5.7.5-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 5.7.5-rc1 review
This is the start of the stable review cycle for the 5.7.5 release. There are 376 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 21 Jun 2020 14:15:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.7.5-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.7.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.7.5-rc1
Adrian Hunter <[email protected]>
perf symbols: Fix kernel maps for kcore and eBPF
Adrian Hunter <[email protected]>
perf symbols: Fix debuginfo search for Ubuntu
Masami Hiramatsu <[email protected]>
perf probe: Check address correctness by map instead of _etext
Masami Hiramatsu <[email protected]>
perf probe: Fix to check blacklist address correctly
Masami Hiramatsu <[email protected]>
perf probe: Do not show the skipped events
Jaegeuk Kim <[email protected]>
f2fs: fix checkpoint=disable:%u%%
Eric Biggers <[email protected]>
f2fs: don't leak filename in f2fs_try_convert_inline_dir()
H. Nikolaus Schaller <[email protected]>
w1: omap-hdq: fix interrupt handling which did show spurious timeouts
H. Nikolaus Schaller <[email protected]>
w1: omap-hdq: fix return value to be -1 if there is a timeout
H. Nikolaus Schaller <[email protected]>
w1: omap-hdq: cleanup to add missing newline for some dev_dbg
Miquel Raynal <[email protected]>
mtd: rawnand: tmio: Fix the probe error path
Miquel Raynal <[email protected]>
mtd: rawnand: mtk: Fix the probe error path
Miquel Raynal <[email protected]>
mtd: rawnand: pasemi: Fix the probe error path
Miquel Raynal <[email protected]>
mtd: rawnand: plat_nand: Fix the probe error path
Miquel Raynal <[email protected]>
mtd: rawnand: sunxi: Fix the probe error path
Miquel Raynal <[email protected]>
mtd: rawnand: oxnas: Fix the probe error path
Miquel Raynal <[email protected]>
mtd: rawnand: socrates: Fix the probe error path
Miquel Raynal <[email protected]>
mtd: rawnand: orion: Fix the probe error path
Miquel Raynal <[email protected]>
mtd: rawnand: xway: Fix the probe error path
Miquel Raynal <[email protected]>
mtd: rawnand: ingenic: Fix the probe error path
Miquel Raynal <[email protected]>
mtd: rawnand: sharpsl: Fix the probe error path
Miquel Raynal <[email protected]>
mtd: rawnand: diskonchip: Fix the probe error path
Álvaro Fernández Rojas <[email protected]>
mtd: rawnand: brcmnand: fix hamming oob layout
Miquel Raynal <[email protected]>
mtd: rawnand: onfi: Fix redundancy detection check
Boris Brezillon <[email protected]>
mtd: rawnand: Fix nand_gpio_waitrdy()
Paul Cercueil <[email protected]>
pwm: jz4740: Enhance precision in calculation of duty cycle
Hans de Goede <[email protected]>
pwm: lpss: Fix get_state runtime-pm reference handling
Anup Patel <[email protected]>
RISC-V: Don't mark init section as non-executable
Ahmed S. Darwish <[email protected]>
block: nr_sects_write(): Disable preemption on seqcount write
NeilBrown <[email protected]>
sunrpc: clean up properly in gss_mech_unregister()
NeilBrown <[email protected]>
sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations.
Alexander Duyck <[email protected]>
virtio-balloon: Disable free page reporting if page poison reporting is not enabled
Masahiro Yamada <[email protected]>
kbuild: force to build vmlinux if CONFIG_MODVERSION=y
Michael Ellerman <[email protected]>
powerpc/64s: Save FSCR to init_task.thread.fscr after feature init
Michael Ellerman <[email protected]>
powerpc/64s: Don't let DT CPU features set FSCR_DSCR
Christophe Leroy <[email protected]>
powerpc/32: Disable KASAN with pages bigger than 16k
Christophe Leroy <[email protected]>
powerpc/kasan: Fix shadow pages allocation failure
Christophe Leroy <[email protected]>
powerpc/kasan: Fix issues by lowering KASAN_SHADOW_END
Christophe Leroy <[email protected]>
powerpc/32s: Fix another build failure with CONFIG_PPC_KUAP_DEBUG
Michael Ellerman <[email protected]>
drivers/macintosh: Fix memleak in windfarm_pm112 driver
Jonathan Bakker <[email protected]>
ARM: dts: s5pv210: Set keep-power-in-suspend for SDHCI1 on Aries
Ludovic Desroches <[email protected]>
ARM: dts: at91: sama5d2_ptc_ek: fix vbus pin
Marek Szyprowski <[email protected]>
ARM: dts: exynos: Fix GPIO polarity for thr GalaxyS3 CM36651 sensor's bus
Jan Kara <[email protected]>
jbd2: avoid leaking transaction credits when unreserving handle
Corentin Labbe <[email protected]>
soc/tegra: pmc: Select GENERIC_PINCONF
Dmitry Osipenko <[email protected]>
ARM: tegra: Correct PL310 Auxiliary Control Register initialization
Douglas Anderson <[email protected]>
kernel/cpu_pm: Fix uninitted local in cpu_pm
Hari Bathini <[email protected]>
powerpc/fadump: Account for memory_limit while reserving memory
Hari Bathini <[email protected]>
powerpc/fadump: consider reserved ranges while reserving memory
Hari Bathini <[email protected]>
powerpc/fadump: use static allocation for reserved memory ranges
Bernard Zhao <[email protected]>
memory: samsung: exynos5422-dmc: Fix tFAW timings alignment
Mikulas Patocka <[email protected]>
alpha: fix memory barriers so that they conform to the specification
Eric Biggers <[email protected]>
dm crypt: avoid truncating the logical block size
Greg Kroah-Hartman <[email protected]>
software node: implement software_node_unregister()
Al Viro <[email protected]>
sparc64: fix misuses of access_process_vm() in genregs32_[sg]et()
Al Viro <[email protected]>
sparc32: fix register window handling in genregs32_[gs]et()
Wei Yongjun <[email protected]>
gnss: sirf: fix error return code in sirf_probe()
Jonathan Bakker <[email protected]>
pinctrl: samsung: Save/restore eint_mask over suspend for EINT_TYPE GPIOs
Jonathan Bakker <[email protected]>
pinctrl: samsung: Correct setting of eint wakeup mask on s5pv210
Qiushi Wu <[email protected]>
power: supply: core: fix memory leak in HWMON error path
Michał Mirosław <[email protected]>
power: supply: core: fix HWMON temperature labels
Anders Roxell <[email protected]>
power: vexpress: add suppress_bind_attrs to true
Jon Derrick <[email protected]>
iommu/vt-d: Allocate domain info for real DMA sub-devices
Jon Derrick <[email protected]>
iommu/vt-d: Only clear real DMA device's context entries
Alexander Monakov <[email protected]>
EDAC/amd64: Add AMD family 17h model 60h PCI IDs
Alexander Monakov <[email protected]>
hwmon: (k10temp) Add AMD family 17h model 60h PCI match
Kai-Heng Feng <[email protected]>
igb: Report speed and duplex as unknown when device is runtime suspended
Weiyi Lu <[email protected]>
clk: mediatek: assign the initial value to clk_init_data of mtk_mux
Macpaul Lin <[email protected]>
usb: musb: mediatek: add reset FADDR to zero in reset interrupt handle
Tomi Valkeinen <[email protected]>
media: ov5640: fix use of destroyed mutex
Larry Finger <[email protected]>
b43_legacy: Fix connection problem with WPA3
Larry Finger <[email protected]>
b43: Fix connection problem with WPA3
Larry Finger <[email protected]>
b43legacy: Fix case where channel status is corrupted
Michał Mirosław <[email protected]>
Bluetooth: hci_bcm: fix freeing not-requested IRQ
Michał Mirosław <[email protected]>
Bluetooth: hci_bcm: respect IRQ polarity from DT
Lukas Wunner <[email protected]>
serial: 8250: Avoid error message on reprobe
Samuel Holland <[email protected]>
media: cedrus: Program output format during each run
Michael Ellerman <[email protected]>
clocksource/drivers/timer-microchip-pit64b: Select CONFIG_TIMER_OF
Thomas Gleixner <[email protected]>
clocksource: Remove obsolete ifdef
Christian Lamparter <[email protected]>
carl9170: remove P2P_GO support
Anup Patel <[email protected]>
irqchip/sifive-plic: Setup cpuhp once after boot CPU handler is present
Anup Patel <[email protected]>
irqchip/sifive-plic: Set default irq affinity in plic_irqdomain_map()
Punit Agrawal <[email protected]>
e1000e: Relax condition to trigger reset for ME workaround
Kai-Heng Feng <[email protected]>
e1000e: Disable TSO for buffer overrun workaround
Ashok Raj <[email protected]>
PCI: Program MPS for RCiEP devices
Krzysztof Struczynski <[email protected]>
ima: Set again build_ima_appraise variable
Krzysztof Struczynski <[email protected]>
ima: Remove redundant policy rule set in add_rules()
Alexander Monakov <[email protected]>
x86/amd_nb: Add AMD family 17h model 60h PCI IDs
Kai-Heng Feng <[email protected]>
serial: 8250_pci: Move Pericom IDs to pci_ids.h
Ashok Raj <[email protected]>
PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints
Kevin Buettner <[email protected]>
PCI: Avoid FLR for AMD Starship USB 3.0
Marcos Scriven <[email protected]>
PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0
Kai-Heng Feng <[email protected]>
PCI: Avoid Pericom USB controller OHCI/EHCI PME# defect
Eric Biggers <[email protected]>
ext4: fix race between ext4_sync_parent() and rename()
Jeffle Xu <[email protected]>
ext4: fix error pointer dereference
Xiyu Yang <[email protected]>
ext4: fix buffer_head refcnt leak when ext4_iget() fails
Harshad Shirwadkar <[email protected]>
ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max
Roberto Sassu <[email protected]>
evm: Fix possible memory leak in evm_calc_hmac_or_hash()
Roberto Sassu <[email protected]>
ima: Remove __init annotation from ima_pcrread()
Roberto Sassu <[email protected]>
ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()
Roberto Sassu <[email protected]>
ima: Directly assign the ima_default_policy pointer to ima_rules
Roberto Sassu <[email protected]>
ima: Evaluate error in init_ima()
Roberto Sassu <[email protected]>
ima: Switch to ima_hash_algo for boot aggregate
Krzysztof Struczynski <[email protected]>
ima: Fix ima digest hash table key calculation
Pavel Tatashin <[email protected]>
mm: call cond_resched() from deferred_init_memmap()
Daniel Jordan <[email protected]>
mm/pagealloc.c: call touch_nmi_watchdog() on max order boundaries in deferred init
Lichao Liu <[email protected]>
MIPS: CPU_LOONGSON2EF need software to maintain cache consistency
Pavel Tatashin <[email protected]>
mm: initialize deferred pages with interrupts enabled
Andrea Arcangeli <[email protected]>
mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked()
Christophe Leroy <[email protected]>
powerpc/mm: Fix conditions to perform MMU specific management by blocks on PPC32.
Filipe Manana <[email protected]>
btrfs: fix space_info bytes_may_use underflow during space cache writeout
Filipe Manana <[email protected]>
btrfs: fix space_info bytes_may_use underflow after nocow buffered write
Filipe Manana <[email protected]>
btrfs: fix wrong file range cleanup after an error filling dealloc range
Filipe Manana <[email protected]>
btrfs: fix corrupt log due to concurrent fsync of inodes with shared extents
Omar Sandoval <[email protected]>
btrfs: fix error handling when submitting direct I/O bio
Qu Wenruo <[email protected]>
btrfs: reloc: fix reloc root leak and NULL pointer dereference
Josef Bacik <[email protected]>
btrfs: force chunk allocation if our global rsv is larger than metadata
Marcos Paulo de Souza <[email protected]>
btrfs: send: emit file capabilities after chown
Filipe Manana <[email protected]>
btrfs: fix a race between scrub and block group removal/allocation
Anand Jain <[email protected]>
btrfs: include non-missing as a qualifier for the latest_bdev
Anand Jain <[email protected]>
btrfs: free alien device after device add
Daniel Axtens <[email protected]>
string.h: fix incompatibility between FORTIFY_SOURCE and KASAN
Daniel Axtens <[email protected]>
kasan: stop tests being eliminated as dead code with FORTIFY_SOURCE
Ilya Leoshkevich <[email protected]>
s390/bpf: Maintain 8-byte stack alignment
Daniel Borkmann <[email protected]>
bpf: Fix up bpf_skb_adjust_room helper's skb csum setting
Jakub Sitnicki <[email protected]>
selftests/bpf, flow_dissector: Close TAP device FD after the test
John Fastabend <[email protected]>
bpf: Fix running sk_skb program types with ktls
John Fastabend <[email protected]>
bpf: Refactor sockmap redirect code so its easy to reuse
Anton Protopopov <[email protected]>
bpf: Fix map permissions check
Eelco Chaudron <[email protected]>
libbpf: Fix perf_buffer__free() API for sparse allocs
Chris Chiu <[email protected]>
platform/x86: asus_wmi: Reserve more space for struct bias_args
Hans de Goede <[email protected]>
platform/x86: intel-vbtn: Only blacklist SW_TABLET_MODE on the 9 / "Laptop" chasis-type
Nickolai Kozachenko <[email protected]>
platform/x86: intel-hid: Add a quirk to support HP Spectre X2 (2015)
Jesse Brandeburg <[email protected]>
ice: Fix inability to set channels when down
Andy Shevchenko <[email protected]>
platform/x86: hp-wmi: Convert simple_strtoul() to kstrtou32()
Pavel Begunkov <[email protected]>
io_uring: fix overflowed reqs cancellation
Angelo Dureghello <[email protected]>
spi: spi-fsl-dspi: fix native data copy
Qiushi Wu <[email protected]>
cpuidle: Fix three reference count leaks
Serge Semin <[email protected]>
spi: dw: Return any value retrieved from the dma_transfer callback
Haibo Chen <[email protected]>
mmc: sdhci-esdhc-imx: fix the mask for tuning start point
Sharon <[email protected]>
iwlwifi: mvm: fix aux station leak
Xie XiuQi <[email protected]>
ixgbe: fix signed-integer-overflow warning
Jacob Keller <[email protected]>
ice: fix potential double free in probe unrolling
Angelo Dureghello <[email protected]>
mmc: sdhci: add quirks for be to le byte swapping
Ulf Hansson <[email protected]>
mmc: via-sdmmc: Respect the cmd->busy_timeout from the mmc core
Ulf Hansson <[email protected]>
mmc: owl-mmc: Respect the cmd->busy_timeout from the mmc core
Ulf Hansson <[email protected]>
staging: greybus: sdio: Respect the cmd->busy_timeout from the mmc core
Veerabhadrarao Badiganti <[email protected]>
mmc: sdhci-msm: Set SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 quirk
Marek Vasut <[email protected]>
mmc: mmci: Switch to mmc_regulator_set_vqmmc()
Coly Li <[email protected]>
bcache: fix refcount underflow in bcache_device_free()
YuanJunQing <[email protected]>
MIPS: Fix IRQ tracing when call handle_fpe() and handle_msa_fpe()
Jiaxun Yang <[email protected]>
PCI: Don't disable decoding when mmio_always_on is set
Alexander Sverdlin <[email protected]>
macvlan: Skip loopback packets in RX handler
Sagi Grimberg <[email protected]>
nvmet: fix memory leak when removing namespaces and controllers concurrently
Weiping Zhang <[email protected]>
nvme-pci: make sure write/poll_queues less or equal then cpu count
Fugang Duan <[email protected]>
net: ethernet: fec: move GPR register offset and bit into DT
Paul Menzel <[email protected]>
ACPI: video: Use native backlight on Acer TravelMate 5735Z
Qu Wenruo <[email protected]>
btrfs: qgroup: mark qgroup inconsistent if we're inherting snapshot to a new qgroup
Josef Bacik <[email protected]>
btrfs: improve global reserve stealing logic
Finn Thain <[email protected]>
m68k: mac: Don't call via_flush_cache() on Mac IIfx
Kaige Li <[email protected]>
MIPS: tools: Fix resource leak in elf-entry.c
Ben Hutchings <[email protected]>
MIPS: Fix exception handler memcpy()
Arvind Sankar <[email protected]>
x86/mm: Stop printing BRK addresses
Brett Creeley <[email protected]>
ice: Fix Tx timeout when link is toggled on a VF's interface
Alan Maguire <[email protected]>
selftests/bpf: CONFIG_LIRC required for test_lirc_mode2.sh
Alan Maguire <[email protected]>
selftests/bpf: CONFIG_IPV6_SEG6_BPF required for test_seg6_loop.o
Felix Kuehling <[email protected]>
drm/amdgpu: Sync with VM root BO when switching VM to CPU update mode
chen gong <[email protected]>
drm/amd/powerpay: Disable gfxoff when setting manual mode on picasso and raven
Nicolas Toromanoff <[email protected]>
crypto: stm32/crc32 - fix multi-instance
Nicolas Toromanoff <[email protected]>
crypto: stm32/crc32 - fix run-time self test issue.
Nicolas Toromanoff <[email protected]>
crypto: stm32/crc32 - fix ext4 chksum BUG_ON()
Serge Semin <[email protected]>
mips: Add udelay lpj numbers adjustment
Eric Joyner <[email protected]>
ice: Fix resource leak on early exit from function
Jesse Brandeburg <[email protected]>
ice: cleanup vf_id signedness
Serge Semin <[email protected]>
mips: MAAR: Use more precise address mask
Huaixin Chang <[email protected]>
sched: Defend cfs and rt bandwidth quota against overflow
Brian Foster <[email protected]>
xfs: don't fail verifier on empty attr3 leaf block
Arvind Sankar <[email protected]>
x86/boot: Correct relocation destination on old linkers
Douglas Anderson <[email protected]>
kgdboc: Use a platform device to handle tty drivers showing up late
Pali Rohár <[email protected]>
mwifiex: Fix memory corruption in dump_station
Dan Carpenter <[email protected]>
rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup()
Alex Elder <[email protected]>
net: ipa: do not clear interrupt in gsi_channel_start()
Stanislav Fomichev <[email protected]>
selftests/bpf: Fix test_align verifier log patterns
Erez Shitrit <[email protected]>
net/mlx5e: IPoIB, Drop multicast packets that this interface sent
Jens Axboe <[email protected]>
io_uring: allow POLL_ADD with double poll_wait() users
Arnd Bergmann <[email protected]>
crypto: blake2b - Fix clang optimization for ARMv7-M
Jesper Dangaard Brouer <[email protected]>
veth: Adjust hard_start offset on redirect XDP frames
Tejun Heo <[email protected]>
iocost: don't let vrate run wild while there's no saturation signal
Coly Li <[email protected]>
raid5: remove gfp flags from scribble_alloc()
Guoqing Jiang <[email protected]>
md: don't flush workqueue unconditionally in md_open
Chung-Hsien Hsu <[email protected]>
brcmfmac: fix WPA/WPA2-PSK 4-way handshake offload and SAE offload failures
Yauheni Kaliuta <[email protected]>
selftests/bpf: Install generated test progs
Ryder Lee <[email protected]>
mt76: avoid rx reorder buffer overflow
Lorenzo Bianconi <[email protected]>
mt76: mt7615: fix mt7615_driver_own routine
Lorenzo Bianconi <[email protected]>
mt76: mt7615: fix mt7615_firmware_own for mt7663e
Lorenzo Bianconi <[email protected]>
mt76: mt7663: fix DMA unmap length
Lorenzo Bianconi <[email protected]>
mt76: mt7622: fix DMA unmap length
Lorenzo Bianconi <[email protected]>
mt76: mt7615: do not always reset the dfs state setting the channel
Lorenzo Bianconi <[email protected]>
mt76: mt7663: fix mt7615_mac_cca_stats_reset routine
Wei Yongjun <[email protected]>
drm/mcde: dsi: Fix return value check in mcde_dsi_bind()
Bhupesh Sharma <[email protected]>
net: qed*: Reduce RX and TX default ring count when running inside kdump kernel
Christophe JAILLET <[email protected]>
wcn36xx: Fix error handling path in 'wcn36xx_probe()'
Rakesh Pillai <[email protected]>
ath10k: Remove msdu from idr when management pkt send fails
Rakesh Pillai <[email protected]>
ath10k: Skip handling del_server during driver exit
Sagi Grimberg <[email protected]>
nvme-tcp: use bh_lock in data_ready
Weiping Zhang <[email protected]>
nvme-pci: align io queue count with allocted nvme_queue in nvme_probe
Arnd Bergmann <[email protected]>
nvme-fc: avoid gcc-10 zero-length-bounds warning
Christoph Hellwig <[email protected]>
nvme: refine the Qemu Identify CNS quirk
Mordechay Goodstein <[email protected]>
iwlwifi: avoid debug max amsdu config overwriting itself
Hans de Goede <[email protected]>
platform/x86: intel-vbtn: Also handle tablet-mode switch on "Detachable" and "Portable" chassis-types
Hans de Goede <[email protected]>
platform/x86: intel-vbtn: Do not advertise switches to userspace if they are not there
Hans de Goede <[email protected]>
platform/x86: intel-vbtn: Split keymap into buttons and switches parts
Hans de Goede <[email protected]>
platform/x86: intel-vbtn: Use acpi_evaluate_integer()
Brian Foster <[email protected]>
xfs: fix duplicate verification from xfs_qm_dqflush()
Brian Foster <[email protected]>
xfs: reset buffer write failure state on successful completion
Daniel Thompson <[email protected]>
kgdb: Fix spurious true from in_dbg_master()
Serge Semin <[email protected]>
mips: cm: Fix an invalid error code of INTVN_*_ERR
Jiaxun Yang <[email protected]>
MIPS: Truncate link address into 32bit for 32bit kernel
Arnd Bergmann <[email protected]>
dsa: sja1105: dynamically allocate stats structure
Devulapally Shiva Krishna <[email protected]>
Crypto/chcr: fix for ccm(aes) failed test
Devulapally Shiva Krishna <[email protected]>
Crypto/chcr: fix ctr, cbc, xts and rfc3686-ctr failed tests
Darrick J. Wong <[email protected]>
xfs: clean up the error handling in xfs_swap_extents
Colin Ian King <[email protected]>
libertas_tf: avoid a null dereference in pointer priv
Tamizh Chelvam <[email protected]>
ath11k: fix kernel panic by freeing the msdu received with invalid length
Jeremy Kerr <[email protected]>
powerpc/spufs: fix copy_to_user while atomic
Yunjian Wang <[email protected]>
net: allwinner: Fix use correct return type for ndo_start_xmit()
Dan Carpenter <[email protected]>
media: cec: silence shift wrapping warning in __cec_s_log_addrs()
Christophe JAILLET <[email protected]>
media: sun8i: Fix an error handling path in 'deinterlace_runtime_resume()'
Wei Yongjun <[email protected]>
ath11k: fix error return code in ath11k_dp_alloc()
Wei Yongjun <[email protected]>
ath10k: fix possible memory leak in ath10k_bmi_lz_data_large()
Ansuel Smith <[email protected]>
cpufreq: qcom: fix wrong compatible binding
Wei Yongjun <[email protected]>
drivers: net: davinci_mdio: fix potential NULL dereference in davinci_mdio_probe()
Wei Yongjun <[email protected]>
selinux: fix error return code in policydb_read()
Wei Yongjun <[email protected]>
net: lpc-enet: fix error return code in lpc_mii_init()
Wei Yongjun <[email protected]>
ice: Fix error return code in ice_add_prof()
Wei Yongjun <[email protected]>
octeontx2-pf: Fix error return code in otx2_probe()
Tejun Heo <[email protected]>
iocost_monitor: drop string wrap around numbers when outputting json
Shaokun Zhang <[email protected]>
drivers/perf: hisi: Fix typo in events attribute array
Łukasz Stelmach <[email protected]>
arm64: kexec_file: print appropriate variable
Andy Shevchenko <[email protected]>
stmmac: intel: Fix clock handling on error and remove paths
Peter Zijlstra <[email protected]>
sched/core: Fix illegal RCU from offline CPUs
Jann Horn <[email protected]>
exit: Move preemption fixup up, move blocking operations down
Roi Dayan <[email protected]>
net/mlx5e: CT: Avoid false warning about rule may be used uninitialized
Nathan Chancellor <[email protected]>
lib/mpi: Fix 64-bit MIPS build with Clang
Doug Berger <[email protected]>
net: bcmgenet: Fix WoL with password after deep sleep
Doug Berger <[email protected]>
net: bcmgenet: set Rx mode before starting netif
Arnd Bergmann <[email protected]>
drm/bridge: fix stack usage warning on old gcc
Masahiro Yamada <[email protected]>
ARM: 8969/1: decompressor: simplify libfdt builds
Sean Young <[email protected]>
media: m88ds3103: error in set_frontend is swallowed and not reported
Andrii Nakryiko <[email protected]>
selftests/bpf: Add runqslower binary to .gitignore
Andrii Nakryiko <[email protected]>
selftests/bpf: Fix bpf_link leak in ns_current_pid_tgid selftest
Andrii Nakryiko <[email protected]>
libbpf: Fix huge memory leak in libbpf_find_vmlinux_btf_id()
Andrii Nakryiko <[email protected]>
selftests/bpf: Fix invalid memory reads in core_relo selftest
Andrii Nakryiko <[email protected]>
selftests/bpf: Fix memory leak in extract_build_id()
Andrii Nakryiko <[email protected]>
selftests/bpf: Fix memory leak in test selector
Andrii Nakryiko <[email protected]>
selftests/bpf: Ensure test flavors use correct skeletons
Andrii Nakryiko <[email protected]>
libbpf: Refactor map creation logic and fix cleanup leak
Sung Lee <[email protected]>
drm/amd/display: Do not disable pipe split if mode is not supported
Alain Michaud <[email protected]>
Bluetooth: Adding driver and quirk defs for multi-role LE
Wei Yongjun <[email protected]>
ath11k: use GFP_ATOMIC under spin lock
Pablo Neira Ayuso <[email protected]>
netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported
Luke Nelson <[email protected]>
bpf, riscv: Fix tail call count off by one in RV32 BPF JIT
Zou Wei <[email protected]>
net/mlx4_core: Add missing iounmap() in error path
Christoph Hellwig <[email protected]>
bcache: remove a duplicate ->make_request_fn assignment
Jesper Dangaard Brouer <[email protected]>
dpaa2-eth: fix return codes used in ndo_setup_tc
Ard Biesheuvel <[email protected]>
efi/libstub/random: Align allocate size to EFI_ALLOC_ALIGN
Andrea Parri (Microsoft) <[email protected]>
Drivers: hv: vmbus: Always handle the VMBus messages on CPU0
Paul Hsieh <[email protected]>
drm/amd/display: dmcu wait loop calculation is incorrect in RV
Dale Zhao <[email protected]>
drm/amd/display: Correct updating logic of dcn21's pipe VM flags
Paul Moore <[email protected]>
audit: fix a net reference leak in audit_list_rules_send()
Hans de Goede <[email protected]>
Bluetooth: btbcm: Add 2 missing models to subver tables
Wen Gong <[email protected]>
ath10k: add flush tx packets for SDIO chip
Tiezhu Yang <[email protected]>
MIPS: Make sparse_init() using top-down allocation
Kieran Bingham <[email protected]>
media: platform: fcp: Set appropriate DMA parameters
Philipp Zabel <[email protected]>
media: imx: utils: fix media bus format enumeration
Philipp Zabel <[email protected]>
media: imx: utils: fix and simplify pixel format enumeration
Colin Ian King <[email protected]>
media: dvb: return -EREMOTEIO on i2c transfer failure.
Paul Moore <[email protected]>
audit: fix a net reference leak in audit_send_reply()
Jitao Shi <[email protected]>
drm/mediatek: set dpi pin mode to gpio low to avoid leakage current
Jitao Shi <[email protected]>
dt-bindings: display: mediatek: control dpi pins mode to avoid leakage
Thomas Zimmermann <[email protected]>
drm/ast: Allocate initial CRTC state of the correct size
Vladimir Oltean <[email protected]>
net: mscc: ocelot: deal with problematic MAC_ETYPE VCAP IS2 rules
Kees Cook <[email protected]>
e1000: Distribute switch variables for initialization
Stephane Eranian <[email protected]>
tools api fs: Make xxx__mountpoint() more scalable
Bjorn Andersson <[email protected]>
regulator: qcom-rpmh: Fix typos in pm8150 and pm8150l
Jaehoon Chung <[email protected]>
brcmfmac: fix wrong location to get firmware feature
Andy Shevchenko <[email protected]>
spi: Respect DataBitLength field of SpiSerialBusV2() ACPI resource
Mansur Alisha Shaik <[email protected]>
media: venus: core: remove CNOC voting while device suspend
Bingbu Cao <[email protected]>
media: staging/intel-ipu3: Implement lock for stream on/off operations
Alvin Lee <[email protected]>
drm/amd/display: Revert to old formula in set_vtg_params
Venkateswara Naralasetty <[email protected]>
ath10k: fix kernel null pointer dereference
Sriram R <[email protected]>
ath11k: Avoid mgmt tx count underflow
Tian Tao <[email protected]>
drm/hisilicon: Enforce 128-byte stride alignment to fix the hardware limitation
Colin Ian King <[email protected]>
ath11k: fix error message to correctly report the command that failed
Kees Cook <[email protected]>
ubsan: entirely disable alignment checks under UBSAN_TRAP
Christoph Hellwig <[email protected]>
staging: android: ion: use vmap instead of vm_map_ram
Christoph Hellwig <[email protected]>
x86: fix vmap arguments in map_irq_stack
Ayush Sawal <[email protected]>
Crypto/chcr: Fixes a coccinile check error
Jia-Ju Bai <[email protected]>
net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss()
Jon Doron <[email protected]>
x86/kvm/hyper-v: Explicitly align hcall param for kvm_hyperv_exit
Paul M Stillwell Jr <[email protected]>
ice: fix PCI device serial number to be lowercase values
Serge Semin <[email protected]>
spi: dw: Fix Rx-only DMA transfers
Zijun Hu <[email protected]>
Bluetooth: hci_qca: Fix suspend/resume functionality failure
Chuhong Yuan <[email protected]>
Bluetooth: btmtkuart: Improve exception handling in btmtuart_probe()
Martin Blumenstingl <[email protected]>
mmc: meson-mx-sdio: trigger a soft reset after a timeout or CRC error
Ludovic Barre <[email protected]>
mmc: mmci_sdmmc: fix power on issue due to pwr_reg initialization
Marta Plantykow <[email protected]>
ice: Change number of XDP TxQ to 0 when destroying rings
Surabhi Boob <[email protected]>
ice: Fix for memory leaks and modify ICE_FREE_CQ_BUFS
Surabhi Boob <[email protected]>
ice: Fix memory leak
Darrick J. Wong <[email protected]>
xfs: more lockdep whackamole with kmem_alloc*
Sven Eckelmann <[email protected]>
batman-adv: Revert "disable ethtool link speed detection when auto negotiation off"
Linus Walleij <[email protected]>
ARM: 8978/1: mm: make act_mm() respect THREAD_SIZE
Peter Rosin <[email protected]>
spi: mux: repair mux usage
Filipe Manana <[email protected]>
btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums
Josef Bacik <[email protected]>
btrfs: account for trans_block_rsv in may_commit_transaction
Serge Semin <[email protected]>
clocksource: dw_apb_timer_of: Fix missing clockevent timers
Serge Semin <[email protected]>
clocksource: dw_apb_timer: Make CPU-affiliation being optional
Saravana Kannan <[email protected]>
clocksource/drivers/timer-versatile: Clear OF_POPULATED flag
Serge Semin <[email protected]>
spi: dw: Enable interrupts in accordance with DMA xfer mode
Serge Semin <[email protected]>
mips: Fix cpu_has_mips64r1/2 activation for MIPS32 CPUs
Mark Pearson <[email protected]>
drm/dp: Lenovo X13 Yoga OLED panel brightness fix
Tuan Phan <[email protected]>
ACPI/IORT: Fix PMCG node single ID mapping handling
Christophe JAILLET <[email protected]>
ath11k: Fix some resource leaks in error path in 'ath11k_thermal_register()'
Jean-Philippe Brucker <[email protected]>
pmu/smmuv3: Clear IRQ affinity hint on device removal
Douglas Anderson <[email protected]>
kgdb: Prevent infinite recursive entries to the debugger
Douglas Anderson <[email protected]>
kgdb: Disable WARN_CONSOLE_UNLOCKED for all kgdb
Hsin-Yu Chao <[email protected]>
Bluetooth: Add SCO fallback for invalid LMP parameters error
Dafna Hirschfeld <[email protected]>
media: i2c: imx219: Fix a bug in imx219_enum_frame_size
Jens Axboe <[email protected]>
io_uring: cleanup io_poll_remove_one() logic
Tiezhu Yang <[email protected]>
MIPS: Loongson: Build ATI Radeon GPU driver as module
Ulf Hansson <[email protected]>
cpuidle: psci: Fixup execution order when entering a domain idle state
Koba Ko <[email protected]>
platform/x86: dell-laptop: don't register micmute LED if there is no token
Jesper Dangaard Brouer <[email protected]>
ixgbe: Fix XDP redirect on archs with PAGE_SIZE above 4K
Jeremy Cline <[email protected]>
lockdown: Allow unprivileged users to see lockdown status
Tomohito Esaki <[email protected]>
drm: rcar-du: Set primary plane zpos immutably at initializing
Weiping Zhang <[email protected]>
block: reset mapping if failed to update hardware queue count
Lorenzo Bianconi <[email protected]>
mt76: mt7615: fix aid configuration in mt7615_mcu_wtbl_generic_tlv
Prarit Bhargava <[email protected]>
tools/power/x86/intel-speed-select: Fix CLX-N package information output
Luke Nelson <[email protected]>
arm64: insn: Fix two bugs in encoding 32-bit logical immediates
Ming Lei <[email protected]>
block: alloc map and request for new hardware queue
Erik Kaneda <[email protected]>
ACPICA: Dispatcher: add status checks
Ioana Ciornei <[email protected]>
soc: fsl: dpio: properly compute the consumer index
Andy Shevchenko <[email protected]>
spi: dw: Zero DMA Tx and Rx configurations on stack
Dejin Zheng <[email protected]>
rtw88: fix an issue about leak system resources
Ian Rogers <[email protected]>
libperf evlist: Fix a refcount leak
Tomasz Figa <[email protected]>
media: staging: ipu3: Fix stale list entries on parameter queue failure
Daniel Thompson <[email protected]>
arm64: cacheflush: Fix KGDB trap detection
Wen Gong <[email protected]>
ath10k: remove the max_sched_scan_reqs value
Ard Biesheuvel <[email protected]>
efi/libstub/x86: Work around LLVM ELF quirk build regression
Arthur Kiyanovski <[email protected]>
net: ena: fix error returning in ena_com_get_hash_function()
Mark Starovoytov <[email protected]>
net: atlantic: make hw_get_regs optional
Huaixin Chang <[email protected]>
sched/fair: Refill bandwidth before scaling
Peter Zijlstra <[email protected]>
x86,smap: Fix smap_{save,restore}() alternatives
Evan Green <[email protected]>
spi: pxa2xx: Apply CS clk quirk to BXT
Andrii Nakryiko <[email protected]>
libbpf: Fix memory leak and possible double-free in hashmap__clear
Veronika Kabatova <[email protected]>
selftests/bpf: Copy runqslower to OUTPUT directory
Gavin Shan <[email protected]>
arm64/kernel: Fix range on invalidating dcache for boot page tables
Wei Yongjun <[email protected]>
net: ethernet: ti: fix return value check in k3_cppi_desc_pool_create_name()
Enric Balletbo i Serra <[email protected]>
drm/bridge: panel: Return always an error pointer in drm_panel_bridge_add()
limingyu <[email protected]>
drm/amdgpu: Init data to avoid oops while reading pp_num_states.
Geert Uytterhoeven <[email protected]>
spi: spi-mem: Fix Dual/Quad modes on Octal-capable devices
Dmytro Laktyushkin <[email protected]>
drm/amd/display: fix virtual signal dsc setup
Joshua Aberback <[email protected]>
drm/amd/display: Force watermark value propagation
Julien Thierry <[email protected]>
objtool: Ignore empty alternatives
Hans Verkuil <[email protected]>
media: v4l2-ctrls: v4l2_ctrl_g/s_ctrl*(): don't continue when WARN_ON
Brad Love <[email protected]>
media: si2157: Better check for running tuner in init
Dan Carpenter <[email protected]>
media: vicodec: Fix error codes in probe function
Mauro Carvalho Chehab <[email protected]>
scripts: sphinx-pre-install: address some issues with Gentoo
Andre Guedes <[email protected]>
igc: Fix default MAC address filter override
Arnd Bergmann <[email protected]>
crypto: ccp -- don't "select" CONFIG_DMADEVICES
Laurent Pinchart <[email protected]>
media: imx: imx7-mipi-csis: Cleanup and fix subdev pad format handling
Bingbu Cao <[email protected]>
media: staging: imgu: do not hold spinlock during freeing mmu page table
Bogdan Togorean <[email protected]>
drm: bridge: adv7511: Extend list of audio sample rates
Maharaja Kennadyrajan <[email protected]>
ath10k: Fix the race condition in firmware dump work queue
Christian König <[email protected]>
drm/amdgpu: fix and cleanup amdgpu_gem_object_close v4
Ard Biesheuvel <[email protected]>
ACPI: GED: use correct trigger type field in _Exx / _Lxx handling
-------------
Diffstat:
.../bindings/display/mediatek/mediatek,dpi.txt | 6 + Documentation/virt/kvm/api.rst | 2 + Makefile | 17 +- arch/alpha/include/asm/io.h | 74 ++++-- arch/alpha/kernel/io.c | 60 ++++- arch/arm/boot/compressed/.gitignore | 9 - arch/arm/boot/compressed/Makefile | 38 ++-- arch/arm/boot/compressed/atags_to_fdt.c | 1 + arch/arm/boot/compressed/fdt.c | 2 + arch/arm/boot/compressed/fdt_ro.c | 2 + arch/arm/boot/compressed/fdt_rw.c | 2 + arch/arm/boot/compressed/fdt_wip.c | 2 + arch/arm/boot/compressed/libfdt_env.h | 24 -- arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts | 2 +- arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi | 2 +- arch/arm/boot/dts/s5pv210-aries.dtsi | 1 + arch/arm/mach-tegra/tegra.c | 4 +- arch/arm/mm/proc-macros.S | 3 +- arch/arm64/include/asm/cacheflush.h | 6 +- arch/arm64/include/asm/pgtable.h | 1 + arch/arm64/kernel/head.S | 12 +- arch/arm64/kernel/insn.c | 14 +- arch/arm64/kernel/machine_kexec_file.c | 6 +- arch/arm64/kernel/vmlinux.lds.S | 1 + arch/m68k/include/asm/mac_via.h | 1 + arch/m68k/mac/config.c | 21 +- arch/m68k/mac/via.c | 6 +- arch/mips/Makefile | 13 +- arch/mips/boot/compressed/Makefile | 2 +- arch/mips/configs/loongson3_defconfig | 2 +- arch/mips/include/asm/cpu-features.h | 6 +- arch/mips/include/asm/mipsregs.h | 2 +- arch/mips/kernel/genex.S | 6 +- arch/mips/kernel/mips-cm.c | 6 +- arch/mips/kernel/setup.c | 10 + arch/mips/kernel/time.c | 70 ++++++ arch/mips/kernel/vmlinux.lds.S | 2 +- arch/mips/loongson2ef/common/init.c | 4 +- arch/mips/loongson64/init.c | 4 +- arch/mips/mm/dma-noncoherent.c | 1 + arch/mips/mti-malta/malta-init.c | 8 +- arch/mips/pistachio/init.c | 8 +- arch/mips/tools/elf-entry.c | 9 +- arch/powerpc/Kconfig | 4 +- arch/powerpc/include/asm/book3s/32/kup.h | 3 +- arch/powerpc/include/asm/fadump-internal.h | 4 +- arch/powerpc/include/asm/kasan.h | 6 +- arch/powerpc/kernel/dt_cpu_ftrs.c | 8 + arch/powerpc/kernel/fadump.c | 155 +++++++++---- arch/powerpc/kernel/prom.c | 19 ++ arch/powerpc/mm/init_32.c | 2 - arch/powerpc/mm/kasan/kasan_init_32.c | 4 +- arch/powerpc/mm/pgtable_32.c | 4 +- arch/powerpc/platforms/cell/spufs/file.c | 113 ++++++---- arch/powerpc/platforms/powernv/smp.c | 1 - arch/riscv/mm/init.c | 11 - arch/riscv/net/bpf_jit_comp32.c | 5 +- arch/s390/net/bpf_jit_comp.c | 19 +- arch/sparc/kernel/ptrace_32.c | 228 ++++++++----------- arch/sparc/kernel/ptrace_64.c | 17 +- arch/x86/boot/compressed/head_32.S | 5 +- arch/x86/boot/compressed/head_64.S | 1 + arch/x86/include/asm/smap.h | 11 +- arch/x86/kernel/amd_nb.c | 5 + arch/x86/kernel/irq_64.c | 2 +- arch/x86/mm/init.c | 2 - block/blk-iocost.c | 28 ++- block/blk-mq.c | 26 +-- block/blk.h | 2 + crypto/blake2b_generic.c | 4 +- drivers/acpi/acpica/dsfield.c | 17 +- drivers/acpi/arm64/iort.c | 5 + drivers/acpi/evged.c | 2 +- drivers/acpi/video_detect.c | 10 + drivers/base/swnode.c | 27 ++- drivers/bluetooth/btbcm.c | 2 + drivers/bluetooth/btmtkuart.c | 14 +- drivers/bluetooth/btusb.c | 1 + drivers/bluetooth/hci_bcm.c | 8 +- drivers/bluetooth/hci_qca.c | 10 +- drivers/clk/mediatek/clk-mux.c | 2 +- drivers/clocksource/Kconfig | 1 + drivers/clocksource/dw_apb_timer.c | 5 +- drivers/clocksource/dw_apb_timer_of.c | 6 +- drivers/clocksource/timer-versatile.c | 3 + drivers/cpufreq/qcom-cpufreq-nvmem.c | 2 +- drivers/cpuidle/cpuidle-psci.c | 8 +- drivers/cpuidle/sysfs.c | 6 +- drivers/crypto/ccp/Kconfig | 3 +- drivers/crypto/chelsio/chcr_algo.c | 45 ++-- drivers/crypto/chelsio/chcr_crypto.h | 1 + drivers/crypto/stm32/stm32-crc32.c | 144 +++++++----- drivers/edac/amd64_edac.c | 14 ++ drivers/edac/amd64_edac.h | 3 + drivers/firmware/efi/libstub/Makefile | 1 + drivers/firmware/efi/libstub/randomalloc.c | 4 +- drivers/gnss/sirf.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 43 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 11 +- .../dc/clk_mgr/dcn10/rv1_clk_mgr_vbios_smu.c | 3 - drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c | 2 +- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c | 6 +- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 5 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +- .../gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 6 +- drivers/gpu/drm/amd/display/dc/inc/hw/dchubbub.h | 2 + drivers/gpu/drm/ast/ast_mode.c | 13 +- drivers/gpu/drm/bridge/adv7511/adv7511_audio.c | 12 +- drivers/gpu/drm/bridge/panel.c | 6 +- drivers/gpu/drm/bridge/tc358768.c | 4 +- drivers/gpu/drm/drm_dp_helper.c | 1 + drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 9 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 4 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c | 2 +- drivers/gpu/drm/mcde/mcde_dsi.c | 7 +- drivers/gpu/drm/mediatek/mtk_dpi.c | 31 +++ drivers/gpu/drm/rcar-du/rcar_du_plane.c | 16 +- drivers/gpu/drm/rcar-du/rcar_du_vsp.c | 14 +- drivers/hv/connection.c | 20 +- drivers/hv/hv.c | 7 + drivers/hv/hyperv_vmbus.h | 11 +- drivers/hv/vmbus_drv.c | 20 +- drivers/hwmon/k10temp.c | 1 + drivers/iommu/intel-iommu.c | 28 ++- drivers/irqchip/irq-sifive-plic.c | 17 +- drivers/macintosh/windfarm_pm112.c | 21 +- drivers/md/bcache/request.c | 1 - drivers/md/bcache/super.c | 7 +- drivers/md/dm-crypt.c | 2 +- drivers/md/md.c | 3 +- drivers/md/raid5.c | 15 +- drivers/media/cec/cec-adap.c | 8 +- drivers/media/dvb-frontends/m88ds3103.c | 2 + drivers/media/i2c/imx219.c | 2 +- drivers/media/i2c/ov5640.c | 4 +- drivers/media/platform/qcom/venus/core.c | 12 +- drivers/media/platform/rcar-fcp.c | 5 + drivers/media/platform/sunxi/sun8i-di/sun8i-di.c | 6 +- drivers/media/platform/vicodec/vicodec-core.c | 15 +- drivers/media/tuners/si2157.c | 15 +- drivers/media/usb/dvb-usb/dibusb-mb.c | 2 +- drivers/media/v4l2-core/v4l2-ctrls.c | 18 +- drivers/memory/samsung/exynos5422-dmc.c | 2 +- drivers/mmc/host/meson-mx-sdio.c | 3 + drivers/mmc/host/mmci.c | 30 +-- drivers/mmc/host/mmci_stm32_sdmmc.c | 1 + drivers/mmc/host/owl-mmc.c | 8 +- drivers/mmc/host/sdhci-esdhc-imx.c | 2 +- drivers/mmc/host/sdhci-msm.c | 4 +- drivers/mmc/host/sdhci.c | 10 +- drivers/mmc/host/sdhci.h | 3 + drivers/mmc/host/via-sdmmc.c | 7 +- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 11 +- drivers/mtd/nand/raw/diskonchip.c | 7 +- drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c | 2 +- drivers/mtd/nand/raw/mtk_nand.c | 2 +- drivers/mtd/nand/raw/nand_base.c | 10 +- drivers/mtd/nand/raw/nand_onfi.c | 2 +- drivers/mtd/nand/raw/orion_nand.c | 2 +- drivers/mtd/nand/raw/oxnas_nand.c | 8 +- drivers/mtd/nand/raw/pasemi_nand.c | 4 +- drivers/mtd/nand/raw/plat_nand.c | 2 +- drivers/mtd/nand/raw/sharpsl.c | 2 +- drivers/mtd/nand/raw/socrates_nand.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 2 +- drivers/mtd/nand/raw/tmio_nand.c | 2 +- drivers/mtd/nand/raw/xway_nand.c | 2 +- drivers/net/dsa/sja1105/sja1105_ethtool.c | 144 ++++++------ drivers/net/ethernet/allwinner/sun4i-emac.c | 4 +- drivers/net/ethernet/amazon/ena/ena_com.c | 6 +- drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 6 + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 + drivers/net/ethernet/broadcom/genet/bcmgenet.h | 2 + drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 39 ++-- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 +- drivers/net/ethernet/freescale/fec_main.c | 24 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 4 +- drivers/net/ethernet/intel/e1000e/e1000.h | 1 - drivers/net/ethernet/intel/e1000e/netdev.c | 16 +- drivers/net/ethernet/intel/ice/ice.h | 2 +- drivers/net/ethernet/intel/ice/ice_common.c | 8 +- drivers/net/ethernet/intel/ice/ice_controlq.c | 49 ++-- drivers/net/ethernet/intel/ice/ice_ethtool.c | 4 - drivers/net/ethernet/intel/ice/ice_flex_pipe.c | 8 +- drivers/net/ethernet/intel/ice/ice_main.c | 8 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 65 +++++- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.h | 2 +- drivers/net/ethernet/intel/igb/igb_ethtool.c | 3 +- drivers/net/ethernet/intel/igc/igc_main.c | 2 + drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 8 +- drivers/net/ethernet/mellanox/mlx4/crdump.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 15 +- drivers/net/ethernet/mscc/ocelot_ace.c | 103 ++++++++- drivers/net/ethernet/mscc/ocelot_ace.h | 5 +- drivers/net/ethernet/mscc/ocelot_flower.c | 2 +- drivers/net/ethernet/nxp/lpc_eth.c | 3 +- drivers/net/ethernet/qlogic/qede/qede.h | 2 + drivers/net/ethernet/qlogic/qede/qede_main.c | 11 +- drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 20 +- drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 5 - drivers/net/ethernet/ti/davinci_mdio.c | 2 + drivers/net/ethernet/ti/k3-cppi-desc-pool.c | 4 +- drivers/net/ipa/gsi.c | 11 +- drivers/net/macvlan.c | 4 + drivers/net/veth.c | 8 +- drivers/net/vmxnet3/vmxnet3_ethtool.c | 2 + drivers/net/wireless/ath/ath10k/bmi.c | 1 + drivers/net/wireless/ath/ath10k/htt.h | 7 + drivers/net/wireless/ath/ath10k/htt_tx.c | 8 +- drivers/net/wireless/ath/ath10k/mac.c | 5 +- drivers/net/wireless/ath/ath10k/pci.c | 1 + drivers/net/wireless/ath/ath10k/qmi.c | 13 +- drivers/net/wireless/ath/ath10k/qmi.h | 6 + drivers/net/wireless/ath/ath10k/txrx.c | 2 + drivers/net/wireless/ath/ath10k/wmi-ops.h | 10 + drivers/net/wireless/ath/ath10k/wmi-tlv.c | 15 ++ drivers/net/wireless/ath/ath11k/dp.c | 4 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 20 +- drivers/net/wireless/ath/ath11k/thermal.c | 6 +- drivers/net/wireless/ath/ath11k/wmi.c | 7 +- drivers/net/wireless/ath/carl9170/fw.c | 4 +- drivers/net/wireless/ath/carl9170/main.c | 21 +- drivers/net/wireless/ath/wcn36xx/main.c | 6 +- drivers/net/wireless/broadcom/b43/main.c | 2 +- drivers/net/wireless/broadcom/b43legacy/main.c | 1 + drivers/net/wireless/broadcom/b43legacy/xmit.c | 1 + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 12 +- .../wireless/broadcom/brcm80211/brcmfmac/feature.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 11 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 5 +- drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 15 +- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 18 +- drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 6 +- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 6 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 14 +- drivers/net/wireless/mediatek/mt76/agg-rx.c | 8 +- drivers/net/wireless/mediatek/mt76/mt76.h | 6 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 34 ++- drivers/net/wireless/mediatek/mt76/mt7615/mac.h | 3 + drivers/net/wireless/mediatek/mt76/mt7615/main.c | 21 +- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7615/regs.h | 2 + drivers/net/wireless/realtek/rtlwifi/usb.c | 8 +- drivers/net/wireless/realtek/rtw88/pci.c | 1 + drivers/nvme/host/core.c | 16 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 79 ++++--- drivers/nvme/host/tcp.c | 4 +- drivers/nvme/target/core.c | 15 +- drivers/pci/probe.c | 24 +- drivers/pci/quirks.c | 48 +++- drivers/perf/arm_smmuv3_pmu.c | 5 +- drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 2 +- drivers/pinctrl/samsung/pinctrl-exynos.c | 82 +++++-- drivers/platform/x86/asus-wmi.c | 2 + drivers/platform/x86/dell-laptop.c | 11 +- drivers/platform/x86/hp-wmi.c | 10 +- drivers/platform/x86/intel-hid.c | 7 + drivers/platform/x86/intel-vbtn.c | 75 +++++-- drivers/power/reset/vexpress-poweroff.c | 1 + drivers/power/supply/power_supply_hwmon.c | 4 +- drivers/pwm/pwm-jz4740.c | 6 +- drivers/pwm/pwm-lpss.c | 15 +- drivers/regulator/qcom-rpmh-regulator.c | 8 +- drivers/soc/fsl/dpio/qbman-portal.c | 1 + drivers/soc/tegra/Kconfig | 1 + drivers/spi/spi-dw-mid.c | 16 +- drivers/spi/spi-dw.c | 8 +- drivers/spi/spi-fsl-dspi.c | 24 +- drivers/spi/spi-mem.c | 10 +- drivers/spi/spi-mux.c | 8 +- drivers/spi/spi-pxa2xx.c | 1 + drivers/spi/spi.c | 1 + drivers/staging/android/ion/ion_heap.c | 4 +- drivers/staging/greybus/sdio.c | 10 +- drivers/staging/media/imx/imx-media-utils.c | 201 ++++++----------- drivers/staging/media/imx/imx7-mipi-csis.c | 82 +++---- drivers/staging/media/ipu3/ipu3-mmu.c | 10 +- drivers/staging/media/ipu3/ipu3-v4l2.c | 10 + drivers/staging/media/ipu3/ipu3.c | 5 +- drivers/staging/media/ipu3/ipu3.h | 4 + drivers/staging/media/sunxi/cedrus/cedrus_dec.c | 2 + drivers/staging/media/sunxi/cedrus/cedrus_video.c | 3 - drivers/tty/serial/8250/8250_core.c | 14 +- drivers/tty/serial/8250/8250_pci.c | 6 - drivers/tty/serial/kgdboc.c | 126 ++++++++--- drivers/usb/musb/mediatek.c | 6 + drivers/virtio/virtio_balloon.c | 9 +- drivers/w1/masters/omap_hdq.c | 74 +++--- fs/btrfs/block-group.c | 2 +- fs/btrfs/block-rsv.c | 3 + fs/btrfs/ctree.h | 4 + fs/btrfs/disk-io.c | 5 +- fs/btrfs/extent-io-tree.h | 1 + fs/btrfs/file-item.c | 6 +- fs/btrfs/inode.c | 81 ++++++- fs/btrfs/qgroup.c | 14 ++ fs/btrfs/relocation.c | 12 +- fs/btrfs/scrub.c | 38 +++- fs/btrfs/send.c | 67 ++++++ fs/btrfs/space-info.c | 43 +++- fs/btrfs/space-info.h | 1 + fs/btrfs/transaction.c | 60 ++--- fs/btrfs/transaction.h | 3 +- fs/btrfs/tree-log.c | 22 +- fs/btrfs/volumes.c | 14 +- fs/ext4/ext4_extents.h | 9 +- fs/ext4/fsync.c | 28 ++- fs/ext4/ialloc.c | 1 + fs/ext4/xattr.c | 7 +- fs/f2fs/f2fs.h | 1 + fs/f2fs/inline.c | 6 +- fs/f2fs/super.c | 25 ++- fs/io_uring.c | 250 +++++++++++++-------- fs/jbd2/transaction.c | 14 +- fs/xfs/kmem.h | 6 +- fs/xfs/libxfs/xfs_attr_leaf.c | 17 +- fs/xfs/xfs_bmap_util.c | 2 +- fs/xfs/xfs_buf.c | 8 +- fs/xfs/xfs_dquot.c | 9 +- include/linux/intel-iommu.h | 1 + include/linux/kgdb.h | 2 +- include/linux/mmzone.h | 2 + include/linux/pci_ids.h | 7 + include/linux/property.h | 1 + include/linux/sched/mm.h | 2 + include/linux/skbuff.h | 8 + include/linux/skmsg.h | 8 + include/linux/string.h | 60 ++++- include/linux/sunrpc/gss_api.h | 1 + include/linux/sunrpc/svcauth_gss.h | 3 +- include/net/bluetooth/hci.h | 9 + include/net/tls.h | 9 + include/trace/events/btrfs.h | 1 + include/uapi/linux/bpf.h | 8 + include/uapi/linux/kvm.h | 2 + kernel/audit.c | 52 +++-- kernel/audit.h | 2 +- kernel/auditfilter.c | 16 +- kernel/bpf/syscall.c | 3 +- kernel/cpu.c | 18 +- kernel/cpu_pm.c | 4 +- kernel/debug/debug_core.c | 5 + kernel/exit.c | 25 ++- kernel/sched/core.c | 13 +- kernel/sched/fair.c | 4 +- kernel/sched/rt.c | 12 +- kernel/sched/sched.h | 2 + kernel/time/clocksource.c | 2 - lib/Kconfig.ubsan | 2 +- lib/mpi/longlong.h | 2 +- lib/test_kasan.c | 29 ++- lib/test_printf.c | 4 +- mm/huge_memory.c | 31 ++- mm/page_alloc.c | 27 +-- net/batman-adv/bat_v_elp.c | 15 +- net/bluetooth/hci_event.c | 1 + net/core/filter.c | 8 +- net/core/skmsg.c | 98 ++++++-- net/netfilter/nft_nat.c | 4 +- net/sunrpc/auth_gss/gss_mech_switch.c | 12 +- net/sunrpc/auth_gss/svcauth_gss.c | 18 +- net/tls/tls_sw.c | 20 +- scripts/sphinx-pre-install | 7 +- security/integrity/evm/evm_crypto.c | 2 +- security/integrity/ima/ima.h | 10 +- security/integrity/ima/ima_crypto.c | 53 ++++- security/integrity/ima/ima_init.c | 24 +- security/integrity/ima/ima_main.c | 3 + security/integrity/ima/ima_policy.c | 12 +- security/integrity/ima/ima_template_lib.c | 18 ++ security/lockdown/lockdown.c | 2 +- security/selinux/ss/policydb.c | 1 + tools/cgroup/iocost_monitor.py | 42 ++-- tools/include/uapi/linux/bpf.h | 8 + tools/lib/api/fs/fs.c | 17 ++ tools/lib/api/fs/fs.h | 12 + tools/lib/bpf/hashmap.c | 7 + tools/lib/bpf/libbpf.c | 236 ++++++++++--------- tools/lib/perf/evlist.c | 1 + tools/objtool/check.c | 6 + tools/perf/builtin-probe.c | 3 + tools/perf/util/dso.c | 16 ++ tools/perf/util/dso.h | 1 + tools/perf/util/probe-event.c | 46 ++-- tools/perf/util/probe-finder.c | 1 + tools/perf/util/symbol.c | 4 + tools/power/x86/intel-speed-select/isst-config.c | 1 + tools/testing/selftests/bpf/.gitignore | 2 +- tools/testing/selftests/bpf/Makefile | 6 +- tools/testing/selftests/bpf/config | 2 + .../testing/selftests/bpf/prog_tests/core_reloc.c | 2 +- .../selftests/bpf/prog_tests/flow_dissector.c | 1 + .../selftests/bpf/prog_tests/ns_current_pid_tgid.c | 5 +- tools/testing/selftests/bpf/test_align.c | 41 ++-- tools/testing/selftests/bpf/test_progs.c | 21 +- 400 files changed, 4012 insertions(+), 2017 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/376 ACPI: GED: use correct trigger type field in _Exx / _Lxx handling
From: Ard Biesheuvel <[email protected]>
commit e5c399b0bd6490c12c0af2a9eaa9d7cd805d52c9 upstream.
Commit ea6f3af4c5e63f69 ("ACPI: GED: add support for _Exx / _Lxx handler methods") added a reference to the 'triggering' field of either the normal or the extended ACPI IRQ resource struct, but inadvertently used the wrong pointer in the latter case. Note that both pointers refer to the same union, and the 'triggering' field appears at the same offset in both struct types, so it currently happens to work by accident. But let's fix it nonetheless
--- drivers/acpi/evged.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/evged.c +1 -1
@@ -94,7 +94,7 @@ static acpi_status acpi_ged_request_inte trigger = p->triggering; }else { gsi = pext->interrupts[0 ]; - trigger = p->triggering; + trigger = pext->triggering; } irq = r.start;
Greg Kroah-Hartman
maintainerPATCH 2/376 drm/amdgpu: fix and cleanup amdgpu_gem_object_close v4
In reply to Greg Kroah-HartmanFrom: Christian König <[email protected]>
[ Upstream commit 82c416b13cb7d22b96ec0888b296a48dff8a09eb ]
The problem is that we can't add the clear fence to the BO when there is an exclusive fence on it since we can't guarantee the the clear fence will complete after the exclusive one.
To fix this refactor the function and also add the exclusive fence as shared to the resv object.
v2: fix warning
v3: add excl fence as shared instead
v4: squash in fix for fence handling in amdgpu_gem_object_close
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 43 ++++++++++++++----------- 1 file changed, 25 insertions(+), 18 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +25 -18
@@ -161,16 +161,17 @@ void amdgpu_gem_object_close(struct drm_gem_object *obj,struct amdgpu_bo_list_entry vm_pd;struct list_head list, duplicates; +struct dma_fence *fence =NULL ;struct ttm_validate_buffer tv;struct ww_acquire_ctx ticket;struct amdgpu_bo_va *bo_va; -int r; +long r;INIT_LIST_HEAD (&list);INIT_LIST_HEAD (&duplicates); tv.bo = &bo->tbo; - tv.num_shared =1 ; + tv.num_shared =2 ;list_add (&tv.head, &list);amdgpu_vm_get_pd_bo (vm, &list, &vm_pd);
@@ -178,28 +179,34 @@ void amdgpu_gem_object_close(struct drm_gem_object *obj, r =ttm_eu_reserve_buffers (&ticket, &list, false, &duplicates);if (r) {dev_err (adev->dev,"leaking bo va because " -"we fail to reserve bo (%d)\n" , r); +"we fail to reserve bo (%ld)\n" , r);return ; } bo_va =amdgpu_vm_bo_find (vm, bo); -if (bo_va && --bo_va->ref_count ==0 ) { -amdgpu_vm_bo_rmv (adev, bo_va); - -if (amdgpu_vm_ready (vm)) { -struct dma_fence *fence =NULL ; +if (!bo_va || --bo_va->ref_count) + goto out_unlock; - r =amdgpu_vm_clear_freed (adev, vm, &fence); -if (unlikely (r)) { -dev_err (adev->dev,"failed to clear page " -"tables on GEM object close (%d)\n" , r); - } +amdgpu_vm_bo_rmv (adev, bo_va); +if (!amdgpu_vm_ready (vm)) + goto out_unlock; -if (fence) { -amdgpu_bo_fence (bo, fence, true); -dma_fence_put (fence); - } - } + fence =dma_resv_get_excl (bo->tbo.base.resv); +if (fence) { +amdgpu_bo_fence (bo, fence, true); + fence =NULL ; } + + r =amdgpu_vm_clear_freed (adev, vm, &fence); +if (r || !fence) + goto out_unlock; + +amdgpu_bo_fence (bo, fence, true); +dma_fence_put (fence); + +out_unlock: +if (unlikely (r <0 )) +dev_err (adev->dev,"failed to clear page " +"tables on GEM object close (%ld)\n" , r);ttm_eu_backoff_reservation (&ticket, &list); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 3/376 ath10k: Fix the race condition in firmware dump work queue
In reply to Greg Kroah-HartmanFrom: Maharaja Kennadyrajan <[email protected]>
[ Upstream commit 3d1c60460fb2823a19ead9e6ec8f184dd7271aa7 ]
There is a race condition, when the user writes 'hw-restart' and 'hard' in the simulate_fw_crash debugfs file without any delay. In the above scenario, the firmware dump work queue(scheduled by 'hard') should be handled gracefully, while the target is in the 'hw-restart'.
Tested HW: QCA9984
Tested FW: 10.4-3.9.0.2-00044
--- drivers/net/wireless/ath/ath10k/pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath10k/pci.c +1 -0
@@ -2074,6 +2074,7 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)ath10k_pci_irq_sync (ar);napi_synchronize (&ar->napi);napi_disable (&ar->napi); +cancel_work_sync (&ar_pci->dump_work);/* Most likely the device has HTT Rx ring configured. The only way to * prevent the device from accessing (and possible corrupting) host
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 4/376 drm: bridge: adv7511: Extend list of audio sample rates
In reply to Greg Kroah-HartmanFrom: Bogdan Togorean <[email protected]>
[ Upstream commit b97b6a1f6e14a25d1e1ca2a46c5fa3e2ca374e22 ]
ADV7511 support sample rates up to 192kHz. CTS and N parameters should be computed accordingly so this commit extend the list up to maximum supported sample rate.
--- drivers/gpu/drm/bridge/adv7511/adv7511_audio.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_audio.c +7 -5
@@ -19,13 +19,15 @@ static void adv7511_calc_cts_n(unsigned int f_tmds, unsigned int fs, {switch (fs) {case 32000 : - *n =4096 ; +case 48000 : +case 96000 : +case 192000 : + *n = fs *128 /1000 ;break ;case 44100 : - *n =6272 ; -break ; -case 48000 : - *n =6144 ; +case 88200 : +case 176400 : + *n = fs *128 /900 ;break ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 5/376 media: staging: imgu: do not hold spinlock during freeing mmu page table
In reply to Greg Kroah-HartmanFrom: Bingbu Cao <[email protected]>
[ Upstream commit e1ebe9f9c88e5a78fcc4670a9063c9b3cd87dda4 ]
ImgU need set the mmu page table in memory as uncached, and set back to write-back when free the page table by set_memory_wb(), set_memory_wb() can not do flushing without interrupt, so the spinlock should not be hold during ImgU page alloc and free, the interrupt should be enabled during memory cache flush.
This patch release spinlock before freeing pages table.
--- drivers/staging/media/ipu3/ipu3-mmu.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/staging/media/ipu3/ipu3-mmu.c +6 -4
@@ -174,8 +174,10 @@ static u32 *imgu_mmu_get_l2pt(struct imgu_mmu *mmu, u32 l1pt_idx)spin_lock_irqsave (&mmu->lock, flags); l2pt = mmu->l2pts[l1pt_idx]; -if (l2pt) - goto done; +if (l2pt) { +spin_unlock_irqrestore (&mmu->lock, flags); +return l2pt; + }spin_unlock_irqrestore (&mmu->lock, flags);
@@ -190,8 +192,9 @@ static u32 *imgu_mmu_get_l2pt(struct imgu_mmu *mmu, u32 l1pt_idx) l2pt = mmu->l2pts[l1pt_idx];if (l2pt) { +spin_unlock_irqrestore (&mmu->lock, flags);imgu_mmu_free_page_table (new_l2pt); - goto done; +return l2pt; } l2pt = new_l2pt;
@@ -200,7 +203,6 @@ static u32 *imgu_mmu_get_l2pt(struct imgu_mmu *mmu, u32 l1pt_idx) pteval =IPU3_ADDR2PTE (virt_to_phys (new_l2pt)); mmu->l1pt[l1pt_idx] = pteval; -done:spin_unlock_irqrestore (&mmu->lock, flags);return l2pt; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 6/376 media: imx: imx7-mipi-csis: Cleanup and fix subdev pad format handling
In reply to Greg Kroah-HartmanFrom: Laurent Pinchart <[email protected]>
[ Upstream commit d321dd233b9f2bb407b8e6b4759408f09ec207c3 ]
The subdev set pad format operation currently misbehaves in multiple ways:
- mipi_csis_try_format() unconditionally stores the format in the device state, even for V4L2_SUBDEV_FORMAT_TRY.
- The format is never stored in the pad cfg, but the pad cfg format always overwrites the format requested by the user.
- The sink format is not propagated to the source.
Fix all this by reworking the set format operation as follows:
1. For the source pad, turn set() into get() as the source format is not modifiable.
2. Validate the requested format and updated the stored format accordingly.
3. Return the format actually set.
4. Propagate the format from sink to source.
--- drivers/staging/media/imx/imx7-mipi-csis.c | 82 ++++++++++------------ 1 file changed, 37 insertions(+), 45 deletions(-)
drivers/staging/media/imx/imx7-mipi-csis.c +37 -45
@@ -669,28 +669,6 @@ static int mipi_csis_init_cfg(struct v4l2_subdev *mipi_sd,return 0 ; } -static struct csis_pix_format const * -mipi_csis_try_format (struct v4l2_subdev *mipi_sd,struct v4l2_mbus_framefmt *mf) -{ -struct csi_state *state =mipi_sd_to_csis_state (mipi_sd); -struct csis_pix_format const *csis_fmt; - - csis_fmt =find_csis_format (mf->code); -if (!csis_fmt) - csis_fmt = &mipi_csis_formats[0 ]; - -v4l_bound_align_image (&mf->width,1 ,CSIS_MAX_PIX_WIDTH , - csis_fmt->pix_width_alignment, - &mf->height,1 ,CSIS_MAX_PIX_HEIGHT ,1 , -0 ); - - state->format_mbus.code = csis_fmt->code; - state->format_mbus.width = mf->width; - state->format_mbus.height = mf->height; - -return csis_fmt; -} -static struct v4l2_mbus_framefmt * mipi_csis_get_format(struct csi_state *state, struct v4l2_subdev_pad_config *cfg,
@@ -703,53 +681,67 @@ mipi_csis_get_format(struct csi_state *state,return &state->format_mbus; } -static int mipi_csis_set_fmt (struct v4l2_subdev *mipi_sd, +static int mipi_csis_get_fmt (struct v4l2_subdev *mipi_sd,struct v4l2_subdev_pad_config *cfg,struct v4l2_subdev_format *sdformat) {struct csi_state *state =mipi_sd_to_csis_state (mipi_sd); -struct csis_pix_format const *csis_fmt;struct v4l2_mbus_framefmt *fmt; -if (sdformat->pad >=CSIS_PADS_NUM ) -return -EINVAL ; - - fmt =mipi_csis_get_format (state, cfg, sdformat->which, sdformat->pad); -mutex_lock (&state->lock); -if (sdformat->pad ==CSIS_PAD_SOURCE ) { - sdformat->format = *fmt; - goto unlock; - } - - csis_fmt =mipi_csis_try_format (mipi_sd, &sdformat->format); - + fmt =mipi_csis_get_format (state, cfg, sdformat->which, sdformat->pad); sdformat->format = *fmt; - -if (csis_fmt && sdformat->which ==V4L2_SUBDEV_FORMAT_ACTIVE ) - state->csis_fmt = csis_fmt; -else - cfg->try_fmt = sdformat->format; - -unlock:mutex_unlock (&state->lock);return 0 ; } -static int mipi_csis_get_fmt (struct v4l2_subdev *mipi_sd, +static int mipi_csis_set_fmt (struct v4l2_subdev *mipi_sd,struct v4l2_subdev_pad_config *cfg,struct v4l2_subdev_format *sdformat) {struct csi_state *state =mipi_sd_to_csis_state (mipi_sd); +struct csis_pix_format const *csis_fmt;struct v4l2_mbus_framefmt *fmt; -mutex_lock (&state->lock); +/* +* The CSIS can't transcode in any way, the source format can't be +* modified. +*/ +if (sdformat->pad ==CSIS_PAD_SOURCE ) +return mipi_csis_get_fmt (mipi_sd, cfg, sdformat); + +if (sdformat->pad !=CSIS_PAD_SINK ) +return -EINVAL ; fmt =mipi_csis_get_format (state, cfg, sdformat->which, sdformat->pad); +mutex_lock (&state->lock); + +/* Validate the media bus code and clamp the size. */ + csis_fmt =find_csis_format (sdformat->format.code); +if (!csis_fmt) + csis_fmt = &mipi_csis_formats[0 ]; + + fmt->code = csis_fmt->code; + fmt->width = sdformat->format.width; + fmt->height = sdformat->format.height; + +v4l_bound_align_image (&fmt->width,1 ,CSIS_MAX_PIX_WIDTH , + csis_fmt->pix_width_alignment, + &fmt->height,1 ,CSIS_MAX_PIX_HEIGHT ,1 ,0 ); + sdformat->format = *fmt; +/* Propagate the format from sink to source. */ + fmt =mipi_csis_get_format (state, cfg, sdformat->which, +CSIS_PAD_SOURCE ); + *fmt = sdformat->format; + +/* Store the CSIS format descriptor for active formats. */ +if (sdformat->which ==V4L2_SUBDEV_FORMAT_ACTIVE ) + state->csis_fmt = csis_fmt; +mutex_unlock (&state->lock);return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 7/376 crypto: ccp -- dont "select" CONFIG_DMADEVICES
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit eebac678556d6927f09a992872f4464cf3aecc76 ]
DMADEVICES is the top-level option for the slave DMA subsystem, and should not be selected by device drivers, as this can cause circular dependencies such as:
drivers/net/ethernet/freescale/Kconfig:6:error: recursive dependency detected!drivers/net/ethernet/freescale/Kconfig:6: symbol NET_VENDOR_FREESCALE depends on PPC_BESTCOMMdrivers/dma/bestcomm/Kconfig:6: symbol PPC_BESTCOMM depends on DMADEVICESdrivers/dma/Kconfig:6: symbol DMADEVICES is selected by CRYPTO_DEV_SP_CCPdrivers/crypto/ccp/Kconfig:10: symbol CRYPTO_DEV_SP_CCP depends on CRYPTOcrypto/Kconfig:16: symbol CRYPTO is selected by LIBCRC32C
lib/Kconfig:222: symbol LIBCRC32C is selected by LIQUIDIOdrivers/net/ethernet/cavium/Kconfig:65: symbol LIQUIDIO depends on PTP_1588_CLOCKdrivers/ptp/Kconfig:8: symbol PTP_1588_CLOCK is implied by FECdrivers/net/ethernet/freescale/Kconfig:23: symbol FEC depends on NET_VENDOR_FREESCALE
The LIQUIDIO driver causing this problem is addressed in a separate patch, but this change is needed to prevent it from happening again.
Using "depends on DMADEVICES" is what we do for all other implementations of slave DMA controllers as well.
--- drivers/crypto/ccp/Kconfig | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/crypto/ccp/Kconfig +1 -2
@@ -10,10 +10,9 @@ config CRYPTO_DEV_CCP_DD config CRYPTO_DEV_SP_CCP bool "Cryptographic Coprocessor device" default y - depends on CRYPTO_DEV_CCP_DD + depends on CRYPTO_DEV_CCP_DD && DMADEVICES select HW_RANDOM select DMA_ENGINE - select DMADEVICES select CRYPTO_SHA1 select CRYPTO_SHA256 help
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 8/376 igc: Fix default MAC address filter override
In reply to Greg Kroah-HartmanFrom: Andre Guedes <[email protected]>
[ Upstream commit ac9156b27564a089ec52f526bfcb59f61c34e7c6 ]
This patch fixes a bug when the user adds the first MAC address filter via ethtool NFC mechanism.
When the first MAC address filter is added, it overwrites the default MAC address filter configured at RAL[0] and RAH[0]. As consequence, frames addressed to the interface MAC address are not sent to host anymore.
This patch fixes the bug by calling igc_set_default_mac_filter() during adapter init so the position 0 of adapter->mac_table[] is assigned to the default MAC address.
--- drivers/net/ethernet/intel/igc/igc_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/intel/igc/igc_main.c +2 -0
@@ -2325,7 +2325,9 @@ static void igc_configure(struct igc_adapter *adapter)igc_setup_mrqc (adapter);igc_setup_rctl (adapter); +igc_set_default_mac_filter (adapter);igc_nfc_filter_restore (adapter); +igc_configure_tx (adapter);igc_configure_rx (adapter);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 9/376 scripts: sphinx-pre-install: address some issues with Gentoo
In reply to Greg Kroah-HartmanFrom: Mauro Carvalho Chehab <[email protected]>
[ Upstream commit e45a631742fadd7c9feb5a0049382102e5d43fe7 ]
There are some small misdetections with Gentoo. While they don't cause too much trouble, it keeps recomending to install things that are already there.
--- scripts/sphinx-pre-install | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
scripts/sphinx-pre-install +4 -3
@@ -557,7 +557,8 @@ sub give_gentoo_hints() "media-fonts/dejavu", 2) if ($pdf); if ($pdf) { - check_missing_file(["/usr/share/fonts/noto-cjk/NotoSansCJKsc-Regular.otf"], + check_missing_file(["/usr/share/fonts/noto-cjk/NotoSansCJKsc-Regular.otf", + "/usr/share/fonts/noto-cjk/NotoSerifCJK-Regular.ttc"], "media-fonts/noto-cjk", 2); }
@@ -572,10 +573,10 @@ sub give_gentoo_hints() my $portage_imagemagick = "/etc/portage/package.use/imagemagick"; my $portage_cairo = "/etc/portage/package.use/graphviz"; - if (qx(cat $portage_imagemagick) ne "$imagemagick\n") { + if (qx(grep imagemagick $portage_imagemagick 2>/dev/null) eq "") { printf("\tsudo su -c 'echo \"$imagemagick\" > $portage_imagemagick'\n") } - if (qx(cat $portage_cairo) ne "$cairo\n") { + if (qx(grep graphviz $portage_cairo 2>/dev/null) eq "") { printf("\tsudo su -c 'echo \"$cairo\" > $portage_cairo'\n"); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 10/376 media: vicodec: Fix error codes in probe function
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit f36592e7b343d853edf44d3545bb68961c0949a4 ]
If these functions fail then we return success, but we should instead preserve negative error code and return that.
--- drivers/media/platform/vicodec/vicodec-core.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/media/platform/vicodec/vicodec-core.c +9 -6
@@ -2114,16 +2114,19 @@ static int vicodec_probe(struct platform_device *pdev)platform_set_drvdata (pdev, dev); -if (register_instance (dev, &dev->stateful_enc, -"stateful-encoder" , true)) + ret =register_instance (dev, &dev->stateful_enc,"stateful-encoder" , + true); +if (ret) goto unreg_dev; -if (register_instance (dev, &dev->stateful_dec, -"stateful-decoder" , false)) + ret =register_instance (dev, &dev->stateful_dec,"stateful-decoder" , + false); +if (ret) goto unreg_sf_enc; -if (register_instance (dev, &dev->stateless_dec, -"stateless-decoder" , false)) + ret =register_instance (dev, &dev->stateless_dec,"stateless-decoder" , + false); +if (ret) goto unreg_sf_dec;#ifdef CONFIG_MEDIA_CONTROLLER
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 11/376 media: si2157: Better check for running tuner in init
In reply to Greg Kroah-HartmanFrom: Brad Love <[email protected]>
[ Upstream commit e955f959ac52e145f27ff2be9078b646d0352af0 ]
Getting the Xtal trim property to check if running is less error prone. Reset if_frequency if state is unknown.
Replaces the previous "garbage check".
--- drivers/media/tuners/si2157.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/media/tuners/si2157.c +7 -8
@@ -75,24 +75,23 @@ static int si2157_init(struct dvb_frontend *fe)struct si2157_cmd cmd;const struct firmware *fw;const char *fw_name; -unsigned int uitmp, chip_id; +unsigned int chip_id, xtal_trim;dev_dbg (&client->dev,"\n" ); -/* Returned IF frequency is garbage when firmware is not running */ -memcpy (cmd.args,"\x15\x00\x06\x07" ,4 ); +/* Try to get Xtal trim property, to verify tuner still running */ +memcpy (cmd.args,"\x15\x00\x04\x02" ,4 ); cmd.wlen =4 ; cmd.rlen =4 ; ret =si2157_cmd_execute (client, &cmd); -if (ret) - goto err; - uitmp = cmd.args[2 ] <<0 | cmd.args[3 ] <<8 ; -dev_dbg (&client->dev,"if_frequency kHz=%u\n" , uitmp); + xtal_trim = cmd.args[2 ] | (cmd.args[3 ] <<8 ); -if (uitmp == dev->if_frequency /1000 ) +if (ret ==0 && xtal_trim <16 ) goto warm; + dev->if_frequency =0 ;/* we no longer know current tuner state */ +/* power up */ if (dev->chiptype ==SI2157_CHIPTYPE_SI2146 ) {memcpy (cmd.args,"\xc0\x05\x01\x00\x00\x0b\x00\x00\x01" ,9 );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 12/376 media: v4l2-ctrls: v4l2_ctrl_g/s_ctrl*(): dont continue when WARN_ON
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 7c3bae3f430af6b4fcbdb7272e191e266fd94b45 ]
If the v4l2_ctrl_g_ctrl*() or __v4l2_ctrl_s_ctrl*() functions are called for the wrong control type then they call WARN_ON since that is a driver error. But they still continue, potentially overwriting data. Change this to return an error (s_ctrl) or 0 (g_ctrl), just to be safe.
--- drivers/media/v4l2-core/v4l2-ctrls.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/media/v4l2-core/v4l2-ctrls.c +12 -6
@@ -3794,7 +3794,8 @@ s32 v4l2_ctrl_g_ctrl(struct v4l2_ctrl *ctrl)struct v4l2_ext_control c;/* It's a driver bug if this happens. */ -WARN_ON (!ctrl->is_int); +if (WARN_ON (!ctrl->is_int)) +return 0 ; c.value =0 ;get_ctrl (ctrl, &c);return c.value;
@@ -3806,7 +3807,8 @@ s64 v4l2_ctrl_g_ctrl_int64(struct v4l2_ctrl *ctrl)struct v4l2_ext_control c;/* It's a driver bug if this happens. */ -WARN_ON (ctrl->is_ptr || ctrl->type !=V4L2_CTRL_TYPE_INTEGER64 ); +if (WARN_ON (ctrl->is_ptr || ctrl->type !=V4L2_CTRL_TYPE_INTEGER64 )) +return 0 ; c.value64 =0 ;get_ctrl (ctrl, &c);return c.value64;
@@ -4215,7 +4217,8 @@ int __v4l2_ctrl_s_ctrl(struct v4l2_ctrl *ctrl, s32 val)lockdep_assert_held (ctrl->handler->lock);/* It's a driver bug if this happens. */ -WARN_ON (!ctrl->is_int); +if (WARN_ON (!ctrl->is_int)) +return -EINVAL ; ctrl->val = val;return set_ctrl (NULL , ctrl,0 ); }
@@ -4226,7 +4229,8 @@ int __v4l2_ctrl_s_ctrl_int64(struct v4l2_ctrl *ctrl, s64 val)lockdep_assert_held (ctrl->handler->lock);/* It's a driver bug if this happens. */ -WARN_ON (ctrl->is_ptr || ctrl->type !=V4L2_CTRL_TYPE_INTEGER64 ); +if (WARN_ON (ctrl->is_ptr || ctrl->type !=V4L2_CTRL_TYPE_INTEGER64 )) +return -EINVAL ; *ctrl->p_new.p_s64 = val;return set_ctrl (NULL , ctrl,0 ); }
@@ -4237,7 +4241,8 @@ int __v4l2_ctrl_s_ctrl_string(struct v4l2_ctrl *ctrl, const char *s)lockdep_assert_held (ctrl->handler->lock);/* It's a driver bug if this happens. */ -WARN_ON (ctrl->type !=V4L2_CTRL_TYPE_STRING ); +if (WARN_ON (ctrl->type !=V4L2_CTRL_TYPE_STRING )) +return -EINVAL ;strscpy (ctrl->p_new.p_char, s, ctrl->maximum +1 );return set_ctrl (NULL , ctrl,0 ); }
@@ -4249,7 +4254,8 @@ int __v4l2_ctrl_s_ctrl_area(struct v4l2_ctrl *ctrl,lockdep_assert_held (ctrl->handler->lock);/* It's a driver bug if this happens. */ -WARN_ON (ctrl->type !=V4L2_CTRL_TYPE_AREA ); +if (WARN_ON (ctrl->type !=V4L2_CTRL_TYPE_AREA )) +return -EINVAL ; *ctrl->p_new.p_area = *area;return set_ctrl (NULL , ctrl,0 ); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 13/376 objtool: Ignore empty alternatives
In reply to Greg Kroah-HartmanFrom: Julien Thierry <[email protected]>
[ Upstream commit 7170cf47d16f1ba29eca07fd818870b7af0a93a5 ]
The .alternatives section can contain entries with no original instructions. Objtool will currently crash when handling such an entry.
Just skip that entry, but still give a warning to discourage useless entries.
--- tools/objtool/check.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/objtool/check.c +6 -0
@@ -916,6 +916,12 @@ static int add_special_section_alts(struct objtool_file *file) }if (special_alt->group) { +if (!special_alt->orig_len) { +WARN_FUNC ("empty alternative entry" , + orig_insn->sec, orig_insn->offset); +continue ; + } + ret =handle_group_alt (file, special_alt, orig_insn, &new_insn);if (ret)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 14/376 drm/amd/display: Force watermark value propagation
In reply to Greg Kroah-HartmanFrom: Joshua Aberback <[email protected]>
[ Upstream commit 868149c9a072cbdc22a73ce25a487f9fbfa171ef ]
[Why]
The HUBBUB watermark registers are in an area that cannot be power gated, but the HUBP copies of the watermark values are in areas that can be power gated. When we power on a pipe, it will not automatically take the HUBBUB values, we need to force propagation by writing to a watermark register.
[How]
- new HUBBUB function to re-write current value in a WM register
- touch WM register after enabling the plane in program_pipe
--- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 5 ++++- drivers/gpu/drm/amd/display/dc/inc/hw/dchubbub.h | 2 ++ 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +4 -1
@@ -1478,8 +1478,11 @@ static void dcn20_program_pipe(if (pipe_ctx->update_flags.bits.odm) hws->funcs.update_odm (dc, context, pipe_ctx); -if (pipe_ctx->update_flags.bits.enable) +if (pipe_ctx->update_flags.bits.enable) {dcn20_enable_plane (dc, pipe_ctx, context); +if (dc->res_pool->hubbub->funcs->force_wm_propagate_to_pipes) + dc->res_pool->hubbub->funcs->force_wm_propagate_to_pipes (dc->res_pool->hubbub); + }if (pipe_ctx->update_flags.raw || pipe_ctx->plane_state->update_flags.raw || pipe_ctx->stream->update_flags.raw)dcn20_update_dchubp_dpp (dc, pipe_ctx, context);
drivers/gpu/drm/amd/display/dc/inc/hw/dchubbub.h +2 -0
@@ -144,6 +144,8 @@ struct hubbub_funcs {void (*allow_self_refresh_control)(struct hubbub *hubbub,bool allow);void (*apply_DEDCN21_147_wa)(struct hubbub *hubbub); + +void (*force_wm_propagate_to_pipes)(struct hubbub *hubbub); };struct hubbub {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 15/376 drm/amd/display: fix virtual signal dsc setup
In reply to Greg Kroah-HartmanFrom: Dmytro Laktyushkin <[email protected]>
[ Upstream commit d5bef51f084fccafa984b114ff74a01a64a0e2e3 ]
This prevents dpcd access on virtual links.
--- drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c +1 -1
@@ -400,7 +400,7 @@ static bool dp_set_dsc_on_rx(struct pipe_ctx *pipe_ctx, bool enable)struct dc_stream_state *stream = pipe_ctx->stream;bool result = false; -if (IS_FPGA_MAXIMUS_DC (dc->ctx->dce_environment)) +if (dc_is_virtual_signal (stream->signal) ||IS_FPGA_MAXIMUS_DC (dc->ctx->dce_environment)) result = true;else result =dm_helpers_dp_write_dsc_enable (dc->ctx, stream, enable);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 16/376 spi: spi-mem: Fix Dual/Quad modes on Octal-capable devices
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 80300a7d5f2d7178335652f41d2e55ba898b4ec1 ]
Currently buswidths 2 and 4 are rejected for a device that advertises Octal capabilities. Allow these buswidths, just like is done for buswidth 2 and Quad-capable devices.
--- drivers/spi/spi-mem.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/spi/spi-mem.c +6 -4
@@ -108,15 +108,17 @@ static int spi_check_buswidth_req(struct spi_mem *mem, u8 buswidth, bool tx)return 0 ;case 2 : -if ((tx && (mode & (SPI_TX_DUAL |SPI_TX_QUAD ))) || - (!tx && (mode & (SPI_RX_DUAL |SPI_RX_QUAD )))) +if ((tx && + (mode & (SPI_TX_DUAL |SPI_TX_QUAD |SPI_TX_OCTAL ))) || + (!tx && + (mode & (SPI_RX_DUAL |SPI_RX_QUAD |SPI_RX_OCTAL ))))return 0 ;break ;case 4 : -if ((tx && (mode &SPI_TX_QUAD )) || - (!tx && (mode &SPI_RX_QUAD ))) +if ((tx && (mode & (SPI_TX_QUAD |SPI_TX_OCTAL ))) || + (!tx && (mode & (SPI_RX_QUAD |SPI_RX_OCTAL ))))return 0 ;break ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 17/376 drm/amdgpu: Init data to avoid oops while reading pp_num_states.
In reply to Greg Kroah-HartmanFrom: limingyu <[email protected]>
[ Upstream commit 6f81b2d047c59eb77cd04795a44245d6a52cdaec ]
For chip like CHIP_OLAND with si enabled(amdgpu.si_support=1), the amdgpu will expose pp_num_states to the /sys directory. In this moment, read the pp_num_states file will excute the amdgpu_get_pp_num_states func. In our case, the data hasn't been initialized, so the kernel will access some ilegal address, trigger the segmentfault and system will reboot soon:
uos@uos-PC:~$ cat /sys/devices/pci0000\:00/0000\:00\:00.0/0000\:01\:00
.0/pp_num_states Message from syslogd@uos-PC at Apr 22 09:26:20 ...
kernel:[ 82.154129] Internal error: Oops: 96000004 [#1] SMPThis patch aims to fix this problem, avoid that reading file triggers the kernel sementfault.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +4 -1
@@ -444,8 +444,11 @@ static ssize_t amdgpu_get_pp_num_states(struct device *dev, ret =smu_get_power_num_states (&adev->smu, &data);if (ret)return ret; - }else if (adev->powerplay.pp_funcs->get_pp_num_states) + }else if (adev->powerplay.pp_funcs->get_pp_num_states) {amdgpu_dpm_get_pp_num_states (adev, &data); + }else { +memset (&data,0 ,sizeof (data)); + }pm_runtime_mark_last_busy (ddev->dev);pm_runtime_put_autosuspend (ddev->dev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 18/376 drm/bridge: panel: Return always an error pointer in drm_panel_bridge_add()
In reply to Greg Kroah-HartmanFrom: Enric Balletbo i Serra <[email protected]>
[ Upstream commit 30be3031087139061de4421bf52015931eaab569 ]
Since commit 89958b7cd955 ("drm/bridge: panel: Infer connector type from panel by default"), drm_panel_bridge_add() and their variants can return NULL and an error pointer. This is fine but none of the actual users of the API are checking for the NULL value. Instead of change all the users, seems reasonable to return an error pointer instead. So change the returned value for those functions when the connector type is unknown.
--- drivers/gpu/drm/bridge/panel.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/bridge/panel.c +3 -3
@@ -166,7 +166,7 @@ static const struct drm_bridge_funcs panel_bridge_bridge_funcs = {* * The connector type is set to @panel->connector_type, which must be set to a * known type. Calling this function with a panel whose connector type is -* DRM_MODE_CONNECTOR_Unknown will return NULL. +* DRM_MODE_CONNECTOR_Unknown will return ERR_PTR(-EINVAL). * * See devm_drm_panel_bridge_add() for an automatically managed version of this * function.
@@ -174,7 +174,7 @@ static const struct drm_bridge_funcs panel_bridge_bridge_funcs = {struct drm_bridge *drm_panel_bridge_add (struct drm_panel *panel) {if (WARN_ON (panel->connector_type == DRM_MODE_CONNECTOR_Unknown)) -return NULL ; +return ERR_PTR (-EINVAL );return drm_panel_bridge_add_typed (panel, panel->connector_type); }
@@ -265,7 +265,7 @@ struct drm_bridge *devm_drm_panel_bridge_add(struct device *dev, struct drm_panel *panel) {if (WARN_ON (panel->connector_type == DRM_MODE_CONNECTOR_Unknown)) -return NULL ; +return ERR_PTR (-EINVAL );return devm_drm_panel_bridge_add_typed (dev, panel, panel->connector_type);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 19/376 net: ethernet: ti: fix return value check in k3_cppi_desc_pool_create_name()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 2ac757e4152e3322a04a6dfb3d1fa010d3521abf ]
In case of error, the function gen_pool_create() returns NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check should be replaced with NULL test.
--- drivers/net/ethernet/ti/k3-cppi-desc-pool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/ti/k3-cppi-desc-pool.c +2 -2
@@ -64,8 +64,8 @@ k3_cppi_desc_pool_create_name(struct device *dev, size_t size,return ERR_PTR (-ENOMEM ); pool->gen_pool =gen_pool_create (ilog2 (pool->desc_size),-1 ); -if (IS_ERR (pool->gen_pool)) { - ret =PTR_ERR (pool->gen_pool); +if (!pool->gen_pool) { + ret = -ENOMEM ;dev_err (pool->dev,"pool create failed %d\n" , ret);kfree_const (pool_name); goto gen_pool_create_fail;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 20/376 arm64/kernel: Fix range on invalidating dcache for boot page tables
In reply to Greg Kroah-HartmanFrom: Gavin Shan <[email protected]>
[ Upstream commit 9d2d75ede59bc1edd8561f2ee9d4702a5ea0ae30 ]
Prior to commit 8eb7e28d4c642c31 ("arm64/mm: move runtime pgds to rodata"), idmap_pgd_dir, tramp_pg_dir, reserved_ttbr0, swapper_pg_dir, and init_pg_dir were contiguous at the end of the kernel image. The maintenance at the end of __create_page_tables assumed these were contiguous, and affected everything from the start of idmap_pg_dir to the end of init_pg_dir.
That commit moved all but init_pg_dir into the .rodata section, with other data placed between idmap_pg_dir and init_pg_dir, but did not update the maintenance. Hence the maintenance is performed on much more data than necessary (but as the bootloader previously made this clean to the PoC there is no functional problem).
As we only alter idmap_pg_dir, and init_pg_dir, we only need to perform maintenance for these. As the other dirs are in .rodata, the bootloader will have initialised them as expected and cleaned them to the PoC. The kernel will initialize them as necessary after enabling the MMU.
This patch reworks the maintenance to only cover the idmap_pg_dir and init_pg_dir to avoid this unnecessary work.
--- arch/arm64/include/asm/pgtable.h | 1 + arch/arm64/kernel/head.S | 12 +++++++++--- arch/arm64/kernel/vmlinux.lds.S | 1 + 3 files changed, 11 insertions(+), 3 deletions(-)
arch/arm64/include/asm/pgtable.h +1 -0
@@ -457,6 +457,7 @@ extern pgd_t init_pg_dir[PTRS_PER_PGD];extern pgd_t init_pg_end[];extern pgd_t swapper_pg_dir[PTRS_PER_PGD ];extern pgd_t idmap_pg_dir[PTRS_PER_PGD ]; +extern pgd_t idmap_pg_end[];extern pgd_t tramp_pg_dir[PTRS_PER_PGD ];extern void set_swapper_pgd (pgd_t *pgdp,pgd_t pgd);
arch/arm64/kernel/head.S +9 -3
@@ -394,13 +394,19 @@ SYM_FUNC_START_LOCAL(__create_page_tables) /* * Since the page tables have been populated with non-cacheable - * accesses (MMU disabled), invalidate the idmap and swapper page - * tables again to remove any speculatively loaded cache lines. + * accesses (MMU disabled), invalidate those tables again to + * remove any speculatively loaded cache lines. */ + dmb sy + adrp x0, idmap_pg_dir + adrp x1, idmap_pg_end + sub x1, x1, x0 + bl __inval_dcache_area + + adrp x0, init_pg_dir adrp x1, init_pg_end sub x1, x1, x0 - dmb sy bl __inval_dcache_area ret x28
arch/arm64/kernel/vmlinux.lds.S +1 -0
@@ -139,6 +139,7 @@ SECTIONS idmap_pg_dir = .; . += IDMAP_DIR_SIZE; + idmap_pg_end = .; #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 tramp_pg_dir = .;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 21/376 selftests/bpf: Copy runqslower to OUTPUT directory
In reply to Greg Kroah-HartmanFrom: Veronika Kabatova <[email protected]>
[ Upstream commit b26d1e2b60284dc9f66ffad9ccd5c5da1100bb4b ]
$(OUTPUT)/runqslower makefile target doesn't actually create runqslower binary in the $(OUTPUT) directory. As lib.mk expects all TEST_GEN_PROGS_EXTENDED (which runqslower is a part of) to be present in the OUTPUT directory, this results in an error when running e.g. make install:
rsync: link_stat "tools/testing/selftests/bpf/runqslower" failed: No
such file or directory (2)
Copy the binary into the OUTPUT directory after building it to fix the error.
--- tools/testing/selftests/bpf/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/Makefile +2 -1
@@ -141,7 +141,8 @@ VMLINUX_BTF := $(abspath $(firstword $(wildcard $(VMLINUX_BTF_PATHS)))) $(OUTPUT)/runqslower: $(BPFOBJ) $(Q)$(MAKE) $(submake_extras) -C $(TOOLSDIR)/bpf/runqslower \ OUTPUT=$(SCRATCH_DIR)/ VMLINUX_BTF=$(VMLINUX_BTF) \ - BPFOBJ=$(BPFOBJ) BPF_INCLUDE=$(INCLUDE_DIR) + BPFOBJ=$(BPFOBJ) BPF_INCLUDE=$(INCLUDE_DIR) && \ + cp $(SCRATCH_DIR)/runqslower $@ $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED): $(OUTPUT)/test_stub.o $(BPFOBJ)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 22/376 libbpf: Fix memory leak and possible double-free in hashmap__clear
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 229bf8bf4d910510bc1a2fd0b89bd467cd71050d ]
Fix memory leak in hashmap_clear() not freeing hashmap_entry structs for each of the remaining entries. Also NULL-out bucket list to prevent possible double-free between hashmap__clear() and hashmap__free().
Running test_progs-asan flavor clearly showed this problem.
--- tools/lib/bpf/hashmap.c | 7 +++++++ 1 file changed, 7 insertions(+)
tools/lib/bpf/hashmap.c +7 -0
@@ -59,7 +59,14 @@ struct hashmap *hashmap__new(hashmap_hash_fn hash_fn,void hashmap__clear (struct hashmap *map) { +struct hashmap_entry *cur, *tmp; +int bkt; + +hashmap__for_each_entry_safe (map, cur, tmp, bkt) { +free (cur); + }free (map->buckets); + map->buckets =NULL ; map->cap = map->cap_bits = map->sz =0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 23/376 spi: pxa2xx: Apply CS clk quirk to BXT
In reply to Greg Kroah-HartmanFrom: Evan Green <[email protected]>
[ Upstream commit 6eefaee4f2d366a389da0eb95e524ba82bf358c4 ]
With a couple allies at Intel, and much badgering, I got confirmation from Intel that at least BXT suffers from the same SPI chip-select issue as Cannonlake (and beyond). The issue being that after going through runtime suspend/resume, toggling the chip-select line without also sending data does nothing.
Add the quirk to BXT to briefly toggle dynamic clock gating off and on, forcing the fabric to wake up enough to notice the CS register change.
--- drivers/spi/spi-pxa2xx.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-pxa2xx.c +1 -0
@@ -150,6 +150,7 @@ static const struct lpss_config lpss_platforms[] = { .tx_threshold_hi = 48, .cs_sel_shift = 8, .cs_sel_mask = 3 << 8, + .cs_clk_stays_gated = true, }, {/* LPSS_CNL_SSP */ .offset = 0x200,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 24/376 x86,smap: Fix smap_{save,restore}() alternatives
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 1ff865e343c2b59469d7e41d370a980a3f972c71 ]
As reported by objtool:
lib/ubsan.o: warning: objtool: .altinstr_replacement+0x0: alternative modifies stack lib/ubsan.o: warning: objtool: .altinstr_replacement+0x7: alternative modifies stack
the smap_{save,restore}() alternatives violate (the newly enforced) rule on stack invariance. That is, due to there only being a single ORC table it must be valid to any alternative. These alternatives violate this with the direct result that unwinds will not be correct when it hits between the PUSH and POP instructions.
Rewrite the functions to only have a conditional jump.
--- arch/x86/include/asm/smap.h | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
arch/x86/include/asm/smap.h +8 -3
@@ -57,8 +57,10 @@ static __always_inline unsigned long smap_save(void) {unsigned long flags; - asm volatile (ALTERNATIVE("", "pushf; pop %0; " __ASM_CLAC, - X86_FEATURE_SMAP) + asmvolatile ("# smap_save\n\t" + ALTERNATIVE("jmp 1f", "", X86_FEATURE_SMAP) + "pushf; pop %0; " __ASM_CLAC "\n\t" + "1:" : "=rm" (flags) : : "memory", "cc"); return flags;
@@ -66,7 +68,10 @@ static __always_inline unsigned long smap_save(void) static __always_inline void smap_restore(unsigned long flags) { - asm volatile (ALTERNATIVE("", "push %0; popf", X86_FEATURE_SMAP) + asmvolatile ("# smap_restore\n\t" + ALTERNATIVE("jmp 1f", "", X86_FEATURE_SMAP) + "push %0; popf\n\t" + "1:" : : "g" (flags) : "memory", "cc"); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 25/376 sched/fair: Refill bandwidth before scaling
In reply to Greg Kroah-HartmanFrom: Huaixin Chang <[email protected]>
[ Upstream commit 5a6d6a6ccb5f48ca8cf7c6d64ff83fd9c7999390 ]
In order to prevent possible hardlockup of sched_cfs_period_timer() loop, loop count is introduced to denote whether to scale quota and period or not. However, scale is done between forwarding period timer and refilling cfs bandwidth runtime, which means that period timer is forwarded with old "period" while runtime is refilled with scaled "quota".
Move do_sched_cfs_period_timer() before scaling to solve this.
--- kernel/sched/fair.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/sched/fair.c +2 -2
@@ -5170,6 +5170,8 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)if (!overrun)break ; + idle =do_sched_cfs_period_timer (cfs_b, overrun, flags); +if (++count >3 ) {u64 new, old =ktime_to_ns (cfs_b->period);
@@ -5199,8 +5201,6 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)/* reset count so we don't come right back in here */ count =0 ; } - - idle =do_sched_cfs_period_timer (cfs_b, overrun, flags); }if (idle) cfs_b->period_active =0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 26/376 net: atlantic: make hw_get_regs optional
In reply to Greg Kroah-HartmanFrom: Mark Starovoytov <[email protected]>
[ Upstream commit d0f23741c202c685447050713907f3be39a985ee ]
This patch fixes potential crash in case if hw_get_regs is NULL.
--- drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/aquantia/atlantic/aq_nic.c +6 -0
@@ -764,6 +764,9 @@ int aq_nic_get_regs(struct aq_nic_s *self, struct ethtool_regs *regs, void *p)u32 *regs_buff = p;int err =0 ; +if (unlikely (!self->aq_hw_ops->hw_get_regs)) +return -EOPNOTSUPP ; + regs->version =1 ; err = self->aq_hw_ops->hw_get_regs(self->aq_hw,
@@ -778,6 +781,9 @@ err_exit:int aq_nic_get_regs_count (struct aq_nic_s *self) { +if (unlikely (!self->aq_hw_ops->hw_get_regs)) +return 0 ; +return self->aq_nic_cfg.aq_hw_caps->mac_regs_count; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 27/376 net: ena: fix error returning in ena_com_get_hash_function()
In reply to Greg Kroah-HartmanFrom: Arthur Kiyanovski <[email protected]>
[ Upstream commit e9a1de378dd46375f9abfd8de1e6f59ee114a793 ]
In case the "func" parameter is NULL we now return "-EINVAL". This shouldn't happen in general, but when it does happen, this is the proper way to handle it.
We also check func for NULL in the beginning of the function, as there is no reason to do all the work and realize in the end of the function it was useless.
--- drivers/net/ethernet/amazon/ena/ena_com.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/amazon/ena/ena_com.c +4 -2
@@ -2345,6 +2345,9 @@ int ena_com_get_hash_function(struct ena_com_dev *ena_dev, rss->hash_key;int rc; +if (unlikely (!func)) +return -EINVAL ; + rc = ena_com_get_feature_ex(ena_dev, &get_resp, ENA_ADMIN_RSS_HASH_FUNCTION, rss->hash_key_dma_addr,
@@ -2357,8 +2360,7 @@ int ena_com_get_hash_function(struct ena_com_dev *ena_dev,if (rss->hash_func) rss->hash_func--; -if (func) - *func = rss->hash_func; + *func = rss->hash_func;if (key)memcpy (key, hash_key->key, (size_t )(hash_key->keys_num) <<2 );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 28/376 efi/libstub/x86: Work around LLVM ELF quirk build regression
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
[ Upstream commit f77767ed5f4d398b29119563155e4ece2dfeee13 ]
When building the x86 EFI stub with Clang, the libstub Makefile rules that manipulate the ELF object files may throw an error like:
STUBCPY drivers/firmware/efi/libstub/efi-stub-helper.stub.o
strip: drivers/firmware/efi/libstub/efi-stub-helper.stub.o: Failed to find link section for section 10
objcopy: drivers/firmware/efi/libstub/efi-stub-helper.stub.o: Failed to find link section for section 10
This is the result of a LLVM feature [0] where symbol references are stored in a LLVM specific .llvm_addrsig section in a non-transparent way, causing generic ELF tools such as strip or objcopy to choke on them.
So force the compiler not to emit these sections, by passing the appropriate command line option.
[0] https://sourceware.org/bugzilla/show_bug.cgi?id=23817
--- drivers/firmware/efi/libstub/Makefile | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/efi/libstub/Makefile +1 -0
@@ -30,6 +30,7 @@ KBUILD_CFLAGS := $(cflags-y) -DDISABLE_BRANCH_PROFILING \ -D__NO_FORTIFY \ $(call cc-option,-ffreestanding) \ $(call cc-option,-fno-stack-protector) \ + $(call cc-option,-fno-addrsig) \ -D__DISABLE_EXPORTS GCOV_PROFILE := n
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 29/376 ath10k: remove the max_sched_scan_reqs value
In reply to Greg Kroah-HartmanFrom: Wen Gong <[email protected]>
[ Upstream commit d431f8939c1419854dfe89dd345387f5397c6edd ]
The struct cfg80211_wowlan of NET_DETECT WoWLAN feature share the same struct cfg80211_sched_scan_request together with scheduled scan request feature, and max_sched_scan_reqs of wiphy is only used for sched scan, and ath10k does not support scheduled scan request feature, so ath10k does not set flag NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR, but ath10k set max_sched_scan_reqs of wiphy to a non zero value 1, then function nl80211_add_commands_unsplit of cfg80211 will set it support command NL80211_CMD_START_SCHED_SCAN because max_sched_scan_reqs is a non zero value, but actually ath10k not support it, then it leads a mismatch result for sched scan of cfg80211, then application shill found the mismatch and stop running case of MAC random address scan and then the case fail.
After remove max_sched_scan_reqs value, it keeps match for sched scan and case of MAC random address scan pass.
Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00029. Tested with QCA6174 PCIe with firmware WLAN.RM.4.4.1-00110-QCARMSWP-1.
--- drivers/net/wireless/ath/ath10k/mac.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/wireless/ath/ath10k/mac.c +0 -1
@@ -8919,7 +8919,6 @@ int ath10k_mac_register(struct ath10k *ar) ar->hw->wiphy->max_scan_ie_len =WLAN_SCAN_PARAMS_MAX_IE_LEN ;if (test_bit (WMI_SERVICE_NLO , ar->wmi.svc_map)) { - ar->hw->wiphy->max_sched_scan_reqs =1 ; ar->hw->wiphy->max_sched_scan_ssids =WMI_PNO_MAX_SUPP_NETWORKS ; ar->hw->wiphy->max_match_sets =WMI_PNO_MAX_SUPP_NETWORKS ; ar->hw->wiphy->max_sched_scan_ie_len =WMI_PNO_MAX_IE_LENGTH ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 30/376 arm64: cacheflush: Fix KGDB trap detection
In reply to Greg Kroah-HartmanFrom: Daniel Thompson <[email protected]>
[ Upstream commit ab8ad279ceac4fc78ae4dcf1a26326e05695e537 ]
flush_icache_range() contains a bodge to avoid issuing IPIs when the kgdb trap handler is running because issuing IPIs is unsafe (and not needed) in this execution context. However the current test, based on kgdb_connected is flawed: it both over-matches and under-matches.
The over match occurs because kgdb_connected is set when gdb attaches to the stub and remains set during normal running. This is relatively harmelss because in almost all cases irq_disabled() will be false.
The under match is more serious. When kdb is used instead of kgdb to access the debugger then kgdb_connected is not set in all the places that the debug core updates sw breakpoints (and hence flushes the icache). This can lead to deadlock.
Fix by replacing the ad-hoc check with the proper kgdb macro. This also allows us to drop the #ifdef wrapper.
--- arch/arm64/include/asm/cacheflush.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/include/asm/cacheflush.h +3 -3
@@ -79,7 +79,7 @@ static inline void flush_icache_range(unsigned long start, unsigned long end)* IPI all online CPUs so that they undergo a context synchronization * event and are forced to refetch the new instructions. */ -#ifdef CONFIG_KGDB +/* * KGDB performs cache maintenance with interrupts disabled, so we * will deadlock trying to IPI the secondary CPUs. In theory, we can
@@ -89,9 +89,9 @@ static inline void flush_icache_range(unsigned long start, unsigned long end)* the patching operation, so we don't need extra IPIs here anyway. * In which case, add a KGDB-specific bodge and return early. */ -if (kgdb_connected &&irqs_disabled ()) +if (in_dbg_master ())return ; -#endif +kick_all_cpus_sync (); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 31/376 media: staging: ipu3: Fix stale list entries on parameter queue failure
In reply to Greg Kroah-HartmanFrom: Tomasz Figa <[email protected]>
[ Upstream commit 735a02f1bbc2c5e6e9cdbf0222948ff03ff7ab2d ]
When queuing parameters fails, current code bails out without deleting the corresponding vb2 buffer from the driver buffer list, but the buffer is returned to vb2. This leads to stale list entries and a crash when the driver stops streaming:
[ 224.935561] ipu3-imgu 0000:00:05.0: set parameters failed. [ 224.998932] ipu3-imgu 0000:00:05.0: set parameters failed. [ 225.064430] ipu3-imgu 0000:00:05.0: set parameters failed. [ 225.128534] ipu3-imgu 0000:00:05.0: set parameters failed. [ 225.194945] ipu3-imgu 0000:00:05.0: set parameters failed. [ 225.360363] ------------[ cut here ]------------ [ 225.360372] WARNING: CPU: 0 PID: 6704 at drivers/media/common/videobuf2/videobuf2-core.c:927 vb2_buffer_done+0x20f/0x21a [videobuf2_common] [ 225.360374] Modules linked in: snd_seq_dummy snd_seq snd_seq_device
veth bridge stp llc tun nf_nat_tftp nf_conntrack_tftp nf_nat_ftp nf_conntrack_ftp esp6 ah6 ip6t_REJECT ip6t_ipv6header cmac rfcomm uinput ipu3_imgu(C) ipu3_cio2 iova videobuf2_v4l2 videobuf2_common videobuf2_dma_sg videobuf2_memops ov13858 ov5670 v4l2_fwnode dw9714 acpi_als xt_MASQUERADE fuse iio_trig_sysfs cros_ec_sensors_ring cros_ec_light_prox cros_ec_sensors cros_ec_sensors_core industrialio_triggered_buffer kfifo_buf industrialio cros_ec_sensorsupport cdc_ether btusb btrtl btintel btbcm usbnet bluetooth ecdh_generic ecc hid_google_hammer iwlmvm iwl7000_mac80211 r8152 mii lzo_rle lzo_compress iwlwifi zram cfg80211 joydev
[ 225.360400] CPU: 0 PID: 6704 Comm: CameraDeviceOps Tainted: G C 5.4.30 #5 [ 225.360402] Hardware name: HP Soraka/Soraka, BIOS Google_Soraka.10431.106.0 12/03/2019 [ 225.360405] RIP: 0010:vb2_buffer_done+0x20f/0x21a [videobuf2_common] [ 225.360408] Code: 5e 41 5f 5d e9 e0 16 5a d4 41 8b 55 08 48 c7 c7 8f 8b 5c c0 48 c7 c6 36 9a 5c c0 44 89 f9 31 c0 e8 a5 1c 5b d4 e9 53 fe ff ff <0f> 0b eb a3 e8 12 d7 43 d4 eb 97 0f 1f 44 00 00 55 48 89 e5 41 56 [ 225.360410] RSP: 0018:ffff9468ab32fba8 EFLAGS: 00010297 [ 225.360412] RAX: ffff8aa7a51577a8 RBX: dead000000000122 RCX: ffff8aa7a51577a8 [ 225.360414] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff8aa7a5157400 [ 225.360416] RBP: ffff9468ab32fbd8 R08: ffff8aa64e47e600 R09: 0000000000000000 [ 225.360418] R10: 0000000000000000 R11: ffffffffc06036e6 R12: dead000000000100 [ 225.360420] R13: ffff8aa7820f1940 R14: ffff8aa7a51577a8 R15: 0000000000000006 [ 225.360422] FS: 00007c1146ffd700(0000) GS:ffff8aa7baa00000(0000) knlGS:0000000000000000 [ 225.360424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 225.360426] CR2: 00007aea3473a000 CR3: 00000000537d6004 CR4: 00000000003606f0 [ 225.360427] Call Trace: [ 225.360434] imgu_return_all_buffers+0x6f/0x8e [ipu3_imgu] [ 225.360438] imgu_vb2_stop_streaming+0xd6/0xf0 [ipu3_imgu] [ 225.360441] __vb2_queue_cancel+0x33/0x22d [videobuf2_common] [ 225.360443] vb2_core_streamoff+0x16/0x78 [videobuf2_common] [ 225.360448] __video_do_ioctl+0x33d/0x42a [ 225.360452] video_usercopy+0x34a/0x615 [ 225.360455] ? video_ioctl2+0x16/0x16 [ 225.360458] v4l2_ioctl+0x46/0x53 [ 225.360462] do_vfs_ioctl+0x50a/0x787 [ 225.360465] ksys_ioctl+0x58/0x83 [ 225.360468] __x64_sys_ioctl+0x1a/0x1e [ 225.360470] do_syscall_64+0x54/0x68 [ 225.360474] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 225.360476] RIP: 0033:0x7c118030f497 [ 225.360479] Code: 8a 66 90 48 8b 05 d1 d9 2b 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d9 2b 00 f7 d8 64 89 01 48 [ 225.360480] RSP: 002b:00007c1146ffa5a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 225.360483] RAX: ffffffffffffffda RBX: 00007c1140010018 RCX: 00007c118030f497 [ 225.360484] RDX: 00007c114001019c RSI: 0000000040045613 RDI: 000000000000004c [ 225.360486] RBP: 00007c1146ffa700 R08: 00007c1140010048 R09: 0000000000000000 [ 225.360488] R10: 0000000000000000 R11: 0000000000000246 R12: 00007c11400101b0 [ 225.360489] R13: 00007c1140010200 R14: 00007c1140010048 R15: 0000000000000001 [ 225.360492] ---[ end trace 73625ecfbd1c930e ]--- [ 225.360498] general protection fault: 0000 [#1] PREEMPT SMP PTI [ 225.360501] CPU: 0 PID: 6704 Comm: CameraDeviceOps Tainted: G WC 5.4.30 #5 [ 225.360502] Hardware name: HP Soraka/Soraka, BIOS Google_Soraka.10431.106.0 12/03/2019 [ 225.360505] RIP: 0010:imgu_return_all_buffers+0x52/0x8e [ipu3_imgu] [ 225.360507] Code: d4 49 8b 85 70 0a 00 00 49 81 c5 70 0a 00 00 49 39 c5 74 3b 49 bc 00 01 00 00 00 00 ad de 49 8d 5c 24 22 4c 8b 30 48 8b 48 08 <49> 89 4e 08 4c 89 31 4c 89 20 48 89 58 08 48 8d b8 58 fc ff ff 44 [ 225.360509] RSP: 0018:ffff9468ab32fbe8 EFLAGS: 00010293 [ 225.360511] RAX: ffff8aa7a51577a8 RBX: dead000000000122 RCX: dead000000000122 [ 225.360512] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff8aa7a5157400 [ 225.360514] RBP: ffff9468ab32fc18 R08: ffff8aa64e47e600 R09: 0000000000000000 [ 225.360515] R10: 0000000000000000 R11: ffffffffc06036e6 R12: dead000000000100 [ 225.360517] R13: ffff8aa7820f1940 R14: dead000000000100 R15: 0000000000000006 [ 225.360519] FS: 00007c1146ffd700(0000) GS:ffff8aa7baa00000(0000) knlGS:0000000000000000 [ 225.360521] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 225.360523] CR2: 00007aea3473a000 CR3: 00000000537d6004 CR4: 00000000003606f0 [ 225.360525] Call Trace: [ 225.360528] imgu_vb2_stop_streaming+0xd6/0xf0 [ipu3_imgu] [ 225.360531] __vb2_queue_cancel+0x33/0x22d [videobuf2_common] [ 225.360534] vb2_core_streamoff+0x16/0x78 [videobuf2_common] [ 225.360537] __video_do_ioctl+0x33d/0x42a [ 225.360540] video_usercopy+0x34a/0x615 [ 225.360542] ? video_ioctl2+0x16/0x16 [ 225.360546] v4l2_ioctl+0x46/0x53 [ 225.360548] do_vfs_ioctl+0x50a/0x787 [ 225.360551] ksys_ioctl+0x58/0x83 [ 225.360554] __x64_sys_ioctl+0x1a/0x1e [ 225.360556] do_syscall_64+0x54/0x68 [ 225.360559] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 225.360561] RIP: 0033:0x7c118030f497 [ 225.360563] Code: 8a 66 90 48 8b 05 d1 d9 2b 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d9 2b 00 f7 d8 64 89 01 48 [ 225.360565] RSP: 002b:00007c1146ffa5a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 225.360567] RAX: ffffffffffffffda RBX: 00007c1140010018 RCX: 00007c118030f497 [ 225.360569] RDX: 00007c114001019c RSI: 0000000040045613 RDI: 000000000000004c [ 225.360570] RBP: 00007c1146ffa700 R08: 00007c1140010048 R09: 0000000000000000 [ 225.360572] R10: 0000000000000000 R11: 0000000000000246 R12: 00007c11400101b0 [ 225.360574] R13: 00007c1140010200 R14: 00007c1140010048 R15: 0000000000000001 [ 225.360576] Modules linked in: snd_seq_dummy snd_seq snd_seq_device
veth bridge stp llc tun nf_nat_tftp nf_conntrack_tftp nf_nat_ftp nf_conntrack_ftp esp6 ah6 ip6t_REJECT ip6t_ipv6header cmac rfcomm uinput ipu3_imgu(C) ipu3_cio2 iova videobuf2_v4l2 videobuf2_common videobuf2_dma_sg videobuf2_memops ov13858 ov567
Fix this by moving the list_del() call just below the list_first_entry() call when the buffer no longer needs to be in the list.
--- drivers/staging/media/ipu3/ipu3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/ipu3/ipu3.c +1 -1
@@ -261,6 +261,7 @@ int imgu_queue_buffers(struct imgu_device *imgu, bool initial, unsigned int pipe ivb =list_first_entry (&imgu_pipe->nodes[node].buffers, struct imgu_vb2_buffer, list); +list_del (&ivb->list); vb = &ivb->vbb.vb2_buf; r =imgu_css_set_parameters (&imgu->css, pipe,vb2_plane_vaddr (vb,0 ));
@@ -274,7 +275,6 @@ int imgu_queue_buffers(struct imgu_device *imgu, bool initial, unsigned int pipevb2_buffer_done (vb,VB2_BUF_STATE_DONE );dev_dbg (&imgu->pci_dev->dev,"queue user parameters %d to css." , vb->index); -list_del (&ivb->list); }else if (imgu_pipe->queue_enabled[node]) {struct imgu_css_buffer *buf =imgu_queue_getbuf (imgu, node, pipe);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 32/376 libperf evlist: Fix a refcount leak
In reply to Greg Kroah-HartmanFrom: Ian Rogers <[email protected]>
[ Upstream commit 4599d292128d89e4cf866a0ea9a9b047a2de8418 ]
Memory leaks found by applying LLVM's libfuzzer on the tools/perf parse_events function.
--- tools/lib/perf/evlist.c | 1 + 1 file changed, 1 insertion(+)
tools/lib/perf/evlist.c +1 -0
@@ -125,6 +125,7 @@ static void perf_evlist__purge(struct perf_evlist *evlist)void perf_evlist__exit (struct perf_evlist *evlist) {perf_cpu_map__put (evlist->cpus); +perf_cpu_map__put (evlist->all_cpus);perf_thread_map__put (evlist->threads); evlist->cpus =NULL ; evlist->threads =NULL ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 33/376 rtw88: fix an issue about leak system resources
In reply to Greg Kroah-HartmanFrom: Dejin Zheng <[email protected]>
[ Upstream commit 191f6b08bfef24e1a9641eaac96ed030a7be4599 ]
the related system resources were not released when pci_iomap() return error in the rtw_pci_io_mapping() function. add pci_release_regions() to fix it.
--- drivers/net/wireless/realtek/rtw88/pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/realtek/rtw88/pci.c +1 -0
@@ -1091,6 +1091,7 @@ static int rtw_pci_io_mapping(struct rtw_dev *rtwdev, len =pci_resource_len (pdev, bar_id); rtwpci->mmap =pci_iomap (pdev, bar_id, len);if (!rtwpci->mmap) { +pci_release_regions (pdev);rtw_err (rtwdev,"failed to map pci memory\n" );return -ENOMEM ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 34/376 spi: dw: Zero DMA Tx and Rx configurations on stack
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 3cb97e223d277f84171cc4ccecab31e08b2ee7b5 ]
Some DMA controller drivers do not tolerate non-zero values in the DMA configuration structures. Zero them to avoid issues with such DMA controller drivers. Even despite above this is a good practice per se.
--- drivers/spi/spi-dw-mid.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-dw-mid.c +2 -0
@@ -147,6 +147,7 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_tx(struct dw_spi *dws,if (!xfer->tx_buf)return NULL ; +memset (&txconf,0 ,sizeof (txconf)); txconf.direction =DMA_MEM_TO_DEV ; txconf.dst_addr = dws->dma_addr; txconf.dst_maxburst =16 ;
@@ -193,6 +194,7 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws,if (!xfer->rx_buf)return NULL ; +memset (&rxconf,0 ,sizeof (rxconf)); rxconf.direction =DMA_DEV_TO_MEM ; rxconf.src_addr = dws->dma_addr; rxconf.src_maxburst =16 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 35/376 soc: fsl: dpio: properly compute the consumer index
In reply to Greg Kroah-HartmanFrom: Ioana Ciornei <[email protected]>
[ Upstream commit 7596ac9d19a9df25707ecaac0675881f62dd8c18 ]
Mask the consumer index before using it. Without this, we would be writing frame descriptors beyond the ring size supported by the QBMAN block.
--- drivers/soc/fsl/dpio/qbman-portal.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/fsl/dpio/qbman-portal.c +1 -0
@@ -669,6 +669,7 @@ int qbman_swp_enqueue_multiple_direct(struct qbman_swp *s, eqcr_ci = s->eqcr.ci; p = s->addr_cena +QBMAN_CENA_SWP_EQCR_CI ; s->eqcr.ci =qbman_read_register (s,QBMAN_CINH_SWP_EQCR_CI ); + s->eqcr.ci &= full_mask; s->eqcr.available =qm_cyc_diff (s->eqcr.pi_ring_size, eqcr_ci, s->eqcr.ci);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 36/376 ACPICA: Dispatcher: add status checks
In reply to Greg Kroah-HartmanFrom: Erik Kaneda <[email protected]>
[ Upstream commit 6bfe5344b2956d0bee116f1c640aef05e5cddd76 ]
ACPICA commit 3244c1eeba9f9fb9ccedb875f7923a3d85e0c6aa
The status chekcs are used to to avoid NULL pointer dereference on field objects
--- drivers/acpi/acpica/dsfield.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/acpi/acpica/dsfield.c +12 -5
@@ -514,13 +514,20 @@ acpi_ds_create_field(union acpi_parse_object *op, info.region_node = region_node; status =acpi_ds_get_field_names (&info, walk_state, arg->common.next); +if (ACPI_FAILURE (status)) { +return_ACPI_STATUS (status); + } +if (info.region_node->object->region.space_id == -ACPI_ADR_SPACE_PLATFORM_COMM - && !(region_node->object->field.internal_pcc_buffer = -ACPI_ALLOCATE_ZEROED (info.region_node->object->region. - length))) { -return_ACPI_STATUS (AE_NO_MEMORY ); +ACPI_ADR_SPACE_PLATFORM_COMM ) { + region_node->object->field.internal_pcc_buffer = +ACPI_ALLOCATE_ZEROED (info.region_node->object->region. + length); +if (!region_node->object->field.internal_pcc_buffer) { +return_ACPI_STATUS (AE_NO_MEMORY ); + } } +return_ACPI_STATUS (status); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 37/376 block: alloc map and request for new hardware queue
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit fd689871bbfbb41cd77379d3e9e5f4def0f7d6c6 ]
Alloc new map and request for new hardware queue when increse hardware queue count. Before this patch, it will show a warning for each new hardware queue, but it's not enough, these hctx have no maps and reqeust, when a bio was mapped to these hardware queue, it will trigger kernel panic when get request from these hctx.
Test environment:
* A NVMe disk supports 128 io queues
* 96 cpus in system
A corner case can always trigger this panic, there are 96
io queues allocated for HCTX_TYPE_DEFAULT type, the corresponding kernel
log: nvme nvme0: 96/0/0 default/read/poll queues. Now we set nvme write queues to 96, then nvme will alloc others(32) queues for read, but blk_mq_update_nr_hw_queues does not alloc map and request for these new added io queues. So when process read nvme disk, it will trigger kernel panic when get request from these hardware context.
Reproduce script:
nr=$(expr cat /sys/block/nvme0n1/device/queue_count - 1) echo $nr > /sys/module/nvme/parameters/write_queues echo 1 > /sys/block/nvme0n1/device/reset_controller dd if=/dev/nvme0n1 of=/dev/null bs=4K count=1
[ 8040.805626] ------------[ cut here ]------------ [ 8040.805627] WARNING: CPU: 82 PID: 12921 at block/blk-mq.c:2578 blk_mq_map_swqueue+0x2b6/0x2c0 [ 8040.805627] Modules linked in: nvme nvme_core nf_conntrack_netlink xt_addrtype br_netfilter overlay xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nft_counter nf_nat_tftp nf_conntrack_tftp nft_masq nf_tables_set nft_fib_inet nft_f
ib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack tun bridge nf_defrag_ipv6 nf_defrag_ipv4 stp llc ip6_tables ip_tables nft_compat rfkill ip_set nf_tables nfne tlink sunrpc intel_rapl_msr intel_rapl_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass ipmi_ssif crct10dif_pclmul crc32_pclmul iTCO_wdt iTCO_vendor_support ghash_clmulni_intel intel_ cstate intel_uncore raid0 joydev intel_rapl_perf ipmi_si pcspkr mei_me ioatdma sg ipmi_devintf mei i2c_i801 dca lpc_ich ipmi_msghandler acpi_power_meter acpi_pad xfs libcrc32c sd_mod ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm d rm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops
[ 8040.805637] ahci drm i40e libahci crc32c_intel libata t10_pi wmi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: nvme_core] [ 8040.805640] CPU: 82 PID: 12921 Comm: kworker/u194:2 Kdump: loaded Tainted: G W 5.6.0-rc5.78317c+ #2 [ 8040.805640] Hardware name: Inspur SA5212M5/YZMB-00882-104, BIOS 4.0.9 08/27/2019 [ 8040.805641] Workqueue: nvme-reset-wq nvme_reset_work [nvme] [ 8040.805642] RIP: 0010:blk_mq_map_swqueue+0x2b6/0x2c0 [ 8040.805643] Code: 00 00 00 00 00 41 83 c5 01 44 39 6d 50 77 b8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 8b bb 98 00 00 00 89 d6 e8 8c 81 03 00 eb 83 <0f> 0b e9 52 ff ff ff 0f 1f 00 0f 1f 44 00 00 41 57 48 89 f1 41 56 [ 8040.805643] RSP: 0018:ffffba590d2e7d48 EFLAGS: 00010246 [ 8040.805643] RAX: 0000000000000000 RBX: ffff9f013e1ba800 RCX: 000000000000003d [ 8040.805644] RDX: ffff9f00ffff6000 RSI: 0000000000000003 RDI: ffff9ed200246d90 [ 8040.805644] RBP: ffff9f00f6a79860 R08: 0000000000000000 R09: 000000000000003d [ 8040.805645] R10: 0000000000000001 R11: ffff9f0138c3d000 R12: ffff9f00fb3a9008 [ 8040.805645] R13: 000000000000007f R14: ffffffff96822660 R15: 000000000000005f [ 8040.805645] FS: 0000000000000000(0000) GS:ffff9f013fa80000(0000) knlGS:0000000000000000 [ 8040.805646] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8040.805646] CR2: 00007f7f397fa6f8 CR3: 0000003d8240a002 CR4: 00000000007606e0 [ 8040.805647] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8040.805647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8040.805647] PKRU: 55555554 [ 8040.805647] Call Trace: [ 8040.805649] blk_mq_update_nr_hw_queues+0x31b/0x390 [ 8040.805650] nvme_reset_work+0xb4b/0xeab [nvme] [ 8040.805651] process_one_work+0x1a7/0x370 [ 8040.805652] worker_thread+0x1c9/0x380 [ 8040.805653] ? max_active_store+0x80/0x80 [ 8040.805655] kthread+0x112/0x130 [ 8040.805656] ? __kthread_parkme+0x70/0x70 [ 8040.805657] ret_from_fork+0x35/0x40 [ 8040.805658] ---[ end trace b5f13b1e73ccb5d3 ]--- [ 8229.365135] BUG: kernel NULL pointer dereference, address: 0000000000000004 [ 8229.365165] #PF: supervisor read access in kernel mode [ 8229.365178] #PF: error_code(0x0000) - not-present page [ 8229.365191] PGD 0 P4D 0 [ 8229.365201] Oops: 0000 [#1] SMP PTI [ 8229.365212] CPU: 77 PID: 13024 Comm: dd Kdump: loaded Tainted: G W 5.6.0-rc5.78317c+ #2 [ 8229.365232] Hardware name: Inspur SA5212M5/YZMB-00882-104, BIOS 4.0.9 08/27/2019 [ 8229.365253] RIP: 0010:blk_mq_get_tag+0x227/0x250 [ 8229.365265] Code: 44 24 04 44 01 e0 48 8b 74 24 38 65 48 33 34 25 28 00 00 00 75 33 48 83 c4 40 5b 5d 41 5c 41 5d 41 5e c3 48 8d 68 10 4c 89 ef <44> 8b 60 04 48 89 ee e8 dd f9 ff ff 83 f8 ff 75 c8 e9 67 fe ff ff [ 8229.365304] RSP: 0018:ffffba590e977970 EFLAGS: 00010246 [ 8229.365317] RAX: 0000000000000000 RBX: ffff9f00f6a79860 RCX: ffffba590e977998 [ 8229.365333] RDX: 0000000000000000 RSI: ffff9f012039b140 RDI: ffffba590e977a38 [ 8229.365349] RBP: 0000000000000010 R08: ffffda58ff94e190 R09: ffffda58ff94e198 [ 8229.365365] R10: 0000000000000011 R11: ffff9f00f6a79860 R12: 0000000000000000 [ 8229.365381] R13: ffffba590e977a38 R14: ffff9f012039b140 R15: 0000000000000001 [ 8229.365397] FS: 00007f481c230580(0000) GS:ffff9f013f940000(0000) knlGS:0000000000000000 [ 8229.365415] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8229.365428] CR2: 0000000000000004 CR3: 0000005f35e26004 CR4: 00000000007606e0 [ 8229.365444] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8229.365460] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8229.365476] PKRU: 55555554 [ 8229.365484] Call Trace: [ 8229.365498] ? finish_wait+0x80/0x80 [ 8229.365512] blk_mq_get_request+0xcb/0x3f0 [ 8229.365525] blk_mq_make_request+0x143/0x5d0 [ 8229.365538] generic_make_request+0xcf/0x310 [ 8229.365553] ? scan_shadow_nodes+0x30/0x30 [ 8229.365564] submit_bio+0x3c/0x150 [ 8229.365576] mpage_readpages+0x163/0x1a0 [ 8229.365588] ? blkdev_direct_IO+0x490/0x490 [ 8229.365601] read_pages+0x6b/0x190 [ 8229.365612] __do_page_cache_readahead+0x1c1/0x1e0 [ 8229.365626] ondemand_readahead+0x182/0x2f0 [ 8229.365639] generic_file_buffered_read+0x590/0xab0 [ 8229.365655] new_sync_read+0x12a/0x1c0 [ 8229.365666] vfs_read+0x8a/0x140 [ 8229.365676] ksys_read+0x59/0xd0 [ 8229.365688] do_syscall_64+0x55/0x1d0 [ 8229.365700] entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- block/blk-mq.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
block/blk-mq.c +12 -12
@@ -2521,18 +2521,6 @@ static void blk_mq_map_swqueue(struct request_queue *q)* If the cpu isn't present, the cpu is mapped to first hctx. */ for_each_possible_cpu (i) { - hctx_idx = set->map[HCTX_TYPE_DEFAULT ].mq_map[i]; -/* unmapped hw queue can be remapped after CPU topo changed */ -if (!set->tags[hctx_idx] && - !__blk_mq_alloc_rq_map (set, hctx_idx)) { -/* -* If tags initialization fail for some hctx, -* that hctx won't be brought online. In this -* case, remap the current ctx to hctx[0] which -* is guaranteed to always have tags allocated -*/ - set->map[HCTX_TYPE_DEFAULT ].mq_map[i] =0 ; - } ctx =per_cpu_ptr (q->queue_ctx, i);for (j =0 ; j < set->nr_maps; j++) {
@@ -2541,6 +2529,18 @@ static void blk_mq_map_swqueue(struct request_queue *q) HCTX_TYPE_DEFAULT, i);continue ; } + hctx_idx = set->map[j].mq_map[i]; +/* unmapped hw queue can be remapped after CPU topo changed */ +if (!set->tags[hctx_idx] && + !__blk_mq_alloc_rq_map (set, hctx_idx)) { +/* +* If tags initialization fail for some hctx, +* that hctx won't be brought online. In this +* case, remap the current ctx to hctx[0] which +* is guaranteed to always have tags allocated +*/ + set->map[j].mq_map[i] =0 ; + } hctx =blk_mq_map_queue_type (q, j, i); ctx->hctxs[j] = hctx;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 38/376 arm64: insn: Fix two bugs in encoding 32-bit logical immediates
In reply to Greg Kroah-HartmanFrom: Luke Nelson <[email protected]>
[ Upstream commit 579d1b3faa3735e781ff74aac0afd598515dbc63 ]
This patch fixes two issues present in the current function for encoding arm64 logical immediates when using the 32-bit variants of instructions.
First, the code does not correctly reject an all-ones 32-bit immediate, and returns an undefined instruction encoding.
Second, the code incorrectly rejects some 32-bit immediates that are actually encodable as logical immediates. The root cause is that the code uses a default mask of 64-bit all-ones, even for 32-bit immediates. This causes an issue later on when the default mask is used to fill the top bits of the immediate with ones, shown here:
/*
* Pattern: 0..01..10..01..1
*
* Fill the unused top bits with ones, and check if
* the result is a valid immediate (all ones with a
* contiguous ranges of zeroes).
*/
imm |= ~mask;
if (!range_of_ones(~imm))
return AARCH64_BREAK_FAULT;
To see the problem, consider an immediate of the form 0..01..10..01..1, where the upper 32 bits are zero, such as 0x80000001. The code checks if ~(imm | ~mask) contains a range of ones: the incorrect mask yields 1..10..01..10..0, which fails the check; the correct mask yields 0..01..10..0, which succeeds.
The fix for both issues is to generate a correct mask based on the instruction immediate size, and use the mask to check for all-ones, all-zeroes, and values wider than the mask.
Currently, arch/arm64/kvm/va_layout.c is the only user of this function, which uses 64-bit immediates and therefore won't trigger these bugs.
We tested the new code against llvm-mc with all 1,302 encodable 32-bit logical immediates and all 5,334 encodable 64-bit logical immediates.
--- arch/arm64/kernel/insn.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
arch/arm64/kernel/insn.c +7 -7
@@ -1535,16 +1535,10 @@ static u32 aarch64_encode_immediate(u64 imm, u32 insn) {unsigned int immr, imms, n, ones, ror, esz, tmp; -u64 mask = ~0UL ; - -/* Can't encode full zeroes or full ones */ -if (!imm || !~imm) -return AARCH64_BREAK_FAULT ; +u64 mask;switch (variant) {case AARCH64_INSN_VARIANT_32BIT : -if (upper_32_bits (imm)) -return AARCH64_BREAK_FAULT ; esz =32 ;break ;case AARCH64_INSN_VARIANT_64BIT :
@@ -1556,6 +1550,12 @@ static u32 aarch64_encode_immediate(u64 imm,return AARCH64_BREAK_FAULT ; } + mask =GENMASK (esz -1 ,0 ); + +/* Can't encode full zeroes, full ones, or value wider than the mask */ +if (!imm || imm == mask || imm & ~mask) +return AARCH64_BREAK_FAULT ; +/* * Inverse of Replicate(). Try to spot a repeating pattern * with a pow2 stride.
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 39/376 tools/power/x86/intel-speed-select: Fix CLX-N package information output
In reply to Greg Kroah-HartmanFrom: Prarit Bhargava <[email protected]>
[ Upstream commit 28c59ae6965ca0626e3150e2f2863e0f0c810ed7 ]
On CLX-N the perf-profile output is missing the package, die, and cpu output. On CLX-N the pkg_dev struct will never be evaluated by the core code so pkg_dev.processed is always 0 and the package, die, and cpu information is never output.
Set the pkg_dev.processed flag to 1 for CLX-N processors.
--- tools/power/x86/intel-speed-select/isst-config.c | 1 + 1 file changed, 1 insertion(+)
tools/power/x86/intel-speed-select/isst-config.c +1 -0
@@ -1169,6 +1169,7 @@ static void dump_clx_n_config_for_cpu(int cpu, void *arg1, void *arg2, ctdp_level = &clx_n_pkg_dev.ctdp_level[0 ]; pbf_info = &ctdp_level->pbf_info; + clx_n_pkg_dev.processed =1 ;isst_ctdp_display_information (cpu, outf, tdp_level, &clx_n_pkg_dev);free_cpu_set (ctdp_level->core_cpumask);free_cpu_set (pbf_info->core_cpumask);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 40/376 mt76: mt7615: fix aid configuration in mt7615_mcu_wtbl_generic_tlv
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit fdf433121f82766ff508a6f06665d2aca3e258d5 ]
If the vif is running in station mode the aid will be passed by mac80211 using bss_conf.aid. Fix aid configuration in mt7615_mcu_wtbl_generic_tlv
--- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +4 -1
@@ -823,8 +823,11 @@ mt7615_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, generic = (struct wtbl_generic *)tlv;if (sta) { +if (vif->type ==NL80211_IFTYPE_STATION ) + generic->partial_aid =cpu_to_le16 (vif->bss_conf.aid); +else + generic->partial_aid =cpu_to_le16 (sta->aid);memcpy (generic->peer_addr, sta->addr,ETH_ALEN ); - generic->partial_aid =cpu_to_le16 (sta->aid); generic->muar_idx = mvif->omac_idx; generic->qos = sta->wme; }else {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 41/376 block: reset mapping if failed to update hardware queue count
In reply to Greg Kroah-HartmanFrom: Weiping Zhang <[email protected]>
[ Upstream commit aa880ad690ab6d4c53934af85fb5a43e69ecb0f5 ]
When we increase hardware queue count, blk_mq_update_queue_map will reset the mapping between cpu and hardware queue base on the hardware queue count(set->nr_hw_queues). The mapping cannot be reset if it encounters error in blk_mq_realloc_hw_ctxs, but the fallback flow will continue using it, then blk_mq_map_swqueue will touch a invalid memory, because the mapping points to a wrong hctx.
blktest block/030:
null_blk: module loaded
Increasing nr_hw_queues to 8 fails, fallback to 1
==================================================================
BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0x2f2/0x830 Read of size 8 at addr 0000000000000128 by task nproc/8541 CPU: 5 PID: 8541 Comm: nproc Not tainted 5.7.0-rc4-dbg+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4-rebuilt.opensuse.org 04/01/2014 Call Trace: dump_stack+0xa5/0xe6 __kasan_report.cold+0x65/0xbb kasan_report+0x45/0x60 check_memory_region+0x15e/0x1c0 __kasan_check_read+0x15/0x20 blk_mq_map_swqueue+0x2f2/0x830 __blk_mq_update_nr_hw_queues+0x3df/0x690 blk_mq_update_nr_hw_queues+0x32/0x50 nullb_device_submit_queues_store+0xde/0x160 [null_blk] configfs_write_file+0x1c4/0x250 [configfs] __vfs_write+0x4c/0x90 vfs_write+0x14b/0x2d0 ksys_write+0xdd/0x180 __x64_sys_write+0x47/0x50 do_syscall_64+0x6f/0x310 entry_SYSCALL_64_after_hwframe+0x49/0xb3
--- block/blk-mq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/blk-mq.c +1 -1
@@ -3353,8 +3353,8 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, prev_nr_hw_queues = set->nr_hw_queues; set->nr_hw_queues = nr_hw_queues; -blk_mq_update_queue_map (set); fallback: +blk_mq_update_queue_map (set);list_for_each_entry (q, &set->tag_list, tag_set_list) {blk_mq_realloc_hw_ctxs (set, q);if (q->nr_hw_queues != set->nr_hw_queues) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 42/376 drm: rcar-du: Set primary plane zpos immutably at initializing
In reply to Greg Kroah-HartmanFrom: Tomohito Esaki <[email protected]>
[ Upstream commit 7982471d01aac33994276bf567c8f1f3a137648a ]
According to drm_plane_create_zpos_property() function documentation, all planes zpos range should be set if zpos property is supported. However, the rcar-du driver didn't set primary plane zpos range. Since the primary plane's zpos is fixed, set it immutably.
--- drivers/gpu/drm/rcar-du/rcar_du_plane.c | 16 +++++++++------- drivers/gpu/drm/rcar-du/rcar_du_vsp.c | 14 ++++++++------ 2 files changed, 17 insertions(+), 13 deletions(-)
drivers/gpu/drm/rcar-du/rcar_du_plane.c +9 -7
@@ -785,13 +785,15 @@ int rcar_du_planes_init(struct rcar_du_group *rgrp)drm_plane_create_alpha_property (&plane->plane); -if (type ==DRM_PLANE_TYPE_PRIMARY ) -continue ; - -drm_object_attach_property (&plane->plane.base, - rcdu->props.colorkey, -RCAR_DU_COLORKEY_NONE ); -drm_plane_create_zpos_property (&plane->plane,1 ,1 ,7 ); +if (type ==DRM_PLANE_TYPE_PRIMARY ) { +drm_plane_create_zpos_immutable_property (&plane->plane, +0 ); + }else { +drm_object_attach_property (&plane->plane.base, + rcdu->props.colorkey, +RCAR_DU_COLORKEY_NONE ); +drm_plane_create_zpos_property (&plane->plane,1 ,1 ,7 ); + } }return 0 ;
drivers/gpu/drm/rcar-du/rcar_du_vsp.c +8 -6
@@ -392,12 +392,14 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,drm_plane_helper_add (&plane->plane, &rcar_du_vsp_plane_helper_funcs); -if (type ==DRM_PLANE_TYPE_PRIMARY ) -continue ; - -drm_plane_create_alpha_property (&plane->plane); -drm_plane_create_zpos_property (&plane->plane,1 ,1 , - vsp->num_planes -1 ); +if (type ==DRM_PLANE_TYPE_PRIMARY ) { +drm_plane_create_zpos_immutable_property (&plane->plane, +0 ); + }else { +drm_plane_create_alpha_property (&plane->plane); +drm_plane_create_zpos_property (&plane->plane,1 ,1 , + vsp->num_planes -1 ); + } }return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 43/376 lockdown: Allow unprivileged users to see lockdown status
In reply to Greg Kroah-HartmanFrom: Jeremy Cline <[email protected]>
[ Upstream commit 60cf7c5ed5f7087c4de87a7676b8c82d96fd166c ]
A number of userspace tools, such as systemtap, need a way to see the current lockdown state so they can gracefully deal with the kernel being locked down. The state is already exposed in /sys/kernel/security/lockdown, but is only readable by root. Adjust the permissions so unprivileged users can read the state.
--- security/lockdown/lockdown.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/lockdown/lockdown.c +1 -1
@@ -150,7 +150,7 @@ static int __init lockdown_secfs_init(void) {struct dentry *dentry; - dentry =securityfs_create_file ("lockdown" ,0600 ,NULL ,NULL , + dentry =securityfs_create_file ("lockdown" ,0644 ,NULL ,NULL , &lockdown_ops);return PTR_ERR_OR_ZERO (dentry); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 44/376 ixgbe: Fix XDP redirect on archs with PAGE_SIZE above 4K
In reply to Greg Kroah-HartmanFrom: Jesper Dangaard Brouer <[email protected]>
[ Upstream commit 88eb0ee17b2ece64fcf6689a4557a5c2e7a89c4b ]
The ixgbe driver have another memory model when compiled on archs with PAGE_SIZE above 4096 bytes. In this mode it doesn't split the page in two halves, but instead increment rx_buffer->page_offset by truesize of packet (which include headroom and tailroom for skb_shared_info).
This is done correctly in ixgbe_build_skb(), but in ixgbe_rx_buffer_flip which is currently only called on XDP_TX and XDP_REDIRECT, it forgets to add the tailroom for skb_shared_info. This breaks XDP_REDIRECT, for veth and cpumap. Fix by adding size of skb_shared_info tailroom.
Maintainers notice: This fix have been queued to Jeff.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +2 -1
@@ -2254,7 +2254,8 @@ static void ixgbe_rx_buffer_flip(struct ixgbe_ring *rx_ring, rx_buffer->page_offset ^= truesize;#else unsigned int truesize =ring_uses_build_skb (rx_ring) ? -SKB_DATA_ALIGN (IXGBE_SKB_PAD + size) : +SKB_DATA_ALIGN (IXGBE_SKB_PAD + size) + +SKB_DATA_ALIGN (sizeof (struct skb_shared_info )) :SKB_DATA_ALIGN (size); rx_buffer->page_offset += truesize;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 45/376 platform/x86: dell-laptop: dont register micmute LED if there is no token
In reply to Greg Kroah-HartmanFrom: Koba Ko <[email protected]>
[ Upstream commit 257e03a334ccb96e657bf5f6ab3b5693a22c2aa4 ]
On Dell G3-3590, error message is issued during boot up, "platform::micmute: Setting an LED's brightness failed (-19)", but there's no micmute led on the machine.
Get the related tokens of SMBIOS, GLOBAL_MIC_MUTE_DISABLE/ENABLE. If one of two tokens doesn't exist,
don't call led_classdev_register() for platform::micmute. After that, you wouldn't see the platform::micmute in /sys/class/leds/, and the error message wouldn't see in dmesg.
--- drivers/platform/x86/dell-laptop.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/platform/x86/dell-laptop.c +7 -4
@@ -2204,10 +2204,13 @@ static int __init dell_init(void)dell_laptop_register_notifier (&dell_laptop_notifier); - micmute_led_cdev.brightness =ledtrig_audio_get (LED_AUDIO_MICMUTE ); - ret =led_classdev_register (&platform_device->dev, &micmute_led_cdev); -if (ret <0 ) - goto fail_led; +if (dell_smbios_find_token (GLOBAL_MIC_MUTE_DISABLE ) && +dell_smbios_find_token (GLOBAL_MIC_MUTE_ENABLE )) { + micmute_led_cdev.brightness =ledtrig_audio_get (LED_AUDIO_MICMUTE ); + ret =led_classdev_register (&platform_device->dev, &micmute_led_cdev); +if (ret <0 ) + goto fail_led; + }if (acpi_video_get_backlight_type () != acpi_backlight_vendor)return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 46/376 cpuidle: psci: Fixup execution order when entering a domain idle state
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
[ Upstream commit 8b7ce5e49049ca78c238f03d70569a73da049f32 ]
Moving forward, platforms are going to need to execute specific "last-man" operations before a domain idle state can be entered. In one way or the other, these operations needs to be triggered while walking the hierarchical topology via runtime PM and genpd, as it's at that point the last-man becomes known.
Moreover, executing last-man operations needs to be done after the CPU PM notifications are sent through cpu_pm_enter(), as otherwise it's likely that some notifications would fail. Therefore, let's re-order the sequence in psci_enter_domain_idle_state(), so cpu_pm_enter() gets called prior pm_runtime_put_sync().
--- drivers/cpuidle/cpuidle-psci.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/cpuidle/cpuidle-psci.c +7 -1
@@ -58,6 +58,10 @@ static int psci_enter_domain_idle_state(struct cpuidle_device *dev,u32 state;int ret; + ret =cpu_pm_enter (); +if (ret) +return -1 ; +/* Do runtime PM to manage a hierarchical CPU toplogy. */ pm_runtime_put_sync_suspend (pd_dev);
@@ -65,10 +69,12 @@ static int psci_enter_domain_idle_state(struct cpuidle_device *dev,if (!state) state = states[idx]; - ret =psci_enter_state (idx, state); + ret =psci_cpu_suspend_enter (state) ?-1 : idx;pm_runtime_get_sync (pd_dev); +cpu_pm_exit (); +/* Clear the domain state to start fresh when back from idle. */ psci_set_domain_state (0 );return ret;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 47/376 MIPS: Loongson: Build ATI Radeon GPU driver as module
In reply to Greg Kroah-HartmanFrom: Tiezhu Yang <[email protected]>
[ Upstream commit a44de7497f91834df0b8b6d459e259788ba66794 ]
When ATI Radeon GPU driver has been compiled directly into the kernel instead of as a module, we should make sure the firmware for the model (check available ones in /lib/firmware/radeon) is built-in to the kernel as well, otherwise there exists the following fatal error during GPU init, change CONFIG_DRM_RADEON=y to CONFIG_DRM_RADEON=m to fix it.
[ 1.900997] [drm] Loading RS780 Microcode [ 1.905077] radeon 0000:01:05.0: Direct firmware load for radeon/RS780_pfp.bin failed with error -2 [ 1.914140] r600_cp: Failed to load firmware "radeon/RS780_pfp.bin" [ 1.920405] [drm:r600_init] *ERROR* Failed to load firmware! [ 1.926069] radeon 0000:01:05.0: Fatal error during GPU init [ 1.931729] [drm] radeon: finishing device.
--- arch/mips/configs/loongson3_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/configs/loongson3_defconfig +1 -1
@@ -229,7 +229,7 @@ CONFIG_MEDIA_CAMERA_SUPPORT=y CONFIG_MEDIA_USB_SUPPORT=y CONFIG_USB_VIDEO_CLASS=m CONFIG_DRM=y -CONFIG_DRM_RADEON=y +CONFIG_DRM_RADEON=m CONFIG_FB_RADEON=y CONFIG_LCD_CLASS_DEVICE=y CONFIG_LCD_PLATFORM=m
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 48/376 io_uring: cleanup io_poll_remove_one() logic
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit 3bfa5bcb26f0b52d7ae8416aa0618fff21aceaaf ]
We only need apoll in the one section, do the juggling with the work restoration there. This removes a special case further down as well.
No functional changes in this patch.
--- fs/io_uring.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-)
fs/io_uring.c +13 -14
@@ -4354,32 +4354,31 @@ static bool __io_poll_remove_one(struct io_kiocb *req, do_complete = true; }spin_unlock (&poll->head->lock); +hash_del (&req->hash_node);return do_complete; }static bool io_poll_remove_one (struct io_kiocb *req) { -struct async_poll *apoll =NULL ;bool do_complete;if (req->opcode ==IORING_OP_POLL_ADD ) { do_complete =__io_poll_remove_one (req, &req->poll); }else { - apoll = req->apoll; +struct async_poll *apoll = req->apoll; +/* non-poll requests have submit ref still */ - do_complete =__io_poll_remove_one (req, &req->apoll->poll); -if (do_complete) + do_complete =__io_poll_remove_one (req, &apoll->poll); +if (do_complete) {io_put_req (req); - } - -hash_del (&req->hash_node); - -if (do_complete && apoll) { -/* -* restore ->work because we need to call io_req_work_drop_env. -*/ -memcpy (&req->work, &apoll->work,sizeof (req->work)); -kfree (apoll); +/* +* restore ->work because we will call +* io_req_work_drop_env below when dropping the +* final reference. +*/ +memcpy (&req->work, &apoll->work,sizeof (req->work)); +kfree (apoll); + } }if (do_complete) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 49/376 media: i2c: imx219: Fix a bug in imx219_enum_frame_size
In reply to Greg Kroah-HartmanFrom: Dafna Hirschfeld <[email protected]>
[ Upstream commit b2bbf1aac61186ef904fd28079e847d3feadb89e ]
When enumerating the frame sizes, the value sent to imx219_get_format_code should be fse->code (the code from the ioctl) and not imx219->fmt.code which is the code set currently in the driver.
--- drivers/media/i2c/imx219.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/imx219.c +1 -1
@@ -781,7 +781,7 @@ static int imx219_enum_frame_size(struct v4l2_subdev *sd,if (fse->index >=ARRAY_SIZE (supported_modes))return -EINVAL ; -if (fse->code !=imx219_get_format_code (imx219, imx219->fmt.code)) +if (fse->code !=imx219_get_format_code (imx219, fse->code))return -EINVAL ; fse->min_width = supported_modes[fse->index].width;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 50/376 Bluetooth: Add SCO fallback for invalid LMP parameters error
In reply to Greg Kroah-HartmanFrom: Hsin-Yu Chao <[email protected]>
[ Upstream commit 56b5453a86203a44726f523b4133c1feca49ce7c ]
Bluetooth PTS test case HFP/AG/ACC/BI-12-I accepts SCO connection with invalid parameter at the first SCO request expecting AG to attempt another SCO request with the use of "safe settings" for given codec, base on section 5.7.1.2 of HFP 1.7 specification.
This patch addresses it by adding "Invalid LMP Parameters" (0x1e) to the SCO fallback case. Verified with below log:
< HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
Handle: 256
Transmit bandwidth: 8000
Receive bandwidth: 8000
Max latency: 13
Setting: 0x0003
Input Coding: Linear
Input Data Format: 1's complement
Input Sample Size: 8-bit
# of bits padding at MSB: 0
Air Coding Format: Transparent Data
Retransmission effort: Optimize for link quality (0x02) Packet type: 0x0380
3-EV3 may not be used
2-EV5 may not be used
3-EV5 may not be used
Quoted 1 line
HCI Event: Command Status (
0x0f) plen 4
Setup Synchronous Connection (0x01|0x0028) ncmd 1
Status: Success (0x00)Quoted 1 line
HCI Event: Number of Completed Packets (
0x13) plen 5
Num handles: 1
Handle: 256
Count: 1
Quoted 1 line
HCI Event: Max Slots Change (
0x1b) plen 3
Handle: 256
Max slots: 1
Quoted 1 line
HCI Event: Synchronous Connect Complete (
0x2c) plen 17
Status: Invalid LMP Parameters / Invalid LL Parameters (0x1e)
Handle: 0
Address: 00:1B:DC:F2:21:59 (OUI 00-1B-DC)
Link type: eSCO (0x02)
Transmission interval: 0x00
Retransmission window: 0x02
RX packet length: 0
TX packet length: 0
Air mode: Transparent (0x03)< HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
Handle: 256
Transmit bandwidth: 8000
Receive bandwidth: 8000
Max latency: 8
Setting: 0x0003
Input Coding: Linear
Input Data Format: 1's complement
Input Sample Size: 8-bit
# of bits padding at MSB: 0
Air Coding Format: Transparent Data
Retransmission effort: Optimize for link quality (0x02) Packet type: 0x03c8
EV3 may be used
2-EV3 may not be used
3-EV3 may not be used
2-EV5 may not be used
3-EV5 may not be used
Quoted 1 line
HCI Event: Command Status (
0x0f) plen 4
Setup Synchronous Connection (0x01|0x0028) ncmd 1
Status: Success (0x00)Quoted 1 line
HCI Event: Max Slots Change (
0x1b) plen 3
Handle: 256
Max slots: 5
Quoted 1 line
HCI Event: Max Slots Change (
0x1b) plen 3
Handle: 256
Max slots: 1
Quoted 1 line
HCI Event: Synchronous Connect Complete (
0x2c) plen 17
Status: Success (0x00)
Handle: 257
Address: 00:1B:DC:F2:21:59 (OUI 00-1B-DC)
Link type: eSCO (0x02)
Transmission interval: 0x06
Retransmission window: 0x04
RX packet length: 30
TX packet length: 30
Air mode: Transparent (0x03)--- net/bluetooth/hci_event.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/hci_event.c +1 -0
@@ -4292,6 +4292,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,case 0x11 :/* Unsupported Feature or Parameter Value */ case 0x1c :/* SCO interval rejected */ case 0x1a :/* Unsupported Remote Feature */ +case 0x1e :/* Invalid LMP Parameters */ case 0x1f :/* Unspecified error */ case 0x20 :/* Unsupported LMP Parameter value */ if (conn->out) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 51/376 kgdb: Disable WARN_CONSOLE_UNLOCKED for all kgdb
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit 202164fbfa2b2ffa3e66b504e0f126ba9a745006 ]
In commit 81eaadcae81b ("kgdboc: disable the console lock when in kgdb") we avoided the WARN_CONSOLE_UNLOCKED() yell when we were in kgdboc. That still works fine, but it turns out that we get a similar yell when using other I/O drivers. One example is the "I/O driver" for the kgdb test suite (kgdbts). When I enabled that I again got the same yells.
Even though "kgdbts" doesn't actually interact with the user over the console, using it still causes kgdb to print to the consoles. That trips the same warning:
con_is_visible+0x60/0x68 con_scroll+0x110/0x1b8 lf+0x4c/0xc8 vt_console_print+0x1b8/0x348 vkdb_printf+0x320/0x89c kdb_printf+0x68/0x90 kdb_main_loop+0x190/0x860 kdb_stub+0x2cc/0x3ec kgdb_cpu_enter+0x268/0x744 kgdb_handle_exception+0x1a4/0x200 kgdb_compiled_brk_fn+0x34/0x44 brk_handler+0x7c/0xb8 do_debug_exception+0x1b4/0x228
Let's increment/decrement the "ignore_console_lock_warning" variable all the time when we enter the debugger.
This will allow us to later revert commit 81eaadcae81b ("kgdboc:
disable the console lock when in kgdb").
--- kernel/debug/debug_core.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/debug/debug_core.c +4 -0
@@ -668,6 +668,8 @@ return_normal:if (kgdb_skipexception (ks->ex_vector, ks->linux_regs)) goto kgdb_restore; +atomic_inc (&ignore_console_lock_warning); +/* Call the I/O driver's pre_exception routine */ if (dbg_io_ops->pre_exception) dbg_io_ops->pre_exception ();
@@ -740,6 +742,8 @@ cpu_master_loop:if (dbg_io_ops->post_exception) dbg_io_ops->post_exception (); +atomic_dec (&ignore_console_lock_warning); +if (!kgdb_single_step) {raw_spin_unlock (&dbg_slave_lock);/* Wait till all the CPUs have quit from the debugger. */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 52/376 kgdb: Prevent infinite recursive entries to the debugger
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit 3ca676e4ca60d1834bb77535dafe24169cadacef ]
If we detect that we recursively entered the debugger we should hack our I/O ops to NULL so that the panic() in the next line won't actually cause another recursion into the debugger. The first line of kgdb_panic() will check this and return.
--- kernel/debug/debug_core.c | 1 + 1 file changed, 1 insertion(+)
kernel/debug/debug_core.c +1 -0
@@ -532,6 +532,7 @@ static int kgdb_reenter_check(struct kgdb_state *ks)if (exception_level >1 ) {dump_stack (); + kgdb_io_module_registered = false;panic ("Recursive entry to debugger" ); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 53/376 pmu/smmuv3: Clear IRQ affinity hint on device removal
In reply to Greg Kroah-HartmanFrom: Jean-Philippe Brucker <[email protected]>
[ Upstream commit 10f6cd2af21bb44faab31a50ec3361d7649e5a39 ]
Currently when trying to remove the SMMUv3 PMU module we get a WARN_ON_ONCE from free_irq(), because the affinity hint set during probe hasn't been properly cleared.
[ 238.878383] WARNING: CPU: 0 PID: 175 at kernel/irq/manage.c:1744 free_irq+0x324/0x358 ... [ 238.897263] Call trace: [ 238.897998] free_irq+0x324/0x358 [ 238.898792] devm_irq_release+0x18/0x28 [ 238.899189] release_nodes+0x1b0/0x228 [ 238.899984] devres_release_all+0x38/0x60 [ 238.900779] device_release_driver_internal+0x10c/0x1d0 [ 238.901574] driver_detach+0x50/0xe0 [ 238.902368] bus_remove_driver+0x5c/0xd8 [ 238.903448] driver_unregister+0x30/0x60 [ 238.903958] platform_driver_unregister+0x14/0x20 [ 238.905075] arm_smmu_pmu_exit+0x1c/0xecc [arm_smmuv3_pmu] [ 238.905547] __arm64_sys_delete_module+0x14c/0x260 [ 238.906342] el0_svc_common.constprop.0+0x74/0x178 [ 238.907355] do_el0_svc+0x24/0x90 [ 238.907932] el0_sync_handler+0x11c/0x198 [ 238.908979] el0_sync+0x158/0x180
Just like the other perf drivers, clear the affinity hint before releasing the device.
--- drivers/perf/arm_smmuv3_pmu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/perf/arm_smmuv3_pmu.c +4 -1
@@ -814,7 +814,7 @@ static int smmu_pmu_probe(struct platform_device *pdev)if (err) {dev_err (dev,"Error %d registering hotplug, PMU @%pa\n" , err, &res_0->start); -return err; + goto out_clear_affinity; } err =perf_pmu_register (&smmu_pmu->pmu, name,-1 );
@@ -833,6 +833,8 @@ static int smmu_pmu_probe(struct platform_device *pdev) out_unregister:cpuhp_state_remove_instance_nocalls (cpuhp_state_num, &smmu_pmu->node); +out_clear_affinity: +irq_set_affinity_hint (smmu_pmu->irq,NULL );return err; }
@@ -842,6 +844,7 @@ static int smmu_pmu_remove(struct platform_device *pdev)perf_pmu_unregister (&smmu_pmu->pmu);cpuhp_state_remove_instance_nocalls (cpuhp_state_num, &smmu_pmu->node); +irq_set_affinity_hint (smmu_pmu->irq,NULL );return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 54/376 ath11k: Fix some resource leaks in error path in ath11k_thermal_register()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 25ca180ad380a0c7286442a922e7fbcc6a9f6083 ]
If 'thermal_cooling_device_register()' fails, we must undo what has been allocated so far. So we must go to 'err_thermal_destroy' instead of returning directly
In case of error in 'ath11k_thermal_register()', the previous 'thermal_cooling_device_register()' call must also be undone. Move the 'ar->thermal.cdev = cdev' a few lines above in order for this to be done in 'ath11k_thermal_unregister()' which is called in the error handling path.
--- drivers/net/wireless/ath/ath11k/thermal.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/thermal.c +4 -2
@@ -174,9 +174,12 @@ int ath11k_thermal_register(struct ath11k_base *sc)if (IS_ERR (cdev)) {ath11k_err (sc,"failed to setup thermal device result: %ld\n" ,PTR_ERR (cdev)); -return -EINVAL ; + ret = -EINVAL ; + goto err_thermal_destroy; } + ar->thermal.cdev = cdev; + ret =sysfs_create_link (&ar->hw->wiphy->dev.kobj, &cdev->device.kobj,"cooling_device" );if (ret) {
@@ -184,7 +187,6 @@ int ath11k_thermal_register(struct ath11k_base *sc) goto err_thermal_destroy; } - ar->thermal.cdev = cdev;if (!IS_REACHABLE (CONFIG_HWMON ))return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 55/376 ACPI/IORT: Fix PMCG node single ID mapping handling
In reply to Greg Kroah-HartmanFrom: Tuan Phan <[email protected]>
[ Upstream commit 50c8ab8d9fbf5b18d5162a797ca26568afc0af1a ]
An IORT PMCG node can have no ID mapping if its overflow interrupt is wire based therefore the code that parses the PMCG node can not assume the node will always have a single mapping present at index 0.
Fix iort_get_id_mapping_index() by checking for an overflow interrupt and mapping count.
--- drivers/acpi/arm64/iort.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/acpi/arm64/iort.c +5 -0
@@ -414,6 +414,7 @@ static struct acpi_iort_node *iort_node_get_id(struct acpi_iort_node *node,static int iort_get_id_mapping_index (struct acpi_iort_node *node) {struct acpi_iort_smmu_v3 *smmu; +struct acpi_iort_pmcg *pmcg;switch (node->type) {case ACPI_IORT_NODE_SMMU_V3 :
@@ -441,6 +442,10 @@ static int iort_get_id_mapping_index(struct acpi_iort_node *node)return smmu->id_mapping_index;case ACPI_IORT_NODE_PMCG : + pmcg = (struct acpi_iort_pmcg *)node->node_data; +if (pmcg->overflow_gsiv || node->mapping_count ==0 ) +return -EINVAL ; +return 0 ;default :return -EINVAL ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 56/376 drm/dp: Lenovo X13 Yoga OLED panel brightness fix
In reply to Greg Kroah-HartmanFrom: Mark Pearson <[email protected]>
[ Upstream commit 0df3ff451287d71c620384eb7bb2cd3a8106412c ]
Add another panel that needs the edid quirk to the list so that brightness control works correctly. Fixes issue seen on Lenovo X13 Yoga with OLED panel
--- drivers/gpu/drm/drm_dp_helper.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_dp_helper.c +1 -0
@@ -1313,6 +1313,7 @@ static const struct edid_quirk edid_quirk_list[] = { { MFG(0x06, 0xaf), PROD_ID(0xeb, 0x41), BIT(DP_QUIRK_FORCE_DPCD_BACKLIGHT) }, { MFG(0x4d, 0x10), PROD_ID(0xc7, 0x14), BIT(DP_QUIRK_FORCE_DPCD_BACKLIGHT) }, { MFG(0x4d, 0x10), PROD_ID(0xe6, 0x14), BIT(DP_QUIRK_FORCE_DPCD_BACKLIGHT) }, + { MFG(0x4c, 0x83), PROD_ID(0x47, 0x41), BIT(DP_QUIRK_FORCE_DPCD_BACKLIGHT) }, };#undef MFG
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 57/376 mips: Fix cpu_has_mips64r1/2 activation for MIPS32 CPUs
In reply to Greg Kroah-HartmanFrom: Serge Semin <[email protected]>
[ Upstream commit a2ac81c6ef4018ea49c034ce165bb9ea1cf99f3e ]
Commit 1aeba347b3a9 ("MIPS: Hardcode cpu_has_mips* where target ISA allows") updated the cpu_has_mips* macro to be replaced with a constant expression where it's possible. By mistake it wasn't done correctly for cpu_has_mips64r1/cpu_has_mips64r2 macro. They are defined to be replaced with conditional expression __isa_range_or_flag(), which means either ISA revision being within the range or the corresponding CPU options flag was set at the probe stage or both being true at the same time. But the ISA level value doesn't indicate whether the ISA is MIPS32 or MIPS64. Due to this if we select MIPS32r1 - MIPS32r5 architectures the __isa_range() macro will activate the cpu_has_mips64rX flags, which is incorrect. In order to fix the problem we make sure the 64bits CPU support is enabled by means of checking the flag cpu_has_64bits aside with proper ISA range and specific Revision flag being set.
--- arch/mips/include/asm/cpu-features.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/mips/include/asm/cpu-features.h +4 -2
@@ -288,10 +288,12 @@# define cpu_has_mips32r6 __isa_ge_or_flag(6, MIPS_CPU_ISA_M32R6)#endif #ifndef cpu_has_mips64r1 -# define cpu_has_mips64r1 __isa_range_or_flag(1, 6, MIPS_CPU_ISA_M64R1) +# define cpu_has_mips64r1 (cpu_has_64bits && \ + __isa_range_or_flag(1, 6, MIPS_CPU_ISA_M64R1))#endif #ifndef cpu_has_mips64r2 -# define cpu_has_mips64r2 __isa_range_or_flag(2, 6, MIPS_CPU_ISA_M64R2) +# define cpu_has_mips64r2 (cpu_has_64bits && \ + __isa_range_or_flag(2, 6, MIPS_CPU_ISA_M64R2))#endif #ifndef cpu_has_mips64r6# define cpu_has_mips64r6 __isa_ge_and_flag(6, MIPS_CPU_ISA_M64R6)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 58/376 spi: dw: Enable interrupts in accordance with DMA xfer mode
In reply to Greg Kroah-HartmanFrom: Serge Semin <[email protected]>
[ Upstream commit 43dba9f3f98c2b184a19f856f06fe22817bfd9e0 ]
It's pointless to track the Tx overrun interrupts if Rx-only SPI transfer is issued. Similarly there is no need in handling the Rx overrun/underrun interrupts if Tx-only SPI transfer is executed. So lets unmask the interrupts only if corresponding SPI transactions are implied.
--- drivers/spi/spi-dw-mid.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/spi/spi-dw-mid.c +8 -4
@@ -220,19 +220,23 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws,static int mid_spi_dma_setup (struct dw_spi *dws,struct spi_transfer *xfer) { -u16 dma_ctrl =0 ; +u16 imr =0 , dma_ctrl =0 ;dw_writel (dws,DW_SPI_DMARDLR ,0xf );dw_writel (dws,DW_SPI_DMATDLR ,0x10 ); -if (xfer->tx_buf) +if (xfer->tx_buf) { dma_ctrl |=SPI_DMA_TDMAE ; -if (xfer->rx_buf) + imr |=SPI_INT_TXOI ; + } +if (xfer->rx_buf) { dma_ctrl |=SPI_DMA_RDMAE ; + imr |=SPI_INT_RXUI |SPI_INT_RXOI ; + }dw_writel (dws,DW_SPI_DMACR , dma_ctrl);/* Set the interrupt mask */ -spi_umask_intr (dws,SPI_INT_TXOI |SPI_INT_RXUI |SPI_INT_RXOI ); +spi_umask_intr (dws, imr); dws->transfer_handler = dma_transfer;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 59/376 clocksource/drivers/timer-versatile: Clear OF_POPULATED flag
In reply to Greg Kroah-HartmanFrom: Saravana Kannan <[email protected]>
[ Upstream commit 7a3768c206a006525afc090f92d4d618d8356b92 ]
The commit 4f41fe386a94 ("clocksource/drivers/timer-probe: Avoid creating dead devices") broke the handling of arm,vexpress-sysreg [1].
The arm,vexpress-sysreg device is handled by both timer-versatile.c and drivers/mfd/vexpress-sysreg.c. While the timer driver doesn't use the device, the mfd driver still needs a device to probe.
So, this patch clears the OF_POPULATED flag to continue creating the device.
[1] - https://lore.kernel.org/lkml/[email protected]/
--- drivers/clocksource/timer-versatile.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/clocksource/timer-versatile.c +3 -0
@@ -6,6 +6,7 @@#include <linux/clocksource.h> #include <linux/io.h> +#include <linux/of.h> #include <linux/of_address.h> #include <linux/sched_clock.h>
@@ -22,6 +23,8 @@ static int __init versatile_sched_clock_init(struct device_node *node) {void __iomem *base =of_iomap (node,0 ); +of_node_clear_flag (node,OF_POPULATED ); +if (!base)return -ENXIO ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 60/376 clocksource: dw_apb_timer: Make CPU-affiliation being optional
In reply to Greg Kroah-HartmanFrom: Serge Semin <[email protected]>
[ Upstream commit cee43dbf2ee3f430434e2b66994eff8a1aeda889 ]
Currently the DW APB Timer driver binds each clockevent timers to a particular CPU. This isn't good for multiple reasons. First of all seeing the device is placed on APB bus (which makes it accessible from any CPU core), accessible over MMIO and having the DYNIRQ flag set we can be sure that manually binding the timer to any CPU just isn't correct. By doing so we just set an extra limitation on device usage. This also doesn't reflect the device actual capability, since by setting the IRQ affinity we can make it virtually local to any CPU. Secondly imagine if you had a real CPU-local timer with the same rating and the same CPU-affinity. In this case if DW APB timer was registered first, then due to the clockevent framework tick-timer selection procedure we'll end up with the real CPU-local timer being left unselected for clock-events tracking. But on most of the platforms (MIPS/ARM/etc) such timers are normally embedded into the CPU core and are accessible with much better performance then devices placed on APB. For instance in MIPS architectures there is r4k-timer, which is CPU-local, assigned with the same rating, and normally its clockevent device is registered after the platform-specific one.
So in order to fix all of these issues let's make the DW APB Timer CPU affinity being optional and deactivated by passing a negative CPU id, which will effectively set the DW APB clockevent timer cpumask to 'cpu_possible_mask'.
--- drivers/clocksource/dw_apb_timer.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/clocksource/dw_apb_timer.c +3 -2
@@ -222,7 +222,8 @@ static int apbt_next_event(unsigned long delta,/** * dw_apb_clockevent_init() - use an APB timer as a clock_event_device * -* @cpu: The CPU the events will be targeted at. +* @cpu: The CPU the events will be targeted at or -1 if CPU affiliation +* isn't required. * @name: The name used for the timer and the IRQ for it. * @rating: The rating to give the timer. * @base: I/O base for the timer registers.
@@ -257,7 +258,7 @@ dw_apb_clockevent_init(int cpu, const char *name, unsigned rating, dw_ced->ced.max_delta_ticks =0x7fffffff ; dw_ced->ced.min_delta_ns =clockevent_delta2ns (5000 , &dw_ced->ced); dw_ced->ced.min_delta_ticks =5000 ; - dw_ced->ced.cpumask =cpumask_of (cpu); + dw_ced->ced.cpumask = cpu <0 ? cpu_possible_mask :cpumask_of (cpu); dw_ced->ced.features =CLOCK_EVT_FEAT_PERIODIC |CLOCK_EVT_FEAT_ONESHOT |CLOCK_EVT_FEAT_DYNIRQ ; dw_ced->ced.set_state_shutdown = apbt_shutdown;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 61/376 clocksource: dw_apb_timer_of: Fix missing clockevent timers
In reply to Greg Kroah-HartmanFrom: Serge Semin <[email protected]>
[ Upstream commit 6d2e16a3181bafb77b535095c39ad1c8b9558c8c ]
Commit 100214889973 ("clocksource: dw_apb_timer_of: use clocksource_of_init") replaced a publicly available driver initialization method with one called by the timer_probe() method available after CLKSRC_OF. In current implementation it traverses all the timers available in the system and calls their initialization methods if corresponding devices were either in dtb or in acpi. But if before the commit any number of available timers would be installed as clockevent and clocksource devices, after that there would be at most two. The rest are just ignored since default case branch doesn't do anything. I don't see a reason of such behaviour, neither the commit message explains it. Moreover this might be wrong if on some platforms these timers might be used for different purpose, as virtually CPU-local clockevent timers and as an independent broadcast timer. So in order to keep the compatibility with the platforms where the order of the timers detection has some meaning, lets add the secondly discovered timer to be of clocksource/sched_clock type, while the very first and the others would provide the clockevents service.
--- drivers/clocksource/dw_apb_timer_of.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/clocksource/dw_apb_timer_of.c +2 -4
@@ -147,10 +147,6 @@ static int num_called;static int __init dw_apb_timer_init (struct device_node *timer) {switch (num_called) { -case 0 : -pr_debug ("%s: found clockevent timer\n" , __func__); -add_clockevent (timer); -break ;case 1 :pr_debug ("%s: found clocksource timer\n" , __func__);add_clocksource (timer);
@@ -161,6 +157,8 @@ static int __init dw_apb_timer_init(struct device_node *timer)#endif break ;default : +pr_debug ("%s: found clockevent timer\n" , __func__); +add_clockevent (timer);break ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 62/376 btrfs: account for trans_block_rsv in may_commit_transaction
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit bb4f58a747f0421b10645fbf75a6acc88da0de50 ]
On ppc64le with 64k page size (respectively 64k block size) generic/320 was failing and debug output showed we were getting a premature ENOSPC with a bunch of space in btrfs_fs_info::trans_block_rsv.
This meant there were still open transaction handles holding space, yet the flusher didn't commit the transaction because it deemed the freed space won't be enough to satisfy the current reserve ticket. Fix this by accounting for space in trans_block_rsv when deciding whether the current transaction should be committed or not.
--- fs/btrfs/space-info.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/btrfs/space-info.c +6 -0
@@ -626,6 +626,7 @@ static int may_commit_transaction(struct btrfs_fs_info *fs_info,struct reserve_ticket *ticket =NULL ;struct btrfs_block_rsv *delayed_rsv = &fs_info->delayed_block_rsv;struct btrfs_block_rsv *delayed_refs_rsv = &fs_info->delayed_refs_rsv; +struct btrfs_block_rsv *trans_rsv = &fs_info->trans_block_rsv;struct btrfs_trans_handle *trans;u64 bytes_needed;u64 reclaim_bytes =0 ;
@@ -688,6 +689,11 @@ static int may_commit_transaction(struct btrfs_fs_info *fs_info,spin_lock (&delayed_refs_rsv->lock); reclaim_bytes += delayed_refs_rsv->reserved;spin_unlock (&delayed_refs_rsv->lock); + +spin_lock (&trans_rsv->lock); + reclaim_bytes += trans_rsv->reserved; +spin_unlock (&trans_rsv->lock); +if (reclaim_bytes >= bytes_needed) goto commit; bytes_needed -= reclaim_bytes;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 63/376 btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
[ Upstream commit 7e4a3f7ed5d54926ec671bbb13e171cfe179cc50 ]
We are currently treating any non-zero return value from btrfs_next_leaf() the same way, by going to the code that inserts a new checksum item in the tree. However if btrfs_next_leaf() returns an error (a value < 0), we should just stop and return the error, and not behave as if nothing has happened, since in that case we do not have a way to know if there is a next leaf or we are currently at the last leaf already.
So fix that by returning the error from btrfs_next_leaf().
--- fs/btrfs/file-item.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/btrfs/file-item.c +4 -2
@@ -887,10 +887,12 @@ again: nritems =btrfs_header_nritems (path->nodes[0 ]);if (!nritems || (path->slots[0 ] >= nritems -1 )) { ret =btrfs_next_leaf (root, path); -if (ret ==1 ) +if (ret <0 ) { + goto out; + }else if (ret >0 ) { found_next =1 ; -if (ret !=0 ) goto insert; + } slot = path->slots[0 ]; }btrfs_item_key_to_cpu (path->nodes[0 ], &found_key, slot);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 64/376 spi: mux: repair mux usage
In reply to Greg Kroah-HartmanFrom: Peter Rosin <[email protected]>
[ Upstream commit a2b02e4623fb127fa65a13e4ac5aa56e4ae16291 ]
It is not valid to cache/short out selection of the mux.
mux_control_select() only locks the mux until mux_control_deselect() is called. mux_control_deselect() may put the mux in some low power state or some other user of the mux might select it for other purposes. These things are probably not happening in the original setting where this driver was developed, but it is said to be a generic SPI mux.
Also, the mux framework will short out the actual low level muxing operation when/if that is possible.
--- drivers/spi/spi-mux.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/spi/spi-mux.c +4 -4
@@ -51,6 +51,10 @@ static int spi_mux_select(struct spi_device *spi)struct spi_mux_priv *priv =spi_controller_get_devdata (spi->controller);int ret; + ret =mux_control_select (priv->mux, spi->chip_select); +if (ret) +return ret; +if (priv->current_cs == spi->chip_select)return 0 ;
@@ -62,10 +66,6 @@ static int spi_mux_select(struct spi_device *spi) priv->spi->mode = spi->mode; priv->spi->bits_per_word = spi->bits_per_word; - ret =mux_control_select (priv->mux, spi->chip_select); -if (ret) -return ret; - priv->current_cs = spi->chip_select;return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 65/376 ARM: 8978/1: mm: make act_mm() respect THREAD_SIZE
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
[ Upstream commit e1de94380af588bdf6ad6f0cc1f75004c35bc096 ]
Recent work with KASan exposed the folling hard-coded bitmask in arch/arm/mm/proc-macros.S:
bic rd, sp, #8128
bic rd, rd, #63
This forms the bitmask 0x1FFF that is coinciding with (PAGE_SIZE << THREAD_SIZE_ORDER) - 1, this code was assuming that THREAD_SIZE is always 8K (8192).
As KASan was increasing THREAD_SIZE_ORDER to 2, I ran into this bug.
Fix it by this little oneline suggested by Ard:
bic rd, sp, #(THREAD_SIZE - 1) & ~63
Where THREAD_SIZE is defined using THREAD_SIZE_ORDER.
We have to also include <linux/const.h> since the THREAD_SIZE expands to use the _AC() macro.
--- arch/arm/mm/proc-macros.S | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/mm/proc-macros.S +2 -1
@@ -5,6 +5,7 @@ * VMA_VM_FLAGS * VM_EXEC */ +#include <linux/const.h> #include <asm/asm-offsets.h> #include <asm/thread_info.h>
@@ -30,7 +31,7 @@ * act_mm - get current->active_mm */ .macro act_mm, rd - bic \rd, sp, #8128 + bic \rd, sp, #(THREAD_SIZE - 1) & ~63 bic \rd, \rd, #63 ldr \rd, [\rd, #TI_TASK] .if (TSK_ACTIVE_MM > IMM12_MASK)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 66/376 batman-adv: Revert "disable ethtool link speed detection when auto negotiation off"
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
[ Upstream commit 9ad346c90509ebd983f60da7d082f261ad329507 ]
The commit 8c46fcd78308 ("batman-adv: disable ethtool link speed detection when auto negotiation off") disabled the usage of ethtool's link_ksetting when auto negotation was enabled due to invalid values when used with tun/tap virtual net_devices. According to the patch, automatic measurements should be used for these kind of interfaces.
But there are major flaws with this argumentation:
* automatic measurements are not implemented
* auto negotiation has nothing to do with the validity of the retrieved values
The first point has to be fixed by a longer patch series. The "validity" part of the second point must be addressed in the same patch series by dropping the usage of ethtool's link_ksetting (thus always doing automatic measurements over ethernet).
Drop the patch again to have more default values for various net_device types/configurations. The user can still overwrite them using the batadv_hardif's BATADV_ATTR_THROUGHPUT_OVERRIDE.
--- net/batman-adv/bat_v_elp.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-)
net/batman-adv/bat_v_elp.c +1 -14
@@ -127,20 +127,7 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh)rtnl_lock (); ret =__ethtool_get_link_ksettings (hard_iface->net_dev, &link_settings);rtnl_unlock (); - -/* Virtual interface drivers such as tun / tap interfaces, VLAN, etc -* tend to initialize the interface throughput with some value for the -* sake of having a throughput number to export via ethtool. This -* exported throughput leaves batman-adv to conclude the interface -* throughput is genuine (reflecting reality), thus no measurements -* are necessary. -* -* Based on the observation that those interface types also tend to set -* the link auto-negotiation to 'off', batman-adv shall check this -* setting to differentiate between genuine link throughput information -* and placeholders installed by virtual interfaces. -*/ -if (ret ==0 && link_settings.base.autoneg ==AUTONEG_ENABLE ) { +if (ret ==0 ) {/* link characteristics might change over time */ if (link_settings.base.duplex ==DUPLEX_FULL ) hard_iface->bat_v.flags |=BATADV_FULL_DUPLEX ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 67/376 xfs: more lockdep whackamole with kmem_alloc*
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit 6dcde60efd946e38fac8d276a6ca47492103e856 ]
Dave Airlie reported the following lockdep complaint:
Quoted 65 lines
======================================================
WARNING: possible circular locking dependency detected 5.7.0-0.rc5.20200515git1ae7efb38854.1.fc33.x86_64 #1 Not tainted
------------------------------------------------------
kswapd0/159 is trying to acquire lock:
ffff9b38d01a4470(&xfs_nondir_ilock_class){++++}-{3:3},
at:xfs_ilock+0xde/0x2c0[xfs]but task is already holding lock:
ffffffffbbb8bd00(fs_reclaim){+.+.}-{0:0}, at:
__fs_reclaim_acquire+0x5/0x30which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (fs_reclaim){+.+.}-{0:0}:
fs_reclaim_acquire+0x34/0x40 __kmalloc+0x4f/0x270 kmem_alloc+0x93/0x1d0 [xfs] kmem_alloc_large+0x4c/0x130 [xfs] xfs_attr_copy_value+0x74/0xa0 [xfs] xfs_attr_get+0x9d/0xc0 [xfs] xfs_get_acl+0xb6/0x200 [xfs] get_acl+0x81/0x160 posix_acl_xattr_get+0x3f/0xd0 vfs_getxattr+0x148/0x170 getxattr+0xa7/0x240 path_getxattr+0x52/0x80 do_syscall_64+0x5c/0xa0 entry_SYSCALL_64_after_hwframe+0x49/0xb3-> #0 (&xfs_nondir_ilock_class){++++}-{3:3}:
__lock_acquire+0x1257/0x20d0 lock_acquire+0xb0/0x310 down_write_nested+0x49/0x120 xfs_ilock+0xde/0x2c0 [xfs] xfs_reclaim_inode+0x3f/0x400 [xfs] xfs_reclaim_inodes_ag+0x20b/0x410 [xfs] xfs_reclaim_inodes_nr+0x31/0x40 [xfs] super_cache_scan+0x190/0x1e0 do_shrink_slab+0x184/0x420 shrink_slab+0x182/0x290 shrink_node+0x174/0x680 balance_pgdat+0x2d0/0x5f0 kswapd+0x21f/0x510 kthread+0x131/0x150 ret_from_fork+0x3a/0x50other info that might help us debug this:
Possible unsafe locking scenario:CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(&xfs_nondir_ilock_class); lock(fs_reclaim);
lock(&xfs_nondir_ilock_class);*** DEADLOCK ***
4 locks held by kswapd0/159:
#0:ffffffffbbb8bd00(fs_reclaim){+.+.}-{0:0}, at:
Quoted 8 lines
__fs_reclaim_acquire+0x5/0x30
#1: ffffffffbbb7cef8 (shrinker_rwsem){++++}-{3:3}, at:
shrink_slab+0x115/0x290
#2: ffff9b39f07a50e8
(&type->s_umount_key#56){++++}-{3:3}, at: super_cache_scan+0x38/0x1e0
#3: ffff9b39f077f258
(&pag->pag_ici_reclaim_lock){+.+.}-{3:3}, at:
xfs_reclaim_inodes_ag+0x82/0x410 [xfs]This is a known false positive because inodes cannot simultaneously be getting reclaimed and the target of a getxattr operation, but lockdep doesn't know that. We can (selectively) shut up lockdep until either it gets smarter or we change inode reclaim not to require the ILOCK by applying a stupid GFP_NOLOCKDEP bandaid.
--- fs/xfs/kmem.h | 6 +++++- fs/xfs/libxfs/xfs_attr_leaf.c | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-)
fs/xfs/kmem.h +5 -1
@@ -19,6 +19,7 @@ typedef unsigned __bitwise xfs_km_flags_t;#define KM_NOFS ((__force xfs_km_flags_t)0x0004u)#define KM_MAYFAIL ((__force xfs_km_flags_t)0x0008u)#define KM_ZERO ((__force xfs_km_flags_t)0x0010u) +#define KM_NOLOCKDEP ((__force xfs_km_flags_t)0x0020u)/* * We use a special process flag to avoid recursive callbacks into
@@ -30,7 +31,7 @@ kmem_flags_convert(xfs_km_flags_t flags) {gfp_t lflags; -BUG_ON (flags & ~(KM_NOFS |KM_MAYFAIL |KM_ZERO )); +BUG_ON (flags & ~(KM_NOFS |KM_MAYFAIL |KM_ZERO |KM_NOLOCKDEP )); lflags =GFP_KERNEL | __GFP_NOWARN;if (flags &KM_NOFS )
@@ -49,6 +50,9 @@ kmem_flags_convert(xfs_km_flags_t flags)if (flags &KM_ZERO ) lflags |= __GFP_ZERO; +if (flags &KM_NOLOCKDEP ) + lflags |= __GFP_NOLOCKDEP; +return lflags; }
fs/xfs/libxfs/xfs_attr_leaf.c +1 -1
@@ -489,7 +489,7 @@ xfs_attr_copy_value( }if (!args->value) { - args->value =kmem_alloc_large (valuelen,0 ); + args->value =kmem_alloc_large (valuelen,KM_NOLOCKDEP );if (!args->value)return -ENOMEM ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 68/376 ice: Fix memory leak
In reply to Greg Kroah-HartmanFrom: Surabhi Boob <[email protected]>
[ Upstream commit 1aaef2bc4e0a5ce9e4dd86359e6a0bf52c6aa64f ]
Handle memory leak on filter management initialization failure.
--- drivers/net/ethernet/intel/ice/ice_common.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_common.c +7 -1
@@ -322,6 +322,7 @@ ice_aq_get_link_info(struct ice_port_info *pi, bool ena_lse,static enum ice_status ice_init_fltr_mgmt_struct (struct ice_hw *hw) {struct ice_switch_info *sw; +enum ice_status status; hw->switch_info =devm_kzalloc (ice_hw_to_dev (hw),sizeof (*hw->switch_info),GFP_KERNEL );
@@ -332,7 +333,12 @@ static enum ice_status ice_init_fltr_mgmt_struct(struct ice_hw *hw)INIT_LIST_HEAD (&sw->vsi_list_map_head); -return ice_init_def_sw_recp (hw); + status =ice_init_def_sw_recp (hw); +if (status) { +devm_kfree (ice_hw_to_dev (hw), hw->switch_info); +return status; + } +return 0 ; }/**
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 69/376 ice: Fix for memory leaks and modify ICE_FREE_CQ_BUFS
In reply to Greg Kroah-HartmanFrom: Surabhi Boob <[email protected]>
[ Upstream commit 68d270783742783f96e89ef92ac24ab3c7fb1d31 ]
Handle memory leaks during control queue initialization and buffer allocation failures. The macro ICE_FREE_CQ_BUFS is modified to re-use for this fix.
--- drivers/net/ethernet/intel/ice/ice_controlq.c | 49 +++++++++++-------- 1 file changed, 28 insertions(+), 21 deletions(-)
drivers/net/ethernet/intel/ice/ice_controlq.c +28 -21
@@ -199,7 +199,9 @@ unwind_alloc_rq_bufs: cq->rq.r.rq_bi[i].pa =0 ; cq->rq.r.rq_bi[i].size =0 ; } + cq->rq.r.rq_bi =NULL ;devm_kfree (ice_hw_to_dev (hw), cq->rq.dma_head); + cq->rq.dma_head =NULL ;return ICE_ERR_NO_MEMORY ; }
@@ -245,7 +247,9 @@ unwind_alloc_sq_bufs: cq->sq.r.sq_bi[i].pa =0 ; cq->sq.r.sq_bi[i].size =0 ; } + cq->sq.r.sq_bi =NULL ;devm_kfree (ice_hw_to_dev (hw), cq->sq.dma_head); + cq->sq.dma_head =NULL ;return ICE_ERR_NO_MEMORY ; }
@@ -304,6 +308,28 @@ ice_cfg_rq_regs(struct ice_hw *hw, struct ice_ctl_q_info *cq)return 0 ; } +#define ICE_FREE_CQ_BUFS(hw, qi, ring) \ +do { \ + int i; \ + /* free descriptors */ \ + if ((qi)->ring.r.ring##_bi) \ + for (i = 0; i < (qi)->num_##ring##_entries; i++) \ + if ((qi)->ring.r.ring##_bi[i].pa) { \ + dmam_free_coherent(ice_hw_to_dev(hw), \ + (qi)->ring.r.ring##_bi[i].size, \ + (qi)->ring.r.ring##_bi[i].va, \ + (qi)->ring.r.ring##_bi[i].pa); \ + (qi)->ring.r.ring##_bi[i].va = NULL;\ + (qi)->ring.r.ring##_bi[i].pa = 0;\ + (qi)->ring.r.ring##_bi[i].size = 0;\ + } \ +/* free the buffer info list */ \ +if ((qi)->ring.cmd_buf) \ +devm_kfree (ice_hw_to_dev (hw), (qi)->ring.cmd_buf); \ +/* free DMA head */ \ +devm_kfree (ice_hw_to_dev (hw), (qi)->ring.dma_head); \ +}while (0 ) +/** * ice_init_sq - main initialization routine for Control ATQ * @hw: pointer to the hardware structure
@@ -357,6 +383,7 @@ static enum ice_status ice_init_sq(struct ice_hw *hw, struct ice_ctl_q_info *cq) goto init_ctrlq_exit; init_ctrlq_free_rings: +ICE_FREE_CQ_BUFS (hw, cq, sq);ice_free_cq_ring (hw, &cq->sq); init_ctrlq_exit:
@@ -416,33 +443,13 @@ static enum ice_status ice_init_rq(struct ice_hw *hw, struct ice_ctl_q_info *cq) goto init_ctrlq_exit; init_ctrlq_free_rings: +ICE_FREE_CQ_BUFS (hw, cq, rq);ice_free_cq_ring (hw, &cq->rq); init_ctrlq_exit:return ret_code; } -#define ICE_FREE_CQ_BUFS(hw, qi, ring) \ -do { \ - int i; \ - /* free descriptors */ \ - for (i = 0; i < (qi)->num_##ring##_entries; i++) \ - if ((qi)->ring.r.ring##_bi[i].pa) { \ - dmam_free_coherent(ice_hw_to_dev(hw), \ - (qi)->ring.r.ring##_bi[i].size,\ - (qi)->ring.r.ring##_bi[i].va,\ - (qi)->ring.r.ring##_bi[i].pa);\ - (qi)->ring.r.ring##_bi[i].va = NULL; \ - (qi)->ring.r.ring##_bi[i].pa = 0; \ - (qi)->ring.r.ring##_bi[i].size = 0; \ - } \ -/* free the buffer info list */ \ -if ((qi)->ring.cmd_buf) \ -devm_kfree (ice_hw_to_dev (hw), (qi)->ring.cmd_buf); \ -/* free DMA head */ \ -devm_kfree (ice_hw_to_dev (hw), (qi)->ring.dma_head); \ -}while (0 ) -/** * ice_shutdown_sq - shutdown the Control ATQ * @hw: pointer to the hardware structure
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 70/376 ice: Change number of XDP TxQ to 0 when destroying rings
In reply to Greg Kroah-HartmanFrom: Marta Plantykow <[email protected]>
[ Upstream commit c8f135c6ee7851ad72bd4d877216950fcbd45fb6 ]
When XDP Tx rings are destroyed the number of XDP Tx queues is not changing. This patch is changing this number to 0.
--- drivers/net/ethernet/intel/ice/ice_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/intel/ice/ice_main.c +3 -0
@@ -1898,6 +1898,9 @@ free_qmap:for (i =0 ; i < vsi->tc_cfg.numtc; i++) max_txqs[i] = vsi->num_txq; +/* change number of XDP Tx queues to 0 */ + vsi->num_xdp_txq =0 ; +return ice_cfg_vsi_lan (vsi->port_info, vsi->idx, vsi->tc_cfg.ena_tc, max_txqs); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 71/376 mmc: mmci_sdmmc: fix power on issue due to pwr_reg initialization
In reply to Greg Kroah-HartmanFrom: Ludovic Barre <[email protected]>
[ Upstream commit 33ba6fec0012e47f4e72bfab922b99327373f210 ]
This patch fix a power-on issue, and avoid to retry the power sequence.
In power off sequence: sdmmc must set pwr_reg in "power-cycle" state (value 0x2), to prevent the card from being supplied through the signal lines (all the lines are driven low).
In power on sequence: when the power is stable, sdmmc must set pwr_reg in "power-off" state (value 0x0) to drive all signal to high before to set "power-on".
To avoid writing the same value to the power register several times, this register is cached by the pwr_reg variable. At probe pwr_reg is initialized to 0 by kzalloc of mmc_alloc_host.
Like pwr_reg value is 0 at probing, the power on sequence fail because the "power-off" state is not writes (value 0x0) and the lines remain drive to low.
This patch initializes "pwr_reg" variable with power register value. This it done in sdmmc variant init to not disturb default mmci behavior.
--- drivers/mmc/host/mmci_stm32_sdmmc.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/mmci_stm32_sdmmc.c +1 -0
@@ -522,6 +522,7 @@ void sdmmc_variant_init(struct mmci_host *host)struct sdmmc_dlyb *dlyb; host->ops = &sdmmc_variant_ops; + host->pwr_reg =readl_relaxed (host->base +MMCIPOWER ); base_dlyb =devm_of_iomap (mmc_dev (host->mmc), np,1 ,NULL );if (IS_ERR (base_dlyb))
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 72/376 mmc: meson-mx-sdio: trigger a soft reset after a timeout or CRC error
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit 91995b904ec2e44b5c159ac6a5d3f154345a4de7 ]
The vendor driver (from the 3.10 kernel) triggers a soft reset every time before starting a new command. While this fixes a problem where SDIO cards are not detected at all (because all commands simply timed out) this hurts SD card read performance a bit (in my tests between 10% to 20%).
Trigger a soft reset after we got a CRC error or if the previous command timed out (just like the vendor driver from the same 3.10 kernel for the newer SDHC controller IP does). This fixes detection of SDIO cards and doesn't hurt SD card read performance at the same time.
With this patch the initialization of an RTL8723BS SDIO card looks like this:
req done (CMD52): -110: 00000000 00000000 00000000 00000000 clock 400000Hz busmode 2 powermode 2 cs 1 Vdd 21 width 1 timing 0 starting CMD0 arg 00000000 flags 000000c0
req done (CMD0): 0: 00000000 00000000 00000000 00000000 clock 400000Hz busmode 2 powermode 2 cs 0 Vdd 21 width 1 timing 0 starting CMD8 arg 000001aa flags 000002f5
req done (CMD8): -110: 00000000 00000000 00000000 00000000 starting CMD5 arg 00000000 flags 000002e1
req done (CMD5): 0: 90ff0000 00000000 00000000 00000000 starting CMD5 arg 00200000 flags 000002e1
req done (CMD5): 0: 90ff0000 00000000 00000000 00000000 starting CMD3 arg 00000000 flags 00000075
req done (CMD3): 0: 00010000 00000000 00000000 00000000 starting CMD7 arg 00010000 flags 00000015
req done (CMD7): 0: 00001e00 00000000 00000000 00000000 starting CMD52 arg 00000000 flags 00000195
req done (CMD52): 0: 00001032 00000000 00000000 00000000 [... more CMD52 omitted ...]
clock 400000Hz busmode 2 powermode 2 cs 0 Vdd 21 width 1 timing 2 clock 50000000Hz busmode 2 powermode 2 cs 0 Vdd 21 width 1 timing 2 starting CMD52 arg 00000e00 flags 00000195
req done (CMD52): 0: 00001000 00000000 00000000 00000000 starting CMD52 arg 80000e02 flags 00000195
req done (CMD52): 0: 00001002 00000000 00000000 00000000 clock 50000000Hz busmode 2 powermode 2 cs 0 Vdd 21 width 4 timing 2 starting CMD52 arg 00020000 flags 00000195
req done (CMD52): 0: 00001007 00000000 00000000 00000000 [... more CMD52 omitted ...]
new high speed SDIO card at address 0001
--- drivers/mmc/host/meson-mx-sdio.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mmc/host/meson-mx-sdio.c +3 -0
@@ -246,6 +246,9 @@ static void meson_mx_mmc_request_done(struct meson_mx_mmc_host *host) mrq = host->mrq; +if (host->cmd->error) +meson_mx_mmc_soft_reset (host); + host->mrq =NULL ; host->cmd =NULL ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 73/376 Bluetooth: btmtkuart: Improve exception handling in btmtuart_probe()
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
[ Upstream commit 4803c54ca24923a30664bea2a7772db6e7303c51 ]
Calls of the functions clk_disable_unprepare() and hci_free_dev() were missing for the exception handling.
Thus add the missed function calls together with corresponding jump targets.
--- drivers/bluetooth/btmtkuart.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/bluetooth/btmtkuart.c +8 -6
@@ -1015,7 +1015,7 @@ static int btmtkuart_probe(struct serdev_device *serdev)if (btmtkuart_is_standalone (bdev)) { err =clk_prepare_enable (bdev->osc);if (err <0 ) -return err; + goto err_hci_free_dev;if (bdev->boot) {gpiod_set_value_cansleep (bdev->boot,1 );
@@ -1028,10 +1028,8 @@ static int btmtkuart_probe(struct serdev_device *serdev)/* Power on */ err =regulator_enable (bdev->vcc); -if (err <0 ) { -clk_disable_unprepare (bdev->osc); -return err; - } +if (err <0 ) + goto err_clk_disable_unprepare;/* Reset if the reset-gpios is available otherwise the board * -level design should be guaranteed.
@@ -1063,7 +1061,6 @@ static int btmtkuart_probe(struct serdev_device *serdev) err =hci_register_dev (hdev);if (err <0 ) {dev_err (&serdev->dev,"Can't register HCI device\n" ); -hci_free_dev (hdev); goto err_regulator_disable; }
@@ -1072,6 +1069,11 @@ static int btmtkuart_probe(struct serdev_device *serdev) err_regulator_disable:if (btmtkuart_is_standalone (bdev))regulator_disable (bdev->vcc); +err_clk_disable_unprepare: +if (btmtkuart_is_standalone (bdev)) +clk_disable_unprepare (bdev->osc); +err_hci_free_dev: +hci_free_dev (hdev);return err; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 74/376 Bluetooth: hci_qca: Fix suspend/resume functionality failure
In reply to Greg Kroah-HartmanFrom: Zijun Hu <[email protected]>
[ Upstream commit feac90d756c03b03b83fabe83571bd88ecc96b78 ]
@dev parameter of qca_suspend()/qca_resume() represents serdev_device, but it is mistook for hci_dev and causes succedent unexpected memory access.
Fix by taking @dev as serdev_device.
--- drivers/bluetooth/hci_qca.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/bluetooth/hci_qca.c +6 -4
@@ -1953,8 +1953,9 @@ static void qca_serdev_remove(struct serdev_device *serdev)static int __maybe_unused qca_suspend (struct device *dev) { - struct hci_dev *hdev = container_of(dev, struct hci_dev, dev); -struct hci_uart *hu =hci_get_drvdata (hdev); +struct serdev_device *serdev =to_serdev_device (dev); +struct qca_serdev *qcadev =serdev_device_get_drvdata (serdev); +struct hci_uart *hu = &qcadev->serdev_hu;struct qca_data *qca = hu->priv;unsigned long flags;int ret =0 ;
@@ -2033,8 +2034,9 @@ error:static int __maybe_unused qca_resume (struct device *dev) { - struct hci_dev *hdev = container_of(dev, struct hci_dev, dev); -struct hci_uart *hu =hci_get_drvdata (hdev); +struct serdev_device *serdev =to_serdev_device (dev); +struct qca_serdev *qcadev =serdev_device_get_drvdata (serdev); +struct hci_uart *hu = &qcadev->serdev_hu;struct qca_data *qca = hu->priv;clear_bit (QCA_SUSPENDING , &qca->flags);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 75/376 spi: dw: Fix Rx-only DMA transfers
In reply to Greg Kroah-HartmanFrom: Serge Semin <[email protected]>
[ Upstream commit 46164fde6b7890e7a3982d54549947c8394c0192 ]
Tx-only DMA transfers are working perfectly fine since in this case the code just ignores the Rx FIFO overflow interrupts. But it turns out the SPI Rx-only transfers are broken since nothing pushing any data to the shift registers, so the Rx FIFO is left empty and the SPI core subsystems just returns a timeout error. Since DW DMAC driver doesn't support something like cyclic write operations of a single byte to a device register, the only way to support the Rx-only SPI transfers is to fake it by using a dummy Tx-buffer. This is what we intend to fix in this commit by setting the SPI_CONTROLLER_MUST_TX flag for DMA-capable platform.
--- drivers/spi/spi-dw.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-dw.c +1 -0
@@ -531,6 +531,7 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws) dws->dma_inited =0 ; }else { master->can_dma = dws->dma_ops->can_dma; + master->flags |=SPI_CONTROLLER_MUST_TX ; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 76/376 ice: fix PCI device serial number to be lowercase values
In reply to Greg Kroah-HartmanFrom: Paul M Stillwell Jr <[email protected]>
[ Upstream commit 1a9c561aa35534a03c0aa51c7fb1485731202a7c ]
Commit ceb2f00707f9 ("ice: Use pci_get_dsn()") changed the code to use a new function to get the Device Serial Number. It also changed the case of the filename for loading a package on a specific NIC from lowercase to uppercase. Change the filename back to lowercase since that is what we specified.
--- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_main.c +1 -1
@@ -3126,7 +3126,7 @@ static char *ice_get_opt_fw_name(struct ice_pf *pf)if (!opt_fw_filename)return NULL ; -snprintf (opt_fw_filename,NAME_MAX ,"%sice-%016llX.pkg" , +snprintf (opt_fw_filename,NAME_MAX ,"%sice-%016llx.pkg" ,ICE_DDP_PKG_PATH , dsn);return opt_fw_filename;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 77/376 x86/kvm/hyper-v: Explicitly align hcall param for kvm_hyperv_exit
In reply to Greg Kroah-HartmanFrom: Jon Doron <[email protected]>
[ Upstream commit f7d31e65368aeef973fab788aa22c4f1d5a6af66 ]
The problem the patch is trying to address is the fact that 'struct kvm_hyperv_exit' has different layout on when compiling in 32 and 64 bit modes.
In 64-bit mode the default alignment boundary is 64 bits thus forcing extra gaps after 'type' and 'msr' but in 32-bit mode the boundary is at 32 bits thus no extra gaps.
This is an issue as even when the kernel is 64 bit, the userspace using the interface can be both 32 and 64 bit but the same 32 bit userspace has to work with 32 bit kernel.
The issue is fixed by forcing the 64 bit layout, this leads to ABI change for 32 bit builds and while we are obviously breaking '32 bit userspace with 32 bit kernel' case, we're fixing the '32 bit userspace with 64 bit kernel' one.
As the interface has no (known) users and 32 bit KVM is rather baroque nowadays, this seems like a reasonable decision.
Message-Id: <[email protected]>
--- Documentation/virt/kvm/api.rst | 2 ++ include/uapi/linux/kvm.h | 2 ++ 2 files changed, 4 insertions(+)
Documentation/virt/kvm/api.rst +2 -0
@@ -5067,9 +5067,11 @@ EOI was received. #define KVM_EXIT_HYPERV_SYNIC 1 #define KVM_EXIT_HYPERV_HCALL 2 __u32 type; + __u32 pad1; union { struct { __u32 msr; + __u32 pad2; __u64 control; __u64 evt_page; __u64 msg_page;
include/uapi/linux/kvm.h +2 -0
@@ -189,9 +189,11 @@ struct kvm_hyperv_exit {#define KVM_EXIT_HYPERV_SYNIC 1#define KVM_EXIT_HYPERV_HCALL 2__u32 type; +__u32 pad1;union {struct {__u32 msr; +__u32 pad2;__u64 control;__u64 evt_page;__u64 msg_page;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 78/376 net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 3e1c6846b9e108740ef8a37be80314053f5dd52a ]
The value adapter->rss_conf is stored in DMA memory, and it is assigned to rssConf, so rssConf->indTableSize can be modified at anytime by malicious hardware. Because rssConf->indTableSize is assigned to n, buffer overflow may occur when the code "rssConf->indTable[n]" is executed.
To fix this possible bug, n is checked after being used.
--- drivers/net/vmxnet3/vmxnet3_ethtool.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/vmxnet3/vmxnet3_ethtool.c +2 -0
@@ -700,6 +700,8 @@ vmxnet3_get_rss(struct net_device *netdev, u32 *p, u8 *key, u8 *hfunc) *hfunc =ETH_RSS_HASH_TOP ;if (!p)return 0 ; +if (n >UPT1_RSS_MAX_IND_TABLE_SIZE ) +return 0 ;while (n--) p[n] = rssConf->indTable[n];return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 79/376 Crypto/chcr: Fixes a coccinile check error
In reply to Greg Kroah-HartmanFrom: Ayush Sawal <[email protected]>
[ Upstream commit 055be6865dea6743b090d1c55c8d21a5e01df201 ]
This fixes an error observed after running coccinile check. drivers/crypto/chelsio/chcr_algo.c:1462:5-8: Unneeded variable:
"err". Return "0" on line 1480
This line is missed in the commit 567be3a5d227 ("crypto:
chelsio - Use multiple txq/rxq per tfm to process the requests").
chelsio - Use multiple txq/rxq per tfm to process the requests").
V1->V2
-Modified subject.
--- drivers/crypto/chelsio/chcr_algo.c | 1 + 1 file changed, 1 insertion(+)
drivers/crypto/chelsio/chcr_algo.c +1 -0
@@ -1443,6 +1443,7 @@ static int chcr_device_init(struct chcr_context *ctx)if (!ctx->dev) { u_ctx =assign_chcr_device ();if (!u_ctx) { + err = -ENXIO ;pr_err ("chcr device assignment fails\n" ); goto out; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 80/376 x86: fix vmap arguments in map_irq_stack
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 0348801151b5aefbcf9d6e9b9e30aceb3a2a7b13 ]
vmap does not take a gfp_t, the flags argument is for VM_* flags.
--- arch/x86/kernel/irq_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/irq_64.c +1 -1
@@ -43,7 +43,7 @@ static int map_irq_stack(unsigned int cpu) pages[i] =pfn_to_page (pa >>PAGE_SHIFT ); } - va =vmap (pages,IRQ_STACK_SIZE /PAGE_SIZE ,GFP_KERNEL ,PAGE_KERNEL ); + va =vmap (pages,IRQ_STACK_SIZE /PAGE_SIZE ,VM_MAP ,PAGE_KERNEL );if (!va)return -ENOMEM ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 81/376 staging: android: ion: use vmap instead of vm_map_ram
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 5bf9917452112694b2c774465ee4dbe441c84b77 ]
vm_map_ram can keep mappings around after the vm_unmap_ram. Using that with non-PAGE_KERNEL mappings can lead to all kinds of aliasing issues.
--- drivers/staging/android/ion/ion_heap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/android/ion/ion_heap.c +2 -2
@@ -99,12 +99,12 @@ int ion_heap_map_user(struct ion_heap *heap, struct ion_buffer *buffer,static int ion_heap_clear_pages (struct page **pages,int num,pgprot_t pgprot) { -void *addr =vm_map_ram (pages, num,-1 , pgprot); +void *addr =vmap (pages, num,VM_MAP , pgprot);if (!addr)return -ENOMEM ;memset (addr,0 ,PAGE_SIZE * num); -vm_unmap_ram (addr, num); +vunmap (addr);return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 82/376 ubsan: entirely disable alignment checks under UBSAN_TRAP
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 9380ce246a052a1e00121cd480028b6907aeae38 ]
Commit 8d58f222e85f ("ubsan: disable UBSAN_ALIGNMENT under COMPILE_TEST") tried to fix the pathological results of UBSAN_ALIGNMENT with UBSAN_TRAP (which objtool would rightly scream about), but it made an assumption about how COMPILE_TEST gets set (it is not set for randconfig). As a result, we need a bigger hammer here: just don't allow the alignment checks with the trap mode.
--- lib/Kconfig.ubsan | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/Kconfig.ubsan +1 -1
@@ -63,7 +63,7 @@ config UBSAN_SANITIZE_ALL config UBSAN_ALIGNMENT bool "Enable checks for pointers alignment" default !HAVE_EFFICIENT_UNALIGNED_ACCESS - depends on !X86 || !COMPILE_TEST + depends on !UBSAN_TRAP help This option enables the check of unaligned memory accesses. Enabling this option on architectures that support unaligned
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 83/376 ath11k: fix error message to correctly report the command that failed
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 9a8074e3bcd7956ec6b4f7c26360af1b0b0abe38 ]
Currently the error message refers to the command WMI_TWT_DIeABLE_CMDID which looks like a cut-n-paste mangled typo. Fix the message to match the command WMI_BSS_COLOR_CHANGE_ENABLE_CMDID that failed.
--- drivers/net/wireless/ath/ath11k/wmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/wmi.c +1 -1
@@ -2779,7 +2779,7 @@ int ath11k_wmi_send_bss_color_change_enable_cmd(struct ath11k *ar, u32 vdev_id, ret =ath11k_wmi_cmd_send (wmi, skb,WMI_BSS_COLOR_CHANGE_ENABLE_CMDID );if (ret) { -ath11k_warn (ab,"Failed to send WMI_TWT_DIeABLE_CMDID" ); +ath11k_warn (ab,"Failed to send WMI_BSS_COLOR_CHANGE_ENABLE_CMDID" );dev_kfree_skb (skb); }return ret;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 84/376 drm/hisilicon: Enforce 128-byte stride alignment to fix the hardware limitation
In reply to Greg Kroah-HartmanFrom: Tian Tao <[email protected]>
[ Upstream commit 9c9a8468de21895abc43f45fc86346467217c986 ]
because the hardware limitation,The initial color depth must set to 32bpp and must set the FB Offset of the display hardware to 128Byte alignment, which is used to solve the display problem at 800x600 and 1440x900 resolution under 16bpp.
--- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 9 +++++---- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 4 ++-- drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c | 2 +- 3 files changed, 8 insertions(+), 7 deletions(-)
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c +5 -4
@@ -94,6 +94,10 @@ static int hibmc_plane_atomic_check(struct drm_plane *plane,return -EINVAL ; } +if (state->fb->pitches[0 ] %128 !=0 ) { +DRM_DEBUG_ATOMIC ("wrong stride with 128-byte aligned\n" ); +return -EINVAL ; + }return 0 ; }
@@ -119,11 +123,8 @@ static void hibmc_plane_atomic_update(struct drm_plane *plane,writel (gpu_addr, priv->mmio +HIBMC_CRT_FB_ADDRESS ); reg = state->fb->width * (state->fb->format->cpp[0 ]); -/* now line_pad is 16 */ - reg =PADDING (16 , reg); - line_l = state->fb->width * state->fb->format->cpp[0 ]; - line_l =PADDING (16 , line_l); + line_l = state->fb->pitches[0 ];writel (HIBMC_FIELD (HIBMC_CRT_FB_WIDTH_WIDTH , reg) |HIBMC_FIELD (HIBMC_CRT_FB_WIDTH_OFFS , line_l), priv->mmio +HIBMC_CRT_FB_WIDTH );
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +2 -2
@@ -94,7 +94,7 @@ static int hibmc_kms_init(struct hibmc_drm_private *priv) priv->dev->mode_config.max_height =1200 ; priv->dev->mode_config.fb_base = priv->fb_base; - priv->dev->mode_config.preferred_depth =24 ; + priv->dev->mode_config.preferred_depth =32 ; priv->dev->mode_config.prefer_shadow =1 ; priv->dev->mode_config.funcs = (void *)&hibmc_mode_funcs;
@@ -307,7 +307,7 @@ static int hibmc_load(struct drm_device *dev)/* reset all the states of crtc/plane/encoder/connector */ drm_mode_config_reset (dev); - ret =drm_fbdev_generic_setup (dev,16 ); + ret =drm_fbdev_generic_setup (dev, dev->mode_config.preferred_depth);if (ret) {DRM_ERROR ("failed to initialize fbdev: %d\n" , ret); goto err;
drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c +1 -1
@@ -50,7 +50,7 @@ void hibmc_mm_fini(struct hibmc_drm_private *hibmc)int hibmc_dumb_create (struct drm_file *file,struct drm_device *dev,struct drm_mode_create_dumb *args) { -return drm_gem_vram_fill_create_dumb (file, dev,0 ,16 , args); +return drm_gem_vram_fill_create_dumb (file, dev,0 ,128 , args); }const struct drm_mode_config_funcs hibmc_mode_funcs = {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 85/376 ath11k: Avoid mgmt tx count underflow
In reply to Greg Kroah-HartmanFrom: Sriram R <[email protected]>
[ Upstream commit 800113ff4b1d277c2b66ffc04d4d38f202a0d187 ]
The mgmt tx count reference is incremented/decremented on every mgmt tx and on tx completion event from firmware.
In case of an unexpected mgmt tx completion event from firmware, the counter would underflow. Avoid this by decrementing
only when the tx count is greater than 0.
--- drivers/net/wireless/ath/ath11k/wmi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/wmi.c +3 -2
@@ -3740,8 +3740,9 @@ static int wmi_process_mgmt_tx_comp(struct ath11k *ar, u32 desc_id,ieee80211_tx_status_irqsafe (ar->hw, msdu); -WARN_ON_ONCE (atomic_read (&ar->num_pending_mgmt_tx) ==0 ); -atomic_dec (&ar->num_pending_mgmt_tx); +/* WARN when we received this event without doing any mgmt tx */ +if (atomic_dec_if_positive (&ar->num_pending_mgmt_tx) <0 ) +WARN_ON_ONCE (1 );return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 86/376 ath10k: fix kernel null pointer dereference
In reply to Greg Kroah-HartmanFrom: Venkateswara Naralasetty <[email protected]>
[ Upstream commit acb31476adc9ff271140cdd4d3c707ff0c97f5a4 ]
Currently sta airtime is updated without any lock in case of host based airtime calculation. Which may result in accessing the invalid sta pointer in case of continuous station connect/disconnect.
This patch fix the kernel null pointer dereference by updating the station airtime with proper RCU lock in case of host based airtime calculation.
Proceeding with the analysis of "ARM Kernel Panic".
The APSS crash happened due to OOPS on CPU 0.
Crash Signature : Unable to handle kernel NULL pointer dereference at virtual address 00000300
During the crash,
PC points to "ieee80211_sta_register_airtime+0x1c/0x448 [mac80211]" LR points to "ath10k_txrx_tx_unref+0x17c/0x364 [ath10k_core]". The Backtrace obtained is as follows:
[<bf880238>] (ieee80211_sta_register_airtime [mac80211]) from [<bf945a38>] (ath10k_txrx_tx_unref+0x17c/0x364 [ath10k_core]) [<bf945a38>] (ath10k_txrx_tx_unref [ath10k_core]) from [<bf9428e4>] (ath10k_htt_txrx_compl_task+0xa50/0xfc0 [ath10k_core]) [<bf9428e4>] (ath10k_htt_txrx_compl_task [ath10k_core]) from [<bf9b9bc8>] (ath10k_pci_napi_poll+0x50/0xf8 [ath10k_pci]) [<bf9b9bc8>] (ath10k_pci_napi_poll [ath10k_pci]) from [<c059e3b0>] (net_rx_action+0xac/0x160)
[<c059e3b0>] (net_rx_action) from [<c02329a4>] (__do_softirq+0x104/0x294) [<c02329a4>] (__do_softirq) from [<c0232b64>] (run_ksoftirqd+0x30/0x90) [<c0232b64>] (run_ksoftirqd) from [<c024e358>] (smpboot_thread_fn+0x25c/0x274) [<c024e358>] (smpboot_thread_fn) from [<c02482fc>] (kthread+0xd8/0xec)
Tested HW: QCA9888
Tested FW: 10.4-3.10-00047
--- drivers/net/wireless/ath/ath10k/txrx.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/ath/ath10k/txrx.c +2 -0
@@ -84,9 +84,11 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt,wake_up (&htt->empty_tx_wq);spin_unlock_bh (&htt->tx_lock); +rcu_read_lock ();if (txq && txq->sta && skb_cb->airtime_est)ieee80211_sta_register_airtime (txq->sta, txq->tid, skb_cb->airtime_est,0 ); +rcu_read_unlock ();if (ar->bus_param.dev_type !=ATH10K_DEV_TYPE_HL )dma_unmap_single (dev, skb_cb->paddr, msdu->len,DMA_TO_DEVICE );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 87/376 drm/amd/display: Revert to old formula in set_vtg_params
In reply to Greg Kroah-HartmanFrom: Alvin Lee <[email protected]>
[ Upstream commit a1a0e61f3c43c610f0a3c109348c14ce930c1977 ]
[Why]
New formula + cursor change causing underflow on certain configs
[How]
Rever to old formula
--- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c +4 -2
@@ -299,6 +299,7 @@ void optc1_set_vtg_params(struct timing_generator *optc,uint32_t asic_blank_end;uint32_t v_init;uint32_t v_fp2 =0 ; +int32_t vertical_line_start;struct optc *optc1 =DCN10TG_FROM_TG (optc);
@@ -315,8 +316,9 @@ void optc1_set_vtg_params(struct timing_generator *optc, patched_crtc_timing.v_border_top;/* if VSTARTUP is before VSYNC, FP2 is the offset, otherwise 0 */ -if (optc1->vstartup_start > asic_blank_end) - v_fp2 = optc1->vstartup_start - asic_blank_end; + vertical_line_start = asic_blank_end - optc1->vstartup_start +1 ; +if (vertical_line_start <0 ) + v_fp2 = -vertical_line_start;/* Interlace */ if (REG (OTG_INTERLACE_CONTROL )) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 88/376 media: staging/intel-ipu3: Implement lock for stream on/off operations
In reply to Greg Kroah-HartmanFrom: Bingbu Cao <[email protected]>
[ Upstream commit 33e3c349b2bf1235be458df09fb8d237141486c4 ]
Currently concurrent stream off operations on ImgU nodes are not synchronized, leading to use-after-free bugs (as reported by KASAN).
[ 250.090724] BUG: KASAN: use-after-free in ipu3_dmamap_free+0xc5/0x116 [ipu3_imgu] [ 250.090726] Read of size 8 at addr ffff888127b29bc0 by task yavta/18836 [ 250.090731] Hardware name: HP Soraka/Soraka, BIOS Google_Soraka.10431.17.0 03/22/2018 [ 250.090732] Call Trace: [ 250.090735] dump_stack+0x6a/0xb1 [ 250.090739] print_address_description+0x8e/0x279 [ 250.090743] ? ipu3_dmamap_free+0xc5/0x116 [ipu3_imgu] [ 250.090746] kasan_report+0x260/0x28a [ 250.090750] ipu3_dmamap_free+0xc5/0x116 [ipu3_imgu] [ 250.090754] ipu3_css_pool_cleanup+0x24/0x37 [ipu3_imgu] [ 250.090759] ipu3_css_pipeline_cleanup+0x61/0xb9 [ipu3_imgu] [ 250.090763] ipu3_css_stop_streaming+0x1f2/0x321 [ipu3_imgu] [ 250.090768] imgu_s_stream+0x94/0x443 [ipu3_imgu] [ 250.090772] ? ipu3_vb2_buf_queue+0x280/0x280 [ipu3_imgu] [ 250.090775] ? vb2_dma_sg_unmap_dmabuf+0x16/0x6f [videobuf2_dma_sg] [ 250.090778] ? vb2_buffer_in_use+0x36/0x58 [videobuf2_common] [ 250.090782] ipu3_vb2_stop_streaming+0xf9/0x135 [ipu3_imgu]
Implemented a lock to synchronize imgu stream on / off operations and the modification of streaming flag (in struct imgu_device), to prevent these issues.
--- drivers/staging/media/ipu3/ipu3-v4l2.c | 10 ++++++++++ drivers/staging/media/ipu3/ipu3.c | 3 +++ drivers/staging/media/ipu3/ipu3.h | 4 ++++ 3 files changed, 17 insertions(+)
drivers/staging/media/ipu3/ipu3-v4l2.c +10 -0
@@ -367,8 +367,10 @@ static void imgu_vb2_buf_queue(struct vb2_buffer *vb)vb2_set_plane_payload (vb,0 , need_bytes); +mutex_lock (&imgu->streaming_lock);if (imgu->streaming)imgu_queue_buffers (imgu, false, node->pipe); +mutex_unlock (&imgu->streaming_lock);dev_dbg (&imgu->pci_dev->dev,"%s for pipe %u node %u" , __func__, node->pipe, node->id);
@@ -468,10 +470,13 @@ static int imgu_vb2_start_streaming(struct vb2_queue *vq, unsigned int count)dev_dbg (dev,"%s node name %s pipe %u id %u" , __func__, node->name, node->pipe, node->id); +mutex_lock (&imgu->streaming_lock);if (imgu->streaming) { r = -EBUSY ; +mutex_unlock (&imgu->streaming_lock); goto fail_return_bufs; } +mutex_unlock (&imgu->streaming_lock);if (!node->enabled) {dev_err (dev,"IMGU node is not enabled" );
@@ -498,9 +503,11 @@ static int imgu_vb2_start_streaming(struct vb2_queue *vq, unsigned int count)/* Start streaming of the whole pipeline now */ dev_dbg (dev,"IMGU streaming is ready to start" ); +mutex_lock (&imgu->streaming_lock); r =imgu_s_stream (imgu, true);if (!r) imgu->streaming = true; +mutex_unlock (&imgu->streaming_lock);return 0 ;
@@ -532,6 +539,7 @@ static void imgu_vb2_stop_streaming(struct vb2_queue *vq)dev_err (&imgu->pci_dev->dev,"failed to stop subdev streaming\n" ); +mutex_lock (&imgu->streaming_lock);/* Was this the first node with streaming disabled? */ if (imgu->streaming &&imgu_all_nodes_streaming (imgu, node)) {/* Yes, really stop streaming now */
@@ -542,6 +550,8 @@ static void imgu_vb2_stop_streaming(struct vb2_queue *vq) }imgu_return_all_buffers (imgu, node,VB2_BUF_STATE_ERROR ); +mutex_unlock (&imgu->streaming_lock); +media_pipeline_stop (&node->vdev.entity); }
drivers/staging/media/ipu3/ipu3.c +3 -0
@@ -675,6 +675,7 @@ static int imgu_pci_probe(struct pci_dev *pci_dev,return r;mutex_init (&imgu->lock); +mutex_init (&imgu->streaming_lock);atomic_set (&imgu->qbuf_barrier,0 );init_waitqueue_head (&imgu->buf_drain_wq);
@@ -738,6 +739,7 @@ out_mmu_exit: out_css_powerdown:imgu_css_set_powerdown (&pci_dev->dev, imgu->base); out_mutex_destroy: +mutex_destroy (&imgu->streaming_lock);mutex_destroy (&imgu->lock);return r;
@@ -755,6 +757,7 @@ static void imgu_pci_remove(struct pci_dev *pci_dev)imgu_css_set_powerdown (&pci_dev->dev, imgu->base);imgu_dmamap_exit (imgu);imgu_mmu_exit (imgu->mmu); +mutex_destroy (&imgu->streaming_lock);mutex_destroy (&imgu->lock); }
drivers/staging/media/ipu3/ipu3.h +4 -0
@@ -146,6 +146,10 @@ struct imgu_device {* vid_buf.list and css->queue */ struct mutex lock; + +/* Lock to protect writes to streaming flag in this struct */ +struct mutex streaming_lock; +/* Forbid streaming and buffer queuing during system suspend. */ atomic_t qbuf_barrier;/* Indicate if system suspend take place while imgu is streaming. */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 89/376 media: venus: core: remove CNOC voting while device suspend
In reply to Greg Kroah-HartmanFrom: Mansur Alisha Shaik <[email protected]>
[ Upstream commit 07f8f22a33a9e3e9955e24a84e2f856dcc8c31c4 ]
The Venus driver is voting Configuration NoC during .probe but not clear voting in .suspend. Because of this NoC is up during shutdown also. As a consequence the whole device could leak energy while in .suspend.
So correct this by moving voting in .resume and unvoting in .suspend
--- drivers/media/platform/qcom/venus/core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/media/platform/qcom/venus/core.c +8 -4
@@ -242,10 +242,6 @@ static int venus_probe(struct platform_device *pdev)if (ret)return ret; - ret =icc_set_bw (core->cpucfg_path,0 ,kbps_to_icc (1000 )); -if (ret) -return ret; - ret =hfi_create (core, &venus_core_ops);if (ret)return ret;
@@ -350,6 +346,10 @@ static __maybe_unused int venus_runtime_suspend(struct device *dev)if (ret)return ret; + ret =icc_set_bw (core->cpucfg_path,0 ,0 ); +if (ret) +return ret; +if (pm_ops->core_power) ret = pm_ops->core_power (dev,POWER_OFF );
@@ -368,6 +368,10 @@ static __maybe_unused int venus_runtime_resume(struct device *dev)return ret; } + ret =icc_set_bw (core->cpucfg_path,0 ,kbps_to_icc (1000 )); +if (ret) +return ret; +return hfi_core_resume (core, false); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 90/376 spi: Respect DataBitLength field of SpiSerialBusV2() ACPI resource
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 0dadde344d965566589cd82797893d5aa06557a3 ]
By unknown reason the commit 64bee4d28c9e
("spi / ACPI: add ACPI enumeration support")
missed the DataBitLength property to encounter when parse SPI slave device data from ACPI.
Fill the gap here.
--- drivers/spi/spi.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi.c +1 -0
@@ -2111,6 +2111,7 @@ static int acpi_spi_add_resource(struct acpi_resource *ares, void *data) } lookup->max_speed_hz = sb->connection_speed; + lookup->bits_per_word = sb->data_bit_length;if (sb->clock_phase ==ACPI_SPI_SECOND_PHASE ) lookup->mode |=SPI_CPHA ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 91/376 brcmfmac: fix wrong location to get firmware feature
In reply to Greg Kroah-HartmanFrom: Jaehoon Chung <[email protected]>
[ Upstream commit c57673852062428cdeabdd6501ac8b8e4c302067 ]
sup_wpa feature is getting after setting feature_disable flag. If firmware is supported sup_wpa feature, it's always enabled regardless of feature_disable flag.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c +2 -1
@@ -285,13 +285,14 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)if (!err) ifp->drvr->feat_flags |=BIT (BRCMF_FEAT_SCAN_RANDOM_MAC ); +brcmf_feat_iovar_int_get (ifp,BRCMF_FEAT_FWSUP ,"sup_wpa" ); +if (drvr->settings->feature_disable) {brcmf_dbg (INFO ,"Features: 0x%02x, disable: 0x%02x\n" , ifp->drvr->feat_flags, drvr->settings->feature_disable); ifp->drvr->feat_flags &= ~drvr->settings->feature_disable; } -brcmf_feat_iovar_int_get (ifp,BRCMF_FEAT_FWSUP ,"sup_wpa" );brcmf_feat_firmware_overrides (drvr);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 92/376 regulator: qcom-rpmh: Fix typos in pm8150 and pm8150l
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit 906746ba26d0b45688f4c3b730c35f765dc958ba ]
Fix typos in pm8150 l13/l16/l17 and pm8150l ldo8 supplies.
--- drivers/regulator/qcom-rpmh-regulator.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/regulator/qcom-rpmh-regulator.c +4 -4
@@ -832,11 +832,11 @@ static const struct rpmh_vreg_init_data pm8150_vreg_data[] = {RPMH_VREG ("ldo10" ,"ldo%s10" , &pmic5_pldo,"vdd-l2-l10" ),RPMH_VREG ("ldo11" ,"ldo%s11" , &pmic5_nldo,"vdd-l1-l8-l11" ),RPMH_VREG ("ldo12" ,"ldo%s12" , &pmic5_pldo_lv,"vdd-l7-l12-l14-l15" ), -RPMH_VREG ("ldo13" ,"ldo%s13" , &pmic5_pldo,"vdd-l13-l6-l17" ), +RPMH_VREG ("ldo13" ,"ldo%s13" , &pmic5_pldo,"vdd-l13-l16-l17" ),RPMH_VREG ("ldo14" ,"ldo%s14" , &pmic5_pldo_lv,"vdd-l7-l12-l14-l15" ),RPMH_VREG ("ldo15" ,"ldo%s15" , &pmic5_pldo_lv,"vdd-l7-l12-l14-l15" ), -RPMH_VREG ("ldo16" ,"ldo%s16" , &pmic5_pldo,"vdd-l13-l6-l17" ), -RPMH_VREG ("ldo17" ,"ldo%s17" , &pmic5_pldo,"vdd-l13-l6-l17" ), +RPMH_VREG ("ldo16" ,"ldo%s16" , &pmic5_pldo,"vdd-l13-l16-l17" ), +RPMH_VREG ("ldo17" ,"ldo%s17" , &pmic5_pldo,"vdd-l13-l16-l17" ), RPMH_VREG("ldo18", "ldo%s18", &pmic5_nldo, "vdd-l3-l4-l5-l18"), {}, };
@@ -857,7 +857,7 @@ static const struct rpmh_vreg_init_data pm8150l_vreg_data[] = {RPMH_VREG ("ldo5" ,"ldo%s5" , &pmic5_pldo,"vdd-l4-l5-l6" ),RPMH_VREG ("ldo6" ,"ldo%s6" , &pmic5_pldo,"vdd-l4-l5-l6" ),RPMH_VREG ("ldo7" ,"ldo%s7" , &pmic5_pldo,"vdd-l7-l11" ), -RPMH_VREG ("ldo8" ,"ldo%s8" , &pmic5_pldo_lv,"vdd-l1-l8-l11" ), +RPMH_VREG ("ldo8" ,"ldo%s8" , &pmic5_pldo_lv,"vdd-l1-l8" ),RPMH_VREG ("ldo9" ,"ldo%s9" , &pmic5_pldo,"vdd-l9-l10" ),RPMH_VREG ("ldo10" ,"ldo%s10" , &pmic5_pldo,"vdd-l9-l10" ), RPMH_VREG("ldo11", "ldo%s11", &pmic5_pldo, "vdd-l7-l11"),
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 93/376 tools api fs: Make xxx__mountpoint() more scalable
In reply to Greg Kroah-HartmanFrom: Stephane Eranian <[email protected]>
[ Upstream commit c6fddb28bad26e5472cb7acf7b04cd5126f1a4ab ]
The xxx_mountpoint() interface provided by fs.c finds mount points for common pseudo filesystems. The first time xxx_mountpoint() is invoked, it scans the mount table (/proc/mounts) looking for a match. If found, it is cached. The price to scan /proc/mounts is paid once if the mount is found.
When the mount point is not found, subsequent calls to xxx_mountpoint() scan /proc/mounts over and over again. There is no caching.
This causes a scaling issue in perf record with hugeltbfs__mountpoint(). The function is called for each process found in synthesize__mmap_events(). If the machine has thousands of processes and if the /proc/mounts has many entries this could cause major overhead in perf record. We have observed multi-second slowdowns on some configurations.
As an example on a laptop:
Before:
$ sudo umount /dev/hugepages $ strace -e trace=openat -o /tmp/tt perf record -a ls $ fgrep mounts /tmp/tt 285
After:
$ sudo umount /dev/hugepages $ strace -e trace=openat -o /tmp/tt perf record -a ls $ fgrep mounts /tmp/tt 1
One could argue that the non-caching in case the moint point is not found is intentional. That way subsequent calls may discover a moint point if the sysadmin mounts the filesystem. But the same argument could be made against caching the mount point. It could be unmounted causing errors. It all depends on the intent of the interface. This patch assumes it is expected to scan /proc/mounts once. The patch documents the caching behavior in the fs.h header file.
An alternative would be to just fix perf record. But it would solve the problem with hugetlbs__mountpoint() but there could be similar issues (possibly down the line) with other xxx_mountpoint() calls in perf or other tools.
--- tools/lib/api/fs/fs.c | 17 +++++++++++++++++ tools/lib/api/fs/fs.h | 12 ++++++++++++ 2 files changed, 29 insertions(+)
tools/lib/api/fs/fs.c +17 -0
@@ -90,6 +90,7 @@ struct fs {const char *const *mounts;char path[PATH_MAX ];bool found; +bool checked;long magic; };
@@ -111,31 +112,37 @@ static struct fs fs__entries[] = { .name = "sysfs", .mounts = sysfs__fs_known_mountpoints, .magic = SYSFS_MAGIC, + .checked = false, }, [FS__PROCFS] = { .name = "proc", .mounts = procfs__known_mountpoints, .magic = PROC_SUPER_MAGIC, + .checked = false, }, [FS__DEBUGFS] = { .name = "debugfs", .mounts = debugfs__known_mountpoints, .magic = DEBUGFS_MAGIC, + .checked = false, }, [FS__TRACEFS] = { .name = "tracefs", .mounts = tracefs__known_mountpoints, .magic = TRACEFS_MAGIC, + .checked = false, }, [FS__HUGETLBFS] = { .name = "hugetlbfs", .mounts = hugetlbfs__known_mountpoints, .magic = HUGETLBFS_MAGIC, + .checked = false, }, [FS__BPF_FS] = { .name = "bpf", .mounts = bpf_fs__known_mountpoints, .magic = BPF_FS_MAGIC, + .checked = false, }, };
@@ -158,6 +165,7 @@ static bool fs__read_mounts(struct fs *fs) }fclose (fp); + fs->checked = true;return fs->found = found; }
@@ -220,6 +228,7 @@ static bool fs__env_override(struct fs *fs)return false; fs->found = true; + fs->checked = true;strncpy (fs->path, override_path,sizeof (fs->path) -1 ); fs->path[sizeof (fs->path) -1 ] ='\0' ;return true;
@@ -246,6 +255,14 @@ static const char *fs__mountpoint(int idx)if (fs->found)return (const char *)fs->path; +/* the mount point was already checked for the mount point +* but and did not exist, so return NULL to avoid scanning again. +* This makes the found and not found paths cost equivalent +* in case of multiple calls. +*/ +if (fs->checked) +return NULL ; +return fs__get_mountpoint (fs); }
tools/lib/api/fs/fs.h +12 -0
@@ -18,6 +18,18 @@ const char *name##__mount(void); \ bool name##__configured(void); \ +/* +* The xxxx__mountpoint() entry points find the first match mount point for each +* filesystems listed below, where xxxx is the filesystem type. +* +* The interface is as follows: +* +* - If a mount point is found on first call, it is cached and used for all +* subsequent calls. +* +* - If a mount point is not found, NULL is returned on first call and all +* subsequent calls. +*/ FS(sysfs) FS(procfs) FS(debugfs)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 94/376 e1000: Distribute switch variables for initialization
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit a34c7f5156654ebaf7eaace102938be7ff7036cb ]
Variables declared in a switch statement before any case statements cannot be automatically initialized with compiler instrumentation (as they are not part of any execution flow). With GCC's proposed automatic stack variable initialization feature, this triggers a warning (and they don't get initialized). Clang's automatic stack variable initialization (via CONFIG_INIT_STACK_ALL=y) doesn't throw a warning, but it also doesn't initialize such variables[1]. Note that these warnings (or silent skipping) happen before the dead-store elimination optimization phase, so even when the automatic initializations are later elided in favor of direct initializations, the warnings remain.
To avoid these problems, move such variables into the "case" where they're used or lift them up into the main function body.
drivers/net/ethernet/intel/e1000/e1000_main.c: In function ‘e1000_xmit_frame’:drivers/net/ethernet/intel/e1000/e1000_main.c:3143:18: warning: statement will never be executed [-Wswitch-unreachable]
3143 | unsigned int pull_size;
| ^~~~~~~~~[1] https://bugs.llvm.org/show_bug.cgi?id=44916
--- drivers/net/ethernet/intel/e1000/e1000_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/e1000/e1000_main.c +3 -1
@@ -3136,8 +3136,9 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb, hdr_len =skb_transport_offset (skb) +tcp_hdrlen (skb);if (skb->data_len && hdr_len == len) {switch (hw->mac_type) { +case e1000_82544: {unsigned int pull_size; -case e1000_82544: +/* Make sure we have room to chop off 4 bytes, * and that the end alignment will work out to * this hardware's requirements
@@ -3158,6 +3159,7 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb, } len =skb_headlen (skb);break ; + }default :/* do nothing */ break ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 95/376 net: mscc: ocelot: deal with problematic MAC_ETYPE VCAP IS2 rules
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 89f9ffd3eb670bad1260bc579f5e13b8f2d5b3e0 ]
By default, the VCAP IS2 will produce a single match for each frame, on the most specific classification.
Example: a ping packet (ICMP over IPv4 over Ethernet) sent from an IP address of 10.0.0.1 and a MAC address of 96:18:82:00:04:01 will match this rule:
tc filter add dev swp0 ingress protocol ipv4 \
flower skip_sw src_ip 10.0.0.1 action drop
but not this one:
tc filter add dev swp0 ingress \
flower skip_sw src_mac 96:18:82:00:04:01 action drop
Currently the driver does not really warn the user in any way about this, and the behavior is rather strange anyway.
The current patch is a workaround to force matches on MAC_ETYPE keys (DMAC and SMAC) for all packets irrespective of higher layer protocol. The setting is made at the port level.
Of course this breaks all other non-src_mac and non-dst_mac matches, so rule exclusivity checks have been added to the driver, in order to never have rules of both types on any ingress port.
The bits that discard higher-level protocol information are set only once a MAC_ETYPE rule is added to a filter block, and only for the ports that are bound to that filter block. Then all further non-MAC_ETYPE rules added to that filter block should be denied by the ports bound to it.
--- drivers/net/ethernet/mscc/ocelot_ace.c | 103 +++++++++++++++++++++- drivers/net/ethernet/mscc/ocelot_ace.h | 5 +- drivers/net/ethernet/mscc/ocelot_flower.c | 2 +- 3 files changed, 106 insertions(+), 4 deletions(-)
drivers/net/ethernet/mscc/ocelot_ace.c +102 -1
@@ -706,13 +706,114 @@ ocelot_ace_rule_get_rule_index(struct ocelot_acl_block *block, int index)return NULL ; } +/* If @on=false, then SNAP, ARP, IP and OAM frames will not match on keys based +* on destination and source MAC addresses, but only on higher-level protocol +* information. The only frame types to match on keys containing MAC addresses +* in this case are non-SNAP, non-ARP, non-IP and non-OAM frames. +* +* If @on=true, then the above frame types (SNAP, ARP, IP and OAM) will match +* on MAC_ETYPE keys such as destination and source MAC on this ingress port. +* However the setting has the side effect of making these frames not matching +* on any _other_ keys than MAC_ETYPE ones. +*/ +static void ocelot_match_all_as_mac_etype (struct ocelot *ocelot,int port, +bool on) +{ +u32 val =0 ; + +if (on) + val =ANA_PORT_VCAP_S2_CFG_S2_SNAP_DIS (3 ) | +ANA_PORT_VCAP_S2_CFG_S2_ARP_DIS (3 ) | +ANA_PORT_VCAP_S2_CFG_S2_IP_TCPUDP_DIS (3 ) | +ANA_PORT_VCAP_S2_CFG_S2_IP_OTHER_DIS (3 ) | +ANA_PORT_VCAP_S2_CFG_S2_OAM_DIS (3 ); + +ocelot_rmw_gix (ocelot, val, +ANA_PORT_VCAP_S2_CFG_S2_SNAP_DIS_M | +ANA_PORT_VCAP_S2_CFG_S2_ARP_DIS_M | +ANA_PORT_VCAP_S2_CFG_S2_IP_TCPUDP_DIS_M | +ANA_PORT_VCAP_S2_CFG_S2_IP_OTHER_DIS_M | +ANA_PORT_VCAP_S2_CFG_S2_OAM_DIS_M , +ANA_PORT_VCAP_S2_CFG , port); +} + +static bool ocelot_ace_is_problematic_mac_etype (struct ocelot_ace_rule *ace) +{ +if (ace->type !=OCELOT_ACE_TYPE_ETYPE ) +return false; +if (ether_addr_to_u64 (ace->frame.etype.dmac.value) & +ether_addr_to_u64 (ace->frame.etype.dmac.mask)) +return true; +if (ether_addr_to_u64 (ace->frame.etype.smac.value) & +ether_addr_to_u64 (ace->frame.etype.smac.mask)) +return true; +return false; +} + +static bool ocelot_ace_is_problematic_non_mac_etype (struct ocelot_ace_rule *ace) +{ +if (ace->type ==OCELOT_ACE_TYPE_SNAP ) +return true; +if (ace->type ==OCELOT_ACE_TYPE_ARP ) +return true; +if (ace->type ==OCELOT_ACE_TYPE_IPV4 ) +return true; +if (ace->type ==OCELOT_ACE_TYPE_IPV6 ) +return true; +return false; +} + +static bool ocelot_exclusive_mac_etype_ace_rules (struct ocelot *ocelot, +struct ocelot_ace_rule *ace) +{ +struct ocelot_acl_block *block = &ocelot->acl_block; +struct ocelot_ace_rule *tmp; +unsigned long port; +int i; + +if (ocelot_ace_is_problematic_mac_etype (ace)) { +/* Search for any non-MAC_ETYPE rules on the port */ +for (i =0 ; i < block->count; i++) { + tmp =ocelot_ace_rule_get_rule_index (block, i); +if (tmp->ingress_port_mask & ace->ingress_port_mask && +ocelot_ace_is_problematic_non_mac_etype (tmp)) +return false; + } + +for_each_set_bit (port, &ace->ingress_port_mask, + ocelot->num_phys_ports) +ocelot_match_all_as_mac_etype (ocelot, port, true); + }else if (ocelot_ace_is_problematic_non_mac_etype (ace)) { +/* Search for any MAC_ETYPE rules on the port */ +for (i =0 ; i < block->count; i++) { + tmp =ocelot_ace_rule_get_rule_index (block, i); +if (tmp->ingress_port_mask & ace->ingress_port_mask && +ocelot_ace_is_problematic_mac_etype (tmp)) +return false; + } + +for_each_set_bit (port, &ace->ingress_port_mask, + ocelot->num_phys_ports) +ocelot_match_all_as_mac_etype (ocelot, port, false); + } + +return true; +} +int ocelot_ace_rule_offload_add (struct ocelot *ocelot, -struct ocelot_ace_rule *rule) +struct ocelot_ace_rule *rule, +struct netlink_ext_ack *extack) {struct ocelot_acl_block *block = &ocelot->acl_block;struct ocelot_ace_rule *ace;int i, index; +if (!ocelot_exclusive_mac_etype_ace_rules (ocelot, rule)) { +NL_SET_ERR_MSG_MOD (extack, +"Cannot mix MAC_ETYPE with non-MAC_ETYPE rules" ); +return -EBUSY ; + } +/* Add rule to the linked list */ ocelot_ace_rule_add (ocelot, block, rule);
drivers/net/ethernet/mscc/ocelot_ace.h +3 -2
@@ -194,7 +194,7 @@ struct ocelot_ace_rule {enum ocelot_ace_action action;struct ocelot_ace_stats stats; -u16 ingress_port_mask; +unsigned long ingress_port_mask;enum ocelot_vcap_bit dmac_mc;enum ocelot_vcap_bit dmac_bc;
@@ -215,7 +215,8 @@ struct ocelot_ace_rule { };int ocelot_ace_rule_offload_add (struct ocelot *ocelot, -struct ocelot_ace_rule *rule); +struct ocelot_ace_rule *rule, +struct netlink_ext_ack *extack);int ocelot_ace_rule_offload_del (struct ocelot *ocelot,struct ocelot_ace_rule *rule); int ocelot_ace_rule_stats_update(struct ocelot *ocelot,
drivers/net/ethernet/mscc/ocelot_flower.c +1 -1
@@ -205,7 +205,7 @@ int ocelot_cls_flower_replace(struct ocelot *ocelot, int port,return ret; } -return ocelot_ace_rule_offload_add (ocelot, ace); +return ocelot_ace_rule_offload_add (ocelot, ace, f->common.extack); }EXPORT_SYMBOL_GPL (ocelot_cls_flower_replace);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 96/376 drm/ast: Allocate initial CRTC state of the correct size
In reply to Greg Kroah-HartmanFrom: Thomas Zimmermann <[email protected]>
[ Upstream commit f0adbc382b8bb46a2467c4e5e1027763a197c8e1 ]
The ast driver inherits from DRM's CRTC state, but still uses the atomic helper for struct drm_crtc_funcs.reset, drm_atomic_helper_crtc_reset().
The helper only allocates enough memory for the core CRTC state. That results in an out-ouf-bounds access when duplicating the initial CRTC state. Simplified backtrace shown below:
[ 21.469321] ================================================================== [ 21.469434] BUG: KASAN: slab-out-of-bounds in ast_crtc_atomic_duplicate_state+0x84/0x100 [ast] [ 21.469445] Read of size 8 at addr ffff888036c1c5f8 by task systemd-udevd/382 [ 21.469451] [ 21.469464] CPU: 2 PID: 382 Comm: systemd-udevd Tainted: G E 5.5.0-rc6-1-default+ #214 [ 21.469473] Hardware name: Sun Microsystems SUN FIRE X2270 M2/SUN FIRE X2270 M2, BIOS 2.05 07/01/2010 [ 21.469480] Call Trace: [ 21.469501] dump_stack+0xb8/0x110 [ 21.469528] print_address_description.constprop.0+0x1b/0x1e0 [ 21.469557] ? ast_crtc_atomic_duplicate_state+0x84/0x100 [ast] [ 21.469581] ? ast_crtc_atomic_duplicate_state+0x84/0x100 [ast] [ 21.469597] __kasan_report.cold+0x1a/0x35 [ 21.469640] ? ast_crtc_atomic_duplicate_state+0x84/0x100 [ast] [ 21.469665] kasan_report+0xe/0x20 [ 21.469693] ast_crtc_atomic_duplicate_state+0x84/0x100 [ast] [ 21.469733] drm_atomic_get_crtc_state+0xbf/0x1c0 [ 21.469768] __drm_atomic_helper_set_config+0x81/0x5a0 [ 21.469803] ? drm_atomic_plane_check+0x690/0x690 [ 21.469843] ? drm_client_rotation+0xae/0x240 [ 21.469876] drm_client_modeset_commit_atomic+0x230/0x390 [ 21.469888] ? __mutex_lock+0x8f0/0xbe0 [ 21.469929] ? drm_client_firmware_config.isra.0+0xa60/0xa60 [ 21.469948] ? drm_client_modeset_commit_force+0x28/0x230 [ 21.470031] ? memset+0x20/0x40 [ 21.470078] drm_client_modeset_commit_force+0x90/0x230 [ 21.470110] drm_fb_helper_restore_fbdev_mode_unlocked+0x5f/0xc0 [ 21.470132] drm_fb_helper_set_par+0x59/0x70 [ 21.470155] fbcon_init+0x61d/0xad0 [ 21.470185] ? drm_fb_helper_restore_fbdev_mode_unlocked+0xc0/0xc0 [ 21.470232] visual_init+0x187/0x240 [ 21.470266] do_bind_con_driver+0x2e3/0x460 [ 21.470321] do_take_over_console+0x20a/0x290 [ 21.470371] do_fbcon_takeover+0x85/0x100 [ 21.470402] register_framebuffer+0x2fd/0x490 [ 21.470425] ? kzalloc.constprop.0+0x10/0x10 [ 21.470503] __drm_fb_helper_initial_config_and_unlock+0xf2/0x140 [ 21.470533] drm_fbdev_client_hotplug+0x162/0x250 [ 21.470563] drm_fbdev_generic_setup+0xd2/0x155 [ 21.470602] ast_driver_load+0x688/0x850 [ast] <...> [ 21.472625] ==================================================================
Allocating enough memory for struct ast_crtc_state in a custom ast CRTC reset handler fixes the problem.
v2:
* implement according to drm_atomic_helper_crtc_reset()
* update state with __drm_atomic_helper_crtc_reset()
--- drivers/gpu/drm/ast/ast_mode.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/ast/ast_mode.c +12 -1
@@ -881,6 +881,17 @@ static const struct drm_crtc_helper_funcs ast_crtc_helper_funcs = { .atomic_disable = ast_crtc_helper_atomic_disable, }; +static void ast_crtc_reset (struct drm_crtc *crtc) +{ +struct ast_crtc_state *ast_state = +kzalloc (sizeof (*ast_state),GFP_KERNEL ); + +if (crtc->state) + crtc->funcs->atomic_destroy_state (crtc, crtc->state); + +__drm_atomic_helper_crtc_reset (crtc, &ast_state->base); +} +static void ast_crtc_destroy (struct drm_crtc *crtc) {drm_crtc_cleanup (crtc);
@@ -919,7 +930,7 @@ static void ast_crtc_atomic_destroy_state(struct drm_crtc *crtc, }static const struct drm_crtc_funcs ast_crtc_funcs = { - .reset = drm_atomic_helper_crtc_reset, + .reset = ast_crtc_reset, .set_config = drm_crtc_helper_set_config, .gamma_set = drm_atomic_helper_legacy_gamma_set, .destroy = ast_crtc_destroy,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 97/376 dt-bindings: display: mediatek: control dpi pins mode to avoid leakage
In reply to Greg Kroah-HartmanFrom: Jitao Shi <[email protected]>
[ Upstream commit b0ff9b590733079f7f9453e5976a9dd2630949e3 ]
Add property "pinctrl-names" to swap pin mode between gpio and dpi mode. Set the dpi pins to gpio mode and output-low to avoid leakage current when dpi disabled.
--- .../devicetree/bindings/display/mediatek/mediatek,dpi.txt | 6 ++++++ 1 file changed, 6 insertions(+)
Documentation/devicetree/bindings/display/mediatek/mediatek,dpi.txt +6 -0
@@ -17,6 +17,9 @@ Required properties: Documentation/devicetree/bindings/graph.txt. This port should be connected to the input port of an attached HDMI or LVDS encoder chip. +Optional properties: +- pinctrl-names: Contain "default" and "sleep". + Example: dpi0: dpi@1401d000 {
@@ -27,6 +30,9 @@ dpi0: dpi@1401d000 { <&mmsys CLK_MM_DPI_ENGINE>, <&apmixedsys CLK_APMIXED_TVDPLL>; clock-names = "pixel", "engine", "pll"; + pinctrl-names = "default", "sleep"; + pinctrl-0 = <&dpi_pin_func>; + pinctrl-1 = <&dpi_pin_idle>; port { dpi0_out: endpoint {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 98/376 drm/mediatek: set dpi pin mode to gpio low to avoid leakage current
In reply to Greg Kroah-HartmanFrom: Jitao Shi <[email protected]>
[ Upstream commit 6bd4763fd532cff43f9b15704f324c45a9806f53 ]
Config dpi pins mode to output and pull low when dpi is disabled. Aovid leakage current from some dpi pins (Hsync Vsync DE ... ).
--- drivers/gpu/drm/mediatek/mtk_dpi.c | 31 ++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+)
drivers/gpu/drm/mediatek/mtk_dpi.c +31 -0
@@ -10,7 +10,9 @@#include <linux/kernel.h> #include <linux/of.h> #include <linux/of_device.h> +#include <linux/of_gpio.h> #include <linux/of_graph.h> +#include <linux/pinctrl/consumer.h> #include <linux/platform_device.h> #include <linux/types.h>
@@ -74,6 +76,9 @@ struct mtk_dpi {enum mtk_dpi_out_yc_map yc_map;enum mtk_dpi_out_bit_num bit_num;enum mtk_dpi_out_channel_swap channel_swap; +struct pinctrl *pinctrl; +struct pinctrl_state *pins_gpio; +struct pinctrl_state *pins_dpi;int refcount; };
@@ -379,6 +384,9 @@ static void mtk_dpi_power_off(struct mtk_dpi *dpi)if (--dpi->refcount !=0 )return ; +if (dpi->pinctrl && dpi->pins_gpio) +pinctrl_select_state (dpi->pinctrl, dpi->pins_gpio); +mtk_dpi_disable (dpi);clk_disable_unprepare (dpi->pixel_clk);clk_disable_unprepare (dpi->engine_clk);
@@ -403,6 +411,9 @@ static int mtk_dpi_power_on(struct mtk_dpi *dpi) goto err_pixel; } +if (dpi->pinctrl && dpi->pins_dpi) +pinctrl_select_state (dpi->pinctrl, dpi->pins_dpi); +mtk_dpi_enable (dpi);return 0 ;
@@ -705,6 +716,26 @@ static int mtk_dpi_probe(struct platform_device *pdev) dpi->dev = dev; dpi->conf = (struct mtk_dpi_conf *)of_device_get_match_data (dev); + dpi->pinctrl =devm_pinctrl_get (&pdev->dev); +if (IS_ERR (dpi->pinctrl)) { + dpi->pinctrl =NULL ; +dev_dbg (&pdev->dev,"Cannot find pinctrl!\n" ); + } +if (dpi->pinctrl) { + dpi->pins_gpio =pinctrl_lookup_state (dpi->pinctrl,"sleep" ); +if (IS_ERR (dpi->pins_gpio)) { + dpi->pins_gpio =NULL ; +dev_dbg (&pdev->dev,"Cannot find pinctrl idle!\n" ); + } +if (dpi->pins_gpio) +pinctrl_select_state (dpi->pinctrl, dpi->pins_gpio); + + dpi->pins_dpi =pinctrl_lookup_state (dpi->pinctrl,"default" ); +if (IS_ERR (dpi->pins_dpi)) { + dpi->pins_dpi =NULL ; +dev_dbg (&pdev->dev,"Cannot find pinctrl active!\n" ); + } + } mem =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); dpi->regs =devm_ioremap_resource (dev, mem);if (IS_ERR (dpi->regs)) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 99/376 audit: fix a net reference leak in audit_send_reply()
In reply to Greg Kroah-HartmanFrom: Paul Moore <[email protected]>
[ Upstream commit a48b284b403a4a073d8beb72d2bb33e54df67fb6 ]
If audit_send_reply() fails when trying to create a new thread to send the reply it also fails to cleanup properly, leaking a reference to a net structure. This patch fixes the error path and makes a handful of other cleanups that came up while fixing the code.
--- kernel/audit.c | 50 +++++++++++++++++++++++++++++--------------------- 1 file changed, 29 insertions(+), 21 deletions(-)
kernel/audit.c +29 -21
@@ -924,19 +924,30 @@ out_kfree_skb:return NULL ; } +static void audit_free_reply (struct audit_reply *reply) +{ +if (!reply) +return ; + +if (reply->skb) +kfree_skb (reply->skb); +if (reply->net) +put_net (reply->net); +kfree (reply); +} +static int audit_send_reply_thread (void *arg) {struct audit_reply *reply = (struct audit_reply *)arg; -struct sock *sk =audit_get_sk (reply->net);audit_ctl_lock ();audit_ctl_unlock ();/* Ignore failure. It'll only happen if the sender goes away, because our timeout is set to infinite. */ -netlink_unicast (sk, reply->skb, reply->portid,0 ); -put_net (reply->net); -kfree (reply); +netlink_unicast (audit_get_sk (reply->net), reply->skb, reply->portid,0 ); + reply->skb =NULL ; +audit_free_reply (reply);return 0 ; }
@@ -950,35 +961,32 @@ static int audit_send_reply_thread(void *arg)* @payload: payload data * @size: payload size * -* Allocates an skb, builds the netlink message, and sends it to the port id. -* No failure notifications. +* Allocates a skb, builds the netlink message, and sends it to the port id. */ static void audit_send_reply (struct sk_buff *request_skb,int seq,int type,int done,int multi,const void *payload,int size) { -struct net *net =sock_net (NETLINK_CB (request_skb).sk); -struct sk_buff *skb;struct task_struct *tsk; -struct audit_reply *reply =kmalloc (sizeof (struct audit_reply ), -GFP_KERNEL ); +struct audit_reply *reply; + reply =kzalloc (sizeof (*reply),GFP_KERNEL );if (!reply)return ; - skb =audit_make_reply (seq, type, done, multi, payload, size); -if (!skb) - goto out; - - reply->net =get_net (net); + reply->skb =audit_make_reply (seq, type, done, multi, payload, size); +if (!reply->skb) + goto err; + reply->net =get_net (sock_net (NETLINK_CB (request_skb).sk)); reply->portid =NETLINK_CB (request_skb).portid; - reply->skb = skb; tsk =kthread_run (audit_send_reply_thread, reply,"audit_send_reply" ); -if (!IS_ERR (tsk)) -return ; -kfree_skb (skb); -out: -kfree (reply); +if (IS_ERR (tsk)) + goto err; + +return ; + +err: +audit_free_reply (reply); }/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 100/376 media: dvb: return -EREMOTEIO on i2c transfer failure.
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 96f3a9392799dd0f6472648a7366622ffd0989f3 ]
Currently when i2c transfers fail the error return -EREMOTEIO is assigned to err but then later overwritten when the tuner attach call is made. Fix this by returning early with the error return code -EREMOTEIO on i2c transfer failure errors.
If the transfer fails, an uninitialized value will be read from b2.
Addresses-Coverity: ("Unused value")
--- drivers/media/usb/dvb-usb/dibusb-mb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb/dibusb-mb.c +1 -1
@@ -81,7 +81,7 @@ static int dibusb_tuner_probe_and_attach(struct dvb_usb_adapter *adap)if (i2c_transfer (&adap->dev->i2c_adap, msg,2 ) !=2 ) {err ("tuner i2c write failed." ); - ret = -EREMOTEIO ; +return -EREMOTEIO ; }if (adap->fe_adap[0 ].fe->ops.i2c_gate_ctrl)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 101/376 media: imx: utils: fix and simplify pixel format enumeration
In reply to Greg Kroah-HartmanFrom: Philipp Zabel <[email protected]>
[ Upstream commit f2267d7ed803add8820c7a6537c12a6d8732f570 ]
Merge yuv_formats and rgb_formats into a single array. Always loop over all entries, skipping those that do not match the requested search criteria. This simplifies the code, lets us get rid of the manual counting of array entries, and stops accidentally ignoring some non-mbus RGB formats.
Before:
$ v4l2-ctl -d /dev/video14 --list-formats-out ioctl: VIDIOC_ENUM_FMT Type: Video Output
[0]: 'UYVY' (UYVY 4:2:2) [1]: 'YUYV' (YUYV 4:2:2) [2]: 'YU12' (Planar YUV 4:2:0) [3]: 'YV12' (Planar YVU 4:2:0) [4]: '422P' (Planar YUV 4:2:2) [5]: 'NV12' (Y/CbCr 4:2:0) [6]: 'NV16' (Y/CbCr 4:2:2) [7]: 'RGBP' (16-bit RGB 5-6-5) [8]: 'RGB3' (24-bit RGB 8-8-8) [9]: 'BX24' (32-bit XRGB 8-8-8-8)
After:
$ v4l2-ctl -d /dev/video14 --list-formats-out ioctl: VIDIOC_ENUM_FMT Type: Video Output
[0]: 'UYVY' (UYVY 4:2:2) [1]: 'YUYV' (YUYV 4:2:2) [2]: 'YU12' (Planar YUV 4:2:0) [3]: 'YV12' (Planar YVU 4:2:0) [4]: '422P' (Planar YUV 4:2:2) [5]: 'NV12' (Y/CbCr 4:2:0) [6]: 'NV16' (Y/CbCr 4:2:2) [7]: 'RGBP' (16-bit RGB 5-6-5) [8]: 'RGB3' (24-bit RGB 8-8-8) [9]: 'BGR3' (24-bit BGR 8-8-8) [10]: 'BX24' (32-bit XRGB 8-8-8-8) [11]: 'XR24' (32-bit BGRX 8-8-8-8) [12]: 'RX24' (32-bit XBGR 8-8-8-8) [13]: 'XB24' (32-bit RGBX 8-8-8-8)
Tested on a imx6q-sabresd.
[[email protected]: Make loop counters unsigned] [[email protected]: Decrement index instead of adding a counter] [[email protected]: Return directly from within loop instead of breaking] [[email protected]: Fix colorspace comparison error]
--- drivers/staging/media/imx/imx-media-utils.c | 193 ++++++-------------- 1 file changed, 59 insertions(+), 134 deletions(-)
drivers/staging/media/imx/imx-media-utils.c +59 -134
@@ -9,12 +9,9 @@/* * List of supported pixel formats for the subdevs. -* -* In all of these tables, the non-mbus formats (with no -* mbus codes) must all fall at the end of the table. */ - -static const struct imx_media_pixfmt yuv_formats[] = { +static const struct imx_media_pixfmt pixel_formats[] = { +/*** YUV formats start here ***/ { .fourcc =V4L2_PIX_FMT_UYVY , .codes = {
@@ -31,12 +28,7 @@ static const struct imx_media_pixfmt yuv_formats[] = { }, .cs = IPUV3_COLORSPACE_YUV, .bpp = 16, - }, -/*** -* non-mbus YUV formats start here. NOTE! when adding non-mbus -* formats, NUM_NON_MBUS_YUV_FORMATS must be updated below. -***/ - { + }, { .fourcc = V4L2_PIX_FMT_YUV420, .cs = IPUV3_COLORSPACE_YUV, .bpp = 12,
@@ -62,13 +54,7 @@ static const struct imx_media_pixfmt yuv_formats[] = { .bpp = 16, .planar = true, }, -}; - -#define NUM_NON_MBUS_YUV_FORMATS 5 -#define NUM_YUV_FORMATS ARRAY_SIZE(yuv_formats) -#define NUM_MBUS_YUV_FORMATS (NUM_YUV_FORMATS - NUM_NON_MBUS_YUV_FORMATS) - -static const struct imx_media_pixfmt rgb_formats[] = { +/*** RGB formats start here ***/ { .fourcc = V4L2_PIX_FMT_RGB565, .codes = {MEDIA_BUS_FMT_RGB565_2X8_LE},
@@ -83,12 +69,28 @@ static const struct imx_media_pixfmt rgb_formats[] = { }, .cs = IPUV3_COLORSPACE_RGB, .bpp = 24, + }, { + .fourcc = V4L2_PIX_FMT_BGR24, + .cs = IPUV3_COLORSPACE_RGB, + .bpp = 24, }, { .fourcc = V4L2_PIX_FMT_XRGB32, .codes = {MEDIA_BUS_FMT_ARGB8888_1X32}, .cs = IPUV3_COLORSPACE_RGB, .bpp = 32, .ipufmt = true, + }, { + .fourcc = V4L2_PIX_FMT_XBGR32, + .cs = IPUV3_COLORSPACE_RGB, + .bpp = 32, + }, { + .fourcc = V4L2_PIX_FMT_BGRX32, + .cs = IPUV3_COLORSPACE_RGB, + .bpp = 32, + }, { + .fourcc = V4L2_PIX_FMT_RGBX32, + .cs = IPUV3_COLORSPACE_RGB, + .bpp = 32, }, /*** raw bayer and grayscale formats start here ***/ {
@@ -182,33 +184,8 @@ static const struct imx_media_pixfmt rgb_formats[] = { .bpp = 16, .bayer = true, }, -/*** -* non-mbus RGB formats start here. NOTE! when adding non-mbus -* formats, NUM_NON_MBUS_RGB_FORMATS must be updated below. -***/ - { - .fourcc = V4L2_PIX_FMT_BGR24, - .cs = IPUV3_COLORSPACE_RGB, - .bpp = 24, - }, { - .fourcc = V4L2_PIX_FMT_XBGR32, - .cs = IPUV3_COLORSPACE_RGB, - .bpp = 32, - }, { - .fourcc = V4L2_PIX_FMT_BGRX32, - .cs = IPUV3_COLORSPACE_RGB, - .bpp = 32, - }, { - .fourcc = V4L2_PIX_FMT_RGBX32, - .cs = IPUV3_COLORSPACE_RGB, - .bpp = 32, - }, }; -#define NUM_NON_MBUS_RGB_FORMATS 2 -#define NUM_RGB_FORMATS ARRAY_SIZE(rgb_formats) -#define NUM_MBUS_RGB_FORMATS (NUM_RGB_FORMATS - NUM_NON_MBUS_RGB_FORMATS) -static const struct imx_media_pixfmt ipu_yuv_formats[] = { { .fourcc =V4L2_PIX_FMT_YUV32 ,
@@ -246,21 +223,24 @@ static void init_mbus_colorimetry(struct v4l2_mbus_framefmt *mbus, mbus->ycbcr_enc); } -static const -struct imx_media_pixfmt *__find_format (u32 fourcc, -u32 code, -bool allow_non_mbus, -bool allow_bayer, -const struct imx_media_pixfmt *array, -u32 array_size) +static const struct imx_media_pixfmt *find_format (u32 fourcc, +u32 code, +enum codespace_sel cs_sel, +bool allow_non_mbus, +bool allow_bayer) { -const struct imx_media_pixfmt *fmt; -int i, j; +unsigned int i; -for (i =0 ; i < array_size; i++) { - fmt = &array[i]; +for (i =0 ; i <ARRAY_SIZE (pixel_formats); i++) { +const struct imx_media_pixfmt *fmt = &pixel_formats[i]; +enum codespace_sel fmt_cs_sel; +unsigned int j; -if ((!allow_non_mbus && !fmt->codes[0 ]) || + fmt_cs_sel = (fmt->cs ==IPUV3_COLORSPACE_YUV ) ? +CS_SEL_YUV :CS_SEL_RGB ; + +if ((cs_sel !=CS_SEL_ANY && fmt_cs_sel != cs_sel) || + (!allow_non_mbus && !fmt->codes[0 ]) || (!allow_bayer && fmt->bayer))continue ;
@@ -270,39 +250,13 @@ struct imx_media_pixfmt *__find_format(u32 fourcc,if (!code)continue ; -for (j =0 ; fmt->codes[j]; j++) { +for (j =0 ; j <ARRAY_SIZE (fmt->codes) && fmt->codes[j]; j++) {if (code == fmt->codes[j])return fmt; } } -return NULL ; -} -static const struct imx_media_pixfmt *find_format (u32 fourcc, -u32 code, -enum codespace_sel cs_sel, -bool allow_non_mbus, -bool allow_bayer) -{ -const struct imx_media_pixfmt *ret; - -switch (cs_sel) { -case CS_SEL_YUV : -return __find_format (fourcc, code, allow_non_mbus, allow_bayer, - yuv_formats,NUM_YUV_FORMATS ); -case CS_SEL_RGB : -return __find_format (fourcc, code, allow_non_mbus, allow_bayer, - rgb_formats,NUM_RGB_FORMATS ); -case CS_SEL_ANY : - ret =__find_format (fourcc, code, allow_non_mbus, allow_bayer, - yuv_formats,NUM_YUV_FORMATS ); -if (ret) -return ret; -return __find_format (fourcc, code, allow_non_mbus, allow_bayer, - rgb_formats,NUM_RGB_FORMATS ); -default : -return NULL ; - } +return NULL ; } static int enum_format(u32 *fourcc, u32 *code, u32 index,
@@ -310,61 +264,32 @@ static int enum_format(u32 *fourcc, u32 *code, u32 index, bool allow_non_mbus, bool allow_bayer) { -const struct imx_media_pixfmt *fmt; -u32 mbus_yuv_sz =NUM_MBUS_YUV_FORMATS ; -u32 mbus_rgb_sz =NUM_MBUS_RGB_FORMATS ; -u32 yuv_sz =NUM_YUV_FORMATS ; -u32 rgb_sz =NUM_RGB_FORMATS ; +unsigned int i; -switch (cs_sel) { -case CS_SEL_YUV : -if (index >= yuv_sz || - (!allow_non_mbus && index >= mbus_yuv_sz)) -return -EINVAL ; - fmt = &yuv_formats[index]; -break ; -case CS_SEL_RGB : -if (index >= rgb_sz || - (!allow_non_mbus && index >= mbus_rgb_sz)) -return -EINVAL ; - fmt = &rgb_formats[index]; -if (!allow_bayer && fmt->bayer) -return -EINVAL ; -break ; -case CS_SEL_ANY : -if (!allow_non_mbus) { -if (index >= mbus_yuv_sz) { - index -= mbus_yuv_sz; -if (index >= mbus_rgb_sz) -return -EINVAL ; - fmt = &rgb_formats[index]; -if (!allow_bayer && fmt->bayer) -return -EINVAL ; - }else { - fmt = &yuv_formats[index]; - } - }else { -if (index >= yuv_sz + rgb_sz) -return -EINVAL ; -if (index >= yuv_sz) { - fmt = &rgb_formats[index - yuv_sz]; -if (!allow_bayer && fmt->bayer) -return -EINVAL ; - }else { - fmt = &yuv_formats[index]; - } +for (i =0 ; i <ARRAY_SIZE (pixel_formats); i++) { +const struct imx_media_pixfmt *fmt = &pixel_formats[i]; +enum codespace_sel fmt_cs_sel; + + fmt_cs_sel = (fmt->cs ==IPUV3_COLORSPACE_YUV ) ? +CS_SEL_YUV :CS_SEL_RGB ; + +if ((cs_sel !=CS_SEL_ANY && fmt_cs_sel != cs_sel) || + (!allow_non_mbus && !fmt->codes[0 ]) || + (!allow_bayer && fmt->bayer)) +continue ; + +if (index ==0 ) { +if (fourcc) + *fourcc = fmt->fourcc; +if (code) + *code = fmt->codes[0 ]; +return 0 ; } -break ; -default : -return -EINVAL ; - } -if (fourcc) - *fourcc = fmt->fourcc; -if (code) - *code = fmt->codes[0 ]; + index--; + } -return 0 ; +return -EINVAL ; } const struct imx_media_pixfmt *
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 102/376 media: imx: utils: fix media bus format enumeration
In reply to Greg Kroah-HartmanFrom: Philipp Zabel <[email protected]>
[ Upstream commit 1df2148fdfc036c9350d41ae81b09b3f8897c9b6 ]
Iterate over all media bus formats, not just over the first format in each imx_media_pixfmt entry.
Before:
$ v4l2-ctl -d $(media-ctl -e ipu1_csi0) --list-subdev-mbus-codes 0 ioctl: VIDIOC_SUBDEV_ENUM_MBUS_CODE (pad=0) 0x2006: MEDIA_BUS_FMT_UYVY8_2X8 0x2008: MEDIA_BUS_FMT_YUYV8_2X8 0x1008: MEDIA_BUS_FMT_RGB565_2X8_LE 0x100a: MEDIA_BUS_FMT_RGB888_1X24 0x100d: MEDIA_BUS_FMT_ARGB8888_1X32 0x3001: MEDIA_BUS_FMT_SBGGR8_1X8 0x3013: MEDIA_BUS_FMT_SGBRG8_1X8 0x3002: MEDIA_BUS_FMT_SGRBG8_1X8 0x3014: MEDIA_BUS_FMT_SRGGB8_1X8 0x3007: MEDIA_BUS_FMT_SBGGR10_1X10 0x300e: MEDIA_BUS_FMT_SGBRG10_1X10 0x300a: MEDIA_BUS_FMT_SGRBG10_1X10 0x300f: MEDIA_BUS_FMT_SRGGB10_1X10 0x2001: MEDIA_BUS_FMT_Y8_1X8 0x200a: MEDIA_BUS_FMT_Y10_1X10
After:
$ v4l2-ctl -d $(media-ctl -e ipu1_csi0) --list-subdev-mbus-codes 0 ioctl: VIDIOC_SUBDEV_ENUM_MBUS_CODE (pad=0) 0x2006: MEDIA_BUS_FMT_UYVY8_2X8 0x200f: MEDIA_BUS_FMT_UYVY8_1X16 0x2008: MEDIA_BUS_FMT_YUYV8_2X8 0x2011: MEDIA_BUS_FMT_YUYV8_1X16 0x1008: MEDIA_BUS_FMT_RGB565_2X8_LE 0x100a: MEDIA_BUS_FMT_RGB888_1X24 0x100c: MEDIA_BUS_FMT_RGB888_2X12_LE 0x100d: MEDIA_BUS_FMT_ARGB8888_1X32 0x3001: MEDIA_BUS_FMT_SBGGR8_1X8 0x3013: MEDIA_BUS_FMT_SGBRG8_1X8 0x3002: MEDIA_BUS_FMT_SGRBG8_1X8 0x3014: MEDIA_BUS_FMT_SRGGB8_1X8 0x3007: MEDIA_BUS_FMT_SBGGR10_1X10 0x3008: MEDIA_BUS_FMT_SBGGR12_1X12 0x3019: MEDIA_BUS_FMT_SBGGR14_1X14 0x301d: MEDIA_BUS_FMT_SBGGR16_1X16 0x300e: MEDIA_BUS_FMT_SGBRG10_1X10 0x3010: MEDIA_BUS_FMT_SGBRG12_1X12 0x301a: MEDIA_BUS_FMT_SGBRG14_1X14 0x301e: MEDIA_BUS_FMT_SGBRG16_1X16 0x300a: MEDIA_BUS_FMT_SGRBG10_1X10 0x3011: MEDIA_BUS_FMT_SGRBG12_1X12 0x301b: MEDIA_BUS_FMT_SGRBG14_1X14 0x301f: MEDIA_BUS_FMT_SGRBG16_1X16 0x300f: MEDIA_BUS_FMT_SRGGB10_1X10 0x3012: MEDIA_BUS_FMT_SRGGB12_1X12 0x301c: MEDIA_BUS_FMT_SRGGB14_1X14 0x3020: MEDIA_BUS_FMT_SRGGB16_1X16 0x2001: MEDIA_BUS_FMT_Y8_1X8 0x200a: MEDIA_BUS_FMT_Y10_1X10 0x2013: MEDIA_BUS_FMT_Y12_1X12
[[email protected]: Decrement index to replace loop counter k] [[email protected]: Return directly from within the loops]
--- drivers/staging/media/imx/imx-media-utils.c | 22 +++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
drivers/staging/media/imx/imx-media-utils.c +16 -6
@@ -269,6 +269,7 @@ static int enum_format(u32 *fourcc, u32 *code, u32 index,for (i =0 ; i <ARRAY_SIZE (pixel_formats); i++) {const struct imx_media_pixfmt *fmt = &pixel_formats[i];enum codespace_sel fmt_cs_sel; +unsigned int j; fmt_cs_sel = (fmt->cs ==IPUV3_COLORSPACE_YUV ) ?CS_SEL_YUV :CS_SEL_RGB ;
@@ -278,15 +279,24 @@ static int enum_format(u32 *fourcc, u32 *code, u32 index, (!allow_bayer && fmt->bayer))continue ; -if (index ==0 ) { -if (fourcc) - *fourcc = fmt->fourcc; -if (code) - *code = fmt->codes[0 ]; +if (fourcc && index ==0 ) { + *fourcc = fmt->fourcc;return 0 ; } - index--; +if (!code) { + index--; +continue ; + } + +for (j =0 ; j <ARRAY_SIZE (fmt->codes) && fmt->codes[j]; j++) { +if (index ==0 ) { + *code = fmt->codes[j]; +return 0 ; + } + + index--; + } }return -EINVAL ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 103/376 media: platform: fcp: Set appropriate DMA parameters
In reply to Greg Kroah-HartmanFrom: Kieran Bingham <[email protected]>
[ Upstream commit dd844fb8e50b12e65bbdc5746c9876c6735500df ]
Enabling CONFIG_DMA_API_DEBUG=y and CONFIG_DMA_API_DEBUG_SG=y will enable extra validation on DMA operations ensuring that the size restraints are met.
When using the FCP in conjunction with the VSP1/DU, and display frames, the size of the DMA operations is larger than the default maximum segment size reported by the DMA core (64K). With the DMA debug enabled, this produces a warning such as the following:
"DMA-API: rcar-fcp fea27000.fcp: mapping sg segment longer than device claims to support [len=3145728] [max=65536]"
We have no specific limitation on the segment size which isn't already handled by the VSP1/DU which actually handles the DMA allcoations and buffer management, so define a maximum segment size of up to 4GB (a 32 bit mask).
--- drivers/media/platform/rcar-fcp.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/media/platform/rcar-fcp.c +5 -0
@@ -8,6 +8,7 @@*/ #include <linux/device.h> +#include <linux/dma-mapping.h> #include <linux/list.h> #include <linux/module.h> #include <linux/mod_devicetable.h>
@@ -21,6 +22,7 @@struct rcar_fcp_device {struct list_head list;struct device *dev; +struct device_dma_parameters dma_parms; };static LIST_HEAD (fcp_devices);
@@ -136,6 +138,9 @@ static int rcar_fcp_probe(struct platform_device *pdev) fcp->dev = &pdev->dev; + fcp->dev->dma_parms = &fcp->dma_parms; +dma_set_max_seg_size (fcp->dev,DMA_BIT_MASK (32 )); +pm_runtime_enable (&pdev->dev);mutex_lock (&fcp_lock);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 104/376 MIPS: Make sparse_init() using top-down allocation
In reply to Greg Kroah-HartmanFrom: Tiezhu Yang <[email protected]>
[ Upstream commit 269b3a9ac538c4ae87f84be640b9fa89914a2489 ]
In the current code, if CONFIG_SWIOTLB is set, when failed to get IO TLB memory from the low pages by plat_swiotlb_setup(), it may lead to the boot process failed with kernel panic.
(1) On the Loongson and SiByte platformarch/mips/loongson64/dma.carch/mips/sibyte/common/dma.c
void __init plat_swiotlb_setup(void)
{
swiotlb_init(1);
}kernel/dma/swiotlb.c
void __initswiotlb_init(int verbose)
{
...
vstart = memblock_alloc_low(PAGE_ALIGN(bytes), PAGE_SIZE);
if (vstart && !swiotlb_init_with_tbl(vstart, io_tlb_nslabs, verbose))
return;
...
pr_warn("Cannot allocate buffer");
no_iotlb_memory = true;
}phys_addr_t swiotlb_tbl_map_single()
{
...
if (no_iotlb_memory)
panic("Can not allocate SWIOTLB buffer earlier ...");...
}
(2) On the Cavium OCTEON platformarch/mips/cavium-octeon/dma-octeon.c
void __init plat_swiotlb_setup(void)
{
...
octeon_swiotlb = memblock_alloc_low(swiotlbsize, PAGE_SIZE);
if (!octeon_swiotlb)
panic("%s: Failed to allocate %zu bytes align=%lx\n",
__func__, swiotlbsize, PAGE_SIZE);...
}
Because IO_TLB_DEFAULT_SIZE is 64M, if the rest size of low memory is less than 64M when call plat_swiotlb_setup(), we can easily reproduce the panic case.
In order to reduce the possibility of kernel panic when failed to get IO TLB memory under CONFIG_SWIOTLB, it is better to allocate low memory as small as possible before plat_swiotlb_setup(), so make sparse_init() using top-down allocation.
--- arch/mips/kernel/setup.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/mips/kernel/setup.c +10 -0
@@ -702,7 +702,17 @@ static void __init arch_mem_init(char **cmdline_p)memblock_reserve (crashk_res.start,resource_size (&crashk_res));#endif device_tree_init (); + +/* +* In order to reduce the possibility of kernel panic when failed to +* get IO TLB memory under CONFIG_SWIOTLB, it is better to allocate +* low memory as small as possible before plat_swiotlb_setup(), so +* make sparse_init() using top-down allocation. +*/ +memblock_set_bottom_up (false);sparse_init (); +memblock_set_bottom_up (true); +plat_swiotlb_setup ();dma_contiguous_reserve (PFN_PHYS (max_low_pfn));
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 105/376 ath10k: add flush tx packets for SDIO chip
In reply to Greg Kroah-HartmanFrom: Wen Gong <[email protected]>
[ Upstream commit dd7fc5545bbafdbd6c1efdc996b61883b285bdc5 ]
When station connected to AP, and run TX traffic such as TCP/UDP, and system enter suspend state, then mac80211 call ath10k_flush with set drop flag, recently it only send wmi peer flush to firmware and firmware will flush all pending TX packets, for PCIe, firmware will indicate the TX packets status to ath10k, and then ath10k indicate to mac80211 TX complete with the status, then all the packets has been flushed at this moment. For SDIO chip, it is different, its TX complete indication is disabled by default, and it has a tx queue in ath10k, and its tx credit control is enabled, total tx credit is 96, when its credit is not sufficient, then the packets will buffered in the tx queue of ath10k, max packets is TARGET_TLV_NUM_MSDU_DESC_HL which is 1024, for SDIO, when mac80211 call ath10k_flush with set drop flag, maybe it have pending packets in tx queue of ath10k, and if it does not have sufficient tx credit, the packets will stay in queue untill tx credit report from firmware, if it is a noisy environment, tx speed is low and the tx credit report from firmware will delay more time, then the num_pending_tx will remain > 0 untill all packets send to firmware. After the 1st ath10k_flush, mac80211 will call the 2nd ath10k_flush without set drop flag immediately, then it will call to ath10k_mac_wait_tx_complete, and it wait untill num_pending_tx become to 0, in noisy environment, it is esay to wait about near 5 seconds, then it cause the suspend take long time.
1st and 2nd callstack of ath10k_flush
[ 303.740427] ath10k_sdio mmc1:0001:1: ath10k_flush drop:1, pending:0-0 [ 303.740495] ------------[ cut here ]------------ [ 303.740739] WARNING: CPU: 1 PID: 3921 at /mnt/host/source/src/third_party/kernel/v4.19/drivers/net/wireless/ath/ath10k/mac.c:7025 ath10k_flush+0x54/0x104 [ath10k_core] [ 303.740757] Modules linked in: bridge stp llc ath10k_sdio ath10k_core rfcomm uinput cros_ec_rpmsg mtk_seninf mtk_cam_isp mtk_vcodec_enc mtk_fd mtk_vcodec_dec mtk_vcodec_common mtk_dip mtk_mdp3 videobuf2_dma_contig videobuf2_memops v4l2_mem2mem videobuf2_v4l2 videobuf2_common hid_google_hammer hci_uart btqca bluetooth dw9768 ov8856 ecdh_generic ov02a10 v4l2_fwnode mtk_scp mtk_rpmsg rpmsg_core mtk_scp_ipi ipt_MASQUERADE fuse iio_trig_sysfs cros_ec_sensors_ring cros_ec_sensors_sync cros_ec_light_prox cros_ec_sensors industrialio_triggered_buffer [ 303.740914] kfifo_buf cros_ec_activity cros_ec_sensors_core lzo_rle lzo_compress ath mac80211 zram cfg80211 joydev [last unloaded: ath10k_core] [ 303.741009] CPU: 1 PID: 3921 Comm: kworker/u16:10 Tainted: G W 4.19.95 #2 [ 303.741027] Hardware name: MediaTek krane sku176 board (DT) [ 303.741061] Workqueue: events_unbound async_run_entry_fn [ 303.741086] pstate: 60000005 (nZCv daif -PAN -UAO) [ 303.741166] pc : ath10k_flush+0x54/0x104 [ath10k_core] [ 303.741244] lr : ath10k_flush+0x54/0x104 [ath10k_core] [ 303.741260] sp : ffffffdf080e77a0 [ 303.741276] x29: ffffffdf080e77a0 x28: ffffffdef3730040 [ 303.741300] x27: ffffff907c2240a0 x26: ffffffde6ff39afc [ 303.741321] x25: ffffffdef3730040 x24: ffffff907bf61018 [ 303.741343] x23: ffffff907c2240a0 x22: ffffffde6ff39a50 [ 303.741364] x21: 0000000000000001 x20: ffffffde6ff39a50 [ 303.741385] x19: ffffffde6bac2420 x18: 0000000000017200 [ 303.741407] x17: ffffff907c24a000 x16: 0000000000000037 [ 303.741428] x15: ffffff907b49a568 x14: ffffff907cf332c1 [ 303.741476] x13: 00000000000922e4 x12: 0000000000000000 [ 303.741497] x11: 0000000000000001 x10: 0000000000000007 [ 303.741518] x9 : f2256b8c1de4bc00 x8 : f2256b8c1de4bc00 [ 303.741539] x7 : ffffff907ab5e764 x6 : 0000000000000000 [ 303.741560] x5 : 0000000000000080 x4 : 0000000000000001 [ 303.741582] x3 : ffffffdf080e74a8 x2 : ffffff907aa91244 [ 303.741603] x1 : ffffffdf080e74a8 x0 : 0000000000000024 [ 303.741624] Call trace: [ 303.741701] ath10k_flush+0x54/0x104 [ath10k_core] [ 303.741941] __ieee80211_flush_queues+0x1dc/0x358 [mac80211] [ 303.742098] ieee80211_flush_queues+0x34/0x44 [mac80211] [ 303.742253] ieee80211_set_disassoc+0xc0/0x5ec [mac80211] [ 303.742399] ieee80211_mgd_deauth+0x720/0x7d4 [mac80211] [ 303.742535] ieee80211_deauth+0x24/0x30 [mac80211] [ 303.742720] cfg80211_mlme_deauth+0x250/0x3bc [cfg80211] [ 303.742849] cfg80211_mlme_down+0x90/0xd0 [cfg80211] [ 303.742971] cfg80211_disconnect+0x340/0x3a0 [cfg80211] [ 303.743087] __cfg80211_leave+0xe4/0x17c [cfg80211] [ 303.743203] cfg80211_leave+0x38/0x50 [cfg80211] [ 303.743319] wiphy_suspend+0x84/0x5bc [cfg80211] [ 303.743335] dpm_run_callback+0x170/0x304 [ 303.743346] __device_suspend+0x2dc/0x3e8 [ 303.743356] async_suspend+0x2c/0xb0 [ 303.743370] async_run_entry_fn+0x48/0xf8 [ 303.743383] process_one_work+0x304/0x604 [ 303.743394] worker_thread+0x248/0x3f4 [ 303.743403] kthread+0x120/0x130 [ 303.743416] ret_from_fork+0x10/0x18
[ 303.743812] ath10k_sdio mmc1:0001:1: ath10k_flush drop:0, pending:0-0 [ 303.743858] ------------[ cut here ]------------ [ 303.744057] WARNING: CPU: 1 PID: 3921 at /mnt/host/source/src/third_party/kernel/v4.19/drivers/net/wireless/ath/ath10k/mac.c:7025 ath10k_flush+0x54/0x104 [ath10k_core] [ 303.744075] Modules linked in: bridge stp llc ath10k_sdio ath10k_core rfcomm uinput cros_ec_rpmsg mtk_seninf mtk_cam_isp mtk_vcodec_enc mtk_fd mtk_vcodec_dec mtk_vcodec_common mtk_dip mtk_mdp3 videobuf2_dma_contig videobuf2_memops v4l2_mem2mem videobuf2_v4l2 videobuf2_common hid_google_hammer hci_uart btqca bluetooth dw9768 ov8856 ecdh_generic ov02a10 v4l2_fwnode mtk_scp mtk_rpmsg rpmsg_core mtk_scp_ipi ipt_MASQUERADE fuse iio_trig_sysfs cros_ec_sensors_ring cros_ec_sensors_sync cros_ec_light_prox cros_ec_sensors industrialio_triggered_buffer kfifo_buf cros_ec_activity cros_ec_sensors_core lzo_rle lzo_compress ath mac80211 zram cfg80211 joydev [last unloaded: ath10k_core] [ 303.744256] CPU: 1 PID: 3921 Comm: kworker/u16:10 Tainted: G W 4.19.95 #2 [ 303.744273] Hardware name: MediaTek krane sku176 board (DT) [ 303.744301] Workqueue: events_unbound async_run_entry_fn [ 303.744325] pstate: 60000005 (nZCv daif -PAN -UAO) [ 303.744403] pc : ath10k_flush+0x54/0x104 [ath10k_core] [ 303.744480] lr : ath10k_flush+0x54/0x104 [ath10k_core] [ 303.744496] sp : ffffffdf080e77a0 [ 303.744512] x29: ffffffdf080e77a0 x28: ffffffdef3730040 [ 303.744534] x27: ffffff907c2240a0 x26: ffffffde6ff39afc [ 303.744556] x25: ffffffdef3730040 x24: ffffff907bf61018 [ 303.744577] x23: ffffff907c2240a0 x22: ffffffde6ff39a50 [ 303.744598] x21: 0000000000000000 x20: ffffffde6ff39a50 [ 303.744620] x19: ffffffde6bac2420 x18: 000000000001831c [ 303.744641] x17: ffffff907c24a000 x16: 0000000000000037 [ 303.744662] x15: ffffff907b49a568 x14: ffffff907cf332c1 [ 303.744683] x13: 00000000000922ea x12: 0000000000000000 [ 303.744704] x11: 0000000000000001 x10: 0000000000000007 [ 303.744747] x9 : f2256b8c1de4bc00 x8 : f2256b8c1de4bc00 [ 303.744768] x7 : ffffff907ab5e764 x6 : 0000000000000000 [ 303.744789] x5 : 0000000000000080 x4 : 0000000000000001 [ 303.744810] x3 : ffffffdf080e74a8 x2 : ffffff907aa91244 [ 303.744831] x1 : ffffffdf080e74a8 x0 : 0000000000000024 [ 303.744853] Call trace: [ 303.744929] ath10k_flush+0x54/0x104 [ath10k_core] [ 303.745098] __ieee80211_flush_queues+0x1dc/0x358 [mac80211] [ 303.745277] ieee80211_flush_queues+0x34/0x44 [mac80211] [ 303.745424] ieee80211_set_disassoc+0x108/0x5ec [mac80211] [ 303.745569] ieee80211_mgd_deauth+0x720/0x7d4 [mac80211] [ 303.745706] ieee80211_deauth+0x24/0x30 [mac80211] [ 303.745853] cfg80211_mlme_deauth+0x250/0x3bc [cfg80211] [ 303.745979] cfg80211_mlme_down+0x90/0xd0 [cfg80211] [ 303.746103] cfg80211_disconnect+0x340/0x3a0 [cfg80211] [ 303.746219] __cfg80211_leave+0xe4/0x17c [cfg80211] [ 303.746335] cfg80211_leave+0x38/0x50 [cfg80211] [ 303.746452] wiphy_suspend+0x84/0x5bc [cfg80211] [ 303.746467] dpm_run_callback+0x170/0x304 [ 303.746477] __device_suspend+0x2dc/0x3e8 [ 303.746487] async_suspend+0x2c/0xb0 [ 303.746498] async_run_entry_fn+0x48/0xf8 [ 303.746510] process_one_work+0x304/0x604 [ 303.746521] worker_thread+0x248/0x3f4 [ 303.746530] kthread+0x120/0x130 [ 303.746542] ret_from_fork+0x10/0x18
one sample's debugging log: it wait 3190 ms(5000 - 1810).
1st ath10k_flush, it has 120 packets in tx queue of ath10k:
<...>-1513 [000] .... 25374.786005: ath10k_log_err: ath10k_sdio mmc1:0001:1 ath10k_flush drop:1, pending:120-0 <...>-1513 [000] ...1 25374.788375: ath10k_log_warn: ath10k_sdio mmc1:0001:1 ath10k_htt_tx_mgmt_inc_pending htt->num_pending_mgmt_tx:0 <...>-1500 [001] .... 25374.790143: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx work, eid:1, count:121
2st ath10k_flush, it has 121 packets in tx queue of ath10k:
<...>-1513 [000] .... 25374.790571: ath10k_log_err: ath10k_sdio mmc1:0001:1 ath10k_flush drop:0, pending:121-0 <...>-1513 [000] .... 25374.791990: ath10k_log_err: ath10k_sdio mmc1:0001:1 ath10k_mac_wait_tx_complete state:1 pending:121-0 <...>-1508 [001] .... 25374.792696: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit update: delta:46 <...>-1508 [001] .... 25374.792700: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit total:46 <...>-1508 [001] .... 25374.792729: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx work, eid:1, count:121 <...>-1508 [001] .... 25374.792937: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx status:0, eid:1, req count:88, count:32, len:49792 <...>-1508 [001] .... 25374.793031: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx status:0, eid:1, req count:75, count:14, len:21784 kworker/u16:0-25773 [003] .... 25374.793701: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx complete, eid:1, pending complete count:46 <...>-1881 [000] .... 25375.073178: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit update: delta:24 <...>-1881 [000] .... 25375.073182: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit total:24 <...>-1881 [000] .... 25375.073429: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx work, eid:1, count:75 <...>-1879 [001] .... 25375.074090: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx complete, eid:1, pending complete count:24 <...>-1881 [000] .... 25375.074123: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx status:0, eid:1, req count:51, count:24, len:37344 <...>-1879 [001] .... 25375.270126: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit update: delta:26 <...>-1879 [001] .... 25375.270130: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit total:26 <...>-1488 [000] .... 25375.270174: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx work, eid:1, count:51 <...>-1488 [000] .... 25375.270529: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx status:0, eid:1, req count:25, count:26, len:40456 <...>-1879 [001] .... 25375.270693: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx complete, eid:1, pending complete count:26 <...>-1488 [001] .... 25377.775885: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit update: delta:12 <...>-1488 [001] .... 25377.775890: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit total:12 <...>-1488 [001] .... 25377.775933: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx work, eid:1, count:25 <...>-1488 [001] .... 25377.776059: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx status:0, eid:1, req count:13, count:12, len:18672 <...>-1879 [001] .... 25377.776100: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx complete, eid:1, pending complete count:12 <...>-1488 [001] .... 25377.878079: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit update: delta:15 <...>-1488 [001] .... 25377.878087: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit total:15 <...>-1879 [000] .... 25377.878323: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx work, eid:1, count:13 <...>-1879 [000] .... 25377.878487: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx status:0, eid:1, req count:0, count:13, len:20228 <...>-1879 [000] .... 25377.878497: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx complete, eid:1, pending complete count:13 <...>-1488 [001] .... 25377.919927: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit update: delta:11 <...>-1488 [001] .... 25377.919932: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 credit total:13 <...>-1488 [001] .... 25377.919976: ath10k_log_dbg: ath10k_sdio mmc1:0001:1 bundle tx work, eid:1, count:0 <...>-1881 [000] .... 25377.982645: ath10k_log_warn: ath10k_sdio mmc1:0001:1 HTT_T2H_MSG_TYPE_MGMT_TX_COMPLETION status:0 <...>-1513 [001] .... 25377.982973: ath10k_log_err: ath10k_sdio mmc1:0001:1 ath10k_mac_wait_tx_complete time_left:1810, pending:0-0
Flush all pending TX packets for the 1st ath10k_flush reduced the wait time of the 2nd ath10k_flush and then suspend take short time.
This Patch only effect SDIO chips.
Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00042.
--- drivers/net/wireless/ath/ath10k/htt.h | 7 +++++++ drivers/net/wireless/ath/ath10k/htt_tx.c | 8 +++++++- drivers/net/wireless/ath/ath10k/mac.c | 1 + 3 files changed, 15 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/htt.h +7 -0
@@ -2035,6 +2035,7 @@ struct ath10k_htt_tx_ops {int (*htt_h2t_aggr_cfg_msg)(struct ath10k_htt *htt,u8 max_subfrms_ampdu,u8 max_subfrms_amsdu); +void (*htt_flush_tx)(struct ath10k_htt *htt); };static inline int ath10k_htt_send_rx_ring_cfg (struct ath10k_htt *htt)
@@ -2074,6 +2075,12 @@ static inline int ath10k_htt_tx(struct ath10k_htt *htt,return htt->tx_ops->htt_tx (htt, txmode, msdu); } +static inline void ath10k_htt_flush_tx (struct ath10k_htt *htt) +{ +if (htt->tx_ops->htt_flush_tx) + htt->tx_ops->htt_flush_tx (htt); +} +static inline int ath10k_htt_alloc_txbuff (struct ath10k_htt *htt) {if (!htt->tx_ops->htt_alloc_txbuff)
drivers/net/wireless/ath/ath10k/htt_tx.c +7 -1
@@ -529,9 +529,14 @@ void ath10k_htt_tx_destroy(struct ath10k_htt *htt) htt->tx_mem_allocated = false; } -void ath10k_htt_tx_stop (struct ath10k_htt *htt) +static void ath10k_htt_flush_tx_queue (struct ath10k_htt *htt) {idr_for_each (&htt->pending_tx, ath10k_htt_tx_clean_up_pending, htt->ar); +} + +void ath10k_htt_tx_stop (struct ath10k_htt *htt) +{ +ath10k_htt_flush_tx_queue (htt);idr_destroy (&htt->pending_tx); }
@@ -1784,6 +1789,7 @@ static const struct ath10k_htt_tx_ops htt_tx_ops_hl = { .htt_send_frag_desc_bank_cfg = ath10k_htt_send_frag_desc_bank_cfg_32, .htt_tx = ath10k_htt_tx_hl, .htt_h2t_aggr_cfg_msg = ath10k_htt_h2t_aggr_cfg_msg_32, + .htt_flush_tx = ath10k_htt_flush_tx_queue, };void ath10k_htt_set_tx_ops (struct ath10k_htt *htt)
drivers/net/wireless/ath/ath10k/mac.c +1 -0
@@ -7190,6 +7190,7 @@ static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,ath10k_wmi_peer_flush (ar, arvif->vdev_id, arvif->bssid, bitmap); } +ath10k_htt_flush_tx (&ar->htt); }return ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 106/376 Bluetooth: btbcm: Add 2 missing models to subver tables
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit c03ee9af4e07112bd3fc688daca9e654f41eca93 ]
Currently the bcm_uart_subver_ and bcm_usb_subver_table-s lack entries for the BCM4324B5 and BCM20703A1 chipsets. This makes the code use just "BCM" as prefix for the filename to pass to request-firmware, making it harder for users to figure out which firmware they need. This especially is problematic with the UART attached BCM4324B5 where this leads to the filename being just "BCM.hcd".
Add the 2 missing devices to subver tables. This has been tested on:
1. A Dell XPS15 9550 where this makes btbcm.c try to load "BCM20703A1-0a5c-6410.hcd" before it tries to load "BCM-0a5c-6410.hcd".
2. A Thinkpad 8 where this makes btbcm.c try to load "BCM4324B5.hcd" before it tries to load "BCM.hcd"
--- drivers/bluetooth/btbcm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btbcm.c +2 -0
@@ -380,6 +380,7 @@ static const struct bcm_subver_table bcm_uart_subver_table[] = { { 0x410e, "BCM43341B0" }, /* 002.001.014 */ { 0x4204, "BCM2076B1" }, /* 002.002.004 */ { 0x4406, "BCM4324B3" }, /* 002.004.006 */ + { 0x4606, "BCM4324B5" }, /* 002.006.006 */ { 0x6109, "BCM4335C0" }, /* 003.001.009 */ { 0x610c, "BCM4354" }, /* 003.001.012 */ { 0x2122, "BCM4343A0" }, /* 001.001.034 */
@@ -395,6 +396,7 @@ static const struct bcm_subver_table bcm_uart_subver_table[] = { };static const struct bcm_subver_table bcm_usb_subver_table[] = { + {0x2105 ,"BCM20703A1" },/* 001.001.005 */ {0x210b ,"BCM43142A0" },/* 001.001.011 */ {0x2112 ,"BCM4314A0" },/* 001.001.018 */ {0x2118 ,"BCM20702A0" },/* 001.001.024 */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 107/376 audit: fix a net reference leak in audit_list_rules_send()
In reply to Greg Kroah-HartmanFrom: Paul Moore <[email protected]>
[ Upstream commit 3054d06719079388a543de6adb812638675ad8f5 ]
If audit_list_rules_send() fails when trying to create a new thread to send the rules it also fails to cleanup properly, leaking a reference to a net structure. This patch fixes the error patch and renames audit_send_list() to audit_send_list_thread() to better match its cousin, audit_send_reply_thread().
--- kernel/audit.c | 2 +- kernel/audit.h | 2 +- kernel/auditfilter.c | 16 +++++++--------- 3 files changed, 9 insertions(+), 11 deletions(-)
kernel/audit.c +1 -1
@@ -880,7 +880,7 @@ main_queue:return 0 ; } -int audit_send_list (void *_dest) +int audit_send_list_thread (void *_dest) {struct audit_netlink_list *dest = _dest;struct sk_buff *skb;
kernel/audit.h +1 -1
@@ -229,7 +229,7 @@ struct audit_netlink_list {struct sk_buff_head q; }; -int audit_send_list (void *_dest); +int audit_send_list_thread (void *_dest);extern int selinux_audit_rule_update (void );
kernel/auditfilter.c +7 -9
@@ -1161,11 +1161,8 @@ int audit_rule_change(int type, int seq, void *data, size_t datasz)*/ int audit_list_rules_send (struct sk_buff *request_skb,int seq) { -u32 portid =NETLINK_CB (request_skb).portid; -struct net *net =sock_net (NETLINK_CB (request_skb).sk);struct task_struct *tsk;struct audit_netlink_list *dest; -int err =0 ;/* We can't just spew out the rules here because we might fill * the available socket buffer space and deadlock waiting for
@@ -1173,25 +1170,26 @@ int audit_list_rules_send(struct sk_buff *request_skb, int seq)* happen if we're actually running in the context of auditctl * trying to _send_ the stuff */ - dest =kmalloc (sizeof (struct audit_netlink_list ),GFP_KERNEL ); + dest =kmalloc (sizeof (*dest),GFP_KERNEL );if (!dest)return -ENOMEM ; - dest->net =get_net (net); - dest->portid = portid; + dest->net =get_net (sock_net (NETLINK_CB (request_skb).sk)); + dest->portid =NETLINK_CB (request_skb).portid;skb_queue_head_init (&dest->q);mutex_lock (&audit_filter_mutex);audit_list_rules (seq, &dest->q);mutex_unlock (&audit_filter_mutex); - tsk =kthread_run (audit_send_list, dest,"audit_send_list" ); + tsk =kthread_run (audit_send_list_thread, dest,"audit_send_list" );if (IS_ERR (tsk)) {skb_queue_purge (&dest->q); +put_net (dest->net);kfree (dest); - err =PTR_ERR (tsk); +return PTR_ERR (tsk); } -return err; +return 0 ; }int audit_comparator (u32 left,u32 op,u32 right)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 108/376 drm/amd/display: Correct updating logic of dcn21s pipe VM flags
In reply to Greg Kroah-HartmanFrom: Dale Zhao <[email protected]>
[ Upstream commit 2a28fe92220a116735ef45939b7edcfee83cc6b0 ]
[Why]:
Renoir's pipe VM flags are not correctly updated if pipe strategy has changed during some scenarios. It will result in watermarks mistakenly calculation, thus underflow and garbage appear.
[How]:
Correctly update pipe VM flags to pipes which have been populated.
--- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +1 -5
@@ -1694,12 +1694,8 @@ static int dcn21_populate_dml_pipes_from_context( {uint32_t pipe_cnt =dcn20_populate_dml_pipes_from_context (dc, context, pipes);int i; -struct resource_context *res_ctx = &context->res_ctx; -for (i =0 ; i < dc->res_pool->pipe_count; i++) { - -if (!res_ctx->pipe_ctx[i].stream) -continue ; +for (i =0 ; i < pipe_cnt; i++) { pipes[i].pipe.src.hostvm =1 ; pipes[i].pipe.src.gpuvm =1 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 109/376 drm/amd/display: dmcu wait loop calculation is incorrect in RV
In reply to Greg Kroah-HartmanFrom: Paul Hsieh <[email protected]>
[ Upstream commit 7fc5c319efceaed1a23b7ef35c333553ce39fecf ]
[Why]
Driver already get display clock from SMU base on MHz, but driver read again and mutiple 1000 cause wait loop value is overflow.
[How]
remove coding error
--- .../drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr_vbios_smu.c | 3 --- 1 file changed, 3 deletions(-)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr_vbios_smu.c +0 -3
@@ -97,9 +97,6 @@ int rv1_vbios_smu_set_dispclk(struct clk_mgr_internal *clk_mgr, int requested_di VBIOSSMC_MSG_SetDispclkFreq, requested_dispclk_khz / 1000); -/* Actual dispclk set is returned in the parameter register */ - actual_dispclk_set_mhz =REG_READ (MP1_SMN_C2PMSG_83 ) *1000 ; -if (!IS_FPGA_MAXIMUS_DC (dc->ctx->dce_environment)) {if (dmcu && dmcu->funcs->is_dmcu_initialized (dmcu)) {if (clk_mgr->dfs_bypass_disp_clk != actual_dispclk_set_mhz)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 110/376 Drivers: hv: vmbus: Always handle the VMBus messages on CPU0
In reply to Greg Kroah-HartmanFrom: Andrea Parri (Microsoft) <[email protected]>
[ Upstream commit 8a857c55420f29da4fc131adc22b12d474c48f4c ]
A Linux guest have to pick a "connect CPU" to communicate with the Hyper-V host. This CPU can not be taken offline because Hyper-V does not provide a way to change that CPU assignment.
Current code sets the connect CPU to whatever CPU ends up running the function vmbus_negotiate_version(), and this will generate problems if that CPU is taken offine.
Establish CPU0 as the connect CPU, and add logics to prevents the
connect CPU from being taken offline. We could pick some other CPU,
and we could pick that "other CPU" dynamically if there was a reason to do so at some point in the future. But for now, #defining the connect CPU to 0 is the most straightforward and least complex solution.
While on this, add inline comments explaining "why" offer and rescind messages should not be handled by a same serialized work queue.
--- drivers/hv/connection.c | 20 +------------------- drivers/hv/hv.c | 7 +++++++ drivers/hv/hyperv_vmbus.h | 11 ++++++----- drivers/hv/vmbus_drv.c | 20 +++++++++++++++++--- 4 files changed, 31 insertions(+), 27 deletions(-)
drivers/hv/connection.c +1 -19
@@ -69,7 +69,6 @@ MODULE_PARM_DESC(max_version,int vmbus_negotiate_version (struct vmbus_channel_msginfo *msginfo,u32 version) {int ret =0 ; -unsigned int cur_cpu;struct vmbus_channel_initiate_contact *msg;unsigned long flags;
@@ -102,24 +101,7 @@ int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo, u32 version) msg->monitor_page1 =virt_to_phys (vmbus_connection.monitor_pages[0 ]); msg->monitor_page2 =virt_to_phys (vmbus_connection.monitor_pages[1 ]); -/* -* We want all channel messages to be delivered on CPU 0. -* This has been the behavior pre-win8. This is not -* perf issue and having all channel messages delivered on CPU 0 -* would be ok. -* For post win8 hosts, we support receiving channel messagges on -* all the CPUs. This is needed for kexec to work correctly where -* the CPU attempting to connect may not be CPU 0. -*/ -if (version >=VERSION_WIN8_1 ) { - cur_cpu =get_cpu (); - msg->target_vcpu =hv_cpu_number_to_vp_number (cur_cpu); - vmbus_connection.connect_cpu = cur_cpu; -put_cpu (); - }else { - msg->target_vcpu =0 ; - vmbus_connection.connect_cpu =0 ; - } + msg->target_vcpu =hv_cpu_number_to_vp_number (VMBUS_CONNECT_CPU );/* * Add to list before we send the request since we may
drivers/hv/hv.c +7 -0
@@ -245,6 +245,13 @@ int hv_synic_cleanup(unsigned int cpu)bool channel_found = false;unsigned long flags; +/* +* Hyper-V does not provide a way to change the connect CPU once +* it is set; we must prevent the connect CPU from going offline. +*/ +if (cpu ==VMBUS_CONNECT_CPU ) +return -EBUSY ; +/* * Search for channels which are bound to the CPU we're about to * cleanup. In case we find one and vmbus is still connected we need to
drivers/hv/hyperv_vmbus.h +6 -5
@@ -212,12 +212,13 @@ enum vmbus_connect_state {#define MAX_SIZE_CHANNEL_MESSAGE HV_MESSAGE_PAYLOAD_BYTE_COUNT -struct vmbus_connection { -/* -* CPU on which the initial host contact was made. -*/ -int connect_cpu; +/* +* The CPU that Hyper-V will interrupt for VMBUS messages, such as +* CHANNELMSG_OFFERCHANNEL and CHANNELMSG_RESCIND_CHANNELOFFER. +*/ +#define VMBUS_CONNECT_CPU 0 +struct vmbus_connection {u32 msg_conn_id;atomic_t offer_in_progress;
drivers/hv/vmbus_drv.c +17 -3
@@ -1098,14 +1098,28 @@ void vmbus_on_msg_dpc(unsigned long data)/* * If we are handling the rescind message; * schedule the work on the global work queue. +* +* The OFFER message and the RESCIND message should +* not be handled by the same serialized work queue, +* because the OFFER handler may call vmbus_open(), +* which tries to open the channel by sending an +* OPEN_CHANNEL message to the host and waits for +* the host's response; however, if the host has +* rescinded the channel before it receives the +* OPEN_CHANNEL message, the host just silently +* ignores the OPEN_CHANNEL message; as a result, +* the guest's OFFER handler hangs for ever, if we +* handle the RESCIND message in the same serialized +* work queue: the RESCIND handler can not start to +* run before the OFFER handler finishes. */ -schedule_work_on (vmbus_connection.connect_cpu, +schedule_work_on (VMBUS_CONNECT_CPU , &ctx->work);break ;case CHANNELMSG_OFFERCHANNEL :atomic_inc (&vmbus_connection.offer_in_progress); -queue_work_on (vmbus_connection.connect_cpu, +queue_work_on (VMBUS_CONNECT_CPU , vmbus_connection.work_queue, &ctx->work);break ;
@@ -1152,7 +1166,7 @@ static void vmbus_force_channel_rescinded(struct vmbus_channel *channel)INIT_WORK (&ctx->work, vmbus_onmessage_work); -queue_work_on (vmbus_connection.connect_cpu, +queue_work_on (VMBUS_CONNECT_CPU , vmbus_connection.work_queue, &ctx->work); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 111/376 efi/libstub/random: Align allocate size to EFI_ALLOC_ALIGN
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
[ Upstream commit e1df73e2d18b3b7d66f2ec38d81d9566b3a7fb21 ]
The EFI stub uses a per-architecture #define for the minimum base and size alignment of page allocations, which is set to 4 KB for all architecures except arm64, which uses 64 KB, to ensure that allocations can always be (un)mapped efficiently, regardless of the page size used by the kernel proper, which could be a kexec'ee
The API wrappers around page based allocations assume that this alignment is always taken into account, and so efi_free() will also round up its size argument to EFI_ALLOC_ALIGN.
Currently, efi_random_alloc() does not honour this alignment for the allocated size, and so freeing such an allocation may result in unrelated memory to be freed, potentially leading to issues after boot. So let's round up size in efi_random_alloc() as well.
--- drivers/firmware/efi/libstub/randomalloc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/firmware/efi/libstub/randomalloc.c +3 -1
@@ -74,6 +74,8 @@ efi_status_t efi_random_alloc(unsigned long size,if (align <EFI_ALLOC_ALIGN ) align =EFI_ALLOC_ALIGN ; + size =round_up (size,EFI_ALLOC_ALIGN ); +/* count the suitable slots in each memory map entry */ for (map_offset =0 ; map_offset < map_size; map_offset += desc_size) {efi_memory_desc_t *md = (void *)memory_map + map_offset;
@@ -109,7 +111,7 @@ efi_status_t efi_random_alloc(unsigned long size, } target =round_up (md->phys_addr, align) + target_slot * align; - pages =round_up (size,EFI_PAGE_SIZE ) /EFI_PAGE_SIZE ; + pages = size /EFI_PAGE_SIZE ; status =efi_bs_call (allocate_pages,EFI_ALLOCATE_ADDRESS ,EFI_LOADER_DATA , pages, &target);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 112/376 dpaa2-eth: fix return codes used in ndo_setup_tc
In reply to Greg Kroah-HartmanFrom: Jesper Dangaard Brouer <[email protected]>
[ Upstream commit b89c1e6bdc73f5775e118eb2ab778e75b262b30c ]
Drivers ndo_setup_tc call should return -EOPNOTSUPP, when it cannot support the qdisc type. Other return values will result in failing the qdisc setup. This lead to qdisc noop getting assigned, which will drop all TX packets on the interface.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +2 -2
@@ -2018,7 +2018,7 @@ static int dpaa2_eth_setup_tc(struct net_device *net_dev,int i;if (type !=TC_SETUP_QDISC_MQPRIO ) -return -EINVAL ; +return -EOPNOTSUPP ; mqprio->hw =TC_MQPRIO_HW_OFFLOAD_TCS ; num_queues =dpaa2_eth_queue_count (priv);
@@ -2030,7 +2030,7 @@ static int dpaa2_eth_setup_tc(struct net_device *net_dev,if (num_tc >dpaa2_eth_tc_count (priv)) {netdev_err (net_dev,"Max %d traffic classes supported\n" ,dpaa2_eth_tc_count (priv)); -return -EINVAL ; +return -EOPNOTSUPP ; }if (!num_tc) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 113/376 bcache: remove a duplicate ->make_request_fn assignment
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit a91b2014fc31dc6eaa02ca33aa3b4d1b6e4a0207 ]
The make_request_fn pointer should only be assigned by blk_alloc_queue. Fix a left over manual initialization.
--- drivers/md/bcache/request.c | 1 - 1 file changed, 1 deletion(-)
drivers/md/bcache/request.c +0 -1
@@ -1372,7 +1372,6 @@ void bch_flash_dev_request_init(struct bcache_device *d) {struct gendisk *g = d->disk; - g->queue->make_request_fn = flash_dev_make_request; g->queue->backing_dev_info->congested_fn = flash_dev_congested; d->cache_miss = flash_dev_cache_miss; d->ioctl = flash_dev_ioctl;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 114/376 net/mlx4_core: Add missing iounmap() in error path
In reply to Greg Kroah-HartmanFrom: Zou Wei <[email protected]>
[ Upstream commit c90af587a9eee697e2d89683113707cada70116a ]
This fixes the following coccicheck warning:
drivers/net/ethernet/mellanox/mlx4/crdump.c:200:2-8: ERROR: missing iounmap; ioremap on line 190 and execution via conditional on line 198
--- drivers/net/ethernet/mellanox/mlx4/crdump.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx4/crdump.c +1 -0
@@ -197,6 +197,7 @@ int mlx4_crdump_collect(struct mlx4_dev *dev) err =devlink_region_snapshot_id_get (devlink, &id);if (err) {mlx4_err (dev,"crdump: devlink get snapshot id err %d\n" , err); +iounmap (cr_space);return err; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 115/376 bpf, riscv: Fix tail call count off by one in RV32 BPF JIT
In reply to Greg Kroah-HartmanFrom: Luke Nelson <[email protected]>
[ Upstream commit 745abfaa9eafa597d31fdf24a3249e5206a98768 ]
This patch fixes an off by one error in the RV32 JIT handling for BPF tail call. Currently, the code decrements TCC before checking if it is less than zero. This limits the maximum number of tail calls to 32 instead of 33 as in other JITs. The fix is to instead check the old value of TCC before decrementing.
--- arch/riscv/net/bpf_jit_comp32.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/riscv/net/bpf_jit_comp32.c +3 -2
@@ -770,12 +770,13 @@ static int emit_bpf_tail_call(int insn, struct rv_jit_context *ctx)emit_bcc (BPF_JGE ,lo (idx_reg),RV_REG_T1 , off, ctx);/* -* if ((temp_tcc = tcc - 1) < 0) +* temp_tcc = tcc - 1; +* if (tcc < 0) * goto out; */ emit (rv_addi (RV_REG_T1 ,RV_REG_TCC ,-1 ), ctx); off = (tc_ninsn - (ctx->ninsns - start_insn)) <<2 ; -emit_bcc (BPF_JSLT ,RV_REG_T1 ,RV_REG_ZERO , off, ctx); +emit_bcc (BPF_JSLT ,RV_REG_TCC ,RV_REG_ZERO , off, ctx);/* * prog = array->ptrs[index];
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 116/376 netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 0d7c83463fdf7841350f37960a7abadd3e650b41 ]
Instead of EINVAL which should be used for malformed netlink messages.
--- net/netfilter/nft_nat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nft_nat.c +2 -2
@@ -129,7 +129,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, priv->type =NF_NAT_MANIP_DST ;break ;default : -return -EINVAL ; +return -EOPNOTSUPP ; }if (tb[NFTA_NAT_FAMILY ] ==NULL )
@@ -196,7 +196,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,if (tb[NFTA_NAT_FLAGS ]) { priv->flags =ntohl (nla_get_be32 (tb[NFTA_NAT_FLAGS ]));if (priv->flags & ~NF_NAT_RANGE_MASK ) -return -EINVAL ; +return -EOPNOTSUPP ; }return nf_ct_netns_get (ctx->net, family);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 117/376 ath11k: use GFP_ATOMIC under spin lock
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 69c93f9674c97dc439cdc0527811f8ad104c2e35 ]
A spin lock is taken here so we should use GFP_ATOMIC.
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +1 -1
@@ -892,7 +892,7 @@ int ath11k_peer_rx_tid_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id,else hw_desc_sz =ath11k_hal_reo_qdesc_size (DP_BA_WIN_SZ_MAX , tid); - vaddr =kzalloc (hw_desc_sz +HAL_LINK_DESC_ALIGN -1 ,GFP_KERNEL ); + vaddr =kzalloc (hw_desc_sz +HAL_LINK_DESC_ALIGN -1 ,GFP_ATOMIC );if (!vaddr) {spin_unlock_bh (&ab->base_lock);return -ENOMEM ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 118/376 Bluetooth: Adding driver and quirk defs for multi-role LE
In reply to Greg Kroah-HartmanFrom: Alain Michaud <[email protected]>
[ Upstream commit 220915857e29795ae5ba4222806268b4a99c19c1 ]
This change adds the relevant driver and quirk to allow drivers to report the le_states as being trustworthy.
This has historically been disabled as controllers did not reliably support this. In particular, this will be used to relax this condition for controllers that have been well tested and reliable.
/* Most controller will fail if we try to create new connections * while we have an existing one in slave role. */ if (hdev->conn_hash.le_num_slave > 0) return NULL;
--- drivers/bluetooth/btusb.c | 1 + include/net/bluetooth/hci.h | 9 +++++++++ 2 files changed, 10 insertions(+)
drivers/bluetooth/btusb.c +1 -0
@@ -58,6 +58,7 @@ static struct usb_driver btusb_driver;#define BTUSB_CW6622 0x100000#define BTUSB_MEDIATEK 0x200000#define BTUSB_WIDEBAND_SPEECH 0x400000 +#define BTUSB_VALID_LE_STATES 0x800000static const struct usb_device_id btusb_table[] = {/* Generic Bluetooth USB device */
include/net/bluetooth/hci.h +9 -0
@@ -214,6 +214,15 @@ enum {* This quirk must be set before hci_register_dev is called. */ HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , + +/* When this quirk is set, the controller has validated that +* LE states reported through the HCI_LE_READ_SUPPORTED_STATES are +* valid. This mechanism is necessary as many controllers have +* been seen has having trouble initiating a connectable +* advertisement despite the state combination being reported as +* supported. +*/ + HCI_QUIRK_VALID_LE_STATES, };/* HCI device flags */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 119/376 drm/amd/display: Do not disable pipe split if mode is not supported
In reply to Greg Kroah-HartmanFrom: Sung Lee <[email protected]>
[ Upstream commit 1dfedb39d38f813357885e19badd1971c17f79a7 ]
[WHY]
If mode is not supported, pipe split should not be disabled. This may cause more modes to fail.
[HOW]
Check for mode support before disabling pipe split.
This commit was previously reverted as it was thought to have problems, but those issues have been resolved.
--- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +7 -2
@@ -2597,19 +2597,24 @@ int dcn20_validate_apply_pipe_split_flags(/* Avoid split loop looks for lowest voltage level that allows most unsplit pipes possible */ if (avoid_split) { +int max_mpc_comb = context->bw_ctx.dml.vba.maxMpcComb; +for (i =0 , pipe_idx =0 ; i < dc->res_pool->pipe_count; i++) {if (!context->res_ctx.pipe_ctx[i].stream)continue ;for (vlevel_split = vlevel; vlevel <= context->bw_ctx.dml.soc.num_states; vlevel++) -if (context->bw_ctx.dml.vba.NoOfDPP[vlevel][0 ][pipe_idx] ==1 ) +if (context->bw_ctx.dml.vba.NoOfDPP[vlevel][0 ][pipe_idx] ==1 && + context->bw_ctx.dml.vba.ModeSupport[vlevel][0 ])break ;/* Impossible to not split this pipe */ if (vlevel > context->bw_ctx.dml.soc.num_states) vlevel = vlevel_split; +else + max_mpc_comb =0 ; pipe_idx++; } - context->bw_ctx.dml.vba.maxMpcComb =0 ; + context->bw_ctx.dml.vba.maxMpcComb = max_mpc_comb; }/* Split loop sets which pipe should be split based on dml outputs and dc flags */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 120/376 libbpf: Refactor map creation logic and fix cleanup leak
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 2d39d7c56f115148b05d1d8c6b8698a5730c8b53 ]
Factor out map creation and destruction logic to simplify code and especially error handling. Also fix map FD leak in case of partially successful map creation during bpf_object load operation.
--- tools/lib/bpf/libbpf.c | 226 ++++++++++++++++++++++------------------- 1 file changed, 121 insertions(+), 105 deletions(-)
tools/lib/bpf/libbpf.c +121 -105
@@ -3482,107 +3482,111 @@ bpf_object__populate_internal_map(struct bpf_object *obj, struct bpf_map *map)return 0 ; } +static void bpf_map__destroy (struct bpf_map *map); + +static int bpf_object__create_map (struct bpf_object *obj,struct bpf_map *map) +{ +struct bpf_create_map_attr create_attr; +struct bpf_map_def *def = &map->def; + +memset (&create_attr,0 ,sizeof (create_attr)); + +if (obj->caps.name) + create_attr.name = map->name; + create_attr.map_ifindex = map->map_ifindex; + create_attr.map_type = def->type; + create_attr.map_flags = def->map_flags; + create_attr.key_size = def->key_size; + create_attr.value_size = def->value_size; + +if (def->type ==BPF_MAP_TYPE_PERF_EVENT_ARRAY && !def->max_entries) { +int nr_cpus; + + nr_cpus =libbpf_num_possible_cpus (); +if (nr_cpus <0 ) { +pr_warn ("map '%s': failed to determine number of system CPUs: %d\n" , + map->name, nr_cpus); +return nr_cpus; + } +pr_debug ("map '%s': setting size to %d\n" , map->name, nr_cpus); + create_attr.max_entries = nr_cpus; + }else { + create_attr.max_entries = def->max_entries; + } + +if (bpf_map__is_struct_ops (map)) + create_attr.btf_vmlinux_value_type_id = + map->btf_vmlinux_value_type_id; + + create_attr.btf_fd =0 ; + create_attr.btf_key_type_id =0 ; + create_attr.btf_value_type_id =0 ; +if (obj->btf && !bpf_map_find_btf_info (obj, map)) { + create_attr.btf_fd =btf__fd (obj->btf); + create_attr.btf_key_type_id = map->btf_key_type_id; + create_attr.btf_value_type_id = map->btf_value_type_id; + } + + map->fd =bpf_create_map_xattr (&create_attr); +if (map->fd <0 && (create_attr.btf_key_type_id || + create_attr.btf_value_type_id)) { +char *cp, errmsg[STRERR_BUFSIZE ]; +int err = -errno; + + cp =libbpf_strerror_r (err, errmsg,sizeof (errmsg)); +pr_warn ("Error in bpf_create_map_xattr(%s):%s(%d). Retrying without BTF.\n" , + map->name, cp, err); + create_attr.btf_fd =0 ; + create_attr.btf_key_type_id =0 ; + create_attr.btf_value_type_id =0 ; + map->btf_key_type_id =0 ; + map->btf_value_type_id =0 ; + map->fd =bpf_create_map_xattr (&create_attr); + } + +if (map->fd <0 ) +return -errno; + +return 0 ; +} +static int bpf_object__create_maps (struct bpf_object *obj) { -struct bpf_create_map_attr create_attr = {}; -int nr_cpus =0 ; -unsigned int i; +struct bpf_map *map; +char *cp, errmsg[STRERR_BUFSIZE ]; +unsigned int i, j;int err;for (i =0 ; i < obj->nr_maps; i++) { -struct bpf_map *map = &obj->maps[i]; -struct bpf_map_def *def = &map->def; -char *cp, errmsg[STRERR_BUFSIZE ]; -int *pfd = &map->fd; + map = &obj->maps[i];if (map->pin_path) { err =bpf_object__reuse_map (map);if (err) { -pr_warn ("error reusing pinned map %s\n" , +pr_warn ("map '%s': error reusing pinned map\n" , map->name); -return err; + goto err_out; } }if (map->fd >=0 ) { -pr_debug ("skip map create (preset) %s: fd=%d\n" , +pr_debug ("map '%s': skipping creation (preset fd=%d)\n" , map->name, map->fd);continue ; } -if (obj->caps.name) - create_attr.name = map->name; - create_attr.map_ifindex = map->map_ifindex; - create_attr.map_type = def->type; - create_attr.map_flags = def->map_flags; - create_attr.key_size = def->key_size; - create_attr.value_size = def->value_size; -if (def->type ==BPF_MAP_TYPE_PERF_EVENT_ARRAY && - !def->max_entries) { -if (!nr_cpus) - nr_cpus =libbpf_num_possible_cpus (); -if (nr_cpus <0 ) { -pr_warn ("failed to determine number of system CPUs: %d\n" , - nr_cpus); - err = nr_cpus; - goto err_out; - } -pr_debug ("map '%s': setting size to %d\n" , - map->name, nr_cpus); - create_attr.max_entries = nr_cpus; - }else { - create_attr.max_entries = def->max_entries; - } - create_attr.btf_fd =0 ; - create_attr.btf_key_type_id =0 ; - create_attr.btf_value_type_id =0 ; -if (bpf_map_type__is_map_in_map (def->type) && - map->inner_map_fd >=0 ) - create_attr.inner_map_fd = map->inner_map_fd; -if (bpf_map__is_struct_ops (map)) - create_attr.btf_vmlinux_value_type_id = - map->btf_vmlinux_value_type_id; - -if (obj->btf && !bpf_map_find_btf_info (obj, map)) { - create_attr.btf_fd =btf__fd (obj->btf); - create_attr.btf_key_type_id = map->btf_key_type_id; - create_attr.btf_value_type_id = map->btf_value_type_id; - } - - *pfd =bpf_create_map_xattr (&create_attr); -if (*pfd <0 && (create_attr.btf_key_type_id || - create_attr.btf_value_type_id)) { - err = -errno; - cp =libbpf_strerror_r (err, errmsg,sizeof (errmsg)); -pr_warn ("Error in bpf_create_map_xattr(%s):%s(%d). Retrying without BTF.\n" , - map->name, cp, err); - create_attr.btf_fd =0 ; - create_attr.btf_key_type_id =0 ; - create_attr.btf_value_type_id =0 ; - map->btf_key_type_id =0 ; - map->btf_value_type_id =0 ; - *pfd =bpf_create_map_xattr (&create_attr); - } - -if (*pfd <0 ) { -size_t j; + err =bpf_object__create_map (obj, map); +if (err) + goto err_out; - err = -errno; -err_out: - cp =libbpf_strerror_r (err, errmsg,sizeof (errmsg)); -pr_warn ("failed to create map (name: '%s'): %s(%d)\n" , - map->name, cp, err); -pr_perm_msg (err); -for (j =0 ; j < i; j++) -zclose (obj->maps[j].fd); -return err; - } +pr_debug ("map '%s': created successfully, fd=%d\n" , map->name, + map->fd);if (bpf_map__is_internal (map)) { err =bpf_object__populate_internal_map (obj, map);if (err <0 ) { -zclose (*pfd); +zclose (map->fd); goto err_out; } }
@@ -3590,16 +3594,23 @@ err_out:if (map->pin_path && !map->pinned) { err =bpf_map__pin (map,NULL );if (err) { -pr_warn ("failed to auto-pin map name '%s' at '%s'\n" , - map->name, map->pin_path); -return err; +pr_warn ("map '%s': failed to auto-pin at '%s': %d\n" , + map->name, map->pin_path, err); +zclose (map->fd); + goto err_out; } } - -pr_debug ("created map %s: fd=%d\n" , map->name, *pfd); }return 0 ; + +err_out: + cp =libbpf_strerror_r (err, errmsg,sizeof (errmsg)); +pr_warn ("map '%s': failed to create: %s(%d)\n" , map->name, cp, err); +pr_perm_msg (err); +for (j =0 ; j < i; j++) +zclose (obj->maps[j].fd); +return err; } static int
@@ -5955,6 +5966,32 @@ int bpf_object__pin(struct bpf_object *obj, const char *path)return 0 ; } +static void bpf_map__destroy (struct bpf_map *map) +{ +if (map->clear_priv) + map->clear_priv (map, map->priv); + map->priv =NULL ; + map->clear_priv =NULL ; + +if (map->mmaped) { +munmap (map->mmaped,bpf_map_mmap_sz (map)); + map->mmaped =NULL ; + } + +if (map->st_ops) { +zfree (&map->st_ops->data); +zfree (&map->st_ops->progs); +zfree (&map->st_ops->kern_func_off); +zfree (&map->st_ops); + } + +zfree (&map->name); +zfree (&map->pin_path); + +if (map->fd >=0 ) +zclose (map->fd); +} +void bpf_object__close (struct bpf_object *obj) {size_t i;
@@ -5970,29 +6007,8 @@ void bpf_object__close(struct bpf_object *obj)btf__free (obj->btf);btf_ext__free (obj->btf_ext); -for (i =0 ; i < obj->nr_maps; i++) { -struct bpf_map *map = &obj->maps[i]; - -if (map->clear_priv) - map->clear_priv (map, map->priv); - map->priv =NULL ; - map->clear_priv =NULL ; - -if (map->mmaped) { -munmap (map->mmaped,bpf_map_mmap_sz (map)); - map->mmaped =NULL ; - } - -if (map->st_ops) { -zfree (&map->st_ops->data); -zfree (&map->st_ops->progs); -zfree (&map->st_ops->kern_func_off); -zfree (&map->st_ops); - } - -zfree (&map->name); -zfree (&map->pin_path); - } +for (i =0 ; i < obj->nr_maps; i++) +bpf_map__destroy (&obj->maps[i]);zfree (&obj->kconfig);zfree (&obj->externs);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 121/376 selftests/bpf: Ensure test flavors use correct skeletons
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 76148faa161e7cfb2d7719f35b37d7db4f3f8596 ]
Ensure that test runner flavors include their own skeletons from <flavor>/ directory. Previously, skeletons generated for no-flavor test_progs were used. Apart from fixing correctness, this also makes it possible to compile only flavors individually:
$ make clean && make test_progs-no_alu32 ... now succeeds ...
--- tools/testing/selftests/bpf/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/Makefile +1 -1
@@ -324,7 +324,7 @@ $(TRUNNER_TEST_OBJS): $(TRUNNER_OUTPUT)/%.test.o: \ $(TRUNNER_BPF_SKELS) \ $$(BPFOBJ) | $(TRUNNER_OUTPUT) $$(call msg,TEST-OBJ,$(TRUNNER_BINARY),$$@) - cd $$(@D) && $$(CC) $$(CFLAGS) -c $(CURDIR)/$$< $$(LDLIBS) -o $$(@F) + cd $$(@D) && $$(CC) -I. $$(CFLAGS) -c $(CURDIR)/$$< $$(LDLIBS) -o $$(@F) $(TRUNNER_EXTRA_OBJS): $(TRUNNER_OUTPUT)/%.o: \ %.c \
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 122/376 selftests/bpf: Fix memory leak in test selector
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit f25d5416d64c796aa639136eb0b076c8bd579b54 ]
Free test selector substrings, which were strdup()'ed.
--- tools/testing/selftests/bpf/test_progs.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
tools/testing/selftests/bpf/test_progs.c +16 -4
@@ -420,6 +420,18 @@ static int libbpf_print_fn(enum libbpf_print_level level,return 0 ; } +static void free_str_set (const struct str_set *set) +{ +int i; + +if (!set) +return ; + +for (i =0 ; i < set->cnt; i++) +free ((void *)set->strs[i]); +free (set->strs); +} +static int parse_str_list (const char *s,struct str_set *set) {char *input, *state =NULL , *next, **tmp, **strs =NULL ;
@@ -756,11 +768,11 @@ int main(int argc, char **argv)fprintf (stdout,"Summary: %d/%d PASSED, %d SKIPPED, %d FAILED\n" , env.succ_cnt, env.sub_succ_cnt, env.skip_cnt, env.fail_cnt); -free (env.test_selector.blacklist.strs); -free (env.test_selector.whitelist.strs); +free_str_set (&env.test_selector.blacklist); +free_str_set (&env.test_selector.whitelist);free (env.test_selector.num_set); -free (env.subtest_selector.blacklist.strs); -free (env.subtest_selector.whitelist.strs); +free_str_set (&env.subtest_selector.blacklist); +free_str_set (&env.subtest_selector.whitelist);free (env.subtest_selector.num_set);return env.fail_cnt ?EXIT_FAILURE :EXIT_SUCCESS ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 123/376 selftests/bpf: Fix memory leak in extract_build_id()
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 9f56bb531a809ecaa7f0ddca61d2cf3adc1cb81a ]
getline() allocates string, which has to be freed.
--- tools/testing/selftests/bpf/test_progs.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/test_progs.c +1 -0
@@ -351,6 +351,7 @@ int extract_build_id(char *build_id, size_t size) len = size;memcpy (build_id, line, len); build_id[len] ='\0' ; +free (line);return 0 ; err:fclose (fp);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 124/376 selftests/bpf: Fix invalid memory reads in core_relo selftest
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 13c908495e5d51718a6da84ae925fa2aac056380 ]
Another one found by AddressSanitizer. input_len is bigger than actually initialized data size.
--- tools/testing/selftests/bpf/prog_tests/core_reloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/prog_tests/core_reloc.c +1 -1
@@ -392,7 +392,7 @@ static struct core_reloc_test_case test_cases[] = { .input = STRUCT_TO_CHAR_PTR(core_reloc_existence___minimal) { .a = 42, }, - .input_len = sizeof(struct core_reloc_existence), + .input_len = sizeof(struct core_reloc_existence___minimal), .output = STRUCT_TO_CHAR_PTR(core_reloc_existence_output) { .a_exists = 1, .b_exists = 0,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 125/376 libbpf: Fix huge memory leak in libbpf_find_vmlinux_btf_id()
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 3521ffa2ee9a48c3236c93f54ae11c074490ebce ]
BTF object wasn't freed.
--- tools/lib/bpf/libbpf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/lib/bpf/libbpf.c +4 -1
@@ -6688,6 +6688,7 @@ int libbpf_find_vmlinux_btf_id(const char *name, enum bpf_attach_type attach_type) {struct btf *btf; +int err; btf =libbpf_find_kernel_btf ();if (IS_ERR (btf)) {
@@ -6695,7 +6696,9 @@ int libbpf_find_vmlinux_btf_id(const char *name,return -EINVAL ; } -return __find_vmlinux_btf_id (btf, name, attach_type); + err =__find_vmlinux_btf_id (btf, name, attach_type); +btf__free (btf); +return err; }static int libbpf_find_prog_btf_id (const char *name,__u32 attach_prog_fd)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 126/376 selftests/bpf: Fix bpf_link leak in ns_current_pid_tgid selftest
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 8d30e80a049ad699264e4a12911e349f93c7279a ]
If condition is inverted, but it's also just not necessary.
--- tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c +1 -4
@@ -80,9 +80,6 @@ void test_ns_current_pid_tgid(void) "User pid/tgid %llu BPF pid/tgid %llu\n", id, bss.pid_tgid)) goto cleanup; cleanup: -if (!link) { -bpf_link__destroy (link); - link =NULL ; - } +bpf_link__destroy (link);bpf_object__close (obj); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 127/376 selftests/bpf: Add runqslower binary to .gitignore
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit e4e8f4d047fdcf7ac7d944e266e85d8041f16cd6 ]
With recent changes, runqslower is being copied into selftests/bpf root directory. So add it into .gitignore.
--- tools/testing/selftests/bpf/.gitignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/.gitignore +1 -1
@@ -39,4 +39,4 @@ test_cpp /no_alu32 /bpf_gcc /tools - +/runqslower
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 128/376 media: m88ds3103: error in set_frontend is swallowed and not reported
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
[ Upstream commit c4ed27cfed45c16c2dd16c9fa3b883e306177e40 ]
Bail out if registers can not be updated.
Addresses-Coverity-ID: 1461655 ("Code maintainability issues")
--- drivers/media/dvb-frontends/m88ds3103.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/dvb-frontends/m88ds3103.c +2 -0
@@ -980,6 +980,8 @@ static int m88ds3103_set_frontend(struct dvb_frontend *fe) goto err; ret =m88ds3103_update_bits (dev,0xc9 ,0x08 ,0x08 ); +if (ret) + goto err; } dev_dbg(&client->dev, "carrier offset=%d\n",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 129/376 ARM: 8969/1: decompressor: simplify libfdt builds
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit 7ae4a78daacf240a8247cde73337dc4b26d253da ]
Copying source files during the build time may not end up with as clean code as expected.
lib/fdt*.c simply wrap scripts/dtc/libfdt/fdt*.c, and it works nicely. Let's follow this approach for the arm decompressor, too.
Add four wrappers, arch/arm/boot/compressed/fdt*.c and remove the Makefile messes. Another nice thing is we no longer need to maintain the own libfdt_env.h because the decompressor can include <linux/libfdt_env.h>.
There is a subtle problem when generated files are turned into check-in files.
When you are doing a rebuild of an existing object tree with O= option, there exists stale "shipped" copies that the old Makefile implementation created. The build system ends up with compiling the stale generated files because Make searches for prerequisites in the current directory, i.e. $(objtree) first, and then the directory listed in VPATH, i.e. $(srctree).
To mend this issue, I added the following code:
ifdef building_out_of_srctree $(shell rm -f $(addprefix $(obj)/, fdt_rw.c fdt_ro.c fdt_wip.c fdt.c)) endif
This will need to stay for a while because "git bisect" crossing this commit, otherwise, would result in a build error.
--- arch/arm/boot/compressed/.gitignore | 9 ------ arch/arm/boot/compressed/Makefile | 38 ++++++++++--------------- arch/arm/boot/compressed/atags_to_fdt.c | 1 + arch/arm/boot/compressed/fdt.c | 2 ++ arch/arm/boot/compressed/fdt_ro.c | 2 ++ arch/arm/boot/compressed/fdt_rw.c | 2 ++ arch/arm/boot/compressed/fdt_wip.c | 2 ++ arch/arm/boot/compressed/libfdt_env.h | 24 ---------------- 8 files changed, 24 insertions(+), 56 deletions(-) create mode 100644 arch/arm/boot/compressed/fdt.c create mode 100644 arch/arm/boot/compressed/fdt_ro.c create mode 100644 arch/arm/boot/compressed/fdt_rw.c create mode 100644 arch/arm/boot/compressed/fdt_wip.c delete mode 100644 arch/arm/boot/compressed/libfdt_env.h
arch/arm/boot/compressed/.gitignore +0 -9
@@ -7,12 +7,3 @@ hyp-stub.S piggy_data vmlinux vmlinux.lds - -# borrowed libfdt files -fdt.c -fdt.h -fdt_ro.c -fdt_rw.c -fdt_wip.c -libfdt.h -libfdt_internal.h
arch/arm/boot/compressed/Makefile +15 -23
@@ -76,29 +76,30 @@ compress-$(CONFIG_KERNEL_LZMA) = lzma compress-$(CONFIG_KERNEL_XZ) = xzkern compress-$(CONFIG_KERNEL_LZ4) = lz4 -# Borrowed libfdt files for the ATAG compatibility mode - -libfdt := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c -libfdt_hdrs := fdt.h libfdt.h libfdt_internal.h - -libfdt_objs := $(addsuffix .o, $(basename $(libfdt))) - -$(addprefix $(obj)/,$(libfdt) $(libfdt_hdrs)): $(obj)/%: $(srctree)/scripts/dtc/libfdt/% - $(call cmd,shipped) - -$(addprefix $(obj)/,$(libfdt_objs) atags_to_fdt.o): \ - $(addprefix $(obj)/,$(libfdt_hdrs)) +libfdt_objs := fdt_rw.o fdt_ro.o fdt_wip.o fdt.o ifeq ($(CONFIG_ARM_ATAG_DTB_COMPAT),y) OBJS += $(libfdt_objs) atags_to_fdt.o endif +# -fstack-protector-strong triggers protection checks in this code, +# but it is being used too early to link to meaningful stack_chk logic. +nossp-flags-$(CONFIG_CC_HAS_STACKPROTECTOR_NONE) := -fno-stack-protector +$(foreach o, $(libfdt_objs) atags_to_fdt.o, \ + $(eval CFLAGS_$(o) := -I $(srctree)/scripts/dtc/libfdt $(nossp-flags-y))) + +# These were previously generated C files. When you are building the kernel +# with O=, make sure to remove the stale files in the output tree. Otherwise, +# the build system wrongly compiles the stale ones. +ifdef building_out_of_srctree +$(shell rm -f $(addprefix $(obj)/, fdt_rw.c fdt_ro.c fdt_wip.c fdt.c)) +endif + targets := vmlinux vmlinux.lds piggy_data piggy.o \ lib1funcs.o ashldi3.o bswapsdi2.o \ head.o $(OBJS) -clean-files += piggy_data lib1funcs.S ashldi3.S bswapsdi2.S \ - $(libfdt) $(libfdt_hdrs) hyp-stub.S +clean-files += piggy_data lib1funcs.S ashldi3.S bswapsdi2.S hyp-stub.S KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
@@ -107,15 +108,6 @@ ORIG_CFLAGS := $(KBUILD_CFLAGS) KBUILD_CFLAGS = $(subst -pg, , $(ORIG_CFLAGS)) endif -# -fstack-protector-strong triggers protection checks in this code, -# but it is being used too early to link to meaningful stack_chk logic. -nossp-flags-$(CONFIG_CC_HAS_STACKPROTECTOR_NONE) := -fno-stack-protector -CFLAGS_atags_to_fdt.o := $(nossp-flags-y) -CFLAGS_fdt.o := $(nossp-flags-y) -CFLAGS_fdt_ro.o := $(nossp-flags-y) -CFLAGS_fdt_rw.o := $(nossp-flags-y) -CFLAGS_fdt_wip.o := $(nossp-flags-y) - ccflags-y := -fpic $(call cc-option,-mno-single-pic-base,) -fno-builtin \ -I$(obj) $(DISABLE_ARM_SSP_PER_TASK_PLUGIN) asflags-y := -DZIMAGE
arch/arm/boot/compressed/atags_to_fdt.c +1 -0
@@ -1,4 +1,5 @@// SPDX-License-Identifier: GPL-2.0 +#include <linux/libfdt_env.h> #include <asm/setup.h> #include <libfdt.h>
arch/arm/boot/compressed/fdt.c new file +2 -0
@@ -0,0 +1,2 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include "../../../../lib/fdt.c"
arch/arm/boot/compressed/fdt_ro.c new file +2 -0
@@ -0,0 +1,2 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include "../../../../lib/fdt_ro.c"
arch/arm/boot/compressed/fdt_rw.c new file +2 -0
@@ -0,0 +1,2 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include "../../../../lib/fdt_rw.c"
arch/arm/boot/compressed/fdt_wip.c new file +2 -0
@@ -0,0 +1,2 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include "../../../../lib/fdt_wip.c"
arch/arm/boot/compressed/libfdt_env.h deleted +0 -24
@@ -1,24 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef _ARM_LIBFDT_ENV_H -#define _ARM_LIBFDT_ENV_H - -#include <linux/limits.h> -#include <linux/types.h> -#include <linux/string.h> -#include <asm/byteorder.h> - -#define INT32_MAX S32_MAX -#define UINT32_MAX U32_MAX - -typedef __be16 fdt16_t ; -typedef __be32 fdt32_t ; -typedef __be64 fdt64_t ; - -#define fdt16_to_cpu (x) be16_to_cpu(x) -#define cpu_to_fdt16 (x) cpu_to_be16(x) -#define fdt32_to_cpu (x) be32_to_cpu(x) -#define cpu_to_fdt32 (x) cpu_to_be32(x) -#define fdt64_to_cpu (x) be64_to_cpu(x) -#define cpu_to_fdt64 (x) cpu_to_be64(x) - -#endif
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 130/376 drm/bridge: fix stack usage warning on old gcc
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 78b0d99a68ecdc84728c99f4fef71942e9ecf35a ]
Some older versions of gcc badly optimize code that passes an inline function argument into another function by reference, causing huge stack usage:
drivers/gpu/drm/bridge/tc358768.c: In function 'tc358768_bridge_pre_enable':drivers/gpu/drm/bridge/tc358768.c:840:1: error: the frame size of 2256 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]
Use a temporary variable as a workaround and add a comment pointing to the gcc bug.
--- drivers/gpu/drm/bridge/tc358768.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/tc358768.c +3 -1
@@ -178,6 +178,8 @@ static int tc358768_clear_error(struct tc358768_priv *priv)static void tc358768_write (struct tc358768_priv *priv,u32 reg,u32 val) { +/* work around https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */ +int tmpval = val;size_t count =2 ;if (priv->error)
@@ -187,7 +189,7 @@ static void tc358768_write(struct tc358768_priv *priv, u32 reg, u32 val)if (reg <0x100 || reg >=0x600 ) count =1 ; - priv->error =regmap_bulk_write (priv->regmap, reg, &val, count); + priv->error =regmap_bulk_write (priv->regmap, reg, &tmpval, count); }static void tc358768_read (struct tc358768_priv *priv,u32 reg,u32 *val)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 131/376 net: bcmgenet: set Rx mode before starting netif
In reply to Greg Kroah-HartmanFrom: Doug Berger <[email protected]>
[ Upstream commit 72f96347628e73dbb61b307f18dd19293cc6792a ]
This commit explicitly calls the bcmgenet_set_rx_mode() function when the network interface is started. This function is normally called by ndo_set_rx_mode when the flags are changed, but apparently not when the driver is suspended and resumed.
This change ensures that address filtering or promiscuous mode are properly restored by the driver after the MAC may have been reset.
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +4 -0
@@ -70,6 +70,9 @@#define GENET_RDMA_REG_OFF (priv->hw_params->rdma_offset + \ TOTAL_DESC * DMA_DESC_SIZE) +/* Forward declarations */ +static void bcmgenet_set_rx_mode (struct net_device *dev); +static inline void bcmgenet_writel (u32 value,void __iomem *offset) {/* MIPS chips strapped for BE will automagically configure the
@@ -2803,6 +2806,7 @@ static void bcmgenet_netif_start(struct net_device *dev)struct bcmgenet_priv *priv =netdev_priv (dev);/* Start the network engine */ +bcmgenet_set_rx_mode (dev);bcmgenet_enable_rx_napi (priv);umac_enable_set (priv,CMD_TX_EN |CMD_RX_EN , true);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 132/376 net: bcmgenet: Fix WoL with password after deep sleep
In reply to Greg Kroah-HartmanFrom: Doug Berger <[email protected]>
[ Upstream commit 6f7689057a0f10a6c967b9f2759d7a3dc948b930 ]
Broadcom STB chips support a deep sleep mode where all register contents are lost. Because we were stashing the MagicPacket password into some of these registers a suspend into that deep sleep then a resumption would not lead to being able to wake-up from MagicPacket with password again.
Fix this by keeping a software copy of the password and program it during suspend.
--- .../net/ethernet/broadcom/genet/bcmgenet.h | 2 + .../ethernet/broadcom/genet/bcmgenet_wol.c | 39 +++++++++---------- 2 files changed, 20 insertions(+), 21 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.h +2 -0
@@ -14,6 +14,7 @@#include <linux/if_vlan.h> #include <linux/phy.h> #include <linux/dim.h> +#include <linux/ethtool.h> /* total number of Buffer Descriptors, same for Rx/Tx */ #define TOTAL_DESC 256
@@ -676,6 +677,7 @@ struct bcmgenet_priv {/* WOL */ struct clk *clk_wol;u32 wolopts; +u8 sopass[SOPASS_MAX ];struct bcmgenet_mib_counters mib;
drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c +18 -21
@@ -41,18 +41,13 @@void bcmgenet_get_wol (struct net_device *dev,struct ethtool_wolinfo *wol) {struct bcmgenet_priv *priv =netdev_priv (dev); -u32 reg; wol->supported =WAKE_MAGIC |WAKE_MAGICSECURE ; wol->wolopts = priv->wolopts;memset (wol->sopass,0 ,sizeof (wol->sopass)); -if (wol->wolopts &WAKE_MAGICSECURE ) { - reg =bcmgenet_umac_readl (priv,UMAC_MPD_PW_MS ); -put_unaligned_be16 (reg, &wol->sopass[0 ]); - reg =bcmgenet_umac_readl (priv,UMAC_MPD_PW_LS ); -put_unaligned_be32 (reg, &wol->sopass[2 ]); - } +if (wol->wolopts &WAKE_MAGICSECURE ) +memcpy (wol->sopass, priv->sopass,sizeof (priv->sopass)); }/* ethtool function - set WOL (Wake on LAN) settings.
@@ -62,7 +57,6 @@ int bcmgenet_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol) {struct bcmgenet_priv *priv =netdev_priv (dev);struct device *kdev = &priv->pdev->dev; -u32 reg;if (!device_can_wakeup (kdev))return -ENOTSUPP ;
@@ -70,17 +64,8 @@ int bcmgenet_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)if (wol->wolopts & ~(WAKE_MAGIC |WAKE_MAGICSECURE ))return -EINVAL ; - reg =bcmgenet_umac_readl (priv,UMAC_MPD_CTRL ); -if (wol->wolopts &WAKE_MAGICSECURE ) { -bcmgenet_umac_writel (priv,get_unaligned_be16 (&wol->sopass[0 ]), -UMAC_MPD_PW_MS ); -bcmgenet_umac_writel (priv,get_unaligned_be32 (&wol->sopass[2 ]), -UMAC_MPD_PW_LS ); - reg |=MPD_PW_EN ; - }else { - reg &= ~MPD_PW_EN ; - } -bcmgenet_umac_writel (priv, reg,UMAC_MPD_CTRL ); +if (wol->wolopts &WAKE_MAGICSECURE ) +memcpy (priv->sopass, wol->sopass,sizeof (priv->sopass));/* Flag the device and relevant IRQ as wakeup capable */ if (wol->wolopts) {
@@ -120,6 +105,14 @@ static int bcmgenet_poll_wol_status(struct bcmgenet_priv *priv)return retries; } +static void bcmgenet_set_mpd_password (struct bcmgenet_priv *priv) +{ +bcmgenet_umac_writel (priv,get_unaligned_be16 (&priv->sopass[0 ]), +UMAC_MPD_PW_MS ); +bcmgenet_umac_writel (priv,get_unaligned_be32 (&priv->sopass[2 ]), +UMAC_MPD_PW_LS ); +} +int bcmgenet_wol_power_down_cfg (struct bcmgenet_priv *priv,enum bcmgenet_power_mode mode) {
@@ -144,13 +137,17 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, reg =bcmgenet_umac_readl (priv,UMAC_MPD_CTRL ); reg |=MPD_EN ; +if (priv->wolopts &WAKE_MAGICSECURE ) { +bcmgenet_set_mpd_password (priv); + reg |=MPD_PW_EN ; + }bcmgenet_umac_writel (priv, reg,UMAC_MPD_CTRL );/* Do not leave UniMAC in MPD mode only */ retries =bcmgenet_poll_wol_status (priv);if (retries <0 ) { reg =bcmgenet_umac_readl (priv,UMAC_MPD_CTRL ); - reg &= ~MPD_EN ; + reg &= ~(MPD_EN |MPD_PW_EN );bcmgenet_umac_writel (priv, reg,UMAC_MPD_CTRL );return retries; }
@@ -189,7 +186,7 @@ void bcmgenet_wol_power_up_cfg(struct bcmgenet_priv *priv, reg =bcmgenet_umac_readl (priv,UMAC_MPD_CTRL );if (!(reg &MPD_EN ))return ;/* already powered up so skip the rest */ - reg &= ~MPD_EN ; + reg &= ~(MPD_EN |MPD_PW_EN );bcmgenet_umac_writel (priv, reg,UMAC_MPD_CTRL );/* Disable CRC Forward */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 133/376 lib/mpi: Fix 64-bit MIPS build with Clang
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 18f1ca46858eac22437819937ae44aa9a8f9f2fa ]
When building 64r6_defconfig with CONFIG_MIPS32_O32 disabled and CONFIG_CRYPTO_RSA enabled:
lib/mpi/generic_mpih-mul1.c:37:24: error: invalid use of a cast in a inline asm context requiring an l-value: remove the cast or build with -fheinous-gnu-extensions
umul_ppmm(prod_high, prod_low, s1_ptr[j], s2_limb);
~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/mpi/longlong.h:664:22: note: expanded from macro 'umul_ppmm'
: "=d" ((UDItype)(w0))
~~~~~~~~~~^~~
lib/mpi/generic_mpih-mul1.c:37:13: error: invalid use of a cast in a
inline asm context requiring an l-value: remove the cast
or build with -fheinous-gnu-extensions
umul_ppmm(prod_high, prod_low, s1_ptr[j], s2_limb);
~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/mpi/longlong.h:668:22: note: expanded from macro 'umul_ppmm'
: "=d" ((UDItype)(w1))
~~~~~~~~~~^~~2 errors generated.
This special case for umul_ppmm for MIPS64r6 was added in commit bbc25bee37d2b ("lib/mpi: Fix umul_ppmm() for MIPS64r6"), due to GCC being inefficient and emitting a __multi3 intrinsic.
There is no such issue with clang; with this patch applied, I can build this configuration without any problems and there are no link errors like mentioned in the commit above (which I can still reproduce with GCC 9.3.0 when that commit is reverted). Only use this definition when GCC is being used.
This really should have been caught by commit b0c091ae04f67 ("lib/mpi:
Eliminate unused umul_ppmm definitions for MIPS") when I was messing around in this area but I was not testing 64-bit MIPS at the time.
--- lib/mpi/longlong.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/mpi/longlong.h +1 -1
@@ -653,7 +653,7 @@ do { \************** MIPS/64 ************** ***************************************/ #if (defined(__mips) && __mips >=3 ) &&W_TYPE_SIZE ==64 -#if defined(__mips_isa_rev) && __mips_isa_rev >=6 +#if defined(__mips_isa_rev) && __mips_isa_rev >=6 && defined(CONFIG_CC_IS_GCC )/* * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C * code below, so we special case MIPS64r6 until the compiler can do better.
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 134/376 net/mlx5e: CT: Avoid false warning about rule may be used uninitialized
In reply to Greg Kroah-HartmanFrom: Roi Dayan <[email protected]>
[ Upstream commit 70a5698a5683cd504b03c6030ee622b1bec3f702 ]
Avoid gcc warning by preset rule to invalid ptr.
--- drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +1 -1
@@ -1132,7 +1132,7 @@ mlx5_tc_ct_flow_offload(struct mlx5e_priv *priv, {bool clear_action = attr->ct_attr.ct_action &TCA_CT_ACT_CLEAR ;struct mlx5_tc_ct_priv *ct_priv =mlx5_tc_ct_get_ct_priv (priv); -struct mlx5_flow_handle *rule; +struct mlx5_flow_handle *rule =ERR_PTR (-EINVAL );int err;if (!ct_priv)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 135/376 exit: Move preemption fixup up, move blocking operations down
In reply to Greg Kroah-HartmanFrom: Jann Horn <[email protected]>
[ Upstream commit 586b58cac8b4683eb58a1446fbc399de18974e40 ]
With CONFIG_DEBUG_ATOMIC_SLEEP=y and CONFIG_CGROUPS=y, kernel oopses in non-preemptible context look untidy; after the main oops, the kernel prints a "sleeping function called from invalid context" report because exit_signals() -> cgroup_threadgroup_change_begin() -> percpu_down_read() can sleep, and that happens before the preempt_count_set(PREEMPT_ENABLED) fixup.
It looks like the same thing applies to profile_task_exit() and kcov_task_exit().
Fix it by moving the preemption fixup up and the calls to profile_task_exit() and kcov_task_exit() down.
--- kernel/exit.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
kernel/exit.c +16 -9
@@ -708,8 +708,12 @@ void __noreturn do_exit(long code)struct task_struct *tsk = current;int group_dead; -profile_task_exit (tsk); -kcov_task_exit (tsk); +/* +* We can get here from a kernel oops, sometimes with preemption off. +* Start by checking for critical errors. +* Then fix up important state like USER_DS and preemption. +* Then do everything else. +*/ WARN_ON (blk_needs_flush_plug (tsk));
@@ -727,6 +731,16 @@ void __noreturn do_exit(long code)*/ set_fs (USER_DS ); +if (unlikely (in_atomic ())) { +pr_info ("note: %s[%d] exited with preempt_count %d\n" , + current->comm,task_pid_nr (current), +preempt_count ()); +preempt_count_set (PREEMPT_ENABLED ); + } + +profile_task_exit (tsk); +kcov_task_exit (tsk); +ptrace_event (PTRACE_EVENT_EXIT , code);validate_creds_for_do_exit (tsk);
@@ -744,13 +758,6 @@ void __noreturn do_exit(long code)exit_signals (tsk);/* sets PF_EXITING */ -if (unlikely (in_atomic ())) { -pr_info ("note: %s[%d] exited with preempt_count %d\n" , - current->comm,task_pid_nr (current), -preempt_count ()); -preempt_count_set (PREEMPT_ENABLED ); - } -/* sync mm's RSS info before statistics gathering */ if (tsk->mm)sync_mm_rss (tsk->mm);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 136/376 sched/core: Fix illegal RCU from offline CPUs
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit bf2c59fce4074e55d622089b34be3a6bc95484fb ]
In the CPU-offline process, it calls mmdrop() after idle entry and the subsequent call to cpuhp_report_idle_dead(). Once execution passes the call to rcu_report_dead(), RCU is ignoring the CPU, which results in lockdep complaining when mmdrop() uses RCU from either memcg or debugobjects below.
Fix it by cleaning up the active_mm state from BP instead. Every arch which has CONFIG_HOTPLUG_CPU should have already called idle_task_exit() from AP. The only exception is parisc because it switches them to &init_mm unconditionally (see smp_boot_one_cpu() and smp_cpu_init()), but the patch will still work there because it calls mmgrab(&init_mm) in smp_cpu_init() and then should call mmdrop(&init_mm) in finish_cpu().
WARNING: suspicious RCU usage
-----------------------------
kernel/workqueue.c:710 RCU or wq_pool_mutex should be held!
other info that might help us debug this:
RCU used illegally from offline CPU!
Call Trace: dump_stack+0xf4/0x164 (unreliable) lockdep_rcu_suspicious+0x140/0x164 get_work_pool+0x110/0x150 __queue_work+0x1bc/0xca0 queue_work_on+0x114/0x120 css_release+0x9c/0xc0 percpu_ref_put_many+0x204/0x230 free_pcp_prepare+0x264/0x570 free_unref_page+0x38/0xf0 __mmdrop+0x21c/0x2c0 idle_task_exit+0x170/0x1b0 pnv_smp_cpu_kill_self+0x38/0x2e0 cpu_die+0x48/0x64 arch_cpu_idle_dead+0x30/0x50 do_idle+0x2f4/0x470 cpu_startup_entry+0x38/0x40 start_secondary+0x7a8/0xa80 start_secondary_resume+0x10/0x14
--- arch/powerpc/platforms/powernv/smp.c | 1 - include/linux/sched/mm.h | 2 ++ kernel/cpu.c | 18 +++++++++++++++++- kernel/sched/core.c | 5 +++-- 4 files changed, 22 insertions(+), 4 deletions(-)
arch/powerpc/platforms/powernv/smp.c +0 -1
@@ -167,7 +167,6 @@ static void pnv_smp_cpu_kill_self(void)/* Standard hot unplug procedure */ idle_task_exit (); - current->active_mm =NULL ;/* for sanity */ cpu =smp_processor_id ();DBG ("CPU%d offline\n" , cpu);generic_set_cpu_dead (cpu);
include/linux/sched/mm.h +2 -0
@@ -49,6 +49,8 @@ static inline void mmdrop(struct mm_struct *mm)__mmdrop (mm); } +void mmdrop (struct mm_struct *mm); +/* * This has to be called after a get_task_mm()/mmget_not_zero() * followed by taking the mmap_sem for writing before modifying the
kernel/cpu.c +17 -1
@@ -3,6 +3,7 @@* * This code is licenced under the GPL. */ +#include <linux/sched/mm.h> #include <linux/proc_fs.h> #include <linux/smp.h> #include <linux/init.h>
@@ -564,6 +565,21 @@ static int bringup_cpu(unsigned int cpu)return bringup_wait_for_ap (cpu); } +static int finish_cpu (unsigned int cpu) +{ +struct task_struct *idle =idle_thread_get (cpu); +struct mm_struct *mm = idle->active_mm; + +/* +* idle_task_exit() will have switched to &init_mm, now +* clean up any remaining active_mm state. +*/ +if (mm != &init_mm) + idle->active_mm = &init_mm; +mmdrop (mm); +return 0 ; +} +/* * Hotplug state machine related functions */
@@ -1549,7 +1565,7 @@ static struct cpuhp_step cpuhp_hp_states[] = { [CPUHP_BRINGUP_CPU] = { .name = "cpu:bringup", .startup.single = bringup_cpu, - .teardown.single = NULL, + .teardown.single = finish_cpu, .cant_stop = true, },/* Final state before CPU kills itself */
kernel/sched/core.c +3 -2
@@ -6190,13 +6190,14 @@ void idle_task_exit(void)struct mm_struct *mm = current->active_mm;BUG_ON (cpu_online (smp_processor_id ())); +BUG_ON (current !=this_rq ()->idle);if (mm != &init_mm) {switch_mm (mm, &init_mm, current); - current->active_mm = &init_mm;finish_arch_post_lock_switch (); } -mmdrop (mm); + +/* finish_cpu(), as ran on the BP, will clean up the active_mm state */ }/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 137/376 stmmac: intel: Fix clock handling on error and remove paths
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 09f012e64e4b8126ed6f02d0a85a57c3a0465cf9 ]
clk_prepare_enable() might fail, we have to check its returned value. Besides that we have to call clk_disable_unprepare() on the error and remove paths. Do above in the dwmac-intel driver.
While at it, remove leftover in stmmac_pci and remove unneeded condition for NULL-aware clk_unregister_fixed_rate() call.
--- .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 20 +++++++++++++++---- .../net/ethernet/stmicro/stmmac/stmmac_pci.c | 5 ----- 2 files changed, 16 insertions(+), 9 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +16 -4
@@ -252,6 +252,7 @@ static void common_default_data(struct plat_stmmacenet_data *plat)static int intel_mgbe_common_data (struct pci_dev *pdev,struct plat_stmmacenet_data *plat) { +int ret;int i; plat->clk_csr =5 ;
@@ -324,7 +325,12 @@ static int intel_mgbe_common_data(struct pci_dev *pdev,dev_warn (&pdev->dev,"Fail to register stmmac-clk\n" ); plat->stmmac_clk =NULL ; } -clk_prepare_enable (plat->stmmac_clk); + + ret =clk_prepare_enable (plat->stmmac_clk); +if (ret) { +clk_unregister_fixed_rate (plat->stmmac_clk); +return ret; + }/* Set default value for multicast hash bins */ plat->multicast_filter_bins =HASH_TABLE_SIZE ;
@@ -657,7 +663,13 @@ static int intel_eth_pci_probe(struct pci_dev *pdev, res.wol_irq = pdev->irq; res.irq = pdev->irq; -return stmmac_dvr_probe (&pdev->dev, plat, &res); + ret =stmmac_dvr_probe (&pdev->dev, plat, &res); +if (ret) { +clk_disable_unprepare (plat->stmmac_clk); +clk_unregister_fixed_rate (plat->stmmac_clk); + } + +return ret; }/**
@@ -675,8 +687,8 @@ static void intel_eth_pci_remove(struct pci_dev *pdev)stmmac_dvr_remove (&pdev->dev); -if (priv->plat->stmmac_clk) -clk_unregister_fixed_rate (priv->plat->stmmac_clk); +clk_disable_unprepare (priv->plat->stmmac_clk); +clk_unregister_fixed_rate (priv->plat->stmmac_clk);for (i =0 ; i <PCI_STD_NUM_BARS ; i++) {if (pci_resource_len (pdev, i) ==0 )
drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +0 -5
@@ -217,15 +217,10 @@ static int stmmac_pci_probe(struct pci_dev *pdev,*/ static void stmmac_pci_remove (struct pci_dev *pdev) { -struct net_device *ndev =dev_get_drvdata (&pdev->dev); -struct stmmac_priv *priv =netdev_priv (ndev);int i;stmmac_dvr_remove (&pdev->dev); -if (priv->plat->stmmac_clk) -clk_unregister_fixed_rate (priv->plat->stmmac_clk); -for (i =0 ; i <PCI_STD_NUM_BARS ; i++) {if (pci_resource_len (pdev, i) ==0 )continue ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 138/376 arm64: kexec_file: print appropriate variable
In reply to Greg Kroah-HartmanFrom: Łukasz Stelmach <[email protected]>
[ Upstream commit 51075e0cb759a736e60ab4f3a5fed8670dba5852 ]
The value of kbuf->memsz may be different than kbuf->bufsz after calling kexec_add_buffer(). Hence both values should be logged.
--- arch/arm64/kernel/machine_kexec_file.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/kernel/machine_kexec_file.c +3 -3
@@ -284,7 +284,7 @@ int load_other_segments(struct kimage *image, image->arch.elf_headers_sz = headers_sz;pr_debug ("Loaded elf core header at 0x%lx bufsz=0x%lx memsz=0x%lx\n" , - image->arch.elf_headers_mem, headers_sz, headers_sz); + image->arch.elf_headers_mem, kbuf.bufsz, kbuf.memsz); }/* load initrd */
@@ -305,7 +305,7 @@ int load_other_segments(struct kimage *image, initrd_load_addr = kbuf.mem;pr_debug ("Loaded initrd at 0x%lx bufsz=0x%lx memsz=0x%lx\n" , - initrd_load_addr, initrd_len, initrd_len); + initrd_load_addr, kbuf.bufsz, kbuf.memsz); }/* load dtb */
@@ -332,7 +332,7 @@ int load_other_segments(struct kimage *image, image->arch.dtb_mem = kbuf.mem;pr_debug ("Loaded dtb at 0x%lx bufsz=0x%lx memsz=0x%lx\n" , - kbuf.mem, dtb_len, dtb_len); + kbuf.mem, kbuf.bufsz, kbuf.memsz);return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 139/376 drivers/perf: hisi: Fix typo in events attribute array
In reply to Greg Kroah-HartmanFrom: Shaokun Zhang <[email protected]>
[ Upstream commit 88562f06ebf56587788783e5420f25fde3ca36c8 ]
Fix up one typo: wr_dr_64b -> wr_ddr_64b.
--- drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/perf/hisilicon/hisi_uncore_hha_pmu.c +1 -1
@@ -283,7 +283,7 @@ static struct attribute *hisi_hha_pmu_events_attr[] = {HISI_PMU_EVENT_ATTR (rx_wbip,0x05 ),HISI_PMU_EVENT_ATTR (rx_wtistash,0x11 ),HISI_PMU_EVENT_ATTR (rd_ddr_64b,0x1c ), -HISI_PMU_EVENT_ATTR (wr_dr_64b,0x1d ), +HISI_PMU_EVENT_ATTR (wr_ddr_64b,0x1d ),HISI_PMU_EVENT_ATTR (rd_ddr_128b,0x1e ),HISI_PMU_EVENT_ATTR (wr_ddr_128b,0x1f ), HISI_PMU_EVENT_ATTR(spill_num, 0x20),
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 140/376 iocost_monitor: drop string wrap around numbers when outputting json
In reply to Greg Kroah-HartmanFrom: Tejun Heo <[email protected]>
[ Upstream commit 21f3cfeab304fc07b90d93d98d4d2f62110fe6b2 ]
Wrapping numbers in strings is used by some to work around bit-width issues in some enviroments. The problem isn't innate to json and the workaround seems to cause more integration problems than help. Let's drop the string wrapping.
--- tools/cgroup/iocost_monitor.py | 42 +++++++++++++++++----------------- 1 file changed, 21 insertions(+), 21 deletions(-)
tools/cgroup/iocost_monitor.py +21 -21
@@ -112,14 +112,14 @@ class IocStat: def dict(self, now): return { 'device' : devname, - 'timestamp' : str(now), - 'enabled' : str(int(self.enabled)), - 'running' : str(int(self.running)), - 'period_ms' : str(self.period_ms), - 'period_at' : str(self.period_at), - 'period_vtime_at' : str(self.vperiod_at), - 'busy_level' : str(self.busy_level), - 'vrate_pct' : str(self.vrate_pct), } + 'timestamp' : now, + 'enabled' : self.enabled, + 'running' : self.running, + 'period_ms' : self.period_ms, + 'period_at' : self.period_at, + 'period_vtime_at' : self.vperiod_at, + 'busy_level' : self.busy_level, + 'vrate_pct' : self.vrate_pct, } def table_preamble_str(self): state = ('RUN' if self.running else 'IDLE') if self.enabled else 'OFF'
@@ -179,19 +179,19 @@ class IocgStat: def dict(self, now, path): out = { 'cgroup' : path, - 'timestamp' : str(now), - 'is_active' : str(int(self.is_active)), - 'weight' : str(self.weight), - 'weight_active' : str(self.active), - 'weight_inuse' : str(self.inuse), - 'hweight_active_pct' : str(self.hwa_pct), - 'hweight_inuse_pct' : str(self.hwi_pct), - 'inflight_pct' : str(self.inflight_pct), - 'debt_ms' : str(self.debt_ms), - 'use_delay' : str(self.use_delay), - 'delay_ms' : str(self.delay_ms), - 'usage_pct' : str(self.usage), - 'address' : str(hex(self.address)) } + 'timestamp' : now, + 'is_active' : self.is_active, + 'weight' : self.weight, + 'weight_active' : self.active, + 'weight_inuse' : self.inuse, + 'hweight_active_pct' : self.hwa_pct, + 'hweight_inuse_pct' : self.hwi_pct, + 'inflight_pct' : self.inflight_pct, + 'debt_ms' : self.debt_ms, + 'use_delay' : self.use_delay, + 'delay_ms' : self.delay_ms, + 'usage_pct' : self.usage, + 'address' : self.address } for i in range(len(self.usages)): out[f'usage_pct_{i}'] = str(self.usages[i]) return out
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 141/376 octeontx2-pf: Fix error return code in otx2_probe()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 654cad8b6a17dcb00077070b27bc65873951a568 ]
Fix to return negative error code -ENOMEM from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +6 -2
@@ -1856,13 +1856,17 @@ static int otx2_probe(struct pci_dev *pdev, const struct pci_device_id *id) num_vec =pci_msix_vec_count (pdev); hw->irq_name =devm_kmalloc_array (&hw->pdev->dev, num_vec,NAME_SIZE ,GFP_KERNEL ); -if (!hw->irq_name) +if (!hw->irq_name) { + err = -ENOMEM ; goto err_free_netdev; + } hw->affinity_mask =devm_kcalloc (&hw->pdev->dev, num_vec,sizeof (cpumask_var_t),GFP_KERNEL ); -if (!hw->affinity_mask) +if (!hw->affinity_mask) { + err = -ENOMEM ; goto err_free_netdev; + }/* Map CSRs */ pf->reg_base =pcim_iomap (pdev,PCI_CFG_REG_BAR_NUM ,0 );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 142/376 ice: Fix error return code in ice_add_prof()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit f8d530ac29fe9248f5e58ca5bcf4c368f8393ccf ]
Fix to return a error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/net/ethernet/intel/ice/ice_flex_pipe.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_flex_pipe.c +3 -1
@@ -2962,8 +2962,10 @@ ice_add_prof(struct ice_hw *hw, enum ice_block blk, u64 id, u8 ptypes[],/* add profile info */ prof =devm_kzalloc (ice_hw_to_dev (hw),sizeof (*prof),GFP_KERNEL ); -if (!prof) +if (!prof) { + status =ICE_ERR_NO_MEMORY ; goto err_ice_add_prof; + } prof->profile_cookie = id; prof->prof_id = prof_id;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 143/376 net: lpc-enet: fix error return code in lpc_mii_init()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 88ec7cb22ddde725ed4ce15991f0bd9dd817fd85 ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/net/ethernet/nxp/lpc_eth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/nxp/lpc_eth.c +2 -1
@@ -823,7 +823,8 @@ static int lpc_mii_init(struct netdata_local *pldat)if (err) goto err_out_unregister_bus; -if (lpc_mii_probe (pldat->ndev) !=0 ) + err =lpc_mii_probe (pldat->ndev); +if (err) goto err_out_unregister_bus;return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 144/376 selinux: fix error return code in policydb_read()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 4c09f8b6913a779ca0c70ea8058bf21537eebb3b ]
Fix to return negative error code -ENOMEM from the kvcalloc() error handling case instead of 0, as done elsewhere in this function.
--- security/selinux/ss/policydb.c | 1 + 1 file changed, 1 insertion(+)
security/selinux/ss/policydb.c +1 -0
@@ -2504,6 +2504,7 @@ int policydb_read(struct policydb *p, void *fp)if (rc) goto bad; + rc = -ENOMEM ; p->type_attr_map_array =kvcalloc (p->p_types.nprim,sizeof (*p->type_attr_map_array),GFP_KERNEL );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 145/376 drivers: net: davinci_mdio: fix potential NULL dereference in davinci_mdio_probe()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit e00edb4efbbc07425441a3be2aa87abaf5800d96 ]
platform_get_resource() may fail and return NULL, so we should better check it's return value to avoid a NULL pointer dereference since devm_ioremap() does not check input parameters for null.
This is detected by Coccinelle semantic patch.
@@
expression pdev, res, n, t, e, e1, e2;
@@
res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t, n);
+ if (!res)
+ return -EINVAL;
... when != res == NULL
e = devm_ioremap(e1, res->start, e2);
--- drivers/net/ethernet/ti/davinci_mdio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/ti/davinci_mdio.c +2 -0
@@ -397,6 +397,8 @@ static int davinci_mdio_probe(struct platform_device *pdev) data->dev = dev; res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); +if (!res) +return -EINVAL ; data->regs =devm_ioremap (dev, res->start,resource_size (res));if (!data->regs)return -ENOMEM ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 146/376 cpufreq: qcom: fix wrong compatible binding
In reply to Greg Kroah-HartmanFrom: Ansuel Smith <[email protected]>
[ Upstream commit 2dea651680cea1f3a29925de51002f33d1f55711 ]
Binding in Documentation is still "operating-points-v2-kryo-cpu". Restore the old binding to fix the compatibility problem.
--- drivers/cpufreq/qcom-cpufreq-nvmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/qcom-cpufreq-nvmem.c +1 -1
@@ -277,7 +277,7 @@ static int qcom_cpufreq_probe(struct platform_device *pdev)if (!np)return -ENOENT ; - ret =of_device_is_compatible (np,"operating-points-v2-qcom-cpu" ); + ret =of_device_is_compatible (np,"operating-points-v2-kryo-cpu" );if (!ret) {of_node_put (np);return -ENOENT ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 147/376 ath10k: fix possible memory leak in ath10k_bmi_lz_data_large()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 2326aa011967f0afbcba7fe1a005d01f8b12900b ]
'cmd' is malloced in ath10k_bmi_lz_data_large() and should be freed before leaving from the error handling cases, otherwise it will cause memory leak.
--- drivers/net/wireless/ath/ath10k/bmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath10k/bmi.c +1 -0
@@ -380,6 +380,7 @@ static int ath10k_bmi_lz_data_large(struct ath10k *ar, const void *buffer, u32 l NULL, NULL);if (ret) {ath10k_warn (ar,"unable to write to the device\n" ); +kfree (cmd);return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 148/376 ath11k: fix error return code in ath11k_dp_alloc()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit f76f750aeea47fd98b6502eb6d37f84ca33662bf ]
Fix to return negative error code -ENOMEM from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/net/wireless/ath/ath11k/dp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/dp.c +3 -1
@@ -909,8 +909,10 @@ int ath11k_dp_alloc(struct ath11k_base *ab) dp->tx_ring[i].tx_status_head =0 ; dp->tx_ring[i].tx_status_tail =DP_TX_COMP_RING_SIZE -1 ; dp->tx_ring[i].tx_status =kmalloc (size,GFP_KERNEL ); -if (!dp->tx_ring[i].tx_status) +if (!dp->tx_ring[i].tx_status) { + ret = -ENOMEM ; goto fail_cmn_srng_cleanup; + } }for (i =0 ; i <HAL_DSCP_TID_MAP_TBL_NUM_ENTRIES_MAX ; i++)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 149/376 media: sun8i: Fix an error handling path in deinterlace_runtime_resume()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 62eedb356188376acd0368384a9b294d5180c00b ]
It is spurious to call 'clk_disable_unprepare()' when 'clk_prepare_enable()' has not been called yet. Re-order the error handling path to avoid it.
--- drivers/media/platform/sunxi/sun8i-di/sun8i-di.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/platform/sunxi/sun8i-di/sun8i-di.c +3 -3
@@ -941,7 +941,7 @@ static int deinterlace_runtime_resume(struct device *device)if (ret) {dev_err (dev->dev,"Failed to enable bus clock\n" ); - goto err_exlusive_rate; + goto err_exclusive_rate; } ret =clk_prepare_enable (dev->mod_clk);
@@ -969,14 +969,14 @@ static int deinterlace_runtime_resume(struct device *device)return 0 ; -err_exlusive_rate: -clk_rate_exclusive_put (dev->mod_clk); err_ram_clk:clk_disable_unprepare (dev->ram_clk); err_mod_clk:clk_disable_unprepare (dev->mod_clk); err_bus_clk:clk_disable_unprepare (dev->bus_clk); +err_exclusive_rate: +clk_rate_exclusive_put (dev->mod_clk);return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 150/376 media: cec: silence shift wrapping warning in __cec_s_log_addrs()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 3b5af3171e2d5a73ae6f04965ed653d039904eb6 ]
The log_addrs->log_addr_type[i] value is a u8 which is controlled by the user and comes from the ioctl. If it's over 31 then that results in undefined behavior (shift wrapping) and that leads to a Smatch static checker warning. We already cap the value later so we can silence the warning just by re-ordering the existing checks.
I think the UBSan checker will also catch this bug at runtime and generate a warning. But otherwise the bug is harmless.
--- drivers/media/cec/cec-adap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/cec/cec-adap.c +4 -4
@@ -1734,6 +1734,10 @@ int __cec_s_log_addrs(struct cec_adapter *adap,unsigned j; log_addrs->log_addr[i] =CEC_LOG_ADDR_INVALID ; +if (log_addrs->log_addr_type[i] >CEC_LOG_ADDR_TYPE_UNREGISTERED ) { +dprintk (1 ,"unknown logical address type\n" ); +return -EINVAL ; + }if (type_mask & (1 << log_addrs->log_addr_type[i])) {dprintk (1 ,"duplicate logical address type\n" );return -EINVAL ;
@@ -1754,10 +1758,6 @@ int __cec_s_log_addrs(struct cec_adapter *adap,dprintk (1 ,"invalid primary device type\n" );return -EINVAL ; } -if (log_addrs->log_addr_type[i] >CEC_LOG_ADDR_TYPE_UNREGISTERED ) { -dprintk (1 ,"unknown logical address type\n" ); -return -EINVAL ; - }for (j =0 ; j < feature_sz; j++) {if ((features[j] &0x80 ) ==0 ) {if (op_is_dev_features)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 151/376 net: allwinner: Fix use correct return type for ndo_start_xmit()
In reply to Greg Kroah-HartmanFrom: Yunjian Wang <[email protected]>
[ Upstream commit 09f6c44aaae0f1bdb8b983d7762676d5018c53bc ]
The method ndo_start_xmit() returns a value of type netdev_tx_t. Fix the ndo function to use the correct type. And emac_start_xmit() can leak one skb if 'channel' == 3.
--- drivers/net/ethernet/allwinner/sun4i-emac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/allwinner/sun4i-emac.c +2 -2
@@ -417,7 +417,7 @@ static void emac_timeout(struct net_device *dev, unsigned int txqueue)/* Hardware start transmission. * Send a packet to media from the upper layer. */ -static int emac_start_xmit (struct sk_buff *skb,struct net_device *dev) +static netdev_tx_t emac_start_xmit (struct sk_buff *skb,struct net_device *dev) {struct emac_board_info *db =netdev_priv (dev);unsigned long channel;
@@ -425,7 +425,7 @@ static int emac_start_xmit(struct sk_buff *skb, struct net_device *dev) channel = db->tx_fifo_stat &3 ;if (channel ==3 ) -return 1 ; +return NETDEV_TX_BUSY ; channel = (channel ==1 ?1 :0 );
Signature · 1 line
2.25.1