5.11.21-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 431/601 RDMA/core: Fix corrupted SL on passive side
In reply to Greg Kroah-HartmanFrom: Håkon Bugge <[email protected]>
[ Upstream commit 194f64a3cad3ab9e381e996a13089de3215d1887 ]
On RoCE systems, a CM REQ contains a Primary Hop Limit > 1 and Primary Subnet Local is zero.
In cm_req_handler(), the cm_process_routed_req() function is called. Since the Primary Subnet Local value is zero in the request, and since this is RoCE (Primary Local LID is permissive), the following statement will be executed:
IBA_SET(CM_REQ_PRIMARY_SL, req_msg, wc->sl);
This corrupts SL in req_msg if it was different from zero. In other words, a request to setup a connection using an SL != zero, will not be honored, and a connection using SL zero will be created instead.
Fixed by not calling cm_process_routed_req() on RoCE systems, the cm_process_route_req() is only for IB anyhow.
--- drivers/infiniband/core/cm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/core/cm.c +2 -1
@@ -2138,7 +2138,8 @@ static int cm_req_handler(struct cm_work *work) goto destroy; } -cm_process_routed_req (req_msg, work->mad_recv_wc->wc); +if (cm_id_priv->av.ah_attr.type !=RDMA_AH_ATTR_TYPE_ROCE ) +cm_process_routed_req (req_msg, work->mad_recv_wc->wc);memset (&work->path[0 ],0 ,sizeof (work->path[0 ]));if (cm_req_has_alt_path (req_msg))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 432/601 nfc: pn533: prevent potential memory corruption
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit ca4d4c34ae9aa5c3c0da76662c5e549d2fc0cc86 ]
If the "type_a->nfcid_len" is too large then it would lead to memory corruption in pn533_target_found_type_a() when we do:
memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
--- drivers/nfc/pn533/pn533.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/nfc/pn533/pn533.c +3 -0
@@ -706,6 +706,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,if (PN533_TYPE_A_SEL_CASCADE (type_a->sel_res) !=0 )return false; +if (type_a->nfcid_len >NFC_NFCID1_MAXSIZE ) +return false; +return true; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 433/601 net: hns3: Limiting the scope of vector_ring_chain variable
In reply to Greg Kroah-HartmanFrom: Salil Mehta <[email protected]>
[ Upstream commit d392ecd1bc29ae15b0e284d5f732c2d36f244271 ]
Limiting the scope of the variable vector_ring_chain to the block where it is used.
--- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +2 -1
@@ -3709,7 +3709,6 @@ static void hns3_nic_set_cpumask(struct hns3_nic_priv *priv)static int hns3_nic_init_vector_data (struct hns3_nic_priv *priv) { -struct hnae3_ring_chain_node vector_ring_chain;struct hnae3_handle *h = priv->ae_handle;struct hns3_enet_tqp_vector *tqp_vector;int ret;
@@ -3741,6 +3740,8 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv) }for (i =0 ; i < priv->vector_num; i++) { +struct hnae3_ring_chain_node vector_ring_chain; + tqp_vector = &priv->tqp_vector[i]; tqp_vector->rx_group.total_bytes =0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 434/601 mips: bmips: fix syscon-reboot nodes
In reply to Greg Kroah-HartmanFrom: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit cde58b861a1d365568588adda59d42351c0c4ad3 ]
Commit a23c4134955e added the clock controller nodes, incorrectly changing the syscon-reboot nodes addresses.
--- arch/mips/boot/dts/brcm/bcm3368.dtsi | 2 +- arch/mips/boot/dts/brcm/bcm63268.dtsi | 2 +- arch/mips/boot/dts/brcm/bcm6358.dtsi | 2 +- arch/mips/boot/dts/brcm/bcm6362.dtsi | 2 +- arch/mips/boot/dts/brcm/bcm6368.dtsi | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-)
arch/mips/boot/dts/brcm/bcm3368.dtsi +1 -1
@@ -59,7 +59,7 @@ periph_cntl: syscon@fff8c008 { compatible = "syscon"; - reg = <0xfff8c000 0x4>; + reg = <0xfff8c008 0x4>; native-endian; };
arch/mips/boot/dts/brcm/bcm63268.dtsi +1 -1
@@ -59,7 +59,7 @@ periph_cntl: syscon@10000008 { compatible = "syscon"; - reg = <0x10000000 0xc>; + reg = <0x10000008 0x4>; native-endian; };
arch/mips/boot/dts/brcm/bcm6358.dtsi +1 -1
@@ -59,7 +59,7 @@ periph_cntl: syscon@fffe0008 { compatible = "syscon"; - reg = <0xfffe0000 0x4>; + reg = <0xfffe0008 0x4>; native-endian; };
arch/mips/boot/dts/brcm/bcm6362.dtsi +1 -1
@@ -59,7 +59,7 @@ periph_cntl: syscon@10000008 { compatible = "syscon"; - reg = <0x10000000 0xc>; + reg = <0x10000008 0x4>; native-endian; };
arch/mips/boot/dts/brcm/bcm6368.dtsi +1 -1
@@ -59,7 +59,7 @@ periph_cntl: syscon@100000008 { compatible = "syscon"; - reg = <0x10000000 0xc>; + reg = <0x10000008 0x4>; native-endian; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 435/601 KVM: arm64: Fix error return code in init_hyp_mode()
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 52b9e265d22bccc5843e167da76ab119874e2883 ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- arch/arm64/kvm/arm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/arm64/kvm/arm.c +3 -1
@@ -1809,8 +1809,10 @@ static int init_hyp_mode(void)if (is_protected_kvm_enabled ()) {init_cpu_logical_map (); -if (!init_psci_relay ()) +if (!init_psci_relay ()) { + err = -ENODEV ; goto out_err; + } }return 0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 436/601 iommu/vt-d: Dont set then clear private data in prq_event_thread()
In reply to Greg Kroah-HartmanFrom: Lu Baolu <[email protected]>
[ Upstream commit 1d421058c815d54113d9afdf6db3f995c788cf0d ]
The VT-d specification (section 7.6) requires that the value in the Private Data field of a Page Group Response Descriptor must match the value in the Private Data field of the respective Page Request Descriptor.
The private data field of a page group response descriptor is set then immediately cleared in prq_event_thread(). This breaks the rule defined by the VT-d specification. Fix it by moving clearing code up.
--- drivers/iommu/intel/svm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iommu/intel/svm.c +2 -2
@@ -1071,12 +1071,12 @@ no_pasid:QI_PGRP_RESP_TYPE ; resp.qw1 =QI_PGRP_IDX (req->prg_index) |QI_PGRP_LPIG (req->lpig); + resp.qw2 =0 ; + resp.qw3 =0 ;if (req->priv_data_present)memcpy (&resp.qw2, req->priv_data,sizeof (req->priv_data)); - resp.qw2 =0 ; - resp.qw3 =0 ;qi_submit_sync (iommu, &resp,1 ,0 ); } prq_advance:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 437/601 iommu: Fix a boundary issue to avoid performance drop
In reply to Greg Kroah-HartmanFrom: Xiang Chen <[email protected]>
[ Upstream commit 3431c3f660a39f6ced954548a59dba6541ce3eb1 ]
After the change of patch ("iommu: Switch gather->end to the inclusive end"), the performace drops from 1600+K IOPS to 1200K in our kunpeng ARM64 platform.
We find that the range [start1, end1) actually is joint from the range [end1, end2), but it is considered as disjoint after the change, so it needs more times of TLB sync, and spends more time on it. So fix the boundary issue to avoid performance drop.
--- include/linux/iommu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/iommu.h +1 -1
@@ -546,7 +546,7 @@ static inline void iommu_iotlb_gather_add_page(struct iommu_domain *domain,* structure can be rewritten. */ if (gather->pgsize != size || - end < gather->start || start > gather->end) { + end +1 < gather->start || start > gather->end +1 ) {if (gather->pgsize)iommu_iotlb_sync (domain, gather); gather->pgsize = size;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 438/601 iommu/vt-d: Report right snoop capability when using FL for IOVA
In reply to Greg Kroah-HartmanFrom: Lu Baolu <[email protected]>
[ Upstream commit 6c00612d0cba10f7d0917cf1f73c945003ed4cd7 ]
The Intel VT-d driver checks wrong register to report snoop capablility when using first level page table for GPA to HPA translation. This might lead the IOMMU driver to say that it supports snooping control, but in reality, it does not. Fix this by always setting PASID-table-entry.PGSNP whenever a pasid entry is setting up for GPA to HPA translation so that the IOMMU driver could report snoop capability as long as it runs in the scalable mode.
--- drivers/iommu/intel/iommu.c | 12 +++++++++++- drivers/iommu/intel/pasid.c | 16 ++++++++++++++++ drivers/iommu/intel/pasid.h | 1 + 3 files changed, 28 insertions(+), 1 deletion(-)
drivers/iommu/intel/iommu.c +11 -1
@@ -647,7 +647,14 @@ static int domain_update_iommu_snooping(struct intel_iommu *skip)rcu_read_lock ();for_each_active_iommu (iommu, drhd) {if (iommu != skip) { -if (!ecap_sc_support (iommu->ecap)) { +/* +* If the hardware is operating in the scalable mode, +* the snooping control is always supported since we +* always set PASID-table-entry.PGSNP bit if the domain +* is managed outside (UNMANAGED). +*/ +if (!sm_supported (iommu) && + !ecap_sc_support (iommu->ecap)) { ret =0 ;break ; }
@@ -2546,6 +2553,9 @@ static int domain_setup_first_level(struct intel_iommu *iommu, flags |= (level ==5 ) ?PASID_FLAG_FL5LP :0 ; +if (domain->domain.type ==IOMMU_DOMAIN_UNMANAGED ) + flags |=PASID_FLAG_PAGE_SNOOP ; +return intel_pasid_setup_first_level (iommu, dev, (pgd_t *)pgd, pasid, domain->iommu_did[iommu->seq_id], flags);
drivers/iommu/intel/pasid.c +16 -0
@@ -411,6 +411,16 @@ static inline void pasid_set_page_snoop(struct pasid_entry *pe, bool value)pasid_set_bits (&pe->val[1 ],1 <<23 , value <<23 ); } +/* +* Setup the Page Snoop (PGSNP) field (Bit 88) of a scalable mode +* PASID entry. +*/ +static inline void +pasid_set_pgsnp (struct pasid_entry *pe) +{ +pasid_set_bits (&pe->val[1 ],1ULL <<24 ,1ULL <<24 ); +} +/* * Setup the First Level Page table Pointer field (Bit 140~191) * of a scalable mode PASID entry.
@@ -579,6 +589,9 @@ int intel_pasid_setup_first_level(struct intel_iommu *iommu, } } +if (flags &PASID_FLAG_PAGE_SNOOP ) +pasid_set_pgsnp (pte); +pasid_set_domain_id (pte, did);pasid_set_address_width (pte, iommu->agaw);pasid_set_page_snoop (pte, !!ecap_smpwc (iommu->ecap));
@@ -657,6 +670,9 @@ int intel_pasid_setup_second_level(struct intel_iommu *iommu,pasid_set_fault_enable (pte);pasid_set_page_snoop (pte, !!ecap_smpwc (iommu->ecap)); +if (domain->domain.type ==IOMMU_DOMAIN_UNMANAGED ) +pasid_set_pgsnp (pte); +/* * Since it is a second level only translation setup, we should * set SRE bit as well (addresses are expected to be GPAs).
drivers/iommu/intel/pasid.h +1 -0
@@ -48,6 +48,7 @@*/ #define PASID_FLAG_SUPERVISOR_MODE BIT(0)#define PASID_FLAG_NESTED BIT(1) +#define PASID_FLAG_PAGE_SNOOP BIT(2)/* * The PASID_FLAG_FL5LP flag Indicates using 5-level paging for first-
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 439/601 iommu/vt-d: Report the right page fault address
In reply to Greg Kroah-HartmanFrom: Lu Baolu <[email protected]>
[ Upstream commit 03d205094af45bca4f8e0498c461a893aa3ec6d9 ]
The Address field of the Page Request Descriptor only keeps bit [63:12] of the offending address. Convert it to a full address before reporting it to device drivers.
--- drivers/iommu/intel/svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/intel/svm.c +1 -1
@@ -899,7 +899,7 @@ intel_svm_prq_report(struct device *dev, struct page_req_dsc *desc)/* Fill in event data for device specific processing */ memset (&event,0 ,sizeof (struct iommu_fault_event )); event.fault.type =IOMMU_FAULT_PAGE_REQ ; - event.fault.prm.addr = desc->addr; + event.fault.prm.addr = (u64 )desc->addr <<VTD_PAGE_SHIFT ; event.fault.prm.pasid = desc->pasid; event.fault.prm.grpid = desc->prg_index; event.fault.prm.perm =prq_to_iommu_prot (desc);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 440/601 iommu/vt-d: Preset Access/Dirty bits for IOVA over FL
In reply to Greg Kroah-HartmanFrom: Lu Baolu <[email protected]>
[ Upstream commit a8ce9ebbecdfda3322bbcece6b3b25888217f8e3 ]
The Access/Dirty bits in the first level page table entry will be set whenever a page table entry was used for address translation or write permission was successfully translated. This is always true when using the first-level page table for kernel IOVA. Instead of wasting hardware cycles to update the certain bits, it's better to set them up at the beginning.
--- drivers/iommu/intel/iommu.c | 14 ++++++++++++-- include/linux/intel-iommu.h | 2 ++ 2 files changed, 14 insertions(+), 2 deletions(-)
drivers/iommu/intel/iommu.c +12 -2
@@ -1023,8 +1023,11 @@ static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain,domain_flush_cache (domain, tmp_page,VTD_PAGE_SIZE ); pteval = ((uint64_t )virt_to_dma_pfn (tmp_page) <<VTD_PAGE_SHIFT ) |DMA_PTE_READ |DMA_PTE_WRITE ; -if (domain_use_first_level (domain)) +if (domain_use_first_level (domain)) { pteval |=DMA_FL_PTE_XD |DMA_FL_PTE_US ; +if (domain->domain.type ==IOMMU_DOMAIN_DMA ) + pteval |=DMA_FL_PTE_ACCESS ; + }if (cmpxchg64 (&pte->val,0ULL , pteval))/* Someone else set it while we were thinking; use theirs. */ free_pgtable_page (tmp_page);
@@ -2351,9 +2354,16 @@ __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,return -EINVAL ; attr = prot & (DMA_PTE_READ |DMA_PTE_WRITE |DMA_PTE_SNP ); -if (domain_use_first_level (domain)) +if (domain_use_first_level (domain)) { attr |=DMA_FL_PTE_PRESENT |DMA_FL_PTE_XD |DMA_FL_PTE_US ; +if (domain->domain.type ==IOMMU_DOMAIN_DMA ) { + attr |=DMA_FL_PTE_ACCESS ; +if (prot &DMA_PTE_WRITE ) + attr |=DMA_FL_PTE_DIRTY ; + } + } + pteval = ((phys_addr_t )phys_pfn <<VTD_PAGE_SHIFT ) | attr;while (nr_pages >0 ) {
include/linux/intel-iommu.h +2 -0
@@ -42,6 +42,8 @@#define DMA_FL_PTE_PRESENT BIT_ULL(0)#define DMA_FL_PTE_US BIT_ULL(2) +#define DMA_FL_PTE_ACCESS BIT_ULL(5) +#define DMA_FL_PTE_DIRTY BIT_ULL(6)#define DMA_FL_PTE_XD BIT_ULL(63)#define ADDR_WIDTH_5LEVEL (57)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 441/601 iommu/vt-d: Remove WO permissions on second-level paging entries
In reply to Greg Kroah-HartmanFrom: Lu Baolu <[email protected]>
[ Upstream commit eea53c5816889ee8b64544fa2e9311a81184ff9c ]
When the first level page table is used for IOVA translation, it only supports Read-Only and Read-Write permissions. The Write-Only permission is not supported as the PRESENT bit (implying Read permission) should always set. When using second level, we still give separate permissions that allows WriteOnly which seems inconsistent and awkward. We want to have consistent behavior. After moving to 1st level, we don't want things to work sometimes, and break if we use 2nd level for the same mappings. Hence remove this configuration.
--- drivers/iommu/intel/iommu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/iommu/intel/iommu.c +2 -1
@@ -2354,8 +2354,9 @@ __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,return -EINVAL ; attr = prot & (DMA_PTE_READ |DMA_PTE_WRITE |DMA_PTE_SNP ); + attr |=DMA_FL_PTE_PRESENT ;if (domain_use_first_level (domain)) { - attr |=DMA_FL_PTE_PRESENT |DMA_FL_PTE_XD |DMA_FL_PTE_US ; + attr |=DMA_FL_PTE_XD |DMA_FL_PTE_US ;if (domain->domain.type ==IOMMU_DOMAIN_DMA ) { attr |=DMA_FL_PTE_ACCESS ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 442/601 iommu/vt-d: Invalidate PASID cache when root/context entry changed
In reply to Greg Kroah-HartmanFrom: Lu Baolu <[email protected]>
[ Upstream commit c0474a606ecb9326227b4d68059942f9db88a897 ]
When the Intel IOMMU is operating in the scalable mode, some information from the root and context table may be used to tag entries in the PASID cache. Software should invalidate the PASID-cache when changing root or context table entries.
--- drivers/iommu/intel/iommu.c | 18 +++++++++--------- include/linux/intel-iommu.h | 1 + 2 files changed, 10 insertions(+), 9 deletions(-)
drivers/iommu/intel/iommu.c +9 -9
@@ -1336,6 +1336,11 @@ static void iommu_set_root_entry(struct intel_iommu *iommu) readl, (sts & DMA_GSTS_RTPS), sts);raw_spin_unlock_irqrestore (&iommu->register_lock, flag); + + iommu->flush.flush_context (iommu,0 ,0 ,0 ,DMA_CCMD_GLOBAL_INVL ); +if (sm_supported (iommu)) +qi_flush_pasid_cache (iommu,0 ,QI_PC_GLOBAL ,0 ); + iommu->flush.flush_iotlb (iommu,0 ,0 ,0 ,DMA_TLB_GLOBAL_FLUSH ); }void iommu_flush_write_buffer (struct intel_iommu *iommu)
@@ -2481,6 +2486,10 @@ static void domain_context_clear_one(struct intel_iommu *iommu, u8 bus, u8 devfn (((u16 )bus) <<8 ) | devfn,DMA_CCMD_MASK_NOBIT , DMA_CCMD_DEVICE_INVL); + +if (sm_supported (iommu)) +qi_flush_pasid_cache (iommu, did_old,QI_PC_ALL_PASIDS ,0 ); + iommu->flush.flush_iotlb(iommu, did_old, 0,
@@ -3325,8 +3334,6 @@ static int __init init_dmars(void)register_pasid_allocator (iommu);#endif iommu_set_root_entry (iommu); - iommu->flush.flush_context (iommu,0 ,0 ,0 ,DMA_CCMD_GLOBAL_INVL ); - iommu->flush.flush_iotlb (iommu,0 ,0 ,0 ,DMA_TLB_GLOBAL_FLUSH ); }#ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
@@ -3516,12 +3523,7 @@ static int init_iommu_hw(void) }iommu_flush_write_buffer (iommu); -iommu_set_root_entry (iommu); - - iommu->flush.flush_context (iommu,0 ,0 ,0 , -DMA_CCMD_GLOBAL_INVL ); - iommu->flush.flush_iotlb (iommu,0 ,0 ,0 ,DMA_TLB_GLOBAL_FLUSH );iommu_enable_translation (iommu);iommu_disable_protect_mem_regions (iommu); }
@@ -3849,8 +3851,6 @@ static int intel_iommu_add(struct dmar_drhd_unit *dmaru) goto disable_iommu;iommu_set_root_entry (iommu); - iommu->flush.flush_context (iommu,0 ,0 ,0 ,DMA_CCMD_GLOBAL_INVL ); - iommu->flush.flush_iotlb (iommu,0 ,0 ,0 ,DMA_TLB_GLOBAL_FLUSH );iommu_enable_translation (iommu);iommu_disable_protect_mem_regions (iommu);
include/linux/intel-iommu.h +1 -0
@@ -369,6 +369,7 @@ enum {/* PASID cache invalidation granu */ #define QI_PC_ALL_PASIDS 0#define QI_PC_PASID_SEL 1 +#define QI_PC_GLOBAL 3#define QI_EIOTLB_ADDR (addr) ((u64)(addr) & VTD_PAGE_MASK)#define QI_EIOTLB_IH (ih) (((u64)ih) << 6)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 443/601 ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 5fb45414ae03421255593fd5556aa2d1d82303aa ]
There are a few calls of usb_driver_claim_interface() but all of those miss the proper error checks, as reported by Coverity. This patch adds those missing checks.
Along with it, replace the magic pointer with -1 with a constant USB_AUDIO_IFACE_UNUSED for better readability.
Addresses-Coverity-ID: 1475943 ("Error handling issues")
Addresses-Coverity-ID: 1475944 ("Error handling issues")
Addresses-Coverity-ID: 1475945 ("Error handling issues")
--- sound/usb/card.c | 14 +++++++------- sound/usb/quirks.c | 16 ++++++++++++---- sound/usb/usbaudio.h | 2 ++ 3 files changed, 21 insertions(+), 11 deletions(-)
sound/usb/card.c +7 -7
@@ -183,9 +183,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int ctrlif, interface);return -EINVAL ; } -usb_driver_claim_interface (&usb_audio_driver, iface, (void *)-1L ); - -return 0 ; +return usb_driver_claim_interface (&usb_audio_driver, iface, +USB_AUDIO_IFACE_UNUSED ); } if ((altsd->bInterfaceClass != USB_CLASS_AUDIO &&
@@ -205,7 +204,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int intif (!snd_usb_parse_audio_interface (chip, interface)) {usb_set_interface (dev, interface,0 );/* reset the current interface */ -usb_driver_claim_interface (&usb_audio_driver, iface, (void *)-1L ); +return usb_driver_claim_interface (&usb_audio_driver, iface, +USB_AUDIO_IFACE_UNUSED ); }return 0 ;
@@ -865,7 +865,7 @@ static void usb_audio_disconnect(struct usb_interface *intf)struct snd_card *card;struct list_head *p; -if (chip == (void *)-1L ) +if (chip ==USB_AUDIO_IFACE_UNUSED )return ; card = chip->card;
@@ -995,7 +995,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message)struct usb_mixer_interface *mixer;struct list_head *p; -if (chip == (void *)-1L ) +if (chip ==USB_AUDIO_IFACE_UNUSED )return 0 ;if (!chip->num_suspended_intf++) {
@@ -1025,7 +1025,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)struct list_head *p;int err =0 ; -if (chip == (void *)-1L ) +if (chip ==USB_AUDIO_IFACE_UNUSED )return 0 ;atomic_inc (&chip->active);/* avoid autopm */
sound/usb/quirks.c +12 -4
@@ -55,8 +55,12 @@ static int create_composite_quirk(struct snd_usb_audio *chip,if (!iface)continue ;if (quirk->ifnum != probed_ifnum && - !usb_interface_claimed (iface)) -usb_driver_claim_interface (driver, iface, (void *)-1L ); + !usb_interface_claimed (iface)) { + err =usb_driver_claim_interface (driver, iface, +USB_AUDIO_IFACE_UNUSED ); +if (err <0 ) +return err; + } }return 0 ;
@@ -426,8 +430,12 @@ static int create_autodetect_quirks(struct snd_usb_audio *chip,continue ; err =create_autodetect_quirk (chip, iface, driver); -if (err >=0 ) -usb_driver_claim_interface (driver, iface, (void *)-1L ); +if (err >=0 ) { + err =usb_driver_claim_interface (driver, iface, +USB_AUDIO_IFACE_UNUSED ); +if (err <0 ) +return err; + } }return 0 ;
sound/usb/usbaudio.h +2 -0
@@ -61,6 +61,8 @@ struct snd_usb_audio {struct media_intf_devnode *ctl_intf_media_devnode; }; +#define USB_AUDIO_IFACE_UNUSED ((void *)-1L) + #define usb_audio_err(chip, fmt, args...) \ dev_err(&(chip)->dev->dev, fmt, ##args) #define usb_audio_warn(chip, fmt, args...) \
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 444/601 HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit bbf62645255f120bc2e7488c237e3f04da42ec70 ]
The lenovo_led_brightness_set function may sleep, so we should have the the led_class_dev's brightness_set_blocking callback point to it, rather then the regular brightness_set callback.
When toggled through sysfs this is not a problem, but the brightness_set callback may be called from atomic context when using LED-triggers.
--- drivers/hid/hid-lenovo.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/hid/hid-lenovo.c +5 -3
@@ -777,7 +777,7 @@ static enum led_brightness lenovo_led_brightness_get( : LED_OFF; } -static void lenovo_led_brightness_set (struct led_classdev *led_cdev, +static int lenovo_led_brightness_set (struct led_classdev *led_cdev,enum led_brightness value) {struct device *dev = led_cdev->dev->parent;
@@ -802,6 +802,8 @@ static void lenovo_led_brightness_set(struct led_classdev *led_cdev,lenovo_led_set_tp10ubkbd (hdev, tp10ubkbd_led[led_nr], value);break ; } + +return 0 ; }static int lenovo_register_leds (struct hid_device *hdev)
@@ -822,7 +824,7 @@ static int lenovo_register_leds(struct hid_device *hdev) data->led_mute.name = name_mute; data->led_mute.brightness_get = lenovo_led_brightness_get; - data->led_mute.brightness_set = lenovo_led_brightness_set; + data->led_mute.brightness_set_blocking = lenovo_led_brightness_set; data->led_mute.dev = &hdev->dev; ret =led_classdev_register (&hdev->dev, &data->led_mute);if (ret <0 )
@@ -830,7 +832,7 @@ static int lenovo_register_leds(struct hid_device *hdev) data->led_micmute.name = name_micm; data->led_micmute.brightness_get = lenovo_led_brightness_get; - data->led_micmute.brightness_set = lenovo_led_brightness_set; + data->led_micmute.brightness_set_blocking = lenovo_led_brightness_set; data->led_micmute.dev = &hdev->dev; ret =led_classdev_register (&hdev->dev, &data->led_micmute);if (ret <0 ) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 445/601 HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 658d04e6eb6be1601ae95d7bee92bbf4096cdc1e ]
Fix the following issues with lenovo_led_set_tp10ubkbd() error handling:
1. On success hid_hw_raw_request() returns the number of bytes sent. So we should check for (ret != 3) rather then for (ret != 0).
2. Actually propagate errors to the caller.
3. Since the LEDs are part of an USB keyboard-dock the mute LEDs can go away at any time. Don't log an error when ret == -ENODEV and set the LED_HW_PLUGGABLE flag to avoid errors getting logged when the USB gets disconnected.
--- drivers/hid/hid-lenovo.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
drivers/hid/hid-lenovo.c +21 -8
@@ -62,8 +62,8 @@ struct lenovo_drvdata {#define TP10UBKBD_LED_OFF 1#define TP10UBKBD_LED_ON 2 -static void lenovo_led_set_tp10ubkbd (struct hid_device *hdev,u8 led_code, -enum led_brightness value) +static int lenovo_led_set_tp10ubkbd (struct hid_device *hdev,u8 led_code, +enum led_brightness value) {struct lenovo_drvdata *data =hid_get_drvdata (hdev);int ret;
@@ -75,10 +75,18 @@ static void lenovo_led_set_tp10ubkbd(struct hid_device *hdev, u8 led_code, data->led_report[2 ] = value ?TP10UBKBD_LED_ON :TP10UBKBD_LED_OFF ; ret =hid_hw_raw_request (hdev, data->led_report[0 ], data->led_report,3 ,HID_OUTPUT_REPORT ,HID_REQ_SET_REPORT ); -if (ret) -hid_err (hdev,"Set LED output report error: %d\n" , ret); +if (ret !=3 ) { +if (ret != -ENODEV ) +hid_err (hdev,"Set LED output report error: %d\n" , ret); + + ret = ret <0 ? ret : -EIO ; + }else { + ret =0 ; + }mutex_unlock (&data->led_report_mutex); + +return ret; }static void lenovo_tp10ubkbd_sync_fn_lock (struct work_struct *work)
@@ -349,7 +357,7 @@ static ssize_t attr_fn_lock_store(struct device *dev, {struct hid_device *hdev =to_hid_device (dev);struct lenovo_drvdata *data =hid_get_drvdata (hdev); -int value; +int value, ret;if (kstrtoint (buf,10 , &value))return -EINVAL ;
@@ -364,7 +372,9 @@ static ssize_t attr_fn_lock_store(struct device *dev,lenovo_features_set_cptkbd (hdev);break ;case USB_DEVICE_ID_LENOVO_TP10UBKBD : -lenovo_led_set_tp10ubkbd (hdev,TP10UBKBD_FN_LOCK_LED , value); + ret =lenovo_led_set_tp10ubkbd (hdev,TP10UBKBD_FN_LOCK_LED , value); +if (ret) +return ret;break ; }
@@ -785,6 +795,7 @@ static int lenovo_led_brightness_set(struct led_classdev *led_cdev,struct lenovo_drvdata *data_pointer =hid_get_drvdata (hdev);u8 tp10ubkbd_led[] = {TP10UBKBD_MUTE_LED ,TP10UBKBD_MICMUTE_LED };int led_nr =0 ; +int ret =0 ;if (led_cdev == &data_pointer->led_micmute) led_nr =1 ;
@@ -799,11 +810,11 @@ static int lenovo_led_brightness_set(struct led_classdev *led_cdev,lenovo_led_set_tpkbd (hdev);break ;case USB_DEVICE_ID_LENOVO_TP10UBKBD : -lenovo_led_set_tp10ubkbd (hdev, tp10ubkbd_led[led_nr], value); + ret =lenovo_led_set_tp10ubkbd (hdev, tp10ubkbd_led[led_nr], value);break ; } -return 0 ; +return ret; }static int lenovo_register_leds (struct hid_device *hdev)
@@ -825,6 +836,7 @@ static int lenovo_register_leds(struct hid_device *hdev) data->led_mute.name = name_mute; data->led_mute.brightness_get = lenovo_led_brightness_get; data->led_mute.brightness_set_blocking = lenovo_led_brightness_set; + data->led_mute.flags =LED_HW_PLUGGABLE ; data->led_mute.dev = &hdev->dev; ret =led_classdev_register (&hdev->dev, &data->led_mute);if (ret <0 )
@@ -833,6 +845,7 @@ static int lenovo_register_leds(struct hid_device *hdev) data->led_micmute.name = name_micm; data->led_micmute.brightness_get = lenovo_led_brightness_get; data->led_micmute.brightness_set_blocking = lenovo_led_brightness_set; + data->led_micmute.flags =LED_HW_PLUGGABLE ; data->led_micmute.dev = &hdev->dev; ret =led_classdev_register (&hdev->dev, &data->led_micmute);if (ret <0 ) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 446/601 HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event()
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 34348a8661e3cd67dcf6938f08c8bb77522301f7 ]
The HID lenovo probe function only attaches drvdata to one of the USB interfaces, but lenovo_event() will get called for all USB interfaces to which hid-lenovo is bound.
This allows a malicious device to fake being a device handled by hid-lenovo, which generates events for which lenovo_event() has special handling (and thus dereferences hid_get_drvdata()) on another interface triggering a NULL pointer exception.
Add a check for hid_get_drvdata() returning NULL, avoiding this possible NULL pointer exception.
--- drivers/hid/hid-lenovo.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/hid-lenovo.c +3 -0
@@ -508,6 +508,9 @@ static int lenovo_event_cptkbd(struct hid_device *hdev,static int lenovo_event (struct hid_device *hdev,struct hid_field *field,struct hid_usage *usage,__s32 value) { +if (!hid_get_drvdata (hdev)) +return 0 ; +switch (hdev->product) {case USB_DEVICE_ID_LENOVO_CUSBKBD :case USB_DEVICE_ID_LENOVO_CBTKBD :
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 447/601 HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 617103246cfd19af837e4cb614ba9f877c4f7779 ]
Mapping the mic-mute button to KEY_MICMUTE is technically correct but KEY_MICMUTE translates to a scancode of 256 (248 + 8) under X, which does not fit in 8 bits, so it does not work.
Because of this userspace is expecting KEY_F20 instead, theoretically KEY_MICMUTE should work under Wayland but even there it does not work, because the desktop-environment is listening only for KEY_F20 and not for KEY_MICMUTE.
--- drivers/hid/hid-lenovo.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/hid/hid-lenovo.c +6 -3
@@ -33,6 +33,9 @@#include "hid-ids.h" +/* Userspace expects F20 for mic-mute KEY_MICMUTE does not work */ +#define LENOVO_KEY_MICMUTE KEY_F20 +struct lenovo_drvdata {u8 led_report[3 ];/* Must be first for proper alignment */ int led_state;
@@ -134,7 +137,7 @@ static int lenovo_input_mapping_tpkbd(struct hid_device *hdev,if (usage->hid == (HID_UP_BUTTON |0x0010 )) {/* This sub-device contains trackpoint, mark it */ hid_set_drvdata (hdev, (void *)1 ); -map_key_clear (KEY_MICMUTE ); +map_key_clear (LENOVO_KEY_MICMUTE );return 1 ; }return 0 ;
@@ -149,7 +152,7 @@ static int lenovo_input_mapping_cptkbd(struct hid_device *hdev, (usage->hid & HID_USAGE_PAGE) == HID_UP_LNVENDOR) {switch (usage->hid &HID_USAGE ) {case 0x00f1 :/* Fn-F4: Mic mute */ -map_key_clear (KEY_MICMUTE ); +map_key_clear (LENOVO_KEY_MICMUTE );return 1 ;case 0x00f2 :/* Fn-F5: Brightness down */ map_key_clear (KEY_BRIGHTNESSDOWN );
@@ -239,7 +242,7 @@ static int lenovo_input_mapping_tp10_ultrabook_kbd(struct hid_device *hdev,map_key_clear (KEY_FN_ESC );return 1 ;case 9 :/* Fn-F4: Mic mute */ -map_key_clear (KEY_MICMUTE ); +map_key_clear (LENOVO_KEY_MICMUTE );return 1 ;case 10 :/* Fn-F7: Control panel */ map_key_clear (KEY_CONFIG );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 448/601 KVM: arm64: Initialize VCPU mdcr_el2 before loading it
In reply to Greg Kroah-HartmanFrom: Alexandru Elisei <[email protected]>
[ Upstream commit 263d6287da1433aba11c5b4046388f2cdf49675c ]
When a VCPU is created, the kvm_vcpu struct is initialized to zero in kvm_vm_ioctl_create_vcpu(). On VHE systems, the first time vcpu.arch.mdcr_el2 is loaded on hardware is in vcpu_load(), before it is set to a sensible value in kvm_arm_setup_debug() later in the run loop. The result is that KVM executes for a short time with MDCR_EL2 set to zero.
This has several unintended consequences:
* Setting MDCR_EL2.HPMN to 0 is constrained unpredictable according to ARM DDI 0487G.a, page D13-3820. The behavior specified by the architecture in this case is for the PE to behave as if MDCR_EL2.HPMN is set to a value less than or equal to PMCR_EL0.N, which means that an unknown number of counters are now disabled by MDCR_EL2.HPME, which is zero.
* The host configuration for the other debug features controlled by MDCR_EL2 is temporarily lost. This has been harmless so far, as Linux doesn't use the other fields, but that might change in the future.
Let's avoid both issues by initializing the VCPU's mdcr_el2 field in kvm_vcpu_vcpu_first_run_init(), thus making sure that the MDCR_EL2 register has a consistent value after each vcpu_load().
--- arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 2 + arch/arm64/kvm/debug.c | 88 +++++++++++++++++++++---------- 3 files changed, 63 insertions(+), 28 deletions(-)
arch/arm64/include/asm/kvm_host.h +1 -0
@@ -714,6 +714,7 @@ static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}static inline void kvm_arch_vcpu_block_finish (struct kvm_vcpu *vcpu) {}void kvm_arm_init_debug (void ); +void kvm_arm_vcpu_init_debug (struct kvm_vcpu *vcpu);void kvm_arm_setup_debug (struct kvm_vcpu *vcpu);void kvm_arm_clear_debug (struct kvm_vcpu *vcpu);void kvm_arm_reset_debug_ptr (struct kvm_vcpu *vcpu);
arch/arm64/kvm/arm.c +2 -0
@@ -580,6 +580,8 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu) vcpu->arch.has_run_once = true; +kvm_arm_vcpu_init_debug (vcpu); +if (likely (irqchip_in_kernel (kvm))) {/* * Map the VGIC hardware resources before running a vcpu the
arch/arm64/kvm/debug.c +60 -28
131 lines not on this page · raw message
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 449/601 ASoC: simple-card: fix possible uninitialized single_cpu local variable
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit fa74c223b6fd78a5314b4c61b9abdbed3c2185b4 ]
The 'single_cpu' local variable is assigned by asoc_simple_parse_dai() and later used in a asoc_simple_canonicalize_cpu() call, assuming the entire function did not exit on errors.
However the first function returns 0 if passed device_node is NULL, thus leaving the variable uninitialized and reporting success.
Addresses-Coverity: Uninitialized scalar variable
--- sound/soc/generic/audio-graph-card.c | 2 +- sound/soc/generic/simple-card.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
sound/soc/generic/audio-graph-card.c +1 -1
@@ -380,7 +380,7 @@ static int graph_dai_link_of(struct asoc_simple_priv *priv,struct device_node *top = dev->of_node;struct asoc_simple_dai *cpu_dai;struct asoc_simple_dai *codec_dai; -int ret, single_cpu; +int ret, single_cpu =0 ;/* Do it only CPU turn */ if (!li->cpu)
sound/soc/generic/simple-card.c +1 -1
@@ -258,7 +258,7 @@ static int simple_dai_link_of(struct asoc_simple_priv *priv,struct device_node *plat =NULL ;char prop[128 ];char *prefix ="" ; -int ret, single_cpu; +int ret, single_cpu =0 ;/* * |CPU |Codec : turn
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 450/601 liquidio: Fix unintented sign extension of a left shift of a u16
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 298b58f00c0f86868ea717426beb5c1198772f81 ]
The macro CN23XX_PEM_BAR1_INDEX_REG is being used to shift oct->pcie_port (a u16) left 24 places. There are two subtle issues here, first the shift gets promoted to an signed int and then sign extended to a u64. If oct->pcie_port is 0x80 or more then the upper bits get sign extended to 1. Secondly shfiting a u16 24 bits will lead to an overflow so it needs to be cast to a u64 for all the bits to not overflow.
It is entirely possible that the u16 port value is never large enough for this to fail, but it is useful to fix unintended overflows such as this.
Fix this by casting the port parameter to the macro to a u64 before the shift.
Addresses-Coverity: ("Unintended sign extension")
--- drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h +1 -1
@@ -521,7 +521,7 @@#define CN23XX_BAR1_INDEX_OFFSET 3#define CN23XX_PEM_BAR1_INDEX_REG (port, idx) \ - (CN23XX_PEM_BAR1_INDEX_START + ((port) << CN23XX_PEM_OFFSET) + \ + (CN23XX_PEM_BAR1_INDEX_START + (((u64)port) << CN23XX_PEM_OFFSET) + \ ((idx) << CN23XX_BAR1_INDEX_OFFSET))/*############################ DPI #########################*/
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 451/601 IB/hfi1: Use kzalloc() for mmu_rb_handler allocation
In reply to Greg Kroah-HartmanFrom: Mike Marciniszyn <[email protected]>
[ Upstream commit ca5f72568e034e1295a7ae350b1f786fcbfb2848 ]
The code currently assumes that the mmu_notifier struct embedded in mmu_rb_handler only contains two fields.
There are now extra fields:
struct mmu_notifier {
struct hlist_node hlist;
const struct mmu_notifier_ops *ops;
struct mm_struct *mm;
struct rcu_head rcu;
unsigned int users;
};Given that there in no init for the mmu_notifier, a kzalloc() should be used to insure that any newly added fields are given a predictable initial value of zero.
--- drivers/infiniband/hw/hfi1/mmu_rb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hfi1/mmu_rb.c +1 -1
@@ -89,7 +89,7 @@ int hfi1_mmu_rb_register(void *ops_arg,struct mmu_rb_handler *h;int ret; - h =kmalloc (sizeof (*h),GFP_KERNEL ); + h =kzalloc (sizeof (*h),GFP_KERNEL );if (!h)return -ENOMEM ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 452/601 powerpc/64s: Fix pte update for kernel memory on radix
In reply to Greg Kroah-HartmanFrom: Jordan Niethe <[email protected]>
[ Upstream commit b8b2f37cf632434456182e9002d63cbc4cccc50c ]
When adding a PTE a ptesync is needed to order the update of the PTE with subsequent accesses otherwise a spurious fault may be raised.
radix__set_pte_at() does not do this for performance gains. For non-kernel memory this is not an issue as any faults of this kind are corrected by the page fault handler. For kernel memory these faults are not handled. The current solution is that there is a ptesync in flush_cache_vmap() which should be called when mapping from the vmalloc region.
However, map_kernel_page() does not call flush_cache_vmap(). This is troublesome in particular for code patching with Strict RWX on radix. In do_patch_instruction() the page frame that contains the instruction to be patched is mapped and then immediately patched. With no ordering or synchronization between setting up the PTE and writing to the page it is possible for faults.
As the code patching is done using __put_user_asm_goto() the resulting fault is obscured - but using a normal store instead it can be seen:
BUG: Unable to handle kernel data access on write at 0xc008000008f24a3c Faulting instruction address: 0xc00000000008bd74 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: nop_module(PO+) [last unloaded: nop_module] CPU: 4 PID: 757 Comm: sh Tainted: P O 5.10.0-rc5-01361-ge3c1b78c8440-dirty #43 NIP: c00000000008bd74 LR: c00000000008bd50 CTR: c000000000025810 REGS: c000000016f634a0 TRAP: 0300 Tainted: P O (5.10.0-rc5-01361-ge3c1b78c8440-dirty) MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 44002884 XER: 00000000 CFAR: c00000000007c68c DAR: c008000008f24a3c DSISR: 42000000 IRQMASK: 1
This results in the kind of issue reported here:
https://lore.kernel.org/linuxppc-dev/[email protected]/
Chris Riedl suggested a reliable way to reproduce the issue:
$ mount -t debugfs none /sys/kernel/debug $ (while true; do echo function > /sys/kernel/debug/tracing/current_tracer ; echo nop > /sys/kernel/debug/tracing/current_tracer ; done) &
Turning ftrace on and off does a large amount of code patching which in usually less then 5min will crash giving a trace like:
ftrace-powerpc: (____ptrval____): replaced (4b473b11) != old (60000000) ------------[ ftrace bug ]------------
ftrace failed to modify
[<c000000000bf8e5c>] napi_busy_loop+0xc/0x390
actual: 11:3b:47:4b
Setting ftrace call site to call ftrace function
ftrace record flags: 80000001
(1)
expected tramp: c00000000006c96c
------------[ cut here ]------------
WARNING: CPU: 4 PID: 809 at kernel/trace/ftrace.c:2065 ftrace_bug+0x28c/0x2e8
Modules linked in: nop_module(PO-) [last unloaded: nop_module]
CPU: 4 PID: 809 Comm: sh Tainted: P O 5.10.0-rc5-01360-gf878ccaf250a #1
NIP: c00000000024f334 LR: c00000000024f330 CTR: c0000000001a5af0
REGS: c000000004c8b760 TRAP: 0700 Tainted: P O (5.10.0-rc5-01360-gf878ccaf250a)
MSR: 900000000282b033 <SF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 28008848 XER: 20040000
CFAR: c0000000001a9c98 IRQMASK: 0
GPR00: c00000000024f330 c000000004c8b9f0 c000000002770600 0000000000000022
GPR04: 00000000ffff7fff c000000004c8b6d0 0000000000000027 c0000007fe9bcdd8
GPR08: 0000000000000023 ffffffffffffffd8 0000000000000027 c000000002613118
GPR12: 0000000000008000 c0000007fffdca00 0000000000000000 0000000000000000
GPR16: 0000000023ec37c5 0000000000000000 0000000000000000 0000000000000008
GPR20: c000000004c8bc90 c0000000027a2d20 c000000004c8bcd0 c000000002612fe8
GPR24: 0000000000000038 0000000000000030 0000000000000028 0000000000000020
GPR28: c000000000ff1b68 c000000000bf8e5c c00000000312f700 c000000000fbb9b0
NIP ftrace_bug+0x28c/0x2e8
LR ftrace_bug+0x288/0x2e8
Call Trace:
ftrace_bug+0x288/0x2e8 (unreliable)
ftrace_modify_all_code+0x168/0x210
arch_ftrace_update_code+0x18/0x30
ftrace_run_update_code+0x44/0xc0
ftrace_startup+0xf8/0x1c0
register_ftrace_function+0x4c/0xc0
function_trace_init+0x80/0xb0
tracing_set_tracer+0x2a4/0x4f0
tracing_set_trace_write+0xd4/0x130
vfs_write+0xf0/0x330
ksys_write+0x84/0x140
system_call_exception+0x14c/0x230
system_call_common+0xf0/0x27cTo fix this when updating kernel memory PTEs using ptesync.
--- arch/powerpc/include/asm/book3s/64/radix.h | 6 ++++-- arch/powerpc/mm/book3s64/radix_pgtable.c | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-)
arch/powerpc/include/asm/book3s/64/radix.h +4 -2
@@ -222,8 +222,10 @@ static inline void radix__set_pte_at(struct mm_struct *mm, unsigned long addr,* from ptesync, it should probably go into update_mmu_cache, rather * than set_pte_at (which is used to set ptes unrelated to faults). * -* Spurious faults to vmalloc region are not tolerated, so there is -* a ptesync in flush_cache_vmap. +* Spurious faults from the kernel memory are not tolerated, so there +* is a ptesync in flush_cache_vmap, and __map_kernel_page() follows +* the pte update sequence from ISA Book III 6.10 Translation Table +* Update Synchronization Requirements. */ }
arch/powerpc/mm/book3s64/radix_pgtable.c +2 -2
@@ -108,7 +108,7 @@ static int early_map_kernel_page(unsigned long ea, unsigned long pa, set_the_pte:set_pte_at (&init_mm, ea, ptep,pfn_pte (pfn, flags)); -smp_wmb (); + asmvolatile ("ptesync" : : :"memory" );return 0 ; }
@@ -168,7 +168,7 @@ static int __map_kernel_page(unsigned long ea, unsigned long pa, set_the_pte:set_pte_at (&init_mm, ea, ptep,pfn_pte (pfn, flags)); -smp_wmb (); + asmvolatile ("ptesync" : : :"memory" );return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 453/601 powerpc/pseries: Add key to flags in pSeries_lpar_hpte_updateboltedpp()
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit b56d55a5aa4aa9fc166595a7feb57f153ef7b555 ]
The flags argument to plpar_pte_protect() (aka. H_PROTECT), includes the key in bits 9-13, but currently we always set those bits to zero.
In the past that hasn't been a problem because we always used key 0 for the kernel, and updateboltedpp() is only used for kernel mappings.
However since commit d94b827e89dc ("powerpc/book3s64/kuap: Use Key 3 for kernel mapping with hash translation") we are now inadvertently changing the key (to zero) when we call plpar_pte_protect().
That hasn't broken anything because updateboltedpp() is only used for STRICT_KERNEL_RWX, which is currently disabled on 64s due to other bugs.
But we want to fix that, so first we need to pass the key correctly to plpar_pte_protect(). We can't pass our newpp value directly in, we have to convert it into the form expected by the hcall.
The hcall we're using here is H_PROTECT, which is specified in section 14.5.4.1.6 of LoPAPR v1.1.
It takes a flags parameter, and the description for flags says:
* flags: AVPN, pp0, pp1, pp2, key0-key4, n, and for the CMO
option: CMO Option flags as defined in Table 189‚
If you then go to the start of the parent section, 14.5.4.1, on page 405, it says:
Register Linkage (For hcall() tokens 0x04 - 0x18)
* On Call
* R3 function call token
* R4 flags (see Table 178‚ “Page Frame Table Access flags field definition‚” on page 401)
Then you have to go to section 14.5.3, and on page 394 there is a list of hcalls and their tokens (table 176), and there you can see that H_PROTECT == 0x18.
Finally you can look at table 178, on page 401, where it specifies the layout of the bits for the key:
Bit Function
-----------------
50-54 | key0-key4
Those are big-endian bit numbers, converting to normal bit numbers you get bits 9-13, or 0x3e00.
In the kernel we have:
#define HPTE_R_KEY_HI ASM_CONST(0x3000000000000000) #define HPTE_R_KEY_LO ASM_CONST(0x0000000000000e00)
So the LO bits of newpp are already in the right place, and the HI bits need to be shifted down by 48.
--- arch/powerpc/platforms/pseries/lpar.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/platforms/pseries/lpar.c +3 -1
@@ -977,11 +977,13 @@ static void pSeries_lpar_hpte_updateboltedpp(unsigned long newpp, slot =pSeries_lpar_hpte_find (vpn, psize, ssize);BUG_ON (slot ==-1 ); - flags = newpp &7 ; + flags = newpp & (HPTE_R_PP |HPTE_R_N );if (mmu_has_feature (MMU_FTR_KERNEL_RO ))/* Move pp0 into bit 8 (IBM 55) */ flags |= (newpp &HPTE_R_PP0 ) >>55 ; + flags |= ((newpp &HPTE_R_KEY_HI ) >>48 ) | (newpp &HPTE_R_KEY_LO ); + lpar_rc =plpar_pte_protect (flags, slot,0 );BUG_ON (lpar_rc !=H_SUCCESS );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 454/601 powerpc/64s: Use htab_convert_pte_flags() in hash__mark_rodata_ro()
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit 2c02e656a29d5f64193eb93da92781bcf0517146 ]
In hash__mark_rodata_ro() we pass the raw PP_RXXX value to hash__change_memory_range(). That has the effect of setting the key to zero, because PP_RXXX contains no key value.
Fix it by using htab_convert_pte_flags(), which knows how to convert a pgprot into a pp value, including the key.
--- arch/powerpc/mm/book3s64/hash_pgtable.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/powerpc/mm/book3s64/hash_pgtable.c +4 -2
@@ -428,12 +428,14 @@ static bool hash__change_memory_range(unsigned long start, unsigned long end,void hash__mark_rodata_ro (void ) { -unsigned long start, end; +unsigned long start, end, pp; start = (unsigned long )_stext; end = (unsigned long )__init_begin; -WARN_ON (!hash__change_memory_range (start, end,PP_RXXX )); + pp =htab_convert_pte_flags (pgprot_val (PAGE_KERNEL_ROX ),HPTE_USE_KERNEL_KEY ); + +WARN_ON (!hash__change_memory_range (start, end, pp)); }void hash__mark_initmem_nx (void )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 455/601 powerpc/perf: Fix PMU constraint check for EBB events
In reply to Greg Kroah-HartmanFrom: Athira Rajeev <[email protected]>
[ Upstream commit 10f8f96179ecc7f69c927f6d231f6d02736cea83 ]
The power PMU group constraints includes check for EBB events to make sure all events in a group must agree on EBB. This will prevent scheduling EBB and non-EBB events together. But in the existing check, settings for constraint mask and value is interchanged. Patch fixes the same.
Before the patch, PMU selftest "cpu_event_pinned_vs_ebb_test" fails with below in dmesg logs. This happens because EBB event gets enabled along with a non-EBB cpu event.
[35600.453346] cpu_event_pinne[41326]: illegal instruction (4) at 10004a18 nip 10004a18 lr 100049f8 code 1 in cpu_event_pinned_vs_ebb_test[10000000+10000]
Test results after the patch:
$ ./pmu/ebb/cpu_event_pinned_vs_ebb_test test: cpu_event_pinned_vs_ebb tags: git_version:v5.12-rc5-93-gf28c3125acd3-dirty Binding to cpu 8 EBB Handler is at 0x100050c8 read error on event 0x7fffe6bd4040! PM_RUN_INST_CMPL: result 9872 running/enabled 37930432 success: cpu_event_pinned_vs_ebb
This bug was hidden by other logic until commit 1908dc911792 (perf:
Tweak perf_event_attr::exclusive semantics).
--- arch/powerpc/perf/isa207-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/perf/isa207-common.c +2 -2
@@ -400,8 +400,8 @@ ebb_bhrb:* EBB events are pinned & exclusive, so this should never actually * hit, but we leave it as a fallback in case. */ - mask |=CNST_EBB_VAL (ebb); - value |=CNST_EBB_MASK ; + mask |=CNST_EBB_MASK ; + value |=CNST_EBB_VAL (ebb); *maskp = mask; *valp = value;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 456/601 powerpc: iommu: fix build when neither PCI or IBMVIO is set
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit b27dadecdf9102838331b9a0b41ffc1cfe288154 ]
When neither CONFIG_PCI nor CONFIG_IBMVIO is set/enabled, iommu.c has a build error. The fault injection code is not useful in that kernel config, so make the FAIL_IOMMU option depend on PCI || IBMVIO.
Prevents this build error (warning escalated to error):../arch/powerpc/kernel/iommu.c:178:30: error: 'fail_iommu_bus_notifier' defined but not used [-Werror=unused-variable]
178 | static struct notifier_block fail_iommu_bus_notifier = {
--- arch/powerpc/Kconfig.debug | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/Kconfig.debug +1 -0
@@ -352,6 +352,7 @@ config PPC_EARLY_DEBUG_CPM_ADDR config FAIL_IOMMU bool "Fault-injection capability for IOMMU" depends on FAULT_INJECTION + depends on PCI || IBMVIO help Provide fault-injection capability for IOMMU. Each device can be selectively enabled via the fail_iommu property.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 457/601 mac80211: bail out if cipher schemes are invalid
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit db878e27a98106a70315d264cc92230d84009e72 ]
If any of the cipher schemes specified by the driver are invalid, bail out and fail the registration rather than just warning. Otherwise, we might later crash when we try to use the invalid cipher scheme, e.g. if the hdr_len is (significantly) less than the pn_offs + pn_len, we'd have an out-of-bounds access in RX validation.
--- net/mac80211/main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/mac80211/main.c +5 -2
@@ -1138,8 +1138,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)if (local->hw.wiphy->max_scan_ie_len) local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len; -WARN_ON (!ieee80211_cs_list_valid (local->hw.cipher_schemes, - local->hw.n_cipher_schemes)); +if (WARN_ON (!ieee80211_cs_list_valid (local->hw.cipher_schemes, + local->hw.n_cipher_schemes))) { + result = -EINVAL ; + goto fail_workqueue; + } result =ieee80211_init_cipher_suites (local);if (result <0 )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 458/601 perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric
In reply to Greg Kroah-HartmanFrom: Smita Koralahalli <[email protected]>
[ Upstream commit 86c2bc3da769124e3e856b6e9457be3667c30919 ]
Commit 08ed77e414ab2342 ("perf vendor events amd: Add recommended events") added the hits event "L2 Cache Hits from L2 HWPF" with the same metric expression as the accesses event "L2 Cache Accesses from L2 HWPF":
$ perf list --details
...
l2_cache_accesses_from_l2_hwpf
[L2 Cache Accesses from L2 HWPF]
[l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3]
l2_cache_hits_from_l2_hwpf
[L2 Cache Hits from L2 HWPF]
[l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3]
...This was wrong and led to counting hits the same as accesses. Section 2.1.15.2 "Performance Measurement" of "PPR for AMD Family 17h Model 31h B0 - 55803 Rev 0.54 - Sep 12, 2019", documents the hits event with EventCode 0x70 which is the same as l2_pf_hit_l2.
Fix this, and massage the description for l2_pf_hit_l2 as the hits event is now the duplicate of l2_pf_hit_l2. AMD recommends using the recommended event over other events if the duplicate exists and maintain both for consistency. Hence, l2_cache_hits_from_l2_hwpf should override l2_pf_hit_l2.
Before:
# perf stat -M l2_cache_accesses_from_l2_hwpf,l2_cache_hits_from_l2_hwpf sleep 1
Performance counter stats for 'sleep 1':
1,436 l2_pf_miss_l2_l3 # 11114.00 l2_cache_accesses_from_l2_hwpf
# 11114.00 l2_cache_hits_from_l2_hwpf
4,482 l2_pf_hit_l2
5,196 l2_pf_miss_l2_hit_l3
1.001765339 seconds time elapsedAfter:
# perf stat -M l2_cache_accesses_from_l2_hwpf sleep 1
Performance counter stats for 'sleep 1':
1,477 l2_pf_miss_l2_l3 # 10442.00 l2_cache_accesses_from_l2_hwpf
3,978 l2_pf_hit_l2
4,987 l2_pf_miss_l2_hit_l31.001491186 seconds time elapsed
# perf stat -e l2_cache_hits_from_l2_hwpf sleep 1
Performance counter stats for 'sleep 1':
3,983 l2_cache_hits_from_l2_hwpf
1.001329970 seconds time elapsedNote the difference in performance counter values for the accesses versus the hits after the fix, and the hits event now counting the same as l2_pf_hit_l2.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206537
--- tools/perf/pmu-events/arch/x86/amdzen1/cache.json | 2 +- tools/perf/pmu-events/arch/x86/amdzen1/recommended.json | 6 +++--- tools/perf/pmu-events/arch/x86/amdzen2/cache.json | 2 +- tools/perf/pmu-events/arch/x86/amdzen2/recommended.json | 6 +++--- 4 files changed, 8 insertions(+), 8 deletions(-)
tools/perf/pmu-events/arch/x86/amdzen1/cache.json +1 -1
@@ -275,7 +275,7 @@ { "EventName": "l2_pf_hit_l2", "EventCode": "0x70", - "BriefDescription": "L2 prefetch hit in L2.", + "BriefDescription": "L2 prefetch hit in L2. Use l2_cache_hits_from_l2_hwpf instead.", "UMask": "0xff" }, {
tools/perf/pmu-events/arch/x86/amdzen1/recommended.json +3 -3
@@ -79,10 +79,10 @@ "UMask": "0x70" }, { - "MetricName": "l2_cache_hits_from_l2_hwpf", + "EventName": "l2_cache_hits_from_l2_hwpf", + "EventCode": "0x70", "BriefDescription": "L2 Cache Hits from L2 HWPF", - "MetricExpr": "l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3", - "MetricGroup": "l2_cache" + "UMask": "0xff" }, { "EventName": "l3_accesses",
tools/perf/pmu-events/arch/x86/amdzen2/cache.json +1 -1
@@ -205,7 +205,7 @@ { "EventName": "l2_pf_hit_l2", "EventCode": "0x70", - "BriefDescription": "L2 prefetch hit in L2.", + "BriefDescription": "L2 prefetch hit in L2. Use l2_cache_hits_from_l2_hwpf instead.", "UMask": "0xff" }, {
tools/perf/pmu-events/arch/x86/amdzen2/recommended.json +3 -3
@@ -79,10 +79,10 @@ "UMask": "0x70" }, { - "MetricName": "l2_cache_hits_from_l2_hwpf", + "EventName": "l2_cache_hits_from_l2_hwpf", + "EventCode": "0x70", "BriefDescription": "L2 Cache Hits from L2 HWPF", - "MetricExpr": "l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3", - "MetricGroup": "l2_cache" + "UMask": "0xff" }, { "EventName": "l3_accesses",
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 459/601 RDMA/hns: Fix missing assignment of max_inline_data
In reply to Greg Kroah-HartmanFrom: Weihang Li <[email protected]>
[ Upstream commit 9eab614338cdfe08db343954454fa5191d082a11 ]
When querying QP, the ULPs should be informed of the max length of inline data supported by the hardware.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +1 -0
@@ -5090,6 +5090,7 @@ done: qp_attr->cur_qp_state = qp_attr->qp_state; qp_attr->cap.max_recv_wr = hr_qp->rq.wqe_cnt; qp_attr->cap.max_recv_sge = hr_qp->rq.max_gs - hr_qp->rq.rsv_sge; + qp_attr->cap.max_inline_data = hr_qp->max_inline_data;if (!ibqp->uobject) { qp_attr->cap.max_send_wr = hr_qp->sq.wqe_cnt;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 460/601 xfs: fix return of uninitialized value in variable error
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 3b6dd9a9aeeada19d0c820ff68e979243a888bb6 ]
A previous commit removed a call to xfs_attr3_leaf_read that assigned an error return code to variable error. We now have a few early error return paths to label 'out' that return error if error is set; however error now is uninitialized so potentially garbage is being returned. Fix this by setting error to zero to restore the original behaviour where error was zero at the label 'restart'.
Addresses-Coverity: ("Uninitialized scalar variable")
--- fs/xfs/libxfs/xfs_attr.c | 1 + 1 file changed, 1 insertion(+)
fs/xfs/libxfs/xfs_attr.c +1 -0
@@ -928,6 +928,7 @@ restart:* Search to see if name already exists, and get back a pointer * to where it should go. */ + error =0 ; retval =xfs_attr_node_hasname (args, &state);if (retval != -ENOATTR && retval != -EEXIST ) goto out;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 461/601 rtw88: Fix an error code in rtw_debugfs_set_rsvd_page()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit c9eaee0c2ec6b1002044fb698cdfb5d9ef4ed28c ]
The sscanf() function returns the number of matches (0 or 1 in this case). It doesn't return error codes. We should return -EINVAL if the string is invalid
--- drivers/net/wireless/realtek/rtw88/debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw88/debug.c +1 -1
@@ -270,7 +270,7 @@ static ssize_t rtw_debugfs_set_rsvd_page(struct file *filp,if (num !=2 ) {rtw_warn (rtwdev,"invalid arguments\n" ); -return num; +return -EINVAL ; } debugfs_priv->rsvd_page.page_offset = offset;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 462/601 mt7601u: fix always true expression
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 87fce88658ba047ae62e83497d3f3c5dc22fa6f9 ]
Currently the expression ~nic_conf1 is always true because nic_conf1 is a u16 and according to 6.5.3.3 of the C standard the ~ operator promotes the u16 to an integer before flipping all the bits. Thus the top 16 bits of the integer result are all set so the expression is always true. If the intention was to flip all the bits of nic_conf1 then casting the integer result back to a u16 is a suitabel fix.
Interestingly static analyzers seem to thing a bitwise ! should be used instead of ~ for this scenario, so I think the original intent of the expression may need some extra consideration.
Addresses-Coverity: ("Logical vs. bitwise operator")
--- drivers/net/wireless/mediatek/mt7601u/eeprom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt7601u/eeprom.c +1 -1
@@ -99,7 +99,7 @@ mt7601u_has_tssi(struct mt7601u_dev *dev, u8 *eeprom) {u16 nic_conf1 =get_unaligned_le16 (eeprom +MT_EE_NIC_CONF_1 ); -return ~nic_conf1 && (nic_conf1 &MT_EE_NIC_CONF_1_TX_ALC_EN ); +return (u16 )~nic_conf1 && (nic_conf1 &MT_EE_NIC_CONF_1_TX_ALC_EN ); } static void
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 463/601 mt76: mt7615: fix tx skb dma unmap
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit ebee7885bb12a8fe2c2f9bac87dbd87a05b645f9 ]
The first pointer in the txp needs to be unmapped as well, otherwise it will leak DMA mapping entries
--- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7615/mac.c +1 -1
@@ -688,7 +688,7 @@ mt7615_txp_skb_unmap_fw(struct mt76_dev *dev, struct mt7615_fw_txp *txp) {int i; -for (i =1 ; i < txp->nbuf; i++) +for (i =0 ; i < txp->nbuf; i++)dma_unmap_single (dev->dev,le32_to_cpu (txp->buf[i]),le16_to_cpu (txp->len[i]),DMA_TO_DEVICE ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 464/601 mt76: mt7915: fix tx skb dma unmap
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 7dcf3c04f0aca746517a77433b33d40868ca4749 ]
The first pointer in the txp needs to be unmapped as well, otherwise it will leak DMA mapping entries
--- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7915/mac.c +1 -1
@@ -1082,7 +1082,7 @@ void mt7915_txp_skb_unmap(struct mt76_dev *dev,int i; txp =mt7915_txwi_to_txp (dev, t); -for (i =1 ; i < txp->nbuf; i++) +for (i =0 ; i < txp->nbuf; i++)dma_unmap_single (dev->dev,le32_to_cpu (txp->buf[i]),le16_to_cpu (txp->len[i]),DMA_TO_DEVICE ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 465/601 mt76: mt7915: fix aggr len debugfs node
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 9fb9d755fae20b5ad62ef8b4e9289e5baea2c6fc ]
Similar to mt7921, fix 802.11 aggr len debugfs reporting for mt7915 driver.
--- drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +1 -1
@@ -98,7 +98,7 @@ mt7915_ampdu_stat_read_phy(struct mt7915_phy *phy, range[i] =mt76_rr (dev,MT_MIB_ARNG (ext_phy, i));for (i =0 ; i <ARRAY_SIZE (bound); i++) - bound[i] =MT_MIB_ARNCR_RANGE (range[i /4 ], i) +1 ; + bound[i] =MT_MIB_ARNCR_RANGE (range[i /4 ], i %4 ) +1 ;seq_printf (file,"\nPhy %d\n" , ext_phy);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 466/601 mt76: mt7615: fix mib stats counter reporting to mac80211
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 2eb6f6c437745bce46bd7a8f3a22a732d5b9becb ]
In order to properly report MIB counters to mac80211, resets stats in mt7615_get_stats routine and hold mt76 mutex accessing MIB counters. Sum up MIB counters in mt7615_mac_update_mib_stats routine.
--- .../net/wireless/mediatek/mt76/mt7615/mac.c | 26 ++++++------------- .../net/wireless/mediatek/mt76/mt7615/main.c | 6 +++++ .../wireless/mediatek/mt76/mt7615/mt7615.h | 10 +++---- 3 files changed, 19 insertions(+), 23 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7615/mac.c +8 -18
@@ -1819,10 +1819,8 @@ mt7615_mac_update_mib_stats(struct mt7615_phy *phy)int i, aggr;u32 val, val2; -memset (mib,0 ,sizeof (*mib)); - - mib->fcs_err_cnt =mt76_get_field (dev,MT_MIB_SDR3 (ext_phy), -MT_MIB_SDR3_FCS_ERR_MASK ); + mib->fcs_err_cnt +=mt76_get_field (dev,MT_MIB_SDR3 (ext_phy), +MT_MIB_SDR3_FCS_ERR_MASK ); val =mt76_get_field (dev,MT_MIB_SDR14 (ext_phy),MT_MIB_AMPDU_MPDU_COUNT );
@@ -1835,24 +1833,16 @@ mt7615_mac_update_mib_stats(struct mt7615_phy *phy) aggr = ext_phy ?ARRAY_SIZE (dev->mt76.aggr_stats) /2 :0 ;for (i =0 ; i <4 ; i++) { val =mt76_rr (dev,MT_MIB_MB_SDR1 (ext_phy, i)); - - val2 =FIELD_GET (MT_MIB_ACK_FAIL_COUNT_MASK , val); -if (val2 > mib->ack_fail_cnt) - mib->ack_fail_cnt = val2; - - val2 =FIELD_GET (MT_MIB_BA_MISS_COUNT_MASK , val); -if (val2 > mib->ba_miss_cnt) - mib->ba_miss_cnt = val2; + mib->ba_miss_cnt +=FIELD_GET (MT_MIB_BA_MISS_COUNT_MASK , val); + mib->ack_fail_cnt +=FIELD_GET (MT_MIB_ACK_FAIL_COUNT_MASK , + val); val =mt76_rr (dev,MT_MIB_MB_SDR0 (ext_phy, i)); - val2 =FIELD_GET (MT_MIB_RTS_RETRIES_COUNT_MASK , val); -if (val2 > mib->rts_retries_cnt) { - mib->rts_cnt =FIELD_GET (MT_MIB_RTS_COUNT_MASK , val); - mib->rts_retries_cnt = val2; - } + mib->rts_cnt +=FIELD_GET (MT_MIB_RTS_COUNT_MASK , val); + mib->rts_retries_cnt +=FIELD_GET (MT_MIB_RTS_RETRIES_COUNT_MASK , + val); val =mt76_rr (dev,MT_TX_AGG_CNT (ext_phy, i)); - dev->mt76.aggr_stats[aggr++] += val &0xffff ; dev->mt76.aggr_stats[aggr++] += val >>16 ; }
drivers/net/wireless/mediatek/mt76/mt7615/main.c +6 -0
@@ -827,11 +827,17 @@ mt7615_get_stats(struct ieee80211_hw *hw,struct mt7615_phy *phy =mt7615_hw_phy (hw);struct mib_stats *mib = &phy->mib; +mt7615_mutex_acquire (phy->dev); + stats->dot11RTSSuccessCount = mib->rts_cnt; stats->dot11RTSFailureCount = mib->rts_retries_cnt; stats->dot11FCSErrorCount = mib->fcs_err_cnt; stats->dot11ACKFailureCount = mib->ack_fail_cnt; +memset (mib,0 ,sizeof (*mib)); + +mt7615_mutex_release (phy->dev); +return 0 ; }
drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h +5 -5
@@ -143,11 +143,11 @@ struct mt7615_vif { };struct mib_stats { -u16 ack_fail_cnt; -u16 fcs_err_cnt; -u16 rts_cnt; -u16 rts_retries_cnt; -u16 ba_miss_cnt; +u32 ack_fail_cnt; +u32 fcs_err_cnt; +u32 rts_cnt; +u32 rts_retries_cnt; +u32 ba_miss_cnt;unsigned long aggr_per; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 467/601 mt76: mt7915: fix mib stats counter reporting to mac80211
In reply to Greg Kroah-HartmanFrom: Ryder Lee <[email protected]>
[ Upstream commit 2b35050a321865859fd2f12a3c18ed7be27858c9 ]
In order to properly report MIB counters to mac80211, resets stats in mt7915_get_stats routine() and hold mt76 mutex accessing MIB counters. Sum up MIB counters in mt7915_mac_update_mib_stats routine.
--- .../net/wireless/mediatek/mt76/mt7915/mac.c | 35 +++++++------------ .../net/wireless/mediatek/mt76/mt7915/main.c | 6 ++++ .../wireless/mediatek/mt76/mt7915/mt7915.h | 10 +++--- 3 files changed, 24 insertions(+), 27 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mac.c +13 -22
@@ -1598,39 +1598,30 @@ mt7915_mac_update_mib_stats(struct mt7915_phy *phy)bool ext_phy = phy != &dev->phy;int i, aggr0, aggr1; -memset (mib,0 ,sizeof (*mib)); - - mib->fcs_err_cnt =mt76_get_field (dev,MT_MIB_SDR3 (ext_phy), -MT_MIB_SDR3_FCS_ERR_MASK ); + mib->fcs_err_cnt +=mt76_get_field (dev,MT_MIB_SDR3 (ext_phy), +MT_MIB_SDR3_FCS_ERR_MASK ); aggr0 = ext_phy ?ARRAY_SIZE (dev->mt76.aggr_stats) /2 :0 ;for (i =0 , aggr1 = aggr0 +4 ; i <4 ; i++) { -u32 val, val2; +u32 val; val =mt76_rr (dev,MT_MIB_MB_SDR1 (ext_phy, i)); - - val2 =FIELD_GET (MT_MIB_ACK_FAIL_COUNT_MASK , val); -if (val2 > mib->ack_fail_cnt) - mib->ack_fail_cnt = val2; - - val2 =FIELD_GET (MT_MIB_BA_MISS_COUNT_MASK , val); -if (val2 > mib->ba_miss_cnt) - mib->ba_miss_cnt = val2; + mib->ba_miss_cnt +=FIELD_GET (MT_MIB_BA_MISS_COUNT_MASK , val); + mib->ack_fail_cnt += +FIELD_GET (MT_MIB_ACK_FAIL_COUNT_MASK , val); val =mt76_rr (dev,MT_MIB_MB_SDR0 (ext_phy, i)); - val2 =FIELD_GET (MT_MIB_RTS_RETRIES_COUNT_MASK , val); -if (val2 > mib->rts_retries_cnt) { - mib->rts_cnt =FIELD_GET (MT_MIB_RTS_COUNT_MASK , val); - mib->rts_retries_cnt = val2; - } + mib->rts_cnt +=FIELD_GET (MT_MIB_RTS_COUNT_MASK , val); + mib->rts_retries_cnt += +FIELD_GET (MT_MIB_RTS_RETRIES_COUNT_MASK , val); val =mt76_rr (dev,MT_TX_AGG_CNT (ext_phy, i)); - val2 =mt76_rr (dev,MT_TX_AGG_CNT2 (ext_phy, i)); - dev->mt76.aggr_stats[aggr0++] += val &0xffff ; dev->mt76.aggr_stats[aggr0++] += val >>16 ; - dev->mt76.aggr_stats[aggr1++] += val2 &0xffff ; - dev->mt76.aggr_stats[aggr1++] += val2 >>16 ; + + val =mt76_rr (dev,MT_TX_AGG_CNT2 (ext_phy, i)); + dev->mt76.aggr_stats[aggr1++] += val &0xffff ; + dev->mt76.aggr_stats[aggr1++] += val >>16 ; } }
drivers/net/wireless/mediatek/mt76/mt7915/main.c +6 -0
@@ -711,13 +711,19 @@ mt7915_get_stats(struct ieee80211_hw *hw, struct ieee80211_low_level_stats *stats) {struct mt7915_phy *phy =mt7915_hw_phy (hw); +struct mt7915_dev *dev =mt7915_hw_dev (hw);struct mib_stats *mib = &phy->mib; +mutex_lock (&dev->mt76.mutex); stats->dot11RTSSuccessCount = mib->rts_cnt; stats->dot11RTSFailureCount = mib->rts_retries_cnt; stats->dot11FCSErrorCount = mib->fcs_err_cnt; stats->dot11ACKFailureCount = mib->ack_fail_cnt; +memset (mib,0 ,sizeof (*mib)); + +mutex_unlock (&dev->mt76.mutex); +return 0 ; }
drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +5 -5
@@ -100,11 +100,11 @@ struct mt7915_vif { };struct mib_stats { -u16 ack_fail_cnt; -u16 fcs_err_cnt; -u16 rts_cnt; -u16 rts_retries_cnt; -u16 ba_miss_cnt; +u32 ack_fail_cnt; +u32 fcs_err_cnt; +u32 rts_cnt; +u32 rts_retries_cnt; +u32 ba_miss_cnt; };struct mt7915_phy {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 468/601 mt76: reduce q->lock hold time
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 2fbcdb4386dda0a911b5485b33468540716251f8 ]
Instead of holding it for the duration of an entire station schedule run, which can block out competing tasks for a significant amount of time, only hold it for scheduling one batch of packets for one station. Improves responsiveness under load
--- drivers/net/wireless/mediatek/mt76/tx.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/net/wireless/mediatek/mt76/tx.c +7 -8
@@ -454,7 +454,6 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid)struct mt76_wcid *wcid;int ret =0 ; -spin_lock_bh (&q->lock);while (1 ) {if (test_bit (MT76_STATE_PM , &phy->state) ||test_bit (MT76_RESET , &phy->state)) {
@@ -464,14 +463,9 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid)if (dev->queue_ops->tx_cleanup && q->queued +2 *MT_TXQ_FREE_THR >= q->ndesc) { -spin_unlock_bh (&q->lock); dev->queue_ops->tx_cleanup (dev, q, false); -spin_lock_bh (&q->lock); } -if (mt76_txq_stopped (q)) -break ; - txq =ieee80211_next_txq (phy->hw, qid);if (!txq)break ;
@@ -481,6 +475,8 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid)if (wcid &&test_bit (MT_WCID_FLAG_PS , &wcid->flags))continue ; +spin_lock_bh (&q->lock); +if (mtxq->send_bar && mtxq->aggr) {struct ieee80211_txq *txq =mtxq_to_txq (mtxq);struct ieee80211_sta *sta = txq->sta;
@@ -494,10 +490,13 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid)spin_lock_bh (&q->lock); } - ret +=mt76_txq_send_burst (phy, q, mtxq); +if (!mt76_txq_stopped (q)) + ret +=mt76_txq_send_burst (phy, q, mtxq); + +spin_unlock_bh (&q->lock); +ieee80211_return_txq (phy->hw, txq, false); } -spin_unlock_bh (&q->lock);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 469/601 mt76: check return value of mt76_txq_send_burst in mt76_txq_schedule_list
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 57b8b57516c5108b0078051a31c68dc9dfcbf68f ]
Since mt76_txq_send_burst routine can report a negative error code, check the returned value before incrementing the number of transmitted frames in mt76_txq_schedule_list routine.
Return -EBUSY directly if the device is in reset or in power management.
--- drivers/net/wireless/mediatek/mt76/tx.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/net/wireless/mediatek/mt76/tx.c +10 -5
@@ -455,11 +455,11 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid)int ret =0 ;while (1 ) { +int n_frames =0 ; +if (test_bit (MT76_STATE_PM , &phy->state) || -test_bit (MT76_RESET , &phy->state)) { - ret = -EBUSY ; -break ; - } +test_bit (MT76_RESET , &phy->state)) +return -EBUSY ;if (dev->queue_ops->tx_cleanup && q->queued +2 *MT_TXQ_FREE_THR >= q->ndesc) {
@@ -491,11 +491,16 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid) }if (!mt76_txq_stopped (q)) - ret +=mt76_txq_send_burst (phy, q, mtxq); + n_frames =mt76_txq_send_burst (phy, q, mtxq);spin_unlock_bh (&q->lock);ieee80211_return_txq (phy->hw, txq, false); + +if (unlikely (n_frames <0 )) +return n_frames; + + ret += n_frames; }return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 470/601 mt76: mt7915: fix rxrate reporting
In reply to Greg Kroah-HartmanFrom: Ryder Lee <[email protected]>
[ Upstream commit 7883906d22c1e73f1f316bd84fc4a7ff8edd12aa ]
Avoid directly updating sinfo->rxrate from firmware since rate_info might be overwritten by wrong results even mt7915_mcu_get_rx_rate() fails check.
Add more error handlings accordingly.
--- .../net/wireless/mediatek/mt76/mt7915/main.c | 5 +- .../net/wireless/mediatek/mt76/mt7915/mcu.c | 47 ++++++++++--------- 2 files changed, 30 insertions(+), 22 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/main.c +4 -1
@@ -833,9 +833,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,struct mt7915_phy *phy =mt7915_hw_phy (hw);struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;struct mt7915_sta_stats *stats = &msta->stats; +struct rate_info rxrate = {}; -if (mt7915_mcu_get_rx_rate (phy, vif, sta, &sinfo->rxrate) ==0 ) +if (!mt7915_mcu_get_rx_rate (phy, vif, sta, &rxrate)) { + sinfo->rxrate = rxrate; sinfo->filled |=BIT_ULL (NL80211_STA_INFO_RX_BITRATE ); + }if (!stats->tx_rate.legacy && !stats->tx_rate.flags)return ;
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +26 -21
90 lines not on this page · raw message
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 471/601 mt76: mt7915: fix txrate reporting
In reply to Greg Kroah-HartmanFrom: Ryder Lee <[email protected]>
[ Upstream commit f43b941fd61003659a3f0e039595e5e525917aa8 ]
Properly check rate_info to fix unexpected reporting.
[ 1215.161863] Call trace: [ 1215.164307] cfg80211_calculate_bitrate+0x124/0x200 [cfg80211] [ 1215.170139] ieee80211s_update_metric+0x80/0xc0 [mac80211] [ 1215.175624] ieee80211_tx_status_ext+0x508/0x838 [mac80211] [ 1215.181190] mt7915_mcu_get_rx_rate+0x28c/0x8d0 [mt7915e] [ 1215.186580] mt7915_mac_tx_free+0x324/0x7c0 [mt7915e] [ 1215.191623] mt7915_queue_rx_skb+0xa8/0xd0 [mt7915e] [ 1215.196582] mt76_dma_cleanup+0x7b0/0x11d0 [mt76] [ 1215.201276] __napi_poll+0x38/0xf8 [ 1215.204668] napi_workfn+0x40/0x80 [ 1215.208062] process_one_work+0x1fc/0x390 [ 1215.212062] worker_thread+0x48/0x4d0 [ 1215.215715] kthread+0x120/0x128 [ 1215.218935] ret_from_fork+0x10/0x1c
--- .../net/wireless/mediatek/mt76/mt7915/mcu.c | 38 ++++++++++++------- 1 file changed, 24 insertions(+), 14 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +24 -14
@@ -351,54 +351,62 @@ mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb) dev->hw_pattern++; } -static void +static int mt7915_mcu_tx_rate_parse (struct mt76_phy *mphy,struct mt7915_mcu_ra_info *ra,struct rate_info *rate,u16 r) {struct ieee80211_supported_band *sband;u16 ru_idx =le16_to_cpu (ra->ru_idx); -u16 flags =0 ; +bool cck = false; rate->mcs =FIELD_GET (MT_RA_RATE_MCS , r); rate->nss =FIELD_GET (MT_RA_RATE_NSS , r) +1 ;switch (FIELD_GET (MT_RA_RATE_TX_MODE , r)) {case MT_PHY_TYPE_CCK : + cck = true; + fallthrough;case MT_PHY_TYPE_OFDM :if (mphy->chandef.chan->band ==NL80211_BAND_5GHZ ) sband = &mphy->sband_5g.sband;else sband = &mphy->sband_2g.sband; + rate->mcs =mt76_get_rate (mphy->dev, sband, rate->mcs, cck); rate->legacy = sband->bitrates[rate->mcs].bitrate;break ;case MT_PHY_TYPE_HT :case MT_PHY_TYPE_HT_GF : rate->mcs += (rate->nss -1 ) *8 ; - flags |=RATE_INFO_FLAGS_MCS ; +if (rate->mcs >31 ) +return -EINVAL ; + rate->flags =RATE_INFO_FLAGS_MCS ;if (ra->gi) - flags |=RATE_INFO_FLAGS_SHORT_GI ; + rate->flags |=RATE_INFO_FLAGS_SHORT_GI ;break ;case MT_PHY_TYPE_VHT : - flags |=RATE_INFO_FLAGS_VHT_MCS ; +if (rate->mcs >9 ) +return -EINVAL ; + rate->flags =RATE_INFO_FLAGS_VHT_MCS ;if (ra->gi) - flags |=RATE_INFO_FLAGS_SHORT_GI ; + rate->flags |=RATE_INFO_FLAGS_SHORT_GI ;break ;case MT_PHY_TYPE_HE_SU :case MT_PHY_TYPE_HE_EXT_SU :case MT_PHY_TYPE_HE_TB :case MT_PHY_TYPE_HE_MU : +if (ra->gi >NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs >11 ) +return -EINVAL ; + rate->he_gi = ra->gi; rate->he_dcm =FIELD_GET (MT_RA_RATE_DCM_EN , r); - - flags |=RATE_INFO_FLAGS_HE_MCS ; + rate->flags =RATE_INFO_FLAGS_HE_MCS ;break ;default : -break ; +return -EINVAL ; } - rate->flags = flags;if (ru_idx) {switch (ru_idx) {
@@ -435,6 +443,8 @@ mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,break ; } } + +return 0 ; } static void
@@ -465,12 +475,12 @@ mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb) mphy = dev->mt76.phy2;/* current rate */ -mt7915_mcu_tx_rate_parse (mphy, ra, &rate, curr); - stats->tx_rate = rate; +if (!mt7915_mcu_tx_rate_parse (mphy, ra, &rate, curr)) + stats->tx_rate = rate;/* probing rate */ -mt7915_mcu_tx_rate_parse (mphy, ra, &prob_rate, probe); - stats->prob_rate = prob_rate; +if (!mt7915_mcu_tx_rate_parse (mphy, ra, &prob_rate, probe)) + stats->prob_rate = prob_rate;if (attempts) {u16 success =le16_to_cpu (ra->success);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 472/601 mt76: mt7663: fix when beacon filter is being applied
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 4bec61d9fb9629c21e60cd24a97235ea1f6020ec ]
HW beacon filter command is being applied until we're in associated state because the command would rely on the associated access point's beacon interval and DTIM information.
--- drivers/net/wireless/mediatek/mt76/mt7615/main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7615/main.c +3 -3
@@ -231,8 +231,6 @@ static int mt7615_add_interface(struct ieee80211_hw *hw, ret =mt7615_mcu_add_dev_info (dev, vif, true);if (ret) goto out; - -mt7615_mac_set_beacon_filter (phy, vif, true); out:mt7615_mutex_release (dev);
@@ -258,7 +256,6 @@ static void mt7615_remove_interface(struct ieee80211_hw *hw,mt7615_free_pending_tx_skbs (dev, msta); -mt7615_mac_set_beacon_filter (phy, vif, false);mt7615_mcu_add_dev_info (dev, vif, false);rcu_assign_pointer (dev->mt76.wcid[idx],NULL );
@@ -557,6 +554,9 @@ static void mt7615_bss_info_changed(struct ieee80211_hw *hw,if (changed &BSS_CHANGED_ARP_FILTER )mt7615_mcu_update_arp_filter (hw, vif, info); +if (changed &BSS_CHANGED_ASSOC ) +mt7615_mac_set_beacon_filter (phy, vif, info->assoc); +mt7615_mutex_release (dev); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 473/601 mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 455ae5aabcc72fed7e5c803d59d122415500dc08 ]
Each packet should be padded with the additional zero to become 4-bytes alignment in sdio tx aggregation.
--- drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c +8 -1
@@ -218,6 +218,7 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q)int qid, err, nframes =0 , len =0 , pse_sz =0 , ple_sz =0 ;bool mcu = q == dev->q_mcu[MT_MCUQ_WM ];struct mt76_sdio *sdio = &dev->sdio; +u8 pad; qid = mcu ?ARRAY_SIZE (sdio->xmit_buf) -1 : q->qid;while (q->first != q->head) {
@@ -234,7 +235,8 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q) goto next; } -if (len + e->skb->len +4 >MT76S_XMIT_BUF_SZ ) + pad =roundup (e->skb->len,4 ) - e->skb->len; +if (len + e->skb->len + pad +4 >MT76S_XMIT_BUF_SZ )break ; if (mt7663s_tx_pick_quota(sdio, mcu, e->buf_sz, &pse_sz,
@@ -252,6 +254,11 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q) len += iter->len; nframes++; } + +if (unlikely (pad)) { +memset (sdio->xmit_buf[qid] + len,0 , pad); + len += pad; + } next: q->first = (q->first +1 ) % q->ndesc; e->done = true;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 474/601 mt76: mt7663s: fix the possible device hang in high traffic
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 45247a85614b49b07b9dc59a4e6783b17e766ff2 ]
Use the additional memory barrier to ensure the skb list up-to-date between the skb producer and consumer to avoid the invalid skb content written into sdio controller and then cause device hang due to mcu assert caught by WR_TIMEOUT_INT.
--- drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c | 2 ++ drivers/net/wireless/mediatek/mt76/sdio.c | 3 +++ 2 files changed, 5 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c +2 -0
@@ -225,6 +225,8 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q)struct mt76_queue_entry *e = &q->entry[q->first];struct sk_buff *iter; +smp_rmb (); +if (!test_bit (MT76_STATE_MCU_RUNNING , &dev->phy.state)) {__skb_put_zero (e->skb,4 ); err = __mt7663s_xmit_queue(dev, e->skb->data,
drivers/net/wireless/mediatek/mt76/sdio.c +3 -0
@@ -256,6 +256,9 @@ mt76s_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, q->entry[q->head].skb = tx_info.skb; q->entry[q->head].buf_sz = len; + +smp_wmb (); + q->head = (q->head +1 ) % q->ndesc; q->queued++;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 475/601 mt76: mt7615: cleanup mcu tx queue in mt7615_dma_reset()
In reply to Greg Kroah-HartmanFrom: Ryder Lee <[email protected]>
[ Upstream commit 69e74d7f23d515fb559b2e0bebfdf4c458d9507d ]
With this patch, mt7615_mac_reset_work() can recover system back.
--- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7615/mac.c +5 -3
@@ -2032,15 +2032,17 @@ void mt7615_dma_reset(struct mt7615_dev *dev)mt76_clear (dev,MT_WPDMA_GLO_CFG ,MT_WPDMA_GLO_CFG_RX_DMA_EN |MT_WPDMA_GLO_CFG_TX_DMA_EN |MT_WPDMA_GLO_CFG_TX_WRITEBACK_DONE ); +usleep_range (1000 ,2000 ); -mt76_queue_tx_cleanup (dev, dev->mt76.q_mcu[MT_MCUQ_WM ], true);for (i =0 ; i < __MT_TXQ_MAX; i++)mt76_queue_tx_cleanup (dev, dev->mphy.q_tx[i], true); -mt76_for_each_q_rx (&dev->mt76, i) { +for (i =0 ; i < __MT_MCUQ_MAX; i++) +mt76_queue_tx_cleanup (dev, dev->mt76.q_mcu[i], true); + +mt76_for_each_q_rx (&dev->mt76, i)mt76_queue_rx_reset (dev, i); - } mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_RX_DMA_EN | MT_WPDMA_GLO_CFG_TX_DMA_EN |
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 476/601 mt76: mt7915: bring up the WA event rx queue for band1
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 76027f40f5ee04bf15cde3a83af9b873c2affa28 ]
This is needed for DBDC cards to work correctly on both bands simultaneously
--- drivers/net/wireless/mediatek/mt76/mt76.h | 1 + drivers/net/wireless/mediatek/mt76/mt7915/dma.c | 8 ++++++++ drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 1 + drivers/net/wireless/mediatek/mt76/mt7915/pci.c | 4 ++++ drivers/net/wireless/mediatek/mt76/mt7915/regs.h | 3 ++- 5 files changed, 16 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt76.h +1 -0
@@ -81,6 +81,7 @@ enum mt76_rxq_id {MT_RXQ_MCU ,MT_RXQ_MCU_WA ,MT_RXQ_EXT , +MT_RXQ_EXT_WA , __MT_RXQ_MAX };
drivers/net/wireless/mediatek/mt76/mt7915/dma.c +8 -0
@@ -286,6 +286,14 @@ int mt7915_dma_init(struct mt7915_dev *dev) rx_buf_size, MT_RX_DATA_RING_BASE);if (ret)return ret; + +/* event from WA */ + ret =mt76_queue_alloc (dev, &dev->mt76.q_rx[MT_RXQ_EXT_WA ], +MT7915_RXQ_MCU_WA_EXT , +MT7915_RX_MCU_RING_SIZE , + rx_buf_size,MT_RX_EVENT_RING_BASE ); +if (ret) +return ret; } ret =mt76_init_queues (dev);
drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +1 -0
@@ -61,6 +61,7 @@ enum mt7915_rxq_id {MT7915_RXQ_BAND1 ,MT7915_RXQ_MCU_WM =0 ,MT7915_RXQ_MCU_WA , + MT7915_RXQ_MCU_WA_EXT, }; struct mt7915_sta_stats {
drivers/net/wireless/mediatek/mt76/mt7915/pci.c +4 -0
@@ -26,6 +26,7 @@ mt7915_rx_poll_complete(struct mt76_dev *mdev, enum mt76_rxq_id q) [MT_RXQ_EXT] = MT_INT_RX_DONE_DATA1, [MT_RXQ_MCU] = MT_INT_RX_DONE_WM, [MT_RXQ_MCU_WA] = MT_INT_RX_DONE_WA, + [MT_RXQ_EXT_WA ] =MT_INT_RX_DONE_WA_EXT , };mt7915_irq_enable (dev, rx_irq_mask[q]);
@@ -67,6 +68,9 @@ static irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)if (intr &MT_INT_RX_DONE_WA )napi_schedule (&dev->mt76.napi[MT_RXQ_MCU_WA ]); +if (intr &MT_INT_RX_DONE_WA_EXT ) +napi_schedule (&dev->mt76.napi[MT_RXQ_EXT_WA ]); +if (intr &MT_INT_MCU_CMD ) {u32 val =mt76_rr (dev,MT_MCU_CMD );
drivers/net/wireless/mediatek/mt76/mt7915/regs.h +2 -1
@@ -342,7 +342,8 @@#define MT_INT_RX_DONE_DATA1 BIT(17)#define MT_INT_RX_DONE_WM BIT(0)#define MT_INT_RX_DONE_WA BIT(1) -#define MT_INT_RX_DONE_ALL (BIT(0) | BIT(1) | GENMASK(17, 16)) +#define MT_INT_RX_DONE_WA_EXT BIT(2) +#define MT_INT_RX_DONE_ALL (GENMASK(2, 0) | GENMASK(17, 16))#define MT_INT_TX_DONE_MCU_WA BIT(15)#define MT_INT_TX_DONE_FWDL BIT(26)#define MT_INT_TX_DONE_MCU_WM BIT(27)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 477/601 mt76: mt7915: cleanup mcu tx queue in mt7915_dma_reset()
In reply to Greg Kroah-HartmanFrom: Ryder Lee <[email protected]>
[ Upstream commit 1ebea45ef027ee31cd50ed92903071391e792edb ]
Cleanup mcu queues in mt7915_mac_reset_work().
--- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mac.c +8 -7
@@ -1453,9 +1453,8 @@ mt7915_update_beacons(struct mt7915_dev *dev) }static void -mt7915_dma_reset (struct mt7915_phy *phy) +mt7915_dma_reset (struct mt7915_dev *dev) { -struct mt7915_dev *dev = phy->dev;struct mt76_phy *mphy_ext = dev->mt76.phy2;int i;
@@ -1463,18 +1462,20 @@ mt7915_dma_reset(struct mt7915_phy *phy) MT_WFDMA0_GLO_CFG_TX_DMA_EN | MT_WFDMA0_GLO_CFG_RX_DMA_EN);mt76_clear (dev,MT_WFDMA1_GLO_CFG ,MT_WFDMA1_GLO_CFG_TX_DMA_EN |MT_WFDMA1_GLO_CFG_RX_DMA_EN ); +usleep_range (1000 ,2000 ); -mt76_queue_tx_cleanup (dev, dev->mt76.q_mcu[MT_MCUQ_WA ], true);for (i =0 ; i < __MT_TXQ_MAX; i++) { -mt76_queue_tx_cleanup (dev, phy->mt76->q_tx[i], true); +mt76_queue_tx_cleanup (dev, dev->mphy.q_tx[i], true);if (mphy_ext)mt76_queue_tx_cleanup (dev, mphy_ext->q_tx[i], true); } -mt76_for_each_q_rx (&dev->mt76, i) { +for (i =0 ; i < __MT_MCUQ_MAX; i++) +mt76_queue_tx_cleanup (dev, dev->mt76.q_mcu[i], true); + +mt76_for_each_q_rx (&dev->mt76, i)mt76_queue_rx_reset (dev, i); - }/* re-init prefetch settings after reset */ mt7915_dma_prefetch (dev);
@@ -1550,7 +1551,7 @@ void mt7915_mac_reset_work(struct work_struct *work)idr_init (&dev->token);if (mt7915_wait_reset_state (dev,MT_MCU_CMD_RESET_DONE )) { -mt7915_dma_reset (&dev->phy); +mt7915_dma_reset (dev);mt76_wr (dev,MT_MCU_INT_EVENT ,MT_MCU_INT_EVENT_DMA_INIT );mt7915_wait_reset_state (dev,MT_MCU_CMD_RECOVERY_DONE );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 478/601 KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit 5088eb4092df12d701af8e0e92860b7186365279 ]
The host CTRL (runlatch) value is not restored after guest exit. The host CTRL should always be 1 except in CPU idle code, so this can result in the host running with runlatch clear, and potentially switching to a different vCPU which then runs with runlatch clear as well.
This has little effect on P9 machines, CTRL is only responsible for some PMU counter logic in the host and so other than corner cases of software relying on that, or explicitly reading the runlatch value (Linux does not appear to be affected but it's possible non-Linux guests could be), there should be no execution correctness problem, though it could be used as a covert channel between guests.
There may be microcontrollers, firmware or monitoring tools that sample the runlatch value out-of-band, however since the register is writable by guests, these values would (should) not be relied upon for correct operation of the host, so suboptimal performance or incorrect reporting should be the worst problem.
--- arch/powerpc/kvm/book3s_hv.c | 3 +++ 1 file changed, 3 insertions(+)
arch/powerpc/kvm/book3s_hv.c +3 -0
@@ -3709,7 +3709,10 @@ static int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit, vcpu->arch.dec_expires = dec + tb; vcpu->cpu =-1 ; vcpu->arch.thread_cpu =-1 ; +/* Save guest CTRL register, set runlatch to 1 */ vcpu->arch.ctrl =mfspr (SPRN_CTRLF ); +if (!(vcpu->arch.ctrl &1 )) +mtspr (SPRN_CTRLT , vcpu->arch.ctrl |1 ); vcpu->arch.iamr =mfspr (SPRN_IAMR ); vcpu->arch.pspb =mfspr (SPRN_PSPB );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 479/601 ovl: show "userxattr" in the mount data
In reply to Greg Kroah-HartmanFrom: Giuseppe Scrivano <[email protected]>
[ Upstream commit 321b46b904816241044e177c1d6282ad20f17416 ]
This was missed when adding the option.
--- fs/overlayfs/super.c | 2 ++ 1 file changed, 2 insertions(+)
fs/overlayfs/super.c +2 -0
@@ -380,6 +380,8 @@ static int ovl_show_options(struct seq_file *m, struct dentry *dentry) ofs->config.metacopy ? "on" : "off");if (ofs->config.ovl_volatile)seq_puts (m,",volatile" ); +if (ofs->config.userxattr) +seq_puts (m,",userxattr" );return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 480/601 ovl: invalidate readdir cache on changes to dir with origin
In reply to Greg Kroah-HartmanFrom: Amir Goldstein <[email protected]>
[ Upstream commit 65cd913ec9d9d71529665924c81015b7ab7d9381 ]
The test in ovl_dentry_version_inc() was out-dated and did not include the case where readdir cache is used on a non-merge dir that has origin xattr, indicating that it may contain leftover whiteouts.
To make the code more robust, use the same helper ovl_dir_is_real() to determine if readdir cache should be used and if readdir cache should be invalidated.
--- fs/overlayfs/overlayfs.h | 30 +++++++++++++++++++++++++++--- fs/overlayfs/readdir.c | 12 ------------ fs/overlayfs/util.c | 31 +++++++++---------------------- 3 files changed, 36 insertions(+), 37 deletions(-)
fs/overlayfs/overlayfs.h +27 -3
@@ -310,9 +310,6 @@ int ovl_check_setxattr(struct dentry *dentry, struct dentry *upperdentry, enum ovl_xattr ox, const void *value, size_t size, int xerr);int ovl_set_impure (struct dentry *dentry,struct dentry *upperdentry); -void ovl_set_flag (unsigned long flag,struct inode *inode); -void ovl_clear_flag (unsigned long flag,struct inode *inode); -bool ovl_test_flag (unsigned long flag,struct inode *inode);bool ovl_inuse_trylock (struct dentry *dentry);void ovl_inuse_unlock (struct dentry *dentry);bool ovl_is_inuse (struct dentry *dentry);
@@ -326,6 +323,21 @@ char *ovl_get_redirect_xattr(struct ovl_fs *ofs, struct dentry *dentry, int padding);int ovl_sync_status (struct ovl_fs *ofs); +static inline void ovl_set_flag (unsigned long flag,struct inode *inode) +{ +set_bit (flag, &OVL_I (inode)->flags); +} + +static inline void ovl_clear_flag (unsigned long flag,struct inode *inode) +{ +clear_bit (flag, &OVL_I (inode)->flags); +} + +static inline bool ovl_test_flag (unsigned long flag,struct inode *inode) +{ +return test_bit (flag, &OVL_I (inode)->flags); +} +static inline bool ovl_is_impuredir (struct super_block *sb,struct dentry *dentry) {
@@ -430,6 +442,18 @@ int ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt, struct dentry *dentry, int level);int ovl_indexdir_cleanup (struct ovl_fs *ofs); +/* +* Can we iterate real dir directly? +* +* Non-merge dir may contain whiteouts from a time it was a merge upper, before +* lower dir was removed under it and possibly before it was rotated from upper +* to lower layer. +*/ +static inline bool ovl_dir_is_real (struct dentry *dir) +{ +return !ovl_test_flag (OVL_WHITEOUTS ,d_inode (dir)); +} +/* inode.c */ int ovl_set_nlink_upper (struct dentry *dentry);int ovl_set_nlink_lower (struct dentry *dentry);
fs/overlayfs/readdir.c +0 -12
@@ -319,18 +319,6 @@ static inline int ovl_dir_read(struct path *realpath,return err; } -/* -* Can we iterate real dir directly? -* -* Non-merge dir may contain whiteouts from a time it was a merge upper, before -* lower dir was removed under it and possibly before it was rotated from upper -* to lower layer. -*/ -static bool ovl_dir_is_real (struct dentry *dir) -{ -return !ovl_test_flag (OVL_WHITEOUTS ,d_inode (dir)); -} -static void ovl_dir_reset (struct file *file) {struct ovl_dir_file *od = file->private_data;
fs/overlayfs/util.c +9 -22
@@ -422,18 +422,20 @@ void ovl_inode_update(struct inode *inode, struct dentry *upperdentry) } } -static void ovl_dentry_version_inc (struct dentry *dentry,bool impurity) +static void ovl_dir_version_inc (struct dentry *dentry,bool impurity) {struct inode *inode =d_inode (dentry);WARN_ON (!inode_is_locked (inode)); +WARN_ON (!d_is_dir (dentry));/* -* Version is used by readdir code to keep cache consistent. For merge -* dirs all changes need to be noted. For non-merge dirs, cache only -* contains impure (ones which have been copied up and have origins) -* entries, so only need to note changes to impure entries. +* Version is used by readdir code to keep cache consistent. +* For merge dirs (or dirs with origin) all changes need to be noted. +* For non-merge dirs, cache contains only impure entries (i.e. ones +* which have been copied up and have origins), so only need to note +* changes to impure entries. */ -if (OVL_TYPE_MERGE (ovl_path_type (dentry)) || impurity) +if (!ovl_dir_is_real (dentry) || impurity)OVL_I (inode)->version++; }
@@ -442,7 +444,7 @@ void ovl_dir_modified(struct dentry *dentry, bool impurity)/* Copy mtime/ctime */ ovl_copyattr (d_inode (ovl_dentry_upper (dentry)),d_inode (dentry)); -ovl_dentry_version_inc (dentry, impurity); +ovl_dir_version_inc (dentry, impurity); }u64 ovl_dentry_version_get (struct dentry *dentry)
@@ -638,21 +640,6 @@ int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry)return err; } -void ovl_set_flag (unsigned long flag,struct inode *inode) -{ -set_bit (flag, &OVL_I (inode)->flags); -} - -void ovl_clear_flag (unsigned long flag,struct inode *inode) -{ -clear_bit (flag, &OVL_I (inode)->flags); -} - -bool ovl_test_flag (unsigned long flag,struct inode *inode) -{ -return test_bit (flag, &OVL_I (inode)->flags); -} -/** * Caller must hold a reference to inode to prevent it from being freed while * it is marked inuse.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 481/601 RDMA/qedr: Fix error return code in qedr_iw_connect()
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 10dd83dbcd157baf7a78a09ddb2f84c627bc7f1d ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/infiniband/hw/qedr/qedr_iw_cm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/hw/qedr/qedr_iw_cm.c +3 -1
@@ -636,8 +636,10 @@ int qedr_iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)memcpy (in_params.local_mac_addr, dev->ndev->dev_addr,ETH_ALEN );if (test_and_set_bit (QEDR_IWARP_CM_WAIT_FOR_CONNECT , - &qp->iwarp_cm_flags)) + &qp->iwarp_cm_flags)) { + rc = -ENODEV ; goto err;/* QP already being destroyed */ + } rc = dev->ops->iwarp_connect (dev->rdma_ctx, &in_params, &out_params);if (rc) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 482/601 IB/hfi1: Fix error return code in parse_platform_config()
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 4c7d9c69adadfc31892c7e8e134deb3546552106 ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/infiniband/hw/hfi1/firmware.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/hfi1/firmware.c +1 -0
@@ -1916,6 +1916,7 @@ int parse_platform_config(struct hfi1_devdata *dd)dd_dev_err (dd,"%s: Failed CRC check at offset %ld\n" , __func__, (ptr - (u32 *)dd->platform_config.data)); + ret = -EINVAL ; goto bail; }/* Jump the CRC DWORD */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 483/601 RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal()
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 22efb0a8d130c6379c1eb64cbace1542b27e37ff ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/bnxt_re/qplib_fp.c +1 -0
@@ -2784,6 +2784,7 @@ do_rq:dev_err (&cq->hwq.pdev->dev,"FP: CQ Processed terminal reported rq_cons_idx 0x%x exceeds max 0x%x\n" , cqe_cons, rq->max_wqe); + rc = -EINVAL ; goto done; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 484/601 cxgb4: Fix unintentional sign extension issues
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit dd2c79677375c37f8f9f8d663eb4708495d595ef ]
The shifting of the u8 integers f->fs.nat_lip[] by 24 bits to the left will be promoted to a 32 bit signed int and then sign-extended to a u64. In the event that the top bit of the u8 is set then all then all the upper 32 bits of the u64 end up as also being set because of the sign-extension. Fix this by casting the u8 values to a u64 before the 24 bit left shift.
Addresses-Coverity: ("Unintended sign extension")
--- .../net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +11 -11
@@ -174,31 +174,31 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,WORD_MASK , f->fs.nat_lip[15 ] | f->fs.nat_lip[14 ] <<8 | f->fs.nat_lip[13 ] <<16 | - f->fs.nat_lip[12] << 24, 1); + (u64)f->fs.nat_lip[12] << 24, 1);set_tcb_field (adap, f, tid,TCB_SND_UNA_RAW_W +1 ,WORD_MASK , f->fs.nat_lip[11 ] | f->fs.nat_lip[10 ] <<8 | f->fs.nat_lip[9 ] <<16 | - f->fs.nat_lip[8 ] <<24 ,1 ); + (u64 )f->fs.nat_lip[8 ] <<24 ,1 );set_tcb_field (adap, f, tid,TCB_SND_UNA_RAW_W +2 ,WORD_MASK , f->fs.nat_lip[7 ] | f->fs.nat_lip[6 ] <<8 | f->fs.nat_lip[5 ] <<16 | - f->fs.nat_lip[4 ] <<24 ,1 ); + (u64 )f->fs.nat_lip[4 ] <<24 ,1 );set_tcb_field (adap, f, tid,TCB_SND_UNA_RAW_W +3 ,WORD_MASK , f->fs.nat_lip[3 ] | f->fs.nat_lip[2 ] <<8 | f->fs.nat_lip[1 ] <<16 | - f->fs.nat_lip[0 ] <<24 ,1 ); + (u64 )f->fs.nat_lip[0 ] <<24 ,1 ); }else {set_tcb_field (adap, f, tid,TCB_RX_FRAG3_LEN_RAW_W ,WORD_MASK , f->fs.nat_lip[3 ] | f->fs.nat_lip[2 ] <<8 | f->fs.nat_lip[1 ] <<16 | - f->fs.nat_lip[0 ] <<24 ,1 ); + (u64 )f->fs.nat_lip[0 ] <<25 ,1 ); } }
@@ -208,25 +208,25 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,WORD_MASK , f->fs.nat_fip[15 ] | f->fs.nat_fip[14 ] <<8 | f->fs.nat_fip[13 ] <<16 | - f->fs.nat_fip[12] << 24, 1); + (u64)f->fs.nat_fip[12] << 24, 1);set_tcb_field (adap, f, tid,TCB_RX_FRAG2_PTR_RAW_W +1 ,WORD_MASK , f->fs.nat_fip[11 ] | f->fs.nat_fip[10 ] <<8 | f->fs.nat_fip[9 ] <<16 | - f->fs.nat_fip[8 ] <<24 ,1 ); + (u64 )f->fs.nat_fip[8 ] <<24 ,1 );set_tcb_field (adap, f, tid,TCB_RX_FRAG2_PTR_RAW_W +2 ,WORD_MASK , f->fs.nat_fip[7 ] | f->fs.nat_fip[6 ] <<8 | f->fs.nat_fip[5 ] <<16 | - f->fs.nat_fip[4 ] <<24 ,1 ); + (u64 )f->fs.nat_fip[4 ] <<24 ,1 );set_tcb_field (adap, f, tid,TCB_RX_FRAG2_PTR_RAW_W +3 ,WORD_MASK , f->fs.nat_fip[3 ] | f->fs.nat_fip[2 ] <<8 | f->fs.nat_fip[1 ] <<16 | - f->fs.nat_fip[0 ] <<24 ,1 ); + (u64 )f->fs.nat_fip[0 ] <<24 ,1 ); }else { set_tcb_field(adap, f, tid,
@@ -234,13 +234,13 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,WORD_MASK , f->fs.nat_fip[3 ] | f->fs.nat_fip[2 ] <<8 | f->fs.nat_fip[1 ] <<16 | - f->fs.nat_fip[0] << 24, 1); + (u64)f->fs.nat_fip[0] << 24, 1); } }set_tcb_field (adap, f, tid,TCB_PDU_HDR_LEN_W ,WORD_MASK , (dp ? (nat_lp[1 ] | nat_lp[0 ] <<8 ) :0 ) | - (sp ? (nat_fp[1 ] <<16 | nat_fp[0 ] <<24 ) :0 ), + (sp ? (nat_fp[1 ] <<16 | (u64 )nat_fp[0 ] <<24 ) :0 ),1 ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 485/601 net: thunderx: Fix unintentional sign extension issue
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit e701a25840360706fe4cf5de0015913ca19c274b ]
The shifting of the u8 integers rq->caching by 26 bits to the left will be promoted to a 32 bit signed int and then sign-extended to a u64. In the event that rq->caching is greater than 0x1f then all then all the upper 32 bits of the u64 end up as also being set because of the int sign-extension. Fix this by casting the u8 values to a u64 before the 26 bit left shift.
Addresses-Coverity: ("Unintended sign extension")
--- drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cavium/thunder/nicvf_queues.c +1 -1
@@ -776,7 +776,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs, mbx.rq.msg =NIC_MBOX_MSG_RQ_CFG ; mbx.rq.qs_num = qs->vnic_id; mbx.rq.rq_num = qidx; - mbx.rq.cfg = (rq->caching <<26 ) | (rq->cq_qs <<19 ) | + mbx.rq.cfg = ((u64 )rq->caching <<26 ) | (rq->cq_qs <<19 ) | (rq->cq_idx <<16 ) | (rq->cont_rbdr_qs <<9 ) | (rq->cont_qs_rbdr_idx <<8 ) | (rq->start_rbdr_qs <<1 ) | (rq->start_qs_rbdr_idx);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 486/601 RDMA/srpt: Fix error return code in srpt_cm_req_recv()
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 6bc950beff0c440ac567cdc4e7f4542a9920953d ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/ulp/srpt/ib_srpt.c +1 -0
@@ -2378,6 +2378,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev,pr_info ("rejected SRP_LOGIN_REQ because target %s_%d is not enabled\n" ,dev_name (&sdev->device->dev), port_num);mutex_unlock (&sport->mutex); + ret = -EINVAL ; goto reject; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 487/601 RDMA/rtrs-clt: destroy sysfs after removing session from active list
In reply to Greg Kroah-HartmanFrom: Gioh Kim <[email protected]>
[ Upstream commit 7f4a8592ff29f19c5a2ca549d0973821319afaad ]
A session can be removed dynamically by sysfs interface "remove_path" that eventually calls rtrs_clt_remove_path_from_sysfs function. The current rtrs_clt_remove_path_from_sysfs first removes the sysfs interfaces and frees sess->stats object. Second it removes the session from the active list.
Therefore some functions could access non-connected session and access the freed sess->stats object even-if they check the session status before accessing the session.
For instance rtrs_clt_request and get_next_path_min_inflight check the session status and try to send IO to the session. The session status could be changed when they are trying to send IO but they could not catch the change and update the statistics information in sess->stats object, and generate use-after-free problem.
(see: "RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its stats")
This patch changes the rtrs_clt_remove_path_from_sysfs to remove the session from the active session list and then destroy the sysfs interfaces.
Each function still should check the session status because closing or error recovery paths can change the status.
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +1 -1
@@ -2799,8 +2799,8 @@ int rtrs_clt_remove_path_from_sysfs(struct rtrs_clt_sess *sess, }while (!changed && old_state !=RTRS_CLT_DEAD );if (likely (changed)) { -rtrs_clt_destroy_sess_files (sess, sysfs_self);rtrs_clt_remove_path_from_arr (sess); +rtrs_clt_destroy_sess_files (sess, sysfs_self);kobject_put (&sess->kobj); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 488/601 i2c: cadence: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 23ceb8462dc6f4b4decdb5536a7e5fc477cdf0b6 ]
The PM reference count is not expected to be incremented on return in functions cdns_i2c_master_xfer and cdns_reg_slave.
However, pm_runtime_get_sync will increment pm usage counter even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-cadence.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-cadence.c +2 -2
@@ -789,7 +789,7 @@ static int cdns_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,bool change_role = false;#endif - ret =pm_runtime_get_sync (id->dev); + ret =pm_runtime_resume_and_get (id->dev);if (ret <0 )return ret;
@@ -911,7 +911,7 @@ static int cdns_reg_slave(struct i2c_client *slave)if (slave->flags &I2C_CLIENT_TEN )return -EAFNOSUPPORT ; - ret =pm_runtime_get_sync (id->dev); + ret =pm_runtime_resume_and_get (id->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 489/601 i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 223125e37af8a641ea4a09747a6a52172fc4b903 ]
The PM reference count is not expected to be incremented on return in functions img_i2c_xfer and img_i2c_init.
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-img-scb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-img-scb.c +2 -2
@@ -1057,7 +1057,7 @@ static int img_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, atomic = true; } - ret =pm_runtime_get_sync (adap->dev.parent); + ret =pm_runtime_resume_and_get (adap->dev.parent);if (ret <0 )return ret;
@@ -1158,7 +1158,7 @@ static int img_i2c_init(struct img_i2c *i2c)u32 rev;int ret; - ret =pm_runtime_get_sync (i2c->adap.dev.parent); + ret =pm_runtime_resume_and_get (i2c->adap.dev.parent);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 490/601 i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 278e5bbdb9a94fa063c0f9bcde2479d0b8042462 ]
The PM reference count is not expected to be incremented on return in lpi2c_imx_master_enable.
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-imx-lpi2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-imx-lpi2c.c +1 -1
@@ -259,7 +259,7 @@ static int lpi2c_imx_master_enable(struct lpi2c_imx_struct *lpi2c_imx)unsigned int temp;int ret; - ret =pm_runtime_get_sync (lpi2c_imx->adapter.dev.parent); + ret =pm_runtime_resume_and_get (lpi2c_imx->adapter.dev.parent);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 491/601 i2c: imx: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 47ff617217ca6a13194fcb35c6c3a0c57c080693 ]
In i2c_imx_xfer() and i2c_imx_remove(), the pm reference count is not expected to be incremented on return.
However, pm_runtime_get_sync will increment pm reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-imx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-imx.c +2 -2
@@ -1208,7 +1208,7 @@ static int i2c_imx_xfer(struct i2c_adapter *adapter,struct imx_i2c_struct *i2c_imx =i2c_get_adapdata (adapter);int result; - result =pm_runtime_get_sync (i2c_imx->adapter.dev.parent); + result =pm_runtime_resume_and_get (i2c_imx->adapter.dev.parent);if (result <0 )return result;
@@ -1451,7 +1451,7 @@ static int i2c_imx_remove(struct platform_device *pdev)struct imx_i2c_struct *i2c_imx =platform_get_drvdata (pdev);int irq, ret; - ret =pm_runtime_get_sync (&pdev->dev); + ret =pm_runtime_resume_and_get (&pdev->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 492/601 i2c: omap: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 780f629741257ed6c54bd3eb53b57f648eabf200 ]
The PM reference count is not expected to be incremented on return in omap_i2c_probe() and omap_i2c_remove().
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here. I Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
What's more, error path 'err_free_mem' seems not like a proper name any more. So I change the name to err_disable_pm and move pm_runtime_disable below, for pm_runtime of 'pdev->dev' should be disabled when pm_runtime_resume_and_get fails.
--- drivers/i2c/busses/i2c-omap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-omap.c +4 -4
@@ -1404,9 +1404,9 @@ omap_i2c_probe(struct platform_device *pdev)pm_runtime_set_autosuspend_delay (omap->dev,OMAP_I2C_PM_TIMEOUT );pm_runtime_use_autosuspend (omap->dev); - r =pm_runtime_get_sync (omap->dev); + r =pm_runtime_resume_and_get (omap->dev);if (r <0 ) - goto err_free_mem; + goto err_disable_pm;/* * Read the Rev hi bit-[15:14] ie scheme this is 1 indicates ver2.
@@ -1513,8 +1513,8 @@ err_unuse_clocks:omap_i2c_write_reg (omap,OMAP_I2C_CON_REG ,0 );pm_runtime_dont_use_autosuspend (omap->dev);pm_runtime_put_sync (omap->dev); +err_disable_pm:pm_runtime_disable (&pdev->dev); -err_free_mem:return r; }
@@ -1525,7 +1525,7 @@ static int omap_i2c_remove(struct platform_device *pdev)int ret;i2c_del_adapter (&omap->adapter); - ret =pm_runtime_get_sync (&pdev->dev); + ret =pm_runtime_resume_and_get (&pdev->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 493/601 i2c: sprd: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 3a4f326463117cee3adcb72999ca34a9aaafda93 ]
The PM reference count is not expected to be incremented on return in sprd_i2c_master_xfer() and sprd_i2c_remove().
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-sprd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-sprd.c +2 -2
@@ -290,7 +290,7 @@ static int sprd_i2c_master_xfer(struct i2c_adapter *i2c_adap,struct sprd_i2c *i2c_dev = i2c_adap->algo_data;int im, ret; - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
@@ -576,7 +576,7 @@ static int sprd_i2c_remove(struct platform_device *pdev)struct sprd_i2c *i2c_dev =platform_get_drvdata (pdev);int ret; - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 494/601 i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 2c662660ce2bd3b09dae21a9a9ac9395e1e6c00b ]
The PM reference count is not expected to be incremented on return in these stm32f7_i2c_xx serious functions.
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-stm32f7.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/i2c/busses/i2c-stm32f7.c +6 -6
@@ -1652,7 +1652,7 @@ static int stm32f7_i2c_xfer(struct i2c_adapter *i2c_adap, i2c_dev->msg_id =0 ; f7_msg->smbus = false; - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
@@ -1698,7 +1698,7 @@ static int stm32f7_i2c_smbus_xfer(struct i2c_adapter *adapter, u16 addr, f7_msg->read_write = read_write; f7_msg->smbus = true; - ret =pm_runtime_get_sync (dev); + ret =pm_runtime_resume_and_get (dev);if (ret <0 )return ret;
@@ -1799,7 +1799,7 @@ static int stm32f7_i2c_reg_slave(struct i2c_client *slave)if (ret)return ret; - ret =pm_runtime_get_sync (dev); + ret =pm_runtime_resume_and_get (dev);if (ret <0 )return ret;
@@ -1880,7 +1880,7 @@ static int stm32f7_i2c_unreg_slave(struct i2c_client *slave)WARN_ON (!i2c_dev->slave[id]); - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
@@ -2277,7 +2277,7 @@ static int stm32f7_i2c_regs_backup(struct stm32f7_i2c_dev *i2c_dev)int ret;struct stm32f7_i2c_regs *backup_regs = &i2c_dev->backup_regs; - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
@@ -2299,7 +2299,7 @@ static int stm32f7_i2c_regs_restore(struct stm32f7_i2c_dev *i2c_dev)int ret;struct stm32f7_i2c_regs *backup_regs = &i2c_dev->backup_regs; - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 495/601 i2c: xiic: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit a85c5c7a3aa8041777ff691400b4046e56149fd3 ]
The PM reference count is not expected to be incremented on return in xiic_xfer and xiic_i2c_remove.
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-xiic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-xiic.c +2 -2
@@ -706,7 +706,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)dev_dbg (adap->dev.parent,"%s entry SR: 0x%x\n" , __func__,xiic_getreg8 (i2c,XIIC_SR_REG_OFFSET )); - err =pm_runtime_get_sync (i2c->dev); + err =pm_runtime_resume_and_get (i2c->dev);if (err <0 )return err;
@@ -873,7 +873,7 @@ static int xiic_i2c_remove(struct platform_device *pdev)/* remove adapter & data */ i2c_del_adapter (&i2c->adap); - ret =pm_runtime_get_sync (i2c->dev); + ret =pm_runtime_resume_and_get (i2c->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 496/601 i2c: cadence: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 5581c2c5d02bc63a0edb53e061c8e97cd490646e ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-cadence.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-cadence.c +4 -1
@@ -1200,7 +1200,10 @@ static int cdns_i2c_probe(struct platform_device *pdev)if (IS_ERR (id->membase))return PTR_ERR (id->membase); - id->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) +return ret; + id->irq = ret; id->adap.owner =THIS_MODULE ; id->adap.dev.of_node = pdev->dev.of_node;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 497/601 i2c: emev2: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit bb6129c32867baa7988f7fd2066cf18ed662d240 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-emev2.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-emev2.c +4 -1
@@ -395,7 +395,10 @@ static int em_i2c_probe(struct platform_device *pdev)em_i2c_reset (&priv->adap); - priv->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) + goto err_clk; + priv->irq = ret; ret =devm_request_irq (&pdev->dev, priv->irq, em_i2c_irq_handler,0 ,"em_i2c" , priv);if (ret)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 498/601 i2c: jz4780: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit c5e5f7a8d931fb4beba245bdbc94734175fda9de ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-jz4780.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-jz4780.c +4 -1
@@ -826,7 +826,10 @@ static int jz4780_i2c_probe(struct platform_device *pdev)jz4780_i2c_writew (i2c,JZ4780_I2C_INTM ,0x0 ); - i2c->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) + goto err; + i2c->irq = ret; ret =devm_request_irq (&pdev->dev, i2c->irq, jz4780_i2c_irq,0 ,dev_name (&pdev->dev), i2c);if (ret)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 499/601 i2c: mlxbf: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 0d3bf53e897dce943b98d975bbde77156af6cd81 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-mlxbf.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/i2c/busses/i2c-mlxbf.c +2 -0
@@ -2376,6 +2376,8 @@ static int mlxbf_i2c_probe(struct platform_device *pdev)mlxbf_i2c_init_slave (pdev, priv); irq =platform_get_irq (pdev,0 ); +if (irq <0 ) +return irq; ret =devm_request_irq (dev, irq, mlxbf_smbus_irq,IRQF_ONESHOT |IRQF_SHARED |IRQF_PROBE_SHARED ,dev_name (dev), priv);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 500/601 i2c: rcar: make sure irq is not threaded on Gen2 and earlier
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 24c6d4bc563881539d2cd4433e502436ad87d512 ]
Ensure this irq runs as fast as possible.
--- drivers/i2c/busses/i2c-rcar.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-rcar.c +5 -1
@@ -928,6 +928,7 @@ static int rcar_i2c_probe(struct platform_device *pdev)struct rcar_i2c_priv *priv;struct i2c_adapter *adap;struct device *dev = &pdev->dev; +unsigned long irqflags =0 ;int ret;/* Otherwise logic will break because some bytes must always use PIO */
@@ -976,6 +977,9 @@ static int rcar_i2c_probe(struct platform_device *pdev)rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ +if (priv->devtype <I2C_RCAR_GEN3 ) + irqflags |=IRQF_NO_THREAD ; +if (priv->devtype ==I2C_RCAR_GEN3 ) { priv->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL );if (!IS_ERR (priv->rstc)) {
@@ -995,7 +999,7 @@ static int rcar_i2c_probe(struct platform_device *pdev) priv->flags |=ID_P_HOST_NOTIFY ; priv->irq =platform_get_irq (pdev,0 ); - ret =devm_request_irq (dev, priv->irq, rcar_i2c_irq,0 ,dev_name (dev), priv); + ret =devm_request_irq (dev, priv->irq, rcar_i2c_irq, irqflags,dev_name (dev), priv);if (ret <0 ) {dev_err (dev,"cannot get irq %d\n" , priv->irq); goto out_pm_disable;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 501/601 i2c: rcar: protect against supurious interrupts on V3U
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 9c975c432bc0aa53a90438fc80b369cb35134a48 ]
V3U creates spurious interrupts which we need to handle. This costs time until BUS_PHASE_DATA can be activated which is problematic for Gen2 SoCs and earlier. Because of this we introduce two interrupt handlers here which will call a generic main irq function once the timing critical stuff is done.
--- drivers/i2c/busses/i2c-rcar.c | 57 ++++++++++++++++++++++++++--------- 1 file changed, 43 insertions(+), 14 deletions(-)
drivers/i2c/busses/i2c-rcar.c +43 -14
@@ -625,20 +625,11 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)* generated. It turned out that taking a spinlock at the beginning of the ISR * was already causing repeated messages. Thus, this driver was converted to * the now lockless behaviour. Please keep this in mind when hacking the driver. +* R-Car Gen3 seems to have this fixed but earlier versions than R-Car Gen2 are +* likely affected. Therefore, we have different interrupt handler entries. */ -static irqreturn_t rcar_i2c_irq (int irq,void *ptr) +static irqreturn_t rcar_i2c_irq (int irq,struct rcar_i2c_priv *priv,u32 msr) { -struct rcar_i2c_priv *priv = ptr; -u32 msr; - -/* Clear START or STOP immediately, except for REPSTART after read */ -if (likely (!(priv->flags &ID_P_REP_AFTER_RD ))) -rcar_i2c_write (priv,ICMCR ,RCAR_BUS_PHASE_DATA ); - - msr =rcar_i2c_read (priv,ICMSR ); - -/* Only handle interrupts that are currently enabled */ - msr &=rcar_i2c_read (priv,ICMIER );if (!msr) {if (rcar_i2c_slave_irq (priv))return IRQ_HANDLED ;
@@ -682,6 +673,41 @@ out:return IRQ_HANDLED ; } +static irqreturn_t rcar_i2c_gen2_irq (int irq,void *ptr) +{ +struct rcar_i2c_priv *priv = ptr; +u32 msr; + +/* Clear START or STOP immediately, except for REPSTART after read */ +if (likely (!(priv->flags &ID_P_REP_AFTER_RD ))) +rcar_i2c_write (priv,ICMCR ,RCAR_BUS_PHASE_DATA ); + +/* Only handle interrupts that are currently enabled */ + msr =rcar_i2c_read (priv,ICMSR ); + msr &=rcar_i2c_read (priv,ICMIER ); + +return rcar_i2c_irq (irq, priv, msr); +} + +static irqreturn_t rcar_i2c_gen3_irq (int irq,void *ptr) +{ +struct rcar_i2c_priv *priv = ptr; +u32 msr; + +/* Only handle interrupts that are currently enabled */ + msr =rcar_i2c_read (priv,ICMSR ); + msr &=rcar_i2c_read (priv,ICMIER ); + +/* +* Clear START or STOP immediately, except for REPSTART after read or +* if a spurious interrupt was detected. +*/ +if (likely (!(priv->flags &ID_P_REP_AFTER_RD ) && msr)) +rcar_i2c_write (priv,ICMCR ,RCAR_BUS_PHASE_DATA ); + +return rcar_i2c_irq (irq, priv, msr); +} +static struct dma_chan *rcar_i2c_request_dma_chan (struct device *dev,enum dma_transfer_direction dir,dma_addr_t port_addr)
@@ -929,6 +955,7 @@ static int rcar_i2c_probe(struct platform_device *pdev)struct i2c_adapter *adap;struct device *dev = &pdev->dev;unsigned long irqflags =0 ; +irqreturn_t (*irqhandler)(int irq,void *ptr) = rcar_i2c_gen3_irq;int ret;/* Otherwise logic will break because some bytes must always use PIO */
@@ -977,8 +1004,10 @@ static int rcar_i2c_probe(struct platform_device *pdev)rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ -if (priv->devtype <I2C_RCAR_GEN3 ) +if (priv->devtype <I2C_RCAR_GEN3 ) { irqflags |=IRQF_NO_THREAD ; + irqhandler = rcar_i2c_gen2_irq; + }if (priv->devtype ==I2C_RCAR_GEN3 ) { priv->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL );
@@ -999,7 +1028,7 @@ static int rcar_i2c_probe(struct platform_device *pdev) priv->flags |=ID_P_HOST_NOTIFY ; priv->irq =platform_get_irq (pdev,0 ); - ret =devm_request_irq (dev, priv->irq, rcar_i2c_irq, irqflags,dev_name (dev), priv); + ret =devm_request_irq (dev, priv->irq, irqhandler, irqflags,dev_name (dev), priv);if (ret <0 ) {dev_err (dev,"cannot get irq %d\n" , priv->irq); goto out_pm_disable;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 502/601 i2c: rcar: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 147178cf03a6dcb337e703d4dacd008683022a58 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with the invalid IRQ #s.
--- drivers/i2c/busses/i2c-rcar.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-rcar.c +4 -1
@@ -1027,7 +1027,10 @@ static int rcar_i2c_probe(struct platform_device *pdev)if (of_property_read_bool (dev->of_node,"smbus" )) priv->flags |=ID_P_HOST_NOTIFY ; - priv->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) + goto out_pm_disable; + priv->irq = ret; ret =devm_request_irq (dev, priv->irq, irqhandler, irqflags,dev_name (dev), priv);if (ret <0 ) {dev_err (dev,"cannot get irq %d\n" , priv->irq);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 503/601 i2c: sh7760: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit e5b2e3e742015dd2aa6bc7bcef2cb59b2de1221c ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-sh7760.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-sh7760.c +4 -1
@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev) goto out2; } - id->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) +return ret; + id->irq = ret; id->adap.nr = pdev->id; id->adap.algo = &sh7760_i2c_algo;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 504/601 iwlwifi: rs-fw: dont support stbc for HE 160
In reply to Greg Kroah-HartmanFrom: Mordechay Goodstein <[email protected]>
[ Upstream commit a9174578262b86f15cb1882f35e53b1fae0649fd ]
Our HE doesn't support it so never set HE 160 stbc
--- .../net/wireless/intel/iwlwifi/mvm/rs-fw.c | 20 ++++++++----------- 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c +8 -12
@@ -1,7 +1,7 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* * Copyright (C) 2017 Intel Deutschland GmbH -* Copyright (C) 2018-2020 Intel Corporation +* Copyright (C) 2018-2021 Intel Corporation */ #include "rs.h" #include "fw-api.h"
@@ -72,19 +72,15 @@ static u16 rs_fw_get_config_flags(struct iwl_mvm *mvm,bool vht_ena = vht_cap->vht_supported;u16 flags =0 ; +/* get STBC flags */ if (mvm->cfg->ht_params->stbc && (num_of_ant (iwl_mvm_get_valid_tx_ant (mvm)) >1 )) { -if (he_cap->has_he) { -if (he_cap->he_cap_elem.phy_cap_info[2 ] & -IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ ) - flags |=IWL_TLC_MNG_CFG_FLAGS_STBC_MSK ; - -if (he_cap->he_cap_elem.phy_cap_info[7 ] & -IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ ) - flags |=IWL_TLC_MNG_CFG_FLAGS_HE_STBC_160MHZ_MSK ; - }else if ((ht_cap->cap &IEEE80211_HT_CAP_RX_STBC ) || - (vht_ena && - (vht_cap->cap &IEEE80211_VHT_CAP_RXSTBC_MASK ))) +if (he_cap->has_he && he_cap->he_cap_elem.phy_cap_info[2 ] & +IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ ) + flags |=IWL_TLC_MNG_CFG_FLAGS_STBC_MSK ; +else if (vht_cap->cap &IEEE80211_VHT_CAP_RXSTBC_MASK ) + flags |=IWL_TLC_MNG_CFG_FLAGS_STBC_MSK ; +else if (ht_cap->cap &IEEE80211_HT_CAP_RX_STBC ) flags |=IWL_TLC_MNG_CFG_FLAGS_STBC_MSK ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 505/601 iwlwifi: dbg: disable ini debug in 9000 family and below
In reply to Greg Kroah-HartmanFrom: Mukesh Sisodiya <[email protected]>
[ Upstream commit 7c81a025054cd0aeeeaf17aba2e9757f0a6a38a1 ]
Yoyo based debug is not applicable to old devices. As init debug is enabled by default in the driver, it needs to be disabled to work the old debug mechanism in old devices.
--- drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +3 -2
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* -* Copyright (C) 2018-2020 Intel Corporation +* Copyright (C) 2018-2021 Intel Corporation */ #include <linux/firmware.h> #include "iwl-drv.h"
@@ -424,7 +424,8 @@ void iwl_dbg_tlv_load_bin(struct device *dev, struct iwl_trans *trans)const struct firmware *fw;int res; -if (!iwlwifi_mod_params.enable_ini) +if (!iwlwifi_mod_params.enable_ini || + trans->trans_cfg->device_family <=IWL_DEVICE_FAMILY_9000 )return ; res =firmware_request_nowarn (&fw,"iwl-debug-yoyo.bin" , dev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 506/601 powerpc/xive: Drop check on irq_data in xive_core_debug_show()
In reply to Greg Kroah-HartmanFrom: Cédric Le Goater <[email protected]>
[ Upstream commit a74ce5926b20cd0e6d624a9b2527073a96dfed7f ]
When looping on IRQ descriptor, irq_data is always valid.
--- arch/powerpc/sysdev/xive/common.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-)
arch/powerpc/sysdev/xive/common.c +10 -11
@@ -1599,6 +1599,8 @@ static void xive_debug_show_irq(struct seq_file *m, u32 hw_irq, struct irq_datau32 target;u8 prio;u32 lirq; +struct xive_irq_data *xd; +u64 val;if (!is_xive_irq (chip))return ;
@@ -1612,17 +1614,14 @@ static void xive_debug_show_irq(struct seq_file *m, u32 hw_irq, struct irq_dataseq_printf (m,"IRQ 0x%08x : target=0x%x prio=%02x lirq=0x%x " , hw_irq, target, prio, lirq); -if (d) { -struct xive_irq_data *xd =irq_data_get_irq_handler_data (d); -u64 val =xive_esb_read (xd,XIVE_ESB_GET ); - -seq_printf (m,"flags=%c%c%c PQ=%c%c" , - xd->flags &XIVE_IRQ_FLAG_STORE_EOI ?'S' :' ' , - xd->flags &XIVE_IRQ_FLAG_LSI ?'L' :' ' , - xd->flags &XIVE_IRQ_FLAG_H_INT_ESB ?'H' :' ' , - val &XIVE_ESB_VAL_P ?'P' :'-' , - val &XIVE_ESB_VAL_Q ?'Q' :'-' ); - } + xd =irq_data_get_irq_handler_data (d); + val =xive_esb_read (xd,XIVE_ESB_GET ); +seq_printf (m,"flags=%c%c%c PQ=%c%c" , + xd->flags &XIVE_IRQ_FLAG_STORE_EOI ?'S' :' ' , + xd->flags &XIVE_IRQ_FLAG_LSI ?'L' :' ' , + xd->flags &XIVE_IRQ_FLAG_H_INT_ESB ?'H' :' ' , + val &XIVE_ESB_VAL_P ?'P' :'-' , + val &XIVE_ESB_VAL_Q ?'Q' :'-' );seq_puts (m,"\n" ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 507/601 powerpc/xive: Fix xmon command "dxi"
In reply to Greg Kroah-HartmanFrom: Cédric Le Goater <[email protected]>
[ Upstream commit 33e4bc5946432a4ac173fd08e8e30a13ab94d06d ]
When under xmon, the "dxi" command dumps the state of the XIVE interrupts. If an interrupt number is specified, only the state of the associated XIVE interrupt is dumped. This form of the command lacks an irq_data parameter which is nevertheless used by xmon_xive_get_irq_config(), leading to an xmon crash.
Fix that by doing a lookup in the system IRQ mapping to query the IRQ descriptor data. Invalid interrupt numbers, or not belonging to the XIVE IRQ domain, OPAL event interrupt number for instance, should be caught by the previous query done at the firmware level.
--- arch/powerpc/sysdev/xive/common.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
arch/powerpc/sysdev/xive/common.c +10 -4
@@ -253,17 +253,20 @@ notrace void xmon_xive_do_dump(int cpu)xmon_printf ("\n" ); } +static struct irq_data *xive_get_irq_data (u32 hw_irq) +{ +unsigned int irq =irq_find_mapping (xive_irq_domain, hw_irq); + +return irq ?irq_get_irq_data (irq) :NULL ; +} +int xmon_xive_get_irq_config (u32 hw_irq,struct irq_data *d) { -struct irq_chip *chip =irq_data_get_irq_chip (d);int rc;u32 target;u8 prio;u32 lirq; -if (!is_xive_irq (chip)) -return -EINVAL ; - rc = xive_ops->get_irq_config (hw_irq, &target, &prio, &lirq);if (rc) {xmon_printf ("IRQ 0x%08x : no config rc=%d\n" , hw_irq, rc);
@@ -273,6 +276,9 @@ int xmon_xive_get_irq_config(u32 hw_irq, struct irq_data *d)xmon_printf ("IRQ 0x%08x : target=0x%x prio=%02x lirq=0x%x " , hw_irq, target, prio, lirq); +if (!d) + d =xive_get_irq_data (hw_irq); +if (d) {struct xive_irq_data *xd =irq_data_get_irq_handler_data (d);u64 val =xive_esb_read (xd,XIVE_ESB_GET );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 508/601 powerpc/syscall: Rename syscall_64.c into interrupt.c
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit ab1a517d55b01b54ba70f5d54f926f5ab4b18339 ]
syscall_64.c will be reused almost as is for PPC32.
As this file also contains functions to handle other types of interrupts rename it interrupt.c
---
arch/powerpc/kernel/Makefile | 2 +-
arch/powerpc/kernel/{syscall_64.c => interrupt.c} | 0
2 files changed, 1 insertion(+), 1 deletion(-)
rename arch/powerpc/kernel/{syscall_64.c => interrupt.c} (100%)arch/powerpc/kernel/Makefile +1 -1
@@ -49,7 +49,7 @@ obj-y := cputable.o syscalls.o \ hw_breakpoint_constraints.o obj-y += ptrace/ obj-$(CONFIG_PPC64) += setup_64.o \ - paca.o nvram_64.o note.o syscall_64.o + paca.o nvram_64.o note.o interrupt.o obj-$(CONFIG_COMPAT) += sys_ppc32.o signal_32.o obj-$(CONFIG_VDSO32) += vdso32_wrapper.o obj-$(CONFIG_PPC_WATCHDOG) += watchdog.o
arch/powerpc/kernel/interrupt.c renamed from arch/powerpc/kernel/syscall_64.c +0 -0
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 509/601 powerpc/syscall: Change condition to check MSR_RI
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit c01b916658150e98f00a4981750c37a3224c8735 ]
In system_call_exception(), MSR_RI also needs to be checked on 8xx. Only booke and 40x doesn't have MSR_RI.
--- arch/powerpc/kernel/interrupt.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/powerpc/kernel/interrupt.c +4 -3
@@ -29,7 +29,7 @@ notrace long system_call_exception(long r3, long r4, long r5,trace_hardirqs_off ();/* finish reconciling */ -if (IS_ENABLED (CONFIG_PPC_BOOK3S )) +if (!IS_ENABLED (CONFIG_BOOKE ) && !IS_ENABLED (CONFIG_40x))BUG_ON (!(regs->msr &MSR_RI ));BUG_ON (!(regs->msr &MSR_PR ));BUG_ON (!FULL_REGS (regs));
@@ -289,7 +289,7 @@ notrace unsigned long interrupt_exit_user_prepare(struct pt_regs *regs, unsignedunsigned long flags;unsigned long ret =0 ; -if (IS_ENABLED (CONFIG_PPC_BOOK3S )) +if (!IS_ENABLED (CONFIG_BOOKE ) && !IS_ENABLED (CONFIG_40x))BUG_ON (!(regs->msr &MSR_RI ));BUG_ON (!(regs->msr &MSR_PR ));BUG_ON (!FULL_REGS (regs));
@@ -377,7 +377,8 @@ notrace unsigned long interrupt_exit_kernel_prepare(struct pt_regs *regs, unsignunsigned long ret =0 ;unsigned long amr; -if (IS_ENABLED (CONFIG_PPC_BOOK3S ) &&unlikely (!(regs->msr &MSR_RI ))) +if (!IS_ENABLED (CONFIG_BOOKE ) && !IS_ENABLED (CONFIG_40x) && +unlikely (!(regs->msr &MSR_RI )))unrecoverable_exception (regs);BUG_ON (regs->msr &MSR_PR );BUG_ON (!FULL_REGS (regs));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 510/601 ASoC: ak5558: correct reset polarity
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit 0b93bbc977af55fd10687f2c96c807cba95cb927 ]
Reset (aka power off) happens when the reset gpio is made active. The reset gpio is GPIO_ACTIVE_LOW
--- sound/soc/codecs/ak5558.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/ak5558.c +2 -2
@@ -272,7 +272,7 @@ static void ak5558_power_off(struct ak5558_priv *ak5558)if (!ak5558->reset_gpiod)return ; -gpiod_set_value_cansleep (ak5558->reset_gpiod,0 ); +gpiod_set_value_cansleep (ak5558->reset_gpiod,1 );usleep_range (1000 ,2000 ); }
@@ -281,7 +281,7 @@ static void ak5558_power_on(struct ak5558_priv *ak5558)if (!ak5558->reset_gpiod)return ; -gpiod_set_value_cansleep (ak5558->reset_gpiod,1 ); +gpiod_set_value_cansleep (ak5558->reset_gpiod,0 );usleep_range (1000 ,2000 ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 511/601 net/mlx5: Fix bit-wise and with zero
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 82c3ba31c370b6001cbf90689e98da1fb6f26aef ]
The bit-wise and of the action field with MLX5_ACCEL_ESP_ACTION_DECRYPT is incorrect as MLX5_ACCEL_ESP_ACTION_DECRYPT is zero and not intended to be a bit-flag. Fix this by using the == operator as was originally intended.
Addresses-Coverity: ("Logically dead code")
--- drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c +1 -1
@@ -850,7 +850,7 @@ mlx5_fpga_ipsec_release_sa_ctx(struct mlx5_fpga_ipsec_sa_ctx *sa_ctx)return ; } -if (sa_ctx->fpga_xfrm->accel_xfrm.attrs.action & +if (sa_ctx->fpga_xfrm->accel_xfrm.attrs.action ==MLX5_ACCEL_ESP_ACTION_DECRYPT )ida_simple_remove (&fipsec->halloc, sa_ctx->sa_handle);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 512/601 net/packet: remove data races in fanout operations
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 94f633ea8ade8418634d152ad0931133338226f6 ]
af_packet fanout uses RCU rules to ensure f->arr elements are not dismantled before RCU grace period.
However, it lacks rcu accessors to make sure KCSAN and other tools wont detect data races. Stupid compilers could also play games.
--- net/packet/af_packet.c | 15 +++++++++------ net/packet/internal.h | 2 +- 2 files changed, 10 insertions(+), 7 deletions(-)
net/packet/af_packet.c +9 -6
@@ -1359,7 +1359,7 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f,struct packet_sock *po, *po_next, *po_skip =NULL ;unsigned int i, j, room =ROOM_NONE ; - po =pkt_sk (f->arr[idx]); + po =pkt_sk (rcu_dereference (f->arr[idx]));if (try_self) { room =packet_rcv_has_room (po, skb);
@@ -1371,7 +1371,7 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f, i = j =min_t (int, po->rollover->sock, num -1 ); do { - po_next = pkt_sk(f->arr[i]); + po_next = pkt_sk(rcu_dereference(f->arr[i])); if (po_next != po_skip && !READ_ONCE(po_next->pressure) && packet_rcv_has_room(po_next, skb) == ROOM_NORMAL) { if (i != j)
@@ -1466,7 +1466,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,if (fanout_has_flag (f,PACKET_FANOUT_FLAG_ROLLOVER )) idx =fanout_demux_rollover (f, skb, idx, true, num); - po =pkt_sk (f->arr[idx]); + po =pkt_sk (rcu_dereference (f->arr[idx]));return po->prot_hook.func (skb, dev, &po->prot_hook, orig_dev); }
@@ -1480,7 +1480,7 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po)struct packet_fanout *f = po->fanout;spin_lock (&f->lock); - f->arr[f->num_members] = sk; +rcu_assign_pointer (f->arr[f->num_members], sk);smp_wmb (); f->num_members++;if (f->num_members ==1 )
@@ -1495,11 +1495,14 @@ static void __fanout_unlink(struct sock *sk, struct packet_sock *po)spin_lock (&f->lock);for (i =0 ; i < f->num_members; i++) { -if (f->arr[i] == sk) +if (rcu_dereference_protected (f->arr[i], +lockdep_is_held (&f->lock)) == sk)break ; }BUG_ON (i >= f->num_members); - f->arr[i] = f->arr[f->num_members -1 ]; +rcu_assign_pointer (f->arr[i], +rcu_dereference_protected (f->arr[f->num_members -1 ], +lockdep_is_held (&f->lock))); f->num_members--;if (f->num_members ==0 )__dev_remove_pack (&f->prot_hook);
net/packet/internal.h +1 -1
@@ -94,7 +94,7 @@ struct packet_fanout {spinlock_t lock;refcount_t sk_ref;struct packet_type prot_hook____cacheline_aligned_in_smp ; -struct sock *arr[]; +struct sock __rcu *arr[]; };struct packet_rollover {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 513/601 drm/i915/gvt: Fix error code in intel_gvt_init_device()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 329328ec6a87f2c1275f50d979d55513de458409 ]
The intel_gvt_init_vgpu_type_groups() function is only called from intel_gvt_init_device(). If it fails then the intel_gvt_init_device() prints the error code and propagates it back again. That's a bug because false is zero/success. The fix is to modify it to return zero or negative error codes and make everything consistent.
--- drivers/gpu/drm/i915/gvt/gvt.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/gvt/gvt.c +4 -4
@@ -126,7 +126,7 @@ static bool intel_get_gvt_attrs(struct attribute_group ***intel_vgpu_type_groupsreturn true; } -static bool intel_gvt_init_vgpu_type_groups (struct intel_gvt *gvt) +static int intel_gvt_init_vgpu_type_groups (struct intel_gvt *gvt) {int i, j;struct intel_vgpu_type *type;
@@ -144,7 +144,7 @@ static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt) gvt_vgpu_type_groups[i] = group; } -return true; +return 0 ; unwind:for (j =0 ; j < i; j++) {
@@ -152,7 +152,7 @@ unwind:kfree (group); } -return false; +return -ENOMEM ; }static void intel_gvt_cleanup_vgpu_type_groups (struct intel_gvt *gvt)
@@ -360,7 +360,7 @@ int intel_gvt_init_device(struct drm_i915_private *i915) goto out_clean_thread; ret =intel_gvt_init_vgpu_type_groups (gvt); -if (ret == false) { +if (ret) {gvt_err ("failed to init vgpu type groups: %d\n" , ret); goto out_clean_types; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 514/601 iommu/amd: Put newline after closing bracket in warning
In reply to Greg Kroah-HartmanFrom: Paul Menzel <[email protected]>
[ Upstream commit 304c73ba69459d4c18c2a4b843be6f5777b4b85c ]
Currently, on the Dell OptiPlex 5055 the EFR mismatch warning looks like below.
[ 1.479774] smpboot: CPU0: AMD Ryzen 5 PRO 1500 Quad-Core Processor (family: 0x17, model: 0x1, stepping: 0x1)
[…]
[ 2.507370] AMD-Vi: [Firmware Warn]: EFR mismatch. Use IVHD EFR (0xf77ef22294ada : 0x400f77ef22294ada
).Add the newline after the )., so it’s on one line.
--- drivers/iommu/amd/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd/init.c +1 -1
@@ -1835,7 +1835,7 @@ static void __init late_iommu_features_init(struct amd_iommu *iommu)* IVHD and MMIO conflict. */ if (features != iommu->features) -pr_warn (FW_WARN "EFR mismatch. Use IVHD EFR (%#llx : %#llx\n)." , +pr_warn (FW_WARN "EFR mismatch. Use IVHD EFR (%#llx : %#llx).\n" , features, iommu->features); }
Signature · 8 lines
2.30.2 _______________________________________________ iommu mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/iommu
Greg Kroah-Hartman
maintainerPATCH 515/601 perf beauty: Fix fsconfig generator
In reply to Greg Kroah-HartmanFrom: Vitaly Chikunov <[email protected]>
[ Upstream commit 2e1daee14e67fbf9b27280b974e2c680a22cabea ]
After gnulib update sed stopped matching `[[:space:]]*+' as before, causing the following compilation error:
In file included from builtin-trace.c:719:
trace/beauty/generated/fsconfig_arrays.c:2:3: error: expected expression before ']' token
2 | [] = "", | ^
trace/beauty/generated/fsconfig_arrays.c:2:3: error: array index in initializer not of integer type trace/beauty/generated/fsconfig_arrays.c:2:3: note: (near initialization for 'fsconfig_cmds')
Fix this by correcting the regular expression used in the generator. Also, clean up the script by removing redundant egrep, xargs, and printf invocations.
Committer testing:
Continues to work:
$ cat tools/perf/trace/beauty/fsconfig.sh #!/bin/sh # SPDX-License-Identifier: LGPL-2.1
if [ $# -ne 1 ] ; then
linux_header_dir=tools/include/uapi/linux
else
linux_header_dir=$1
fi
linux_mount=${linux_header_dir}/mount.h
printf "static const char *fsconfig_cmds[] = {\n"
ms='[[:space:]]*'
sed -nr "s/^${ms}FSCONFIG_([[:alnum:]_]+)${ms}=${ms}([[:digit:]]+)${ms},.*/\t[\2] = \"\1\",/p" \
${linux_mount}
printf "};\n"
$ tools/perf/trace/beauty/fsconfig.sh
static const char *fsconfig_cmds[] = {
[0] = "SET_FLAG",
[1] = "SET_STRING",
[2] = "SET_BINARY",
[3] = "SET_PATH",
[4] = "SET_PATH_EMPTY",
[5] = "SET_FD",
[6] = "CMD_CREATE",
[7] = "CMD_RECONFIGURE",
};
$--- tools/perf/trace/beauty/fsconfig.sh | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
tools/perf/trace/beauty/fsconfig.sh +3 -4
@@ -10,8 +10,7 @@ fi linux_mount=${linux_header_dir}/mount.h printf "static const char *fsconfig_cmds[] = {\n" -regex='^[[:space:]]*+FSCONFIG_([[:alnum:]_]+)[[:space:]]*=[[:space:]]*([[:digit:]]+)[[:space:]]*,[[:space:]]*.*' -egrep $regex ${linux_mount} | \ - sed -r "s/$regex/\2 \1/g" | \ - xargs printf "\t[%s] = \"%s\",\n" +ms='[[:space:]]*' +sed -nr "s/^${ms}FSCONFIG_([[:alnum:]_]+)${ms}=${ms}([[:digit:]]+)${ms},.*/\t[\2] = \"\1\",/p" \ + ${linux_mount} printf "};\n"
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 516/601 drm/amdgpu: fix an error code in init_pmu_entry_by_type_and_add()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 90cb3d8aca1baea9471d28f28d5de1528dd5e424 ]
If the kmemdup() fails then this should return a negative error code but it currently returns success
--- drivers/gpu/drm/amd/amdgpu/amdgpu_pmu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_pmu.c +3 -1
@@ -519,8 +519,10 @@ static int init_pmu_entry_by_type_and_add(struct amdgpu_pmu_entry *pmu_entry, pmu_entry->pmu.attr_groups =kmemdup (attr_groups,sizeof (attr_groups),GFP_KERNEL ); -if (!pmu_entry->pmu.attr_groups) +if (!pmu_entry->pmu.attr_groups) { + ret = -ENOMEM ; goto err_attr_group; + }snprintf (pmu_name,PMU_NAME_SIZE ,"%s_%d" , pmu_entry->pmu_file_prefix,adev_to_drm (pmu_entry->adev)->primary->index);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 517/601 drm/amd/pm: fix error code in smu_set_power_limit()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit bbdfe5aaef3c1d5c5e62fa235ef13f064e4c1c17 ]
We should return -EINVAL instead of success if the "limit" is too high.
--- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +1 -0
@@ -1931,6 +1931,7 @@ int smu_set_power_limit(struct smu_context *smu, uint32_t limit)dev_err (smu->adev->dev,"New power limit (%d) is over the max allowed %d\n" , limit, smu->max_power_limit); + ret = -EINVAL ; goto out; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 518/601 MIPS: pci-legacy: stop using of_pci_range_to_resource
In reply to Greg Kroah-HartmanFrom: Ilya Lipnitskiy <[email protected]>
[ Upstream commit 3ecb9dc1581eebecaee56decac70e35365260866 ]
Mirror commit aeba3731b150 ("powerpc/pci: Fix IO space breakage after of_pci_range_to_resource() change").
Most MIPS platforms do not define PCI_IOBASE, nor implement pci_address_to_pio(). Moreover, IO_SPACE_LIMIT is 0xffff for most MIPS platforms. of_pci_range_to_resource passes the _start address_ of the IO range into pci_address_to_pio, which then checks it against IO_SPACE_LIMIT and fails, because for MIPS platforms that use pci-legacy (pci-lantiq, pci-rt3883, pci-mt7620), IO ranges start much higher than 0xffff.
In fact, pci-mt7621 in staging already works around this problem, see commit 09dd629eeabb ("staging: mt7621-pci: fix io space and properly set resource limits")
So just stop using of_pci_range_to_resource, which does not work for MIPS.
Fixes PCI errors like:
pci_bus 0000:00: root bus resource [io 0xffffffff]
--- arch/mips/pci/pci-legacy.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/mips/pci/pci-legacy.c +7 -2
@@ -166,8 +166,13 @@ void pci_load_of_ranges(struct pci_controller *hose, struct device_node *node) res = hose->mem_resource;break ; } -if (res !=NULL ) -of_pci_range_to_resource (&range, node, res); +if (res !=NULL ) { + res->name = node->full_name; + res->flags = range.flags; + res->start = range.cpu_addr; + res->end = range.cpu_addr + range.size -1 ; + res->parent = res->child = res->sibling =NULL ; + } } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 519/601 powerpc/pseries: extract host bridge from pci_bus prior to bus removal
In reply to Greg Kroah-HartmanFrom: Tyrel Datwyler <[email protected]>
[ Upstream commit 38d0b1c9cec71e6d0f3bddef0bbce41d05a3e796 ]
The pci_bus->bridge reference may no longer be valid after pci_bus_remove() resulting in passing a bad value to device_unregister() for the associated bridge device.
Store the host_bridge reference in a separate variable prior to pci_bus_remove().
--- arch/powerpc/platforms/pseries/pci_dlpar.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/platforms/pseries/pci_dlpar.c +3 -1
@@ -50,6 +50,7 @@ EXPORT_SYMBOL_GPL(init_phb_dynamic);int remove_phb_dynamic (struct pci_controller *phb) {struct pci_bus *b = phb->bus; +struct pci_host_bridge *host_bridge =to_pci_host_bridge (b->bridge);struct resource *res;int rc, i;
@@ -76,7 +77,8 @@ int remove_phb_dynamic(struct pci_controller *phb)/* Remove the PCI bus and unregister the bridge device from sysfs */ phb->bus =NULL ;pci_remove_bus (b); -device_unregister (b->bridge); + host_bridge->bus =NULL ; +device_unregister (&host_bridge->dev);/* Now release the IO resource */ if (res->flags &IORESOURCE_IO )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 520/601 mptcp: fix format specifiers for unsigned int
In reply to Greg Kroah-HartmanFrom: Geliang Tang <[email protected]>
[ Upstream commit e4b6135134a75f530bd634ea7c168efaf0f9dff3 ]
Some of the sequence numbers are printed as the negative ones in the debug log:
[ 46.250932] MPTCP: DSS [ 46.250940] MPTCP: data_fin=0 dsn64=0 use_map=0 ack64=1 use_ack=1 [ 46.250948] MPTCP: data_ack=2344892449471675613 [ 46.251012] MPTCP: msk=000000006e157e3f status=10 [ 46.251023] MPTCP: msk=000000006e157e3f snd_data_fin_enable=0 pending=0 snd_nxt=2344892449471700189 write_seq=2344892449471700189 [ 46.251343] MPTCP: msk=00000000ec44a129 ssk=00000000f7abd481 sending dfrag at seq=-1658937016627538668 len=100 already sent=0 [ 46.251360] MPTCP: data_seq=16787807057082012948 subflow_seq=1 data_len=100 dsn64=1
This patch used the format specifier %u instead of %d for the unsigned int values to fix it.
--- net/mptcp/protocol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mptcp/protocol.c +2 -2
@@ -1258,7 +1258,7 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk,int avail_size;size_t ret =0 ; -pr_debug ("msk=%p ssk=%p sending dfrag at seq=%lld len=%d already sent=%d" , +pr_debug ("msk=%p ssk=%p sending dfrag at seq=%llu len=%u already sent=%u" , msk, ssk, dfrag->data_seq, dfrag->data_len, info->sent);/* compute send limit */
@@ -1671,7 +1671,7 @@ static int mptcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)if (!msk->first_pending)WRITE_ONCE (msk->first_pending, dfrag); } -pr_debug ("msk=%p dfrag at seq=%lld len=%d sent=%d new=%d" , msk, +pr_debug ("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d" , msk, dfrag->data_seq, dfrag->data_len, dfrag->already_sent, !dfrag_collapsed);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 521/601 powerpc/smp: Reintroduce cpu_core_mask
In reply to Greg Kroah-HartmanFrom: Srikar Dronamraju <[email protected]>
[ Upstream commit c47f892d7aa62765bf0689073f75990b4517a4cf ]
Daniel reported that with Commit 4ca234a9cbd7 ("powerpc/smp: Stop updating cpu_core_mask") QEMU was unable to set single NUMA node SMP topologies such as:
-smp 8,maxcpus=8,cores=2,threads=2,sockets=2
i.e he expected 2 sockets in one NUMA node.
The above commit helped to reduce boot time on Large Systems for example 4096 vCPU single socket QEMU instance. PAPR is silent on having more than one socket within a NUMA node.
cpu_core_mask and cpu_cpu_mask for any CPU would be same unless the number of sockets is different from the number of NUMA nodes.
One option is to reintroduce cpu_core_mask but use a slightly different method to arrive at the cpu_core_mask. Previously each CPU's chip-id would be compared with all other CPU's chip-id to verify if both the CPUs were related at the chip level. Now if a CPU 'A' is found related / (unrelated) to another CPU 'B', all the thread siblings of 'A' and thread siblings of 'B' are automatically marked as related / (unrelated).
Also if a platform doesn't support ibm,chip-id property, i.e its cpu_to_chip_id returns -1, cpu_core_map holds a copy of cpu_cpu_mask().
--- arch/powerpc/include/asm/smp.h | 5 +++++ arch/powerpc/kernel/smp.c | 39 ++++++++++++++++++++++++++++------ 2 files changed, 37 insertions(+), 7 deletions(-)
arch/powerpc/include/asm/smp.h +5 -0
@@ -121,6 +121,11 @@ static inline struct cpumask *cpu_sibling_mask(int cpu)return per_cpu (cpu_sibling_map, cpu); } +static inline struct cpumask *cpu_core_mask (int cpu) +{ +return per_cpu (cpu_core_map, cpu); +} +static inline struct cpumask *cpu_l2_cache_mask (int cpu) {return per_cpu (cpu_l2_cache_map, cpu);
arch/powerpc/kernel/smp.c +32 -7
@@ -1056,17 +1056,12 @@ void __init smp_prepare_cpus(unsigned int max_cpus) local_memory_node(numa_cpu_lookup_table[cpu])); }#endif -/* -* cpu_core_map is now more updated and exists only since -* its been exported for long. It only will have a snapshot -* of cpu_cpu_mask. -*/ -cpumask_copy (per_cpu (cpu_core_map, cpu),cpu_cpu_mask (cpu)); }/* Init the cpumasks so the boot CPU is related to itself */ cpumask_set_cpu (boot_cpuid,cpu_sibling_mask (boot_cpuid));cpumask_set_cpu (boot_cpuid,cpu_l2_cache_mask (boot_cpuid)); +cpumask_set_cpu (boot_cpuid,cpu_core_mask (boot_cpuid));if (has_coregroup_support ())cpumask_set_cpu (boot_cpuid,cpu_coregroup_mask (boot_cpuid));
@@ -1407,6 +1402,9 @@ static void remove_cpu_from_masks(int cpu)set_cpus_unrelated (cpu, i, cpu_smallcore_mask); } +for_each_cpu (i,cpu_core_mask (cpu)) +set_cpus_unrelated (cpu, i, cpu_core_mask); +if (has_coregroup_support ()) {for_each_cpu (i,cpu_coregroup_mask (cpu))set_cpus_unrelated (cpu, i, cpu_coregroup_mask);
@@ -1467,8 +1465,11 @@ static void update_coregroup_mask(int cpu, cpumask_var_t *mask)static void add_cpu_to_masks (int cpu) { +struct cpumask *(*submask_fn)(int ) = cpu_sibling_mask;int first_thread =cpu_first_thread_sibling (cpu); +int chip_id =cpu_to_chip_id (cpu);cpumask_var_t mask; +bool ret;int i;/*
@@ -1484,12 +1485,36 @@ static void add_cpu_to_masks(int cpu)add_cpu_to_smallcore_masks (cpu);/* In CPU-hotplug path, hence use GFP_ATOMIC */ -alloc_cpumask_var_node (&mask,GFP_ATOMIC ,cpu_to_node (cpu)); + ret =alloc_cpumask_var_node (&mask,GFP_ATOMIC ,cpu_to_node (cpu));update_mask_by_l2 (cpu, &mask);if (has_coregroup_support ())update_coregroup_mask (cpu, &mask); +if (chip_id ==-1 || !ret) { +cpumask_copy (per_cpu (cpu_core_map, cpu),cpu_cpu_mask (cpu)); + goto out; + } + +if (shared_caches) + submask_fn = cpu_l2_cache_mask; + +/* Update core_mask with all the CPUs that are part of submask */ +or_cpumasks_related (cpu, cpu, submask_fn, cpu_core_mask); + +/* Skip all CPUs already part of current CPU core mask */ +cpumask_andnot (mask, cpu_online_mask,cpu_core_mask (cpu)); + +for_each_cpu (i, mask) { +if (chip_id ==cpu_to_chip_id (i)) { +or_cpumasks_related (cpu, i, submask_fn, cpu_core_mask); +cpumask_andnot (mask, mask,submask_fn (i)); + }else { +cpumask_andnot (mask, mask,cpu_core_mask (i)); + } + } + +out:free_cpumask_var (mask); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 522/601 KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid
In reply to Greg Kroah-HartmanFrom: David Edmondson <[email protected]>
[ Upstream commit d9e46d344e62a0d56fd86a8289db5bed8a57c92e ]
If the VM entry/exit controls for loading/saving MSR_EFER are either not available (an older processor or explicitly disabled) or not used (host and guest values are the same), reading GUEST_IA32_EFER from the VMCS returns an inaccurate value.
Because of this, in dump_vmcs() don't use GUEST_IA32_EFER to decide whether to print the PDPTRs - always do so if the fields exist.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
arch/x86/kvm/vmx/vmx.c +3 -6
@@ -5759,7 +5759,6 @@ void dump_vmcs(void)u32 vmentry_ctl, vmexit_ctl;u32 cpu_based_exec_ctrl, pin_based_exec_ctrl, secondary_exec_control;unsigned long cr4; -u64 efer;if (!dump_invalid_vmcs) {pr_warn_ratelimited ("set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.\n" );
@@ -5771,7 +5770,6 @@ void dump_vmcs(void) cpu_based_exec_ctrl =vmcs_read32 (CPU_BASED_VM_EXEC_CONTROL ); pin_based_exec_ctrl =vmcs_read32 (PIN_BASED_VM_EXEC_CONTROL ); cr4 =vmcs_readl (GUEST_CR4 ); - efer =vmcs_read64 (GUEST_IA32_EFER ); secondary_exec_control =0 ;if (cpu_has_secondary_exec_ctrls ()) secondary_exec_control =vmcs_read32 (SECONDARY_VM_EXEC_CONTROL );
@@ -5783,9 +5781,7 @@ void dump_vmcs(void)pr_err ("CR4: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n" , cr4,vmcs_readl (CR4_READ_SHADOW ),vmcs_readl (CR4_GUEST_HOST_MASK ));pr_err ("CR3 = 0x%016lx\n" ,vmcs_readl (GUEST_CR3 )); -if ((secondary_exec_control &SECONDARY_EXEC_ENABLE_EPT ) && - (cr4 &X86_CR4_PAE ) && !(efer &EFER_LMA )) - { +if (cpu_has_vmx_ept ()) {pr_err ("PDPTR0 = 0x%016llx PDPTR1 = 0x%016llx\n" ,vmcs_read64 (GUEST_PDPTR0 ),vmcs_read64 (GUEST_PDPTR1 )); pr_err("PDPTR2 = 0x%016llx PDPTR3 = 0x%016llx\n",
@@ -5811,7 +5807,8 @@ void dump_vmcs(void)if ((vmexit_ctl & (VM_EXIT_SAVE_IA32_PAT |VM_EXIT_SAVE_IA32_EFER )) || (vmentry_ctl & (VM_ENTRY_LOAD_IA32_PAT |VM_ENTRY_LOAD_IA32_EFER )))pr_err ("EFER = 0x%016llx PAT = 0x%016llx\n" , - efer,vmcs_read64 (GUEST_IA32_PAT )); +vmcs_read64 (GUEST_IA32_EFER ), +vmcs_read64 (GUEST_IA32_PAT ));pr_err ("DebugCtl = 0x%016llx DebugExceptions = 0x%016lx\n" ,vmcs_read64 (GUEST_IA32_DEBUGCTL ),vmcs_readl (GUEST_PENDING_DBG_EXCEPTIONS ));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 523/601 rtlwifi: 8821ae: upgrade PHY and RF parameters
In reply to Greg Kroah-HartmanFrom: Ping-Ke Shih <[email protected]>
[ Upstream commit 18fb0bedb5fc2fddc057dbe48b7360a6ffda34b3 ]
The signal strength of 5G is quite low, so user can't connect to an AP far away. New parameters with new format and its parser are updated by the commit 84d26fda52e2 ("rtlwifi: Update 8821ae new phy parameters and its parser."), but some parameters are missing. Use this commit to update to the novel parameters that use new format.
--- .../realtek/rtlwifi/rtl8821ae/table.c | 500 +++++++++++++----- 1 file changed, 370 insertions(+), 130 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c +370 -130
@@ -249,7 +249,7 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {0x824 ,0x00030FE0 ,0x828 ,0x00000000 ,0x82C ,0x002081DD , -0x830 ,0x2AAA8E24 , +0x830 ,0x2AAAEEC8 ,0x834 ,0x0037A706 ,0x838 ,0x06489B44 , 0x83C, 0x0000095B,
@@ -324,10 +324,10 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {0x9D8 ,0x00000000 ,0x9DC ,0x00000000 ,0x9E0 ,0x00005D00 , -0x9E4 ,0x00000002 , +0x9E4 ,0x00000003 ,0x9E8 ,0x00000001 ,0xA00 ,0x00D047C8 , -0xA04 ,0x01FF000C , +0xA04 ,0x01FF800C ,0xA08 ,0x8C8A8300 ,0xA0C ,0x2E68000F , 0xA10, 0x9500BB78,
@@ -1320,7 +1320,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x083 ,0x00021800 ,0x084 ,0x00028000 ,0x085 ,0x00048000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 , +0x086 ,0x0009483A , +0xA0000000 ,0x00000000 ,0x086 ,0x00094838 , +0xB0000000 ,0x00000000 ,0x087 ,0x00044980 ,0x088 ,0x00048000 , 0x089, 0x0000D480,
@@ -1409,36 +1413,32 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x03C ,0x000CA000 ,0x0EF ,0x00000000 ,0x0EF ,0x00001100 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004ADF3 ,0x034 ,0x00049DF0 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004ADF3 ,0x034 ,0x00049DF0 , -0xFF0F0404 ,0xCDEF , -0x034 ,0x0004ADF3 , -0x034 ,0x00049DF0 , -0xFF0F0200 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004ADF5 ,0x034 ,0x00049DF2 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0004A0F3 , +0x034 ,0x000490B1 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004A0F3 ,0x034 ,0x000490B1 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0004ADF5 , +0x034 ,0x00049DF2 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0004ADF3 , +0x034 ,0x00049DF0 , +0xA0000000 ,0x00000000 ,0x034 ,0x0004ADF7 ,0x034 ,0x00049DF3 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00048DED , -0x034 ,0x00047DEA , -0x034 ,0x00046DE7 , -0x034 ,0x00045CE9 , -0x034 ,0x00044CE6 , -0x034 ,0x000438C6 , -0x034 ,0x00042886 , -0x034 ,0x00041486 , -0x034 ,0x00040447 , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00048DED ,0x034 ,0x00047DEA , 0x034, 0x00046DE7,
@@ -1448,7 +1448,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00042886 ,0x034 ,0x00041486 ,0x034 ,0x00040447 , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00048DED ,0x034 ,0x00047DEA , 0x034, 0x00046DE7,
@@ -1458,7 +1458,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00042886 ,0x034 ,0x00041486 ,0x034 ,0x00040447 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x000480AE , +0x034 ,0x000470AB , +0x034 ,0x0004608B , +0x034 ,0x00045069 , +0x034 ,0x00044048 , +0x034 ,0x00043045 , +0x034 ,0x00042026 , +0x034 ,0x00041023 , +0x034 ,0x00040002 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x000480AE ,0x034 ,0x000470AB , 0x034, 0x0004608B,
@@ -1468,7 +1478,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00042026 ,0x034 ,0x00041023 ,0x034 ,0x00040002 , -0xCDCDCDCD ,0xCDCD , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00048DED , +0x034 ,0x00047DEA , +0x034 ,0x00046DE7 , +0x034 ,0x00045CE9 , +0x034 ,0x00044CE6 , +0x034 ,0x000438C6 , +0x034 ,0x00042886 , +0x034 ,0x00041486 , +0x034 ,0x00040447 , +0xA0000000 ,0x00000000 ,0x034 ,0x00048DEF ,0x034 ,0x00047DEC , 0x034, 0x00046DE9,
@@ -1478,38 +1498,36 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x0004248A ,0x034 ,0x0004108D ,0x034 ,0x0004008A , -0xFF0F0104 ,0xDEAD , -0xFF0F0200 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0002ADF4 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0002A0F3 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0002A0F3 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0002ADF4 , +0xA0000000 ,0x00000000 ,0x034 ,0x0002ADF7 , -0xFF0F0200 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00029DF4 , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00029DF4 , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00029DF4 , -0xFF0F0200 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00029DF1 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x000290F0 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x000290F0 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00029DF1 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00029DF4 , +0xA0000000 ,0x00000000 ,0x034 ,0x00029DF2 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00028DF1 , -0x034 ,0x00027DEE , -0x034 ,0x00026DEB , -0x034 ,0x00025CEC , -0x034 ,0x00024CE9 , -0x034 ,0x000238CA , -0x034 ,0x00022889 , -0x034 ,0x00021489 , -0x034 ,0x0002044A , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00028DF1 ,0x034 ,0x00027DEE , 0x034, 0x00026DEB,
@@ -1519,7 +1537,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022889 ,0x034 ,0x00021489 ,0x034 ,0x0002044A , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00028DF1 ,0x034 ,0x00027DEE , 0x034, 0x00026DEB,
@@ -1529,7 +1547,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022889 ,0x034 ,0x00021489 ,0x034 ,0x0002044A , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x000280AF ,0x034 ,0x000270AC , 0x034, 0x0002608B,
@@ -1539,7 +1557,27 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022026 ,0x034 ,0x00021023 ,0x034 ,0x00020002 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x000280AF , +0x034 ,0x000270AC , +0x034 ,0x0002608B , +0x034 ,0x00025069 , +0x034 ,0x00024048 , +0x034 ,0x00023045 , +0x034 ,0x00022026 , +0x034 ,0x00021023 , +0x034 ,0x00020002 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00028DF1 , +0x034 ,0x00027DEE , +0x034 ,0x00026DEB , +0x034 ,0x00025CEC , +0x034 ,0x00024CE9 , +0x034 ,0x000238CA , +0x034 ,0x00022889 , +0x034 ,0x00021489 , +0x034 ,0x0002044A , +0xA0000000 ,0x00000000 ,0x034 ,0x00028DEE ,0x034 ,0x00027DEB , 0x034, 0x00026CCD,
@@ -1549,27 +1587,24 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022849 ,0x034 ,0x00021449 ,0x034 ,0x0002004D , -0xFF0F0104 ,0xDEAD , -0xFF0F02C0 ,0xABCD , +0xB0000000 ,0x00000000 , +0x8000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0000A0D7 , +0x034 ,0x000090D3 , +0x034 ,0x000080B1 , +0x034 ,0x000070AE , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0000A0D7 ,0x034 ,0x000090D3 ,0x034 ,0x000080B1 ,0x034 ,0x000070AE , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x034 ,0x0000ADF7 ,0x034 ,0x00009DF4 ,0x034 ,0x00008DF1 ,0x034 ,0x00007DEE , -0xFF0F02C0 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00006DEB , -0x034 ,0x00005CEC , -0x034 ,0x00004CE9 , -0x034 ,0x000038CA , -0x034 ,0x00002889 , -0x034 ,0x00001489 , -0x034 ,0x0000044A , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00006DEB ,0x034 ,0x00005CEC , 0x034, 0x00004CE9,
@@ -1577,7 +1612,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002889 ,0x034 ,0x00001489 ,0x034 ,0x0000044A , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00006DEB ,0x034 ,0x00005CEC , 0x034, 0x00004CE9,
@@ -1585,7 +1620,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002889 ,0x034 ,0x00001489 ,0x034 ,0x0000044A , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0000608D ,0x034 ,0x0000506B , 0x034, 0x0000404A,
@@ -1593,7 +1628,23 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002044 ,0x034 ,0x00001025 ,0x034 ,0x00000004 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0000608D , +0x034 ,0x0000506B , +0x034 ,0x0000404A , +0x034 ,0x00003047 , +0x034 ,0x00002044 , +0x034 ,0x00001025 , +0x034 ,0x00000004 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00006DEB , +0x034 ,0x00005CEC , +0x034 ,0x00004CE9 , +0x034 ,0x000038CA , +0x034 ,0x00002889 , +0x034 ,0x00001489 , +0x034 ,0x0000044A , +0xA0000000 ,0x00000000 ,0x034 ,0x00006DCD ,0x034 ,0x00005CCD , 0x034, 0x00004CCA,
@@ -1601,11 +1652,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002888 ,0x034 ,0x00001488 ,0x034 ,0x00000486 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x018 ,0x0001712A ,0x0EF ,0x00000040 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x035 ,0x00000187 ,0x035 ,0x00008187 , 0x035, 0x00010187,
@@ -1615,7 +1666,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x00040188 ,0x035 ,0x00048188 ,0x035 ,0x00050188 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x035 ,0x00000187 ,0x035 ,0x00008187 , 0x035, 0x00010187,
@@ -1625,7 +1676,37 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x00040188 ,0x035 ,0x00048188 ,0x035 ,0x00050188 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x035 ,0x00000128 , +0x035 ,0x00008128 , +0x035 ,0x00010128 , +0x035 ,0x000201C8 , +0x035 ,0x000281C8 , +0x035 ,0x000301C8 , +0x035 ,0x000401C8 , +0x035 ,0x000481C8 , +0x035 ,0x000501C8 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x035 ,0x00000145 , +0x035 ,0x00008145 , +0x035 ,0x00010145 , +0x035 ,0x00020196 , +0x035 ,0x00028196 , +0x035 ,0x00030196 , +0x035 ,0x000401C7 , +0x035 ,0x000481C7 , +0x035 ,0x000501C7 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x035 ,0x00000128 , +0x035 ,0x00008128 , +0x035 ,0x00010128 , +0x035 ,0x000201C8 , +0x035 ,0x000281C8 , +0x035 ,0x000301C8 , +0x035 ,0x000401C8 , +0x035 ,0x000481C8 , +0x035 ,0x000501C8 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x035 ,0x00000187 ,0x035 ,0x00008187 , 0x035, 0x00010187,
@@ -1635,7 +1716,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x00040188 ,0x035 ,0x00048188 ,0x035 ,0x00050188 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x035 ,0x00000145 ,0x035 ,0x00008145 , 0x035, 0x00010145,
@@ -1645,11 +1726,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x000401C7 ,0x035 ,0x000481C7 ,0x035 ,0x000501C7 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x018 ,0x0001712A ,0x0EF ,0x00000010 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x036 ,0x00085733 ,0x036 ,0x0008D733 , 0x036, 0x00095733,
@@ -1662,7 +1743,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x000CE4B4 ,0x036 ,0x000D64B4 ,0x036 ,0x000DE4B4 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x036 ,0x00085733 ,0x036 ,0x0008D733 , 0x036, 0x00095733,
@@ -1675,7 +1756,46 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x000CE4B4 ,0x036 ,0x000D64B4 ,0x036 ,0x000DE4B4 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x036 ,0x000063B5 , +0x036 ,0x0000E3B5 , +0x036 ,0x000163B5 , +0x036 ,0x0001E3B5 , +0x036 ,0x000263B5 , +0x036 ,0x0002E3B5 , +0x036 ,0x000363B5 , +0x036 ,0x0003E3B5 , +0x036 ,0x000463B5 , +0x036 ,0x0004E3B5 , +0x036 ,0x000563B5 , +0x036 ,0x0005E3B5 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x036 ,0x000056B3 , +0x036 ,0x0000D6B3 , +0x036 ,0x000156B3 , +0x036 ,0x0001D6B3 , +0x036 ,0x00026634 , +0x036 ,0x0002E634 , +0x036 ,0x00036634 , +0x036 ,0x0003E634 , +0x036 ,0x000467B4 , +0x036 ,0x0004E7B4 , +0x036 ,0x000567B4 , +0x036 ,0x0005E7B4 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x036 ,0x000063B5 , +0x036 ,0x0000E3B5 , +0x036 ,0x000163B5 , +0x036 ,0x0001E3B5 , +0x036 ,0x000263B5 , +0x036 ,0x0002E3B5 , +0x036 ,0x000363B5 , +0x036 ,0x0003E3B5 , +0x036 ,0x000463B5 , +0x036 ,0x0004E3B5 , +0x036 ,0x000563B5 , +0x036 ,0x0005E3B5 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x036 ,0x00085733 ,0x036 ,0x0008D733 , 0x036, 0x00095733,
@@ -1688,7 +1808,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x000CE4B4 ,0x036 ,0x000D64B4 ,0x036 ,0x000DE4B4 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x036 ,0x000056B3 ,0x036 ,0x0000D6B3 , 0x036, 0x000156B3,
@@ -1701,103 +1821,162 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x0004E7B4 ,0x036 ,0x000567B4 ,0x036 ,0x0005E7B4 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x0EF ,0x00000008 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x000001C8 ,0x03C ,0x00000492 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x000001C8 ,0x03C ,0x00000492 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x000001B6 , +0x03C ,0x00000492 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x0000022A , +0x03C ,0x00000594 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x000001B6 , +0x03C ,0x00000492 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x000001C8 ,0x03C ,0x00000492 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x03C ,0x0000022A ,0x03C ,0x00000594 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000800 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000800 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000800 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000820 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x00000820 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x00000800 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x00000800 , +0xA0000000 ,0x00000000 ,0x03C ,0x00000900 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x018 ,0x0001712A ,0x0EF ,0x00000002 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x008 ,0x0004E400 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x008 ,0x0004E400 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x008 ,0x0004E400 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x008 ,0x00002000 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x0DF ,0x000000C0 , -0x01F ,0x00040064 , -0xFF0F0104 ,0xABCD , +0x01F ,0x00000064 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x058 ,0x000A7284 ,0x059 ,0x000600EC , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x058 ,0x000A7284 ,0x059 ,0x000600EC , -0xFF0F0404 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x058 ,0x00081184 , +0x059 ,0x0006016C , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x058 ,0x00081184 , +0x059 ,0x0006016C , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x058 ,0x00081184 , +0x059 ,0x0006016C , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x058 ,0x000A7284 ,0x059 ,0x000600EC , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x058 ,0x00081184 ,0x059 ,0x0006016C , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x061 ,0x000E8D73 ,0x062 ,0x00093FC5 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x061 ,0x000E8D73 ,0x062 ,0x00093FC5 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x061 ,0x000EFD83 , +0x062 ,0x00093FCC , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x061 ,0x000EAD53 , +0x062 ,0x00093BC4 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x061 ,0x000EFD83 , +0x062 ,0x00093FCC , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x061 ,0x000E8D73 ,0x062 ,0x00093FC5 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x061 ,0x000EAD53 ,0x062 ,0x00093BC4 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x063 ,0x000110EB , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xFF0F0200 ,0xCDEF , -0x063 ,0x000710E9 , -0xFF0F02C0 ,0xCDEF , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x063 ,0x000110EB , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x063 ,0x000110E9 , +0xA0000000 ,0x00000000 ,0x063 ,0x000714E9 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 , +0x064 ,0x0001C27C , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 , +0x064 ,0x0001C27C , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x064 ,0x0001C27C , -0xFF0F0204 ,0xCDEF , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x064 ,0x0001C67C , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 ,0x064 ,0x0001C27C , -0xFF0F0404 ,0xCDEF , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x064 ,0x0001C27C , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x064 ,0x0001C67C , -0xFF0F0104 ,0xDEAD , -0xFF0F0200 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00091016 , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00091016 , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x065 ,0x00093016 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x065 ,0x00093015 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00093015 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00093016 , +0xA0000000 ,0x00000000 ,0x065 ,0x00091016 , -0xFF0F0200 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x018 ,0x00000006 ,0x0EF ,0x00002000 , 0x03B, 0x0003824B,
@@ -1895,9 +2074,10 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x0B4 ,0x0001214C ,0x0B7 ,0x0003000C ,0x01C ,0x000539D2 , +0x0C4 ,0x000AFE00 ,0x018 ,0x0001F12A , -0x0FE ,0x00000000 , -0x0FE ,0x00000000 , +0xFFE ,0x00000000 , +0xFFE ,0x00000000 , 0x018, 0x0001712A, };
@@ -2017,6 +2197,7 @@ u32 RTL8812AE_MAC_REG_ARRAY[] = {u32 RTL8812AE_MAC_1T_ARRAYLEN =ARRAY_SIZE (RTL8812AE_MAC_REG_ARRAY );u32 RTL8821AE_MAC_REG_ARRAY [] = { +0x421 ,0x0000000F ,0x428 ,0x0000000A ,0x429 ,0x00000010 ,0x430 ,0x00000000 ,
@@ -2485,7 +2666,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0xA6360001 ,0x81C ,0xA5380001 ,0x81C ,0xA43A0001 , -0x81C ,0xA33C0001 , +0x81C ,0x683C0001 ,0x81C ,0x673E0001 ,0x81C ,0x66400001 , 0x81C, 0x65420001,
@@ -2519,7 +2700,66 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0x017A0001 ,0x81C ,0x017C0001 ,0x81C ,0x017E0001 , -0xFF0F02C0 ,0xABCD , +0x8000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x81C ,0xFB000101 , +0x81C ,0xFA020101 , +0x81C ,0xF9040101 , +0x81C ,0xF8060101 , +0x81C ,0xF7080101 , +0x81C ,0xF60A0101 , +0x81C ,0xF50C0101 , +0x81C ,0xF40E0101 , +0x81C ,0xF3100101 , +0x81C ,0xF2120101 , +0x81C ,0xF1140101 , +0x81C ,0xF0160101 , +0x81C ,0xEF180101 , +0x81C ,0xEE1A0101 , +0x81C ,0xED1C0101 , +0x81C ,0xEC1E0101 , +0x81C ,0xEB200101 , +0x81C ,0xEA220101 , +0x81C ,0xE9240101 , +0x81C ,0xE8260101 , +0x81C ,0xE7280101 , +0x81C ,0xE62A0101 , +0x81C ,0xE52C0101 , +0x81C ,0xE42E0101 , +0x81C ,0xE3300101 , +0x81C ,0xA5320101 , +0x81C ,0xA4340101 , +0x81C ,0xA3360101 , +0x81C ,0x87380101 , +0x81C ,0x863A0101 , +0x81C ,0x853C0101 , +0x81C ,0x843E0101 , +0x81C ,0x69400101 , +0x81C ,0x68420101 , +0x81C ,0x67440101 , +0x81C ,0x66460101 , +0x81C ,0x49480101 , +0x81C ,0x484A0101 , +0x81C ,0x474C0101 , +0x81C ,0x2A4E0101 , +0x81C ,0x29500101 , +0x81C ,0x28520101 , +0x81C ,0x27540101 , +0x81C ,0x26560101 , +0x81C ,0x25580101 , +0x81C ,0x245A0101 , +0x81C ,0x235C0101 , +0x81C ,0x055E0101 , +0x81C ,0x04600101 , +0x81C ,0x03620101 , +0x81C ,0x02640101 , +0x81C ,0x01660101 , +0x81C ,0x01680101 , +0x81C ,0x016A0101 , +0x81C ,0x016C0101 , +0x81C ,0x016E0101 , +0x81C ,0x01700101 , +0x81C ,0x01720101 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x81C ,0xFB000101 ,0x81C ,0xFA020101 , 0x81C, 0xF9040101,
@@ -2578,7 +2818,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0x016E0101 ,0x81C ,0x01700101 ,0x81C ,0x01720101 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x81C ,0xFF000101 ,0x81C ,0xFF020101 , 0x81C, 0xFE040101,
@@ -2637,7 +2877,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0x046E0101 ,0x81C ,0x03700101 ,0x81C ,0x02720101 , -0xFF0F02C0 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x81C ,0x01740101 ,0x81C ,0x01760101 , 0x81C, 0x01780101,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 524/601 wlcore: fix overlapping snprintf arguments in debugfs
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 7b0e2c4f6be3ec68bf807c84e985e81c21404cd1 ]
gcc complains about undefined behavior in calling snprintf() with the same buffer as input and output:
drivers/net/wireless/ti/wl18xx/debugfs.c: In function 'diversity_num_of_packets_per_ant_read':drivers/net/wireless/ti/wl18xx/../wlcore/debugfs.h:86:3: error: 'snprintf' argument 4 overlaps destination object 'buf' [-Werror=restrict]
86 | snprintf(buf, sizeof(buf), "%s[%d] = %d\n", \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
87 | buf, i, stats->sub.name[i]); \
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/wireless/ti/wl18xx/debugfs.c:24:2: note: in expansion of macro 'DEBUGFS_FWSTATS_FILE_ARRAY'
24 | DEBUGFS_FWSTATS_FILE_ARRAY(a, b, c, wl18xx_acx_statistics)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~drivers/net/wireless/ti/wl18xx/debugfs.c:159:1: note: in expansion of macro 'WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY'
159 | WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(diversity, num_of_packets_per_ant,
There are probably other ways of handling the debugfs file, without using on-stack buffers, but a simple workaround here is to remember the current position in the buffer and just keep printing in there.
--- drivers/net/wireless/ti/wlcore/boot.c | 13 ++++++++----- drivers/net/wireless/ti/wlcore/debugfs.h | 7 ++++--- 2 files changed, 12 insertions(+), 8 deletions(-)
drivers/net/wireless/ti/wlcore/boot.c +8 -5
@@ -72,6 +72,7 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl)unsigned int *min_ver = (wl->fw_type ==WL12XX_FW_TYPE_MULTI ) ? wl->min_mr_fw_ver : wl->min_sr_fw_ver;char min_fw_str[32 ] ="" ; +int off =0 ;int i;/* the chip must be exactly equal */
@@ -105,13 +106,15 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl)return 0 ; fail: -for (i =0 ; i <NUM_FW_VER ; i++) +for (i =0 ; i <NUM_FW_VER && off <sizeof (min_fw_str); i++)if (min_ver[i] ==WLCORE_FW_VER_IGNORE ) -snprintf (min_fw_str,sizeof (min_fw_str), -"%s*." , min_fw_str); + off +=snprintf (min_fw_str + off, +sizeof (min_fw_str) - off, +"*." );else -snprintf (min_fw_str,sizeof (min_fw_str), -"%s%u." , min_fw_str, min_ver[i]); + off +=snprintf (min_fw_str + off, +sizeof (min_fw_str) - off, +"%u." , min_ver[i]);wl1271_error ("Your WiFi FW version (%u.%u.%u.%u.%u) is invalid.\n" "Please use at least FW %s\n"
drivers/net/wireless/ti/wlcore/debugfs.h +4 -3
@@ -78,13 +78,14 @@ static ssize_t sub## _ ##name## _read(struct file *file, \struct wl1271 *wl = file->private_data; \struct struct_type *stats = wl->stats.fw_stats; \char buf[DEBUGFS_FORMAT_BUFFER_SIZE ] ="" ; \ +int pos =0 ; \int i; \ \wl1271_debugfs_update_stats (wl); \ \ -for (i =0 ; i < len; i++) \ -snprintf (buf,sizeof (buf),"%s[%d] = %d\n" , \ - buf, i, stats->sub.name[i]); \ +for (i =0 ; i < len && pos <sizeof (buf); i++) \ + pos +=snprintf (buf + pos,sizeof (buf), \ +"[%d] = %d\n" , i, stats->sub.name[i]); \ \return wl1271_format_buffer (userbuf, count, ppos,"%s" , buf); \ } \
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 525/601 i2c: sh7760: fix IRQ error path
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 92dfb27240fea2776f61c5422472cb6defca7767 ]
While adding the invalid IRQ check after calling platform_get_irq(), I managed to overlook that the driver has a complex error path in its probe() method, thus a simple *return* couldn't be used. Use a proper *goto* instead!
--- drivers/i2c/busses/i2c-sh7760.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-sh7760.c +1 -1
@@ -473,7 +473,7 @@ static int sh7760_i2c_probe(struct platform_device *pdev) ret =platform_get_irq (pdev,0 );if (ret <0 ) -return ret; + goto out3; id->irq = ret; id->adap.nr = pdev->id;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 526/601 i2c: mediatek: Fix wrong dma sync flag
In reply to Greg Kroah-HartmanFrom: Qii Wang <[email protected]>
[ Upstream commit 3186b880447ad3cc9b6487fa626a71d64b831524 ]
The right flag is apdma_sync when apdma remove hand-shake signel.
--- drivers/i2c/busses/i2c-mt65xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-mt65xx.c +1 -1
@@ -479,7 +479,7 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c) {u16 control_reg; -if (i2c->dev_comp->dma_sync) { +if (i2c->dev_comp->apdma_sync) {writel (I2C_DMA_WARM_RST , i2c->pdmabase +OFFSET_RST );udelay (10 );writel (I2C_DMA_CLR_FLAG , i2c->pdmabase +OFFSET_RST );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 527/601 mwl8k: Fix a double Free in mwl8k_probe_hw
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit a8e083ee8e2a6c94c29733835adae8bf5b832748 ]
In mwl8k_probe_hw, hw->priv->txq is freed at the first time by dma_free_coherent() in the call chain:
if(!priv->ap_fw)->mwl8k_init_txqs(hw)->mwl8k_txq_init(hw, i).
Then in err_free_queues of mwl8k_probe_hw, hw->priv->txq is freed at the second time by mwl8k_txq_deinit(hw, i)->dma_free_coherent().
My patch set txq->txd to NULL after the first free to avoid the double free.
--- drivers/net/wireless/marvell/mwl8k.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/marvell/mwl8k.c +1 -0
@@ -1474,6 +1474,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index)if (txq->skb ==NULL ) {dma_free_coherent (&priv->pdev->dev, size, txq->txd, txq->txd_dma); + txq->txd =NULL ;return -ENOMEM ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 528/601 netfilter: nft_payload: fix C-VLAN offload support
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 14c20643ef9457679cc6934d77adc24296505214 ]
- add another struct flow_dissector_key_vlan for C-VLAN
- update layer 3 dependency to allow to match on IPv4/IPv6
--- include/net/netfilter/nf_tables_offload.h | 1 + net/netfilter/nft_payload.c | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-)
include/net/netfilter/nf_tables_offload.h +1 -0
@@ -45,6 +45,7 @@ struct nft_flow_key {struct flow_dissector_key_ports tp;struct flow_dissector_key_ip ip;struct flow_dissector_key_vlan vlan; +struct flow_dissector_key_vlan cvlan;struct flow_dissector_key_eth_addrs eth_addrs;struct flow_dissector_key_meta meta; }__aligned(BITS_PER_LONG / 8) ;/* Ensure that we can do comparisons as longs. */
net/netfilter/nft_payload.c +3 -2
@@ -241,7 +241,7 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,if (!nft_payload_offload_mask (reg, priv->len,sizeof (__be16)))return -EOPNOTSUPP ; -NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_CVLAN , vlan, +NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_CVLAN , cvlan, vlan_tci,sizeof (__be16), reg);break ; case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto) +
@@ -249,8 +249,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,if (!nft_payload_offload_mask (reg, priv->len,sizeof (__be16)))return -EOPNOTSUPP ; -NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_CVLAN , vlan, +NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_CVLAN , cvlan, vlan_tpid,sizeof (__be16), reg); +nft_offload_set_dependency (ctx,NFT_OFFLOAD_DEP_NETWORK );break ;default :return -EOPNOTSUPP ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 529/601 netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit ff4d90a89d3d4d9814e0a2696509a7d495be4163 ]
The flow dissector representation expects the VLAN id in host byteorder. Add the NFT_OFFLOAD_F_NETWORK2HOST flag to swap the bytes from nft_cmp.
--- include/net/netfilter/nf_tables_offload.h | 11 +++++- net/netfilter/nft_cmp.c | 41 +++++++++++++++++++++-- net/netfilter/nft_payload.c | 10 +++--- 3 files changed, 55 insertions(+), 7 deletions(-)
include/net/netfilter/nf_tables_offload.h +10 -1
@@ -4,11 +4,16 @@#include <net/flow_offload.h> #include <net/netfilter/nf_tables.h> +enum nft_offload_reg_flags { +NFT_OFFLOAD_F_NETWORK2HOST = (1 <<0 ), +}; +struct nft_offload_reg {u32 key;u32 len;u32 base_offset;u32 offset; +u32 flags;struct nft_data data;struct nft_data mask; };
@@ -72,13 +77,17 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, const struct nft_rulvoid nft_flow_rule_destroy (struct nft_flow_rule *flow);int nft_flow_rule_offload_commit (struct net *net); -#define NFT_OFFLOAD_MATCH (__key, __base, __field, __len, __reg) \ +#define NFT_OFFLOAD_MATCH_FLAGS (__key, __base, __field, __len, __reg, __flags) \ (__reg)->base_offset = \ offsetof(struct nft_flow_key, __base); \ (__reg)->offset = \ offsetof(struct nft_flow_key, __base.__field); \ (__reg)->len = __len; \ (__reg)->key = __key; \ + (__reg)->flags = __flags; + +#define NFT_OFFLOAD_MATCH (__key, __base, __field, __len, __reg) \ + NFT_OFFLOAD_MATCH_FLAGS(__key, __base, __field, __len, __reg, 0)#define NFT_OFFLOAD_MATCH_EXACT (__key, __base, __field, __len, __reg) \ NFT_OFFLOAD_MATCH(__key, __base, __field, __len, __reg) \
net/netfilter/nft_cmp.c +39 -2
58 lines not on this page · raw message
net/netfilter/nft_payload.c +6 -4
@@ -226,8 +226,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,if (!nft_payload_offload_mask (reg, priv->len,sizeof (__be16)))return -EOPNOTSUPP ; -NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_VLAN , vlan, - vlan_tci,sizeof (__be16), reg); +NFT_OFFLOAD_MATCH_FLAGS (FLOW_DISSECTOR_KEY_VLAN , vlan, + vlan_tci,sizeof (__be16), reg, +NFT_OFFLOAD_F_NETWORK2HOST );break ;case offsetof(struct vlan_ethhdr , h_vlan_encapsulated_proto):if (!nft_payload_offload_mask (reg, priv->len,sizeof (__be16)))
@@ -241,8 +242,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,if (!nft_payload_offload_mask (reg, priv->len,sizeof (__be16)))return -EOPNOTSUPP ; -NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_CVLAN , cvlan, - vlan_tci,sizeof (__be16), reg); +NFT_OFFLOAD_MATCH_FLAGS (FLOW_DISSECTOR_KEY_CVLAN , cvlan, + vlan_tci,sizeof (__be16), reg, +NFT_OFFLOAD_F_NETWORK2HOST );break ;case offsetof(struct vlan_ethhdr , h_vlan_encapsulated_proto) +sizeof (struct vlan_hdr ):
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 530/601 netfilter: nftables_offload: special ethertype handling for VLAN
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 783003f3bb8a565326e89d18bbd948ad8ffc816a ]
The nftables offload parser sets FLOW_DISSECTOR_KEY_BASIC .n_proto to the ethertype field in the ethertype frame. However:
- FLOW_DISSECTOR_KEY_BASIC .n_proto field always stores either IPv4 or IPv6 ethertypes.
- FLOW_DISSECTOR_KEY_VLAN .vlan_tpid stores either the 802.1q and 802.1ad ethertypes. Same as for FLOW_DISSECTOR_KEY_CVLAN.
This function adjusts the flow dissector to handle two scenarios:
1) FLOW_DISSECTOR_KEY_VLAN .vlan_tpid is set to 802.1q or 802.1ad. Then, transfer:
- the .n_proto field to FLOW_DISSECTOR_KEY_VLAN .tpid.
- the original FLOW_DISSECTOR_KEY_VLAN .tpid to the FLOW_DISSECTOR_KEY_CVLAN .tpid
- the original FLOW_DISSECTOR_KEY_CVLAN .tpid to the .n_proto field.
2) .n_proto is set to 802.1q or 802.1ad. Then, transfer:
- the .n_proto field to FLOW_DISSECTOR_KEY_VLAN .tpid.
- the original FLOW_DISSECTOR_KEY_VLAN .tpid to the .n_proto field.
--- net/netfilter/nf_tables_offload.c | 44 +++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+)
net/netfilter/nf_tables_offload.c +44 -0
@@ -45,6 +45,48 @@ void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow, offsetof(struct nft_flow_key , control); } +struct nft_offload_ethertype { +__be16 value; +__be16 mask; +}; + +static void nft_flow_rule_transfer_vlan (struct nft_offload_ctx *ctx, +struct nft_flow_rule *flow) +{ +struct nft_flow_match *match = &flow->match; +struct nft_offload_ethertype ethertype; + +if (match->dissector.used_keys &BIT (FLOW_DISSECTOR_KEY_CONTROL ) && + match->key.basic.n_proto !=htons (ETH_P_8021Q ) && + match->key.basic.n_proto !=htons (ETH_P_8021AD )) +return ; + + ethertype.value = match->key.basic.n_proto; + ethertype.mask = match->mask.basic.n_proto; + +if (match->dissector.used_keys &BIT (FLOW_DISSECTOR_KEY_VLAN ) && + (match->key.vlan.vlan_tpid ==htons (ETH_P_8021Q ) || + match->key.vlan.vlan_tpid ==htons (ETH_P_8021AD ))) { + match->key.basic.n_proto = match->key.cvlan.vlan_tpid; + match->mask.basic.n_proto = match->mask.cvlan.vlan_tpid; + match->key.cvlan.vlan_tpid = match->key.vlan.vlan_tpid; + match->mask.cvlan.vlan_tpid = match->mask.vlan.vlan_tpid; + match->key.vlan.vlan_tpid = ethertype.value; + match->mask.vlan.vlan_tpid = ethertype.mask; + match->dissector.offset[FLOW_DISSECTOR_KEY_CVLAN ] = + offsetof(struct nft_flow_key , cvlan); + match->dissector.used_keys |=BIT (FLOW_DISSECTOR_KEY_CVLAN ); + }else { + match->key.basic.n_proto = match->key.vlan.vlan_tpid; + match->mask.basic.n_proto = match->mask.vlan.vlan_tpid; + match->key.vlan.vlan_tpid = ethertype.value; + match->mask.vlan.vlan_tpid = ethertype.mask; + match->dissector.offset[FLOW_DISSECTOR_KEY_VLAN ] = + offsetof(struct nft_flow_key , vlan); + match->dissector.used_keys |=BIT (FLOW_DISSECTOR_KEY_VLAN ); + } +} +struct nft_flow_rule *nft_flow_rule_create (struct net *net,const struct nft_rule *rule) {
@@ -89,6 +131,8 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, expr =nft_expr_next (expr); } +nft_flow_rule_transfer_vlan (ctx, flow); + flow->proto = ctx->dep.l3num;kfree (ctx);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 531/601 vsock/vmci: log once the failed queue pair allocation
In reply to Greg Kroah-HartmanFrom: Stefano Garzarella <[email protected]>
[ Upstream commit e16edc99d658cd41c60a44cc14d170697aa3271f ]
VMCI feature is not supported in conjunction with the vSphere Fault Tolerance (FT) feature.
VMware Tools can repeatedly try to create a vsock connection. If FT is enabled the kernel logs is flooded with the following messages:
qp_alloc_hypercall result = -20
Could not attach to queue pair with -20
"qp_alloc_hypercall result = -20" was hidden by commit e8266c4c3307 ("VMCI: Stop log spew when qp allocation isn't possible"), but "Could not attach to queue pair with -20" is still there flooding the log.
Since the error message can be useful in some cases, print it only once.
--- net/vmw_vsock/vmci_transport.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/vmw_vsock/vmci_transport.c +1 -2
@@ -568,8 +568,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair, peer, flags, VMCI_NO_PRIVILEGE_FLAGS); out:if (err <0 ) { -pr_err ("Could not attach to queue pair with %d\n" , - err); +pr_err_once ("Could not attach to queue pair with %d\n" , err); err =vmci_transport_error_to_vsock_error (err); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 532/601 libbpf: Initialize the bpf_seq_printf parameters array field by field
In reply to Greg Kroah-HartmanFrom: Florent Revest <[email protected]>
[ Upstream commit 83cd92b46484aa8f64cdc0bff8ac6940d1f78519 ]
When initializing the __param array with a one liner, if all args are const, the initial array value will be placed in the rodata section but because libbpf does not support relocation in the rodata section, any pointer in this array will stay NULL.
--- tools/lib/bpf/bpf_tracing.h | 40 +++++++++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 11 deletions(-)
tools/lib/bpf/bpf_tracing.h +29 -11
@@ -413,20 +413,38 @@ typeof(name(0)) name(struct pt_regs *ctx) \ } \ static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args) +#define ___bpf_fill0 (arr, p, x) do {} while (0) +#define ___bpf_fill1 (arr, p, x) arr[p] = x +#define ___bpf_fill2(arr, p, x, args...) arr[p] = x; ___bpf_fill1(arr, p + 1, args) +#define ___bpf_fill3(arr, p, x, args...) arr[p] = x; ___bpf_fill2(arr, p + 1, args) +#define ___bpf_fill4(arr, p, x, args...) arr[p] = x; ___bpf_fill3(arr, p + 1, args) +#define ___bpf_fill5(arr, p, x, args...) arr[p] = x; ___bpf_fill4(arr, p + 1, args) +#define ___bpf_fill6(arr, p, x, args...) arr[p] = x; ___bpf_fill5(arr, p + 1, args) +#define ___bpf_fill7(arr, p, x, args...) arr[p] = x; ___bpf_fill6(arr, p + 1, args) +#define ___bpf_fill8(arr, p, x, args...) arr[p] = x; ___bpf_fill7(arr, p + 1, args) +#define ___bpf_fill9(arr, p, x, args...) arr[p] = x; ___bpf_fill8(arr, p + 1, args) +#define ___bpf_fill10(arr, p, x, args...) arr[p] = x; ___bpf_fill9(arr, p + 1, args) +#define ___bpf_fill11(arr, p, x, args...) arr[p] = x; ___bpf_fill10(arr, p + 1, args) +#define ___bpf_fill12(arr, p, x, args...) arr[p] = x; ___bpf_fill11(arr, p + 1, args) +#define ___bpf_fill(arr, args...) \ + ___bpf_apply(___bpf_fill, ___bpf_narg(args))(arr, 0, args) +/* * BPF_SEQ_PRINTF to wrap bpf_seq_printf to-be-printed values * in a structure. */ -#define BPF_SEQ_PRINTF(seq, fmt, args...) \ - ({ \ - _Pragma("GCC diagnostic push") \ - _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ - static const char ___fmt[] = fmt; \ - unsigned long long ___param[] = { args }; \ - _Pragma("GCC diagnostic pop") \ - int ___ret = bpf_seq_printf(seq, ___fmt, sizeof(___fmt), \ - ___param, sizeof(___param)); \ - ___ret; \ - }) +#define BPF_SEQ_PRINTF(seq, fmt, args...) \ +({ \ + static const char ___fmt[] = fmt; \ + unsigned long long ___param[___bpf_narg(args)]; \ + \ + _Pragma("GCC diagnostic push") \ + _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ + ___bpf_fill(___param, args); \ + _Pragma("GCC diagnostic pop") \ + \ + bpf_seq_printf(seq, ___fmt, sizeof(___fmt), \ + ___param, sizeof(___param)); \ +})#endif
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 533/601 net: ethernet: ixp4xx: Set the DMA masks explicitly
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
[ Upstream commit 8d892d60941b00c86d2029c8a99db24ab4979673 ]
The former fix only papered over the actual problem: the ethernet core expects the netdev .dev member to have the proper DMA masks set, or there will be BUG_ON() triggered in kernel/dma/mapping.c.
Fix this by simply copying dma_mask and dma_mask_coherent from the parent device.
--- drivers/net/ethernet/xscale/ixp4xx_eth.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/xscale/ixp4xx_eth.c +4 -1
@@ -1086,7 +1086,7 @@ static int init_queues(struct port *port)int i;if (!ports_open) { - dma_pool =dma_pool_create (DRV_NAME , port->netdev->dev.parent, + dma_pool =dma_pool_create (DRV_NAME , &port->netdev->dev,POOL_ALLOC_SIZE ,32 ,0 );if (!dma_pool)return -ENOMEM ;
@@ -1436,6 +1436,9 @@ static int ixp4xx_eth_probe(struct platform_device *pdev) ndev->netdev_ops = &ixp4xx_netdev_ops; ndev->ethtool_ops = &ixp4xx_ethtool_ops; ndev->tx_queue_len =100 ; +/* Inherit the DMA masks from the platform device */ + ndev->dev.dma_mask = dev->dma_mask; + ndev->dev.coherent_dma_mask = dev->coherent_dma_mask;netif_napi_add (ndev, &port->napi, eth_poll,NAPI_WEIGHT );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 534/601 gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
[ Upstream commit 7ad18ff6449cbd6beb26b53128ddf56d2685aa93 ]
Commit 38ec4944b593 ("gro: ensure frag0 meets IP header alignment") did the right thing, but missed the fact that napi_gro_frags() logics calls for skb_gro_reset_offset() *before* pulling Ethernet header to the skb linear space.
That said, the introduced check for frag0 address being aligned to 4 always fails for it as Ethernet header is obviously 14 bytes long, and in case with NET_IP_ALIGN its start is not aligned to 4.
Fix this by adding @nhoff argument to skb_gro_reset_offset() which tells if an IP header is placed right at the start of frag0 or not. This restores Fast GRO for napi_gro_frags() that became very slow after the mentioned commit, and preserves the introduced check to avoid silent unaligned accesses.
Quoted 1 line
From v1 [0]:
- inline tiny skb_gro_reset_offset() to let the code be optimized more efficively (esp. for the !NET_IP_ALIGN case) (Eric);
- pull in Reviewed-by from Eric.
[0] https://lore.kernel.org/netdev/[email protected]
--- net/core/dev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/core/dev.c +4 -4
@@ -5867,7 +5867,7 @@ static struct list_head *gro_list_prepare(struct napi_struct *napi,return head; } -static void skb_gro_reset_offset (struct sk_buff *skb) +static inline void skb_gro_reset_offset (struct sk_buff *skb,u32 nhoff) {const struct skb_shared_info *pinfo =skb_shinfo (skb);const skb_frag_t *frag0 = &pinfo->frags[0 ];
@@ -5878,7 +5878,7 @@ static void skb_gro_reset_offset(struct sk_buff *skb)if (!skb_headlen (skb) && pinfo->nr_frags && !PageHighMem (skb_frag_page (frag0)) && - (!NET_IP_ALIGN || !(skb_frag_off (frag0) &3 ))) { + (!NET_IP_ALIGN || !((skb_frag_off (frag0) + nhoff) &3 ))) {NAPI_GRO_CB (skb)->frag0 =skb_frag_address (frag0); NAPI_GRO_CB(skb)->frag0_len = min_t(unsigned int, skb_frag_size(frag0),
@@ -6111,7 +6111,7 @@ gro_result_t napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)skb_mark_napi_id (skb, napi);trace_napi_gro_receive_entry (skb); -skb_gro_reset_offset (skb); +skb_gro_reset_offset (skb,0 ); ret =napi_skb_finish (napi, skb,dev_gro_receive (napi, skb));trace_napi_gro_receive_exit (ret);
@@ -6204,7 +6204,7 @@ static struct sk_buff *napi_frags_skb(struct napi_struct *napi) napi->skb =NULL ;skb_reset_mac_header (skb); -skb_gro_reset_offset (skb); +skb_gro_reset_offset (skb, hlen);if (unlikely (skb_gro_header_hard (skb, hlen))) { eth =skb_gro_header_slow (skb, hlen,0 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 535/601 RDMA/cxgb4: add missing qpid increment
In reply to Greg Kroah-HartmanFrom: Potnuri Bharat Teja <[email protected]>
[ Upstream commit 3a6684385928d00b29acac7658a5ae1f2a44494c ]
missing qpid increment leads to skipping few qpids while allocating QP. This eventually leads to adapter running out of qpids after establishing fewer connections than it actually supports.
Current patch increments the qpid correctly.
--- drivers/infiniband/hw/cxgb4/resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/cxgb4/resource.c +1 -1
@@ -216,7 +216,7 @@ u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx) goto out; entry->qid = qid;list_add_tail (&entry->entry, &uctx->cqids); -for (i = qid; i & rdev->qpmask; i++) { +for (i = qid +1 ; i & rdev->qpmask; i++) { entry =kmalloc (sizeof (*entry),GFP_KERNEL );if (!entry) goto out;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 536/601 RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
In reply to Greg Kroah-HartmanFrom: Sindhu Devale <[email protected]>
[ Upstream commit 783a11bf2400e5d5c42a943c3083dc0330751842 ]
When i40iw_hmc_sd_one fails, chunk is freed without the deletion of chunk entry in the PBLE info list.
Fix it by adding the chunk entry to the PBLE info list only after successful addition of SD in i40iw_hmc_sd_one.
This fixes a static checker warning reported here:
https://lore.kernel.org/linux-rdma/YHV4CFXzqTm23AOZ@mwanda/
--- drivers/infiniband/hw/i40iw/i40iw_pble.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/infiniband/hw/i40iw/i40iw_pble.c +2 -4
@@ -392,12 +392,9 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev,i40iw_debug (dev,I40IW_DEBUG_PBLE ,"next_fpm_addr = %llx chunk_size[%u] = 0x%x\n" , pble_rsrc->next_fpm_addr, chunk->size, chunk->size); pble_rsrc->unallocated_pble -= (chunk->size >>3 ); -list_add (&chunk->list, &pble_rsrc->pinfo.clist); sd_reg_val = (sd_entry_type ==I40IW_SD_TYPE_PAGED ) ? sd_entry->u.pd_table.pd_page_addr.pa : sd_entry->u.bp.addr.pa; -if (sd_entry->valid) -return 0 ; -if (dev->is_pf) { +if (dev->is_pf && !sd_entry->valid) { ret_code =i40iw_hmc_sd_one (dev, hmc_info->hmc_fn_id, sd_reg_val, idx->sd_idx, sd_entry->entry_type, true);
@@ -408,6 +405,7 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev, } sd_entry->valid = true; +list_add (&chunk->list, &pble_rsrc->pinfo.clist);return 0 ; error:kfree (chunk);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 537/601 ALSA: usb: midi: dont return -ENOMEM when usb_urb_ep_type_check fails
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit cfd577acb769301b19c31361d45ae1f145318b7a ]
Currently when the call to usb_urb_ep_type_check fails (returning -EINVAL) the error return path returns -ENOMEM via the exit label "error". Other uses of the same error exit label set the err variable to -ENOMEM but this is not being used. I believe the original intent was for the error exit path to return the value in err rather than the hard coded -ENOMEM, so return this rather than the hard coded -ENOMEM.
Addresses-Coverity: ("Unused value")
--- sound/usb/midi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/midi.c +1 -1
@@ -1332,7 +1332,7 @@ static int snd_usbmidi_in_endpoint_create(struct snd_usb_midi *umidi, error:snd_usbmidi_in_endpoint_delete (ep); -return -ENOMEM ; +return err; }/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 538/601 sfc: ef10: fix TX queue lookup in TX event handling
In reply to Greg Kroah-HartmanFrom: Edward Cree <[email protected]>
[ Upstream commit 172e269edfce34bac7c61c15551816bda4b0f140 ]
We're starting from a TXQ label, not a TXQ type, so
efx_channel_get_tx_queue() is inappropriate. This worked by chance, because labels and types currently match on EF10, but we shouldn't rely on that.
--- drivers/net/ethernet/sfc/ef10.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/sfc/ef10.c +1 -2
@@ -2928,8 +2928,7 @@ efx_ef10_handle_tx_event(struct efx_channel *channel, efx_qword_t *event)/* Get the transmit queue */ tx_ev_q_label =EFX_QWORD_FIELD (*event,ESF_DZ_TX_QLABEL ); - tx_queue =efx_channel_get_tx_queue (channel, - tx_ev_q_label %EFX_MAX_TXQ_PER_CHANNEL ); + tx_queue = channel->tx_queue + (tx_ev_q_label %EFX_MAX_TXQ_PER_CHANNEL );if (!tx_queue->timestamping) {/* Transmit completion */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 539/601 vsock/virtio: free queued packets when closing socket
In reply to Greg Kroah-HartmanFrom: Stefano Garzarella <[email protected]>
[ Upstream commit 8432b8114957235f42e070a16118a7f750de9d39 ]
As reported by syzbot [1], there is a memory leak while closing the socket. We partially solved this issue with commit ac03046ece2b ("vsock/virtio: free packets during the socket release"), but we forgot to drain the RX queue when the socket is definitely closed by the scheduled work.
To avoid future issues, let's use the new virtio_transport_remove_sock() to drain the RX queue before removing the socket from the af_vsock lists calling vsock_remove_sock().
[1] https://syzkaller.appspot.com/bug?extid=24452624fc4c571eedd9
--- net/vmw_vsock/virtio_transport_common.c | 28 +++++++++++++++++-------- 1 file changed, 19 insertions(+), 9 deletions(-)
net/vmw_vsock/virtio_transport_common.c +19 -9
@@ -733,6 +733,23 @@ static int virtio_transport_reset_no_sock(const struct virtio_transport *t,return t->send_pkt (reply); } +/* This function should be called with sk_lock held and SOCK_DONE set */ +static void virtio_transport_remove_sock (struct vsock_sock *vsk) +{ +struct virtio_vsock_sock *vvs = vsk->trans; +struct virtio_vsock_pkt *pkt, *tmp; + +/* We don't need to take rx_lock, as the socket is closing and we are +* removing it. +*/ +list_for_each_entry_safe (pkt, tmp, &vvs->rx_queue, list) { +list_del (&pkt->list); +virtio_transport_free_pkt (pkt); + } + +vsock_remove_sock (vsk); +} +static void virtio_transport_wait_close (struct sock *sk,long timeout) {if (timeout) {
@@ -765,7 +782,7 @@ static void virtio_transport_do_close(struct vsock_sock *vsk, (!cancel_timeout || cancel_delayed_work(&vsk->close_work))) { vsk->close_work_scheduled = false; -vsock_remove_sock (vsk); +virtio_transport_remove_sock (vsk);/* Release refcnt obtained when we scheduled the timeout */ sock_put (sk);
@@ -828,22 +845,15 @@ static bool virtio_transport_close(struct vsock_sock *vsk)void virtio_transport_release (struct vsock_sock *vsk) { -struct virtio_vsock_sock *vvs = vsk->trans; -struct virtio_vsock_pkt *pkt, *tmp;struct sock *sk = &vsk->sk;bool remove_sock = true;if (sk->sk_type ==SOCK_STREAM ) remove_sock =virtio_transport_close (vsk); -list_for_each_entry_safe (pkt, tmp, &vvs->rx_queue, list) { -list_del (&pkt->list); -virtio_transport_free_pkt (pkt); - } -if (remove_sock) {sock_set_flag (sk,SOCK_DONE ); -vsock_remove_sock (vsk); +virtio_transport_remove_sock (vsk); } }EXPORT_SYMBOL_GPL (virtio_transport_release);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 540/601 net: marvell: prestera: fix port event handling on init
In reply to Greg Kroah-HartmanFrom: Vadym Kochan <[email protected]>
[ Upstream commit 333980481b99edb24ebd5d1a53af70a15d9146de ]
For some reason there might be a crash during ports creation if port events are handling at the same time because fw may send initial port event with down state.
The crash points to cancel_delayed_work() which is called when port went is down. Currently I did not find out the real cause of the issue, so fixed it by cancel port stats work only if previous port's state was up & runnig.
The following is the crash which can be triggered:
[ 28.311104] Unable to handle kernel paging request at virtual address 000071775f776600 [ 28.319097] Mem abort info: [ 28.321914] ESR = 0x96000004 [ 28.324996] EC = 0x25: DABT (current EL), IL = 32 bits [ 28.330350] SET = 0, FnV = 0 [ 28.333430] EA = 0, S1PTW = 0 [ 28.336597] Data abort info: [ 28.339499] ISV = 0, ISS = 0x00000004 [ 28.343362] CM = 0, WnR = 0 [ 28.346354] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000100bf7000 [ 28.352842] [000071775f776600] pgd=0000000000000000, p4d=0000000000000000 [ 28.359695] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 28.365310] Modules linked in: prestera_pci(+) prestera uio_pdrv_genirq [ 28.372005] CPU: 0 PID: 1291 Comm: kworker/0:1H Not tainted 5.11.0-rc4 #1 [ 28.378846] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 28.384283] Workqueue: prestera_fw_wq prestera_fw_evt_work_fn [prestera_pci] [ 28.391413] pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--) [ 28.397468] pc : get_work_pool+0x48/0x60 [ 28.401442] lr : try_to_grab_pending+0x6c/0x1b0 [ 28.406018] sp : ffff80001391bc60 [ 28.409358] x29: ffff80001391bc60 x28: 0000000000000000 [ 28.414725] x27: ffff000104fc8b40 x26: ffff80001127de88 [ 28.420089] x25: 0000000000000000 x24: ffff000106119760 [ 28.425452] x23: ffff00010775dd60 x22: ffff00010567e000 [ 28.430814] x21: 0000000000000000 x20: ffff80001391bcb0 [ 28.436175] x19: ffff00010775deb8 x18: 00000000000000c0 [ 28.441537] x17: 0000000000000000 x16: 000000008d9b0e88 [ 28.446898] x15: 0000000000000001 x14: 00000000000002ba [ 28.452261] x13: 80a3002c00000002 x12: 00000000000005f4 [ 28.457622] x11: 0000000000000030 x10: 000000000000000c [ 28.462985] x9 : 000000000000000c x8 : 0000000000000030 [ 28.468346] x7 : ffff800014400000 x6 : ffff000106119758 [ 28.473708] x5 : 0000000000000003 x4 : ffff00010775dc60 [ 28.479068] x3 : 0000000000000000 x2 : 0000000000000060 [ 28.484429] x1 : 000071775f776600 x0 : ffff00010775deb8 [ 28.489791] Call trace: [ 28.492259] get_work_pool+0x48/0x60 [ 28.495874] cancel_delayed_work+0x38/0xb0 [ 28.500011] prestera_port_handle_event+0x90/0xa0 [prestera] [ 28.505743] prestera_evt_recv+0x98/0xe0 [prestera] [ 28.510683] prestera_fw_evt_work_fn+0x180/0x228 [prestera_pci] [ 28.516660] process_one_work+0x1e8/0x360 [ 28.520710] worker_thread+0x44/0x480 [ 28.524412] kthread+0x154/0x160 [ 28.527670] ret_from_fork+0x10/0x38 [ 28.531290] Code: a8c17bfd d50323bf d65f03c0 9278dc21 (f9400020) [ 28.537429] ---[ end trace 5eced933df3a080b ]---
--- drivers/net/ethernet/marvell/prestera/prestera_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/prestera/prestera_main.c +2 -1
@@ -431,7 +431,8 @@ static void prestera_port_handle_event(struct prestera_switch *sw,netif_carrier_on (port->dev);if (!delayed_work_pending (caching_dw))queue_delayed_work (prestera_wq, caching_dw,0 ); - }else { + }else if (netif_running (port->dev) && +netif_carrier_ok (port->dev)) {netif_carrier_off (port->dev);if (delayed_work_pending (caching_dw))cancel_delayed_work (caching_dw);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 541/601 net: davinci_emac: Fix incorrect masking of tx and rx error channel
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit d83b8aa5207d81f9f6daec9888390f079cc5db3f ]
The bit-masks used for the TXERRCH and RXERRCH (tx and rx error channels) are incorrect and always lead to a zero result. The mask values are currently the incorrect post-right shifted values, fix this by setting them to the currect values.
(I double checked these against the TMS320TCI6482 data sheet, section 5.30, page 127 to ensure I had the correct mask values for the TXERRCH and RXERRCH fields in the MACSTATUS register).
Addresses-Coverity: ("Operands don't affect result")
--- drivers/net/ethernet/ti/davinci_emac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/ti/davinci_emac.c +2 -2
@@ -169,11 +169,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1";/* EMAC mac_status register */ #define EMAC_MACSTATUS_TXERRCODE_MASK (0xF00000)#define EMAC_MACSTATUS_TXERRCODE_SHIFT (20) -#define EMAC_MACSTATUS_TXERRCH_MASK (0x7) +#define EMAC_MACSTATUS_TXERRCH_MASK (0x70000)#define EMAC_MACSTATUS_TXERRCH_SHIFT (16)#define EMAC_MACSTATUS_RXERRCODE_MASK (0xF000)#define EMAC_MACSTATUS_RXERRCODE_SHIFT (12) -#define EMAC_MACSTATUS_RXERRCH_MASK (0x7) +#define EMAC_MACSTATUS_RXERRCH_MASK (0x700)#define EMAC_MACSTATUS_RXERRCH_SHIFT (8)/* EMAC RX register masks */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 542/601 mt76: mt7615: fix memleak when mt7615_unregister_device()
In reply to Greg Kroah-HartmanFrom: Ryder Lee <[email protected]>
[ Upstream commit 8ab31da7b89f71c4c2defcca989fab7b42f87d71 ]
mt7615_tx_token_put() should get call before mt76_free_pending_txwi().
--- drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c +1 -2
@@ -168,10 +168,9 @@ void mt7615_unregister_device(struct mt7615_dev *dev)mt76_unregister_device (&dev->mt76);if (mcu_running)mt7615_mcu_exit (dev); -mt7615_dma_cleanup (dev);mt7615_tx_token_put (dev); - +mt7615_dma_cleanup (dev);tasklet_disable (&dev->irq_tasklet);mt76_free_device (&dev->mt76);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 543/601 mt76: mt7915: fix memleak when mt7915_unregister_device()
In reply to Greg Kroah-HartmanFrom: Ryder Lee <[email protected]>
[ Upstream commit e9d32af478cfc3744a45245c0b126738af4b3ac4 ]
mt7915_tx_token_put() should get call before mt76_free_pending_txwi().
--- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/init.c +1 -2
@@ -675,9 +675,8 @@ void mt7915_unregister_device(struct mt7915_dev *dev)mt7915_unregister_ext_phy (dev);mt76_unregister_device (&dev->mt76);mt7915_mcu_exit (dev); -mt7915_dma_cleanup (dev); -mt7915_tx_token_put (dev); +mt7915_dma_cleanup (dev);mt76_free_device (&dev->mt76); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 544/601 powerpc/pseries/iommu: Fix window size for direct mapping with pmem
In reply to Greg Kroah-HartmanFrom: Leonardo Bras <[email protected]>
[ Upstream commit a9d2f9bb225fd2a764aef57738ab6c7f38d782ae ]
As of today, if the DDW is big enough to fit (1 << MAX_PHYSMEM_BITS) it's possible to use direct DMA mapping even with pmem region.
But, if that happens, the window size (len) is set to (MAX_PHYSMEM_BITS
- page_shift) instead of MAX_PHYSMEM_BITS, causing a pagesize times smaller DDW to be created, being insufficient for correct usage.
Fix this so the correct window size is used in this case.
--- arch/powerpc/platforms/pseries/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/pseries/iommu.c +1 -1
@@ -1229,7 +1229,7 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)if (pmem_present) {if (query.largest_available_block >= (1ULL << (MAX_PHYSMEM_BITS - page_shift))) - len =MAX_PHYSMEM_BITS - page_shift; + len =MAX_PHYSMEM_BITS ;else dev_info (&dev->dev,"Skipping ibm,pmemory" ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 545/601 crypto: ccp: Detect and reject "invalid" addresses destined for PSP
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 74c1f1366eb7714b8b211554f6c5cee315ff3fbc ]
Explicitly reject using pointers that are not virt_to_phys() friendly as the source for SEV commands that are sent to the PSP. The PSP works with physical addresses, and __pa()/virt_to_phys() will not return the correct address in these cases, e.g. for a vmalloc'd pointer. At best, the bogus address will cause the command to fail, and at worst lead to system instability.
While it's unlikely that callers will deliberately use a bad pointer for SEV buffers, a caller can easily use a vmalloc'd pointer unknowingly when running with CONFIG_VMAP_STACK=y as it's not obvious that putting the command buffers on the stack would be bad. The command buffers are relative small and easily fit on the stack, and the APIs to do not document that the incoming pointer must be a physically contiguous, __pa() friendly pointer.
Message-Id: <[email protected]>
--- drivers/crypto/ccp/sev-dev.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/crypto/ccp/sev-dev.c +3 -0
@@ -149,6 +149,9 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret) sev = psp->sev_data; +if (data &&WARN_ON_ONCE (!virt_addr_valid (data))) +return -EINVAL ; +/* Get the physical address of the command buffer */ phys_lsb = data ?lower_32_bits (__psp_pa (data)) :0 ; phys_msb = data ?upper_32_bits (__psp_pa (data)) :0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 546/601 net: dsa: mv88e6xxx: Fix off-by-one in VTU devlink region size
In reply to Greg Kroah-HartmanFrom: Tobias Waldekranz <[email protected]>
[ Upstream commit 281140a0a2ce4febf2c0ce5d29d0e7d961a826b1 ]
In the unlikely event of the VTU being loaded to the brim with 4k entries, the last one was placed in the buffer, but the size reported to devlink was off-by-one. Make sure that the final entry is available to the caller.
--- drivers/net/dsa/mv88e6xxx/devlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/devlink.c +1 -1
@@ -678,7 +678,7 @@ static int mv88e6xxx_setup_devlink_regions_global(struct dsa_switch *ds,sizeof (struct mv88e6xxx_devlink_atu_entry );break ;case MV88E6XXX_REGION_VTU : - size =mv88e6xxx_max_vid (chip) * + size = (mv88e6xxx_max_vid (chip) +1 ) *sizeof (struct mv88e6xxx_devlink_vtu_entry );break ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 547/601 nfp: devlink: initialize the devlink port attribute "lanes"
In reply to Greg Kroah-HartmanFrom: Yinjun Zhang <[email protected]>
[ Upstream commit 90b669d65d99a3ee6965275269967cdee4da106e ]
The number of lanes of devlink port should be correctly initialized when registering the port, so that the input check when running "devlink port split <port> count <N>" can pass.
--- drivers/net/ethernet/netronome/nfp/nfp_devlink.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/netronome/nfp/nfp_devlink.c +1 -0
@@ -364,6 +364,7 @@ int nfp_devlink_port_register(struct nfp_app *app, struct nfp_port *port) attrs.split = eth_port.is_split; attrs.splittable = !attrs.split; + attrs.lanes = eth_port.port_lanes; attrs.flavour =DEVLINK_PORT_FLAVOUR_PHYSICAL ; attrs.phys.port_number = eth_port.label_port; attrs.phys.split_subport_number = eth_port.label_subport;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 548/601 net: stmmac: fix TSO and TBS feature enabling during driver open
In reply to Greg Kroah-HartmanFrom: Ong Boon Leong <[email protected]>
[ Upstream commit 5e6038b88a5718910dd74b949946d9d9cee9a041 ]
TSO and TBS cannot co-exist and current implementation requires two fixes:
1) stmmac_open() does not need to call stmmac_enable_tbs() because the MAC is reset in stmmac_init_dma_engine() anyway.
2) Inside stmmac_hw_setup(), we should call stmmac_enable_tso() for TX Q that is _not_ configured for TBS.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +9 -3
@@ -2757,8 +2757,15 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp)/* Enable TSO */ if (priv->tso) { -for (chan =0 ; chan < tx_cnt; chan++) +for (chan =0 ; chan < tx_cnt; chan++) { +struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan]; + +/* TSO and TBS cannot co-exist */ +if (tx_q->tbs &STMMAC_TBS_AVAIL ) +continue ; +stmmac_enable_tso (priv, priv->ioaddr,1 , chan); + } }/* Enable Split Header */
@@ -2850,9 +2857,8 @@ static int stmmac_open(struct net_device *dev)struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];int tbs_en = priv->plat->tx_queues_cfg[chan].tbs_en; +/* Setup per-TXQ tbs flag before TX descriptor alloc */ tx_q->tbs |= tbs_en ?STMMAC_TBS_AVAIL :0 ; -if (stmmac_enable_tbs (priv, priv->ioaddr, tbs_en, chan)) - tx_q->tbs &= ~STMMAC_TBS_AVAIL ; } ret =alloc_dma_desc_resources (priv);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 549/601 net: renesas: ravb: Fix a stuck issue when a lot of frames are received
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
[ Upstream commit 5718458b092bf6bf4482c5df32affba3c3259517 ]
When a lot of frames were received in the short term, the driver caused a stuck of receiving until a new frame was received. For example, the following command from other device could cause this issue.
$ sudo ping -f -l 1000 -c 1000 <this driver's ipaddress>
The previous code always cleared the interrupt flag of RX but checks the interrupt flags in ravb_poll(). So, ravb_poll() could not call ravb_rx() in the next time until a new RX frame was received if ravb_rx() returned true. To fix the issue, always calls ravb_rx() regardless the interrupt flags condition.
--- drivers/net/ethernet/renesas/ravb_main.c | 35 ++++++++---------------- 1 file changed, 12 insertions(+), 23 deletions(-)
drivers/net/ethernet/renesas/ravb_main.c +12 -23
@@ -911,31 +911,20 @@ static int ravb_poll(struct napi_struct *napi, int budget)int q = napi - priv->napi;int mask =BIT (q);int quota = budget; -u32 ris0, tis; -for (;;) { - tis =ravb_read (ndev,TIS ); - ris0 =ravb_read (ndev,RIS0 ); -if (!((ris0 & mask) || (tis & mask))) -break ; +/* Processing RX Descriptor Ring */ +/* Clear RX interrupt */ +ravb_write (ndev, ~(mask |RIS0_RESERVED ),RIS0 ); +if (ravb_rx (ndev, "a, q)) + goto out; -/* Processing RX Descriptor Ring */ -if (ris0 & mask) { -/* Clear RX interrupt */ -ravb_write (ndev, ~(mask |RIS0_RESERVED ),RIS0 ); -if (ravb_rx (ndev, "a, q)) - goto out; - } -/* Processing TX Descriptor Ring */ -if (tis & mask) { -spin_lock_irqsave (&priv->lock, flags); -/* Clear TX interrupt */ -ravb_write (ndev, ~(mask |TIS_RESERVED ),TIS ); -ravb_tx_free (ndev, q, true); -netif_wake_subqueue (ndev, q); -spin_unlock_irqrestore (&priv->lock, flags); - } - } +/* Processing RX Descriptor Ring */ +spin_lock_irqsave (&priv->lock, flags); +/* Clear TX interrupt */ +ravb_write (ndev, ~(mask |TIS_RESERVED ),TIS ); +ravb_tx_free (ndev, q, true); +netif_wake_subqueue (ndev, q); +spin_unlock_irqrestore (&priv->lock, flags);napi_complete (napi);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 550/601 net: phy: intel-xway: enable integrated led functions
In reply to Greg Kroah-HartmanFrom: Martin Schiller <[email protected]>
[ Upstream commit 357a07c26697a770d39d28b6b111f978deb4017d ]
The Intel xway phys offer the possibility to deactivate the integrated LED function and to control the LEDs manually.
If this was set by the bootloader, it must be ensured that the integrated LED function is enabled for all LEDs when loading the driver.
Before commit 6e2d85ec0559 ("net: phy: Stop with excessive soft reset") the LEDs were enabled by a soft-reset of the PHY (using genphy_soft_reset). Initialize the XWAY_MDIO_LED with it's default value (which is applied during a soft reset) instead of adding back the soft reset. This brings back the default LED configuration while still preventing an excessive amount of soft resets.
--- drivers/net/phy/intel-xway.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/net/phy/intel-xway.c +21 -0
@@ -11,6 +11,18 @@#define XWAY_MDIO_IMASK 0x19/* interrupt mask */ #define XWAY_MDIO_ISTAT 0x1A/* interrupt status */ +#define XWAY_MDIO_LED 0x1B/* led control */ + +/* bit 15:12 are reserved */ +#define XWAY_MDIO_LED_LED3_EN BIT(11)/* Enable the integrated function of LED3 */ +#define XWAY_MDIO_LED_LED2_EN BIT(10)/* Enable the integrated function of LED2 */ +#define XWAY_MDIO_LED_LED1_EN BIT(9)/* Enable the integrated function of LED1 */ +#define XWAY_MDIO_LED_LED0_EN BIT(8)/* Enable the integrated function of LED0 */ +/* bit 7:4 are reserved */ +#define XWAY_MDIO_LED_LED3_DA BIT(3)/* Direct Access to LED3 */ +#define XWAY_MDIO_LED_LED2_DA BIT(2)/* Direct Access to LED2 */ +#define XWAY_MDIO_LED_LED1_DA BIT(1)/* Direct Access to LED1 */ +#define XWAY_MDIO_LED_LED0_DA BIT(0)/* Direct Access to LED0 */ #define XWAY_MDIO_INIT_WOL BIT(15)/* Wake-On-LAN */ #define XWAY_MDIO_INIT_MSRE BIT(14)
@@ -159,6 +171,15 @@ static int xway_gphy_config_init(struct phy_device *phydev)/* Clear all pending interrupts */ phy_read (phydev,XWAY_MDIO_ISTAT ); +/* Ensure that integrated led function is enabled for all leds */ + err =phy_write (phydev,XWAY_MDIO_LED , +XWAY_MDIO_LED_LED0_EN | +XWAY_MDIO_LED_LED1_EN | +XWAY_MDIO_LED_LED2_EN | +XWAY_MDIO_LED_LED3_EN ); +if (err) +return err; + phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDCH, XWAY_MMD_LEDCH_NACS_NONE | XWAY_MMD_LEDCH_SBF_F02HZ |
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 551/601 RDMA/rxe: Fix a bug in rxe_fill_ip_info()
In reply to Greg Kroah-HartmanFrom: Bob Pearson <[email protected]>
[ Upstream commit 45062f441590810772959d8e1f2b24ba57ce1bd9 ]
Fix a bug in rxe_fill_ip_info() which was attempting to convert from RDMA_NETWORK_XXX to RXE_NETWORK_XXX. .._IPV6 should have mapped to .._IPV6 not .._IPV4.
--- drivers/infiniband/sw/rxe/rxe_av.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_av.c +1 -1
@@ -88,7 +88,7 @@ void rxe_av_fill_ip_info(struct rxe_av *av, struct rdma_ah_attr *attr) type =RXE_NETWORK_TYPE_IPV4 ;break ;case RDMA_NETWORK_IPV6 : - type =RXE_NETWORK_TYPE_IPV4 ; + type =RXE_NETWORK_TYPE_IPV6 ;break ;default :/* not reached - checked in rxe_av_chk_attr */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 552/601 RDMA/core: Add CM to restrack after successful attachment to a device
In reply to Greg Kroah-HartmanFrom: Shay Drory <[email protected]>
[ Upstream commit cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa ]
The device attach triggers addition of CM_ID to the restrack DB. However, when error occurs, we releasing this device, but defer CM_ID release. This causes to the situation where restrack sees CM_ID that is not valid anymore.
As a solution, add the CM_ID to the resource tracking DB only after the attachment is finished.
Found by syzcaller:
infiniband syz0: added syz_tunrdma_rxe: ignoring netdev event = 10 for syz_tun infiniband syz0: set down
infiniband syz0: ib_query_port failed (-19)
restrack: ------------[ cut here ]------------
infiniband syz0: BUG: RESTRACK detected leak of resources
restrack: User CM_ID object allocated by syz-executor716 is not freed
restrack: ------------[ cut here ]------------
--- drivers/infiniband/core/cma.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/infiniband/core/cma.c +10 -2
@@ -463,7 +463,6 @@ static void _cma_attach_to_dev(struct rdma_id_private *id_priv, id_priv->id.route.addr.dev_addr.transport =rdma_node_get_transport (cma_dev->device->node_type);list_add_tail (&id_priv->list, &cma_dev->id_list); -rdma_restrack_add (&id_priv->res);trace_cm_id_attach (id_priv, cma_dev->device); }
@@ -700,6 +699,7 @@ static int cma_ib_acquire_dev(struct rdma_id_private *id_priv,mutex_lock (&lock);cma_attach_to_dev (id_priv, listen_id_priv->cma_dev);mutex_unlock (&lock); +rdma_restrack_add (&id_priv->res);return 0 ; }
@@ -754,8 +754,10 @@ static int cma_iw_acquire_dev(struct rdma_id_private *id_priv, } out: -if (!ret) +if (!ret) {cma_attach_to_dev (id_priv, cma_dev); +rdma_restrack_add (&id_priv->res); + }mutex_unlock (&lock);return ret;
@@ -816,6 +818,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) found:cma_attach_to_dev (id_priv, cma_dev); +rdma_restrack_add (&id_priv->res);mutex_unlock (&lock); addr = (struct sockaddr_ib *)cma_src_addr (id_priv);memcpy (&addr->sib_addr, &sgid,sizeof (sgid));
@@ -2529,6 +2532,7 @@ static int cma_listen_on_dev(struct rdma_id_private *id_priv, rdma_addr_size(cma_src_addr(id_priv)));_cma_attach_to_dev (dev_id_priv, cma_dev); +rdma_restrack_add (&dev_id_priv->res);cma_id_get (id_priv); dev_id_priv->internal_id =1 ; dev_id_priv->afonly = id_priv->afonly;
@@ -3169,6 +3173,7 @@ port_found:ib_addr_set_pkey (&id_priv->id.route.addr.dev_addr, pkey); id_priv->id.port_num = p;cma_attach_to_dev (id_priv, cma_dev); +rdma_restrack_add (&id_priv->res);cma_set_loopback (cma_src_addr (id_priv)); out:mutex_unlock (&lock);
@@ -3201,6 +3206,7 @@ static void addr_handler(int status, struct sockaddr *src_addr,if (status)pr_debug_ratelimited ("RDMA CM: ADDR_ERROR: failed to acquire device. status %d\n" , status); +rdma_restrack_add (&id_priv->res); }else if (status) {pr_debug_ratelimited ("RDMA CM: ADDR_ERROR: failed to resolve IP. status %d\n" , status); }
@@ -3812,6 +3818,8 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)if (ret) goto err2; +if (!cma_any_addr (addr)) +rdma_restrack_add (&id_priv->res);return 0 ; err2:if (id_priv->cma_dev)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 553/601 powerpc/64: Fix the definition of the fixmap area
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 9ccba66d4d2aff9a3909aa77d57ea8b7cc166f3c ]
At the time being, the fixmap area is defined at the top of the address space or just below KASAN.
This definition is not valid for PPC64.
For PPC64, use the top of the I/O space.
Because of circular dependencies, it is not possible to include asm/fixmap.h in asm/book3s/64/pgtable.h , so define a fixed size AREA at the top of the I/O space for fixmap and ensure during build that the size is big enough.
--- arch/powerpc/include/asm/book3s/64/pgtable.h | 4 +++- arch/powerpc/include/asm/fixmap.h | 9 +++++++++ arch/powerpc/include/asm/nohash/64/pgtable.h | 5 ++++- 3 files changed, 16 insertions(+), 2 deletions(-)
arch/powerpc/include/asm/book3s/64/pgtable.h +3 -1
@@ -7,6 +7,7 @@#ifndef __ASSEMBLY__#include <linux/mmdebug.h> #include <linux/bug.h> +#include <linux/sizes.h> #endif /*
@@ -323,7 +324,8 @@ extern unsigned long pci_io_base;#define PHB_IO_END (KERN_IO_START + FULL_IO_SIZE)#define IOREMAP_BASE (PHB_IO_END)#define IOREMAP_START (ioremap_bot) -#define IOREMAP_END (KERN_IO_END) +#define IOREMAP_END (KERN_IO_END - FIXADDR_SIZE) +#define FIXADDR_SIZE SZ_32M/* Advertise special mapping type for AGP */ #define HAVE_PAGE_AGP
arch/powerpc/include/asm/fixmap.h +9 -0
@@ -23,12 +23,17 @@#include <asm/kmap_size.h> #endif +#ifdef CONFIG_PPC64 +#define FIXADDR_TOP (IOREMAP_END + FIXADDR_SIZE) +#else +#define FIXADDR_SIZE 0#ifdef CONFIG_KASAN #include <asm/kasan.h> #define FIXADDR_TOP (KASAN_SHADOW_START - PAGE_SIZE)#else #define FIXADDR_TOP ((unsigned long)(-PAGE_SIZE))#endif +#endif /* * Here we define all the compile-time 'special' virtual
@@ -50,6 +55,7 @@*/ enum fixed_addresses {FIX_HOLE , +#ifdef CONFIG_PPC32 /* reserve the top 128K for early debugging purposes */ FIX_EARLY_DEBUG_TOP =FIX_HOLE ,FIX_EARLY_DEBUG_BASE =FIX_EARLY_DEBUG_TOP +(ALIGN (SZ_128K ,PAGE_SIZE )/PAGE_SIZE )-1 ,
@@ -72,6 +78,7 @@ enum fixed_addresses { FIX_IMMR_SIZE,#endif /* FIX_PCIE_MCFG, */ +#endif /* CONFIG_PPC32 */ __end_of_permanent_fixed_addresses, #define NR_FIX_BTMAPS (SZ_256K / PAGE_SIZE)
@@ -98,6 +105,8 @@ enum fixed_addresses {static inline void __set_fixmap (enum fixed_addresses idx,phys_addr_t phys,pgprot_t flags) { +BUILD_BUG_ON (IS_ENABLED (CONFIG_PPC64 ) && __FIXADDR_SIZE >FIXADDR_SIZE ); +if (__builtin_constant_p (idx))BUILD_BUG_ON (idx >= __end_of_fixed_addresses);else if (WARN_ON (idx >= __end_of_fixed_addresses))
arch/powerpc/include/asm/nohash/64/pgtable.h +4 -1
@@ -6,6 +6,8 @@* the ppc64 non-hashed page table. */ +#include <linux/sizes.h> +#include <asm/nohash/64/pgtable-4k.h> #include <asm/barrier.h> #include <asm/asm-const.h>
@@ -54,7 +56,8 @@#define PHB_IO_END (KERN_IO_START + FULL_IO_SIZE)#define IOREMAP_BASE (PHB_IO_END)#define IOREMAP_START (ioremap_bot) -#define IOREMAP_END (KERN_VIRT_START + KERN_VIRT_SIZE) +#define IOREMAP_END (KERN_VIRT_START + KERN_VIRT_SIZE - FIXADDR_SIZE) +#define FIXADDR_SIZE SZ_32M/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 554/601 ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
In reply to Greg Kroah-HartmanFrom: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 7dd9a40fd6e0d0f1fd8e1931c007e080801dfdce ]
When the error check in ath9k_hw_read_revisions() was added, it checked for -EIO which is what ath9k_regread() in the ath9k_htc driver uses. However, for plain ath9k, the register read function uses ioread32(), which just returns -1 on error. So if such a read fails, it still gets passed through and ends up as a weird mac revision in the log output.
Fix this by changing ath9k_regread() to return -1 on error like ioread32() does, and fix the error check to look for that instead of -EIO.
--- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +- drivers/net/wireless/ath/ath9k/hw.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/htc_drv_init.c +1 -1
@@ -246,7 +246,7 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)if (unlikely (r)) {ath_dbg (common,WMI ,"REGISTER READ FAILED: (0x%04x, %d)\n" , reg_offset, r); -return -EIO ; +return -1 ; }return be32_to_cpu (val);
drivers/net/wireless/ath/ath9k/hw.c +1 -1
@@ -287,7 +287,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah) srev =REG_READ (ah,AR_SREV ); -if (srev == -EIO ) { +if (srev ==-1 ) {ath_err (ath9k_hw_common (ah),"Failed to read SREV register" );return false;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 555/601 ath10k: Fix a use after free in ath10k_htc_send_bundle
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 8392df5d7e0b6a7d21440da1fc259f9938f4dec3 ]
In ath10k_htc_send_bundle, the bundle_skb could be freed by dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later by bundle_skb->len.
As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to skb_len after the bundle_skb was freed.
--- drivers/net/wireless/ath/ath10k/htc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/htc.c +1 -1
@@ -665,7 +665,7 @@ static int ath10k_htc_send_bundle(struct ath10k_htc_ep *ep,ath10k_dbg (ar,ATH10K_DBG_HTC ,"bundle tx status %d eid %d req count %d count %d len %d\n" , - ret, ep->eid,skb_queue_len (&ep->tx_req_head), cn, bundle_skb->len); + ret, ep->eid,skb_queue_len (&ep->tx_req_head), cn, skb_len);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 556/601 ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock
In reply to Greg Kroah-HartmanFrom: Shuah Khan <[email protected]>
[ Upstream commit eaaf52e4b866f265eb791897d622961293fd48c1 ]
ath10k_wmi_tlv_op_pull_peer_stats_info() could try to unlock RCU lock winthout locking it first when peer reason doesn't match the valid cases for this function.
Add a default case to return without unlocking.
--- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath10k/wmi-tlv.c +3 -0
@@ -592,6 +592,9 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb)GFP_ATOMIC );break ; +default : +kfree (tb); +return ; } exit:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 557/601 wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit a9a4c080deb33f44e08afe35f4ca4bb9ece89f4e ]
The size of the buffer than can be written to is currently incorrect, it is always the size of the entire buffer even though the snprintf is writing as position pos into the buffer. Fix this by setting the buffer size to be the number of bytes left in the buffer, namely sizeof(buf) - pos.
Addresses-Coverity: ("Out-of-bounds access")
--- drivers/net/wireless/ti/wlcore/debugfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ti/wlcore/debugfs.h +1 -1
@@ -84,7 +84,7 @@ static ssize_t sub## _ ##name## _read(struct file *file, \wl1271_debugfs_update_stats (wl); \ \for (i =0 ; i < len && pos <sizeof (buf); i++) \ - pos +=snprintf (buf + pos,sizeof (buf), \ + pos +=snprintf (buf + pos,sizeof (buf) - pos, \"[%d] = %d\n" , i, stats->sub.name[i]); \ \return wl1271_format_buffer (userbuf, count, ppos,"%s" , buf); \
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 558/601 powerpc/perf: Fix the threshold event selection for memory events in power10
In reply to Greg Kroah-HartmanFrom: Athira Rajeev <[email protected]>
[ Upstream commit 66d9b7492887d34c711bc05b36c22438acba51b4 ]
Memory events (mem-loads and mem-stores) currently use the threshold event selection as issue to finish. Power10 supports issue to complete as part of thresholding which is more appropriate for mem-loads and mem-stores. Hence fix the event code for memory events to use issue to complete.
--- arch/powerpc/perf/power10-events-list.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/perf/power10-events-list.h +2 -2
@@ -75,5 +75,5 @@ EVENT(PM_RUN_INST_CMPL_ALT, 0x00002);* thresh end (TE) */ -EVENT (MEM_LOADS ,0x34340401e0 ); -EVENT (MEM_STORES ,0x343c0401e0 ); +EVENT (MEM_LOADS ,0x35340401e0 ); +EVENT (MEM_STORES ,0x353c0401e0 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 559/601 powerpc/52xx: Fix an invalid ASM expression (addi used instead of add)
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 8a87a507714386efc39c3ae6fa24d4f79846b522 ]
AS arch/powerpc/platforms/52xx/lite5200_sleep.oarch/powerpc/platforms/52xx/lite5200_sleep.S: Assembler messages:arch/powerpc/platforms/52xx/lite5200_sleep.S:184: Warning: invalid register expression
In the following code, 'addi' is wrong, has to be 'add'
/* local udelay in sram is needed */ udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ mullw r12, r12, r11 mftb r13 /* start */ addi r12, r13, r12 /* end */
--- arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/52xx/lite5200_sleep.S +1 -1
@@ -181,7 +181,7 @@ sram_code: udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ mullw r12, r12, r11 mftb r13 /* start */ - addi r12, r13, r12 /* end */ + add r12, r13, r12 /* end */ 1: mftb r13 /* current */ cmp cr0, r13, r12
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 560/601 net: phy: marvell: fix m88e1011_set_downshift
In reply to Greg Kroah-HartmanFrom: Maxim Kochetkov <[email protected]>
[ Upstream commit 990875b299b8612aeb85cb2e2751796f1add65ff ]
Changing downshift params without software reset has no effect, so call genphy_soft_reset() after change downshift params.
As the datasheet says:
Changes to these bits are disruptive to the normal operation therefore, any changes to these registers must be followed by software reset to take effect.
--- drivers/net/phy/marvell.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-)
drivers/net/phy/marvell.c +16 -10
@@ -1022,22 +1022,28 @@ static int m88e1011_get_downshift(struct phy_device *phydev, u8 *data)static int m88e1011_set_downshift (struct phy_device *phydev,u8 cnt) { -int val; +int val, err;if (cnt >MII_M1011_PHY_SCR_DOWNSHIFT_MAX )return -E2BIG ; -if (!cnt) -return phy_clear_bits (phydev,MII_M1011_PHY_SCR , -MII_M1011_PHY_SCR_DOWNSHIFT_EN ); +if (!cnt) { + err =phy_clear_bits (phydev,MII_M1011_PHY_SCR , +MII_M1011_PHY_SCR_DOWNSHIFT_EN ); + }else { + val =MII_M1011_PHY_SCR_DOWNSHIFT_EN ; + val |=FIELD_PREP (MII_M1011_PHY_SCR_DOWNSHIFT_MASK , cnt -1 ); - val =MII_M1011_PHY_SCR_DOWNSHIFT_EN ; - val |=FIELD_PREP (MII_M1011_PHY_SCR_DOWNSHIFT_MASK , cnt -1 ); + err =phy_modify (phydev,MII_M1011_PHY_SCR , +MII_M1011_PHY_SCR_DOWNSHIFT_EN | +MII_M1011_PHY_SCR_DOWNSHIFT_MASK , + val); + } -return phy_modify (phydev,MII_M1011_PHY_SCR , -MII_M1011_PHY_SCR_DOWNSHIFT_EN | -MII_M1011_PHY_SCR_DOWNSHIFT_MASK , - val); +if (err <0 ) +return err; + +return genphy_soft_reset (phydev); } static int m88e1011_get_tunable(struct phy_device *phydev,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 561/601 net: phy: marvell: fix m88e1111_set_downshift
In reply to Greg Kroah-HartmanFrom: Maxim Kochetkov <[email protected]>
[ Upstream commit e7679c55a7249f1315256cfc672d53e84072e223 ]
Changing downshift params without software reset has no effect, so call genphy_soft_reset() after change downshift params.
As the datasheet says:
Changes to these bits are disruptive to the normal operation therefore, any changes to these registers must be followed by software reset to take effect.
--- drivers/net/phy/marvell.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-)
drivers/net/phy/marvell.c +16 -10
@@ -964,22 +964,28 @@ static int m88e1111_get_downshift(struct phy_device *phydev, u8 *data)static int m88e1111_set_downshift (struct phy_device *phydev,u8 cnt) { -int val; +int val, err;if (cnt >MII_M1111_PHY_EXT_CR_DOWNSHIFT_MAX )return -E2BIG ; -if (!cnt) -return phy_clear_bits (phydev,MII_M1111_PHY_EXT_CR , -MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN ); +if (!cnt) { + err =phy_clear_bits (phydev,MII_M1111_PHY_EXT_CR , +MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN ); + }else { + val =MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN ; + val |=FIELD_PREP (MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK , cnt -1 ); - val =MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN ; - val |=FIELD_PREP (MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK , cnt -1 ); + err =phy_modify (phydev,MII_M1111_PHY_EXT_CR , +MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN | +MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK , + val); + } -return phy_modify (phydev,MII_M1111_PHY_EXT_CR , -MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN | -MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK , - val); +if (err <0 ) +return err; + +return genphy_soft_reset (phydev); } static int m88e1111_get_tunable(struct phy_device *phydev,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 562/601 net: enetc: fix link error again
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 74c97ea3b61e4ce149444f904ee8d4fc7073505b ]
A link time bug that I had fixed before has come back now that another sub-module was added to the enetc driver:
ERROR: modpost: "enetc_ierb_register_pf" [drivers/net/ethernet/freescale/enetc/fsl-enetc.ko] undefined!
The problem is that the enetc Makefile is not actually used for the ierb module if that is the only built-in driver in there and everything else is a loadable module.
Fix it by always entering the directory this time, regardless of which symbols are configured. This should reliably fix the problem and prevent it from coming back another time.
--- drivers/net/ethernet/freescale/Makefile | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/freescale/Makefile +1 -3
@@ -24,6 +24,4 @@ obj-$(CONFIG_FSL_DPAA_ETH) += dpaa/ obj-$(CONFIG_FSL_DPAA2_ETH) += dpaa2/ -obj-$(CONFIG_FSL_ENETC) += enetc/ -obj-$(CONFIG_FSL_ENETC_MDIO) += enetc/ -obj-$(CONFIG_FSL_ENETC_VF) += enetc/ +obj-y += enetc/
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 563/601 bnxt_en: fix ternary sign extension bug in bnxt_show_temp()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 27537929f30d3136a71ef29db56127a33c92dad7 ]
The problem is that bnxt_show_temp() returns long but "rc" is an int and "len" is a u32. With ternary operations the type promotion is quite tricky. The negative "rc" is first promoted to u32 and then to long so it ends up being a high positive value instead of a a negative as we intended.
Fix this by removing the ternary.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +3 -1
@@ -9546,7 +9546,9 @@ static ssize_t bnxt_show_temp(struct device *dev,if (!rc) len =sprintf (buf,"%u\n" , resp->temp *1000 );/* display millidegree */ mutex_unlock (&bp->hwrm_cmd_lock); -return rc ?: len; +if (rc) +return rc; +return len; } static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 564/601 ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
In reply to Greg Kroah-HartmanFrom: Kunihiko Hayashi <[email protected]>
[ Upstream commit 9ba585cc5b56ea14a453ba6be9bdb984ed33471a ]
UniPhier PXs2 boards have RTL8211E ethernet phy, and the phy have the RX/TX delays of RGMII interface using pull-ups on the RXDLY and TXDLY pins.
After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay config"), the delays are working correctly, however, "rgmii" means no delay and the phy doesn't work. So need to set the phy-mode to "rgmii-id" to show that RX/TX delays are enabled.
--- arch/arm/boot/dts/uniphier-pxs2.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/uniphier-pxs2.dtsi +1 -1
@@ -583,7 +583,7 @@ clocks = <&sys_clk 6>; reset-names = "ether"; resets = <&sys_rst 6>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; local-mac-address = [00 00 00 00 00 00]; socionext,syscon-phy-mode = <&soc_glue 0>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 565/601 arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
In reply to Greg Kroah-HartmanFrom: Kunihiko Hayashi <[email protected]>
[ Upstream commit dcabb06bf127b3e0d3fbc94a2b65dd56c2725851 ]
UniPhier LD20 and PXs3 boards have RTL8211E ethernet phy, and the phy have the RX/TX delays of RGMII interface using pull-ups on the RXDLY and TXDLY pins.
After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay config"), the delays are working correctly, however, "rgmii" means no delay and the phy doesn't work. So need to set the phy-mode to "rgmii-id" to show that RX/TX delays are enabled.
--- arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi | 2 +- arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi +1 -1
@@ -734,7 +734,7 @@ clocks = <&sys_clk 6>; reset-names = "ether"; resets = <&sys_rst 6>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; local-mac-address = [00 00 00 00 00 00]; socionext,syscon-phy-mode = <&soc_glue 0>;
arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi +2 -2
@@ -564,7 +564,7 @@ clocks = <&sys_clk 6>; reset-names = "ether"; resets = <&sys_rst 6>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; local-mac-address = [00 00 00 00 00 00]; socionext,syscon-phy-mode = <&soc_glue 0>;
@@ -585,7 +585,7 @@ clocks = <&sys_clk 7>; reset-names = "ether"; resets = <&sys_rst 7>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; local-mac-address = [00 00 00 00 00 00]; socionext,syscon-phy-mode = <&soc_glue 1>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 566/601 net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb
In reply to Greg Kroah-HartmanFrom: Phillip Potter <[email protected]>
[ Upstream commit d13f048dd40e8577260cd43faea8ec9b77520197 ]
Modify the header size check in geneve6_xmit_skb and geneve_xmit_skb to use pskb_inet_may_pull rather than pskb_network_may_pull. This fixes two kernel selftest failures introduced by the commit introducing the checks:
IPv4 over geneve6: PMTU exceptions
IPv4 over geneve6: PMTU exceptions - nexthop objects
It does this by correctly accounting for the fact that IPv4 packets may transit over geneve IPv6 tunnels (and vice versa), and still fixes the uninit-value bug fixed by the original commit.
--- drivers/net/geneve.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/geneve.c +2 -2
@@ -891,7 +891,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!pskb_network_may_pull (skb,sizeof (struct iphdr ))) +if (!pskb_inet_may_pull (skb))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
@@ -988,7 +988,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!pskb_network_may_pull (skb,sizeof (struct ipv6hdr ))) +if (!pskb_inet_may_pull (skb))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 567/601 selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static
In reply to Greg Kroah-HartmanFrom: Petr Machata <[email protected]>
[ Upstream commit c8d0260cdd96fdccdef0509c4160e28a1012a5d7 ]
The FDB roaming test installs a destination MAC address on the wrong interface of an FDB database and tests whether the mirroring fails, because packets are sent to the wrong port. The test by mistake installs the FDB entry as local. This worked previously, because drivers were notified of local FDB entries in the same way as of static entries. However that has been fixed in the commit 6ab4c3117aec ("net: bridge: don't notify switchdev for local FDB addresses"), and local entries are not notified anymore. As a result, the HW is not reconfigured for the FDB roam, and mirroring keeps working, failing the test.
To fix the issue, mark the FDB entry as static.
--- .../selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh +1 -1
@@ -271,7 +271,7 @@ test_span_gre_fdb_roaming() while ((RET == 0)); do bridge fdb del dev $swp3 $h3mac vlan 555 master 2>/dev/null - bridge fdb add dev $swp2 $h3mac vlan 555 master + bridge fdb add dev $swp2 $h3mac vlan 555 master static sleep 1 fail_test_span_gre_dir $tundev ingress
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 568/601 selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test
In reply to Greg Kroah-HartmanFrom: Danielle Ratson <[email protected]>
[ Upstream commit 1f1c92139e36223b89d8140f2b72f75e79baf8bd ]
Currently, the error return code of the failure condition is lost after using an if statement, so the test doesn't fail when it should.
Remove the if statement that separates the condition and the error code check, so the test won't always pass.
--- .../testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
tools/testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh +1 -5
@@ -98,11 +98,7 @@ __tc_flower_test() jq -r '[ .[] | select(.kind == "flower") | .options | .in_hw ]' | jq .[] | wc -l) [[ $((offload_count - 1)) -eq $count ]] - if [[ $should_fail -eq 0 ]]; then - check_err $? "Offload mismatch" - else - check_err_fail $should_fail $? "Offload more than expacted" - fi + check_err_fail $should_fail $? "Attempt to offload $count rules (actual result $((offload_count - 1)))" } tc_flower_test()
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 569/601 bnxt_en: Fix RX consumer index logic in the error path.
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit bbd6f0a948139970f4a615dff189d9a503681a39 ]
In bnxt_rx_pkt(), the RX buffers are expected to complete in order. If the RX consumer index indicates an out of order buffer completion, it means we are hitting a hardware bug and the driver will abort all remaining RX packets and reset the RX ring. The RX consumer index that we pass to bnxt_discard_rx() is not correct. We should be passing the current index (tmp_raw_cons) instead of the old index (raw_cons). This bug can cause us to be at the wrong index when trying to abort the next RX packet. It can crash like this:
#0 [ffff9bbcdf5c39a8] machine_kexec at ffffffff9b05e007 #1 [ffff9bbcdf5c3a00] __crash_kexec at ffffffff9b111232 #2 [ffff9bbcdf5c3ad0] panic at ffffffff9b07d61e
#3 [ffff9bbcdf5c3b50] oops_end at ffffffff9b030978
#4 [ffff9bbcdf5c3b78] no_context at ffffffff9b06aaf0 #5 [ffff9bbcdf5c3bd8] __bad_area_nosemaphore at ffffffff9b06ae2e #6 [ffff9bbcdf5c3c28] bad_area_nosemaphore at ffffffff9b06af24 #7 [ffff9bbcdf5c3c38] __do_page_fault at ffffffff9b06b67e #8 [ffff9bbcdf5c3cb0] do_page_fault at ffffffff9b06bb12 #9 [ffff9bbcdf5c3ce0] page_fault at ffffffff9bc015c5
[exception RIP: bnxt_rx_pkt+237]
RIP: ffffffffc0259cdd RSP: ffff9bbcdf5c3d98 RFLAGS: 00010213
RAX: 000000005dd8097f RBX: ffff9ba4cb11b7e0 RCX: ffffa923cf6e9000
RDX: 0000000000000fff RSI: 0000000000000627 RDI: 0000000000001000
RBP: ffff9bbcdf5c3e60 R8: 0000000000420003 R9: 000000000000020d
R10: ffffa923cf6ec138 R11: ffff9bbcdf5c3e83 R12: ffff9ba4d6f928c0
R13: ffff9ba4cac28080 R14: ffff9ba4cb11b7f0 R15: ffff9ba4d5a30000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +4 -2
@@ -1731,14 +1731,16 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, cons = rxcmp->rx_cmp_opaque;if (unlikely (cons != rxr->rx_next_cons)) { -int rc1 =bnxt_discard_rx (bp, cpr, raw_cons, rxcmp); +int rc1 =bnxt_discard_rx (bp, cpr, &tmp_raw_cons, rxcmp);/* 0xffff is forced error, don't print it */ if (rxr->rx_next_cons !=0xffff )netdev_warn (bp->dev,"RX cons %x != expected cons %x\n" , cons, rxr->rx_next_cons);bnxt_sched_reset (bp, rxr); -return rc1; +if (rc1) +return rc1; + goto next_rx_no_prod_no_len; } rx_buf = &rxr->rx_buf_ring[cons]; data = rx_buf->data;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 570/601 KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit dbdd096a5a74b94f6b786a47baef2085859b0dce ]
Disable pass-through of the FS and GS base MSRs for 32-bit KVM. Intel's SDM unequivocally states that the MSRs exist if and only if the CPU supports x86-64. FS_BASE and GS_BASE are mostly a non-issue; a clever guest could opportunistically use the MSRs without issue. KERNEL_GS_BASE is a bigger problem, as a clever guest would subtly be broken if it were migrated, as KVM disallows software access to the MSRs, and unlike the direct variants, KERNEL_GS_BASE needs to be explicitly migrated as it's not captured in the VMCS.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/nested.c | 2 ++ arch/x86/kvm/vmx/vmx.c | 4 ++++ 2 files changed, 6 insertions(+)
arch/x86/kvm/vmx/nested.c +2 -0
@@ -618,6 +618,7 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu, }/* KVM unconditionally exposes the FS/GS base MSRs to L1. */ +#ifdef CONFIG_X86_64 nested_vmx_disable_intercept_for_msr (msr_bitmap_l1, msr_bitmap_l0,MSR_FS_BASE ,MSR_TYPE_RW );
@@ -626,6 +627,7 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,nested_vmx_disable_intercept_for_msr (msr_bitmap_l1, msr_bitmap_l0,MSR_KERNEL_GS_BASE ,MSR_TYPE_RW ); +#endif /* * Checking the L0->L1 bitmap is trying to verify two things:
arch/x86/kvm/vmx/vmx.c +4 -0
@@ -155,9 +155,11 @@ static u32 vmx_possible_passthrough_msrs[MAX_POSSIBLE_PASSTHROUGH_MSRS] = {MSR_IA32_SPEC_CTRL ,MSR_IA32_PRED_CMD ,MSR_IA32_TSC , +#ifdef CONFIG_X86_64MSR_FS_BASE ,MSR_GS_BASE ,MSR_KERNEL_GS_BASE , +#endifMSR_IA32_SYSENTER_CS ,MSR_IA32_SYSENTER_ESP , MSR_IA32_SYSENTER_EIP,
@@ -6890,9 +6892,11 @@ static int vmx_create_vcpu(struct kvm_vcpu *vcpu)bitmap_fill (vmx->shadow_msr_intercept.write,MAX_POSSIBLE_PASSTHROUGH_MSRS );vmx_disable_intercept_for_msr (vcpu,MSR_IA32_TSC ,MSR_TYPE_R ); +#ifdef CONFIG_X86_64 vmx_disable_intercept_for_msr (vcpu,MSR_FS_BASE ,MSR_TYPE_RW );vmx_disable_intercept_for_msr (vcpu,MSR_GS_BASE ,MSR_TYPE_RW );vmx_disable_intercept_for_msr (vcpu,MSR_KERNEL_GS_BASE ,MSR_TYPE_RW ); +#endif vmx_disable_intercept_for_msr (vcpu,MSR_IA32_SYSENTER_CS ,MSR_TYPE_RW );vmx_disable_intercept_for_msr (vcpu,MSR_IA32_SYSENTER_ESP ,MSR_TYPE_RW );vmx_disable_intercept_for_msr (vcpu,MSR_IA32_SYSENTER_EIP ,MSR_TYPE_RW );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 571/601 KVM: SVM: Zero out the VMCB array used to track SEV ASID association
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 3b1902b87bf11f1c6a84368470dc13da6f3da3bd ]
Zero out the array of VMCB pointers so that pre_sev_run() won't see garbage when querying the array to detect when an SEV ASID is being associated with a new VMCB. In practice, reading random values is all but guaranteed to be benign as a false negative (which is extremely unlikely on its own) can only happen on CPU0 on the first VMRUN and would only cause KVM to skip the ASID flush. For anything bad to happen, a previous instance of KVM would have to exit without flushing the ASID, _and_ KVM would have to not flush the ASID at any time while building the new SEV guest.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/svm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/kvm/svm/svm.c +2 -3
@@ -576,9 +576,8 @@ static int svm_cpu_init(int cpu)clear_page (page_address (sd->save_area));if (svm_sev_enabled ()) { - sd->sev_vmcbs =kmalloc_array (max_sev_asid +1 , -sizeof (void *), -GFP_KERNEL ); + sd->sev_vmcbs =kcalloc (max_sev_asid +1 ,sizeof (void *), +GFP_KERNEL );if (!sd->sev_vmcbs) goto free_save_area; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 572/601 KVM: SVM: Free sev_asid_bitmap during init if SEV setup fails
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit f31b88b35f90f6b7ae4abc1015494a285f459221 ]
Free sev_asid_bitmap if the reclaim bitmap allocation fails, othwerise KVM will unnecessarily keep the bitmap when SEV is not fully enabled.
Freeing the page is also necessary to avoid introducing a bug when a future patch eliminates svm_sev_enabled() in favor of using the global 'sev' flag directly. While sev_hardware_enabled() checks max_sev_asid, which is true even if KVM setup fails, 'sev' will be true if and only if KVM setup fully succeeds.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/sev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/kvm/svm/sev.c +4 -1
@@ -1276,8 +1276,11 @@ void __init sev_hardware_setup(void) goto out; sev_reclaim_asid_bitmap =bitmap_zalloc (max_sev_asid,GFP_KERNEL ); -if (!sev_reclaim_asid_bitmap) +if (!sev_reclaim_asid_bitmap) { +bitmap_free (sev_asid_bitmap); + sev_asid_bitmap =NULL ; goto out; + }pr_info ("SEV supported: %u ASIDs\n" , max_sev_asid - min_sev_asid +1 ); sev_supported = true;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 573/601 KVM: SVM: Disable SEV/SEV-ES if NPT is disabled
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit fa13680f5668cff05302a2f4753c49334a83a064 ]
Disable SEV and SEV-ES if NPT is disabled. While the APM doesn't clearly state that NPT is mandatory, it's alluded to by:
The guest page tables, managed by the guest, may mark data memory pages as either private or shared, thus allowing selected pages to be shared outside the guest.
And practically speaking, shadow paging can't work since KVM can't read the guest's page tables.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/svm.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
arch/x86/kvm/svm/svm.c +10 -10
@@ -980,7 +980,16 @@ static __init int svm_hardware_setup(void)kvm_enable_efer_bits (EFER_SVME |EFER_LMSLE ); } -if (IS_ENABLED (CONFIG_KVM_AMD_SEV ) && sev) { +if (!boot_cpu_has (X86_FEATURE_NPT )) + npt_enabled = false; + +if (npt_enabled && !npt) + npt_enabled = false; + +kvm_configure_mmu (npt_enabled,get_max_npt_level (),PG_LEVEL_1G ); +pr_info ("kvm: Nested Paging %sabled\n" , npt_enabled ?"en" :"dis" ); + +if (IS_ENABLED (CONFIG_KVM_AMD_SEV ) && sev && npt_enabled) {sev_hardware_setup (); }else { sev = false;
@@ -995,15 +1004,6 @@ static __init int svm_hardware_setup(void) goto err; } -if (!boot_cpu_has (X86_FEATURE_NPT )) - npt_enabled = false; - -if (npt_enabled && !npt) - npt_enabled = false; - -kvm_configure_mmu (npt_enabled,get_max_npt_level (),PG_LEVEL_1G ); -pr_info ("kvm: Nested Paging %sabled\n" , npt_enabled ?"en" :"dis" ); -if (nrips) {if (!boot_cpu_has (X86_FEATURE_NRIPS )) nrips = false;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 574/601 net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 6d72e7c767acbbdd44ebc7d89c6690b405b32b57 ]
In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..).
If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd().
But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len).
As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, thus my patch assigns skb->len to 'len' before the possible free and use 'len' instead of skb->len later.
--- drivers/net/ethernet/qualcomm/emac/emac-mac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/qualcomm/emac/emac-mac.c +3 -1
@@ -1437,6 +1437,7 @@ netdev_tx_t emac_mac_tx_buf_send(struct emac_adapter *adpt, {struct emac_tpd tpd;u32 prod_idx; +int len;memset (&tpd,0 ,sizeof (tpd));
@@ -1456,9 +1457,10 @@ netdev_tx_t emac_mac_tx_buf_send(struct emac_adapter *adpt,if (skb_network_offset (skb) !=ETH_HLEN )TPD_TYP_SET (&tpd,1 ); + len = skb->len;emac_tx_fill_tpd (adpt, tx_q, skb, &tpd); -netdev_sent_queue (adpt->netdev, skb->len); +netdev_sent_queue (adpt->netdev, len);/* Make sure the are enough free descriptors to hold one * maximum-sized SKB. We need one desc for each fragment,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 575/601 selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 0f20615d64ee2ad5e2a133a812382d0c4071589b ]
Fix BPF_CORE_READ_BITFIELD() macro used for reading CO-RE-relocatable bitfields. Missing breaks in a switch caused 8-byte reads always. This can confuse libbpf because it does strict checks that memory load size corresponds to the original size of the field, which in this case quite often would be wrong.
After fixing that, we run into another problem, which quite subtle, so worth documenting here. The issue is in Clang optimization and CO-RE relocation interactions. Without that asm volatile construct (also known as barrier_var()), Clang will re-order BYTE_OFFSET and BYTE_SIZE relocations and will apply BYTE_OFFSET 4 times for each switch case arm. This will result in the same error from libbpf about mismatch of memory load size and original field size. I.e., if we were reading u32, we'd still have *(u8 *), *(u16 *), *(u32 *), and *(u64 *) memory loads, three of which will fail. Using barrier_var() forces Clang to apply BYTE_OFFSET relocation first (and once) to calculate p, after which value of p is used without relocation in each of switch case arms, doing appropiately-sized memory load.
Here's the list of relevant relocations and pieces of generated BPF code before and after this patch for test_core_reloc_bitfields_direct selftests.
BEFORE
=====
#45: core_reloc: insn #160 --> [5] + 0:5: byte_sz --> struct core_reloc_bitfields.u32 #46: core_reloc: insn #167 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 #47: core_reloc: insn #174 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 #48: core_reloc: insn #178 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 #49: core_reloc: insn #182 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32
157: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0 ll
159: 7b 12 20 01 00 00 00 00 *(u64 *)(r2 + 288) = r1
160: b7 02 00 00 04 00 00 00 r2 = 4
; BYTE_SIZE relocation here ^^^
161: 66 02 07 00 03 00 00 00 if w2 s> 3 goto +7 <LBB0_63>
162: 16 02 0d 00 01 00 00 00 if w2 == 1 goto +13 <LBB0_65>
163: 16 02 01 00 02 00 00 00 if w2 == 2 goto +1 <LBB0_66>
164: 05 00 12 00 00 00 00 00 goto +18 <LBB0_69>0000000000000528 <LBB0_66>:
165: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
167: 69 11 08 00 00 00 00 00 r1 = *(u16 *)(r1 + 8)
; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^
168: 05 00 0e 00 00 00 00 00 goto +14 <LBB0_69>0000000000000548 <LBB0_63>:
169: 16 02 0a 00 04 00 00 00 if w2 == 4 goto +10 <LBB0_67>
170: 16 02 01 00 08 00 00 00 if w2 == 8 goto +1 <LBB0_68>
171: 05 00 0b 00 00 00 00 00 goto +11 <LBB0_69>0000000000000560 <LBB0_68>:
172: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
174: 79 11 08 00 00 00 00 00 r1 = *(u64 *)(r1 + 8)
; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^
175: 05 00 07 00 00 00 00 00 goto +7 <LBB0_69>0000000000000580 <LBB0_65>:
176: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
178: 71 11 08 00 00 00 00 00 r1 = *(u8 *)(r1 + 8)
; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^
179: 05 00 03 00 00 00 00 00 goto +3 <LBB0_69>00000000000005a0 <LBB0_67>:
180: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
182: 61 11 08 00 00 00 00 00 r1 = *(u32 *)(r1 + 8); BYTE_OFFSET relo here w/ RIGHT size ^^^^^^^^^^^^^^^^
00000000000005b8 <LBB0_69>:
183: 67 01 00 00 20 00 00 00 r1 <<= 32
184: b7 02 00 00 00 00 00 00 r2 = 0
185: 16 02 02 00 00 00 00 00 if w2 == 0 goto +2 <LBB0_71>
186: c7 01 00 00 20 00 00 00 r1 s>>= 32
187: 05 00 01 00 00 00 00 00 goto +1 <LBB0_72>00000000000005e0 <LBB0_71>:
188: 77 01 00 00 20 00 00 00 r1 >>= 32
AFTER
=====
#30: core_reloc: insn #132 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 #31: core_reloc: insn #134 --> [5] + 0:5: byte_sz --> struct core_reloc_bitfields.u32
129: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0 ll
131: 7b 12 20 01 00 00 00 00 *(u64 *)(r2 + 288) = r1
132: b7 01 00 00 08 00 00 00 r1 = 8
; BYTE_OFFSET relo here ^^^
; no size check for non-memory dereferencing instructions
133: 0f 12 00 00 00 00 00 00 r2 += r1
134: b7 03 00 00 04 00 00 00 r3 = 4
; BYTE_SIZE relocation here ^^^
135: 66 03 05 00 03 00 00 00 if w3 s> 3 goto +5 <LBB0_63>
136: 16 03 09 00 01 00 00 00 if w3 == 1 goto +9 <LBB0_65>
137: 16 03 01 00 02 00 00 00 if w3 == 2 goto +1 <LBB0_66>
138: 05 00 0a 00 00 00 00 00 goto +10 <LBB0_69>0000000000000458 <LBB0_66>:
139: 69 21 00 00 00 00 00 00 r1 = *(u16 *)(r2 + 0)
; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
140: 05 00 08 00 00 00 00 00 goto +8 <LBB0_69>0000000000000468 <LBB0_63>:
141: 16 03 06 00 04 00 00 00 if w3 == 4 goto +6 <LBB0_67>
142: 16 03 01 00 08 00 00 00 if w3 == 8 goto +1 <LBB0_68>
143: 05 00 05 00 00 00 00 00 goto +5 <LBB0_69>0000000000000480 <LBB0_68>:
144: 79 21 00 00 00 00 00 00 r1 = *(u64 *)(r2 + 0)
; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
145: 05 00 03 00 00 00 00 00 goto +3 <LBB0_69>0000000000000490 <LBB0_65>:
146: 71 21 00 00 00 00 00 00 r1 = *(u8 *)(r2 + 0)
; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
147: 05 00 01 00 00 00 00 00 goto +1 <LBB0_69>00000000000004a0 <LBB0_67>:
148: 61 21 00 00 00 00 00 00 r1 = *(u32 *)(r2 + 0)
; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
00000000000004a8 <LBB0_69>:
149: 67 01 00 00 20 00 00 00 r1 <<= 32
150: b7 02 00 00 00 00 00 00 r2 = 0
151: 16 02 02 00 00 00 00 00 if w2 == 0 goto +2 <LBB0_71>
152: c7 01 00 00 20 00 00 00 r1 s>>= 32
153: 05 00 01 00 00 00 00 00 goto +1 <LBB0_72>00000000000004d0 <LBB0_71>:
154: 77 01 00 00 20 00 00 00 r1 >>= 323
--- tools/lib/bpf/bpf_core_read.h | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
tools/lib/bpf/bpf_core_read.h +12 -4
@@ -88,11 +88,19 @@ enum bpf_enum_value_kind {const void *p = (const void *)s +__CORE_RELO (s, field,BYTE_OFFSET ); \unsigned long long val; \ \ +/* This is a so-called barrier_var() operation that makes specified \ +* variable "a black box" for optimizing compiler. \ +* It forces compiler to perform BYTE_OFFSET relocation on p and use \ +* its calculated value in the switch below, instead of applying \ +* the same relocation 4 times for each individual memory load. \ +*/ \ + asmvolatile ("" :"=r" (p) :"0" (p)); \ + \switch (__CORE_RELO (s, field,BYTE_SIZE )) { \ -case 1 : val = *(const unsigned char *)p; \ -case 2 : val = *(const unsigned short *)p; \ -case 4 : val = *(const unsigned int *)p; \ -case 8 : val = *(const unsigned long long *)p; \ +case 1 : val = *(const unsigned char *)p;break ; \ +case 2 : val = *(const unsigned short *)p;break ; \ +case 4 : val = *(const unsigned int *)p;break ; \ +case 8 : val = *(const unsigned long long *)p;break ; \ } \ val <<=__CORE_RELO (s, field,LSHIFT_U64 ); \if (__CORE_RELO (s, field,SIGNED )) \
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 576/601 selftests/bpf: Fix field existence CO-RE reloc tests
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 5a30eb23922b52f33222c6729b6b3ff1c37a6c66 ]
Negative field existence cases for have a broken assumption that FIELD_EXISTS CO-RE relo will fail for fields that match the name but have incompatible type signature. That's not how CO-RE relocations generally behave. Types and fields that match by name but not by expected type are treated as non-matching candidates and are skipped. Error later is reported if no matching candidate was found. That's what happens for most relocations, but existence relocations (FIELD_EXISTS and TYPE_EXISTS) are more permissive and they are designed to return 0 or 1, depending if a match is found. This allows to handle name-conflicting but incompatible types in BPF code easily. Combined with ___flavor suffixes, it's possible to handle pretty much any structural type changes in kernel within the compiled once BPF source code.
So, long story short, negative field existence test cases are invalid in their assumptions, so this patch reworks them into a single consolidated positive case that doesn't match any of the fields.
--- .../selftests/bpf/prog_tests/core_reloc.c | 31 ++++++++++++------- ...ore_reloc_existence___err_wrong_arr_kind.c | 3 -- ...loc_existence___err_wrong_arr_value_type.c | 3 -- ...ore_reloc_existence___err_wrong_int_kind.c | 3 -- ..._core_reloc_existence___err_wrong_int_sz.c | 3 -- ...ore_reloc_existence___err_wrong_int_type.c | 3 -- ..._reloc_existence___err_wrong_struct_type.c | 3 -- ..._core_reloc_existence___wrong_field_defs.c | 3 ++ .../selftests/bpf/progs/core_reloc_types.h | 20 ++---------- 9 files changed, 24 insertions(+), 48 deletions(-) delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c create mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c
tools/testing/selftests/bpf/prog_tests/core_reloc.c +19 -12
@@ -210,11 +210,6 @@ static int duration = 0; .bpf_obj_file = "test_core_reloc_existence.o", \ .btf_src_file = "btf__core_reloc_" #name ".o" \ -#define FIELD_EXISTS_ERR_CASE (name) { \ - FIELD_EXISTS_CASE_COMMON(name), \ - .fails = true, \ -} -#define BITFIELDS_CASE_COMMON (objfile, test_name_prefix, name) \ .case_name = test_name_prefix#name, \ .bpf_obj_file = objfile, \
@@ -642,13 +637,25 @@ static struct core_reloc_test_case test_cases[] = { }, .output_len = sizeof(struct core_reloc_existence_output), }, - - FIELD_EXISTS_ERR_CASE(existence__err_int_sz), - FIELD_EXISTS_ERR_CASE(existence__err_int_type), - FIELD_EXISTS_ERR_CASE(existence__err_int_kind), - FIELD_EXISTS_ERR_CASE(existence__err_arr_kind), - FIELD_EXISTS_ERR_CASE(existence__err_arr_value_type), - FIELD_EXISTS_ERR_CASE(existence__err_struct_type), + { + FIELD_EXISTS_CASE_COMMON(existence___wrong_field_defs), + .input = STRUCT_TO_CHAR_PTR(core_reloc_existence___wrong_field_defs) { + }, + .input_len = sizeof(struct core_reloc_existence___wrong_field_defs), + .output = STRUCT_TO_CHAR_PTR(core_reloc_existence_output) { + .a_exists = 0, + .b_exists = 0, + .c_exists = 0, + .arr_exists = 0, + .s_exists = 0, + .a_value = 0xff000001u, + .b_value = 0xff000002u, + .c_value = 0xff000003u, + .arr_value = 0xff000004u, + .s_value = 0xff000005u, + }, + .output_len = sizeof(struct core_reloc_existence_output), + }, /* bitfield relocation checks */ BITFIELDS_CASE(bitfields, {
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_arr_kind x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_arr_value_type x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_int_kind x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_int_sz x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_int_type x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_struct_type x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c new file +3 -0
@@ -0,0 +1,3 @@ +#include "core_reloc_types.h" + +void f (struct core_reloc_existence___wrong_field_defs x) {}
tools/testing/selftests/bpf/progs/core_reloc_types.h +2 -18
@@ -700,27 +700,11 @@ struct core_reloc_existence___minimal {int a; }; -struct core_reloc_existence___err_wrong_int_sz { -short a; -}; - -struct core_reloc_existence___err_wrong_int_type { +struct core_reloc_existence___wrong_field_defs { +void *a;int b[1 ]; -}; - -struct core_reloc_existence___err_wrong_int_kind {struct {int x; } c; -}; - -struct core_reloc_existence___err_wrong_arr_kind {int arr; -}; - -struct core_reloc_existence___err_wrong_arr_value_type { -short arr[1 ]; -}; - -struct core_reloc_existence___err_wrong_struct_type {int s; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 577/601 selftests/bpf: Fix core_reloc test runner
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit bede0ebf0be87e9678103486a77f39e0334c6791 ]
Fix failed tests checks in core_reloc test runner, which allowed failing tests to pass quietly. Also add extra check to make sure that expected to fail test cases with invalid names are caught as test failure anyway, as this is not an expected failure mode. Also fix mislabeled probed vs direct bitfield test cases.
--- .../selftests/bpf/prog_tests/core_reloc.c | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
tools/testing/selftests/bpf/prog_tests/core_reloc.c +12 -8
@@ -217,7 +217,7 @@ static int duration = 0;#define BITFIELDS_CASE (name, ...) { \ BITFIELDS_CASE_COMMON("test_core_reloc_bitfields_probed.o", \ - "direct:", name), \ + "probed:", name), \ .input = STRUCT_TO_CHAR_PTR(core_reloc_##name) __VA_ARGS__, \ .input_len = sizeof(struct core_reloc_##name), \ .output = STRUCT_TO_CHAR_PTR(core_reloc_bitfields_output) \
@@ -225,7 +225,7 @@ static int duration = 0; .output_len = sizeof(struct core_reloc_bitfields_output), \ }, { \ BITFIELDS_CASE_COMMON("test_core_reloc_bitfields_direct.o", \ - "probed:", name), \ + "direct:", name), \ .input = STRUCT_TO_CHAR_PTR(core_reloc_##name) __VA_ARGS__, \ .input_len = sizeof(struct core_reloc_##name), \ .output = STRUCT_TO_CHAR_PTR(core_reloc_bitfields_output) \
@@ -545,8 +545,7 @@ static struct core_reloc_test_case test_cases[] = {ARRAYS_ERR_CASE (arrays___err_too_small),ARRAYS_ERR_CASE (arrays___err_too_shallow),ARRAYS_ERR_CASE (arrays___err_non_array), -ARRAYS_ERR_CASE (arrays___err_wrong_val_type1), -ARRAYS_ERR_CASE (arrays___err_wrong_val_type2), +ARRAYS_ERR_CASE (arrays___err_wrong_val_type), ARRAYS_ERR_CASE(arrays___err_bad_zero_sz_arr),/* enum/ptr/int handling scenarios */
@@ -864,13 +863,20 @@ void test_core_reloc(void) "prog '%s' not found\n", probe_name)) goto cleanup; + +if (test_case->btf_src_file) { + err =access (test_case->btf_src_file,R_OK ); +if (!ASSERT_OK (err,"btf_src_file" )) + goto cleanup; + } + load_attr.obj = obj; load_attr.log_level =0 ; load_attr.target_btf_path = test_case->btf_src_file; err =bpf_object__load_xattr (&load_attr);if (err) {if (!test_case->fails) -CHECK (false,"obj_load" ,"failed to load prog '%s': %d\n" , probe_name, err); +ASSERT_OK (err,"obj_load" ); goto cleanup; }
@@ -909,10 +915,8 @@ void test_core_reloc(void) goto cleanup; } -if (test_case->fails) { -CHECK (false,"obj_load_fail" ,"should fail to load prog '%s'\n" , probe_name); +if (!ASSERT_FALSE (test_case->fails,"obj_load_should_fail" )) goto cleanup; - } equal =memcmp (data->out, test_case->output, test_case->output_len) ==0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 578/601 bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
[ Upstream commit 10bf4e83167cc68595b85fd73bb91e8f2c086e36 ]
Similarly as b02709587ea3 ("bpf: Fix propagation of 32-bit signed bounds from 64-bit bounds."), we also need to fix the propagation of 32 bit unsigned bounds from 64 bit counterparts. That is, really only set the u32_{min,max}_value when /both/ {umin,umax}_value safely fit in 32 bit space. For example, the register with a umin_value == 1 does /not/ imply that u32_min_value is also equal to 1, since umax_value could be much larger than 32 bit subregister can hold, and thus u32_min_value is in the interval [0,1] instead.
Before fix, invalid tracking result of R2_w=inv1:
[...]
5: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0) R10=fp0
5: (35) if r2 >= 0x1 goto pc+1
[...] // goto path
7: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,umin_value=1) R10=fp0
7: (b6) if w2 <= 0x1 goto pc+1
[...] // goto path
9: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,smin_value=-9223372036854775807,smax_value=9223372032559808513,umin_value=1,umax_value=18446744069414584321,var_off=(0x1; 0xffffffff00000000),s32_min_value=1,s32_max_value=1,u32_max_value=1) R10=fp0 9: (bc) w2 = w2
10: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv1 R10=fp0
[...]
After fix, correct tracking result of R2_w=inv(id=0,umax_value=1,var_off=(0x0; 0x1)):
[...]
5: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0) R10=fp0
5: (35) if r2 >= 0x1 goto pc+1
[...] // goto path
7: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,umin_value=1) R10=fp0
7: (b6) if w2 <= 0x1 goto pc+1
[...] // goto path
9: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,smax_value=9223372032559808513,umax_value=18446744069414584321,var_off=(0x0; 0xffffffff00000001),s32_min_value=0,s32_max_value=1,u32_max_value=1) R10=fp0 9: (bc) w2 = w2
10: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,umax_value=1,var_off=(0x0; 0x1)) R10=fp0
[...]
Thus, same issue as in b02709587ea3 holds for unsigned subregister tracking. Also, align __reg64_bound_u32() similarly to __reg64_bound_s32() as done in b02709587ea3 to make them uniform again.
--- kernel/bpf/verifier.c | 8 +++----- tools/testing/selftests/bpf/verifier/array_access.c | 2 +- 2 files changed, 4 insertions(+), 6 deletions(-)
kernel/bpf/verifier.c +3 -5
@@ -1304,9 +1304,7 @@ static bool __reg64_bound_s32(s64 a)static bool __reg64_bound_u32 (u64 a) { -if (a >U32_MIN && a <U32_MAX ) -return true; -return false; +return a >U32_MIN && a <U32_MAX ; }static void __reg_combine_64_into_32 (struct bpf_reg_state *reg)
@@ -1317,10 +1315,10 @@ static void __reg_combine_64_into_32(struct bpf_reg_state *reg) reg->s32_min_value = (s32 )reg->smin_value; reg->s32_max_value = (s32 )reg->smax_value; } -if (__reg64_bound_u32 (reg->umin_value)) +if (__reg64_bound_u32 (reg->umin_value) &&__reg64_bound_u32 (reg->umax_value)) { reg->u32_min_value = (u32 )reg->umin_value; -if (__reg64_bound_u32 (reg->umax_value)) reg->u32_max_value = (u32 )reg->umax_value; + }/* Intersecting with the old var_off might have improved our bounds * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
tools/testing/selftests/bpf/verifier/array_access.c +1 -1
@@ -186,7 +186,7 @@ }, .fixup_map_hash_48b = { 3 }, .errstr_unpriv = "R0 leaks addr", - .errstr = "invalid access to map value, value_size=48 off=44 size=8", + .errstr = "R0 unbounded memory access", .result_unpriv = REJECT, .result = REJECT, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 579/601 RDMA/siw: Fix a use after free in siw_alloc_mr
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 3093ee182f01689b89e9f8797b321603e5de4f63 ]
Our code analyzer reported a UAF.
In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a freed object. After, the execution continue up to the err_out branch of siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).
My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {} section, to avoid the uaf.
--- drivers/infiniband/sw/siw/siw_mem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/sw/siw/siw_mem.c +2 -2
@@ -106,8 +106,6 @@ int siw_mr_add_mem(struct siw_mr *mr, struct ib_pd *pd, void *mem_obj, mem->perms = rights &IWARP_ACCESS_MASK ;kref_init (&mem->ref); - mr->mem = mem; -get_random_bytes (&next,4 ); next &=0x00ffffff ;
@@ -116,6 +114,8 @@ int siw_mr_add_mem(struct siw_mr *mr, struct ib_pd *pd, void *mem_obj,kfree (mem);return -ENOMEM ; } + + mr->mem = mem;/* Set the STag index part */ mem->stag = id <<8 ; mr->base_mr.lkey = mr->base_mr.rkey = mem->stag;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 580/601 RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 34b39efa5ae82fc0ad0acc27653c12a56328dbbe ]
In bnxt_qplib_alloc_res, it calls bnxt_qplib_alloc_dpi_tbl(). Inside bnxt_qplib_alloc_dpi_tbl, dpit->dbr_bar_reg_iomem is freed via pci_iounmap() in unmap_io error branch. After the callee returns err code, bnxt_qplib_alloc_res calls bnxt_qplib_free_res()->bnxt_qplib_free_dpi_tbl() in the fail branch. Then dpit->dbr_bar_reg_iomem is freed in the second time by pci_iounmap().
My patch set dpit->dbr_bar_reg_iomem to NULL after it is freed by pci_iounmap() in the first time, to avoid the double free.
--- drivers/infiniband/hw/bnxt_re/qplib_res.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/bnxt_re/qplib_res.c +1 -0
@@ -854,6 +854,7 @@ static int bnxt_qplib_alloc_dpi_tbl(struct bnxt_qplib_res *res, unmap_io:pci_iounmap (res->pdev, dpit->dbr_bar_reg_iomem); + dpit->dbr_bar_reg_iomem =NULL ;return -ENOMEM ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 581/601 net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
In reply to Greg Kroah-HartmanFrom: Linus Lüssing <[email protected]>
[ Upstream commit 99014088156cd78867d19514a0bc771c4b86b93b ]
The IPv6 Multicast Router Advertisements parsing has the following two issues:
For one thing, ICMPv6 MRD Advertisements are smaller than ICMPv6 MLD messages (ICMPv6 MRD Adv.: 8 bytes vs. ICMPv6 MLDv1/2: >= 24 bytes, assuming MLDv2 Reports with at least one multicast address entry). When ipv6_mc_check_mld_msg() tries to parse an Multicast Router Advertisement its MLD length check will fail - and it will wrongly return -EINVAL, even if we have a valid MRD Advertisement. With the returned -EINVAL the bridge code will assume a broken packet and will wrongly discard it, potentially leading to multicast packet loss towards multicast routers.
The second issue is the MRD header parsing in br_ip6_multicast_mrd_rcv(): It wrongly checks for an ICMPv6 header immediately after the IPv6 header (IPv6 next header type). However according to RFC4286, section 2 all MRD messages contain a Router Alert option (just like MLD). So instead there is an IPv6 Hop-by-Hop option for the Router Alert between the IPv6 and ICMPv6 header, again leading to the bridge wrongly discarding Multicast Router Advertisements.
To fix these two issues, introduce a new return value -ENODATA to ipv6_mc_check_mld() to indicate a valid ICMPv6 packet with a hop-by-hop option which is not an MLD but potentially an MRD packet. This also simplifies further parsing in the bridge code, as ipv6_mc_check_mld() already fully checks the ICMPv6 header and hop-by-hop option.
These issues were found and fixed with the help of the mrdisc tool
(https://github.com/troglobit/mrdisc).
--- include/net/addrconf.h | 1 - net/bridge/br_multicast.c | 33 ++++++++------------------------- net/ipv6/mcast_snoop.c | 12 +++++++----- 3 files changed, 15 insertions(+), 31 deletions(-)
include/net/addrconf.h +0 -1
@@ -233,7 +233,6 @@ void ipv6_mc_unmap(struct inet6_dev *idev);void ipv6_mc_remap (struct inet6_dev *idev);void ipv6_mc_init_dev (struct inet6_dev *idev);void ipv6_mc_destroy_dev (struct inet6_dev *idev); -int ipv6_mc_check_icmpv6 (struct sk_buff *skb);int ipv6_mc_check_mld (struct sk_buff *skb);void addrconf_dad_failure (struct sk_buff *skb,struct inet6_ifaddr *ifp);
net/bridge/br_multicast.c +8 -25
@@ -3075,25 +3075,14 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br, }#if IS_ENABLED (CONFIG_IPV6 ) -static int br_ip6_multicast_mrd_rcv (struct net_bridge *br, -struct net_bridge_port *port, -struct sk_buff *skb) +static void br_ip6_multicast_mrd_rcv (struct net_bridge *br, +struct net_bridge_port *port, +struct sk_buff *skb) { -int ret; - -if (ipv6_hdr (skb)->nexthdr !=IPPROTO_ICMPV6 ) -return -ENOMSG ; - - ret =ipv6_mc_check_icmpv6 (skb); -if (ret <0 ) -return ret; -if (icmp6_hdr (skb)->icmp6_type !=ICMPV6_MRDISC_ADV ) -return -ENOMSG ; +return ;br_multicast_mark_router (br, port); - -return 0 ; } static int br_multicast_ipv6_rcv(struct net_bridge *br,
@@ -3107,18 +3096,12 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br, err =ipv6_mc_check_mld (skb); -if (err == -ENOMSG ) { +if (err == -ENOMSG || err == -ENODATA ) {if (!ipv6_addr_is_ll_all_nodes (&ipv6_hdr (skb)->daddr))BR_INPUT_SKB_CB (skb)->mrouters_only =1 ; - -if (ipv6_addr_is_all_snoopers (&ipv6_hdr (skb)->daddr)) { - err =br_ip6_multicast_mrd_rcv (br, port, skb); - -if (err <0 && err != -ENOMSG ) { -br_multicast_err_count (br, port, skb->protocol); -return err; - } - } +if (err == -ENODATA && +ipv6_addr_is_all_snoopers (&ipv6_hdr (skb)->daddr)) +br_ip6_multicast_mrd_rcv (br, port, skb);return 0 ; }else if (err <0 ) {
net/ipv6/mcast_snoop.c +7 -5
@@ -109,7 +109,7 @@ static int ipv6_mc_check_mld_msg(struct sk_buff *skb)struct mld_msg *mld;if (!ipv6_mc_may_pull (skb, len)) -return -EINVAL ; +return -ENODATA ; mld = (struct mld_msg *)skb_transport_header (skb);
@@ -122,7 +122,7 @@ static int ipv6_mc_check_mld_msg(struct sk_buff *skb)case ICMPV6_MGM_QUERY :return ipv6_mc_check_mld_query (skb);default : -return -ENOMSG ; +return -ENODATA ; } }
@@ -131,7 +131,7 @@ static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)return skb_checksum_validate (skb,IPPROTO_ICMPV6 , ip6_compute_pseudo); } -int ipv6_mc_check_icmpv6 (struct sk_buff *skb) +static int ipv6_mc_check_icmpv6 (struct sk_buff *skb) {unsigned int len =skb_transport_offset (skb) +sizeof (struct icmp6hdr );unsigned int transport_len =ipv6_transport_len (skb);
@@ -150,7 +150,6 @@ int ipv6_mc_check_icmpv6(struct sk_buff *skb)return 0 ; } -EXPORT_SYMBOL (ipv6_mc_check_icmpv6);/** * ipv6_mc_check_mld - checks whether this is a sane MLD packet
@@ -161,7 +160,10 @@ EXPORT_SYMBOL(ipv6_mc_check_icmpv6);* * -EINVAL: A broken packet was detected, i.e. it violates some internet * standard -* -ENOMSG: IP header validation succeeded but it is not an MLD packet. +* -ENOMSG: IP header validation succeeded but it is not an ICMPv6 packet +* with a hop-by-hop option. +* -ENODATA: IP+ICMPv6 header with hop-by-hop option validation succeeded +* but it is not an MLD packet. * -ENOMEM: A memory allocation failure happened. * * Caller needs to set the skb network header and free any returned skb if it
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 582/601 net: dsa: mv88e6xxx: Fix 6095/6097/6185 ports in non-SERDES CMODE
In reply to Greg Kroah-HartmanFrom: Tobias Waldekranz <[email protected]>
[ Upstream commit 6066234aa33850e9e35e7be82d92b9e9091e774b ]
The .serdes_get_lane op used the magic value 0xff to indicate a valid SERDES lane and 0 signaled that a non-SERDES mode was set on the port.
Unfortunately, "0" is also a valid lane ID, so even when these ports where configured to e.g. RGMII the driver would set them up as SERDES ports.
- Replace 0xff with 0 to indicate a valid lane ID. The number is on the one hand just as arbitrary, but it is at least the first valid one and therefore less of a surprise.
- Follow the other .serdes_get_lane implementations and return -ENODEV in the case where no SERDES is assigned to the port.
--- drivers/net/dsa/mv88e6xxx/serdes.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/dsa/mv88e6xxx/serdes.c +3 -3
@@ -443,15 +443,15 @@ int mv88e6185_serdes_power(struct mv88e6xxx_chip *chip, int port, u8 lane,u8 mv88e6185_serdes_get_lane (struct mv88e6xxx_chip *chip,int port) {/* There are no configurable serdes lanes on this switch chip but we -* need to return non-zero so that callers of +* need to return a non-negative lane number so that callers of * mv88e6xxx_serdes_get_lane() know this is a serdes port. */ switch (chip->ports[port].cmode) {case MV88E6185_PORT_STS_CMODE_SERDES :case MV88E6185_PORT_STS_CMODE_1000BASE_X : -return 0xff ; -default :return 0 ; +default : +return -ENODEV ; } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 583/601 net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 75258586793efc521e5dd52a5bf6c7a4cf7002be ]
In digital_tg_recv_dep_req, it calls nfc_tm_data_received(..,resp). If nfc_tm_data_received() failed, the callee will free the resp via kfree_skb() and return error. But in the exit branch, the resp will be freed again.
My patch sets resp to NULL if nfc_tm_data_received() failed, to avoid the double free.
--- net/nfc/digital_dep.c | 2 ++ 1 file changed, 2 insertions(+)
net/nfc/digital_dep.c +2 -0
@@ -1273,6 +1273,8 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg, } rc =nfc_tm_data_received (ddev->nfc_dev, resp); +if (rc) + resp =NULL ; exit:kfree_skb (ddev->chaining_skb);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 584/601 perf tools: Change fields type in perf_record_time_conv
In reply to Greg Kroah-HartmanFrom: Leo Yan <[email protected]>
[ Upstream commit e1d380ea8b00db4bb14d1f513000d4b62aa9d3f0 ]
C standard claims "An object declared as type _Bool is large enough to store the values 0 and 1", bool type size can be 1 byte or larger than 1 byte. Thus it's uncertian for bool type size with different compilers.
This patch changes the bool type in structure perf_record_time_conv to __u8 type, and pads extra bytes for 8-byte alignment; this can give reliable structure size.
--- tools/lib/perf/include/perf/event.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/lib/perf/include/perf/event.h +3 -2
@@ -336,8 +336,9 @@ struct perf_record_time_conv {__u64 time_zero;__u64 time_cycles;__u64 time_mask; -bool cap_user_time_zero; -bool cap_user_time_short; +__u8 cap_user_time_zero; +__u8 cap_user_time_short; +__u8 reserved[6 ];/* For alignment */ };struct perf_record_header_feature {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 585/601 perf jit: Let convert_timestamp() to be backwards-compatible
In reply to Greg Kroah-HartmanFrom: Leo Yan <[email protected]>
[ Upstream commit aa616f5a8a2d22a179d5502ebd85045af66fa656 ]
Commit d110162cafc80dad ("perf tsc: Support cap_user_time_short for event TIME_CONV") supports the extended parameters for event TIME_CONV, but it broke the backwards compatibility, so any perf data file with old event format fails to convert timestamp.
This patch introduces a helper event_contains() to check if an event contains a specific member or not. For the backwards-compatibility, if the event size confirms the extended parameters are supported in the event TIME_CONV, then copies these parameters.
Committer notes:
To make this compiler backwards compatible add this patch:
- struct perf_tsc_conversion tc = { 0 };
+ struct perf_tsc_conversion tc = { .time_shift = 0, };
--- tools/lib/perf/include/perf/event.h | 2 ++ tools/perf/util/jitdump.c | 30 +++++++++++++++++++---------- 2 files changed, 22 insertions(+), 10 deletions(-)
tools/lib/perf/include/perf/event.h +2 -0
@@ -8,6 +8,8 @@#include <linux/bpf.h> #include <sys/types.h> /* pid_t */ +#define event_contains (obj, mem) ((obj).header.size > offsetof(typeof(obj), mem)) +struct perf_record_mmap {struct perf_event_header header;__u32 pid, tid;
tools/perf/util/jitdump.c +20 -10
@@ -369,21 +369,31 @@ jit_inject_event(struct jit_buf_desc *jd, union perf_event *event)static uint64_t convert_timestamp (struct jit_buf_desc *jd,uint64_t timestamp) { -struct perf_tsc_conversion tc; +struct perf_tsc_conversion tc = { .time_shift =0 , }; +struct perf_record_time_conv *time_conv = &jd->session->time_conv;if (!jd->use_arch_timestamp)return timestamp; - tc.time_shift = jd->session->time_conv.time_shift; - tc.time_mult = jd->session->time_conv.time_mult; - tc.time_zero = jd->session->time_conv.time_zero; - tc.time_cycles = jd->session->time_conv.time_cycles; - tc.time_mask = jd->session->time_conv.time_mask; - tc.cap_user_time_zero = jd->session->time_conv.cap_user_time_zero; - tc.cap_user_time_short = jd->session->time_conv.cap_user_time_short; + tc.time_shift = time_conv->time_shift; + tc.time_mult = time_conv->time_mult; + tc.time_zero = time_conv->time_zero; -if (!tc.cap_user_time_zero) -return 0 ; +/* +* The event TIME_CONV was extended for the fields from "time_cycles" +* when supported cap_user_time_short, for backward compatibility, +* checks the event size and assigns these extended fields if these +* fields are contained in the event. +*/ +if (event_contains (*time_conv, time_cycles)) { + tc.time_cycles = time_conv->time_cycles; + tc.time_mask = time_conv->time_mask; + tc.cap_user_time_zero = time_conv->cap_user_time_zero; + tc.cap_user_time_short = time_conv->cap_user_time_short; + +if (!tc.cap_user_time_zero) +return 0 ; + }return tsc_to_perf_time (timestamp, &tc); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 586/601 perf session: Add swap operation for event TIME_CONV
In reply to Greg Kroah-HartmanFrom: Leo Yan <[email protected]>
[ Upstream commit 050ffc449008eeeafc187dec337d9cf1518f89bc ]
Since commit d110162cafc8 ("perf tsc: Support cap_user_time_short for event TIME_CONV"), the event PERF_RECORD_TIME_CONV has extended the data structure for clock parameters.
To be backwards-compatible, this patch adds a dedicated swap operation for the event PERF_RECORD_TIME_CONV, based on checking if the event contains field "time_cycles", it can support both for the old and new event formats.
--- tools/perf/util/session.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
tools/perf/util/session.c +14 -1
@@ -946,6 +946,19 @@ static void perf_event__stat_round_swap(union perf_event *event, event->stat_round.time =bswap_64 (event->stat_round.time); } +static void perf_event__time_conv_swap (union perf_event *event, +bool sample_id_all__maybe_unused ) +{ + event->time_conv.time_shift =bswap_64 (event->time_conv.time_shift); + event->time_conv.time_mult =bswap_64 (event->time_conv.time_mult); + event->time_conv.time_zero =bswap_64 (event->time_conv.time_zero); + +if (event_contains (event->time_conv, time_cycles)) { + event->time_conv.time_cycles =bswap_64 (event->time_conv.time_cycles); + event->time_conv.time_mask =bswap_64 (event->time_conv.time_mask); + } +} +typedef void (*perf_event__swap_op )(union perf_event *event,bool sample_id_all);
@@ -982,7 +995,7 @@ static perf_event__swap_op perf_event__swap_ops[] = { [PERF_RECORD_STAT] = perf_event__stat_swap, [PERF_RECORD_STAT_ROUND] = perf_event__stat_round_swap, [PERF_RECORD_EVENT_UPDATE] = perf_event__event_update_swap, - [PERF_RECORD_TIME_CONV] = perf_event__all64_swap, + [PERF_RECORD_TIME_CONV] = perf_event__time_conv_swap, [PERF_RECORD_HEADER_MAX] = NULL, };
Signature · 1 line
2.30.2