4c970987 ("drm/msm: update cursors asynchronously through atomic") Suggested-by: Boris Brezillon <boris.brezillon(a)collabora.com> Signed-off-by: Helen Koike <helen.koike(a)collabora.com> --- Hello, As mentioned in the cover letter, But I couldn't test on MSM because I don't have the hardware and I would appreciate if anyone could test it. In other platforms (VC4, AMD, Rockchip), there is a hidden drm_framebuffer_get(new_fb)/drm_framebuffer_put(old_fb) in async_update that is wrong, but I couldn't identify those here, not sure if it is hidden somewhere else, but if tests fail this is probably the cause. Thanks! Helen Changes in v3: None Changes in v2: - update CC stable and Fixes tag drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c index be13140967b4..b854f471e9e5 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c @@ -502,6 +502,8 @@ static int mdp5_plane_atomic_async_check(struct drm_plane *plane, static void mdp5_plane_atomic_async_update(struct drm_plane *plane, struct drm_plane_state *new_state) { + struct drm_framebuffer *old_fb = plane->state->fb; + plane->state->src_x = new_state->src_x; plane->state->src_y = new_state->src_y; plane->state->crtc_x = new_state->crtc_x; @@ -524,6 +526,8 @@ static void mdp5_plane_atomic_async_update(struct drm_plane *plane, *to_mdp5_plane_state(plane->state) = *to_mdp5_plane_state(new_state); + + new_state->fb = old_fb; } static const struct drm_plane_helper_funcs mdp5_plane_helper_funcs = { -- 2.20.1

4 years, 10 months

3
4
0 0

[PATCH 4.19 000/187] 4.19.34-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.34 release. There are 187 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Apr 6 08:44:30 UTC 2019. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.34-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.34-rc1 Andrea Righi <righi.andrea(a)gmail.com> kprobes/x86: Blacklist non-attachable interrupt functions Coly Li <colyli(a)suse.de> bcache: fix potential div-zero error of writeback_rate_p_term_inverse Hans de Goede <hdegoede(a)redhat.com> ACPI / video: Extend chassis-type detection with a "Lunch Box" check Nathan Chancellor <natechancellor(a)gmail.com> net: stmmac: Avoid one more sometimes uninitialized Clang warning Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers Hans de Goede <hdegoede(a)redhat.com> Input: soc_button_array - fix mapping of the 5th GPIO in a PNP0C40 device Ben Dooks <ben.dooks(a)codethink.co.uk> dmaengine: tegra: avoid overflow of byte tracking Katsuhiro Suzuki <katsuhiro(a)katsuster.net> clk: rockchip: fix frac settings of GPLL clock for rk3328 Jerome Brunet <jbrunet(a)baylibre.com> clk: meson: clean-up clock registration Peter Wu <peter(a)lekensteyn.nl> drm/fb-helper: fix leaks in error path of drm_fb_helper_fbdev_setup Rafael Ávila de Espíndola <rafael(a)espindo.la> x86/build: Mark per-CPU symbols as absolute explicitly for LLD Zumeng Chen <zumeng.chen(a)gmail.com> wlcore: Fix memory leak in case wl12xx_fetch_firmware failure Hans de Goede <hdegoede(a)redhat.com> brcmfmac: Use firmware_request_nowarn for the clm_blob Ondrej Mosnacek <omosnace(a)redhat.com> selinux: do not override context on context mounts George Rimar <grimar(a)accesssoftek.com> x86/build: Specify elf_i386 linker emulation explicitly for i386 objects Daniel Vetter <daniel.vetter(a)ffwll.ch> drm/nouveau: Stop using drm_crtc_force_disable Paul Kocialkowski <paul.kocialkowski(a)bootlin.com> drm: Auto-set allow_fb_modifiers when given modifiers at plane init Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> pinctrl: meson: meson8b: add the eth_rxd2 and eth_rxd3 pins Axel Lin <axel.lin(a)ingics.com> regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting Pawe? Chmiel <pawel.mikolaj.chmiel(a)gmail.com> media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration Steve Longerbeam <slongerbeam(a)gmail.com> media: rcar-vin: Allow independent VIN link enablement Florian Westphal <fw(a)strlen.de> netfilter: physdev: relax br_netfilter dependency Shunyong Yang <shunyong.yang(a)hxt-semitech.com> dmaengine: qcom_hidma: initialize tx flags in hidma_prep_dma_* Shunyong Yang <shunyong.yang(a)hxt-semitech.com> dmaengine: qcom_hidma: assign channel cookie correctly Anders Roxell <anders.roxell(a)linaro.org> dmaengine: imx-dma: fix warning comparison of distinct pointer types Valentin Schneider <valentin.schneider(a)arm.com> cpu/hotplug: Mute hotplug lockdep during init Buland Singh <bsingh(a)redhat.com> hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable Sheng Yong <shengyong1(a)huawei.com> f2fs: UBSAN: set boolean value iostat_enable correctly Song Hongyan <hongyan.song(a)intel.com> HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR busy_clear bit Timo Alho <talho(a)nvidia.com> soc/tegra: fuse: Fix illegal free of IO base address David Tolnay <dtolnay(a)gmail.com> hwrng: virtio - Avoid repeated init of completion Akinobu Mita <akinobu.mita(a)gmail.com> media: mt9m111: set initial frame size other than 0x0 Tony Jones <tonyj(a)suse.de> perf script python: Add trace_context extension module to sys.modules Tony Jones <tonyj(a)suse.de> perf script python: Use PyBytes for attr in trace-event-python Jérôme de Bretagne <jerome.debretagne(a)gmail.com> platform/x86: intel-hid: Missing power button release on some Dell models Roger Quadros <rogerq(a)ti.com> usb: dwc3: gadget: Fix OTG events when gadget driver isn't loaded Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: dice: add support for Solid State Logic Duende Classic/Mini Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Enable vblank interrupt during CRC capture Nathan Fontenot <nfont(a)linux.vnet.ibm.com> powerpc/pseries: Perform full re-add of CPU for topology update post-migration Manfred Schlaegl <manfred.schlaegl(a)ginzinger.com> tty: increase the default flip buffer limit to 2*640K Chen-Yu Tsai <wens(a)csie.org> backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial state Oleg Nesterov <oleg(a)redhat.com> cgroup/pids: turn cgroup_subsys->free() into cgroup_subsys->release() to fix the accounting Nicolai Stange <nstange(a)suse.de> powerpc/64s: Clear on-stack exception marker upon exception return Stanislav Fomichev <sdf(a)google.com> selftests/bpf: skip verifier tests for unsupported program types Valdis Kletnieks <valdis.kletnieks(a)vt.edu> bpf: fix missing prototype warnings Paolo Valente <paolo.valente(a)linaro.org> block, bfq: fix in-service-queue check for queue merging Russell King <rmk+kernel(a)armlinux.org.uk> ARM: avoid Cortex-A9 livelock on tight dmb loops Vladimir Murzin <vladimir.murzin(a)arm.com> ARM: 8830/1: NOMMU: Toggle only bits in EXC_RETURN we are really care of Stanislaw Gruszka <sgruszka(a)redhat.com> mt7601u: bump supported EEPROM version Alexey Khoroshilov <khoroshilov(a)ispras.ru> soc: qcom: gsbi: Fix error handling in gsbi_probe() Ard Biesheuvel <ard.biesheuvel(a)linaro.org> efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted Mathieu Malaterre <malat(a)debian.org> ARM: dts: lpc32xx: Remove leading 0x and 0s from bindings notation Shayenne Moura <shayenneluzmoura(a)gmail.com> drm/vkms: Bugfix extra vblank frame Andrea Parri <andrea.parri(a)amarulasolutions.com> sched/core: Use READ_ONCE()/WRITE_ONCE() in move_queued_task()/task_rq_lock() Ard Biesheuvel <ard.biesheuvel(a)linaro.org> efi/memattr: Don't bail on zero VA if it equals the region's PA Hidetoshi Seto <seto.hidetoshi(a)jp.fujitsu.com> sched/debug: Initialize sd_sysctl_cpus if !CONFIG_CPUMASK_OFFSTACK wen yang <yellowriver2010(a)hotmail.com> ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe Johannes Berg <johannes.berg(a)intel.com> iwlwifi: mvm: fix RFH config command with >=10 CPUs Stefan Roese <sr(a)denx.de> staging: spi: mt7621: Add return code check on device_reset() Thierry Reding <treding(a)nvidia.com> i2c: of: Try to find an I2C adapter matching the parent Rajneesh Bhardwaj <rajneesh.bhardwaj(a)linux.intel.com> platform/x86: intel_pmc_core: Fix PCH IP sts reading Kai-Heng Feng <kai.heng.feng(a)canonical.com> e1000e: Exclude device from suspend direct complete optimization Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru> e1000e: fix cyclic resets at link up with active tx Mathieu Poirier <mathieu.poirier(a)linaro.org> perf/aux: Make perf_event accessible to setup_aux() Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Disconnect mpcc when changing tg Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Don't re-program planes for DPMS changes Julia Lawall <julia.lawall(a)lip6.fr> drm: rcar-du: add missing of_node_put Guenter Roeck <linux(a)roeck-us.net> cdrom: Fix race condition in cdrom_sysctl_register Manfred Schlaegl <manfred.schlaegl(a)ginzinger.com> fbdev: fbmem: fix memory access if logo is bigger than the screen Heiner Kallweit <hkallweit1(a)gmail.com> net: phy: consider latched link-down status in polling mode Raju Rangoju <rajur(a)chelsio.com> iw_cxgb4: fix srqidx leak during connection abort Russell King <rmk+kernel(a)armlinux.org.uk> net: marvell: mvpp2: fix stuck in-band SGMII negotiation Thomas Gleixner <tglx(a)linutronix.de> genirq: Avoid summation loops for /proc/stat Coly Li <colyli(a)suse.de> bcache: improve sysfs_strtoul_clamp() Coly Li <colyli(a)suse.de> bcache: fix potential div-zero error of writeback_rate_i_term_inverse Coly Li <colyli(a)suse.de> bcache: fix input overflow to sequential_cutoff Coly Li <colyli(a)suse.de> bcache: fix input overflow to cache set sysfs file io_error_halflife Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com> sched/topology: Fix percpu data types in struct sd_data & struct s_data John Stultz <john.stultz(a)linaro.org> usb: f_fs: Avoid crash due to out-of-scope stack ptr access Rakesh Pillai <pillair(a)codeaurora.org> ath10k: fix shadow register implementation for WCN3990 Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> ALSA: PCM: check if ops are defined before suspending PCM Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> ARM: dts: meson8b: fix the Ethernet data line signals in eth_rgmii_pins Nathan Chancellor <natechancellor(a)gmail.com> ARM: 8833/1: Ensure that NEON code always compiles with Clang Chieh-Min Wang <chiehminw(a)synology.com> netfilter: conntrack: fix cloned unconfirmed skb->_nfct race in __nf_conntrack_confirm Masami Hiramatsu <mhiramat(a)kernel.org> kprobes: Prohibit probing on RCU debug routine Andrea Righi <righi.andrea(a)gmail.com> kprobes: Prohibit probing on bsearch() Tycho Andersen <tycho(a)tycho.ws> selftests: skip seccomp get_metadata test if not real root Hans de Goede <hdegoede(a)redhat.com> ACPI / video: Refactor and fix dmi_is_desktop() Sara Sharon <sara.sharon(a)intel.com> iwlwifi: pcie: fix emergency path Thomas Richter <tmricht(a)linux.ibm.com> perf report: Add s390 diagnosic sampling descriptor size Michal Kazior <michal(a)plume.com> leds: lp55xx: fix null deref on firmware load failure Theodore Ts'o <tytso(a)mit.edu> jbd2: fix race when writing superblock Tejun Heo <tj(a)kernel.org> cgroup, rstat: Don't flush subtree root unless necessary Hong Liu <hong.liu(a)intel.com> HID: intel-ish-hid: avoid binding wrong ishtp_cl_device Aurelien Jarno <aurelien(a)aurel32.net> vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1 Oleksandr Andrushchenko <oleksandr_andrushchenko(a)epam.com> xen/gntdev: Do not destroy context while dma-bufs are in use Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> mt76: usb: do not run mt76u_queues_deinit twice Ezequiel Garcia <ezequiel(a)collabora.com> media: mtk-jpeg: Correct return type for mem2mem buffer helpers Ezequiel Garcia <ezequiel(a)collabora.com> media: mx2_emmaprp: Correct return type for mem2mem buffer helpers Ezequiel Garcia <ezequiel(a)collabora.com> media: s5p-g2d: Correct return type for mem2mem buffer helpers Ezequiel Garcia <ezequiel(a)collabora.com> media: rockchip/rga: Correct return type for mem2mem buffer helpers Ezequiel Garcia <ezequiel(a)collabora.com> media: s5p-jpeg: Correct return type for mem2mem buffer helpers Ezequiel Garcia <ezequiel(a)collabora.com> media: sh_veu: Correct return type for mem2mem buffer helpers Akinobu Mita <akinobu.mita(a)gmail.com> media: ov7740: fix runtime pm initialization Wen Yang <yellowriver2010(a)hotmail.com> SoC: imx-sgtl5000: add missing put_device() He Kuang <hekuang(a)huawei.com> perf report: Don't shadow inlined symbol with different addr range Brian Norris <briannorris(a)chromium.org> mwifiex: don't advertise IBSS features without FW support Thomas Richter <tmricht(a)linux.ibm.com> perf test: Fix failure of 'evsel-tp-sched' test on s390 Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Clear stream->mode_changed after commit Sedat Dilek <sedat.dilek(a)gmail.com> scsi: fcoe: make use of fip_mode enum complete Jason Yan <yanaijie(a)huawei.com> scsi: megaraid_sas: return error when create DMA pool failed Sebastian Ott <sebott(a)linux.ibm.com> s390/ism: ignore some errors during deregistration Ross Lagerwall <ross.lagerwall(a)citrix.com> efi: cper: Fix possible out-of-bounds access Erwan Velu <erwanaliasr1(a)gmail.com> cpufreq: acpi-cpufreq: Report if CPU doesn't support boost technologies Takashi Iwai <tiwai(a)suse.de> ASoC: qcom: Fix of-node refcount unbalance in qcom_snd_parse_of() Wei Li <liwei391(a)huawei.com> perf annotate: Fix getting source line failure Katsuhiro Suzuki <katsuhiro(a)katsuster.net> clk: fractional-divider: check parent rate only if flag is set Håkon Bugge <haakon.bugge(a)oracle.com> IB/mlx4: Increase the timeout for CM cache Dongli Zhang <dongli.zhang(a)oracle.com> loop: set GENHD_FL_NO_PART_SCAN after blkdev_reread_part() Vadim Pasternak <vadimp(a)mellanox.com> platform/mellanox: mlxreg-hotplug: Fix KASAN warning Yang Fan <nullptr.cpp(a)gmail.com> platform/x86: ideapad-laptop: Fix no_hw_rfkill_list for Lenovo RESCUER R720-15IKBN Florian Fainelli <f.fainelli(a)gmail.com> mlxsw: spectrum: Avoid -Wformat-truncation warnings Florian Fainelli <f.fainelli(a)gmail.com> e1000e: Fix -Wformat-truncation warnings Andrew Lunn <andrew(a)lunn.ch> net: dsa: mv88e6xxx: Add lockdep classes to fix false positive splat Aaro Koskinen <aaro.koskinen(a)iki.fi> mmc: omap: fix the maximum timeout setting Qu Wenruo <wqu(a)suse.com> btrfs: qgroup: Make qgroup async transaction commit more aggressive Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> powerpc/hugetlb: Handle mmap_min_addr correctly in get_unmapped_area callback Nicolas Boichat <drinkcat(a)chromium.org> iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> ARM: 8840/1: use a raw_spinlock_t in unwind Lubomir Rintel <lkundrak(a)v3.sk> serial: 8250_pxa: honor the port number from devicetree Sai Prakash Ranjan <saiprakash.ranjan(a)codeaurora.org> coresight: etm4x: Add support to enable ETMv4.2 Nathan Chancellor <natechancellor(a)gmail.com> powerpc/xmon: Fix opcode being uninitialized in print_insn_powerpc Masahiro Yamada <yamada.masahiro(a)socionext.com> kbuild: invoke syncconfig if include/config/auto.conf.cmd is missing Benjamin Block <bblock(a)linux.ibm.com> scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c Alexey Kardashevskiy <aik(a)ozlabs.ru> powerpc/powernv/ioda: Fix locked_vm counting for memory used by IOMMU tables Paul Kocialkowski <paul.kocialkowski(a)bootlin.com> usb: chipidea: Grab the (legacy) USB PHY by phandle first Eric Biggers <ebiggers(a)google.com> crypto: cavium/zip - fix collision with generic cra_driver_name Julia Lawall <Julia.Lawall(a)lip6.fr> crypto: crypto4xx - add missing of_node_put after of_device_is_available Wen Yang <wen.yang99(a)zte.com.cn> mt76: fix a leaked reference by adding a missing of_node_put Alexei Avshalom Lazar <ailizaro(a)codeaurora.org> wil6210: check null pointer in _wil_cfg80211_merge_extra_ies Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> PCI/PME: Fix hotplug/sysfs remove deadlock in pcie_pme_remove() Tony Jones <tonyj(a)suse.de> tools lib traceevent: Fix buffer overflow in arg_eval Carlos Maiolino <cmaiolino(a)redhat.com> fs: fix guard_bio_eod to check for real EOD errors luojiajun <luojiajun3(a)huawei.com> jbd2: fix invalid descriptor block checksum Florian Westphal <fw(a)strlen.de> netfilter: conntrack: tcp: only close if RST matches exact sequence Li RongQing <lirongqing(a)baidu.com> netfilter: nf_tables: check the result of dereferencing base_chain->stats Slavomir Kaslev <kaslevs(a)vmware.com> fs: Make splice() and tee() take into account O_NONBLOCK flag on pipes Yao Liu <yotta.liu(a)ucloud.cn> cifs: Fix NULL pointer dereference of devname Namjae Jeon <linkinjeon(a)gmail.com> cifs: Accept validate negotiate if server return NT_STATUS_NOT_SUPPORTED Chao Yu <yuchao0(a)huawei.com> f2fs: fix to check inline_xattr_size boundary correctly Jason Cai (Xiang Feng) <jason.cai.kern(a)gmail.com> dm thin: add sanity checks to thin-pool and external snapshot creation Louis Taylor <louis(a)kragniz.eu> cifs: use correct format characters Qian Cai <cai(a)lca.pw> page_poison: play nicely with KASAN Shuriyc Chu <sureeju(a)gmail.com> fs/file.c: initialize init_files.resize_wait Sahitya Tummala <stummala(a)codeaurora.org> f2fs: do not use mutex lock in atomic context Jia Guo <guojia12(a)huawei.com> ocfs2: fix a panic problem caused by o2cb_ctl Qian Cai <cai(a)lca.pw> mm/slab.c: kmemleak no scan alien caches Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512! Vlastimil Babka <vbabka(a)suse.cz> mm, mempolicy: fix uninit memory access Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> memcg: killed threads should not invoke memcg OOM killer Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> mm,oom: don't kill global init via memory.oom.group Daniel Jordan <daniel.m.jordan(a)oracle.com> mm, swap: bounds check swap_info array accesses to avoid NULL derefs Qian Cai <cai(a)lca.pw> mm/page_ext.c: fix an imbalance with kmemleak Peng Fan <peng.fan(a)nxp.com> mm/cma.c: cma_declare_contiguous: correct err handling Qian Cai <cai(a)lca.pw> mm/sparse: fix a bad comparison Jiri Olsa <jolsa(a)redhat.com> perf c2c: Fix c2c report for empty numa node Kairui Song <kasong(a)redhat.com> x86/hyperv: Fix kernel panic when kexec on HyperV Linus Torvalds <torvalds(a)linux-foundation.org> iio: adc: fix warning in Qualcomm PM8xxx HK/XOADC driver Xiang Chen <chenxiang66(a)hisilicon.com> scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO John Garry <john.garry(a)huawei.com> scsi: hisi_sas: Set PHY linkrate when disconnected Stanislav Fomichev <sdf(a)google.com> libbpf: force fixdep compilation at the start of the build Arnd Bergmann <arnd(a)arndb.de> enic: fix build warning without CONFIG_CPUMASK_OFFSTACK Nathan Chancellor <natechancellor(a)gmail.com> net: stmmac: Avoid sometimes uninitialized Clang warnings Christian Brauner <christian(a)brauner.io> sysctl: handle overflow for file-max Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com> include/linux/relay.h: fix percpu annotation in struct rchan Russell King <rmk+kernel(a)armlinux.org.uk> gpio: gpio-omap: fix level interrupt idling Tonghao Zhang <xiangxia.m.yue(a)gmail.com> net/mlx5: Avoid panic when setting vport mac, getting vport config Tonghao Zhang <xiangxia.m.yue(a)gmail.com> net/mlx5: Avoid panic when setting vport rate Douglas Anderson <dianders(a)chromium.org> tracing: kdb: Fix ftdump to not sleep Chao Yu <yuchao0(a)huawei.com> f2fs: fix to avoid deadlock in f2fs_read_inline_dir() Chao Yu <yuchao0(a)huawei.com> f2fs: fix to adapt small inline xattr space in __find_inline_xattr() Masahiro Yamada <yamada.masahiro(a)socionext.com> h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux- Aurelien Aptel <aaptel(a)suse.com> CIFS: fix POSIX lock leak and invalid ptr deref Razvan Stefanescu <razvan.stefanescu(a)microchip.com> tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped Razvan Stefanescu <razvan.stefanescu(a)microchip.com> tty/serial: atmel: Add is_half_duplex helper zhangyi (F) <yi.zhang(a)huawei.com> ext4: cleanup bh release code in ext4_ind_remove_space() Will Deacon <will.deacon(a)arm.com> arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals ------------- Diffstat: Documentation/arm/kernel_mode_neon.txt | 4 +- Makefile | 11 +++-- arch/arm/boot/dts/lpc32xx.dtsi | 18 +++---- arch/arm/boot/dts/meson8b.dtsi | 6 +-- arch/arm/include/asm/barrier.h | 2 + arch/arm/include/asm/processor.h | 6 ++- arch/arm/include/asm/v7m.h | 2 +- arch/arm/kernel/entry-header.S | 3 +- arch/arm/kernel/entry-v7m.S | 4 ++ arch/arm/kernel/machine_kexec.c | 5 +- arch/arm/kernel/smp.c | 4 +- arch/arm/kernel/unwind.c | 14 +++--- arch/arm/lib/Makefile | 2 +- arch/arm/lib/xor-neon.c | 2 +- arch/arm/mach-omap2/prm_common.c | 4 +- arch/arm/mm/proc-v7m.S | 3 ++ arch/arm64/mm/fault.c | 9 ++-- arch/h8300/Makefile | 2 +- arch/powerpc/include/asm/topology.h | 2 + arch/powerpc/kernel/entry_64.S | 7 +++ arch/powerpc/mm/hugetlbpage-radix.c | 5 +- arch/powerpc/mm/numa.c | 9 +--- arch/powerpc/platforms/powernv/pci-ioda-tce.c | 1 - arch/powerpc/platforms/powernv/pci-ioda.c | 7 ++- arch/powerpc/platforms/pseries/hotplug-cpu.c | 19 ++++++++ arch/powerpc/xmon/ppc-dis.c | 2 +- arch/s390/kernel/perf_cpum_sf.c | 6 +-- arch/x86/boot/Makefile | 2 +- arch/x86/entry/entry_64.S | 4 ++ arch/x86/events/intel/bts.c | 4 +- arch/x86/events/intel/pt.c | 5 +- arch/x86/hyperv/hv_init.c | 7 +++ arch/x86/kernel/vmlinux.lds.S | 2 +- arch/x86/realmode/rm/Makefile | 2 +- block/bfq-iosched.c | 5 +- block/bfq-iosched.h | 3 ++ drivers/acpi/acpi_video.c | 20 +++++--- drivers/block/loop.c | 21 ++++++-- drivers/cdrom/cdrom.c | 7 ++- drivers/char/hpet.c | 2 +- drivers/char/hw_random/virtio-rng.c | 2 +- drivers/clk/clk-fractional-divider.c | 2 +- drivers/clk/meson/meson-aoclk.c | 15 ++++-- drivers/clk/rockchip/clk-rk3328.c | 12 ++--- drivers/cpufreq/acpi-cpufreq.c | 4 +- drivers/crypto/amcc/crypto4xx_trng.c | 4 +- drivers/crypto/cavium/zip/zip_main.c | 6 ++- drivers/dma/imx-dma.c | 2 +- drivers/dma/qcom/hidma.c | 19 +++++--- drivers/dma/tegra20-apb-dma.c | 5 +- drivers/firmware/efi/cper.c | 13 +++-- drivers/firmware/efi/libstub/arm-stub.c | 5 ++ drivers/firmware/efi/libstub/efi-stub-helper.c | 10 ++++ drivers/firmware/efi/libstub/efistub.h | 1 + drivers/firmware/efi/libstub/fdt.c | 3 ++ drivers/firmware/efi/memattr.c | 2 +- drivers/gpio/gpio-omap.c | 14 +++--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 ++++++- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 42 ++++++++-------- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++ .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 7 +-- drivers/gpu/drm/drm_dp_mst_topology.c | 1 + drivers/gpu/drm/drm_fb_helper.c | 2 +- drivers/gpu/drm/drm_plane.c | 3 ++ drivers/gpu/drm/nouveau/dispnv04/tvnv17.c | 4 +- drivers/gpu/drm/rcar-du/rcar_du_kms.c | 2 + drivers/gpu/drm/vkms/vkms_crtc.c | 3 ++ drivers/hid/intel-ish-hid/ipc/ipc.c | 9 ++-- drivers/hid/intel-ish-hid/ishtp/bus.c | 4 +- drivers/hwtracing/coresight/coresight-etm-perf.c | 6 +-- drivers/hwtracing/coresight/coresight-etm4x.c | 3 +- drivers/i2c/i2c-core-of.c | 14 +++++- drivers/iio/adc/qcom-pm8xxx-xoadc.c | 10 ++-- drivers/infiniband/hw/cxgb4/cm.c | 5 +- drivers/infiniband/hw/mlx4/cm.c | 2 +- drivers/input/misc/soc_button_array.c | 2 +- drivers/iommu/io-pgtable-arm-v7s.c | 3 +- drivers/leds/leds-lp55xx-common.c | 4 +- drivers/md/bcache/sysfs.c | 25 ++++++++-- drivers/md/bcache/sysfs.h | 13 +++-- drivers/md/dm-thin.c | 13 +++++ drivers/media/i2c/mt9m111.c | 2 + drivers/media/i2c/ov7740.c | 7 ++- drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 40 +++++++-------- drivers/media/platform/mx2_emmaprp.c | 6 +-- drivers/media/platform/rcar-vin/rcar-core.c | 8 ++- drivers/media/platform/rockchip/rga/rga.c | 6 +-- drivers/media/platform/s5p-g2d/g2d.c | 6 +-- drivers/media/platform/s5p-jpeg/jpeg-core.c | 57 ++++++++++++---------- drivers/media/platform/sh_veu.c | 4 +- drivers/mmc/host/omap.c | 2 +- drivers/net/dsa/mv88e6xxx/chip.c | 8 +++ drivers/net/ethernet/cisco/enic/enic_main.c | 6 +-- drivers/net/ethernet/intel/e1000e/netdev.c | 21 ++++---- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 17 ++++--- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 17 ++++--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 4 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +-- drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 2 +- drivers/net/phy/phy-c45.c | 10 +++- drivers/net/phy/phy_device.c | 13 +++-- drivers/net/wireless/ath/ath10k/ce.c | 26 +++++----- drivers/net/wireless/ath/ath10k/ce.h | 2 +- drivers/net/wireless/ath/wil6210/cfg80211.c | 14 ++++-- .../wireless/broadcom/brcm80211/brcmfmac/common.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 20 +++++--- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 11 +++-- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 10 ++-- drivers/net/wireless/mediatek/mt76/eeprom.c | 24 ++++++--- drivers/net/wireless/mediatek/mt76/usb.c | 11 +---- drivers/net/wireless/mediatek/mt7601u/eeprom.h | 2 +- drivers/net/wireless/ti/wlcore/main.c | 7 ++- drivers/pci/pcie/pme.c | 22 ++++++--- drivers/perf/arm_spe_pmu.c | 6 +-- drivers/pinctrl/meson/pinctrl-meson8b.c | 6 ++- drivers/platform/mellanox/mlxreg-hotplug.c | 5 +- drivers/platform/x86/ideapad-laptop.c | 2 +- drivers/platform/x86/intel-hid.c | 7 ++- drivers/platform/x86/intel_pmc_core.c | 3 +- drivers/platform/x86/intel_pmc_core.h | 2 +- drivers/regulator/act8865-regulator.c | 5 +- drivers/s390/net/ism_drv.c | 12 +++-- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +- drivers/scsi/fcoe/fcoe.c | 2 +- drivers/scsi/fcoe/fcoe_ctlr.c | 7 ++- drivers/scsi/fcoe/fcoe_transport.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 13 ++++- drivers/scsi/megaraid/megaraid_sas_base.c | 1 + drivers/scsi/qedf/qedf_main.c | 2 +- drivers/scsi/scsi_scan.c | 6 +-- drivers/soc/qcom/qcom_gsbi.c | 7 ++- drivers/soc/tegra/fuse/fuse-tegra.c | 12 +++-- drivers/staging/mt7621-spi/spi-mt7621.c | 7 ++- drivers/tty/serial/8250/8250_pxa.c | 4 ++ drivers/tty/serial/atmel_serial.c | 43 +++++++++++----- drivers/tty/tty_buffer.c | 2 +- drivers/usb/chipidea/core.c | 9 +++- drivers/usb/dwc3/gadget.c | 2 + drivers/usb/gadget/function/f_fs.c | 1 + drivers/video/backlight/pwm_bl.c | 2 +- drivers/video/fbdev/core/fbmem.c | 3 ++ drivers/xen/gntdev-dmabuf.c | 12 ++++- drivers/xen/gntdev-dmabuf.h | 2 +- drivers/xen/gntdev.c | 2 +- fs/btrfs/qgroup.c | 28 +++++------ fs/buffer.c | 7 +++ fs/cifs/cifs_dfs_ref.c | 4 +- fs/cifs/connect.c | 5 ++ fs/cifs/file.c | 14 +++++- fs/cifs/smb1ops.c | 2 +- fs/cifs/smb2pdu.c | 10 +++- fs/ext4/indirect.c | 47 +++++++++--------- fs/f2fs/f2fs.h | 1 - fs/f2fs/inline.c | 8 ++- fs/f2fs/super.c | 13 ++--- fs/f2fs/sysfs.c | 12 +++-- fs/f2fs/trace.c | 20 +++++--- fs/f2fs/xattr.c | 13 +++-- fs/file.c | 1 + fs/jbd2/commit.c | 6 ++- fs/jbd2/journal.c | 52 ++++++++++---------- fs/ocfs2/cluster/nodemanager.c | 14 +++--- fs/read_write.c | 6 +++ fs/splice.c | 12 +++++ include/linux/cgroup-defs.h | 2 +- include/linux/cgroup.h | 2 + include/linux/clk-provider.h | 3 ++ include/linux/f2fs_fs.h | 13 ++--- include/linux/filter.h | 4 +- include/linux/irqdesc.h | 1 + include/linux/perf_event.h | 2 +- include/linux/relay.h | 2 +- include/linux/ring_buffer.h | 2 +- include/linux/sched.h | 4 +- include/linux/sched/topology.h | 8 +-- include/net/netfilter/br_netfilter.h | 1 - include/scsi/libfcoe.h | 4 +- kernel/cgroup/cgroup.c | 15 +++--- kernel/cgroup/pids.c | 4 +- kernel/cgroup/rstat.c | 10 ++-- kernel/cpu.c | 9 ++++ kernel/events/ring_buffer.c | 2 +- kernel/exit.c | 1 + kernel/irq/chip.c | 12 ++++- kernel/irq/internals.h | 8 ++- kernel/irq/irqdesc.c | 7 ++- kernel/rcu/update.c | 2 + kernel/sched/core.c | 9 ++-- kernel/sched/debug.c | 4 ++ kernel/sched/sched.h | 6 +-- kernel/sched/topology.c | 2 +- kernel/sysctl.c | 3 ++ kernel/trace/ring_buffer.c | 5 +- kernel/trace/trace.c | 6 ++- kernel/trace/trace_kdb.c | 6 ++- lib/bsearch.c | 2 + lib/raid6/Makefile | 2 +- mm/cma.c | 4 +- mm/memcontrol.c | 19 ++++++-- mm/mempolicy.c | 2 +- mm/oom_kill.c | 3 +- mm/page_alloc.c | 2 +- mm/page_ext.c | 1 + mm/page_poison.c | 4 ++ mm/slab.c | 17 ++++--- mm/sparse.c | 2 +- mm/swapfile.c | 51 ++++++++++--------- mm/vmalloc.c | 6 ++- net/bridge/br_netfilter_hooks.c | 5 -- net/netfilter/nf_conntrack_core.c | 14 ++++-- net/netfilter/nf_conntrack_proto_tcp.c | 50 +++++++++++++++---- net/netfilter/nf_tables_core.c | 14 +++--- net/netfilter/xt_physdev.c | 9 +++- security/selinux/hooks.c | 9 +++- sound/core/pcm_native.c | 8 +++ sound/firewire/dice/dice.c | 12 ++++- sound/soc/fsl/fsl-asoc-card.c | 1 + sound/soc/fsl/imx-sgtl5000.c | 1 + sound/soc/qcom/common.c | 10 +++- tools/lib/bpf/Makefile | 3 +- tools/lib/traceevent/event-parse.c | 2 +- tools/perf/builtin-c2c.c | 8 ++- tools/perf/tests/evsel-tp-sched.c | 6 +-- tools/perf/util/annotate.c | 4 +- tools/perf/util/s390-cpumsf.c | 5 ++ .../util/scripting-engines/trace-event-python.c | 15 ++++-- tools/perf/util/sort.c | 10 +++- tools/perf/util/srcline.c | 2 +- tools/testing/selftests/bpf/test_verifier.c | 9 +++- tools/testing/selftests/seccomp/seccomp_bpf.c | 6 +++ 230 files changed, 1275 insertions(+), 620 deletions(-)

4 years, 11 months

9
195
0 0

Re: [PATCH 00/35] crypto: ccree: features and bug fixes for 5.2

by Gilad Ben-Yossef

On Thu, Apr 18, 2019 at 4:39 PM Gilad Ben-Yossef <gilad(a)benyossef.com> wrote: > > A set of new features, mostly support for CryptoCell 713 > features including protected keys, security disable mode and > new HW revision indetification interface alongside many bug fixes. FYI, A port of those patches from this patch series which have been marked for stable is available at https://github.com/gby/linux/tree/4.19-ccree Gilad -- Gilad Ben-Yossef Chief Coffee Drinker values of β will give rise to dom!

4 years, 11 months

2
5
0 0

[PATCH 1/2] block: Fix a NULL pointer dereference in generic_make_request()

by Guilherme G. Piccoli

Commit 37f9579f4c31 ("blk-mq: Avoid that submitting a bio concurrently with device removal triggers a crash") introduced a NULL pointer dereference in generic_make_request(). The patch sets q to NULL and enter_succeeded to false; right after, there's an 'if (enter_succeeded)' which is not taken, and then the 'else' will dereference q in blk_queue_dying(q). This patch just moves the 'q = NULL' to a point in which it won't trigger the oops, although the semantics of this NULLification remains untouched. A simple test case/reproducer is as follows: a) Build kernel v5.1-rc7 with CONFIG_BLK_CGROUP=n. b) Create a raid0 md array with 2 NVMe devices as members, and mount it with an ext4 filesystem. c) Run the following oneliner (supposing the raid0 is mounted in /mnt): (dd of=/mnt/tmp if=/dev/zero bs=1M count=999 &); sleep 0.3; echo 1 > /sys/block/nvme0n1/device/device/remove (whereas nvme0n1 is the 2nd array member) This will trigger the following oops: BUG: unable to handle kernel NULL pointer dereference at 0000000000000078 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI RIP: 0010:generic_make_request+0x32b/0x400 Call Trace: submit_bio+0x73/0x140 ext4_io_submit+0x4d/0x60 ext4_writepages+0x626/0xe90 do_writepages+0x4b/0xe0 [...] This patch has no functional changes and preserves the md/raid0 behavior when a member is removed before kernel v4.17. Cc: Bart Van Assche <bvanassche(a)acm.org> Cc: stable(a)vger.kernel.org # v4.17 Fixes: 37f9579f4c31 ("blk-mq: Avoid that submitting a bio concurrently with device removal triggers a crash") Signed-off-by: Guilherme G. Piccoli <gpiccoli(a)canonical.com> --- block/blk-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/blk-core.c b/block/blk-core.c index a55389ba8779..e21856a7f3fa 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -1076,7 +1076,6 @@ blk_qc_t generic_make_request(struct bio *bio) flags = BLK_MQ_REQ_NOWAIT; if (blk_queue_enter(q, flags) < 0) { enter_succeeded = false; - q = NULL; } } @@ -1108,6 +1107,7 @@ blk_qc_t generic_make_request(struct bio *bio) bio_wouldblock_error(bio); else bio_io_error(bio); + q = NULL; } bio = bio_list_pop(&bio_list_on_stack[0]); } while (bio); -- 2.21.0

4 years, 11 months

7
11
0 0

[PATCH 1/2] HID: wacom: Don't set tool type until we're in range

by Gerecke, Jason

From: Jason Gerecke <jason.gerecke(a)wacom.com> The serial number and tool type information that is reported by the tablet while a pen is merely "in prox" instead of fully "in range" can be stale and cause us to report incorrect tool information. Serial number, tool type, and other information is only valid once the pen comes fully in range so we should be careful to not use this information until that point. In particular, this issue may cause the driver to incorectly report BTN_TOOL_RUBBER after switching from the eraser tool back to the pen. Fixes: a48324de6d ("HID: wacom: Bluetooth IRQ for Intuos Pro should handle prox/range") Cc: <stable(a)vger.kernel.org> # 4.11+ Signed-off-by: Jason Gerecke <jason.gerecke(a)wacom.com> Reviewed-by: Aaron Armstrong Skomra <aaron.skomra(a)wacom.com> --- drivers/hid/wacom_wac.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c index 747730d32ab6..4c1bc239207e 100644 --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -1236,13 +1236,13 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom) /* Add back in missing bits of ID for non-USI pens */ wacom->id[0] |= (wacom->serial[0] >> 32) & 0xFFFFF; } - wacom->tool[0] = wacom_intuos_get_tool_type(wacom_intuos_id_mangle(wacom->id[0])); for (i = 0; i < pen_frames; i++) { unsigned char *frame = &data[i*pen_frame_len + 1]; bool valid = frame[0] & 0x80; bool prox = frame[0] & 0x40; bool range = frame[0] & 0x20; + bool invert = frame[0] & 0x10; if (!valid) continue; @@ -1251,9 +1251,24 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom) wacom->shared->stylus_in_proximity = false; wacom_exit_report(wacom); input_sync(pen_input); + + wacom->tool[0] = 0; + wacom->id[0] = 0; + wacom->serial[0] = 0; return; } + if (range) { + if (!wacom->tool[0]) { /* first in range */ + /* Going into range select tool */ + if (invert) + wacom->tool[0] = BTN_TOOL_RUBBER; + else if (wacom->id[0]) + wacom->tool[0] = wacom_intuos_get_tool_type(wacom->id[0]); + else + wacom->tool[0] = BTN_TOOL_PEN; + } + input_report_abs(pen_input, ABS_X, get_unaligned_le16(&frame[1])); input_report_abs(pen_input, ABS_Y, get_unaligned_le16(&frame[3])); -- 2.21.0

4 years, 11 months

3
3
0 0

Re: [PATCH] powerpc/powernv/npu: Fix reference leak

by Greg Kurz

On Mon, 29 Apr 2019 16:01:29 +1000 Alexey Kardashevskiy <aik(a)ozlabs.ru> wrote: > On 20/04/2019 01:34, Greg Kurz wrote: > > Since 902bdc57451c, get_pci_dev() calls pci_get_domain_bus_and_slot(). This > > has the effect of incrementing the reference count of the PCI device, as > > explained in drivers/pci/search.c: > > > > * Given a PCI domain, bus, and slot/function number, the desired PCI > > * device is located in the list of PCI devices. If the device is > > * found, its reference count is increased and this function returns a > > * pointer to its data structure. The caller must decrement the > > * reference count by calling pci_dev_put(). If no device is found, > > * %NULL is returned. > > > > Nothing was done to call pci_dev_put() and the reference count of GPU and > > NPU PCI devices rockets up. > > > > A natural way to fix this would be to teach the callers about the change, > > so that they call pci_dev_put() when done with the pointer. This turns > > out to be quite intrusive, as it affects many paths in npu-dma.c, > > pci-ioda.c and vfio_pci_nvlink2.c. > > > afaict this referencing is only done to protect the current traverser > and what you've done is actually a natural way (and the generic > pci_get_dev_by_id() does exactly the same), although this looks a bit weird. > Not exactly the same: pci_get_dev_by_id() always increment the refcount of the returned PCI device. The refcount is only decremented when this device is passed to pci_get_dev_by_id() to continue searching. That means that the users of the PCI device pointer returned by pci_get_dev_by_id() or its exported variants pci_get_subsys(), pci_get_device() and pci_get_class() do handle the refcount. They all pass the pointer to pci_dev_put() or continue the search, which calls pci_dev_put() internally. Direct and indirect callers of get_pci_dev() don't care for the refcount at all unless I'm missing something. > > > Also, the issue appeared in 4.16 and > > some affected code got moved around since then: it would be problematic > > to backport the fix to stable releases. > > > > All that code never cared for reference counting anyway. Call pci_dev_put() > > from get_pci_dev() to revert to the previous behavior. > >> Fixes: 902bdc57451c ("powerpc/powernv/idoa: Remove unnecessary pcidev > from pci_dn") > > Cc: stable(a)vger.kernel.org # v4.16 > > Signed-off-by: Greg Kurz <groug(a)kaod.org> > > --- > > arch/powerpc/platforms/powernv/npu-dma.c | 15 ++++++++++++++- > > 1 file changed, 14 insertions(+), 1 deletion(-) > > > > diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c > > index e713ade30087..d8f3647e8fb2 100644 > > --- a/arch/powerpc/platforms/powernv/npu-dma.c > > +++ b/arch/powerpc/platforms/powernv/npu-dma.c > > @@ -31,9 +31,22 @@ static DEFINE_SPINLOCK(npu_context_lock); > > static struct pci_dev *get_pci_dev(struct device_node *dn) > > { > > struct pci_dn *pdn = PCI_DN(dn); > > + struct pci_dev *pdev; > > > > - return pci_get_domain_bus_and_slot(pci_domain_nr(pdn->phb->bus), > > + pdev = pci_get_domain_bus_and_slot(pci_domain_nr(pdn->phb->bus), > > pdn->busno, pdn->devfn); > > + > > + /* > > + * pci_get_domain_bus_and_slot() increased the reference count of > > + * the PCI device, but callers don't need that actually as the PE > > + * already holds a reference to the device. > > Imho this would be just enough. > > Anyway, > > Reviewed-by: Alexey Kardashevskiy <aik(a)ozlabs.ru> > Thanks ! I now realize that I forgot to add the --cc option for stable on my stgit command line :-\. Cc'ing now. > > How did you find it? :) > While reading code to find some inspiration for OpenCAPI passthrough. :) I saw the following in vfio_pci_ibm_npu2_init(): if (!pnv_pci_get_gpu_dev(vdev->pdev)) return -ENODEV; and simply followed the function calls. > > > Since callers aren't > > + * aware of the reference count change, call pci_dev_put() now to > > + * avoid leaks. > > + */ > > + if (pdev) > > + pci_dev_put(pdev); > > + > > + return pdev; > > } > > > > /* Given a NPU device get the associated PCI device. */ > > >

4 years, 11 months

2
3
0 0

[Linux-stable-mirror] [PATCH] drbd: fix discard_zeroes_if_aligned regression

by Eric Wheeler

From: Eric Wheeler <git(a)linux.ewheeler.net> According to drbd.conf documentation, "To not break established and expected behaviour, and suddenly cause fstrim on thin-provisioned LVs to run out-of-space instead of freeing up space, the default value is yes." This behavior regressed in the REQ_OP_WRITE_ZEROES refactor near 45c21793 drbd: implement REQ_OP_WRITE_ZEROES 0dbed96 drbd: make intelligent use of blkdev_issue_zeroout which caused dm-thin backed DRBD volumes to zero blocks and run out of space instead of passing discard to the backing device as defined by the discard_zeroes_if_aligned option. A helper function could reduce code duplication. Signed-off-by: Eric Wheeler <drbd(a)linux.ewheeler.net> Cc: <stable(a)vger.kernel.org> # 4.14 --- drivers/block/drbd/drbd_receiver.c | 22 ++++++++++++++++++++-- drivers/block/drbd/drbd_req.c | 23 +++++++++++++++++++++-- 2 files changed, 41 insertions(+), 4 deletions(-) diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c index 62a902f..58f0e43 100644 --- a/drivers/block/drbd/drbd_receiver.c +++ b/drivers/block/drbd/drbd_receiver.c @@ -1507,9 +1507,27 @@ void drbd_bump_write_ordering(struct drbd_resource *resource, struct drbd_backin static void drbd_issue_peer_discard(struct drbd_device *device, struct drbd_peer_request *peer_req) { struct block_device *bdev = device->ldev->backing_bdev; + struct disk_conf *dc; + bool discard_zeroes_if_aligned, zeroout; - if (blkdev_issue_zeroout(bdev, peer_req->i.sector, peer_req->i.size >> 9, - GFP_NOIO, 0)) + rcu_read_lock(); + dc = rcu_dereference(device->ldev->disk_conf); + discard_zeroes_if_aligned = dc->discard_zeroes_if_aligned; + rcu_read_unlock(); + + /* Use zeroout unless discard_zeroes_if_aligned is set. + * If blkdev_issue_discard fails, then retry with blkdev_issue_zeroout. + * See also drbd_process_discard_req() in drbd_req.c. + */ + zeroout = true; + if (discard_zeroes_if_aligned && + blkdev_issue_discard(bdev, peer_req->i.sector, + peer_req->i.size >> 9, GFP_NOIO, 0) == 0) + zeroout = false; + + if (zeroout && + blkdev_issue_zeroout(bdev, peer_req->i.sector, + peer_req->i.size >> 9, GFP_NOIO, 0) != 0) peer_req->flags |= EE_WAS_ERROR; drbd_endio_write_sec_final(peer_req); diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c index de8566e..070b5e7 100644 --- a/drivers/block/drbd/drbd_req.c +++ b/drivers/block/drbd/drbd_req.c @@ -1158,9 +1158,28 @@ static int drbd_process_write_request(struct drbd_request *req) static void drbd_process_discard_req(struct drbd_request *req) { struct block_device *bdev = req->device->ldev->backing_bdev; + struct drbd_device *device = req->device; + struct disk_conf *dc; + bool discard_zeroes_if_aligned, zeroout; - if (blkdev_issue_zeroout(bdev, req->i.sector, req->i.size >> 9, - GFP_NOIO, 0)) + rcu_read_lock(); + dc = rcu_dereference(device->ldev->disk_conf); + discard_zeroes_if_aligned = dc->discard_zeroes_if_aligned; + rcu_read_unlock(); + + /* Use zeroout unless discard_zeroes_if_aligned is set. + * If blkdev_issue_discard fails, then retry with blkdev_issue_zeroout. + * See also drbd_issue_peer_discard() in drbd_receiver.c. + */ + zeroout = true; + if (discard_zeroes_if_aligned && + blkdev_issue_discard(bdev, req->i.sector, req->i.size >> 9, + GFP_NOIO, 0) == 0) + zeroout = false; + + if (zeroout && + blkdev_issue_zeroout(bdev, req->i.sector, req->i.size >> 9, + GFP_NOIO, 0) != 0) req->private_bio->bi_status = BLK_STS_IOERR; bio_endio(req->private_bio); } -- 1.8.3.1

4 years, 11 months

3
4
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror April 2019