6.6.54-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 6.6.54-rc1 review
This is the start of the stable review cycle for the 6.6.54 release. There are 538 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 04 Oct 2024 12:56:13 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.54-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.54-rc1
Alexey Gladkov (Intel) <[email protected]>
x86/tdx: Fix "in-kernel MMIO" check
Mika Westerberg <[email protected]>
thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()
Gil Fine <[email protected]>
thunderbolt: Fix minimum allocated USB 3.x and PCIe bandwidth
Mika Westerberg <[email protected]>
thunderbolt: Send uevent after asymmetric/symmetric switch
Martin KaFai Lau <[email protected]>
libbpf: Ensure undefined bpf_attr field stays 0
Arend van Spriel <[email protected]>
wifi: brcmfmac: add linefeed at end of file
André Apitzsch <[email protected]>
iio: magnetometer: ak8975: Fix 'Unexpected device' error
Robin Murphy <[email protected]>
perf/arm-cmn: Fail DTC counter allocation correctly
Harshit Mogalapalli <[email protected]>
usb: yurex: Fix inconsistent locking bug in yurex_read()
Oleg Nesterov <[email protected]>
bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
Paolo Bonzini <[email protected]>
Documentation: KVM: fix warning in "make htmldocs"
Andy Shevchenko <[email protected]>
i2c: isch: Add missed 'else'
Tommy Huang <[email protected]>
i2c: aspeed: Update the stop sw state when the bus recovery occurs
Liam R. Howlett <[email protected]>
mm/damon/vaddr: protect vma traversal in __damon_va_thre_regions() with rcu read lock
Dmitry Vyukov <[email protected]>
module: Fix KCOV-ignored file name
Haibo Chen <[email protected]>
spi: fspi: add support for imx8ulp
David Gow <[email protected]>
mm: only enforce minimum stack gap size if it's sensible
Zhiguo Niu <[email protected]>
lockdep: fix deadlock issue between lockdep and rcu
Mikulas Patocka <[email protected]>
dm-verity: restart or panic on an I/O error
Song Liu <[email protected]>
bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0
Kairui Song <[email protected]>
mm/filemap: optimize filemap folio adding
Kairui Song <[email protected]>
lib/xarray: introduce a new helper xas_get_order
Kairui Song <[email protected]>
mm/filemap: return early if failed to allocate memory for split
Gil Fine <[email protected]>
thunderbolt: Improve DisplayPort tunnel setup process to be more robust
Gil Fine <[email protected]>
thunderbolt: Configure asymmetric link if needed and bandwidth allows
Gil Fine <[email protected]>
thunderbolt: Add support for asymmetric link
Mika Westerberg <[email protected]>
thunderbolt: Introduce tb_switch_depth()
Mika Westerberg <[email protected]>
thunderbolt: Introduce tb_for_each_upstream_port_on_path()
Gil Fine <[email protected]>
thunderbolt: Introduce tb_port_path_direction_downstream()
Gil Fine <[email protected]>
thunderbolt: Change bandwidth reservations to comply USB4 v2
Gil Fine <[email protected]>
thunderbolt: Make is_gen4_link() available to the rest of the driver
Mika Westerberg <[email protected]>
thunderbolt: Use weight constants in tb_usb3_consumed_bandwidth()
Mika Westerberg <[email protected]>
thunderbolt: Use constants for path weight and priority
Gil Fine <[email protected]>
thunderbolt: Create multiple DisplayPort tunnels if there are more DP IN/OUT pairs
Mika Westerberg <[email protected]>
thunderbolt: Expose tb_tunnel_xxx() log macros to the rest of the driver
Mika Westerberg <[email protected]>
thunderbolt: Use tb_tunnel_dbg() where possible to make logging more consistent
Gil Fine <[email protected]>
thunderbolt: Fix debug log when DisplayPort adapter not available for pairing
Haibo Chen <[email protected]>
dt-bindings: spi: nxp-fspi: add imx8ulp support
Peng Fan <[email protected]>
dt-bindings: spi: nxp-fspi: support i.MX93 and i.MX95
Filipe Manana <[email protected]>
btrfs: fix race setting file private on concurrent lseek using same fd
Filipe Manana <[email protected]>
btrfs: update comment for struct btrfs_inode::lock
David Sterba <[email protected]>
btrfs: reorder btrfs_inode to fill gaps
Qu Wenruo <[email protected]>
btrfs: subpage: fix the bitmap dump which can cause bitmap corruption
Syed Nayyar Waris <[email protected]>
lib/bitmap: add bitmap_{read,write}()
Dmitry Vyukov <[email protected]>
x86/entry: Remove unwanted instrumentation in common_interrupt()
Xin Li <[email protected]>
x86/idtentry: Incorporate definitions/declarations of the FRED entries
Jiri Slaby (SUSE) <[email protected]>
serial: don't use uninitialized value in uart_poll_init()
Michael Trimarchi <[email protected]>
tty: serial: kgdboc: Fix 8250_* kgdb over serial
Ma Ke <[email protected]>
pps: add an error check in parport_attach
Christophe JAILLET <[email protected]>
pps: remove usage of the deprecated ida_simple_xx() API
Pawel Laszczak <[email protected]>
usb: xhci: fix loss of data on Cadence xHC
Daehwan Jung <[email protected]>
xhci: Add a quirk for writing ERST in high-low order
Oliver Neukum <[email protected]>
USB: misc: yurex: fix race between read and write
Lee Jones <[email protected]>
usb: yurex: Replace snprintf() with the safer scnprintf() variant
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix soc_dev leak during device remove
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix memory leak during device remove
Krzysztof Kozlowski <[email protected]>
ARM: dts: imx6ul-geam: fix fsl,pins property in tscgrp pinctrl
Haibo Chen <[email protected]>
spi: fspi: involve lut_num for struct nxp_fspi_devtype_data
VanGiang Nguyen <[email protected]>
padata: use integer wrap around to prevent deadlock on seq_nr overflow
Krzysztof Kozlowski <[email protected]>
cpuidle: riscv-sbi: Use scoped device node handling to fix missing of_node_put
Eric Dumazet <[email protected]>
icmp: change the order of rate limits
Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix conversion of system address to physical memory address
Li Lingfeng <[email protected]>
nfs: fix memory leak in error path of nfs4_do_reclaim
Mickaël Salaün <[email protected]>
fs: Fix file_set_fowner LSM hook inconsistencies
Julian Sun <[email protected]>
vfs: fix race between evice_inodes() and find_inode()&iput()
Dragan Simic <[email protected]>
arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity
Qingqing Zhou <[email protected]>
arm64: dts: qcom: sa8775p: Mark APPS and PCIe SMMUs as DMA coherent
Dragan Simic <[email protected]>
arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency
D Scott Phillips <[email protected]>
arm64: errata: Enable the AC03_CPU_38 workaround for ampere1a
Anastasia Belova <[email protected]>
arm64: esr: Define ESR_ELx_EC_* constants as UL
Gaosheng Cui <[email protected]>
hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume
Gaosheng Cui <[email protected]>
hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init
Guoqing Jiang <[email protected]>
hwrng: mtk - Use devm_pm_runtime_enable
Chao Yu <[email protected]>
f2fs: fix to check atomic_file in f2fs ioctl interfaces
Jann Horn <[email protected]>
f2fs: Require FMODE_WRITE for atomic write ioctls
Nikita Zhandarovich <[email protected]>
f2fs: avoid potential int overflow in sanity_check_area_boundary()
Nikita Zhandarovich <[email protected]>
f2fs: prevent possible int overflow in dir_block_index()
Nikita Zhandarovich <[email protected]>
f2fs: fix several potential integer overflows in file offsets
Luca Stefani <[email protected]>
btrfs: always update fstrim_range on failure in FITRIM ioctl
Qu Wenruo <[email protected]>
btrfs: tree-checker: fix the wrong output of data backref objectid
Zhen Lei <[email protected]>
debugobjects: Fix conditions in fill_pool()
Ma Ke <[email protected]>
wifi: mt76: mt7615: check devm_kasprintf() returned value
Bitterblue Smith <[email protected]>
wifi: rtw88: 8822c: Fix reported RX band width
Nick Morrow <[email protected]>
wifi: rtw88: 8821cu: Remove VID/PID 0bda:c82c
Ma Ke <[email protected]>
wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he
Ma Ke <[email protected]>
wifi: mt76: mt7915: check devm_kasprintf() returned value
Ma Ke <[email protected]>
wifi: mt76: mt7921: Check devm_kasprintf() returned value
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix sampling synchronization
Ard Biesheuvel <[email protected]>
efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
Werner Sembach <[email protected]>
ACPI: resource: Add another DMI match for the TongFang GMxXGxx
Thomas Weißschuh <[email protected]>
ACPI: sysfs: validate return type of _STR method
Mikhail Lobanov <[email protected]>
drbd: Add NULL check for net_conf to prevent dereference in state validation
Qiu-ji Chen <[email protected]>
drbd: Fix atomicity violation in drbd_uuid_set_bm()
Pavan Kumar Paluri <[email protected]>
crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure
Johan Hovold <[email protected]>
serial: qcom-geni: fix fifo polling timeout
Mathias Nyman <[email protected]>
xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
Florian Fainelli <[email protected]>
tty: rp2: Fix reset with non forgiving PCIe host bridges
Jann Horn <[email protected]>
firmware_loader: Block path traversal
Fabio Porcedda <[email protected]>
bus: mhi: host: pci_generic: Fix the name for the Telit FE990A
Krzysztof Kozlowski <[email protected]>
bus: integrator-lm: fix OF node leak in probe()
Tomas Marek <[email protected]>
usb: dwc2: drd: fix clock gating on USB role switch
Pawel Laszczak <[email protected]>
usb: cdnsp: Fix incorrect usb_request status
Oliver Neukum <[email protected]>
USB: class: CDC-ACM: fix race between get_serial and set_serial
Oliver Neukum <[email protected]>
USB: misc: cypress_cy7c63: check for short transfer
Oliver Neukum <[email protected]>
USB: appledisplay: close race between probe and completion handler
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled
Oliver Neukum <[email protected]>
usbnet: fix cyclical race on disconnect with work queue
Bitterblue Smith <[email protected]>
wifi: rtw88: Fix USB/SDIO devices not transmitting beacons
Stefan Mätje <[email protected]>
can: esd_usb: Remove CAN_CTRLMODE_3_SAMPLES for CAN-USB/3-FD
Finn Thain <[email protected]>
scsi: mac_scsi: Disallow bus errors during PDMA send
Finn Thain <[email protected]>
scsi: mac_scsi: Refactor polling loop
Finn Thain <[email protected]>
scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messages
Manish Pandey <[email protected]>
scsi: ufs: qcom: Update MODE_MAX cfg_bw value
Martin Wilck <[email protected]>
scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
Damien Le Moal <[email protected]>
ata: libata-scsi: Fix ata_msense_control() CDL page reporting
Namjae Jeon <[email protected]>
ksmbd: handle caseless file creation
Namjae Jeon <[email protected]>
ksmbd: allow write with FILE_APPEND_DATA
Hobin Woo <[email protected]>
ksmbd: make __dir_empty() compatible with POSIX
Chuck Lever <[email protected]>
fs: Create a generic is_dot_dotdot() utility
Michael Ellerman <[email protected]>
powerpc/atomic: Use YZ constraints for DS-form instructions
Roman Smirnov <[email protected]>
KEYS: prevent NULL pointer dereference in find_asymmetric_key()
Mario Limonciello <[email protected]>
drm/amd/display: Validate backlight caps are sane
Robin Chen <[email protected]>
drm/amd/display: Round calculated vtotal
Leo Ma <[email protected]>
drm/amd/display: Add HDMI DSC native YCbCr422 support
Fangzhi Zuo <[email protected]>
drm/amd/display: Skip Recompute DSC Params if no Stream on Link
Sean Christopherson <[email protected]>
KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock
Sean Christopherson <[email protected]>
KVM: x86: Move x2APIC ICR helper above kvm_apic_write_nodecode()
Sean Christopherson <[email protected]>
KVM: x86: Enforce x2APIC's must-be-zero reserved ICR bits
Snehal Koukuntla <[email protected]>
KVM: arm64: Add memory length checks and remove inline in do_ffa_mem_xfer
Werner Sembach <[email protected]>
Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
Nuno Sa <[email protected]>
Input: adp5588-keys - fix check on return code
Jason Gunthorpe <[email protected]>
iommufd: Protect against overflow of ALIGN() during iova allocation
Roman Smirnov <[email protected]>
Revert "media: tuners: fix error return code of hybrid_tuner_request_state()"
Krzysztof Kozlowski <[email protected]>
soc: versatile: integrator: fix OF node leak in probe() error path
Herve Codina <[email protected]>
soc: fsl: cpm1: tsa: Fix tsa_write8()
Ma Ke <[email protected]>
ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
Dmitry Baryshkov <[email protected]>
Revert "soc: qcom: smd-rpm: Match rpmsg channel instead of compatible"
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
Maciej W. Rozycki <[email protected]>
PCI: Use an error code with PCIe failed link retraining
Maciej W. Rozycki <[email protected]>
PCI: Correct error reporting with PCIe failed link retraining
Frank Li <[email protected]>
PCI: imx6: Fix missing call to phy_power_off() in error handling
Siddharth Vadapalli <[email protected]>
PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main" IRQ
Maciej W. Rozycki <[email protected]>
PCI: Clear the LBMS bit after a link retrain
Maciej W. Rozycki <[email protected]>
PCI: Revert to the original speed after PCIe failed link retraining
Laurent Pinchart <[email protected]>
Remove *.orig pattern from .gitignore
Felix Moessbauer <[email protected]>
io_uring/sqpoll: do not put cpumask on stack
Jens Axboe <[email protected]>
io_uring/sqpoll: retain test for whether the CPU is valid
Juergen Gross <[email protected]>
xen: allow mapping ACPI data using a different physical address
Juergen Gross <[email protected]>
xen: move checks for e820 conflicts further up
Duanqiang Wen <[email protected]>
Revert "net: libwx: fix alloc msix vectors failed"
Zack Rusin <[email protected]>
drm/vmwgfx: Prevent unmapping active read buffers
Fangzhi Zuo <[email protected]>
drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
Shu Han <[email protected]>
mm: call the security_mmap_file() LSM hook in remap_file_pages()
Jens Axboe <[email protected]>
io_uring: check for presence of task_work rather than TIF_NOTIFY_SIGNAL
Felix Moessbauer <[email protected]>
io_uring/sqpoll: do not allow pinning outside of cpuset
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path
Simon Horman <[email protected]>
netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
Phil Sutter <[email protected]>
netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
Furong Xu <[email protected]>
net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled
Wenbo Li <[email protected]>
virtio_net: Fix mismatched buf address when unmapping for small packets
Jiwon Kim <[email protected]>
bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()
Youssef Samir <[email protected]>
net: qrtr: Update packets cloning when broadcasting
Josh Hunt <[email protected]>
tcp: check skb is non-NULL in tcp_rto_delta_us()
Thomas Weißschuh <[email protected]>
net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
Kaixin Wang <[email protected]>
net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
Eric Dumazet <[email protected]>
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
Sean Anderson <[email protected]>
net: xilinx: axienet: Fix packet counting
Sean Anderson <[email protected]>
net: xilinx: axienet: Schedule NAPI in two steps
Mikulas Patocka <[email protected]>
Revert "dm: requeue IO if mapping table not yet available"
Dan Carpenter <[email protected]>
ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
Jason Wang <[email protected]>
vhost_vdpa: assign irq bypass producer token correctly
Yanfei Xu <[email protected]>
cxl/pci: Fix to record only non-zero ranges
Kees Cook <[email protected]>
interconnect: icc-clk: Add missed num_nodes initialization
Suzuki K Poulose <[email protected]>
coresight: tmc: sg: Do not leak sg_table
Markus Schneider-Pargmann <[email protected]>
serial: 8250: omap: Cleanup on error in request_irq
Jinjie Ruan <[email protected]>
driver core: Fix a potential null-ptr-deref in module_add_driver()
Krzysztof Kozlowski <[email protected]>
dt-bindings: iio: asahi-kasei,ak8975: drop incorrect AK09116 compatible
Krzysztof Kozlowski <[email protected]>
iio: magnetometer: ak8975: drop incorrect AK09116 compatible
Biju Das <[email protected]>
iio: magnetometer: ak8975: Convert enum->pointer for data in the match tables
Vasileios Amoiridis <[email protected]>
iio: chemical: bme680: Fix read/write ops to device by adding mutexes
Antoniu Miclaus <[email protected]>
ABI: testing: fix admv8818 attr description
Zijun Hu <[email protected]>
driver core: Fix error handling in driver API device_rename()
Guillaume Stols <[email protected]>
iio: adc: ad7606: fix standby gpio state to match the documentation
Guillaume Stols <[email protected]>
iio: adc: ad7606: fix oversampling gpio array
Hannes Reinecke <[email protected]>
nvme-multipath: system fails to create generic nvme device
Alexander Dahl <[email protected]>
spi: atmel-quadspi: Avoid overwriting delay register settings
Ming Lei <[email protected]>
lib/sbitmap: define swap_lock as raw_spinlock_t
Jinjie Ruan <[email protected]>
spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
Jinjie Ruan <[email protected]>
spi: atmel-quadspi: Undo runtime PM changes at driver exit time
Chao Yu <[email protected]>
f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error()
Chao Yu <[email protected]>
f2fs: get rid of online repaire on corrupted directory
Chao Yu <[email protected]>
f2fs: clean up w/ dotdot_name
Daeho Jeong <[email protected]>
f2fs: prevent atomic file from being dirtied before commit
Yeongjin Gil <[email protected]>
f2fs: compress: don't redirty sparse cluster during {,de}compress
Chao Yu <[email protected]>
f2fs: compress: do sanity check on cluster when CONFIG_F2FS_CHECK_FS is on
Chao Yu <[email protected]>
f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
Chao Yu <[email protected]>
f2fs: support .shutdown in f2fs_sops
Chao Yu <[email protected]>
f2fs: atomic: fix to truncate pagecache before on-disk metadata truncation
Chao Yu <[email protected]>
f2fs: fix to wait page writeback before setting gcing flag
Yeongjin Gil <[email protected]>
f2fs: Create COW inode from parent dentry for atomic write
Chao Yu <[email protected]>
f2fs: fix to avoid racing in between read and OPU dio write
Chao Yu <[email protected]>
f2fs: reduce expensive checkpoint trigger frequency
Chao Yu <[email protected]>
f2fs: atomic: fix to avoid racing w/ GC
Danny Tsen <[email protected]>
crypto: powerpc/p10-aes-gcm - Disable CRYPTO_AES_GCM_P10
Herbert Xu <[email protected]>
crypto: caam - Pad SG length when allocating hash edesc
Li Lingfeng <[email protected]>
nfsd: return -EINVAL when namelen is 0
Guoqing Jiang <[email protected]>
nfsd: call cache_put if xdr_reserve_space returns NULL
Dave Jiang <[email protected]>
ntb: Force physically contiguous allocation of rx ring buffers
Max Hawking <[email protected]>
ntb_perf: Fix printk format
Jinjie Ruan <[email protected]>
ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
Vitaliy Shevtsov <[email protected]>
RDMA/irdma: fix error message in irdma_modify_qp_roce()
Mikhail Lobanov <[email protected]>
RDMA/cxgb4: Added NULL check for lookup_atid
Jinjie Ruan <[email protected]>
riscv: Fix fp alignment bug in perf_callchain_user()
Mark Bloch <[email protected]>
RDMA/mlx5: Obtain upper net device only when needed
Junxian Huang <[email protected]>
RDMA/hns: Fix restricted __le16 degrades to integer issue
Junxian Huang <[email protected]>
RDMA/hns: Optimize hem allocation performance
Chengchang Tang <[email protected]>
RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS
Junxian Huang <[email protected]>
RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler
Chengchang Tang <[email protected]>
RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
wenglianfa <[email protected]>
RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
wenglianfa <[email protected]>
RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
Junxian Huang <[email protected]>
RDMA/hns: Don't modify rq next block addr in HIP09 QPC
Jonas Blixt <[email protected]>
watchdog: imx_sc_wdt: Don't disable WDT in suspend
Michael Guralnik <[email protected]>
RDMA/mlx5: Limit usage of over-sized mkeys from the MR cache
Cheng Xu <[email protected]>
RDMA/erdma: Return QP state in erdma_query_qp
Alexandra Diupina <[email protected]>
PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
Patrisious Haddad <[email protected]>
IB/core: Fix ib_cache_setup_one error flow cleanup
Wang Jianzheng <[email protected]>
pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
Jeff Layton <[email protected]>
nfsd: fix refcount leak when file is unhashed after being found
Jeff Layton <[email protected]>
nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
Alexander Shiyan <[email protected]>
clk: rockchip: rk3588: Fix 32k clock name for pmu_24m_32k_100m_src_p
Yuntao Liu <[email protected]>
clk: starfive: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage
David Lechner <[email protected]>
clk: ti: dra7-atl: Fix leak of of_nodes
Md Haris Iqbal <[email protected]>
RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
Jack Wang <[email protected]>
RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer
Yunfei Dong <[email protected]>
media: mediatek: vcodec: Fix H264 stateless decoder smatch warning
Yunfei Dong <[email protected]>
media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning
Yunfei Dong <[email protected]>
media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning
Claudiu Beznea <[email protected]>
clk: at91: sama7g5: Allocate only the needed amount of memory for PLLs
Yang Yingliang <[email protected]>
pinctrl: single: fix missing error code in pcs_probe()
Zhu Yanjun <[email protected]>
RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
Biju Das <[email protected]>
media: platform: rzg2l-cru: rzg2l-csi2: Add missing MODULE_DEVICE_TABLE
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Clean up clock on probe failure/removal
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix register misspelling
Li Zhijian <[email protected]>
nvdimm: Fix devs leaks in scan_labels()
Samasth Norway Ananda <[email protected]>
x86/PCI: Check pcie_find_root_port() return for NULL
Javier Carrasco <[email protected]>
leds: pca995x: Fix device child node usage in pca995x_probe()
Javier Carrasco <[email protected]>
leds: pca995x: Use device_for_each_child_node() to access device child nodes
Pieterjan Camerlynck <[email protected]>
leds: leds-pca995x: Add support for NXP PCA9956B
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8250: use special function for Lucid 5LPE PLL
Varadarajan Narayanan <[email protected]>
clk: qcom: ipq5332: Register gcc_qdss_tsctr_clk_src
Dan Carpenter <[email protected]>
PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
Takashi Sakamoto <[email protected]>
firewire: core: correct range of block for case of switch statement
Ilpo Järvinen <[email protected]>
PCI: Wait for Link before restoring Downstream Buses
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
Emanuele Ghidoli <[email protected]>
Input: ilitek_ts_i2c - add report id message validation
Emanuele Ghidoli <[email protected]>
Input: ilitek_ts_i2c - avoid wrong input subsystem sync
Christophe JAILLET <[email protected]>
pinctrl: ti: ti-iodelay: Fix some error handling paths
Peng Fan <[email protected]>
pinctrl: ti: iodelay: Use scope based of_node_put() cleanups
Rob Herring <[email protected]>
pinctrl: Use device_get_match_data()
Uwe Kleine-König <[email protected]>
pinctrl: ti: ti-iodelay: Convert to platform remove callback returning void
Javier Carrasco <[email protected]>
leds: bd2606mvv: Fix device child node usage in bd2606mvv_probe()
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8550: use rcg2_shared_ops for ESC RCGs
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8650: Update the GDSC flags
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8550: use rcg2_ops for mdss_dptx1_aux_clk_src
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8550: fix several supposed typos
Jonas Karlman <[email protected]>
clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
Peng Fan <[email protected]>
remoteproc: imx_rproc: Initialize workqueue earlier
Peng Fan <[email protected]>
remoteproc: imx_rproc: Correct ddr alias for i.MX8M
Peng Fan <[email protected]>
clk: imx: imx8qxp: Parent should be initialized earlier than the clock
Peng Fan <[email protected]>
clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk
Zhipeng Wang <[email protected]>
clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
Pengfei Li <[email protected]>
clk: imx: fracn-gppll: fix fractional part of PLL getting lost
Ye Li <[email protected]>
clk: imx: composite-7ulp: Check the PCC present bit
Jacky Bai <[email protected]>
clk: imx: composite-93: keep root clock on when mcore enabled
Peng Fan <[email protected]>
clk: imx: composite-8m: Enable gate clk with mcore_booted
Markus Elfring <[email protected]>
clk: imx: composite-8m: Less function calls in __imx8m_clk_hw_composite() after error detection
Sebastien Laveze <[email protected]>
clk: imx: imx6ul: fix default parent for enet*_ref_sel
Shengjiu Wang <[email protected]>
clk: imx: clk-audiomix: Correct parent clock for earc_phy and audpll
Ian Rogers <[email protected]>
perf time-utils: Fix 32-bit nsec parsing
Yang Jihong <[email protected]>
perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
Yicong Yang <[email protected]>
perf stat: Display iostat headers correctly
Yang Jihong <[email protected]>
perf sched timehist: Fix missing free of session in perf_sched__timehist()
Kan Liang <[email protected]>
perf report: Fix --total-cycles --stdio output error
Namhyung Kim <[email protected]>
perf ui/browser/annotate: Use global annotation_options
Namhyung Kim <[email protected]>
perf annotate: Move some source code related fields from 'struct annotation' to 'struct annotated_source'
Namhyung Kim <[email protected]>
perf annotate: Split branch stack cycles info from 'struct annotation'
Ian Rogers <[email protected]>
perf inject: Fix leader sampling inserting additional samples
Ian Rogers <[email protected]>
perf callchain: Fix stitch LBR memory leaks
Namhyung Kim <[email protected]>
perf mem: Free the allocated sort string, fixing a leak
Daniel Borkmann <[email protected]>
bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
Daniel Borkmann <[email protected]>
bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
Daniel Borkmann <[email protected]>
bpf: Fix helper writes to read-only maps
Daniel Borkmann <[email protected]>
bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
Ryusuke Konishi <[email protected]>
nilfs2: fix potential oob read in nilfs_btree_check_delete()
Ryusuke Konishi <[email protected]>
nilfs2: determine empty node blocks as corrupted
Ryusuke Konishi <[email protected]>
nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
Yujie Liu <[email protected]>
sched/numa: Fix the vma scan starving issue
Mel Gorman <[email protected]>
sched/numa: Complete scanning of inactive VMAs when there is no alternative
Mel Gorman <[email protected]>
sched/numa: Complete scanning of partial VMAs regardless of PID activity
Raghavendra K T <[email protected]>
sched/numa: Move up the access pid reset logic
Mel Gorman <[email protected]>
sched/numa: Trace decisions related to skipping VMAs
Mel Gorman <[email protected]>
sched/numa: Rename vma_numab_state::access_pids[] => ::pids_active[], ::next_pid_reset => ::pids_active_reset
Mel Gorman <[email protected]>
sched/numa: Document vma_numab_state fields
Ojaswin Mujoo <[email protected]>
ext4: check stripe size compatibility on remount as well
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: avoid OOB when system.data xattr changes underneath the filesystem
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: return error on ext4_find_inline_entry
Kemeng Shi <[email protected]>
ext4: avoid negative min_clusters in find_group_orlov()
Kemeng Shi <[email protected]>
ext4: avoid potential buffer_head leak in __ext4_new_inode()
Kemeng Shi <[email protected]>
ext4: avoid buffer_head leak in ext4_mark_inode_used()
Jiawei Ye <[email protected]>
smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
yangerkun <[email protected]>
ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
Chen Yu <[email protected]>
kthread: fix task state in kthread worker if being frozen
Lasse Collin <[email protected]>
xz: cleanup CRC32 edits from 2018
Eduard Zingerman <[email protected]>
bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
Jiangshan Yi <[email protected]>
samples/bpf: Fix compilation errors with cf-protection option
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling tc_redirect.c with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compile if backtrace support missing in libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix redefinition errors compiling lwt_reroute.c
Yonghong Song <[email protected]>
selftests/bpf: Fix flaky selftest lwt_redirect/lwt_reroute
Tony Ambardar <[email protected]>
selftests/bpf: Fix C++ compile error from missing _Bool type
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling test_lru_map.c
Tony Ambardar <[email protected]>
selftests/bpf: Fix arg parsing in veristat, test_progs
David Vernet <[email protected]>
libbpf: Don't take direct pointers into BTF data from st_ops
Eduard Zingerman <[email protected]>
libbpf: Sync progs autoload with maps autocreate for struct_ops maps
Kui-Feng Lee <[email protected]>
libbpf: Convert st_ops->data to shadow type.
Kui-Feng Lee <[email protected]>
libbpf: Find correct module BTFs for struct_ops maps and progs.
Andrii Nakryiko <[email protected]>
libbpf: use stable map placeholder FDs
Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling decap_sanity.c with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling core_reloc.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling flow_dissector.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling kfree_skb.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix include of <sys/fcntl.h>
Yonghong Song <[email protected]>
selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test
Yonghong Song <[email protected]>
selftests/bpf: Refactor out some functions in ns_current_pid_tgid test
Yonghong Song <[email protected]>
selftests/bpf: Replace CHECK with ASSERT_* in ns_current_pid_tgid test
Tony Ambardar <[email protected]>
selftests/bpf: Fix missing BUILD_BUG_ON() declaration
Tony Ambardar <[email protected]>
selftests/bpf: Fix missing UINT_MAX definitions in benchmarks
Tony Ambardar <[email protected]>
selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
Tony Ambardar <[email protected]>
selftests/bpf: Drop unneeded error.h includes
Tushar Vyavahare <[email protected]>
selftests/bpf: Implement get_hw_ring_size function to retrieve current and max interface size
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
Tony Ambardar <[email protected]>
selftests/bpf: Use pid_t consistently in test_progs.c
Tony Ambardar <[email protected]>
tools/runqslower: Fix LDFLAGS and add LDLIBS support
Tony Ambardar <[email protected]>
selftests/bpf: Fix wrong binary in Makefile log output
Cupertino Miranda <[email protected]>
selftests/bpf: Add CFLAGS per source file and runner
Jose E. Marchesi <[email protected]>
bpf: Temporarily define BPF_NO_PRESEVE_ACCESS_INDEX for GCC
Jose E. Marchesi <[email protected]>
bpf: Disable some `attribute ignored' warnings in GCC
Jose E. Marchesi <[email protected]>
bpf: Use -Wno-error in certain tests when building with GCC
Tony Ambardar <[email protected]>
selftests/bpf: Fix error linking uprobe_multi on mips
Alexei Starovoitov <[email protected]>
selftests/bpf: Workaround strict bpf_lsm return value check.
Tianchen Ding <[email protected]>
sched/fair: Make SCHED_IDLE entity be preempted in strict hierarchy
Jonathan McDowell <[email protected]>
tpm: Clean up TPM space after command failure
Juergen Gross <[email protected]>
xen/swiotlb: fix allocated size
Juergen Gross <[email protected]>
xen/swiotlb: add alignment check for dma buffers
Juergen Gross <[email protected]>
xen: tolerate ACPI NVS memory overlapping with Xen allocated memory
Juergen Gross <[email protected]>
xen: add capability to remap non-RAM pages to different PFNs
Juergen Gross <[email protected]>
xen: move max_pfn in xen_memory_setup() out of function scope
Juergen Gross <[email protected]>
xen: introduce generic helper checking for memory map conflicts
Linus Torvalds <[email protected]>
minmax: avoid overly complex min()/max() macro arguments in xen
Niklas Cassel <[email protected]>
ata: libata: Clear DID_TIME_OUT for ATA PT commands with sense data
Jason Gerecke <[email protected]>
HID: wacom: Do not warn about dropped packets for first packet
Jason Gerecke <[email protected]>
HID: wacom: Support sequence numbers smaller than 16-bit
Juergen Gross <[email protected]>
xen: use correct end address of kernel for conflict checking
Yuesong Li <[email protected]>
drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
Sherry Yang <[email protected]>
drm/msm: fix %s null argument error
Dmitry Baryshkov <[email protected]>
drm/msm/dsi: correct programming sequence for SM8350 / SM8450
Wolfram Sang <[email protected]>
ipmi: docs: don't advertise deprecated sysfs entries
Vladimir Lypak <[email protected]>
drm/msm/a5xx: workaround early ring-buffer emptiness check
Vladimir Lypak <[email protected]>
drm/msm/a5xx: fix races in preemption evaluation stage
Vladimir Lypak <[email protected]>
drm/msm/a5xx: properly clear preemption records on resume
Vladimir Lypak <[email protected]>
drm/msm/a5xx: disable preemption in submits by default
Aleksandr Mishin <[email protected]>
drm/msm: Fix incorrect file name output in adreno_request_fw()
Christophe Leroy <[email protected]>
powerpc/vdso: Inconditionally use CFUNC macro
Christophe Leroy <[email protected]>
powerpc/8xx: Fix kernel vs user address comparison
Christophe Leroy <[email protected]>
powerpc/8xx: Fix initial memory mapping
Fei Shao <[email protected]>
drm/mediatek: Use spin_lock_irqsave() for CRTC event lock
Jason-JH.Lin <[email protected]>
drm/mediatek: Fix missing configuration flags in mtk_crtc_ddp_config()
Jeongjun Park <[email protected]>
jfs: fix out-of-bounds in dbNextAG() and diAlloc()
Dan Carpenter <[email protected]>
scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
Stefan Wahren <[email protected]>
drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get
Liu Ying <[email protected]>
drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid()
Nikita Zhandarovich <[email protected]>
drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
Jonas Karlman <[email protected]>
drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
Alex Bee <[email protected]>
drm/rockchip: vop: Allow 4096px width scaling
WangYuli <[email protected]>
drm/amd/amdgpu: Properly tune the size of struct
Finn Thain <[email protected]>
scsi: NCR5380: Check for phase match during PDMA fixup
Gilbert Wu <[email protected]>
scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quickly
Alex Deucher <[email protected]>
drm/radeon: properly handle vbios fake edid sizing
Alex Deucher <[email protected]>
drm/amdgpu: properly handle vbios fake edid sizing
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
Claudiu Beznea <[email protected]>
drm/stm: ltdc: check memory returned by devm_kzalloc()
Christophe JAILLET <[email protected]>
drm/stm: Fix an error handling path in stm_drm_platform_probe()
Geert Uytterhoeven <[email protected]>
pmdomain: core: Harden inter-column space in debug summary
Dmitry Baryshkov <[email protected]>
iommu/arm-smmu-qcom: apply num_context_bank fixes for SDM630 / SDM660
Konrad Dybcio <[email protected]>
iommu/arm-smmu-qcom: Work around SDM845 Adreno SMMU w/ 16K pages
Marc Gonzalez <[email protected]>
iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
Miquel Raynal <[email protected]>
mtd: rawnand: mtk: Fix init error path
Miquel Raynal <[email protected]>
mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips
Jinjie Ruan <[email protected]>
mtd: rawnand: mtk: Use for_each_child_of_node_scoped()
Frederic Weisbecker <[email protected]>
rcu/nocb: Fix RT throttling hrtimer armed from offline CPU
Charles Han <[email protected]>
mtd: powernv: Add check devm_kasprintf() returned value
Jason Gunthorpe <[email protected]>
iommu/amd: Do not set the D bit on AMD v2 table entries
Christophe JAILLET <[email protected]>
fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
Artur Weber <[email protected]>
power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
Chris Morgan <[email protected]>
power: supply: axp20x_battery: Remove design from min and max voltage
Yuntao Liu <[email protected]>
hwmon: (ntc_thermistor) fix module autoloading
Mirsad Todorovac <[email protected]>
mtd: slram: insert break after errors in parsing the map
Guenter Roeck <[email protected]>
hwmon: (max16065) Fix alarm attributes
Andrew Davis <[email protected]>
hwmon: (max16065) Remove use of i2c_match_id()
Guenter Roeck <[email protected]>
hwmon: (max16065) Fix overflows seen when writing limits
tangbin <[email protected]>
ASoC: loongson: fix error release
Finn Thain <[email protected]>
m68k: Fix kernel_clone_args.flags in m68k_clone()
Yuntao Liu <[email protected]>
ALSA: hda: cs35l41: fix module autoloading
Masami Hiramatsu (Google) <[email protected]>
selftests/ftrace: Add required dependency for kprobe tests
Linus Walleij <[email protected]>
ASoC: tas2781-i2c: Get the right GPIO line
Linus Walleij <[email protected]>
ASoC: tas2781-i2c: Drop weird GPIO code
Rob Herring (Arm) <[email protected]>
ASoC: tas2781: Use of_property_read_reg()
Gergo Koteles <[email protected]>
ASoC: tas2781: remove unused acpi_subysystem_id
Ma Ke <[email protected]>
ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the error
Yosry Ahmed <[email protected]>
x86/mm: Use IPIs to synchronize LAM enablement
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8195: Correct clock order for dp_intf*
Ankit Agrawal <[email protected]>
clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
Krzysztof Kozlowski <[email protected]>
reset: k210: fix OF node leak in probe() error path
Krzysztof Kozlowski <[email protected]>
reset: berlin: fix OF node leak in probe() error path
Krzysztof Kozlowski <[email protected]>
ARM: versatile: fix OF node leak in CPUs prepare
Krzysztof Kozlowski <[email protected]>
ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
Claudiu Beznea <[email protected]>
ARM: dts: microchip: sama7g5: Fix RTT clock
Jinjie Ruan <[email protected]>
spi: bcmbca-hsspi: Fix missing pm_runtime_disable()
Andrew Davis <[email protected]>
arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations
Andrew Davis <[email protected]>
arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Correct vendor prefix for Hardkernel ODROID-M1
Alexander Dahl <[email protected]>
ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes
Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes
Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes
Chen-Yu Tsai <[email protected]>
regulator: Return actual error in of_regulator_bulk_get_all()
Andy Shevchenko <[email protected]>
spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
Cristian Marussi <[email protected]>
firmware: arm_scmi: Fix double free in OPTEE transport
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8186: Fix supported-hw mask for GPU OPPs
David Virag <[email protected]>
arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB
Ma Ke <[email protected]>
spi: ppc4xx: handle irq_of_parse_and_map() errors
Riyan Dhiman <[email protected]>
block: fix potential invalid pointer dereference in blk_add_partition
Christian Heusel <[email protected]>
block: print symbolic error name instead of error code
Felix Moessbauer <[email protected]>
io_uring/io-wq: inherit cpuset of cgroup in io worker
Felix Moessbauer <[email protected]>
io_uring/io-wq: do not allow pinning outside of cpuset
Yu Kuai <[email protected]>
block, bfq: fix procress reference leakage for bfqq in merge chain
Yu Kuai <[email protected]>
block, bfq: fix uaf for accessing waker_bfqq after splitting
Gao Xiang <[email protected]>
erofs: fix incorrect symlink detection in fast symlink
David Howells <[email protected]>
cachefiles: Fix non-taking of sb_writers around set/removexattr
Yu Kuai <[email protected]>
block, bfq: don't break merge chain in bfq_split_bfqq()
Yu Kuai <[email protected]>
block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
Yu Kuai <[email protected]>
block, bfq: fix possible UAF for bfqq->bic with merge chain
Ming Lei <[email protected]>
nbd: fix race between timeout and normal completion
Ming Lei <[email protected]>
ublk: move zone report data out of request pdu
Eric Dumazet <[email protected]>
ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
Su Hui <[email protected]>
net: tipc: avoid possible garbage value
Justin Iurman <[email protected]>
net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
Heiner Kallweit <[email protected]>
r8169: disable ALDPS per default for RTL8125
Jinjie Ruan <[email protected]>
net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
Guillaume Nault <[email protected]>
bareudp: Pull inner IP header on xmit.
Guillaume Nault <[email protected]>
bareudp: Pull inner IP header in bareudp_udp_encap_recv().
Luiz Augusto von Dentz <[email protected]>
Bluetooth: btusb: Fix not handling ZPL/short-transfer
Marc Kleine-Budde <[email protected]>
can: m_can: m_can_close(): stop clocks after device has been shut down
Jake Hamby <[email protected]>
can: m_can: enable NAPI before enabling interrupts
Kuniyuki Iwashima <[email protected]>
can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
Eric Dumazet <[email protected]>
sock_map: Add a cond_resched() in sock_hash_free()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
Jiawei Ye <[email protected]>
wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
Dmitry Antipov <[email protected]>
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
Felix Fietkau <[email protected]>
wifi: mt76: mt7996: fix uninitialized TLV data
Benjamin Lin <[email protected]>
wifi: mt76: mt7996: ensure 4-byte alignment for beacon commands
Howard Hsu <[email protected]>
wifi: mt76: mt7915: fix rx filter setting for bfee functionality
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
Felix Fietkau <[email protected]>
wifi: mt76: mt7603: fix mixed declarations and code
Weili Qian <[email protected]>
crypto: hisilicon/qm - inject error before stopping queue
Weili Qian <[email protected]>
crypto: hisilicon/qm - reset device before enabling it
Weili Qian <[email protected]>
crypto: hisilicon/hpre - mask cluster timeout error
John B. Wyatt IV <[email protected]>
pm:cpupower: Add missing powercap_set_enabled() stub function
Aaron Lu <[email protected]>
x86/sgx: Fix deadlock in SGX NUMA node search
Howard Hsu <[email protected]>
wifi: mt76: mt7996: fix EHT beamforming capability check
Howard Hsu <[email protected]>
wifi: mt76: mt7996: fix HE and EHT beamforming capabilities
Peter Chiu <[email protected]>
wifi: mt76: mt7996: fix wmm set of station interface to 3
Peter Chiu <[email protected]>
wifi: mt76: mt7996: fix traffic delay when switching back to working channel
Peter Chiu <[email protected]>
wifi: mt76: mt7996: use hweight16 to get correct tx antenna
Bjørn Mork <[email protected]>
wifi: mt76: mt7915: fix oops on non-dbdc mt7986
Nishanth Menon <[email protected]>
cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
Robin Murphy <[email protected]>
perf/arm-cmn: Ensure dtm_idx is big enough
Robin Murphy <[email protected]>
perf/arm-cmn: Fix CCLA register offset
Robin Murphy <[email protected]>
perf/arm-cmn: Refactor node ID handling. Again.
Robin Murphy <[email protected]>
perf/arm-cmn: Improve debugfs pretty-printing for large configs
Robin Murphy <[email protected]>
perf/arm-cmn: Rework DTC counters (again)
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: remove annotation to access set timeout while holding lock
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject expiration higher than timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject element expiration with no timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
Clément Léger <[email protected]>
ACPI: CPPC: Fix MASK_VAL() usage
Zhang Changzhong <[email protected]>
can: j1939: use correct function name in comment
Mark Brown <[email protected]>
kselftest/arm64: Actually test SME vector length changes via sigreturn
Yicong Yang <[email protected]>
drivers/perf: hisi_pcie: Fix TLP headers bandwidth counting
Yicong Yang <[email protected]>
drivers/perf: hisi_pcie: Record hardware counts correctly
Kamlesh Gurudasani <[email protected]>
padata: Honor the caller's alignment in case of chunk_size 0
Avraham Stern <[email protected]>
wifi: iwlwifi: mvm: increase the time between ranging measurements
Johannes Berg <[email protected]>
wifi: iwlwifi: config: label 'gl' devices as discrete
Golan Ben Ami <[email protected]>
wifi: iwlwifi: remove AX101, AX201 and AX203 support from LNL
Ping-Ke Shih <[email protected]>
wifi: mac80211: don't use rate mask for offchannel TX either
Jing Zhang <[email protected]>
drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
Andre Przywara <[email protected]>
kselftest/arm64: signal: fix/refactor SVE vector length enumeration
Dan Carpenter <[email protected]>
powercap: intel_rapl: Fix off by one in get_rpi()
Calvin Owens <[email protected]>
ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros
Olaf Hering <[email protected]>
mount: handle OOM on mnt_warn_timestamp_expiry
Atish Patra <[email protected]>
RISC-V: KVM: Fix to allow hpmcounter31 from the guest
Atish Patra <[email protected]>
RISC-V: KVM: Allow legacy PMU access from guest
Andrew Jones <[email protected]>
RISC-V: KVM: Fix sbiret init before forwarding to userspace
Dmitry Kandybka <[email protected]>
wifi: rtw88: remove CPT execution branch never used
Dave Martin <[email protected]>
arm64: signal: Fix some under-bracketed UAPI macros
Yanteng Si <[email protected]>
net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
Baochen Qiang <[email protected]>
wifi: ath12k: fix invalid AMPDU factor calculation in ath12k_peer_assoc_h_he()
P Praneesh <[email protected]>
wifi: ath12k: match WMI BSS chan info structure with firmware definition
P Praneesh <[email protected]>
wifi: ath12k: fix BSS chan info request WMI command
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k: Remove error checks when creating debugfs entries
Arend van Spriel <[email protected]>
wifi: brcmfmac: introducing fwil query functions
Arend van Spriel <[email protected]>
wifi: brcmfmac: export firmware interface functions
Aleksandr Mishin <[email protected]>
ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
Helge Deller <[email protected]>
crypto: xor - fix template benchmarking
Dmitry Antipov <[email protected]>
wifi: rtw88: always wait for both firmware loading attempts
Shubhrajyoti Datta <[email protected]>
EDAC/synopsys: Fix error injection on Zynq UltraScale+
Serge Semin <[email protected]>
EDAC/synopsys: Fix ECC status and IRQ control race condition
-------------
Diffstat:
.gitignore | 1 - .../ABI/testing/sysfs-bus-iio-filter-admv8818 | 2 +- Documentation/arch/arm64/silicon-errata.rst | 2 + .../iio/magnetometer/asahi-kasei,ak8975.yaml | 1 - .../devicetree/bindings/spi/spi-nxp-fspi.yaml | 19 +- Documentation/driver-api/ipmi.rst | 2 +- Documentation/virt/kvm/locking.rst | 33 +- Makefile | 4 +- arch/arm/boot/dts/microchip/sam9x60.dtsi | 4 +- arch/arm/boot/dts/microchip/sama7g5.dtsi | 2 +- arch/arm/boot/dts/nxp/imx/imx6ul-geam.dts | 2 +- arch/arm/boot/dts/nxp/imx/imx7d-zii-rmu2.dts | 2 +- arch/arm/mach-ep93xx/clock.c | 2 +- arch/arm/mach-versatile/platsmp-realview.c | 1 + arch/arm/vfp/vfpinstr.h | 44 +- arch/arm64/Kconfig | 2 +- .../boot/dts/exynos/exynos7885-jackpotlte.dts | 2 +- arch/arm64/boot/dts/mediatek/mt8186.dtsi | 12 +- arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 1 + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 12 +- arch/arm64/boot/dts/qcom/sa8775p.dtsi | 2 + arch/arm64/boot/dts/renesas/r9a07g043u.dtsi | 4 +- arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 4 +- arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 4 +- .../boot/dts/rockchip/rk3399-pinebook-pro.dts | 4 +- arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 +- arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts | 4 +- arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 4 +- arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/esr.h | 88 +-- arch/arm64/include/uapi/asm/sigcontext.h | 6 +- arch/arm64/kernel/cpu_errata.c | 10 +- arch/arm64/kvm/hyp/nvhe/ffa.c | 21 +- arch/m68k/kernel/process.c | 2 +- arch/powerpc/crypto/Kconfig | 1 + arch/powerpc/include/asm/asm-compat.h | 6 + arch/powerpc/include/asm/atomic.h | 5 +- arch/powerpc/include/asm/uaccess.h | 7 +- arch/powerpc/kernel/head_8xx.S | 6 +- arch/powerpc/kernel/vdso/gettimeofday.S | 4 - arch/powerpc/mm/nohash/8xx.c | 4 +- arch/riscv/include/asm/kvm_vcpu_pmu.h | 21 +- arch/riscv/kernel/perf_callchain.c | 2 +- arch/riscv/kvm/vcpu_sbi.c | 4 +- arch/x86/coco/tdx/tdx.c | 6 + arch/x86/events/intel/pt.c | 15 +- arch/x86/include/asm/acpi.h | 8 + arch/x86/include/asm/hardirq.h | 8 +- arch/x86/include/asm/idtentry.h | 73 +- arch/x86/kernel/acpi/boot.c | 11 + arch/x86/kernel/cpu/sgx/main.c | 27 +- arch/x86/kernel/jailhouse.c | 1 + arch/x86/kernel/mmconf-fam10h_64.c | 1 + arch/x86/kernel/process_64.c | 29 +- arch/x86/kernel/smpboot.c | 1 + arch/x86/kernel/x86_init.c | 1 + arch/x86/kvm/lapic.c | 35 +- arch/x86/mm/tlb.c | 7 +- arch/x86/pci/fixup.c | 4 +- arch/x86/xen/mmu_pv.c | 5 +- arch/x86/xen/p2m.c | 98 +++ arch/x86/xen/setup.c | 203 ++++-- arch/x86/xen/xen-ops.h | 6 +- block/bfq-iosched.c | 81 +- block/partitions/core.c | 8 +- crypto/asymmetric_keys/asymmetric_type.c | 7 +- crypto/xor.c | 31 +- drivers/acpi/cppc_acpi.c | 43 +- drivers/acpi/device_sysfs.c | 5 +- drivers/acpi/pmic/tps68470_pmic.c | 6 +- drivers/acpi/resource.c | 6 + drivers/ata/libata-eh.c | 8 + drivers/ata/libata-scsi.c | 5 +- drivers/base/core.c | 15 +- drivers/base/firmware_loader/main.c | 30 + drivers/base/module.c | 14 +- drivers/base/power/domain.c | 2 +- drivers/block/drbd/drbd_main.c | 8 +- drivers/block/drbd/drbd_state.c | 2 +- drivers/block/nbd.c | 13 +- drivers/block/ublk_drv.c | 62 +- drivers/bluetooth/btusb.c | 5 +- drivers/bus/arm-integrator-lm.c | 1 + drivers/bus/mhi/host/pci_generic.c | 13 +- drivers/char/hw_random/bcm2835-rng.c | 4 +- drivers/char/hw_random/cctrng.c | 1 + drivers/char/hw_random/mtk-rng.c | 2 +- drivers/char/tpm/tpm-dev-common.c | 2 + drivers/char/tpm/tpm2-space.c | 3 + drivers/clk/at91/sama7g5.c | 5 +- drivers/clk/imx/clk-composite-7ulp.c | 7 + drivers/clk/imx/clk-composite-8m.c | 61 +- drivers/clk/imx/clk-composite-93.c | 15 +- drivers/clk/imx/clk-fracn-gppll.c | 4 + drivers/clk/imx/clk-imx6ul.c | 4 +- drivers/clk/imx/clk-imx8mp-audiomix.c | 13 +- drivers/clk/imx/clk-imx8mp.c | 4 +- drivers/clk/imx/clk-imx8qxp.c | 10 +- drivers/clk/qcom/clk-alpha-pll.c | 52 ++ drivers/clk/qcom/clk-alpha-pll.h | 2 + drivers/clk/qcom/dispcc-sm8250.c | 9 +- drivers/clk/qcom/dispcc-sm8550.c | 14 +- drivers/clk/qcom/gcc-ipq5332.c | 1 + drivers/clk/rockchip/clk-rk3228.c | 2 +- drivers/clk/rockchip/clk-rk3588.c | 2 +- drivers/clk/starfive/clk-starfive-jh7110-vout.c | 2 +- drivers/clk/ti/clk-dra7-atl.c | 1 + drivers/clocksource/timer-qcom.c | 7 +- drivers/cpufreq/ti-cpufreq.c | 10 +- drivers/cpuidle/cpuidle-riscv-sbi.c | 21 +- drivers/crypto/caam/caamhash.c | 1 + drivers/crypto/ccp/sev-dev.c | 2 + drivers/crypto/hisilicon/hpre/hpre_main.c | 54 +- drivers/crypto/hisilicon/qm.c | 151 ++-- drivers/crypto/hisilicon/sec2/sec_main.c | 16 +- drivers/crypto/hisilicon/zip/zip_main.c | 23 +- drivers/cxl/core/pci.c | 8 +- drivers/edac/igen6_edac.c | 2 +- drivers/edac/synopsys_edac.c | 85 ++- drivers/firewire/core-cdev.c | 2 +- drivers/firmware/arm_scmi/optee.c | 7 + drivers/firmware/efi/libstub/tpm.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h | 4 +- drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 29 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 16 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 9 +- drivers/gpu/drm/amd/display/dc/dc_dsc.h | 3 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 6 +- drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c | 5 +- .../drm/amd/display/modules/freesync/freesync.c | 2 +- drivers/gpu/drm/bridge/lontium-lt8912b.c | 35 +- drivers/gpu/drm/exynos/exynos_drm_gsc.c | 2 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 32 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 12 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.h | 2 + drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 30 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c | 2 +- drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 12 +- drivers/gpu/drm/radeon/evergreen_cs.c | 62 +- drivers/gpu/drm/radeon/radeon_atombios.c | 29 +- drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 2 + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 4 +- drivers/gpu/drm/stm/drv.c | 4 +- drivers/gpu/drm/stm/ltdc.c | 2 + drivers/gpu/drm/vc4/vc4_hdmi.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.h | 3 + drivers/hid/wacom_wac.c | 13 +- drivers/hid/wacom_wac.h | 2 +- drivers/hwmon/max16065.c | 27 +- drivers/hwmon/ntc_thermistor.c | 1 + drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +- drivers/i2c/busses/i2c-aspeed.c | 16 +- drivers/i2c/busses/i2c-isch.c | 3 +- drivers/iio/adc/ad7606.c | 8 +- drivers/iio/adc/ad7606_spi.c | 5 +- drivers/iio/chemical/bme680_core.c | 7 + drivers/iio/magnetometer/ak8975.c | 85 +-- drivers/infiniband/core/cache.c | 4 +- drivers/infiniband/core/iwcm.c | 2 +- drivers/infiniband/hw/cxgb4/cm.c | 5 + drivers/infiniband/hw/erdma/erdma_verbs.c | 25 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 22 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 33 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 16 +- drivers/infiniband/hw/irdma/verbs.c | 2 +- drivers/infiniband/hw/mlx5/main.c | 2 +- drivers/infiniband/hw/mlx5/mr.c | 14 +- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 9 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 1 + drivers/input/keyboard/adp5588-keys.c | 2 +- drivers/input/serio/i8042-acpipnpio.h | 37 + drivers/input/touchscreen/ilitek_ts_i2c.c | 18 +- drivers/interconnect/icc-clk.c | 3 +- drivers/iommu/amd/io_pgtable_v2.c | 2 +- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 28 + drivers/iommu/iommufd/io_pagetable.c | 8 + drivers/leds/leds-bd2606mvv.c | 23 +- drivers/leds/leds-pca995x.c | 78 +- drivers/md/dm-rq.c | 4 +- drivers/md/dm-verity-target.c | 23 +- drivers/md/dm.c | 11 +- drivers/media/dvb-frontends/rtl2830.c | 2 +- drivers/media/dvb-frontends/rtl2832.c | 2 +- .../vcodec/decoder/vdec/vdec_h264_req_if.c | 9 +- .../vcodec/decoder/vdec/vdec_h264_req_multi_if.c | 9 +- .../mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c | 10 +- .../media/platform/renesas/rzg2l-cru/rzg2l-csi2.c | 1 + drivers/media/tuners/tuner-i2c.h | 4 +- drivers/mtd/devices/powernv_flash.c | 3 + drivers/mtd/devices/slram.c | 2 + drivers/mtd/nand/raw/mtk_nand.c | 36 +- drivers/net/bareudp.c | 26 +- drivers/net/bonding/bond_main.c | 6 +- drivers/net/can/m_can/m_can.c | 14 +- drivers/net/can/usb/esd_usb.c | 6 +- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +- drivers/net/ethernet/realtek/r8169_phy_config.c | 2 + drivers/net/ethernet/seeq/ether3.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 37 +- drivers/net/usb/usbnet.c | 37 +- drivers/net/virtio_net.c | 10 +- drivers/net/wireless/ath/ath12k/mac.c | 5 +- drivers/net/wireless/ath/ath12k/wmi.c | 1 + drivers/net/wireless/ath/ath12k/wmi.h | 3 +- drivers/net/wireless/ath/ath9k/debug.c | 2 - drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 - .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 2 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 26 +- .../wireless/broadcom/brcm80211/brcmfmac/fwil.c | 115 +-- .../wireless/broadcom/brcm80211/brcmfmac/fwil.h | 145 +++- drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 11 + drivers/net/wireless/intel/iwlwifi/iwl-config.h | 1 + drivers/net/wireless/intel/iwlwifi/mvm/constants.h | 2 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 36 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7603/dma.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7615/init.c | 3 + drivers/net/wireless/mediatek/mt76/mt7915/init.c | 2 + drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7921/init.c | 2 + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 65 +- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 23 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 4 +- drivers/net/wireless/microchip/wilc1000/hif.c | 4 +- drivers/net/wireless/realtek/rtw88/coex.c | 38 +- drivers/net/wireless/realtek/rtw88/fw.c | 13 +- drivers/net/wireless/realtek/rtw88/main.c | 7 +- drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 - drivers/net/wireless/realtek/rtw88/rtw8822c.c | 12 +- drivers/ntb/hw/intel/ntb_hw_gen1.c | 2 +- drivers/ntb/ntb_transport.c | 23 +- drivers/ntb/test/ntb_perf.c | 2 +- drivers/nvdimm/namespace_devs.c | 34 +- drivers/nvme/host/multipath.c | 2 +- drivers/pci/controller/dwc/pci-dra7xx.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 7 +- drivers/pci/controller/dwc/pci-keystone.c | 2 +- drivers/pci/controller/dwc/pcie-kirin.c | 4 +- drivers/pci/controller/pcie-xilinx-nwl.c | 39 +- drivers/pci/pci.c | 20 +- drivers/pci/pci.h | 6 +- drivers/pci/quirks.c | 31 +- drivers/perf/alibaba_uncore_drw_pmu.c | 2 +- drivers/perf/arm-cmn.c | 242 +++--- drivers/perf/hisilicon/hisi_pcie_pmu.c | 16 +- drivers/pinctrl/bcm/pinctrl-ns.c | 8 +- drivers/pinctrl/berlin/berlin-bg2.c | 8 +- drivers/pinctrl/berlin/berlin-bg2cd.c | 8 +- drivers/pinctrl/berlin/berlin-bg2q.c | 8 +- drivers/pinctrl/berlin/berlin-bg4ct.c | 9 +- drivers/pinctrl/berlin/pinctrl-as370.c | 9 +- drivers/pinctrl/mvebu/pinctrl-armada-38x.c | 9 +- drivers/pinctrl/mvebu/pinctrl-armada-39x.c | 9 +- drivers/pinctrl/mvebu/pinctrl-armada-ap806.c | 5 +- drivers/pinctrl/mvebu/pinctrl-armada-cp110.c | 6 +- drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 9 +- drivers/pinctrl/mvebu/pinctrl-dove.c | 48 +- drivers/pinctrl/mvebu/pinctrl-kirkwood.c | 7 +- drivers/pinctrl/mvebu/pinctrl-orion.c | 7 +- drivers/pinctrl/nomadik/pinctrl-abx500.c | 9 +- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 10 +- drivers/pinctrl/pinctrl-at91.c | 11 +- drivers/pinctrl/pinctrl-single.c | 3 +- drivers/pinctrl/pinctrl-xway.c | 11 +- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 113 ++- drivers/power/supply/axp20x_battery.c | 16 +- drivers/power/supply/max17042_battery.c | 5 +- drivers/powercap/intel_rapl_common.c | 2 +- drivers/pps/clients/pps_parport.c | 14 +- drivers/regulator/of_regulator.c | 2 +- drivers/remoteproc/imx_rproc.c | 6 +- drivers/reset/reset-berlin.c | 3 +- drivers/reset/reset-k210.c | 3 +- drivers/scsi/NCR5380.c | 78 +- drivers/scsi/elx/libefc/efc_nport.c | 2 +- drivers/scsi/mac_scsi.c | 166 ++--- drivers/scsi/sd.c | 2 +- drivers/scsi/smartpqi/smartpqi_init.c | 20 +- drivers/soc/fsl/qe/tsa.c | 2 +- drivers/soc/qcom/smd-rpm.c | 35 +- drivers/soc/versatile/soc-integrator.c | 1 + drivers/soc/versatile/soc-realview.c | 20 +- drivers/spi/atmel-quadspi.c | 15 +- drivers/spi/spi-bcmbca-hsspi.c | 8 +- drivers/spi/spi-fsl-lpspi.c | 1 + drivers/spi/spi-nxp-fspi.c | 54 +- drivers/spi/spi-ppc4xx.c | 7 +- drivers/thunderbolt/switch.c | 331 +++++++-- drivers/thunderbolt/tb.c | 812 ++++++++++++++++----- drivers/thunderbolt/tb.h | 56 +- drivers/thunderbolt/tb_regs.h | 9 +- drivers/thunderbolt/tunnel.c | 217 ++++-- drivers/thunderbolt/tunnel.h | 26 +- drivers/thunderbolt/usb4.c | 116 ++- drivers/tty/serial/8250/8250_omap.c | 2 +- drivers/tty/serial/qcom_geni_serial.c | 31 +- drivers/tty/serial/rp2.c | 2 +- drivers/tty/serial/serial_core.c | 14 +- drivers/ufs/host/ufs-qcom.c | 2 +- drivers/usb/cdns3/cdnsp-ring.c | 6 +- drivers/usb/cdns3/host.c | 4 +- drivers/usb/class/cdc-acm.c | 2 + drivers/usb/dwc2/drd.c | 9 + drivers/usb/host/xhci-mem.c | 5 +- drivers/usb/host/xhci-pci.c | 17 +- drivers/usb/host/xhci-ring.c | 14 + drivers/usb/host/xhci.h | 3 + drivers/usb/misc/appledisplay.c | 15 +- drivers/usb/misc/cypress_cy7c63.c | 4 + drivers/usb/misc/yurex.c | 24 +- drivers/vhost/vdpa.c | 16 +- drivers/video/fbdev/hpfb.c | 1 + drivers/watchdog/imx_sc_wdt.c | 24 - drivers/xen/swiotlb-xen.c | 10 +- fs/btrfs/btrfs_inode.h | 47 +- fs/btrfs/ctree.h | 2 + fs/btrfs/extent-tree.c | 4 +- fs/btrfs/file.c | 34 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/subpage.c | 10 +- fs/btrfs/tree-checker.c | 2 +- fs/cachefiles/xattr.c | 34 +- fs/crypto/fname.c | 8 +- fs/ecryptfs/crypto.c | 10 - fs/erofs/inode.c | 20 +- fs/ext4/ialloc.c | 14 +- fs/ext4/inline.c | 35 +- fs/ext4/mballoc.c | 10 +- fs/ext4/super.c | 29 +- fs/f2fs/compress.c | 87 ++- fs/f2fs/data.c | 14 +- fs/f2fs/dir.c | 3 +- fs/f2fs/extent_cache.c | 4 +- fs/f2fs/f2fs.h | 48 +- fs/f2fs/file.c | 167 +++-- fs/f2fs/inode.c | 5 + fs/f2fs/namei.c | 69 -- fs/f2fs/segment.c | 8 + fs/f2fs/super.c | 20 +- fs/f2fs/xattr.c | 14 +- fs/fcntl.c | 14 +- fs/inode.c | 4 + fs/jfs/jfs_dmap.c | 4 +- fs/jfs/jfs_imap.c | 2 +- fs/namei.c | 6 +- fs/namespace.c | 14 +- fs/nfs/nfs4state.c | 1 + fs/nfsd/filecache.c | 3 +- fs/nfsd/nfs4idmap.c | 13 +- fs/nfsd/nfs4recover.c | 8 + fs/nilfs2/btree.c | 12 +- fs/smb/server/vfs.c | 19 +- include/acpi/cppc_acpi.h | 2 + include/linux/bitmap.h | 77 ++ include/linux/bpf.h | 7 +- include/linux/f2fs_fs.h | 2 +- include/linux/fs.h | 11 + include/linux/mm.h | 4 +- include/linux/mm_types.h | 31 +- include/linux/sbitmap.h | 2 +- include/linux/sched/numa_balancing.h | 10 + include/linux/usb/usbnet.h | 15 + include/linux/xarray.h | 6 + include/net/bluetooth/hci_core.h | 4 +- include/net/ip.h | 2 + include/net/mac80211.h | 7 +- include/net/tcp.h | 21 +- include/sound/tas2781.h | 8 +- include/trace/events/f2fs.h | 3 +- include/trace/events/sched.h | 52 ++ io_uring/io-wq.c | 25 +- io_uring/io_uring.c | 4 +- io_uring/sqpoll.c | 12 + kernel/bpf/btf.c | 8 + kernel/bpf/helpers.c | 12 +- kernel/bpf/syscall.c | 4 +- kernel/bpf/verifier.c | 57 +- kernel/kthread.c | 10 +- kernel/locking/lockdep.c | 50 +- kernel/module/Makefile | 2 +- kernel/padata.c | 6 +- kernel/rcu/tree_nocb.h | 5 +- kernel/sched/fair.c | 134 +++- kernel/trace/bpf_trace.c | 15 +- lib/debugobjects.c | 5 +- lib/sbitmap.c | 4 +- lib/test_xarray.c | 93 +++ lib/xarray.c | 53 +- lib/xz/xz_crc32.c | 2 +- lib/xz/xz_private.h | 4 - mm/damon/vaddr.c | 2 + mm/filemap.c | 50 +- mm/mmap.c | 4 + mm/util.c | 2 +- net/bluetooth/hci_conn.c | 6 +- net/bluetooth/hci_sync.c | 5 +- net/bluetooth/mgmt.c | 13 +- net/can/bcm.c | 4 +- net/can/j1939/transport.c | 8 +- net/core/filter.c | 50 +- net/core/sock_map.c | 1 + net/ipv4/icmp.c | 103 +-- net/ipv6/Kconfig | 1 + net/ipv6/icmp.c | 28 +- net/ipv6/netfilter/nf_reject_ipv6.c | 14 +- net/ipv6/route.c | 2 +- net/ipv6/rpl_iptunnel.c | 12 +- net/mac80211/iface.c | 17 +- net/mac80211/offchannel.c | 1 + net/mac80211/rate.c | 2 +- net/mac80211/scan.c | 2 +- net/mac80211/tx.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 7 +- net/netfilter/nf_tables_api.c | 16 +- net/qrtr/af_qrtr.c | 2 +- net/tipc/bcast.c | 2 +- net/wireless/nl80211.c | 3 +- net/wireless/scan.c | 6 +- net/wireless/sme.c | 3 +- samples/bpf/Makefile | 6 +- security/bpf/hooks.c | 1 - security/smack/smackfs.c | 2 +- sound/pci/hda/cs35l41_hda_spi.c | 1 + sound/pci/hda/tas2781_hda_i2c.c | 14 +- sound/soc/codecs/rt5682.c | 4 +- sound/soc/codecs/rt5682s.c | 4 +- sound/soc/codecs/tas2781-comlib.c | 4 - sound/soc/codecs/tas2781-fmwlib.c | 1 - sound/soc/codecs/tas2781-i2c.c | 56 +- sound/soc/loongson/loongson_card.c | 4 +- tools/bpf/runqslower/Makefile | 3 +- tools/lib/bpf/bpf.c | 4 +- tools/lib/bpf/bpf.h | 4 +- tools/lib/bpf/libbpf.c | 246 +++++-- tools/lib/bpf/libbpf_internal.h | 14 + tools/lib/bpf/libbpf_probes.c | 1 + tools/perf/builtin-annotate.c | 2 +- tools/perf/builtin-inject.c | 1 + tools/perf/builtin-mem.c | 1 + tools/perf/builtin-report.c | 11 +- tools/perf/builtin-sched.c | 8 +- tools/perf/builtin-top.c | 3 +- tools/perf/ui/browsers/annotate.c | 77 +- tools/perf/ui/browsers/hists.c | 34 +- tools/perf/ui/browsers/hists.h | 2 - tools/perf/util/annotate.c | 118 +-- tools/perf/util/annotate.h | 39 +- tools/perf/util/block-info.c | 10 +- tools/perf/util/block-info.h | 3 +- tools/perf/util/hist.h | 25 +- tools/perf/util/machine.c | 17 +- tools/perf/util/session.c | 3 + tools/perf/util/sort.c | 14 +- tools/perf/util/stat-display.c | 3 +- tools/perf/util/thread.c | 4 + tools/perf/util/thread.h | 1 + tools/perf/util/time-utils.c | 4 +- tools/perf/util/tool.h | 1 + tools/power/cpupower/lib/powercap.c | 8 + tools/testing/selftests/arm64/signal/Makefile | 2 +- tools/testing/selftests/arm64/signal/sve_helpers.c | 56 ++ tools/testing/selftests/arm64/signal/sve_helpers.h | 21 + .../testcases/fake_sigreturn_sme_change_vl.c | 46 +- .../testcases/fake_sigreturn_sve_change_vl.c | 30 +- .../selftests/arm64/signal/testcases/ssve_regs.c | 36 +- .../arm64/signal/testcases/ssve_za_regs.c | 36 +- .../selftests/arm64/signal/testcases/sve_regs.c | 32 +- .../selftests/arm64/signal/testcases/za_no_regs.c | 32 +- .../selftests/arm64/signal/testcases/za_regs.c | 36 +- tools/testing/selftests/bpf/Makefile | 30 +- tools/testing/selftests/bpf/bench.c | 1 + tools/testing/selftests/bpf/bench.h | 1 + .../selftests/bpf/map_tests/sk_storage_map.c | 2 +- tools/testing/selftests/bpf/network_helpers.c | 24 + tools/testing/selftests/bpf/network_helpers.h | 4 + .../selftests/bpf/prog_tests/bpf_iter_setsockopt.c | 2 +- .../testing/selftests/bpf/prog_tests/core_reloc.c | 1 + .../selftests/bpf/prog_tests/decap_sanity.c | 1 - .../selftests/bpf/prog_tests/flow_dissector.c | 3 +- tools/testing/selftests/bpf/prog_tests/kfree_skb.c | 1 + .../testing/selftests/bpf/prog_tests/lwt_helpers.h | 2 - .../selftests/bpf/prog_tests/lwt_redirect.c | 2 +- .../testing/selftests/bpf/prog_tests/lwt_reroute.c | 2 + .../selftests/bpf/prog_tests/ns_current_pid_tgid.c | 156 +++- .../selftests/bpf/prog_tests/parse_tcp_hdr_opt.c | 1 + tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 1 - .../testing/selftests/bpf/prog_tests/tc_redirect.c | 12 +- tools/testing/selftests/bpf/prog_tests/tcp_rtt.c | 1 + .../selftests/bpf/prog_tests/user_ringbuf.c | 1 + .../testing/selftests/bpf/progs/cg_storage_multi.h | 2 - .../bpf/progs/test_libbpf_get_fd_by_id_opts.c | 1 + .../selftests/bpf/progs/test_ns_current_pid_tgid.c | 17 +- tools/testing/selftests/bpf/test_cpp.cpp | 4 + tools/testing/selftests/bpf/test_lru_map.c | 3 +- tools/testing/selftests/bpf/test_progs.c | 18 +- tools/testing/selftests/bpf/testing_helpers.c | 4 +- tools/testing/selftests/bpf/unpriv_helpers.c | 1 - tools/testing/selftests/bpf/veristat.c | 8 +- tools/testing/selftests/bpf/xdp_hw_metadata.c | 14 - .../ftrace/test.d/kprobe/kprobe_args_char.tc | 2 +- .../ftrace/test.d/kprobe/kprobe_args_string.tc | 2 +- virt/kvm/kvm_main.c | 31 +- 508 files changed, 6523 insertions(+), 3354 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/538 EDAC/synopsys: Fix ECC status and IRQ control race condition
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit 591c946675d88dcc0ae9ff54be9d5caaee8ce1e3 ]
The race condition around the ECCCLR register access happens in the IRQ disable method called in the device remove() procedure and in the ECC IRQ handler:
1. Enable IRQ:
a. ECCCLR = EN_CE | EN_UE
2. Disable IRQ:
a. ECCCLR = 0
3. IRQ handler:
a. ECCCLR = CLR_CE | CLR_CE_CNT | CLR_CE | CLR_CE_CNT b. ECCCLR = 0
c. ECCCLR = EN_CE | EN_UE
So if the IRQ disabling procedure is called concurrently with the IRQ handler method the IRQ might be actually left enabled due to the statement 3c.
The root cause of the problem is that ECCCLR register (which since v3.10a has been called as ECCCTL) has intermixed ECC status data clear flags and the IRQ enable/disable flags. Thus the IRQ disabling (clear EN flags) and handling (write 1 to clear ECC status data) procedures must be serialised around the ECCCTL register modification to prevent the race.
So fix the problem described above by adding the spin-lock around the ECCCLR modifications and preventing the IRQ-handler from modifying the IRQs enable flags (there is no point in disabling the IRQ and then re-enabling it again within a single IRQ handler call, see the statements 3a/3b and 3c above).
Stable-dep-of: 35e6dbfe1846 ("EDAC/synopsys: Fix error injection on Zynq UltraScale+")
--- drivers/edac/synopsys_edac.c | 50 ++++++++++++++++++++++++++---------- 1 file changed, 37 insertions(+), 13 deletions(-)
drivers/edac/synopsys_edac.c +37 -13
@@ -9,6 +9,7 @@#include <linux/edac.h> #include <linux/module.h> #include <linux/platform_device.h> +#include <linux/spinlock.h> #include <linux/interrupt.h> #include <linux/of.h>
@@ -299,6 +300,7 @@ struct synps_ecc_status {/** * struct synps_edac_priv - DDR memory controller private instance data. * @baseaddr: Base address of the DDR controller. +* @reglock: Concurrent CSRs access lock. * @message: Buffer for framing the event specific info. * @stat: ECC status information. * @p_data: Platform data.
@@ -313,6 +315,7 @@ struct synps_ecc_status {*/ struct synps_edac_priv {void __iomem *baseaddr; +spinlock_t reglock;char message[SYNPS_EDAC_MSG_SIZE ];struct synps_ecc_status stat;const struct synps_platform_data *p_data;
@@ -408,7 +411,8 @@ static int zynq_get_error_info(struct synps_edac_priv *priv)static int zynqmp_get_error_info (struct synps_edac_priv *priv) {struct synps_ecc_status *p; -u32 regval, clearval =0 ; +u32 regval, clearval; +unsigned long flags;void __iomem *base; base = priv->baseaddr;
@@ -452,10 +456,14 @@ static int zynqmp_get_error_info(struct synps_edac_priv *priv) p->ueinfo.blknr = (regval &ECC_CEADDR1_BLKNR_MASK ); p->ueinfo.data =readl (base +ECC_UESYND0_OFST ); out: - clearval =ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_CE_ERRCNT ; - clearval |=ECC_CTRL_CLR_UE_ERR |ECC_CTRL_CLR_UE_ERRCNT ; +spin_lock_irqsave (&priv->reglock, flags); + + clearval =readl (base +ECC_CLR_OFST ) | +ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_CE_ERRCNT | +ECC_CTRL_CLR_UE_ERR |ECC_CTRL_CLR_UE_ERRCNT ;writel (clearval, base +ECC_CLR_OFST ); -writel (0x0 , base +ECC_CLR_OFST ); + +spin_unlock_irqrestore (&priv->reglock, flags);return 0 ; }
@@ -515,24 +523,41 @@ static void handle_error(struct mem_ctl_info *mci, struct synps_ecc_status *p)static void enable_intr (struct synps_edac_priv *priv) { +unsigned long flags; +/* Enable UE/CE Interrupts */ -if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) -writel (DDR_UE_MASK |DDR_CE_MASK , - priv->baseaddr +ECC_CLR_OFST ); -else +if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR )) {writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , priv->baseaddr +DDR_QOS_IRQ_EN_OFST ); +return ; + } + +spin_lock_irqsave (&priv->reglock, flags); + +writel (DDR_UE_MASK |DDR_CE_MASK , + priv->baseaddr +ECC_CLR_OFST ); + +spin_unlock_irqrestore (&priv->reglock, flags); }static void disable_intr (struct synps_edac_priv *priv) { +unsigned long flags; +/* Disable UE/CE Interrupts */ -if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) -writel (0x0 , priv->baseaddr +ECC_CLR_OFST ); -else +if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR )) {writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , priv->baseaddr +DDR_QOS_IRQ_DB_OFST ); + +return ; + } + +spin_lock_irqsave (&priv->reglock, flags); + +writel (0 , priv->baseaddr +ECC_CLR_OFST ); + +spin_unlock_irqrestore (&priv->reglock, flags); }/**
@@ -576,8 +601,6 @@ static irqreturn_t intr_handler(int irq, void *dev_id)/* v3.0 of the controller does not have this register */ if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ))writel (regval, priv->baseaddr +DDR_QOS_IRQ_STAT_OFST ); -else -enable_intr (priv);return IRQ_HANDLED ; }
@@ -1359,6 +1382,7 @@ static int mc_probe(struct platform_device *pdev) priv = mci->pvt_info; priv->baseaddr = baseaddr; priv->p_data = p_data; +spin_lock_init (&priv->reglock);mc_init (mci, pdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/538 EDAC/synopsys: Fix error injection on Zynq UltraScale+
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubhrajyoti Datta <[email protected]>
[ Upstream commit 35e6dbfe1846caeafabb49b7575adb36b0aa2269 ]
The Zynq UltraScale+ MPSoC DDR has a disjoint memory from 2GB to 32GB. The DDR host interface has a contiguous memory so while injecting errors, the driver should remove the hole else the injection fails as the address translation is incorrect.
Introduce a get_mem_info() function pointer and set it for Zynq UltraScale+ platform to return host address.
--- drivers/edac/synopsys_edac.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-)
drivers/edac/synopsys_edac.c +34 -1
@@ -10,6 +10,7 @@#include <linux/module.h> #include <linux/platform_device.h> #include <linux/spinlock.h> +#include <linux/sizes.h> #include <linux/interrupt.h> #include <linux/of.h>
@@ -337,6 +338,7 @@ struct synps_edac_priv {* @get_mtype: Get mtype. * @get_dtype: Get dtype. * @get_ecc_state: Get ECC state. +* @get_mem_info: Get EDAC memory info * @quirks: To differentiate IPs. */ struct synps_platform_data {
@@ -344,6 +346,9 @@ struct synps_platform_data {enum mem_type (*get_mtype)(const void __iomem *base);enum dev_type (*get_dtype)(const void __iomem *base);bool (*get_ecc_state)(void __iomem *base); +#ifdef CONFIG_EDAC_DEBUG +u64 (*get_mem_info)(struct synps_edac_priv *priv); +#endif int quirks; };
@@ -402,6 +407,25 @@ static int zynq_get_error_info(struct synps_edac_priv *priv)return 0 ; } +#ifdef CONFIG_EDAC_DEBUG +/** +* zynqmp_get_mem_info - Get the current memory info. +* @priv: DDR memory controller private instance data. +* +* Return: host interface address. +*/ +static u64 zynqmp_get_mem_info (struct synps_edac_priv *priv) +{ +u64 hif_addr =0 , linear_addr; + + linear_addr = priv->poison_addr; +if (linear_addr >=SZ_32G ) + linear_addr = linear_addr -SZ_32G +SZ_2G ; + hif_addr = linear_addr >>3 ; +return hif_addr; +} +#endif +/** * zynqmp_get_error_info - Get the current ECC error info. * @priv: DDR memory controller private instance data.
@@ -922,6 +946,9 @@ static const struct synps_platform_data zynqmp_edac_def = { .get_mtype = zynqmp_get_mtype, .get_dtype = zynqmp_get_dtype, .get_ecc_state = zynqmp_get_ecc_state, +#ifdef CONFIG_EDAC_DEBUG + .get_mem_info = zynqmp_get_mem_info, +#endif .quirks = (DDR_ECC_INTR_SUPPORT #ifdef CONFIG_EDAC_DEBUG | DDR_ECC_DATA_POISON_SUPPORT
@@ -975,10 +1002,16 @@ MODULE_DEVICE_TABLE(of, synps_edac_match);static void ddr_poison_setup (struct synps_edac_priv *priv) {int col =0 , row =0 , bank =0 , bankgrp =0 , rank =0 , regval; +const struct synps_platform_data *p_data;int index;ulong hif_addr =0 ; - hif_addr = priv->poison_addr >>3 ; + p_data = priv->p_data; + +if (p_data->get_mem_info) + hif_addr = p_data->get_mem_info (priv); +else + hif_addr = priv->poison_addr >>3 ;for (index =0 ; index <DDR_MAX_ROW_SHIFT ; index++) {if (priv->row_shift[index])
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/538 wifi: rtw88: always wait for both firmware loading attempts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d ]
In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.
--- drivers/net/wireless/realtek/rtw88/main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/realtek/rtw88/main.c +4 -3
@@ -1314,20 +1314,21 @@ static int rtw_wait_firmware_completion(struct rtw_dev *rtwdev) {const struct rtw_chip_info *chip = rtwdev->chip;struct rtw_fw_state *fw; +int ret =0 ; fw = &rtwdev->fw;wait_for_completion (&fw->completion);if (!fw->firmware) -return -EINVAL ; + ret = -EINVAL ;if (chip->wow_fw_name) { fw = &rtwdev->wow_fw;wait_for_completion (&fw->completion);if (!fw->firmware) -return -EINVAL ; + ret = -EINVAL ; } -return 0 ; +return ret; } static enum rtw_lps_deep_mode rtw_update_lps_deep_mode(struct rtw_dev *rtwdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/538 crypto: xor - fix template benchmarking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit ab9a244c396aae4aaa34b2399b82fc15ec2df8c1 ]
Commit c055e3eae0f1 ("crypto: xor - use ktime for template benchmarking") switched from using jiffies to ktime-based performance benchmarking.
This works nicely on machines which have a fine-grained ktime() clocksource as e.g. x86 machines with TSC.
But other machines, e.g. my 4-way HP PARISC server, don't have such fine-grained clocksources, which is why it seems that 800 xor loops take zero seconds, which then shows up in the logs as:
xor: measuring software checksum speed
8regs : -1018167296 MB/sec
8regs_prefetch : -1018167296 MB/sec
32regs : -1018167296 MB/sec
32regs_prefetch : -1018167296 MB/secFix this with some small modifications to the existing code to improve the algorithm to always produce correct results without introducing major delays for architectures with a fine-grained ktime() clocksource:
a) Delay start of the timing until ktime() just advanced. On machines with a fast ktime() this should be just one additional ktime() call.
b) Count the number of loops. Run at minimum 800 loops and finish earliest when the ktime() counter has progressed.
With that the throughput can now be calculated more accurately under all conditions.
v2:
- clean up coding style (noticed & suggested by Herbert Xu)
- rephrased & fixed typo in commit message
--- crypto/xor.c | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-)
crypto/xor.c +14 -17
@@ -83,33 +83,30 @@ static void __init do_xor_speed(struct xor_block_template *tmpl, void *b1, void *b2) { int speed; -int i, j; -ktime_t min, start, diff; +unsigned long reps; +ktime_t min, start, t0; tmpl->next = template_list; template_list = tmpl;preempt_disable (); - min = (ktime_t )S64_MAX ; -for (i =0 ; i <3 ; i++) { - start =ktime_get (); -for (j =0 ; j <REPS ; j++) { -mb ();/* prevent loop optimization */ - tmpl->do_2 (BENCH_SIZE , b1, b2); -mb (); - } - diff =ktime_sub (ktime_get (), start); -if (diff < min) - min = diff; - } + reps =0 ; + t0 =ktime_get (); +/* delay start until time has advanced */ +while ((start =ktime_get ()) == t0) +cpu_relax (); +do { +mb ();/* prevent loop optimization */ + tmpl->do_2 (BENCH_SIZE , b1, b2); +mb (); + }while (reps++ <REPS || (t0 =ktime_get ()) == start); + min =ktime_sub (t0, start);preempt_enable ();// bytes/ns == GB/s, multiply by 1000 to get MB/s [not MiB/s] -if (!min) - min =1 ; - speed = (1000 *REPS *BENCH_SIZE ) / (unsigned int )ktime_to_ns (min); + speed = (1000 * reps *BENCH_SIZE ) / (unsigned int )ktime_to_ns (min); tmpl->speed = speed;pr_info (" %-16s: %5d MB/sec\n" , tmpl->name, speed);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/538 ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 07442c46abad1d50ac82af5e0f9c5de2732c4592 ]
In tps68470_pmic_opregion_probe() pointer 'dev' is compared to NULL which is useless.
Fix this issue by removing unneeded check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/pmic/tps68470_pmic.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/acpi/pmic/tps68470_pmic.c +2 -4
@@ -376,10 +376,8 @@ static int tps68470_pmic_opregion_probe(struct platform_device *pdev)struct tps68470_pmic_opregion *opregion;acpi_status status; -if (!dev || !tps68470_regmap) { -dev_warn (dev,"dev or regmap is NULL\n" ); -return -EINVAL ; - } +if (!tps68470_regmap) +return dev_err_probe (dev, -EINVAL ,"regmap is missing\n" );if (!handle) {dev_warn (dev,"acpi handle is NULL\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/538 wifi: brcmfmac: export firmware interface functions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arend van Spriel <[email protected]>
[ Upstream commit 31343230abb1683e8afb254e6b13a7a7fd01fcac ]
With multi-vendor support the vendor-specific module may need to use the firmware interface functions so export them using the macro BRCMF_EXPORT_SYMBOL_GPL() which exports them to driver namespace.
Stable-dep-of: c6002b6c05f3 ("wifi: brcmfmac: introducing fwil query functions")
--- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 4 +- .../broadcom/brcm80211/brcmfmac/core.c | 2 +- .../broadcom/brcm80211/brcmfmac/feature.c | 2 +- .../broadcom/brcm80211/brcmfmac/fwil.c | 115 +--------------- .../broadcom/brcm80211/brcmfmac/fwil.h | 127 +++++++++++++++--- 5 files changed, 121 insertions(+), 129 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +2 -2
@@ -3067,7 +3067,7 @@ brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,struct brcmf_scb_val_le scbval;struct brcmf_pktcnt_le pktcnt;s32 err; -u32 rate; +u32 rate =0 ;u32 rssi;/* Get the current tx rate */
@@ -7269,7 +7269,7 @@ static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)u32 nmode =0 ;u32 vhtmode =0 ;u32 bw_cap[2 ] = {WLC_BW_20MHZ_BIT ,WLC_BW_20MHZ_BIT }; -u32 rxchain; +u32 rxchain =0 ;u32 nchain;int err;s32 i;
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +1 -1
@@ -691,7 +691,7 @@ static int brcmf_net_mon_open(struct net_device *ndev) {struct brcmf_if *ifp =netdev_priv (ndev);struct brcmf_pub *drvr = ifp->drvr; -u32 monitor; +u32 monitor =0 ;int err;brcmf_dbg (TRACE ,"Enter\n" );
drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c +1 -1
@@ -184,7 +184,7 @@ static void brcmf_feat_wlc_version_overrides(struct brcmf_pub *drv)static void brcmf_feat_iovar_int_get (struct brcmf_if *ifp,enum brcmf_feat_id id,char *name) { -u32 data; +u32 data =0 ;int err;/* we need to know firmware error */
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c +7 -108
155 lines not on this page · raw message
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h +110 -17
139 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/538 wifi: brcmfmac: introducing fwil query functions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arend van Spriel <[email protected]>
[ Upstream commit c6002b6c05f3edfa12fd25990cc637281f200442 ]
When the firmware interface layer was refactored it provided various "get" and "set" functions. For the "get" in some cases a parameter needed to be passed down to firmware as a key indicating what to "get" turning the output parameter of the "get" function into an input parameter as well. To accommodate this the "get" function blindly copies the parameter which in some places resulted in an uninitialized warnings from the compiler. These have been fixed by initializing the input parameter in the past. Recently another batch of similar fixes were submitted to address clang static checker warnings [1].
Proposing another solution by introducing a "query" variant which is used when the (input) parameter is needed by firmware. The "get" variant will only fill the (output) parameter with the result received from firmware taking care of proper endianess conversion.
[1] https://lore.kernel.org/all/[email protected]/
--- .../broadcom/brcm80211/brcmfmac/btcoex.c | 2 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 30 +++++++------- .../broadcom/brcm80211/brcmfmac/core.c | 2 +- .../broadcom/brcm80211/brcmfmac/feature.c | 2 +- .../broadcom/brcm80211/brcmfmac/fwil.h | 40 ++++++++++++++----- 5 files changed, 48 insertions(+), 28 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c +1 -1
@@ -123,7 +123,7 @@ static s32 brcmf_btcoex_params_read(struct brcmf_if *ifp, u32 addr, u32 *data) { *data = addr; -return brcmf_fil_iovar_int_get (ifp,"btc_params" , data); +return brcmf_fil_iovar_int_query (ifp,"btc_params" , data); }/**
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +15 -15
@@ -663,8 +663,8 @@ static int brcmf_cfg80211_request_sta_if(struct brcmf_if *ifp, u8 *macaddr)/* interface_create version 3+ */ /* get supported version from firmware side */ iface_create_ver =0 ; - err =brcmf_fil_bsscfg_int_get (ifp,"interface_create" , - &iface_create_ver); + err =brcmf_fil_bsscfg_int_query (ifp,"interface_create" , + &iface_create_ver);if (err) {brcmf_err ("fail to get supported version, err=%d\n" , err);return -EOPNOTSUPP ;
@@ -756,8 +756,8 @@ static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)/* interface_create version 3+ */ /* get supported version from firmware side */ iface_create_ver =0 ; - err =brcmf_fil_bsscfg_int_get (ifp,"interface_create" , - &iface_create_ver); + err =brcmf_fil_bsscfg_int_query (ifp,"interface_create" , + &iface_create_ver);if (err) {brcmf_err ("fail to get supported version, err=%d\n" , err);return -EOPNOTSUPP ;
@@ -2101,7 +2101,8 @@ brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)if (!sme->crypto.n_akm_suites)return 0 ; - err =brcmf_fil_bsscfg_int_get (netdev_priv (ndev),"wpa_auth" , &val); + err =brcmf_fil_bsscfg_int_get (netdev_priv (ndev), +"wpa_auth" , &val);if (err) {bphy_err (drvr,"could not get wpa_auth (%d)\n" , err);return err;
@@ -2680,7 +2681,7 @@ brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,struct brcmf_cfg80211_info *cfg =wiphy_to_cfg (wiphy);struct brcmf_cfg80211_vif *vif =wdev_to_vif (wdev);struct brcmf_pub *drvr = cfg->pub; -s32 qdbm =0 ; +s32 qdbm;s32 err;brcmf_dbg (TRACE ,"Enter\n" );
@@ -3067,7 +3068,7 @@ brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,struct brcmf_scb_val_le scbval;struct brcmf_pktcnt_le pktcnt;s32 err; -u32 rate =0 ; +u32 rate;u32 rssi;/* Get the current tx rate */
@@ -7046,8 +7047,8 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg, ch.bw =BRCMU_CHAN_BW_20 ; cfg->d11inf.encchspec (&ch); chaninfo = ch.chspec; - err =brcmf_fil_bsscfg_int_get (ifp,"per_chan_info" , - &chaninfo); + err =brcmf_fil_bsscfg_int_query (ifp,"per_chan_info" , + &chaninfo);if (!err) {if (chaninfo &WL_CHAN_RADAR ) channel->flags |=
@@ -7081,7 +7082,7 @@ static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)/* verify support for bw_cap command */ val =WLC_BAND_5G ; - err =brcmf_fil_iovar_int_get (ifp,"bw_cap" , &val); + err =brcmf_fil_iovar_int_query (ifp,"bw_cap" , &val);if (!err) {/* only set 2G bandwidth using bw_cap command */
@@ -7157,11 +7158,11 @@ static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])int err; band =WLC_BAND_2G ; - err =brcmf_fil_iovar_int_get (ifp,"bw_cap" , &band); + err =brcmf_fil_iovar_int_query (ifp,"bw_cap" , &band);if (!err) { bw_cap[NL80211_BAND_2GHZ ] = band; band =WLC_BAND_5G ; - err =brcmf_fil_iovar_int_get (ifp,"bw_cap" , &band); + err =brcmf_fil_iovar_int_query (ifp,"bw_cap" , &band);if (!err) { bw_cap[NL80211_BAND_5GHZ ] = band;return ;
@@ -7170,7 +7171,6 @@ static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])return ; }brcmf_dbg (INFO ,"fallback to mimo_bw_cap info\n" ); - mimo_bwcap =0 ; err =brcmf_fil_iovar_int_get (ifp,"mimo_bw_cap" , &mimo_bwcap);if (err)/* assume 20MHz if firmware does not give a clue */
@@ -7266,10 +7266,10 @@ static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)struct brcmf_pub *drvr = cfg->pub;struct brcmf_if *ifp =brcmf_get_ifp (drvr,0 );struct wiphy *wiphy =cfg_to_wiphy (cfg); -u32 nmode =0 ; +u32 nmode;u32 vhtmode =0 ;u32 bw_cap[2 ] = {WLC_BW_20MHZ_BIT ,WLC_BW_20MHZ_BIT }; -u32 rxchain =0 ; +u32 rxchain;u32 nchain;int err;s32 i;
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +1 -1
@@ -691,7 +691,7 @@ static int brcmf_net_mon_open(struct net_device *ndev) {struct brcmf_if *ifp =netdev_priv (ndev);struct brcmf_pub *drvr = ifp->drvr; -u32 monitor =0 ; +u32 monitor;int err;brcmf_dbg (TRACE ,"Enter\n" );
drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c +1 -1
@@ -184,7 +184,7 @@ static void brcmf_feat_wlc_version_overrides(struct brcmf_pub *drv)static void brcmf_feat_iovar_int_get (struct brcmf_if *ifp,enum brcmf_feat_id id,char *name) { -u32 data =0 ; +u32 data;int err;/* we need to know firmware error */
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h +30 -10
@@ -96,15 +96,22 @@ static inlines32 brcmf_fil_cmd_int_get (struct brcmf_if *ifp,u32 cmd,u32 *data) {s32 err; -__le32 data_le =cpu_to_le32 (*data); - err =brcmf_fil_cmd_data_get (ifp, cmd, &data_le,sizeof (data_le)); + err =brcmf_fil_cmd_data_get (ifp, cmd, data,sizeof (*data));if (err ==0 ) - *data =le32_to_cpu (data_le); + *data =le32_to_cpu (*(__le32 *)data);brcmf_dbg (FIL ,"ifidx=%d, cmd=%d, value=%d\n" , ifp->ifidx, cmd, *data);return err; } +static inline +s32 brcmf_fil_cmd_int_query (struct brcmf_if *ifp,u32 cmd,u32 *data) +{ +__le32 *data_le = (__le32 *)data; + + *data_le =cpu_to_le32 (*data); +return brcmf_fil_cmd_int_get (ifp, cmd, data); +}s32 brcmf_fil_iovar_data_set (struct brcmf_if *ifp,const char *name,const void *data,u32 len);
@@ -120,14 +127,21 @@ s32 brcmf_fil_iovar_int_set(struct brcmf_if *ifp, const char *name, u32 data)static inline s32 brcmf_fil_iovar_int_get (struct brcmf_if *ifp,const char *name,u32 *data) { -__le32 data_le =cpu_to_le32 (*data);s32 err; - err =brcmf_fil_iovar_data_get (ifp, name, &data_le,sizeof (data_le)); + err =brcmf_fil_iovar_data_get (ifp, name, data,sizeof (*data));if (err ==0 ) - *data =le32_to_cpu (data_le); + *data =le32_to_cpu (*(__le32 *)data);return err; } +static inline +s32 brcmf_fil_iovar_int_query (struct brcmf_if *ifp,const char *name,u32 *data) +{ +__le32 *data_le = (__le32 *)data; + + *data_le =cpu_to_le32 (*data); +return brcmf_fil_iovar_int_get (ifp, name, data); +} s32 brcmf_fil_bsscfg_data_set(struct brcmf_if *ifp, const char *name,
@@ -145,15 +159,21 @@ s32 brcmf_fil_bsscfg_int_set(struct brcmf_if *ifp, const char *name, u32 data)static inline s32 brcmf_fil_bsscfg_int_get (struct brcmf_if *ifp,const char *name,u32 *data) { -__le32 data_le =cpu_to_le32 (*data);s32 err; - err =brcmf_fil_bsscfg_data_get (ifp, name, &data_le, -sizeof (data_le)); + err =brcmf_fil_bsscfg_data_get (ifp, name, data,sizeof (*data));if (err ==0 ) - *data =le32_to_cpu (data_le); + *data =le32_to_cpu (*(__le32 *)data);return err; } +static inline +s32 brcmf_fil_bsscfg_int_query (struct brcmf_if *ifp,const char *name,u32 *data) +{ +__le32 *data_le = (__le32 *)data; + + *data_le =cpu_to_le32 (*data); +return brcmf_fil_bsscfg_int_get (ifp, name, data); +}s32 brcmf_fil_xtlv_data_set (struct brcmf_if *ifp,const char *name,u16 id,void *data,u32 len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/538 wifi: ath9k: Remove error checks when creating debugfs entries
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit f6ffe7f0184792c2f99aca6ae5b916683973d7d3 ]
We should not be checking the return values from debugfs creation at all: the debugfs functions are designed to handle errors of previously called functions and just transparently abort the creation of debugfs entries when debugfs is disabled. If we check the return value and abort driver initialisation, we break the driver if debugfs is disabled (such as when booting with debugfs=off).
Earlier versions of ath9k accidentally did the right thing by checking the return value, but only for NULL, not for IS_ERR(). This was "fixed" by the two commits referenced below, breaking ath9k with debugfs=off starting from the 6.6 kernel (as reported in the Bugzilla linked below).
Restore functionality by just getting rid of the return value check entirely.
--- drivers/net/wireless/ath/ath9k/debug.c | 2 -- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 -- 2 files changed, 4 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +0 -2
@@ -1380,8 +1380,6 @@ int ath9k_init_debug(struct ath_hw *ah) sc->debug.debugfs_phy =debugfs_create_dir ("ath9k" , sc->hw->wiphy->debugfsdir); -if (IS_ERR (sc->debug.debugfs_phy)) -return -ENOMEM ;#ifdef CONFIG_ATH_DEBUG debugfs_create_file("debug", 0600, sc->debug.debugfs_phy,
drivers/net/wireless/ath/ath9k/htc_drv_debug.c +0 -2
@@ -486,8 +486,6 @@ int ath9k_htc_init_debug(struct ath_hw *ah) priv->debug.debugfs_phy =debugfs_create_dir (KBUILD_MODNAME , priv->hw->wiphy->debugfsdir); -if (IS_ERR (priv->debug.debugfs_phy)) -return -ENOMEM ;ath9k_cmn_spectral_init_debug (&priv->spec_priv, priv->debug.debugfs_phy);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/538 wifi: ath12k: fix BSS chan info request WMI command
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: P Praneesh <[email protected]>
[ Upstream commit 59529c982f85047650fd473db903b23006a796c6 ]
Currently, the firmware returns incorrect pdev_id information in WMI_PDEV_BSS_CHAN_INFO_EVENTID, leading to incorrect filling of the pdev's survey information.
To prevent this issue, when requesting BSS channel information through WMI_PDEV_BSS_CHAN_INFO_REQUEST_CMDID, firmware expects pdev_id as one of the arguments in this WMI command.
Add pdev_id to the struct wmi_pdev_bss_chan_info_req_cmd and fill it during ath12k_wmi_pdev_bss_chan_info_request(). This resolves the issue of sending the correct pdev_id in WMI_PDEV_BSS_CHAN_INFO_EVENTID.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/wmi.c | 1 + drivers/net/wireless/ath/ath12k/wmi.h | 1 + 2 files changed, 2 insertions(+)
drivers/net/wireless/ath/ath12k/wmi.c +1 -0
@@ -1501,6 +1501,7 @@ int ath12k_wmi_pdev_bss_chan_info_request(struct ath12k *ar, cmd->tlv_header =ath12k_wmi_tlv_cmd_hdr (WMI_TAG_PDEV_BSS_CHAN_INFO_REQUEST ,sizeof (*cmd)); cmd->req_type =cpu_to_le32 (type); + cmd->pdev_id =cpu_to_le32 (ar->pdev->pdev_id);ath12k_dbg (ar->ab,ATH12K_DBG_WMI ,"WMI bss chan info req type %d\n" , type);
drivers/net/wireless/ath/ath12k/wmi.h +1 -0
@@ -3058,6 +3058,7 @@ struct wmi_pdev_bss_chan_info_req_cmd {__le32 tlv_header;/* ref wmi_bss_chan_info_req_type */ __le32 req_type; +__le32 pdev_id; } __packed;struct wmi_ap_ps_peer_cmd {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/538 wifi: ath12k: match WMI BSS chan info structure with firmware definition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: P Praneesh <[email protected]>
[ Upstream commit dd98d54db29fb553839f43ade5f547baa93392c8 ]
struct wmi_pdev_bss_chan_info_event is not similar to the firmware struct definition, this will cause some random failures.
Fix by matching the struct wmi_pdev_bss_chan_info_event with the firmware structure definition.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/wmi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/wmi.h +1 -1
@@ -4034,7 +4034,6 @@ struct wmi_vdev_stopped_event { } __packed;struct wmi_pdev_bss_chan_info_event { -__le32 pdev_id;__le32 freq;/* Units in MHz */ __le32 noise_floor;/* units are dBm */ /* rx clear - how often the channel was unused */
@@ -4052,6 +4051,7 @@ struct wmi_pdev_bss_chan_info_event {/*rx_cycle cnt for my bss in 64bits format */ __le32 rx_bss_cycle_count_low;__le32 rx_bss_cycle_count_high; +__le32 pdev_id; } __packed;#define WMI_VDEV_INSTALL_KEY_COMPL_STATUS_SUCCESS 0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/538 wifi: ath12k: fix invalid AMPDU factor calculation in ath12k_peer_assoc_h_he()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit a66de2d0f22b1740f3f9777776ad98c4bee62dff ]
Currently ampdu_factor is wrongly calculated in ath12k_peer_assoc_h_he(), fix it.
This is found during code review.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4
--- drivers/net/wireless/ath/ath12k/mac.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath12k/mac.c +2 -3
@@ -1681,9 +1681,8 @@ static void ath12k_peer_assoc_h_he(struct ath12k *ar,* request, then use MAX_AMPDU_LEN_FACTOR as 16 to calculate max_ampdu * length. */ - ampdu_factor = (he_cap->he_cap_elem.mac_cap_info[3 ] & -IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK ) >> -IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK ; + ampdu_factor =u8_get_bits (he_cap->he_cap_elem.mac_cap_info[3 ], +IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK );if (ampdu_factor) {if (sta->deflink.vht_cap.vht_supported)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/538 net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanteng Si <[email protected]>
[ Upstream commit c70f3163681381c15686bdd2fe56bf4af9b8aaaa ]
Reference and PTP clocks rate of the Loongson GMAC devices is 125MHz. (So is in the GNET devices which support is about to be added.) Set the respective plat_stmmacenet_data field up in accordance with that so to have the coalesce command and timestamping work correctly.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +3 -0
@@ -35,6 +35,9 @@ static int loongson_default_data(struct plat_stmmacenet_data *plat)/* Disable RX queues routing by default */ plat->rx_queues_cfg[0 ].pkt_route =0x0 ; + plat->clk_ref_rate =125000000 ; + plat->clk_ptp_rate =125000000 ; +/* Default to phy auto-detection */ plat->phy_addr =-1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/538 arm64: signal: Fix some under-bracketed UAPI macros
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Martin <[email protected]>
[ Upstream commit fc2220c9b15828319b09384e68399b4afc6276d9 ]
A few SME-related sigcontext UAPI macros leave an argument unprotected from misparsing during macro expansion.
Add parentheses around references to macro arguments where appropriate.
--- arch/arm64/include/uapi/asm/sigcontext.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/include/uapi/asm/sigcontext.h +3 -3
@@ -312,10 +312,10 @@ struct zt_context { ((sizeof (struct za_context ) + (__SVE_VQ_BYTES -1 )) \ / __SVE_VQ_BYTES * __SVE_VQ_BYTES) -#define ZA_SIG_REGS_SIZE (vq) ((vq * __SVE_VQ_BYTES) * (vq * __SVE_VQ_BYTES)) +#define ZA_SIG_REGS_SIZE (vq) (((vq) * __SVE_VQ_BYTES) * ((vq) * __SVE_VQ_BYTES))#define ZA_SIG_ZAV_OFFSET (vq, n) (ZA_SIG_REGS_OFFSET + \ - (SVE_SIG_ZREG_SIZE(vq) * n)) + (SVE_SIG_ZREG_SIZE(vq) * (n)))#define ZA_SIG_CONTEXT_SIZE (vq) \ (ZA_SIG_REGS_OFFSET + ZA_SIG_REGS_SIZE(vq))
@@ -326,7 +326,7 @@ struct zt_context {#define ZT_SIG_REGS_OFFSET sizeof(struct zt_context) -#define ZT_SIG_REGS_SIZE (n) (ZT_SIG_REG_BYTES * n) +#define ZT_SIG_REGS_SIZE (n) (ZT_SIG_REG_BYTES * (n))#define ZT_SIG_CONTEXT_SIZE (n) \ (sizeof(struct zt_context) + ZT_SIG_REGS_SIZE(n))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/538 wifi: rtw88: remove CPT execution branch never used
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
[ Upstream commit 77c977327dfaa9ae2e154964cdb89ceb5c7b7cf1 ]
In 'rtw_coex_action_bt_a2dp_pan', 'wl_cpt_test' and 'bt_cpt_test' are hardcoded to false, so corresponding 'table_case' and 'tdma_case' assignments are never met.
Also 'rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[1])' is never executed. Assuming that CPT was never fully implemented, remove lookalike leftovers. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/realtek/rtw88/coex.c | 38 ++++++----------------- 1 file changed, 10 insertions(+), 28 deletions(-)
drivers/net/wireless/realtek/rtw88/coex.c +10 -28
@@ -2194,7 +2194,6 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)struct rtw_coex_stat *coex_stat = &coex->stat;struct rtw_efuse *efuse = &rtwdev->efuse;u8 table_case, tdma_case; -bool wl_cpt_test = false, bt_cpt_test = false;rtw_dbg (rtwdev,RTW_DBG_COEX ,"[BTCoex], %s()\n" , __func__);
@@ -2202,29 +2201,16 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]);if (efuse->share_ant) {/* Shared-Ant */ -if (wl_cpt_test) { -if (coex_stat->wl_gl_busy) { - table_case =20 ; - tdma_case =17 ; - }else { - table_case =10 ; - tdma_case =15 ; - } - }else if (bt_cpt_test) { - table_case =26 ; - tdma_case =26 ; - }else { -if (coex_stat->wl_gl_busy && - coex_stat->wl_noisy_level ==0 ) - table_case =14 ; -else - table_case =10 ; +if (coex_stat->wl_gl_busy && + coex_stat->wl_noisy_level ==0 ) + table_case =14 ; +else + table_case =10 ; -if (coex_stat->wl_gl_busy) - tdma_case =15 ; -else - tdma_case =20 ; - } +if (coex_stat->wl_gl_busy) + tdma_case =15 ; +else + tdma_case =20 ; }else {/* Non-Shared-Ant */ table_case =112 ;
@@ -2235,11 +2221,7 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev) tdma_case =120 ; } -if (wl_cpt_test) -rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[1 ]); -else -rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]); - +rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]);rtw_coex_table (rtwdev, false, table_case);rtw_coex_tdma (rtwdev, false, tdma_case); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/538 RISC-V: KVM: Fix sbiret init before forwarding to userspace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Jones <[email protected]>
[ Upstream commit 6b7b282e6baea06ba65b55ae7d38326ceb79cebf ]
When forwarding SBI calls to userspace ensure sbiret.error is initialized to SBI_ERR_NOT_SUPPORTED first, in case userspace neglects to set it to anything. If userspace neglects it then we can't be sure it did anything else either, so we just report it didn't do or try anything. Just init sbiret.value to zero, which is the preferred value to return when nothing special is specified.
KVM was already initializing both sbiret.error and sbiret.value, but the values used appear to come from a copy+paste of the __sbi_ecall() implementation, i.e. a0 and a1, which don't apply prior to the call being executed, nor at all when forwarding to userspace.
--- arch/riscv/kvm/vcpu_sbi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/kvm/vcpu_sbi.c +2 -2
@@ -91,8 +91,8 @@ void kvm_riscv_vcpu_sbi_forward(struct kvm_vcpu *vcpu, struct kvm_run *run) run->riscv_sbi.args[3 ] = cp->a3; run->riscv_sbi.args[4 ] = cp->a4; run->riscv_sbi.args[5 ] = cp->a5; - run->riscv_sbi.ret[0 ] = cp->a0; - run->riscv_sbi.ret[1 ] = cp->a1; + run->riscv_sbi.ret[0 ] =SBI_ERR_NOT_SUPPORTED ; + run->riscv_sbi.ret[1 ] =0 ; } void kvm_riscv_vcpu_sbi_system_reset(struct kvm_vcpu *vcpu,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/538 RISC-V: KVM: Allow legacy PMU access from guest
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <[email protected]>
[ Upstream commit 7d1ffc8b087e97dbe1985912c7a2d00e53cea169 ]
Currently, KVM traps & emulates PMU counter access only if SBI PMU is available as the guest can only configure/read PMU counters via SBI only. However, if SBI PMU is not enabled in the host, the guest will fallback to the legacy PMU which will try to access cycle/instret and result in an illegal instruction trap which is not desired.
KVM can allow dummy emulation of cycle/instret only for the guest if SBI PMU is not enabled in the host. The dummy emulation will still return zero as we don't to expose the host counter values from a guest using legacy PMU.
--- arch/riscv/include/asm/kvm_vcpu_pmu.h | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
arch/riscv/include/asm/kvm_vcpu_pmu.h +14 -1
@@ -10,6 +10,7 @@#define __KVM_VCPU_RISCV_PMU_H#include <linux/perf/riscv_pmu.h> +#include <asm/kvm_vcpu_insn.h> #include <asm/sbi.h> #ifdef CONFIG_RISCV_PMU_SBI
@@ -92,8 +93,20 @@ void kvm_riscv_vcpu_pmu_reset(struct kvm_vcpu *vcpu);struct kvm_pmu { }; +static inline int kvm_riscv_vcpu_pmu_read_legacy (struct kvm_vcpu *vcpu,unsigned int csr_num, +unsigned long *val,unsigned long new_val, +unsigned long wr_mask) +{ +if (csr_num ==CSR_CYCLE || csr_num ==CSR_INSTRET ) { + *val =0 ; +return KVM_INSN_CONTINUE_NEXT_SEPC ; + }else { +return KVM_INSN_ILLEGAL_TRAP ; + } +} +#define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \ -{.base = 0, .count = 0, .func = NULL }, +{.base = CSR_CYCLE, .count = 3, .func = kvm_riscv_vcpu_pmu_read_legacy },static inline void kvm_riscv_vcpu_pmu_init (struct kvm_vcpu *vcpu) {}static inline int kvm_riscv_vcpu_pmu_incr_fw (struct kvm_vcpu *vcpu,unsigned long fid)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/538 RISC-V: KVM: Fix to allow hpmcounter31 from the guest
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <[email protected]>
[ Upstream commit 5aa09297a3dcc798d038bd7436f8c90f664045a6 ]
The csr_fun defines a count parameter which defines the total number CSRs emulated in KVM starting from the base. This value should be equal to total number of counters possible for trap/emulation (32).
--- arch/riscv/include/asm/kvm_vcpu_pmu.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/riscv/include/asm/kvm_vcpu_pmu.h +3 -3
@@ -58,11 +58,11 @@ struct kvm_pmu {#if defined(CONFIG_32BIT )#define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \ -{.base = CSR_CYCLEH, .count = 31, .func = kvm_riscv_vcpu_pmu_read_hpm }, \ -{.base = CSR_CYCLE, .count = 31, .func = kvm_riscv_vcpu_pmu_read_hpm }, +{.base = CSR_CYCLEH, .count = 32, .func = kvm_riscv_vcpu_pmu_read_hpm }, \ +{.base = CSR_CYCLE, .count = 32, .func = kvm_riscv_vcpu_pmu_read_hpm },#else #define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \ -{.base = CSR_CYCLE, .count = 31, .func = kvm_riscv_vcpu_pmu_read_hpm }, +{.base = CSR_CYCLE, .count = 32, .func = kvm_riscv_vcpu_pmu_read_hpm },#endif int kvm_riscv_vcpu_pmu_incr_fw (struct kvm_vcpu *vcpu,unsigned long fid);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/538 mount: handle OOM on mnt_warn_timestamp_expiry
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olaf Hering <[email protected]>
[ Upstream commit 4bcda1eaf184e308f07f9c61d3a535f9ce477ce8 ]
If no page could be allocated, an error pointer was used as format string in pr_warn.
Rearrange the code to return early in case of OOM. Also add a check for the return value of d_path.
--- fs/namespace.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/namespace.c +11 -3
@@ -2796,8 +2796,15 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *if (!__mnt_is_readonly (mnt) && (!(sb->s_iflags &SB_I_TS_EXPIRY_WARNED )) && (ktime_get_real_seconds () +TIME_UPTIME_SEC_MAX > sb->s_time_max)) { -char *buf = (char *)__get_free_page (GFP_KERNEL ); -char *mntpath = buf ?d_path (mountpoint, buf,PAGE_SIZE ) :ERR_PTR (-ENOMEM ); +char *buf, *mntpath; + + buf = (char *)__get_free_page (GFP_KERNEL ); +if (buf) + mntpath =d_path (mountpoint, buf,PAGE_SIZE ); +else + mntpath =ERR_PTR (-ENOMEM ); +if (IS_ERR (mntpath)) + mntpath ="(unknown)" ; pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n", sb->s_type->name,
@@ -2805,8 +2812,9 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount * mntpath, &sb->s_time_max, (unsigned long long)sb->s_time_max); -free_page ((unsigned long )buf); sb->s_iflags |=SB_I_TS_EXPIRY_WARNED ; +if (buf) +free_page ((unsigned long )buf); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/538 ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Calvin Owens <[email protected]>
[ Upstream commit 89a906dfa8c3b21b3e5360f73c49234ac1eb885b ]
Floating point instructions in userspace can crash some arm kernels built with clang/LLD 17.0.6:
BUG: unsupported FP instruction in kernel mode
FPEXC == 0xc0000780
Internal error: Oops - undefined instruction: 0 [#1] ARM
CPU: 0 PID: 196 Comm: vfp-reproducer Not tainted 6.10.0 #1
Hardware name: BCM2835
PC is at vfp_support_entry+0xc8/0x2cc
LR is at do_undefinstr+0xa8/0x250
pc : [<c0101d50>] lr : [<c010a80c>] psr: a0000013
sp : dc8d1f68 ip : 60000013 fp : bedea19c
r10: ec532b17 r9 : 00000010 r8 : 0044766c
r7 : c0000780 r6 : ec532b17 r5 : c1c13800 r4 : dc8d1fb0
r3 : c10072c4 r2 : c0101c88 r1 : ec532b17 r0 : 0044766c
Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 00c5387d Table: 0251c008 DAC: 00000051
Register r0 information: non-paged memory
Register r1 information: vmalloc memory
Register r2 information: non-slab/vmalloc memory
Register r3 information: non-slab/vmalloc memory
Register r4 information: 2-page vmalloc region
Register r5 information: slab kmalloc-cg-2k
Register r6 information: vmalloc memory
Register r7 information: non-slab/vmalloc memory
Register r8 information: non-paged memory
Register r9 information: zero-size pointer
Register r10 information: vmalloc memory
Register r11 information: non-paged memory
Register r12 information: non-paged memory
Process vfp-reproducer (pid: 196, stack limit = 0x61aaaf8b)
Stack: (0xdc8d1f68 to 0xdc8d2000)
1f60: 0000081f b6f69300 0000000f c10073f4 c10072c4 dc8d1fb0
1f80: ec532b17 0c532b17 0044766c b6f9ccd8 00000000 c010a80c 00447670 60000010
1fa0: ffffffff c1c13800 00c5387d c0100f10 b6f68af8 00448fc0 00000000 bedea188
1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c
1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff 00000000 00000000
Call trace:
[<c0101d50>] (vfp_support_entry) from [<c010a80c>] (do_undefinstr+0xa8/0x250)
[<c010a80c>] (do_undefinstr) from [<c0100f10>] (__und_usr+0x70/0x80)
Exception stack(0xdc8d1fb0 to 0xdc8d1ff8)
1fa0: b6f68af8 00448fc0 00000000 bedea188
1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c
1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff
Code: 0a000061 e3877202 e594003c e3a09010 (eef16a10)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Fatal exception in interrupt
---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---This is a minimal userspace reproducer on a Raspberry Pi Zero W:
#include <stdio.h>
#include <math.h>
int main(void)
{
double v = 1.0;
printf("%fn", NAN + *(volatile double *)&v);
return 0;
}Another way to consistently trigger the oops is:
calvin@raspberry-pi-zero-w ~$ python -c "import json"
The bug reproduces only when the kernel is built with DYNAMIC_DEBUG=n, because the pr_debug() calls act as barriers even when not activated.
This is the output from the same kernel source built with the same compiler and DYNAMIC_DEBUG=y, where the userspace reproducer works as expected:
VFP: bounce: trigger ec532b17 fpexc c0000780
VFP: emulate: INST=0xee377b06 SCR=0x00000000
VFP: bounce: trigger eef1fa10 fpexc c0000780
VFP: emulate: INST=0xeeb40b40 SCR=0x00000000
VFP: raising exceptions 30000000
calvin@raspberry-pi-zero-w ~$ ./vfp-reproducer
nanCrudely grepping for vmsr/vmrs instructions in the otherwise nearly idential text for vfp_support_entry() makes the problem obvious:
vmlinux.llvm.good [0xc0101cb8] <+48>: vmrs r7, fpexc
vmlinux.llvm.good [0xc0101cd8] <+80>: vmsr fpexc, r0
vmlinux.llvm.good [0xc0101d20] <+152>: vmsr fpexc, r7
vmlinux.llvm.good [0xc0101d38] <+176>: vmrs r4, fpexc
vmlinux.llvm.good [0xc0101d6c] <+228>: vmrs r0, fpscr
vmlinux.llvm.good [0xc0101dc4] <+316>: vmsr fpexc, r0
vmlinux.llvm.good [0xc0101dc8] <+320>: vmrs r0, fpsid
vmlinux.llvm.good [0xc0101dcc] <+324>: vmrs r6, fpscr
vmlinux.llvm.good [0xc0101e10] <+392>: vmrs r10, fpinst
vmlinux.llvm.good [0xc0101eb8] <+560>: vmrs r10, fpinst2 vmlinux.llvm.bad [0xc0101cb8] <+48>: vmrs r7, fpexc
vmlinux.llvm.bad [0xc0101cd8] <+80>: vmsr fpexc, r0
vmlinux.llvm.bad [0xc0101d20] <+152>: vmsr fpexc, r7
vmlinux.llvm.bad [0xc0101d30] <+168>: vmrs r0, fpscr
vmlinux.llvm.bad [0xc0101d50] <+200>: vmrs r6, fpscr <== BOOM!
vmlinux.llvm.bad [0xc0101d6c] <+228>: vmsr fpexc, r0
vmlinux.llvm.bad [0xc0101d70] <+232>: vmrs r0, fpsid
vmlinux.llvm.bad [0xc0101da4] <+284>: vmrs r10, fpinst
vmlinux.llvm.bad [0xc0101df8] <+368>: vmrs r4, fpexc
vmlinux.llvm.bad [0xc0101e5c] <+468>: vmrs r10, fpinst2I think LLVM's reordering is valid as the code is currently written: the compiler doesn't know the instructions have side effects in hardware.
Fix by using "asm volatile" in fmxr() and fmrx(), so they cannot be reordered with respect to each other. The original compiler now produces working kernels on my hardware with DYNAMIC_DEBUG=n.
This is the relevant piece of the diff of the vfp_support_entry() text, from the original oopsing kernel to a working kernel with this patch:
vmrs r0, fpscr
tst r0, #4096
bne 0xc0101d48
tst r0, #458752
beq 0xc0101ecc
orr r7, r7, #536870912
ldr r0, [r4, #0x3c]
mov r9, #16
-vmrs r6, fpscr
orr r9, r9, #251658240
add r0, r0, #4
str r0, [r4, #0x3c]
mvn r0, #159
sub r0, r0, #-1207959552
and r0, r7, r0
vmsr fpexc, r0
vmrs r0, fpsid
+vmrs r6, fpscr
and r0, r0, #983040
cmp r0, #65536
bne 0xc0101d88--- arch/arm/vfp/vfpinstr.h | 48 ++++++++++++++++++++++------------------- 1 file changed, 26 insertions(+), 22 deletions(-)
arch/arm/vfp/vfpinstr.h +26 -22
@@ -64,33 +64,37 @@#ifdef CONFIG_AS_VFP_VMRS_FPINST -#define fmrx (_vfp_) ({ \ - u32 __v; \ - asm(".fpu vfpv2\n" \ - "vmrs %0, " #_vfp_ \ - : "=r" (__v) : : "cc"); \ - __v; \ - }) - -#define fmxr (_vfp_,_var_) \ - asm(".fpu vfpv2\n" \ - "vmsr " #_vfp_ ", %0" \ - : : "r" (_var_) : "cc") +#define fmrx (_vfp_) ({ \ + u32 __v; \ + asm volatile (".fpu vfpv2\n" \ + "vmrs %0, " #_vfp_ \ + : "=r" (__v) : : "cc"); \ + __v; \ +}) + +#define fmxr (_vfp_, _var_) ({ \ + asm volatile (".fpu vfpv2\n" \ + "vmsr " #_vfp_ ", %0" \ + : : "r" (_var_) : "cc"); \ +})#else #define vfpreg (_vfp_) #_vfp_ -#define fmrx (_vfp_) ({ \ - u32 __v; \ - asm("mrc p10, 7, %0, " vfpreg(_vfp_) ", cr0, 0 @ fmrx %0, " #_vfp_ \ - : "=r" (__v) : : "cc"); \ - __v; \ - }) - -#define fmxr (_vfp_,_var_) \ - asm("mcr p10, 7, %0, " vfpreg(_vfp_) ", cr0, 0 @ fmxr " #_vfp_ ", %0" \ - : : "r" (_var_) : "cc") +#define fmrx (_vfp_) ({ \ + u32 __v; \ + asm volatile ("mrc p10, 7, %0, " vfpreg(_vfp_) "," \ + "cr0, 0 @ fmrx %0, " #_vfp_ \ + : "=r" (__v) : : "cc"); \ + __v; \ +}) + +#define fmxr (_vfp_, _var_) ({ \ + asm volatile ("mcr p10, 7, %0, " vfpreg(_vfp_) "," \ + "cr0, 0 @ fmxr " #_vfp_ ", %0" \ + : : "r" (_var_) : "cc"); \ +})#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/538 powercap: intel_rapl: Fix off by one in get_rpi()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 95f6580352a7225e619551febb83595bcb77ab17 ]
The rp->priv->rpi array is either rpi_msr or rpi_tpmi which have NR_RAPL_PRIMITIVES number of elements. Thus the > needs to be >= to prevent an off by one access.
--- drivers/powercap/intel_rapl_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/powercap/intel_rapl_common.c +1 -1
@@ -738,7 +738,7 @@ static struct rapl_primitive_info *get_rpi(struct rapl_package *rp, int prim) {struct rapl_primitive_info *rpi = rp->priv->rpi; -if (prim <0 || prim >NR_RAPL_PRIMITIVES || !rpi) +if (prim <0 || prim >=NR_RAPL_PRIMITIVES || !rpi)return NULL ;return &rpi[prim];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/538 kselftest/arm64: signal: fix/refactor SVE vector length enumeration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <[email protected]>
[ Upstream commit 5225b6562b9a7dc808d5a1e465aaf5e2ebb220cd ]
Currently a number of SVE/SME related tests have almost identical functions to enumerate all supported vector lengths. However over time the copy&pasted code has diverged, allowing some bugs to creep in:
- fake_sigreturn_sme_change_vl reports a failure, not a SKIP if only one vector length is supported (but the SVE version is fine)
- fake_sigreturn_sme_change_vl tries to set the SVE vector length, not the SME one (but the other SME tests are fine)
- za_no_regs keeps iterating forever if only one vector length is supported (but za_regs is correct)
Since those bugs seem to be mostly copy&paste ones, let's consolidate the enumeration loop into one shared function, and just call that from each test. That should fix the above bugs, and prevent similar issues from happening again.
--- tools/testing/selftests/arm64/signal/Makefile | 2 +- .../selftests/arm64/signal/sve_helpers.c | 56 +++++++++++++++++++ .../selftests/arm64/signal/sve_helpers.h | 21 +++++++ .../testcases/fake_sigreturn_sme_change_vl.c | 32 +++-------- .../testcases/fake_sigreturn_sve_change_vl.c | 30 ++-------- .../arm64/signal/testcases/ssve_regs.c | 36 +++--------- .../arm64/signal/testcases/ssve_za_regs.c | 36 +++--------- .../arm64/signal/testcases/sve_regs.c | 32 +++-------- .../arm64/signal/testcases/za_no_regs.c | 32 +++-------- .../arm64/signal/testcases/za_regs.c | 36 +++--------- 10 files changed, 132 insertions(+), 181 deletions(-) create mode 100644 tools/testing/selftests/arm64/signal/sve_helpers.c create mode 100644 tools/testing/selftests/arm64/signal/sve_helpers.h
tools/testing/selftests/arm64/signal/Makefile +1 -1
@@ -23,7 +23,7 @@ $(TEST_GEN_PROGS): $(PROGS) # Common test-unit targets to build common-layout test-cases executables # Needs secondary expansion to properly include the testcase c-file in pre-reqs COMMON_SOURCES := test_signals.c test_signals_utils.c testcases/testcases.c \ - signals.S + signals.S sve_helpers.c COMMON_HEADERS := test_signals.h test_signals_utils.h testcases/testcases.h .SECONDEXPANSION:
tools/testing/selftests/arm64/signal/sve_helpers.c new file +56 -0
56 lines not on this page · raw message
tools/testing/selftests/arm64/signal/sve_helpers.h new file +21 -0
@@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* +* Copyright (C) 2024 ARM Limited +* +* Common helper functions for SVE and SME functionality. +*/ + +#ifndef __SVE_HELPERS_H__ +#define __SVE_HELPERS_H__ + +#include <stdbool.h> + +#define VLS_USE_SVE false +#define VLS_USE_SME true + +extern unsigned int vls[]; +extern unsigned int nvls; + +int sve_fill_vls (bool use_sme,int min_vls); + +#endif
tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c +8 -24
@@ -6,44 +6,28 @@* handler, this is not supported and is expected to segfault. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" struct fake_sigframe sf; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,2 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SVE_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; +if (!res) +return true; - vl &=PR_SME_VL_LEN_MASK ; +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least two VLs */ -if (nvls <2 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } - -return true; +return false; } static int fake_sigreturn_ssve_change_vl(struct tdescr *td,
tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sve_change_vl.c +6 -24
@@ -12,40 +12,22 @@#include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" struct fake_sigframe sf; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sve_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SVE ,2 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SVE_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; +if (!res) +return true; - vl &=PR_SVE_VL_LEN_MASK ; - -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least two VLs */ -if (nvls <2 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); +if (res ==KSFT_SKIP ) td->result =KSFT_SKIP ; -return false; - } -return true; +return false; } static int fake_sigreturn_sve_change_vl(struct tdescr *td,
tools/testing/selftests/arm64/signal/testcases/ssve_regs.c +8 -28
@@ -6,51 +6,31 @@* set up as expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *64 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Did we find the lowest supported VL? */ -if (vq <sve_vq_from_vl (vl)) -break ; +if (!res) +return true; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_ssve_regs (void )
tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c +8 -28
@@ -6,51 +6,31 @@* signal frames is set up as expected when enabled simultaneously. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *128 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Did we find the lowest supported VL? */ -if (vq <sve_vq_from_vl (vl)) -break ; +if (!res) +return true; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_regs (void )
tools/testing/selftests/arm64/signal/testcases/sve_regs.c +8 -24
@@ -6,47 +6,31 @@* expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *64 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sve_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SVE ,1 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SVE_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SVE_VL_LEN_MASK ; - -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); +if (!res) +return true; - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_sve_regs (void )
tools/testing/selftests/arm64/signal/testcases/za_no_regs.c +8 -24
@@ -6,47 +6,31 @@* expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *128 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SME_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); +if (!res) +return true; - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; } static int do_one_sme_vl(struct tdescr *td, siginfo_t *si, ucontext_t *uc,
tools/testing/selftests/arm64/signal/testcases/za_regs.c +8 -28
@@ -6,51 +6,31 @@* expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *128 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SME_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Did we find the lowest supported VL? */ -if (vq <sve_vq_from_vl (vl)) -break ; +if (!res) +return true; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_za_regs (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/538 drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jing Zhang <[email protected]>
[ Upstream commit a3dd920977dccc453c550260c4b7605b280b79c3 ]
The alibaba_uncore_pmu driver forgot to clear all interrupt status in the interrupt processing function. After the PMU counter overflow interrupt occurred, an interrupt storm occurred, causing the system to hang.
Therefore, clear the correct interrupt status in the interrupt handling function to fix it.
--- drivers/perf/alibaba_uncore_drw_pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/perf/alibaba_uncore_drw_pmu.c +1 -1
@@ -408,7 +408,7 @@ static irqreturn_t ali_drw_pmu_isr(int irq_num, void *data) }/* clear common counter intr status */ - clr_status =FIELD_PREP (ALI_DRW_PMCOM_CNT_OV_INTR_MASK ,1 ); + clr_status =FIELD_PREP (ALI_DRW_PMCOM_CNT_OV_INTR_MASK , status);writel (clr_status, drw_pmu->cfg_base +ALI_DRW_PMU_OV_INTR_CLR ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/538 wifi: mac80211: dont use rate mask for offchannel TX either
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit e7a7ef9a0742dbd0818d5b15fba2c5313ace765b ]
Like the commit ab9177d83c04 ("wifi: mac80211: don't use rate mask for scanning"), ignore incorrect settings to avoid no supported rate warning reported by syzbot.
The syzbot did bisect and found cause is commit 9df66d5b9f45 ("cfg80211:
fix default HE tx bitrate mask in 2G band"), which however corrects bitmask of HE MCS and recognizes correctly settings of empty legacy rate plus HE MCS rate instead of returning -EINVAL.
As suggestions [1], follow the change of SCAN TX to consider this case of offchannel TX as well.
--- include/net/mac80211.h | 7 ++++--- net/mac80211/offchannel.c | 1 + net/mac80211/rate.c | 2 +- net/mac80211/scan.c | 2 +- net/mac80211/tx.c | 2 +- 5 files changed, 8 insertions(+), 6 deletions(-)
include/net/mac80211.h +4 -3
@@ -936,8 +936,9 @@ enum mac80211_tx_info_flags {* of their QoS TID or other priority field values. * @IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX: first MLO TX, used mostly internally * for sequence number assignment -* @IEEE80211_TX_CTRL_SCAN_TX: Indicates that this frame is transmitted -* due to scanning, not in normal operation on the interface. +* @IEEE80211_TX_CTRL_DONT_USE_RATE_MASK: Don't use rate mask for this frame +* which is transmitted due to scanning or offchannel TX, not in normal +* operation on the interface. * @IEEE80211_TX_CTRL_MLO_LINK: If not @IEEE80211_LINK_UNSPECIFIED, this * frame should be transmitted on the specific link. This really is * only relevant for frames that do not have data present, and is
@@ -958,7 +959,7 @@ enum mac80211_tx_control_flags {IEEE80211_TX_CTRL_NO_SEQNO =BIT (7 ),IEEE80211_TX_CTRL_DONT_REORDER =BIT (8 ),IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX =BIT (9 ), -IEEE80211_TX_CTRL_SCAN_TX =BIT (10 ), +IEEE80211_TX_CTRL_DONT_USE_RATE_MASK =BIT (10 ), IEEE80211_TX_CTRL_MLO_LINK = 0xf0000000, };
net/mac80211/offchannel.c +1 -0
@@ -940,6 +940,7 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, }IEEE80211_SKB_CB (skb)->flags = flags; +IEEE80211_SKB_CB (skb)->control.flags |=IEEE80211_TX_CTRL_DONT_USE_RATE_MASK ; skb->dev = sdata->dev;
net/mac80211/rate.c +1 -1
@@ -890,7 +890,7 @@ void ieee80211_get_tx_rates(struct ieee80211_vif *vif,if (ieee80211_is_tx_data (skb))rate_control_apply_mask (sdata, sta, sband, dest, max_rates); -if (!(info->control.flags &IEEE80211_TX_CTRL_SCAN_TX )) +if (!(info->control.flags &IEEE80211_TX_CTRL_DONT_USE_RATE_MASK )) mask = sdata->rc_rateidx_mask[info->band];if (dest[0 ].idx <0 )
net/mac80211/scan.c +1 -1
@@ -636,7 +636,7 @@ static void ieee80211_send_scan_probe_req(struct ieee80211_sub_if_data *sdata,cpu_to_le16 (IEEE80211_SN_TO_SEQ (sn)); }IEEE80211_SKB_CB (skb)->flags |= tx_flags; -IEEE80211_SKB_CB (skb)->control.flags |=IEEE80211_TX_CTRL_SCAN_TX ; +IEEE80211_SKB_CB (skb)->control.flags |=IEEE80211_TX_CTRL_DONT_USE_RATE_MASK ;ieee80211_tx_skb_tid_band (sdata, skb,7 , channel->band); } }
net/mac80211/tx.c +1 -1
@@ -706,7 +706,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx) txrc.skb = tx->skb; txrc.reported_rate.idx =-1 ; -if (unlikely (info->control.flags &IEEE80211_TX_CTRL_SCAN_TX )) { +if (unlikely (info->control.flags &IEEE80211_TX_CTRL_DONT_USE_RATE_MASK )) { txrc.rate_idx_mask = ~0 ; }else { txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/538 wifi: iwlwifi: remove AX101, AX201 and AX203 support from LNL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Golan Ben Ami <[email protected]>
[ Upstream commit 6adae0b081454393ca5f7363fd3c7379c8e2a7a1 ]
LNL is the codename for the upcoming Series 2 Core Ultra processors designed by Intel. AX101, AX201 and AX203 devices are not shiped on LNL platforms, so don't support them.
Stable-dep-of: 8131dd52810d ("wifi: iwlwifi: config: label 'gl' devices as discrete")
--- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 32 ++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +31 -1
@@ -504,7 +504,37 @@ static const struct pci_device_id iwl_hw_card_ids[] = { {IWL_PCI_DEVICE(0x2727, PCI_ANY_ID, iwl_bz_trans_cfg)}, {IWL_PCI_DEVICE(0x272D, PCI_ANY_ID, iwl_bz_trans_cfg)}, {IWL_PCI_DEVICE(0x272b, PCI_ANY_ID, iwl_bz_trans_cfg)}, - {IWL_PCI_DEVICE(0xA840, PCI_ANY_ID, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0000, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0090, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0094, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0098, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x009C, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x00C0, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x00C4, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x00E0, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x00E4, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x00E8, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x00EC, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0100, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0110, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0114, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0118, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x011C, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0310, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0314, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0510, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x0A10, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x1671, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x1672, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x1771, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x1772, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x1791, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x1792, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x4090, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x40C4, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x40E0, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x4110, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, 0x4314, iwl_bz_trans_cfg)}, {IWL_PCI_DEVICE(0x7740, PCI_ANY_ID, iwl_bz_trans_cfg)}, /* Sc devices */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/538 wifi: iwlwifi: config: label gl devices as discrete
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 8131dd52810dfcdb49fcdc78f5e18e1538b6c441 ]
The 'gl' devices are in the bz family, but they're not, integrated, so should have their own trans config struct. Fix that, also necessitating the removal of LTR config, and while at it remove 0x2727 and 0x272D IDs that were only used for test chips.
--- drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 11 +++++++++++ drivers/net/wireless/intel/iwlwifi/iwl-config.h | 1 + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 4 +--- 3 files changed, 13 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/cfg/bz.c +11 -0
@@ -152,6 +152,17 @@ const struct iwl_cfg_trans_params iwl_bz_trans_cfg = { .ltr_delay = IWL_CFG_TRANS_LTR_DELAY_2500US, }; +const struct iwl_cfg_trans_params iwl_gl_trans_cfg = { + .device_family =IWL_DEVICE_FAMILY_BZ , + .base_params = &iwl_bz_base_params, + .mq_rx_supported = true, + .rf_id = true, + .gen2 = true, + .umac_prph_offset =0x300000 , + .xtal_latency =12000 , + .low_latency_xtal = true, +}; +const char iwl_bz_name[] ="Intel(R) TBD Bz device" ;const struct iwl_cfg iwl_cfg_bz = {
drivers/net/wireless/intel/iwlwifi/iwl-config.h +1 -0
@@ -493,6 +493,7 @@ extern const struct iwl_cfg_trans_params iwl_so_long_latency_trans_cfg;extern const struct iwl_cfg_trans_params iwl_so_long_latency_imr_trans_cfg;extern const struct iwl_cfg_trans_params iwl_ma_trans_cfg;extern const struct iwl_cfg_trans_params iwl_bz_trans_cfg; +extern const struct iwl_cfg_trans_params iwl_gl_trans_cfg;extern const struct iwl_cfg_trans_params iwl_sc_trans_cfg;extern const char iwl9162_name[];extern const char iwl9260_name[];
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +1 -3
@@ -501,9 +501,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = { {IWL_PCI_DEVICE(0x7E40, PCI_ANY_ID, iwl_ma_trans_cfg)},/* Bz devices */ - {IWL_PCI_DEVICE(0x2727, PCI_ANY_ID, iwl_bz_trans_cfg)}, - {IWL_PCI_DEVICE(0x272D, PCI_ANY_ID, iwl_bz_trans_cfg)}, - {IWL_PCI_DEVICE(0x272b, PCI_ANY_ID, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0x272b, PCI_ANY_ID, iwl_gl_trans_cfg)}, {IWL_PCI_DEVICE(0xA840, 0x0000, iwl_bz_trans_cfg)}, {IWL_PCI_DEVICE(0xA840, 0x0090, iwl_bz_trans_cfg)}, {IWL_PCI_DEVICE(0xA840, 0x0094, iwl_bz_trans_cfg)},
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/538 wifi: iwlwifi: mvm: increase the time between ranging measurements
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit 3a7ee94559dfd640604d0265739e86dec73b64e8 ]
The algo running in fw may take a little longer than 5 milliseconds, (e.g. measurement on 80MHz while associated). Increase the minimum time between measurements to 7 milliseconds.
--- drivers/net/wireless/intel/iwlwifi/mvm/constants.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/constants.h +1 -1
@@ -103,7 +103,7 @@#define IWL_MVM_FTM_INITIATOR_SECURE_LTF false#define IWL_MVM_FTM_RESP_NDP_SUPPORT true#define IWL_MVM_FTM_RESP_LMR_FEEDBACK_SUPPORT true -#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR 5 +#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR 7#define IWL_MVM_FTM_NON_TB_MAX_TIME_BETWEEN_MSR 1000#define IWL_MVM_D3_DEBUG false#define IWL_MVM_USE_TWT true
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/538 padata: Honor the callers alignment in case of chunk_size 0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamlesh Gurudasani <[email protected]>
[ Upstream commit 24cc57d8faaa4060fd58adf810b858fcfb71a02f ]
In the case where we are forcing the ps.chunk_size to be at least 1, we are ignoring the caller's alignment.
Move the forcing of ps.chunk_size to be at least 1 before rounding it up to caller's alignment, so that caller's alignment is honored.
While at it, use max() to force the ps.chunk_size to be at least 1 to improve readability.
--- kernel/padata.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/padata.c +3 -0
@@ -511,9 +511,12 @@ void __init padata_do_multithreaded(struct padata_mt_job *job)* thread function. Load balance large jobs between threads by * increasing the number of chunks, guarantee at least the minimum * chunk size from the caller, and honor the caller's alignment. +* Ensure chunk_size is at least 1 to prevent divide-by-0 +* panic in padata_mt_helper(). */ ps.chunk_size = job->size / (ps.nworks * load_balance_factor); ps.chunk_size =max (ps.chunk_size, job->min_chunk); + ps.chunk_size =max (ps.chunk_size,1ul ); ps.chunk_size =roundup (ps.chunk_size, job->align);/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/538 drivers/perf: hisi_pcie: Record hardware counts correctly
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <[email protected]>
[ Upstream commit daecd3373a16a039ad241086e30a1ec46fc9d61f ]
Currently we set the period and record it as the initial value of the counter without checking it's set to the hardware successfully or not. However the counter maybe unwritable if the target event is unsupported by the device. In such case we will pass user a wrong count:
[start counts when setting the period]hwc->prev_count = 0x8000000000000000 device.counter_value = 0 // the counter is not set as the period [when user reads the counter]event->count = device.counter_value - hwc->prev_count
= 0x8000000000000000 // wrong. should be 0.
Fix this by record the hardware counter counts correctly when setting the period.
--- drivers/perf/hisilicon/hisi_pcie_pmu.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/perf/hisilicon/hisi_pcie_pmu.c +14 -0
@@ -458,10 +458,24 @@ static void hisi_pcie_pmu_set_period(struct perf_event *event)struct hisi_pcie_pmu *pcie_pmu =to_pcie_pmu (event->pmu);struct hw_perf_event *hwc = &event->hw;int idx = hwc->idx; +u64 orig_cnt, cnt; + + orig_cnt =hisi_pcie_pmu_read_counter (event);local64_set (&hwc->prev_count,HISI_PCIE_INIT_VAL );hisi_pcie_pmu_writeq (pcie_pmu,HISI_PCIE_CNT , idx,HISI_PCIE_INIT_VAL );hisi_pcie_pmu_writeq (pcie_pmu,HISI_PCIE_EXT_CNT , idx,HISI_PCIE_INIT_VAL ); + +/* +* The counter maybe unwritable if the target event is unsupported. +* Check this by comparing the counts after setting the period. If +* the counts stay unchanged after setting the period then update +* the hwc->prev_count correctly. Otherwise the final counts user +* get maybe totally wrong. +*/ + cnt =hisi_pcie_pmu_read_counter (event); +if (orig_cnt == cnt) +local64_set (&hwc->prev_count, cnt); }static void hisi_pcie_pmu_enable_counter (struct hisi_pcie_pmu *pcie_pmu,struct hw_perf_event *hwc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/538 drivers/perf: hisi_pcie: Fix TLP headers bandwidth counting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <[email protected]>
[ Upstream commit 17bf68aeb3642221e3e770399b5a52f370747ac1 ]
We make the initial value of event ctrl register as HISI_PCIE_INIT_SET and modify according to the user options. This will make TLP headers bandwidth only counting never take effect since HISI_PCIE_INIT_SET configures to count the TLP payloads bandwidth. Fix this by making the initial value of event ctrl register as 0.
--- drivers/perf/hisilicon/hisi_pcie_pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/perf/hisilicon/hisi_pcie_pmu.c +1 -1
@@ -221,7 +221,7 @@ static void hisi_pcie_pmu_config_filter(struct perf_event *event)struct hisi_pcie_pmu *pcie_pmu =to_pcie_pmu (event->pmu);struct hw_perf_event *hwc = &event->hw;u64 port, trig_len, thr_len, len_mode; -u64 reg =HISI_PCIE_INIT_SET ; +u64 reg =0 ;/* Config HISI_PCIE_EVENT_CTRL according to event. */ reg |=FIELD_PREP (HISI_PCIE_EVENT_M ,hisi_pcie_get_real_event (event));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/538 kselftest/arm64: Actually test SME vector length changes via sigreturn
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 6f0315330af7a57c1c00587fdfb69c7778bf1c50 ]
The test case for SME vector length changes via sigreturn use a bit too much cut'n'paste and only actually changed the SVE vector length in the test itself. Andre's recent factoring out of the initialisation code caused this to be exposed and the test to start failing. Fix the test to actually cover the thing it's supposed to test.
--- .../testcases/fake_sigreturn_sme_change_vl.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c +7 -7
@@ -35,30 +35,30 @@ static int fake_sigreturn_ssve_change_vl(struct tdescr *td, {size_t resv_sz, offset;struct _aarch64_ctx *head =GET_SF_RESV_HEAD (sf); -struct sve_context *sve; +struct za_context *za;/* Get a signal context with a SME ZA frame in it */ if (!get_current_context (td, &sf.uc,sizeof (sf.uc)))return 1 ; resv_sz =GET_SF_RESV_SIZE (sf); - head =get_header (head,SVE_MAGIC , resv_sz, &offset); + head =get_header (head,ZA_MAGIC , resv_sz, &offset);if (!head) { -fprintf (stderr,"No SVE context\n" ); +fprintf (stderr,"No ZA context\n" );return 1 ; } -if (head->size !=sizeof (struct sve_context )) { +if (head->size !=sizeof (struct za_context )) {fprintf (stderr,"Register data present, aborting\n" );return 1 ; } - sve = (struct sve_context *)head; + za = (struct za_context *)head;/* No changes are supported; init left us at minimum VL so go to max */ fprintf (stderr,"Attempting to change VL from %d to %d\n" , - sve->vl, vls[0 ]); - sve->vl = vls[0 ]; + za->vl, vls[0 ]); + za->vl = vls[0 ];fake_sigreturn (&sf,sizeof (sf),0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/538 can: j1939: use correct function name in comment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Changzhong <[email protected]>
[ Upstream commit dc2ddcd136fe9b6196a7dd01f75f824beb02d43f ]
The function j1939_cancel_all_active_sessions() was renamed to j1939_cancel_active_session() but name in comment wasn't updated.
--- net/can/j1939/transport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/can/j1939/transport.c +4 -4
@@ -1179,10 +1179,10 @@ static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer)break ;case -ENETDOWN :/* In this case we should get a netdev_event(), all active -* sessions will be cleared by -* j1939_cancel_all_active_sessions(). So handle this as an -* error, but let j1939_cancel_all_active_sessions() do the -* cleanup including propagation of the error to user space. +* sessions will be cleared by j1939_cancel_active_session(). +* So handle this as an error, but let +* j1939_cancel_active_session() do the cleanup including +* propagation of the error to user space. */ break ;case -EOVERFLOW :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/538 ACPI: CPPC: Fix MASK_VAL() usage
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Léger <[email protected]>
[ Upstream commit 60949b7b805424f21326b450ca4f1806c06d982e ]
MASK_VAL() was added as a way to handle bit_offset and bit_width for registers located in system memory address space. However, while suited for reading, it does not work for writing and result in corrupted registers when writing values with bit_offset > 0. Moreover, when a register is collocated with another one at the same address but with a different mask, the current code results in the other registers being overwritten with 0s. The write procedure for SYSTEM_MEMORY registers should actually read the value, mask it, update it and write it with the updated value. Moreover, since registers can be located in the same word, we must take care of locking the access before doing it. We should potentially use a global lock since we don't know in if register addresses aren't shared with another _CPC package but better not encourage vendors to do so. Assume that registers can use the same word inside a _CPC package and thus, use a per _CPC package lock.
--- drivers/acpi/cppc_acpi.c | 43 ++++++++++++++++++++++++++++++++++++---- include/acpi/cppc_acpi.h | 2 ++ 2 files changed, 41 insertions(+), 4 deletions(-)
drivers/acpi/cppc_acpi.c +39 -4
@@ -167,8 +167,11 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);#define GET_BIT_WIDTH (reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width)/* Shift and apply the mask for CPC reads/writes */ -#define MASK_VAL (reg, val) (((val) >> (reg)->bit_offset) & \ +#define MASK_VAL_READ (reg, val) (((val) >> (reg)->bit_offset) & \ GENMASK(((reg)->bit_width) - 1, 0)) +#define MASK_VAL_WRITE (reg, prev_val, val) \ + ((((val) & GENMASK(((reg)->bit_width) - 1, 0)) << (reg)->bit_offset) | \ + ((prev_val) & ~(GENMASK(((reg)->bit_width) - 1, 0) << (reg)->bit_offset))) \static ssize_t show_feedback_ctrs (struct kobject *kobj,struct kobj_attribute *attr,char *buf)
@@ -852,6 +855,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)/* Store CPU Logical ID */ cpc_ptr->cpu_id = pr->id; +spin_lock_init (&cpc_ptr->rmw_lock);/* Parse PSD data for this CPU */ ret =acpi_get_psd (cpc_ptr, handle);
@@ -1057,7 +1061,7 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) }if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) - *val =MASK_VAL (reg, *val); + *val =MASK_VAL_READ (reg, *val);return 0 ; }
@@ -1066,9 +1070,11 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val) {int ret_val =0 ;int size; +u64 prev_val;void __iomem *vaddr =NULL ;int pcc_ss_id =per_cpu (cpu_pcc_subspace_idx, cpu);struct cpc_reg *reg = ®_res->cpc_entry.reg; +struct cpc_desc *cpc_desc; size =GET_BIT_WIDTH (reg);
@@ -1101,8 +1107,34 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)return acpi_os_write_memory ((acpi_physical_address )reg->address, val, size); -if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) - val =MASK_VAL (reg, val); +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) { + cpc_desc =per_cpu (cpc_desc_ptr, cpu); +if (!cpc_desc) { +pr_debug ("No CPC descriptor for CPU:%d\n" , cpu); +return -ENODEV ; + } + +spin_lock (&cpc_desc->rmw_lock); +switch (size) { +case 8 : + prev_val =readb_relaxed (vaddr); +break ; +case 16 : + prev_val =readw_relaxed (vaddr); +break ; +case 32 : + prev_val =readl_relaxed (vaddr); +break ; +case 64 : + prev_val =readq_relaxed (vaddr); +break ; +default : +spin_unlock (&cpc_desc->rmw_lock); +return -EFAULT ; + } + val =MASK_VAL_WRITE (reg, prev_val, val); + val |= prev_val; + }switch (size) {case 8 :
@@ -1129,6 +1161,9 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)break ; } +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) +spin_unlock (&cpc_desc->rmw_lock); +return ret_val; }
include/acpi/cppc_acpi.h +2 -0
@@ -64,6 +64,8 @@ struct cpc_desc {int cpu_id;int write_cmd_status;int write_cmd_id; +/* Lock used for RMW operations in cpc_write() */ +spinlock_t rmw_lock;struct cpc_register_resource cpc_regs[MAX_CPC_REG_ENT ];struct acpi_psd_package domain_info;struct kobject kobj;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/538 netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e0c47281723f301894c14e6f5cd5884fdfb813f9 ]
Element timeout that is below CONFIG_HZ never expires because the timeout extension is not allocated given that nf_msecs_to_jiffies64() returns 0. Set timeout to the minimum value to honor timeout.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -4462,7 +4462,7 @@ int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)return -ERANGE ; ms *=NSEC_PER_MSEC ; - *result =nsecs_to_jiffies64 (ms); + *result =nsecs_to_jiffies64 (ms) ? : !!ms;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/538 netfilter: nf_tables: reject element expiration with no timeout
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit d2dc429ecb4e79ad164028d965c00f689e6f6d06 ]
If element timeout is unset and set provides no default timeout, the element expiration is silently ignored, reject this instead to let user know this is unsupported.
Also prepare for supporting timeout that never expire, where zero timeout and expiration must be also rejected.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -6698,6 +6698,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (nla[NFTA_SET_ELEM_EXPIRATION ] !=NULL ) {if (!(set->flags &NFT_SET_TIMEOUT ))return -EINVAL ; +if (timeout ==0 ) +return -EOPNOTSUPP ; + err =nf_msecs_to_jiffies64 (nla[NFTA_SET_ELEM_EXPIRATION ], &expiration);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/538 netfilter: nf_tables: reject expiration higher than timeout
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit c0f38a8c60174368aed1d0f9965d733195f15033 ]
Report ERANGE to userspace if user specifies an expiration larger than the timeout.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -6705,6 +6705,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, &expiration);if (err)return err; + +if (expiration > timeout) +return -ERANGE ; }if (nla[NFTA_SET_ELEM_EXPR ]) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/538 netfilter: nf_tables: remove annotation to access set timeout while holding lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 15d8605c0cf4fc9cf4386cae658c68a0fd4bdb92 ]
Mutex is held when adding an element, no need for READ_ONCE, remove it.
--- net/netfilter/nf_tables_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +2 -2
@@ -6691,7 +6691,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,return err; }else if (set->flags &NFT_SET_TIMEOUT && !(flags &NFT_SET_ELEM_INTERVAL_END )) { - timeout =READ_ONCE (set->timeout); + timeout = set->timeout; } expiration =0 ;
@@ -6798,7 +6798,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (err <0 ) goto err_parse_key_end; -if (timeout !=READ_ONCE (set->timeout)) { +if (timeout != set->timeout) { err =nft_set_ext_add (&tmpl,NFT_SET_EXT_TIMEOUT );if (err <0 ) goto err_parse_key_end;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/538 perf/arm-cmn: Rework DTC counters (again)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit 7633ec2c262fab3e7c5bf3cd3876b5748f584a57 ]
The bitmap-based scheme for tracking DTC counter usage turns out to be a complete dead-end for its imagined purpose, since by the time we have to keep track of a per-DTC counter index anyway, we already have enough information to make the bitmap itself redundant. Revert the remains of it back to almost the original scheme, but now expanded to track per-DTC indices, in preparation for making use of them in anger.
Note that since cycle count events always use a dedicated counter on a single DTC, we reuse the field to encode their DTC index directly.
Stable-dep-of: e79634b53e39 ("perf/arm-cmn: Refactor node ID handling. Again.")
--- drivers/perf/arm-cmn.c | 126 +++++++++++++++++++++-------------------- 1 file changed, 64 insertions(+), 62 deletions(-)
drivers/perf/arm-cmn.c +64 -62
@@ -281,16 +281,13 @@ struct arm_cmn_node {u16 id, logid;enum cmn_node_type type; -int dtm; -union { -/* DN/HN-F/CXHA */ -struct { -u8 val :4 ; -u8 count :4 ; - } occupid[SEL_MAX ]; -/* XP */ -u8 dtc; - }; +u8 dtm; +s8 dtc; +/* DN/HN-F/CXHA */ +struct { +u8 val :4 ; +u8 count :4 ; + } occupid[SEL_MAX ];union {u8 event[4 ];__le32 event_sel;
@@ -540,12 +537,12 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)seq_puts (s,"\n |" );for (x =0 ; x < cmn->mesh_x; x++) { -u8 dtc = cmn->xps[xp_base + x].dtc; +s8 dtc = cmn->xps[xp_base + x].dtc; -if (dtc & (dtc -1 )) +if (dtc <0 )seq_puts (s," DTC ?? |" );else -seq_printf (s," DTC %ld |" ,__ffs (dtc)); +seq_printf (s," DTC %d |" , dtc); }seq_puts (s,"\n |" );for (x =0 ; x < cmn->mesh_x; x++)
@@ -589,8 +586,7 @@ static void arm_cmn_debugfs_init(struct arm_cmn *cmn, int id) {}struct arm_cmn_hw_event {struct arm_cmn_node *dn;u64 dtm_idx[4 ]; -unsigned int dtc_idx; -u8 dtcs_used; +s8 dtc_idx[CMN_MAX_DTCS ];u8 num_dns;u8 dtm_offset;bool wide_sel;
@@ -600,6 +596,10 @@ struct arm_cmn_hw_event {#define for_each_hw_dn (hw, dn, i) \ for (i = 0, dn = hw->dn; i < hw->num_dns; i++, dn++) +/* @i is the DTC number, @idx is the counter index on that DTC */ +#define for_each_hw_dtc_idx (hw, i, idx) \ + for (int i = 0, idx; i < CMN_MAX_DTCS; i++) if ((idx = hw->dtc_idx[i]) >= 0) +static struct arm_cmn_hw_event *to_cmn_hw (struct perf_event *event) {BUILD_BUG_ON (sizeof (struct arm_cmn_hw_event ) > offsetof(struct hw_perf_event , target));
@@ -1429,12 +1429,11 @@ static void arm_cmn_init_counter(struct perf_event *event) {struct arm_cmn *cmn =to_cmn (event->pmu);struct arm_cmn_hw_event *hw =to_cmn_hw (event); -unsigned int i, pmevcnt =CMN_DT_PMEVCNT (hw->dtc_idx);u64 count; -for (i =0 ; hw->dtcs_used & (1U << i); i++) { -writel_relaxed (CMN_COUNTER_INIT , cmn->dtc[i].base + pmevcnt); - cmn->dtc[i].counters[hw->dtc_idx] = event; +for_each_hw_dtc_idx (hw, i, idx) { +writel_relaxed (CMN_COUNTER_INIT , cmn->dtc[i].base +CMN_DT_PMEVCNT (idx)); + cmn->dtc[i].counters[idx] = event; } count =arm_cmn_read_dtm (cmn, hw, false);
@@ -1447,11 +1446,9 @@ static void arm_cmn_event_read(struct perf_event *event)struct arm_cmn_hw_event *hw =to_cmn_hw (event);u64 delta, new, prev;unsigned long flags; -unsigned int i; -if (hw->dtc_idx ==CMN_DT_NUM_COUNTERS ) { - i =__ffs (hw->dtcs_used); - delta =arm_cmn_read_cc (cmn->dtc + i); +if (CMN_EVENT_TYPE (event) ==CMN_TYPE_DTC ) { + delta =arm_cmn_read_cc (cmn->dtc + hw->dtc_idx[0 ]);local64_add (delta, &event->count);return ; }
@@ -1461,8 +1458,8 @@ static void arm_cmn_event_read(struct perf_event *event) delta = new - prev;local_irq_save (flags); -for (i =0 ; hw->dtcs_used & (1U << i); i++) { - new =arm_cmn_read_counter (cmn->dtc + i, hw->dtc_idx); +for_each_hw_dtc_idx (hw, i, idx) { + new =arm_cmn_read_counter (cmn->dtc + i, idx); delta += new <<16 ; }local_irq_restore (flags);
@@ -1518,7 +1515,7 @@ static void arm_cmn_event_start(struct perf_event *event, int flags)int i;if (type ==CMN_TYPE_DTC ) { - i =__ffs (hw->dtcs_used); + i = hw->dtc_idx[0 ];writeq_relaxed (CMN_CC_INIT , cmn->dtc[i].base +CMN_DT_PMCCNTR ); cmn->dtc[i].cc_active = true; }else if (type ==CMN_TYPE_WP ) {
@@ -1549,7 +1546,7 @@ static void arm_cmn_event_stop(struct perf_event *event, int flags)int i;if (type ==CMN_TYPE_DTC ) { - i =__ffs (hw->dtcs_used); + i = hw->dtc_idx[0 ]; cmn->dtc[i].cc_active = false; }else if (type ==CMN_TYPE_WP ) {int wp_idx =arm_cmn_wp_idx (event);
@@ -1735,12 +1732,19 @@ static int arm_cmn_event_init(struct perf_event *event) hw->dn =arm_cmn_node (cmn, type);if (!hw->dn)return -EINVAL ; + +memset (hw->dtc_idx,-1 ,sizeof (hw->dtc_idx));for (dn = hw->dn; dn->type == type; dn++) {if (bynodeid && dn->id != nodeid) { hw->dn++;continue ; } hw->num_dns++; +if (dn->dtc <0 ) +memset (hw->dtc_idx,0 , cmn->num_dtcs); +else + hw->dtc_idx[dn->dtc] =0 ; +if (bynodeid)break ; }
@@ -1752,12 +1756,6 @@ static int arm_cmn_event_init(struct perf_event *event) nodeid, nid.x, nid.y, nid.port, nid.dev, type);return -EINVAL ; } -/* -* Keep assuming non-cycles events count in all DTC domains; turns out -* it's hard to make a worthwhile optimisation around this, short of -* going all-in with domain-local counter allocation as well. -*/ - hw->dtcs_used = (1U << cmn->num_dtcs) -1 ;return arm_cmn_validate_group (cmn, event); }
@@ -1783,28 +1781,25 @@ static void arm_cmn_event_clear(struct arm_cmn *cmn, struct perf_event *event, }memset (hw->dtm_idx,0 ,sizeof (hw->dtm_idx)); -for (i =0 ; hw->dtcs_used & (1U << i); i++) - cmn->dtc[i].counters[hw->dtc_idx] =NULL ; +for_each_hw_dtc_idx (hw, j, idx) + cmn->dtc[j].counters[idx] =NULL ; }static int arm_cmn_event_add (struct perf_event *event,int flags) {struct arm_cmn *cmn =to_cmn (event->pmu);struct arm_cmn_hw_event *hw =to_cmn_hw (event); -struct arm_cmn_dtc *dtc = &cmn->dtc[0 ];struct arm_cmn_node *dn;enum cmn_node_type type =CMN_EVENT_TYPE (event); -unsigned int i, dtc_idx, input_sel; +unsigned int input_sel, i =0 ;if (type ==CMN_TYPE_DTC ) { - i =0 ;while (cmn->dtc[i].cycles)if (++i == cmn->num_dtcs)return -ENOSPC ; cmn->dtc[i].cycles = event; - hw->dtc_idx =CMN_DT_NUM_COUNTERS ; - hw->dtcs_used =1U << i; + hw->dtc_idx[0 ] = i;if (flags &PERF_EF_START )arm_cmn_event_start (event,0 );
@@ -1812,17 +1807,22 @@ static int arm_cmn_event_add(struct perf_event *event, int flags) }/* Grab a free global counter first... */ - dtc_idx =0 ; -while (dtc->counters[dtc_idx]) -if (++dtc_idx ==CMN_DT_NUM_COUNTERS ) -return -ENOSPC ; - - hw->dtc_idx = dtc_idx; +for_each_hw_dtc_idx (hw, j, idx) { +if (j >0 ) { + idx = hw->dtc_idx[0 ]; + }else { + idx =0 ; +while (cmn->dtc[j].counters[idx]) +if (++idx ==CMN_DT_NUM_COUNTERS ) + goto free_dtms; + } + hw->dtc_idx[j] = idx; + }/* ...then the local counters to feed it. */ for_each_hw_dn (hw, dn, i) {struct arm_cmn_dtm *dtm = &cmn->dtms[dn->dtm] + hw->dtm_offset; -unsigned int dtm_idx, shift; +unsigned int dtm_idx, shift, d =0 ;u64 reg; dtm_idx =0 ;
@@ -1841,11 +1841,11 @@ static int arm_cmn_event_add(struct perf_event *event, int flags) tmp = dtm->wp_event[wp_idx ^1 ];if (tmp >=0 &&CMN_EVENT_WP_COMBINE (event) != -CMN_EVENT_WP_COMBINE (dtc->counters[tmp])) +CMN_EVENT_WP_COMBINE (cmn->dtc[d].counters[tmp])) goto free_dtms; input_sel =CMN__PMEVCNT0_INPUT_SEL_WP + wp_idx; - dtm->wp_event[wp_idx] = dtc_idx; + dtm->wp_event[wp_idx] = hw->dtc_idx[d];writel_relaxed (cfg, dtm->base +CMN_DTM_WPn_CONFIG (wp_idx)); }else {struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id);
@@ -1865,7 +1865,7 @@ static int arm_cmn_event_add(struct perf_event *event, int flags) dtm->input_sel[dtm_idx] = input_sel; shift =CMN__PMEVCNTn_GLOBAL_NUM_SHIFT (dtm_idx); dtm->pmu_config_low &= ~(CMN__PMEVCNT0_GLOBAL_NUM << shift); - dtm->pmu_config_low |=FIELD_PREP (CMN__PMEVCNT0_GLOBAL_NUM , dtc_idx) << shift; + dtm->pmu_config_low |=FIELD_PREP (CMN__PMEVCNT0_GLOBAL_NUM , hw->dtc_idx[d]) << shift; dtm->pmu_config_low |=CMN__PMEVCNT_PAIRED (dtm_idx); reg = (u64 )le32_to_cpu (dtm->pmu_config_high) <<32 | dtm->pmu_config_low;writeq_relaxed (reg, dtm->base +CMN_DTM_PMU_CONFIG );
@@ -1893,7 +1893,7 @@ static void arm_cmn_event_del(struct perf_event *event, int flags)arm_cmn_event_stop (event,PERF_EF_UPDATE );if (type ==CMN_TYPE_DTC ) - cmn->dtc[__ffs (hw->dtcs_used)].cycles =NULL ; + cmn->dtc[hw->dtc_idx[0 ]].cycles =NULL ;else arm_cmn_event_clear (cmn, event, hw->num_dns); }
@@ -2074,7 +2074,6 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn) {struct arm_cmn_node *dn, *xp;int dtc_idx =0 ; -u8 dtcs_present = (1 << cmn->num_dtcs) -1 ; cmn->dtc =devm_kcalloc (cmn->dev, cmn->num_dtcs,sizeof (cmn->dtc[0 ]),GFP_KERNEL );if (!cmn->dtc)
@@ -2084,23 +2083,26 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn) cmn->xps =arm_cmn_node (cmn,CMN_TYPE_XP ); +if (cmn->part ==PART_CMN600 && cmn->num_dtcs >1 ) { +/* We do at least know that a DTC's XP must be in that DTC's domain */ + dn =arm_cmn_node (cmn,CMN_TYPE_DTC ); +for (int i =0 ; i < cmn->num_dtcs; i++) +arm_cmn_node_to_xp (cmn, dn + i)->dtc = i; + } +for (dn = cmn->dns; dn->type; dn++) { -if (dn->type ==CMN_TYPE_XP ) { - dn->dtc &= dtcs_present; +if (dn->type ==CMN_TYPE_XP )continue ; - } xp =arm_cmn_node_to_xp (cmn, dn); + dn->dtc = xp->dtc; dn->dtm = xp->dtm;if (cmn->multi_dtm) dn->dtm +=arm_cmn_nid (cmn, dn->id).port /2 ;if (dn->type ==CMN_TYPE_DTC ) { -int err; -/* We do at least know that a DTC's XP must be in that DTC's domain */ -if (xp->dtc ==0xf ) - xp->dtc =1 << dtc_idx; - err =arm_cmn_init_dtc (cmn, dn, dtc_idx++); +int err =arm_cmn_init_dtc (cmn, dn, dtc_idx++); +if (err)return err; }
@@ -2258,9 +2260,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) cmn->mesh_x = xp->logid;if (cmn->part ==PART_CMN600 ) - xp->dtc =0xf ; + xp->dtc =-1 ;else - xp->dtc =1 <<arm_cmn_dtc_domain (cmn, xp_region); + xp->dtc =arm_cmn_dtc_domain (cmn, xp_region); xp->dtm = dtm - cmn->dtms;arm_cmn_init_dtm (dtm++, xp,0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/538 perf/arm-cmn: Improve debugfs pretty-printing for large configs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit a1083ee717e9bde012268782e084d343314490a4 ]
The debugfs pretty-printer was written for the CMN-600 assumptions of a maximum 8x8 mesh, but CMN-700 now allows coordinates and ID values up to 12 and 128 respectively, which can overflow the format strings, mess up the alignment of the table and hurt overall readability. This table does prove useful for double-checking that the driver is picking up the topology of new systems correctly and for verifying user expectations, so tweak the formatting to stay nice and readable with wider values.
Stable-dep-of: e79634b53e39 ("perf/arm-cmn: Refactor node ID handling. Again.")
--- drivers/perf/arm-cmn.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/perf/arm-cmn.c +5 -4
@@ -493,6 +493,7 @@ static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)for (dn = cmn->dns; dn->type; dn++) {struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id); +int pad = dn->logid <10 ;if (dn->type ==CMN_TYPE_XP )continue ;
@@ -503,7 +504,7 @@ static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)if (nid.x != x || nid.y != y || nid.port != p || nid.dev != d)continue ; -seq_printf (s," #%-2d |" , dn->logid); +seq_printf (s," %*c#%-*d |" , pad +1 ,' ' ,3 - pad, dn->logid);return ; }seq_puts (s," |" );
@@ -516,7 +517,7 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)seq_puts (s," X" );for (x =0 ; x < cmn->mesh_x; x++) -seq_printf (s," %d " , x); +seq_printf (s," %-2d " , x);seq_puts (s,"\nY P D+" ); y = cmn->mesh_y;while (y--) {
@@ -526,13 +527,13 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)for (x =0 ; x < cmn->mesh_x; x++)seq_puts (s,"--------+" ); -seq_printf (s,"\n%d |" , y); +seq_printf (s,"\n%-2d |" , y);for (x =0 ; x < cmn->mesh_x; x++) {struct arm_cmn_node *xp = cmn->xps + xp_base + x;for (p =0 ; p <CMN_MAX_PORTS ; p++) port[p][x] =arm_cmn_device_connect_info (cmn, xp, p); -seq_printf (s," XP #%-2d |" , xp_base + x); +seq_printf (s," XP #%-3d|" , xp_base + x); }seq_puts (s,"\n |" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/538 perf/arm-cmn: Refactor node ID handling. Again.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit e79634b53e398966c49f803c49701bc74dc3ccf8 ]
The scope of the "extra device ports" configuration is not made clear by the CMN documentation - so far we've assumed it applies globally, based on the sole example which suggests as much. However it transpires that this is incorrect, and the format does in fact vary based on each individual XP's port configuration. As a consequence, we're currenly liable to decode the port/device indices from a node ID incorrectly, thus program the wrong event source in the DTM leading to bogus event counts, and also show device topology on the wrong ports in debugfs.
To put this right, rework node IDs yet again to carry around the additional data necessary to decode them properly per-XP. At this point the notion of fully decomposing an ID becomes more impractical than it's worth, so unabstracting the XY mesh coordinates (where 2/3 users were just debug anyway) ends up leaving things a bit simpler overall.
--- drivers/perf/arm-cmn.c | 94 ++++++++++++++++++------------------------ 1 file changed, 40 insertions(+), 54 deletions(-)
drivers/perf/arm-cmn.c +40 -54
@@ -24,14 +24,6 @@#define CMN_NI_NODE_ID GENMASK_ULL(31, 16)#define CMN_NI_LOGICAL_ID GENMASK_ULL(47, 32) -#define CMN_NODEID_DEVID (reg) ((reg) & 3) -#define CMN_NODEID_EXT_DEVID (reg) ((reg) & 1) -#define CMN_NODEID_PID (reg) (((reg) >> 2) & 1) -#define CMN_NODEID_EXT_PID (reg) (((reg) >> 1) & 3) -#define CMN_NODEID_1x1_PID (reg) (((reg) >> 2) & 7) -#define CMN_NODEID_X (reg, bits) ((reg) >> (3 + (bits))) -#define CMN_NODEID_Y (reg, bits) (((reg) >> 3) & ((1U << (bits)) - 1)) -#define CMN_CHILD_INFO 0x0080#define CMN_CI_CHILD_COUNT GENMASK_ULL(15, 0)#define CMN_CI_CHILD_PTR_OFFSET GENMASK_ULL(31, 16)
@@ -281,8 +273,11 @@ struct arm_cmn_node {u16 id, logid;enum cmn_node_type type; +/* XP properties really, but replicated to children for convenience */ u8 dtm;s8 dtc; + u8 portid_bits:4; + u8 deviceid_bits:4;/* DN/HN-F/CXHA */ struct {u8 val :4 ;
@@ -358,49 +353,33 @@ struct arm_cmn {static int arm_cmn_hp_state;struct arm_cmn_nodeid { -u8 x; -u8 y;u8 port;u8 dev; };static int arm_cmn_xyidbits (const struct arm_cmn *cmn) { -return fls ((cmn->mesh_x -1 ) | (cmn->mesh_y -1 ) |2 ); +return fls ((cmn->mesh_x -1 ) | (cmn->mesh_y -1 )); } -static struct arm_cmn_nodeid arm_cmn_nid (const struct arm_cmn *cmn,u16 id) +static struct arm_cmn_nodeid arm_cmn_nid (const struct arm_cmn_node *dn) {struct arm_cmn_nodeid nid; -if (cmn->num_xps ==1 ) { - nid.x =0 ; - nid.y =0 ; - nid.port =CMN_NODEID_1x1_PID (id); - nid.dev =CMN_NODEID_DEVID (id); - }else { -int bits =arm_cmn_xyidbits (cmn); - - nid.x =CMN_NODEID_X (id, bits); - nid.y =CMN_NODEID_Y (id, bits); -if (cmn->ports_used &0xc ) { - nid.port =CMN_NODEID_EXT_PID (id); - nid.dev =CMN_NODEID_EXT_DEVID (id); - }else { - nid.port =CMN_NODEID_PID (id); - nid.dev =CMN_NODEID_DEVID (id); - } - } + nid.dev = dn->id & ((1U << dn->deviceid_bits) -1 ); + nid.port = (dn->id >> dn->deviceid_bits) & ((1U << dn->portid_bits) -1 );return nid; }static struct arm_cmn_node *arm_cmn_node_to_xp (const struct arm_cmn *cmn,const struct arm_cmn_node *dn) { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id); -int xp_idx = cmn->mesh_x * nid.y + nid.x; +int id = dn->id >> (dn->portid_bits + dn->deviceid_bits); +int bits =arm_cmn_xyidbits (cmn); +int x = id >> bits; +int y = id & ((1U << bits) -1 ); -return cmn->xps + xp_idx; +return cmn->xps + cmn->mesh_x * y + x; }static struct arm_cmn_node *arm_cmn_node (const struct arm_cmn *cmn,enum cmn_node_type type)
@@ -486,13 +465,13 @@ static const char *arm_cmn_device_type(u8 type) } } -static void arm_cmn_show_logid (struct seq_file *s,int x,int y,int p,int d) +static void arm_cmn_show_logid (struct seq_file *s,const struct arm_cmn_node *xp,int p,int d) {struct arm_cmn *cmn = s->private;struct arm_cmn_node *dn; +u16 id = xp->id | d | (p << xp->deviceid_bits);for (dn = cmn->dns; dn->type; dn++) { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id);int pad = dn->logid <10 ;if (dn->type ==CMN_TYPE_XP )
@@ -501,7 +480,7 @@ static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)if (dn->type <CMN_TYPE_HNI )continue ; -if (nid.x != x || nid.y != y || nid.port != p || nid.dev != d) +if (dn->id != id)continue ;seq_printf (s," %*c#%-*d |" , pad +1 ,' ' ,3 - pad, dn->logid);
@@ -522,6 +501,7 @@ static int arm_cmn_map_show(struct seq_file *s, void *data) y = cmn->mesh_y;while (y--) {int xp_base = cmn->mesh_x * y; +struct arm_cmn_node *xp = cmn->xps + xp_base;u8 port[CMN_MAX_PORTS ][CMN_MAX_DIMENSION ];for (x =0 ; x < cmn->mesh_x; x++)
@@ -529,16 +509,14 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)seq_printf (s,"\n%-2d |" , y);for (x =0 ; x < cmn->mesh_x; x++) { -struct arm_cmn_node *xp = cmn->xps + xp_base + x; -for (p =0 ; p <CMN_MAX_PORTS ; p++) - port[p][x] =arm_cmn_device_connect_info (cmn, xp, p); + port[p][x] =arm_cmn_device_connect_info (cmn, xp + x, p);seq_printf (s," XP #%-3d|" , xp_base + x); }seq_puts (s,"\n |" );for (x =0 ; x < cmn->mesh_x; x++) { -s8 dtc = cmn->xps[xp_base + x].dtc; +s8 dtc = xp[x].dtc;if (dtc <0 )seq_puts (s," DTC ?? |" );
@@ -555,10 +533,10 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)seq_puts (s,arm_cmn_device_type (port[p][x]));seq_puts (s,"\n 0|" );for (x =0 ; x < cmn->mesh_x; x++) -arm_cmn_show_logid (s, x, y, p,0 ); +arm_cmn_show_logid (s, xp + x, p,0 );seq_puts (s,"\n 1|" );for (x =0 ; x < cmn->mesh_x; x++) -arm_cmn_show_logid (s, x, y, p,1 ); +arm_cmn_show_logid (s, xp + x, p,1 ); }seq_puts (s,"\n-----+" ); }
@@ -1751,10 +1729,7 @@ static int arm_cmn_event_init(struct perf_event *event) }if (!hw->num_dns) { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, nodeid); - -dev_dbg (cmn->dev,"invalid node 0x%x (%d,%d,%d,%d) type 0x%x\n" , - nodeid, nid.x, nid.y, nid.port, nid.dev, type); +dev_dbg (cmn->dev,"invalid node 0x%x type 0x%x\n" , nodeid, type);return -EINVAL ; }
@@ -1849,7 +1824,7 @@ static int arm_cmn_event_add(struct perf_event *event, int flags) dtm->wp_event[wp_idx] = hw->dtc_idx[d];writel_relaxed (cfg, dtm->base +CMN_DTM_WPn_CONFIG (wp_idx)); }else { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id); +struct arm_cmn_nodeid nid =arm_cmn_nid (dn);if (cmn->multi_dtm) nid.port %=2 ;
@@ -2096,10 +2071,12 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn)continue ; xp =arm_cmn_node_to_xp (cmn, dn); + dn->portid_bits = xp->portid_bits; + dn->deviceid_bits = xp->deviceid_bits; dn->dtc = xp->dtc; dn->dtm = xp->dtm;if (cmn->multi_dtm) - dn->dtm +=arm_cmn_nid (cmn, dn->id).port /2 ; + dn->dtm +=arm_cmn_nid (dn).port /2 ;if (dn->type ==CMN_TYPE_DTC ) {int err =arm_cmn_init_dtc (cmn, dn, dtc_idx++);
@@ -2269,18 +2246,27 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)arm_cmn_init_dtm (dtm++, xp,0 );/* * Keeping track of connected ports will let us filter out -* unnecessary XP events easily. We can also reliably infer the -* "extra device ports" configuration for the node ID format -* from this, since in that case we will see at least one XP -* with port 2 connected, for the HN-D. +* unnecessary XP events easily, and also infer the per-XP +* part of the node ID format. */ for (int p =0 ; p <CMN_MAX_PORTS ; p++)if (arm_cmn_device_connect_info (cmn, xp, p)) xp_ports |=BIT (p); -if (cmn->multi_dtm && (xp_ports &0xc )) +if (cmn->num_xps ==1 ) { + xp->portid_bits =3 ; + xp->deviceid_bits =2 ; + }else if (xp_ports >0x3 ) { + xp->portid_bits =2 ; + xp->deviceid_bits =1 ; + }else { + xp->portid_bits =1 ; + xp->deviceid_bits =2 ; + } + +if (cmn->multi_dtm && (xp_ports >0x3 ))arm_cmn_init_dtm (dtm++, xp,1 ); -if (cmn->multi_dtm && (xp_ports &0x30 )) +if (cmn->multi_dtm && (xp_ports >0xf ))arm_cmn_init_dtm (dtm++, xp,2 ); cmn->ports_used |= xp_ports;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/538 perf/arm-cmn: Fix CCLA register offset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit 88b63a82c84ed9bbcbdefb10cb6f75dd1dd04887 ]
Apparently pmu_event_sel is offset by 8 for all CCLA nodes, not just the CCLA_RNI combination type.
--- drivers/perf/arm-cmn.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/perf/arm-cmn.c +7 -3
@@ -70,7 +70,8 @@/* Technically this is 4 bits wide on DNs, but we only use 2 there anyway */ #define CMN__PMU_OCCUP1_ID GENMASK_ULL(34, 32) -/* HN-Ps are weird... */ +/* Some types are designed to coexist with another device in the same node */ +#define CMN_CCLA_PMU_EVENT_SEL 0x008#define CMN_HNP_PMU_EVENT_SEL 0x008/* DTMs live in the PMU space of XP registers */
@@ -2321,10 +2322,13 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)case CMN_TYPE_CXHA :case CMN_TYPE_CCRA :case CMN_TYPE_CCHA : -case CMN_TYPE_CCLA :case CMN_TYPE_HNS : dn++;break ; +case CMN_TYPE_CCLA : + dn->pmu_base +=CMN_CCLA_PMU_EVENT_SEL ; + dn++; +break ;/* Nothing to see here */ case CMN_TYPE_MPAM_S :case CMN_TYPE_MPAM_NS :
@@ -2342,7 +2346,7 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)case CMN_TYPE_HNP :case CMN_TYPE_CCLA_RNI : dn[1 ] = dn[0 ]; - dn[0 ].pmu_base +=CMN_HNP_PMU_EVENT_SEL ; + dn[0 ].pmu_base +=CMN_CCLA_PMU_EVENT_SEL ; dn[1 ].type =arm_cmn_subtype (dn->type); dn +=2 ;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/538 perf/arm-cmn: Ensure dtm_idx is big enough
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit 359414b33e00bae91e4eabf3e4ef8e76024c7673 ]
While CMN_MAX_DIMENSION was bumped to 12 for CMN-650, that only supports up to a 10x10 mesh, so bumping dtm_idx to 256 bits at the time worked out OK in practice. However CMN-700 did finally support up to 144 XPs, and thus needs a worst-case 288 bits of dtm_idx for an aggregated XP event on a maxed-out config. Oops.
--- drivers/perf/arm-cmn.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/perf/arm-cmn.c +4 -1
@@ -35,6 +35,9 @@#define CMN_MAX_XPS (CMN_MAX_DIMENSION * CMN_MAX_DIMENSION)#define CMN_MAX_DTMS (CMN_MAX_XPS + (CMN_MAX_DIMENSION - 1) * 4) +/* Currently XPs are the node type we can have most of; others top out at 128 */ +#define CMN_MAX_NODES_PER_EVENT CMN_MAX_XPS +/* The CFG node has various info besides the discovery tree */ #define CMN_CFGM_PERIPH_ID_01 0x0008#define CMN_CFGM_PID0_PART_0 GENMASK_ULL(7, 0)
@@ -565,7 +568,7 @@ static void arm_cmn_debugfs_init(struct arm_cmn *cmn, int id) {}struct arm_cmn_hw_event {struct arm_cmn_node *dn; -u64 dtm_idx[4 ]; +u64 dtm_idx[DIV_ROUND_UP (CMN_MAX_NODES_PER_EVENT *2 ,64 )];s8 dtc_idx[CMN_MAX_DTCS ];u8 num_dns;u8 dtm_offset;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/538 cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
[ Upstream commit abc00ffda43bd4ba85896713464c7510c39f8165 ]
Commit b4bc9f9e27ed ("cpufreq: ti-cpufreq: add support for omap34xx and omap36xx") introduced special handling for OMAP3 class devices where syscon node may not be present. However, this also creates a bug where the syscon node is present, however the offset used to read is beyond the syscon defined range.
Fix this by providing a quirk option that is populated when such special handling is required. This allows proper failure for all other platforms when the syscon node and efuse offsets are mismatched.
--- drivers/cpufreq/ti-cpufreq.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/cpufreq/ti-cpufreq.c +8 -2
@@ -61,6 +61,9 @@ struct ti_cpufreq_soc_data {unsigned long efuse_shift;unsigned long rev_offset;bool multi_regulator; +/* Backward compatibility hack: Might have missing syscon */ +#define TI_QUIRK_SYSCON_MAY_BE_MISSING 0x1 +u8 quirks; };struct ti_cpufreq_data {
@@ -182,6 +185,7 @@ static struct ti_cpufreq_soc_data omap34xx_soc_data = { .efuse_mask = BIT(3), .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = false, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };/*
@@ -209,6 +213,7 @@ static struct ti_cpufreq_soc_data omap36xx_soc_data = { .efuse_mask = BIT(9), .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = true, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };/*
@@ -223,6 +228,7 @@ static struct ti_cpufreq_soc_data am3517_soc_data = { .efuse_mask = 0, .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = false, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };static struct ti_cpufreq_soc_data am625_soc_data = {
@@ -250,7 +256,7 @@ static int ti_cpufreq_get_efuse(struct ti_cpufreq_data *opp_data, ret =regmap_read (opp_data->syscon, opp_data->soc_data->efuse_offset, &efuse); -if (ret == -EIO ) { +if (opp_data->soc_data->quirks &TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO ) {/* not a syscon register! */ void __iomem *regs =ioremap (OMAP3_SYSCON_BASE + opp_data->soc_data->efuse_offset,4 );
@@ -291,7 +297,7 @@ static int ti_cpufreq_get_rev(struct ti_cpufreq_data *opp_data, ret =regmap_read (opp_data->syscon, opp_data->soc_data->rev_offset, &revision); -if (ret == -EIO ) { +if (opp_data->soc_data->quirks &TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO ) {/* not a syscon register! */ void __iomem *regs =ioremap (OMAP3_SYSCON_BASE + opp_data->soc_data->rev_offset,4 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/538 wifi: mt76: mt7915: fix oops on non-dbdc mt7986
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <[email protected]>
[ Upstream commit 862bf7cbd772c2bad570ef0c5b5556a1330656dd ]
mt7915_band_config() sets band_idx = 1 on the main phy for mt7986 with MT7975_ONE_ADIE or MT7976_ONE_ADIE.
Commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status") introduced a dereference of the phys array indirectly indexed by band_idx via wcid->phy_idx in mt76_wcid_cleanup(). This caused the following Oops on affected mt7986 devices:
Unable to handle kernel read from unreadable memory at virtual address 0000000000000024 Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005 CM = 0, WnR = 0 user pgtable: 4k pages, 39-bit VAs, pgdp=0000000042545000 [0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 Internal error: Oops: 0000000096000005 [#1] SMP Modules linked in: ... mt7915e mt76_connac_lib mt76 mac80211 cfg80211 ... CPU: 2 PID: 1631 Comm: hostapd Not tainted 5.15.150 #0 Hardware name: ZyXEL EX5700 (Telenor) (DT) pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mt76_wcid_cleanup+0x84/0x22c [mt76] lr : mt76_wcid_cleanup+0x64/0x22c [mt76] sp : ffffffc00a803700 x29: ffffffc00a803700 x28: ffffff80008f7300 x27: ffffff80003f3c00 x26: ffffff80000a7880 x25: ffffffc008c26e00 x24: 0000000000000001 x23: ffffffc000a68114 x22: 0000000000000000 x21: ffffff8004172cc8 x20: ffffffc00a803748 x19: ffffff8004152020 x18: 0000000000000000 x17: 00000000000017c0 x16: ffffffc008ef5000 x15: 0000000000000be0 x14: ffffff8004172e28 x13: ffffff8004172e28 x12: 0000000000000000 x11: 0000000000000000 x10: ffffff8004172e30 x9 : ffffff8004172e28 x8 : 0000000000000000 x7 : ffffff8004156020 x6 : 0000000000000000 x5 : 0000000000000031 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000000 x1 : ffffff80008f7300 x0 : 0000000000000024 Call trace: mt76_wcid_cleanup+0x84/0x22c [mt76] __mt76_sta_remove+0x70/0xbc [mt76] mt76_sta_state+0x8c/0x1a4 [mt76] mt7915_eeprom_get_power_delta+0x11e4/0x23a0 [mt7915e] drv_sta_state+0x144/0x274 [mac80211] sta_info_move_state+0x1cc/0x2a4 [mac80211] sta_set_sinfo+0xaf8/0xc24 [mac80211] sta_info_destroy_addr_bss+0x4c/0x6c [mac80211] ieee80211_color_change_finish+0x1c08/0x1e70 [mac80211] cfg80211_check_station_change+0x1360/0x4710 [cfg80211] genl_family_rcv_msg_doit+0xb4/0x110 genl_rcv_msg+0xd0/0x1bc netlink_rcv_skb+0x58/0x120 genl_rcv+0x34/0x50 netlink_unicast+0x1f0/0x2ec netlink_sendmsg+0x198/0x3d0 ____sys_sendmsg+0x1b0/0x210 ___sys_sendmsg+0x80/0xf0 __sys_sendmsg+0x44/0xa0 __arm64_sys_sendmsg+0x20/0x30 invoke_syscall.constprop.0+0x4c/0xe0 do_el0_svc+0x40/0xd0 el0_svc+0x14/0x4c el0t_64_sync_handler+0x100/0x110 el0t_64_sync+0x15c/0x160 Code: d2800002 910092c0 52800023 f9800011 (885f7c01) ---[ end trace 7e42dd9a39ed2281 ]---
Fix by using mt76_dev_phy() which will map band_idx to the correct phy for all hardware combinations.
--- drivers/net/wireless/mediatek/mt76/mac80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mac80211.c +1 -1
@@ -1503,7 +1503,7 @@ EXPORT_SYMBOL_GPL(mt76_wcid_init);void mt76_wcid_cleanup (struct mt76_dev *dev,struct mt76_wcid *wcid) { -struct mt76_phy *phy = dev->phys[wcid->phy_idx]; +struct mt76_phy *phy =mt76_dev_phy (dev, wcid->phy_idx);struct ieee80211_hw *hw;struct sk_buff_head list;struct sk_buff *skb;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/538 wifi: mt76: mt7996: use hweight16 to get correct tx antenna
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chiu <[email protected]>
[ Upstream commit f98c3de92bb05dac4a4969df8a4595ed380b4604 ]
The chainmask is u16 so using hweight8 cannot get correct tx_ant. Without this patch, the tx_ant of band 2 would be -1 and lead to the following issue:
BUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]
--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +1 -1
@@ -1412,7 +1412,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb, {struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;struct mt7996_phy *phy = mvif->phy; -int tx_ant =hweight8 (phy->mt76->chainmask) -1 ; +int tx_ant =hweight16 (phy->mt76->chainmask) -1 ;struct sta_rec_bf *bf;struct tlv *tlv;const u8 matrix[4 ][4 ] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/538 wifi: mt76: mt7996: fix traffic delay when switching back to working channel
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chiu <[email protected]>
[ Upstream commit 376200f095d0c3a7096199b336204698d7086279 ]
During scanning, UNI_CHANNEL_RX_PATH tag is necessary for the firmware to properly stop and resume MAC TX queue. Without this tag, HW needs more time to resume traffic when switching back to working channel.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +4 -0
@@ -287,6 +287,10 @@ int mt7996_set_channel(struct mt7996_phy *phy)if (ret) goto out; + ret =mt7996_mcu_set_chan_info (phy,UNI_CHANNEL_RX_PATH ); +if (ret) + goto out; + ret =mt7996_dfs_init_radar_detector (phy);mt7996_mac_cca_stats_reset (phy);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/538 wifi: mt76: mt7996: fix wmm set of station interface to 3
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chiu <[email protected]>
[ Upstream commit 9265397caacf5c0c2d10c40b2958a474664ebd9e ]
According to connac3 HW design, the WMM index of AP and STA interface should be 0 and 3, respectively.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +1 -1
@@ -190,7 +190,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw, mvif->mt76.omac_idx = idx; mvif->phy = phy; mvif->mt76.band_idx = band_idx; - mvif->mt76.wmm_idx = vif->type !=NL80211_IFTYPE_AP ; + mvif->mt76.wmm_idx = vif->type ==NL80211_IFTYPE_AP ?0 :3 ; ret =mt7996_mcu_add_dev_info (phy, vif, true);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/538 wifi: mt76: mt7996: fix HE and EHT beamforming capabilities
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Howard Hsu <[email protected]>
[ Upstream commit e1f4847fdbdf5d44ae60e035c131920e5ab88598 ]
Fix HE and EHT beamforming capabilities for different bands and interface types.
--- .../net/wireless/mediatek/mt76/mt7996/init.c | 65 ++++++++++++------- 1 file changed, 43 insertions(+), 22 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/init.c +43 -22
@@ -561,8 +561,6 @@ mt7996_set_stream_he_txbf_caps(struct mt7996_phy *phy,return ; elem->phy_cap_info[3 ] |=IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER ; -if (vif ==NL80211_IFTYPE_AP ) - elem->phy_cap_info[4 ] |=IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER ; c =FIELD_PREP (IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK , sts - 1) |
@@ -570,6 +568,11 @@ mt7996_set_stream_he_txbf_caps(struct mt7996_phy *phy, sts - 1); elem->phy_cap_info[5 ] |= c; +if (vif !=NL80211_IFTYPE_AP ) +return ; + + elem->phy_cap_info[4 ] |=IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER ; + c =IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB ; elem->phy_cap_info[6 ] |= c;
@@ -729,7 +732,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,IEEE80211_EHT_MAC_CAP0_OM_CONTROL ; eht_cap_elem->phy_cap_info[0 ] = -IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE ;
@@ -743,30 +745,36 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,u8_encode_bits (u8_get_bits (val,GENMASK (2 ,1 )),IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK ) |u8_encode_bits (val, -IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK ) | -u8_encode_bits (val, -IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK ); +IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK ); eht_cap_elem->phy_cap_info[2 ] =u8_encode_bits (sts -1 ,IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK ) | -u8_encode_bits (sts -1 ,IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK ) | -u8_encode_bits (sts -1 ,IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK ); +u8_encode_bits (sts -1 ,IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK ); + +if (band ==NL80211_BAND_6GHZ ) { + eht_cap_elem->phy_cap_info[0 ] |= +IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ ; + + eht_cap_elem->phy_cap_info[1 ] |= +u8_encode_bits (val, +IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK ); + + eht_cap_elem->phy_cap_info[2 ] |= +u8_encode_bits (sts -1 , +IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK ); + } eht_cap_elem->phy_cap_info[3 ] =IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK | -IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK | -IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK | -IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK | -IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK ; +IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK ; eht_cap_elem->phy_cap_info[4 ] =u8_encode_bits (min_t (int, sts -1 ,2 ),IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK ); eht_cap_elem->phy_cap_info[5 ] = -IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |u8_encode_bits (IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US ,IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK ) | u8_encode_bits(u8_get_bits(0x11, GENMASK(1, 0)),
@@ -780,14 +788,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band, IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK) |u8_encode_bits (val,IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK ); - eht_cap_elem->phy_cap_info[7 ] = -IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ | -IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ | -IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ | -IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ | -IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ | -IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ ; - val =u8_encode_bits (nss,IEEE80211_EHT_MCS_NSS_RX ) |u8_encode_bits (nss,IEEE80211_EHT_MCS_NSS_TX );#define SET_EHT_MAX_NSS (_bw, _val) do { \
@@ -798,8 +798,29 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,SET_EHT_MAX_NSS (80 , val);SET_EHT_MAX_NSS (160 , val); -SET_EHT_MAX_NSS (320 , val); +if (band ==NL80211_BAND_6GHZ ) +SET_EHT_MAX_NSS (320 , val);#undef SET_EHT_MAX_NSS + +if (iftype !=NL80211_IFTYPE_AP ) +return ; + + eht_cap_elem->phy_cap_info[3 ] |= +IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK | +IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK ; + + eht_cap_elem->phy_cap_info[7 ] = +IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ | +IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ | +IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ | +IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ ; + +if (band !=NL80211_BAND_6GHZ ) +return ; + + eht_cap_elem->phy_cap_info[7 ] |= +IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ | +IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ ; } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/538 wifi: mt76: mt7996: fix EHT beamforming capability check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Howard Hsu <[email protected]>
[ Upstream commit 9ca65757f0a5b393a7737d37f377d5daf91716af ]
If a VIF acts as a beamformer, it should check peer's beamformee capability, and vice versa.
--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +2 -2
@@ -1188,10 +1188,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,if (bfee)return vif->bss_conf.eht_su_beamformee && -EHT_PHY (CAP0_SU_BEAMFORMEE , pe->phy_cap_info[0 ]); +EHT_PHY (CAP0_SU_BEAMFORMER , pe->phy_cap_info[0 ]);else return vif->bss_conf.eht_su_beamformer && -EHT_PHY (CAP0_SU_BEAMFORMER , pe->phy_cap_info[0 ]); +EHT_PHY (CAP0_SU_BEAMFORMEE , pe->phy_cap_info[0 ]); }if (sta->deflink.he_cap.has_he) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/538 x86/sgx: Fix deadlock in SGX NUMA node search
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Lu <[email protected]>
[ Upstream commit 9c936844010466535bd46ea4ce4656ef17653644 ]
When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask.
Also worth mentioning is that it's perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality.
Rework the loop to start and end on *a* node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.
--- arch/x86/kernel/cpu/sgx/main.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
arch/x86/kernel/cpu/sgx/main.c +14 -13
@@ -474,24 +474,25 @@ struct sgx_epc_page *__sgx_alloc_epc_page(void) {struct sgx_epc_page *page;int nid_of_current =numa_node_id (); -int nid = nid_of_current; +int nid_start, nid; -if (node_isset (nid_of_current, sgx_numa_mask)) { - page =__sgx_alloc_epc_page_from_node (nid_of_current); -if (page) -return page; - } - -/* Fall back to the non-local NUMA nodes: */ -while (true) { - nid =next_node_in (nid, sgx_numa_mask); -if (nid == nid_of_current) -break ; +/* +* Try local node first. If it doesn't have an EPC section, +* fall back to the non-local NUMA nodes. +*/ +if (node_isset (nid_of_current, sgx_numa_mask)) + nid_start = nid_of_current; +else + nid_start =next_node_in (nid_of_current, sgx_numa_mask); + nid = nid_start; +do { page =__sgx_alloc_epc_page_from_node (nid);if (page)return page; - } + + nid =next_node_in (nid, sgx_numa_mask); + }while (nid != nid_start);return ERR_PTR (-ENOMEM ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/538 pm:cpupower: Add missing powercap_set_enabled() stub function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John B. Wyatt IV <[email protected]>
[ Upstream commit 4b80294fb53845dc5c98cca0c989da09150f2ca9 ]
There was a symbol listed in the powercap.h file that was not implemented. Implement it with a stub return of 0.
Programs like SWIG require that functions that are defined in the headers be implemented.
--- tools/power/cpupower/lib/powercap.c | 8 ++++++++ 1 file changed, 8 insertions(+)
tools/power/cpupower/lib/powercap.c +8 -0
@@ -77,6 +77,14 @@ int powercap_get_enabled(int *mode)return sysfs_get_enabled (path, mode); } +/* +* TODO: implement function. Returns dummy 0 for now. +*/ +int powercap_set_enabled (int mode) +{ +return 0 ; +} +/* * Hardcoded, because rapl is the only powercap implementation - * this needs to get more generic if more powercap implementations
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/538 crypto: hisilicon/hpre - mask cluster timeout error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit 145013f723947c83b1a5f76a0cf6e7237d59e973 ]
The timeout threshold of the hpre cluster is 16ms. When the CPU and device share virtual address, page fault processing time may exceed the threshold.
In the current test, there is a high probability that the cluster times out. However, the cluster is waiting for the completion of memory access, which is not an error, the device does not need to be reset. If an error occurs in the cluster, qm also reports the error. Therefore, the cluster timeout error of hpre can be masked.
--- drivers/crypto/hisilicon/hpre/hpre_main.c | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-)
drivers/crypto/hisilicon/hpre/hpre_main.c +6 -16
@@ -13,9 +13,7 @@#include <linux/uacce.h> #include "hpre.h" -#define HPRE_QM_ABNML_INT_MASK 0x100004#define HPRE_CTRL_CNT_CLR_CE_BIT BIT(0) -#define HPRE_COMM_CNT_CLR_CE 0x0#define HPRE_CTRL_CNT_CLR_CE 0x301000#define HPRE_FSM_MAX_CNT 0x301008#define HPRE_VFG_AXQOS 0x30100c
@@ -42,7 +40,6 @@#define HPRE_HAC_INT_SET 0x301500#define HPRE_RNG_TIMEOUT_NUM 0x301A34#define HPRE_CORE_INT_ENABLE 0 -#define HPRE_CORE_INT_DISABLE GENMASK(21, 0)#define HPRE_RDCHN_INI_ST 0x301a00#define HPRE_CLSTR_BASE 0x302000#define HPRE_CORE_EN_OFFSET 0x04
@@ -66,7 +63,6 @@#define HPRE_CLSTR_ADDR_INTRVL 0x1000#define HPRE_CLUSTER_INQURY 0x100#define HPRE_CLSTR_ADDR_INQRY_RSLT 0x104 -#define HPRE_TIMEOUT_ABNML_BIT 6#define HPRE_PASID_EN_BIT 9#define HPRE_REG_RD_INTVRL_US 10#define HPRE_REG_RD_TMOUT_US 1000
@@ -202,9 +198,9 @@ static const struct hisi_qm_cap_info hpre_basic_info[] = { {HPRE_QM_RESET_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0xC37, 0x6C37}, {HPRE_QM_OOO_SHUTDOWN_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0x4, 0x6C37}, {HPRE_QM_CE_MASK_CAP, 0x312C, 0, GENMASK(31, 0), 0x0, 0x8, 0x8}, - {HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFFFE}, - {HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFFFE}, - {HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFFFE}, + {HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFC3E}, + {HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFC3E}, + {HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFC3E}, {HPRE_CE_MASK_CAP, 0x3138, 0, GENMASK(31, 0), 0x0, 0x1, 0x1}, {HPRE_CLUSTER_NUM_CAP, 0x313c, 20, GENMASK(3, 0), 0x0, 0x4, 0x1}, {HPRE_CORE_TYPE_NUM_CAP, 0x313c, 16, GENMASK(3, 0), 0x0, 0x2, 0x2},
@@ -653,11 +649,6 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)writel (HPRE_QM_USR_CFG_MASK , qm->io_base +QM_AWUSER_M_CFG_ENABLE );writel_relaxed (HPRE_QM_AXI_CFG_MASK , qm->io_base +QM_AXI_M_CFG ); -/* HPRE need more time, we close this interrupt */ - val =readl_relaxed (qm->io_base +HPRE_QM_ABNML_INT_MASK ); - val |=BIT (HPRE_TIMEOUT_ABNML_BIT ); -writel_relaxed (val, qm->io_base +HPRE_QM_ABNML_INT_MASK ); -if (qm->ver >=QM_HW_V3 )writel (HPRE_RSA_ENB |HPRE_ECC_ENB , qm->io_base +HPRE_TYPES_ENB );
@@ -666,9 +657,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)writel (HPRE_QM_VFG_AX_MASK , qm->io_base +HPRE_VFG_AXCACHE );writel (0x0 , qm->io_base +HPRE_BD_ENDIAN ); -writel (0x0 , qm->io_base +HPRE_INT_MASK );writel (0x0 , qm->io_base +HPRE_POISON_BYPASS ); -writel (0x0 , qm->io_base +HPRE_COMM_CNT_CLR_CE );writel (0x0 , qm->io_base +HPRE_ECC_BYPASS );writel (HPRE_BD_USR_MASK , qm->io_base +HPRE_BD_ARUSR_CFG );
@@ -758,7 +747,7 @@ static void hpre_hw_error_disable(struct hisi_qm *qm)static void hpre_hw_error_enable (struct hisi_qm *qm) { -u32 ce, nfe; +u32 ce, nfe, err_en; ce =hisi_qm_get_hw_info (qm, hpre_basic_info,HPRE_CE_MASK_CAP , qm->cap_ver); nfe =hisi_qm_get_hw_info (qm, hpre_basic_info,HPRE_NFE_MASK_CAP , qm->cap_ver);
@@ -775,7 +764,8 @@ static void hpre_hw_error_enable(struct hisi_qm *qm)hpre_master_ooo_ctrl (qm, true);/* enable hpre hw error interrupts */ -writel (HPRE_CORE_INT_ENABLE , qm->io_base +HPRE_INT_MASK ); + err_en = ce | nfe |HPRE_HAC_RAS_FE_ENABLE ; +writel (~err_en, qm->io_base +HPRE_INT_MASK ); }static inline struct hisi_qm *hpre_file_to_qm (struct hpre_debugfs_file *file)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/538 crypto: hisilicon/qm - reset device before enabling it
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit 5d2d1ee0874c26b8010ddf7f57e2f246e848af38 ]
Before the device is enabled again, the device may still store the previously processed data. If an error occurs in the previous task, the device may fail to be enabled again. Therefore, before enabling device, reset the device to restore the initial state.
Stable-dep-of: b04f06fc0243 ("crypto: hisilicon/qm - inject error before stopping queue")
--- drivers/crypto/hisilicon/hpre/hpre_main.c | 32 +++--- drivers/crypto/hisilicon/qm.c | 114 +++++++++++++++------- drivers/crypto/hisilicon/sec2/sec_main.c | 16 ++- drivers/crypto/hisilicon/zip/zip_main.c | 23 +++-- 4 files changed, 121 insertions(+), 64 deletions(-)
drivers/crypto/hisilicon/hpre/hpre_main.c +19 -13
@@ -353,6 +353,8 @@ static struct dfx_diff_registers hpre_diff_regs[] = { }, }; +static const struct hisi_qm_err_ini hpre_err_ini; +bool hpre_check_alg_support (struct hisi_qm *qm,u32 alg) {u32 cap_val;
@@ -1151,6 +1153,7 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) qm->qp_num = pf_q_num; qm->debug.curr_qm_qp_num = pf_q_num; qm->qm_list = &hpre_devices; + qm->err_ini = &hpre_err_ini;if (pf_q_num_flag)set_bit (QM_MODULE_PARAM , &qm->misc_ctl); }
@@ -1340,8 +1343,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)hpre_open_sva_prefetch (qm); - qm->err_ini = &hpre_err_ini; - qm->err_ini->err_info_init (qm);hisi_qm_dev_err_init (qm); ret =hpre_show_last_regs_init (qm);if (ret)
@@ -1370,6 +1371,18 @@ static int hpre_probe_init(struct hpre *hpre)return 0 ; } +static void hpre_probe_uninit (struct hisi_qm *qm) +{ +if (qm->fun_type ==QM_HW_VF ) +return ; + +hpre_cnt_regs_clear (qm); + qm->debug.curr_qm_qp_num =0 ; +hpre_show_last_regs_uninit (qm); +hpre_close_sva_prefetch (qm); +hisi_qm_dev_err_uninit (qm); +} +static int hpre_probe (struct pci_dev *pdev,const struct pci_device_id *id) {struct hisi_qm *qm;
@@ -1395,7 +1408,7 @@ static int hpre_probe(struct pci_dev *pdev, const struct pci_device_id *id) ret =hisi_qm_start (qm);if (ret) - goto err_with_err_init; + goto err_with_probe_init; ret =hpre_debugfs_init (qm);if (ret)
@@ -1432,9 +1445,8 @@ static int hpre_probe(struct pci_dev *pdev, const struct pci_device_id *id)hpre_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -err_with_err_init: -hpre_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); +err_with_probe_init: +hpre_probe_uninit (qm); err_with_qm_init:hisi_qm_uninit (qm);
@@ -1455,13 +1467,7 @@ static void hpre_remove(struct pci_dev *pdev)hpre_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -if (qm->fun_type ==QM_HW_PF ) { -hpre_cnt_regs_clear (qm); - qm->debug.curr_qm_qp_num =0 ; -hpre_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); - } - +hpre_probe_uninit (qm);hisi_qm_uninit (qm); }
drivers/crypto/hisilicon/qm.c +80 -34
183 lines not on this page · raw message
drivers/crypto/hisilicon/sec2/sec_main.c +7 -9
@@ -1061,9 +1061,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)struct hisi_qm *qm = &sec->qm;int ret; - qm->err_ini = &sec_err_ini; - qm->err_ini->err_info_init (qm); - ret =sec_set_user_domain_and_cache (qm);if (ret)return ret;
@@ -1118,6 +1115,7 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) qm->qp_num = pf_q_num; qm->debug.curr_qm_qp_num = pf_q_num; qm->qm_list = &sec_devices; + qm->err_ini = &sec_err_ini;if (pf_q_num_flag)set_bit (QM_MODULE_PARAM , &qm->misc_ctl); }else if (qm->fun_type ==QM_HW_VF && qm->ver ==QM_HW_V1 ) {
@@ -1182,6 +1180,12 @@ static int sec_probe_init(struct sec_dev *sec)static void sec_probe_uninit (struct hisi_qm *qm) { +if (qm->fun_type ==QM_HW_VF ) +return ; + +sec_debug_regs_clear (qm); +sec_show_last_regs_uninit (qm); +sec_close_sva_prefetch (qm);hisi_qm_dev_err_uninit (qm); }
@@ -1274,7 +1278,6 @@ static int sec_probe(struct pci_dev *pdev, const struct pci_device_id *id)sec_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); err_probe_uninit: -sec_show_last_regs_uninit (qm);sec_probe_uninit (qm); err_qm_uninit:sec_qm_uninit (qm);
@@ -1296,11 +1299,6 @@ static void sec_remove(struct pci_dev *pdev)sec_debugfs_exit (qm); (void )hisi_qm_stop (qm,QM_NORMAL ); - -if (qm->fun_type ==QM_HW_PF ) -sec_debug_regs_clear (qm); -sec_show_last_regs_uninit (qm); -sec_probe_uninit (qm);sec_qm_uninit (qm);
drivers/crypto/hisilicon/zip/zip_main.c +15 -8
@@ -1150,8 +1150,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) hisi_zip->ctrl = ctrl; ctrl->hisi_zip = hisi_zip; - qm->err_ini = &hisi_zip_err_ini; - qm->err_ini->err_info_init (qm); ret =hisi_zip_set_user_domain_and_cache (qm);if (ret)
@@ -1212,6 +1210,7 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) qm->qp_num = pf_q_num; qm->debug.curr_qm_qp_num = pf_q_num; qm->qm_list = &zip_devices; + qm->err_ini = &hisi_zip_err_ini;if (pf_q_num_flag)set_bit (QM_MODULE_PARAM , &qm->misc_ctl); }else if (qm->fun_type ==QM_HW_VF && qm->ver ==QM_HW_V1 ) {
@@ -1278,6 +1277,16 @@ static int hisi_zip_probe_init(struct hisi_zip *hisi_zip)return 0 ; } +static void hisi_zip_probe_uninit (struct hisi_qm *qm) +{ +if (qm->fun_type ==QM_HW_VF ) +return ; + +hisi_zip_show_last_regs_uninit (qm); +hisi_zip_close_sva_prefetch (qm); +hisi_qm_dev_err_uninit (qm); +} +static int hisi_zip_probe (struct pci_dev *pdev,const struct pci_device_id *id) {struct hisi_zip *hisi_zip;
@@ -1304,7 +1313,7 @@ static int hisi_zip_probe(struct pci_dev *pdev, const struct pci_device_id *id) ret =hisi_qm_start (qm);if (ret) - goto err_dev_err_uninit; + goto err_probe_uninit; ret =hisi_zip_debugfs_init (qm);if (ret)
@@ -1341,9 +1350,8 @@ static int hisi_zip_probe(struct pci_dev *pdev, const struct pci_device_id *id)hisi_zip_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -err_dev_err_uninit: -hisi_zip_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); +err_probe_uninit: +hisi_zip_probe_uninit (qm); err_qm_uninit:hisi_zip_qm_uninit (qm);
@@ -1364,8 +1372,7 @@ static void hisi_zip_remove(struct pci_dev *pdev)hisi_zip_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -hisi_zip_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); +hisi_zip_probe_uninit (qm);hisi_zip_qm_uninit (qm); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/538 crypto: hisilicon/qm - inject error before stopping queue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit b04f06fc0243600665b3b50253869533b7938468 ]
The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.
--- drivers/crypto/hisilicon/qm.c | 47 ++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 23 deletions(-)
drivers/crypto/hisilicon/qm.c +24 -23
@@ -4106,6 +4106,28 @@ static int qm_set_vf_mse(struct hisi_qm *qm, bool set)return -ETIMEDOUT ; } +static void qm_dev_ecc_mbit_handle (struct hisi_qm *qm) +{ +u32 nfe_enb =0 ; + +/* Kunpeng930 hardware automatically close master ooo when NFE occurs */ +if (qm->ver >=QM_HW_V3 ) +return ; + +if (!qm->err_status.is_dev_ecc_mbit && + qm->err_status.is_qm_ecc_mbit && + qm->err_ini->close_axi_master_ooo) { + qm->err_ini->close_axi_master_ooo (qm); + }else if (qm->err_status.is_dev_ecc_mbit && + !qm->err_status.is_qm_ecc_mbit && + !qm->err_ini->close_axi_master_ooo) { + nfe_enb =readl (qm->io_base +QM_RAS_NFE_ENABLE ); +writel (nfe_enb &QM_RAS_NFE_MBIT_DISABLE , + qm->io_base +QM_RAS_NFE_ENABLE ); +writel (QM_ECC_MBIT , qm->io_base +QM_ABNORMAL_INT_SET ); + } +} +static int qm_vf_reset_prepare (struct hisi_qm *qm,enum qm_stop_reason stop_reason) {
@@ -4170,6 +4192,8 @@ static int qm_controller_reset_prepare(struct hisi_qm *qm)return ret; } +qm_dev_ecc_mbit_handle (qm); +/* PF obtains the information of VF by querying the register. */ qm_cmd_uninit (qm);
@@ -4216,28 +4240,6 @@ static int qm_master_ooo_check(struct hisi_qm *qm)return ret; } -static void qm_dev_ecc_mbit_handle (struct hisi_qm *qm) -{ -u32 nfe_enb =0 ; - -/* Kunpeng930 hardware automatically close master ooo when NFE occurs */ -if (qm->ver >=QM_HW_V3 ) -return ; - -if (!qm->err_status.is_dev_ecc_mbit && - qm->err_status.is_qm_ecc_mbit && - qm->err_ini->close_axi_master_ooo) { - qm->err_ini->close_axi_master_ooo (qm); - }else if (qm->err_status.is_dev_ecc_mbit && - !qm->err_status.is_qm_ecc_mbit && - !qm->err_ini->close_axi_master_ooo) { - nfe_enb =readl (qm->io_base +QM_RAS_NFE_ENABLE ); -writel (nfe_enb &QM_RAS_NFE_MBIT_DISABLE , - qm->io_base +QM_RAS_NFE_ENABLE ); -writel (QM_ECC_MBIT , qm->io_base +QM_ABNORMAL_INT_SET ); - } -} -static int qm_soft_reset_prepare (struct hisi_qm *qm) {struct pci_dev *pdev = qm->pdev;
@@ -4262,7 +4264,6 @@ static int qm_soft_reset_prepare(struct hisi_qm *qm)return ret; } -qm_dev_ecc_mbit_handle (qm); ret =qm_master_ooo_check (qm);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/538 wifi: mt76: mt7603: fix mixed declarations and code
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 9b8d932053b8b45d650360b36f701cf0f9b6470e ]
Move the qid variable declaration further up
--- drivers/net/wireless/mediatek/mt76/mt7603/dma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7603/dma.c +2 -2
@@ -29,7 +29,7 @@ mt7603_rx_loopback_skb(struct mt7603_dev *dev, struct sk_buff *skb)struct ieee80211_sta *sta;struct mt7603_sta *msta;struct mt76_wcid *wcid; -u8 tid =0 , hwq =0 ; +u8 qid, tid =0 , hwq =0 ;void *priv;int idx;u32 val;
@@ -57,7 +57,7 @@ mt7603_rx_loopback_skb(struct mt7603_dev *dev, struct sk_buff *skb)if (ieee80211_is_data_qos (hdr->frame_control)) { tid = *ieee80211_get_qos_ctl (hdr) &IEEE80211_QOS_CTL_TAG1D_MASK ; -u8 qid = tid_to_ac[tid]; + qid = tid_to_ac[tid]; hwq = wmm_queue_map[qid];skb_set_queue_mapping (skb, qid); }else if (ieee80211_is_data (hdr->frame_control)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/538 wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit a26a5107bc52922cf5f67361e307ad66547b51c7 ]
Looking at https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819
and running reproducer with CONFIG_UBSAN_BOUNDS, I've noticed the following:
[ T4985] UBSAN: array-index-out-of-bounds in net/wireless/scan.c:3479:25 [ T4985] index 164 is out of range for type 'struct ieee80211_channel *[]' <...skipped...>
[ T4985] Call Trace:
[ T4985] <TASK> [ T4985] dump_stack_lvl+0x1c2/0x2a0 [ T4985] ? __pfx_dump_stack_lvl+0x10/0x10 [ T4985] ? __pfx__printk+0x10/0x10 [ T4985] __ubsan_handle_out_of_bounds+0x127/0x150 [ T4985] cfg80211_wext_siwscan+0x11a4/0x1260
<...the rest is not too useful...>
Even if we do 'creq->n_channels = n_channels' before 'creq->ssids = (void *)&creq->channels[n_channels]', UBSAN treats the latter as off-by-one error. Fix this by using pointer arithmetic rather than an expression with explicit array indexing and use convenient 'struct_size()' to simplify the math here and in 'kzalloc()' above.
--- net/wireless/scan.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/wireless/scan.c +3 -3
@@ -3209,8 +3209,8 @@ int cfg80211_wext_siwscan(struct net_device *dev, n_channels =ieee80211_get_num_supported_channels (wiphy); } - creq =kzalloc (sizeof (*creq) +sizeof (struct cfg80211_ssid ) + - n_channels *sizeof (void *), + creq =kzalloc (struct_size (creq, channels, n_channels) + +sizeof (struct cfg80211_ssid ),GFP_ATOMIC );if (!creq)return -ENOMEM ;
@@ -3218,7 +3218,7 @@ int cfg80211_wext_siwscan(struct net_device *dev, creq->wiphy = wiphy; creq->wdev = dev->ieee80211_ptr;/* SSIDs come after channels */ - creq->ssids = (void *)&creq->channels[n_channels]; + creq->ssids = (void *)creq +struct_size (creq, channels, n_channels); creq->n_channels = n_channels; creq->n_ssids =1 ; creq->scan_start = jiffies;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/538 wifi: mt76: mt7915: fix rx filter setting for bfee functionality
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Howard Hsu <[email protected]>
[ Upstream commit 6ac80fce713e875a316a58975b830720a3e27721 ]
Fix rx filter setting to prevent dropping NDPA frames. Without this change, bfee functionality may behave abnormally.
--- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/main.c +1 -2
@@ -557,8 +557,7 @@ static void mt7915_configure_filter(struct ieee80211_hw *hw,MT76_FILTER (CONTROL ,MT_WF_RFCR_DROP_CTS |MT_WF_RFCR_DROP_RTS | -MT_WF_RFCR_DROP_CTL_RSV | -MT_WF_RFCR_DROP_NDPA ); +MT_WF_RFCR_DROP_CTL_RSV ); *total_flags = flags;mt76_wr (dev,MT_WF_RFCR (band), phy->rxfilter);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/538 wifi: mt76: mt7996: ensure 4-byte alignment for beacon commands
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Lin <[email protected]>
[ Upstream commit 5d197d37809b220616a0fb00856b9eeeafe1f69e ]
If TLV includes beacon content, its length might not be 4-byte aligned. Make sure the length is aligned before sending beacon commands to FW.
Stable-dep-of: 9e461f4a2329 ("wifi: mt76: mt7996: fix uninitialized TLV data")
--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 14 +++++--------- drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 4 ++-- 2 files changed, 7 insertions(+), 11 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +5 -9
@@ -520,13 +520,10 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb)static struct tlv *mt7996_mcu_add_uni_tlv (struct sk_buff *skb,u16 tag,u16 len) { -struct tlv *ptlv, tlv = { - .tag =cpu_to_le16 (tag), - .len =cpu_to_le16 (len), - }; +struct tlv *ptlv =skb_put (skb, len); - ptlv =skb_put (skb, len); -memcpy (ptlv, &tlv,sizeof (tlv)); + ptlv->tag =cpu_to_le16 (tag); + ptlv->len =cpu_to_le16 (len);return ptlv; }
@@ -2072,7 +2069,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, info =IEEE80211_SKB_CB (skb); info->hw_queue |=FIELD_PREP (MT_TX_HW_QUEUE_PHY , phy->mt76->band_idx); - len =sizeof (*bcn) +MT_TXD_SIZE + skb->len; + len =ALIGN (sizeof (*bcn) +MT_TXD_SIZE + skb->len,4 ); tlv =mt7996_mcu_add_uni_tlv (rskb,UNI_BSS_INFO_BCN_CONTENT , len); bcn = (struct bss_bcn_content_tlv *)tlv; bcn->enable = en;
@@ -2141,8 +2138,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev, info->band = band; info->hw_queue |=FIELD_PREP (MT_TX_HW_QUEUE_PHY , phy->mt76->band_idx); - len =sizeof (*discov) +MT_TXD_SIZE + skb->len; - + len =ALIGN (sizeof (*discov) +MT_TXD_SIZE + skb->len,4 ); tlv =mt7996_mcu_add_uni_tlv (rskb,UNI_BSS_INFO_OFFLOAD , len); discov = (struct bss_inband_discovery_tlv *)tlv;
drivers/net/wireless/mediatek/mt76/mt7996/mcu.h +2 -2
@@ -587,10 +587,10 @@ enum { sizeof(struct sta_rec_hdr_trans) + \ sizeof(struct tlv)) -#define MT7996_MAX_BEACON_SIZE 1342 +#define MT7996_MAX_BEACON_SIZE 1338#define MT7996_BEACON_UPDATE_SIZE (sizeof(struct bss_req_hdr) + \ sizeof(struct bss_bcn_content_tlv) + \ - MT_TXD_SIZE + \ + 4 + MT_TXD_SIZE + \ sizeof(struct bss_bcn_cntdwn_tlv) + \ sizeof(struct bss_bcn_mbss_tlv))#define MT7996_MAX_BSS_OFFLOAD_SIZE (MT7996_MAX_BEACON_SIZE + \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/538 wifi: mt76: mt7996: fix uninitialized TLV data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 9e461f4a2329109571f4b10f9bcad28d07e6ebb3 ]
Use skb_put_zero instead of skb_put
--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +1 -1
@@ -520,7 +520,7 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb)static struct tlv *mt7996_mcu_add_uni_tlv (struct sk_buff *skb,u16 tag,u16 len) { -struct tlv *ptlv =skb_put (skb, len); +struct tlv *ptlv =skb_put_zero (skb, len); ptlv->tag =cpu_to_le16 (tag); ptlv->len =cpu_to_le16 (len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/538 wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 15ea13b1b1fbf6364d4cd568e65e4c8479632999 ]
Although not reproduced in practice, these two cases may be considered by UBSAN as off-by-one errors. So fix them in the same way as in commit a26a5107bc52 ("wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()").
--- net/wireless/nl80211.c | 3 ++- net/wireless/sme.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/wireless/nl80211.c +2 -1
@@ -9679,7 +9679,8 @@ nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,return ERR_PTR (-ENOMEM );if (n_ssids) - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids = n_ssids;if (ie_len) {if (n_ssids)
net/wireless/sme.c +2 -1
@@ -115,7 +115,8 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev) n_channels = i; } request->n_channels = n_channels; - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids =1 ; memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/538 wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 9d301de12da6e1bb069a9835c38359b8e8135121 ]
Since '__dev_queue_xmit()' should be called with interrupts enabled, the following backtrace:
ieee80211_do_stop()
...
spin_lock_irqsave(&local->queue_stop_reason_lock, flags)
...
ieee80211_free_txskb()
ieee80211_report_used_skb()
ieee80211_report_ack_skb()
cfg80211_mgmt_tx_status_ext()
nl80211_frame_tx_status()
genlmsg_multicast_netns()
genlmsg_multicast_netns_filtered()
nlmsg_multicast_filtered()
netlink_broadcast_filtered()
do_one_broadcast()
netlink_broadcast_deliver()
__netlink_sendskb()
netlink_deliver_tap()
__netlink_deliver_tap_skb()
dev_queue_xmit()
__dev_queue_xmit() ; with IRQS disabled ...
spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)
issues the warning (as reported by syzbot reproducer):
WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120
Fix this by implementing a two-phase skb reclamation in 'ieee80211_do_stop()', where actual work is performed outside of a section with interrupts disabled.
--- net/mac80211/iface.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
net/mac80211/iface.c +16 -1
@@ -466,6 +466,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do {struct ieee80211_local *local = sdata->local;unsigned long flags; +struct sk_buff_head freeq;struct sk_buff *skb, *tmp;u32 hw_reconf_flags =0 ;int i, flushed;
@@ -652,18 +653,32 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_doskb_queue_purge (&sdata->status_queue); } +/* +* Since ieee80211_free_txskb() may issue __dev_queue_xmit() +* which should be called with interrupts enabled, reclamation +* is done in two phases: +*/ +__skb_queue_head_init (&freeq); + +/* unlink from local queues... */ spin_lock_irqsave (&local->queue_stop_reason_lock, flags);for (i =0 ; i <IEEE80211_MAX_QUEUES ; i++) { skb_queue_walk_safe(&local->pending[i], skb, tmp) {struct ieee80211_tx_info *info =IEEE80211_SKB_CB (skb);if (info->control.vif == &sdata->vif) {__skb_unlink (skb, &local->pending[i]); -ieee80211_free_txskb (&local->hw, skb); +__skb_queue_tail (&freeq, skb); } } }spin_unlock_irqrestore (&local->queue_stop_reason_lock, flags); +/* ... and perform actual reclamation with interrupts enabled. */ + skb_queue_walk_safe(&freeq, skb, tmp) { +__skb_unlink (skb, &freeq); +ieee80211_free_txskb (&local->hw, skb); + } +if (sdata->vif.type ==NL80211_IFTYPE_AP_VLAN )ieee80211_txq_remove_vlan (local, sdata);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/538 wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawei Ye <[email protected]>
[ Upstream commit 6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8 ]
In the wilc_parse_join_bss_param function, the TSF field of the ies structure is accessed after the RCU read-side critical section is unlocked. According to RCU usage rules, this is illegal. Reusing this pointer can lead to unpredictable behavior, including accessing memory that has been updated or causing use-after-free issues.
This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues.
To address this, the TSF value is now stored in a local variable ies_tsf before the RCU lock is released. The param->tsf_lo field is then assigned using this local variable, ensuring that the TSF value is safely accessed.
--- drivers/net/wireless/microchip/wilc1000/hif.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/microchip/wilc1000/hif.c +3 -1
@@ -381,6 +381,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,struct wilc_join_bss_param *param;u8 rates_len =0 ;int ies_len; +u64 ies_tsf;int ret; param =kzalloc (sizeof (*param),GFP_KERNEL );
@@ -396,6 +397,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,return NULL ; } ies_len = ies->len; + ies_tsf = ies->tsf;rcu_read_unlock (); param->beacon_period =cpu_to_le16 (bss->beacon_interval);
@@ -451,7 +453,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,IEEE80211_P2P_ATTR_ABSENCE_NOTICE , (u8 *)&noa_attr, sizeof(noa_attr));if (ret >0 ) { - param->tsf_lo =cpu_to_le32 (ies->tsf); + param->tsf_lo =cpu_to_le32 (ies_tsf); param->noa_enabled =1 ; param->idx = noa_attr.index;if (noa_attr.oppps_ctwindow &IEEE80211_P2P_OPPPS_ENABLE_BIT ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/538 Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit d47da6bd4cfa982fe903f33423b9e2ec541e9496 ]
If HCI_CONN_MGMT_CONNECTED has been set then the event shall be HCI_CONN_MGMT_DISCONNECTED.
--- include/net/bluetooth/hci_core.h | 4 ++-- net/bluetooth/hci_conn.c | 6 ++---- net/bluetooth/mgmt.c | 13 +++++++++---- 3 files changed, 13 insertions(+), 10 deletions(-)
include/net/bluetooth/hci_core.h +2 -2
@@ -2224,8 +2224,8 @@ void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, bool mgmt_connected);void mgmt_disconnect_failed (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 link_type,u8 addr_type,u8 status); -void mgmt_connect_failed (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 link_type, -u8 addr_type,u8 status); +void mgmt_connect_failed (struct hci_dev *hdev,struct hci_conn *conn, +u8 status);void mgmt_pin_code_request (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 secure);void mgmt_pin_code_reply_complete (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 status);
net/bluetooth/hci_conn.c +2 -4
@@ -107,8 +107,7 @@ void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)* where a timeout + cancel does indicate an actual failure. */ if (status && status !=HCI_ERROR_UNKNOWN_CONN_ID ) -mgmt_connect_failed (hdev, &conn->dst, conn->type, - conn->dst_type, status); +mgmt_connect_failed (hdev, conn, status);/* The connection attempt was doing scan for new RPA, and is * in scan phase. If params are not associated with any other
@@ -1233,8 +1232,7 @@ void hci_conn_failed(struct hci_conn *conn, u8 status)hci_le_conn_failed (conn, status);break ;case ACL_LINK : -mgmt_connect_failed (hdev, &conn->dst, conn->type, - conn->dst_type, status); +mgmt_connect_failed (hdev, conn, status);break ; }
net/bluetooth/mgmt.c +9 -4
@@ -9724,13 +9724,18 @@ void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,mgmt_pending_remove (cmd); } -void mgmt_connect_failed (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 link_type, -u8 addr_type,u8 status) +void mgmt_connect_failed (struct hci_dev *hdev,struct hci_conn *conn,u8 status) {struct mgmt_ev_connect_failed ev; -bacpy (&ev.addr.bdaddr, bdaddr); - ev.addr.type =link_to_bdaddr (link_type, addr_type); +if (test_and_clear_bit (HCI_CONN_MGMT_CONNECTED , &conn->flags)) { +mgmt_device_disconnected (hdev, &conn->dst, conn->type, + conn->dst_type, status, true); +return ; + } + +bacpy (&ev.addr.bdaddr, &conn->dst); + ev.addr.type =link_to_bdaddr (conn->type, conn->dst_type); ev.status =mgmt_status (status);mgmt_event (MGMT_EV_CONNECT_FAILED , hdev, &ev,sizeof (ev),NULL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/538 Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit cfbfeee61582e638770a1a10deef866c9adb38f5 ]
This ignores errors from HCI_OP_REMOTE_NAME_REQ_CANCEL since it shouldn't interfere with the stopping of discovery and in certain conditions it seems to be failing.
--- net/bluetooth/hci_sync.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/bluetooth/hci_sync.c +4 -1
@@ -5391,7 +5391,10 @@ int hci_stop_discovery_sync(struct hci_dev *hdev)if (!e)return 0 ; -return hci_remote_name_cancel_sync (hdev, &e->data.bdaddr); +/* Ignore cancel errors since it should interfere with stopping +* of the discovery. +*/ +hci_remote_name_cancel_sync (hdev, &e->data.bdaddr); }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/538 sock_map: Add a cond_resched() in sock_hash_free()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b1339be951ad31947ae19bc25cb08769bf255100 ]
Several syzbot soft lockup reports all have in common sock_hash_free()
If a map with a large number of buckets is destroyed, we need to yield the cpu when needed.
--- net/core/sock_map.c | 1 + 1 file changed, 1 insertion(+)
net/core/sock_map.c +1 -0
@@ -1171,6 +1171,7 @@ static void sock_hash_free(struct bpf_map *map)sock_put (elem->sk);sock_hash_free_elem (htab, elem); } +cond_resched (); }/* wait for psock readers accessing its map link */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/538 can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 94b0818fa63555a65f6ba107080659ea6bcca63e ]
syzbot reported a warning in bcm_release(). [0]
The blamed change fixed another warning that is triggered when connect() is issued again for a socket whose connect()ed device has been unregistered.
However, if the socket is just close()d without the 2nd connect(), the remaining bo->bcm_proc_read triggers unnecessary remove_proc_entry() in bcm_release().
Let's clear bo->bcm_proc_read after remove_proc_entry() in bcm_notify().
[0]
name '4986'
WARNING: CPU: 0 PID: 5234 at fs/proc/generic.c:711 remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Modules linked in: CPU: 0 UID: 0 PID: 5234 Comm: syz-executor606 Not tainted 6.11.0-rc5-syzkaller-00178-g5517ae241919 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Code: ff eb 05 e8 cb 1e 5e ff 48 8b 5c 24 10 48 c7 c7 e0 f7 aa 8e e8 2a 38 8e 09 90 48 c7 c7 60 3a 1b 8c 48 89 de e8 da 42 20 ff 90 <0f> 0b 90 90 48 8b 44 24 18 48 c7 44 24 40 0e 36 e0 45 49 c7 04 07 RSP: 0018:ffffc9000345fa20 EFLAGS: 00010246 RAX: 2a2d0aee2eb64600 RBX: ffff888032f1f548 RCX: ffff888029431e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000345fb08 R08: ffffffff8155b2f2 R09: 1ffff1101710519a R10: dffffc0000000000 R11: ffffed101710519b R12: ffff888011d38640 R13: 0000000000000004 R14: 0000000000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcfb52722f0 CR3: 000000000e734000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> bcm_release+0x250/0x880 net/can/bcm.c:1578 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcfb51ee969 Code: Unable to access opcode bytes at 0x7fcfb51ee93f. RSP: 002b:00007ffce0109ca8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fcfb51ee969 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 00007fcfb526f3b0 R08: ffffffffffffffb8 R09: 0000555500000000 R10: 0000555500000000 R11: 0000000000000246 R12: 00007fcfb526f3b0 R13: 0000000000000000 R14: 00007fcfb5271ee0 R15: 00007fcfb51bf160 </TASK>
--- net/can/bcm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/can/bcm.c +3 -1
@@ -1429,8 +1429,10 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,/* remove device reference, if this is our bound device */ if (bo->bound && bo->ifindex == dev->ifindex) {#if IS_ENABLED (CONFIG_PROC_FS ) -if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) +if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) {remove_proc_entry (bo->procname,sock_net (sk)->can.bcmproc_dir); + bo->bcm_proc_read =NULL ; + }#endif bo->bound =0 ; bo->ifindex =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/538 can: m_can: enable NAPI before enabling interrupts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jake Hamby <[email protected]>
[ Upstream commit 801ad2f87b0c6d0c34a75a4efd6bfd3a2d9f9298 ]
If an interrupt (RX-complete or error flag) is set when bringing up the CAN device, e.g. due to CAN bus traffic before initializing the device, when m_can_start() is called and interrupts are enabled, m_can_isr() is called immediately, which disables all CAN interrupts and calls napi_schedule().
Because napi_enable() isn't called until later in m_can_open(), the call to napi_schedule() never schedules the m_can_poll() callback and the device is left with interrupts disabled and can't receive any CAN packets until rebooted.
This can be verified by running "cansend" from another device before setting the bitrate and calling "ip link set up can0" on the test device. Adding debug lines to m_can_isr() shows it's called with flags (IR_EP | IR_EW | IR_CRCE), which calls m_can_disable_all_interrupts() and napi_schedule(), and then m_can_poll() is never called.
Move the call to napi_enable() above the call to m_can_start() to enable any initial interrupt flags to be handled by m_can_poll() so that interrupts are reenabled. Add a call to napi_disable() in the error handling section of m_can_open(), to handle the case where later functions return errors.
Also, in m_can_close(), move the call to napi_disable() below the call to m_can_stop() to ensure all interrupts are handled when bringing down the device. This race condition is much less likely to occur.
Tested on a Microchip SAMA7G54 MPU. The fix should be applicable to any SoC with a Bosch M_CAN controller.
--- drivers/net/can/m_can/m_can.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/can/m_can/m_can.c +6 -6
@@ -1599,9 +1599,6 @@ static int m_can_close(struct net_device *dev)netif_stop_queue (dev); -if (!cdev->is_peripheral) -napi_disable (&cdev->napi); -m_can_stop (dev);m_can_clk_stop (cdev);free_irq (dev->irq, dev);
@@ -1611,6 +1608,8 @@ static int m_can_close(struct net_device *dev)destroy_workqueue (cdev->tx_wq); cdev->tx_wq =NULL ;can_rx_offload_disable (&cdev->offload); + }else { +napi_disable (&cdev->napi); }close_candev (dev);
@@ -1842,6 +1841,8 @@ static int m_can_open(struct net_device *dev)if (cdev->is_peripheral)can_rx_offload_enable (&cdev->offload); +else +napi_enable (&cdev->napi);/* register interrupt handler */ if (cdev->is_peripheral) {
@@ -1873,9 +1874,6 @@ static int m_can_open(struct net_device *dev)if (err) goto exit_start_fail; -if (!cdev->is_peripheral) -napi_enable (&cdev->napi); -netif_start_queue (dev);return 0 ;
@@ -1889,6 +1887,8 @@ static int m_can_open(struct net_device *dev) out_wq_fail:if (cdev->is_peripheral)can_rx_offload_disable (&cdev->offload); +else +napi_disable (&cdev->napi);close_candev (dev); exit_disable_clks:m_can_clk_stop (cdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/538 can: m_can: m_can_close(): stop clocks after device has been shut down
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 2c09b50efcad985cf920ca88baa9aa52b1999dcc ]
After calling m_can_stop() an interrupt may be pending or NAPI might still be executed. This means the driver might still touch registers of the IP core after the clocks have been disabled. This is not good practice and might lead to aborts depending on the SoC integration.
To avoid these potential problems, make m_can_close() symmetric to m_can_open(), i.e. stop the clocks at the end, right before shutting down the transceiver.
--- drivers/net/can/m_can/m_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/m_can/m_can.c +1 -1
@@ -1600,7 +1600,6 @@ static int m_can_close(struct net_device *dev)netif_stop_queue (dev);m_can_stop (dev); -m_can_clk_stop (cdev);free_irq (dev->irq, dev);if (cdev->is_peripheral) {
@@ -1614,6 +1613,7 @@ static int m_can_close(struct net_device *dev)close_candev (dev); +m_can_clk_stop (cdev);phy_power_off (cdev->transceiver);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/538 Bluetooth: btusb: Fix not handling ZPL/short-transfer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 7b05933340f4490ef5b09e84d644d12484b05fdf ]
Requesting transfers of the exact same size of wMaxPacketSize may result in ZPL/short-transfer since the USB stack cannot handle it as we are limiting the buffer size to be the same as wMaxPacketSize.
Also, in terms of throughput this change has the same effect to interrupt endpoint as 290ba200815f "Bluetooth: Improve USB driver throughput by increasing the frame size" had for the bulk endpoint, so users of the advertisement bearer (e.g. BT Mesh) may benefit from this change.
--- drivers/bluetooth/btusb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +4 -1
@@ -1352,7 +1352,10 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)if (!urb)return -ENOMEM ; - size =le16_to_cpu (data->intr_ep->wMaxPacketSize); +/* Use maximum HCI Event size so the USB stack handles +* ZPL/short-transfer automatically. +*/ + size =HCI_MAX_EVENT_SIZE ; buf =kmalloc (size, mem_flags);if (!buf) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/538 bareudp: Pull inner IP header in bareudp_udp_encap_recv().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 45fa29c85117170b0508790f878b13ec6593c888 ]
Bareudp reads the inner IP header to get the ECN value. Therefore, it needs to ensure that it's part of the skb's linear data.
This is similar to the vxlan and geneve fixes for that same problem:
* commit f7789419137b ("vxlan: Pull inner IP header in vxlan_rcv().")
* commit 1ca1ba465e55 ("geneve: make sure to pull inner header in
geneve_rx()")
--- drivers/net/bareudp.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
drivers/net/bareudp.c +18 -2
@@ -67,6 +67,7 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)__be16 proto;void *oiph;int err; +int nh; bareudp =rcu_dereference_sk_user_data (sk);if (!bareudp)
@@ -144,10 +145,25 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb) }skb_dst_set (skb, &tun_dst->dst); skb->dev = bareudp->dev; - oiph =skb_network_header (skb); -skb_reset_network_header (skb);skb_reset_mac_header (skb); +/* Save offset of outer header relative to skb->head, +* because we are going to reset the network header to the inner header +* and might change skb->head. +*/ + nh =skb_network_header (skb) - skb->head; + +skb_reset_network_header (skb); + +if (!pskb_inet_may_pull (skb)) { +DEV_STATS_INC (bareudp->dev, rx_length_errors); +DEV_STATS_INC (bareudp->dev, rx_errors); + goto drop; + } + +/* Get the outer header. */ + oiph = skb->head + nh; +if (!ipv6_mod_enabled () || family ==AF_INET ) err =IP_ECN_decapsulate (oiph, skb);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/538 bareudp: Pull inner IP header on xmit.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit c471236b2359e6b27388475dd04fff0a5e2bf922 ]
Both bareudp_xmit_skb() and bareudp6_xmit_skb() read their skb's inner IP header to get its ECN value (with ip_tunnel_ecn_encap()). Therefore we need to ensure that the inner IP header is part of the skb's linear data.
--- drivers/net/bareudp.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/bareudp.c +6 -0
@@ -319,6 +319,9 @@ static int bareudp_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be32 saddr;int err; +if (!skb_vlan_inet_prepare (skb, skb->protocol !=htons (ETH_P_TEB ))) +return -EINVAL ; +if (!sock)return -ESHUTDOWN ;
@@ -382,6 +385,9 @@ static int bareudp6_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; +if (!skb_vlan_inet_prepare (skb, skb->protocol !=htons (ETH_P_TEB ))) +return -EINVAL ; +if (!sock)return -ESHUTDOWN ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/538 net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 799a9225997799f7b1b579bc50a93b78b4fb2a01 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.c +1 -2
@@ -2305,12 +2305,11 @@ static int enetc_setup_irqs(struct enetc_ndev_priv *priv)snprintf (v->name,sizeof (v->name),"%s-rxtx%d" , priv->ndev->name, i); - err =request_irq (irq, enetc_msix,0 , v->name, v); + err =request_irq (irq, enetc_msix,IRQF_NO_AUTOEN , v->name, v);if (err) {dev_err (priv->dev,"request_irq() failed!\n" ); goto irq_err; } -disable_irq (irq); v->tbier_base = hw->reg +ENETC_BDR (TX ,0 ,ENETC_TBIER ); v->rbier = hw->reg +ENETC_BDR (RX , i,ENETC_RBIER );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/538 r8169: disable ALDPS per default for RTL8125
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit b9c7ac4fe22c608acf6153a3329df2b6b6cd416c ]
En-Wei reported that traffic breaks if cable is unplugged for more than 3s and then re-plugged. This was supposed to be fixed by 621735f59064 ("r8169: fix rare issue with broken rx after link-down on RTL8125"). But apparently this didn't fix the issue for everybody. The 3s threshold rang a bell, as this is the delay after which ALDPS kicks in. And indeed disabling ALDPS fixes the issue for this user. Maybe this fixes the issue in general. In a follow-up step we could remove the first fix attempt and see whether anybody complains.
--- drivers/net/ethernet/realtek/r8169_phy_config.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/realtek/r8169_phy_config.c +2 -0
@@ -1060,6 +1060,7 @@ static void rtl8125a_2_hw_phy_config(struct rtl8169_private *tp,phy_modify_paged (phydev,0xa86 ,0x15 ,0x0001 ,0x0000 );rtl8168g_enable_gphy_10m (phydev); +rtl8168g_disable_aldps (phydev);rtl8125a_config_eee_phy (phydev); }
@@ -1099,6 +1100,7 @@ static void rtl8125b_hw_phy_config(struct rtl8169_private *tp,phy_modify_paged (phydev,0xbf8 ,0x12 ,0xe000 ,0xa000 );rtl8125_legacy_force_mode (phydev); +rtl8168g_disable_aldps (phydev);rtl8125b_config_eee_phy (phydev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/538 net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Iurman <[email protected]>
[ Upstream commit 2c84b0aa28b9e73e8c4b4ce038269469434ae372 ]
Free the skb before returning from rpl_input when skb_cow_head() fails. Use a "drop" label and goto instructions.
--- net/ipv6/rpl_iptunnel.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/ipv6/rpl_iptunnel.c +7 -5
@@ -263,10 +263,8 @@ static int rpl_input(struct sk_buff *skb) rlwt =rpl_lwt_lwtunnel (orig_dst->lwtstate); err =rpl_do_srh (skb, rlwt); -if (unlikely (err)) { -kfree_skb (skb); -return err; - } +if (unlikely (err)) + goto drop;local_bh_disable (); dst =dst_cache_get (&rlwt->cache);
@@ -286,9 +284,13 @@ static int rpl_input(struct sk_buff *skb) err =skb_cow_head (skb,LL_RESERVED_SPACE (dst->dev));if (unlikely (err)) -return err; + goto drop;return dst_input (skb); + +drop: +kfree_skb (skb); +return err; } static int nla_put_rpl_srh(struct sk_buff *skb, int attrtype,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/538 net: tipc: avoid possible garbage value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 99655a304e450baaae6b396cb942b9e47659d644 ]
Clang static checker (scan-build) warning:net/tipc/bcast.c:305:4:
The expression is an uninitialized value. The computed value will also be garbage [core.uninitialized.Assign]
305 | (*cong_link_cnt)++;
| ^~~~~~~~~~~~~~~~~~tipc_rcast_xmit() will increase cong_link_cnt's value, but cong_link_cnt is uninitialized. Although it won't really cause a problem, it's better to fix it.
--- net/tipc/bcast.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/bcast.c +1 -1
@@ -320,8 +320,8 @@ static int tipc_mcast_send_sync(struct net *net, struct sk_buff *skb, {struct tipc_msg *hdr, *_hdr;struct sk_buff_head tmpq; +u16 cong_link_cnt =0 ;struct sk_buff *_skb; -u16 cong_link_cnt;int rc =0 ;/* Is a cluster supporting with new capabilities ? */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/538 ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 04ccecfa959d3b9ae7348780d8e379c6486176ac ]
Blamed commit accidentally removed a check for rt->rt6i_idev being NULL, as spotted by syzbot:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856 addrconf_notify+0x3cb/0x1020 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352 unregister_netdevice_many net/core/dev.c:11414 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289 unregister_netdevice include/linux/netdevice.h:3129 [inline] __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685 tun_detach drivers/net/tun.c:701 [inline] tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1acc77def9 Code: Unable to access opcode bytes at 0x7f1acc77decf. RSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043 RBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
--- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/route.c +1 -1
@@ -175,7 +175,7 @@ static void rt6_uncached_list_flush_dev(struct net_device *dev)struct net_device *rt_dev = rt->dst.dev;bool handled = false; -if (rt_idev->dev == dev) { +if (rt_idev && rt_idev->dev == dev) { rt->rt6i_idev =in6_dev_get (blackhole_netdev);in6_dev_put (rt_idev); handled = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/538 ublk: move zone report data out of request pdu
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit 9327b51c9a9c864f5177127e09851da9d78b4943 ]
ublk zoned takes 16 bytes in each request pdu just for handling REPORT_ZONE operation, this way does waste memory since request pdu is allocated statically.
Store the transient zone report data into one global xarray, and remove it after the report zone request is completed. This way is reasonable since report zone is run in slow code path.
--- drivers/block/ublk_drv.c | 62 +++++++++++++++++++++++++++++----------- 1 file changed, 46 insertions(+), 16 deletions(-)
drivers/block/ublk_drv.c +46 -16
@@ -68,9 +68,6 @@ struct ublk_rq_data {struct llist_node node;struct kref ref; -__u64 sector; -__u32 operation; -__u32 nr_zones; };struct ublk_uring_cmd_pdu {
@@ -215,6 +212,33 @@ static inline bool ublk_queue_is_zoned(struct ublk_queue *ubq)#ifdef CONFIG_BLK_DEV_ZONED +struct ublk_zoned_report_desc { +__u64 sector; +__u32 operation; +__u32 nr_zones; +}; + +static DEFINE_XARRAY (ublk_zoned_report_descs); + +static int ublk_zoned_insert_report_desc (const struct request *req, +struct ublk_zoned_report_desc *desc) +{ +return xa_insert (&ublk_zoned_report_descs, (unsigned long )req, + desc,GFP_KERNEL ); +} + +static struct ublk_zoned_report_desc *ublk_zoned_erase_report_desc ( +const struct request *req) +{ +return xa_erase (&ublk_zoned_report_descs, (unsigned long )req); +} + +static struct ublk_zoned_report_desc *ublk_zoned_get_report_desc ( +const struct request *req) +{ +return xa_load (&ublk_zoned_report_descs, (unsigned long )req); +} +static int ublk_get_nr_zones (const struct ublk_device *ub) {const struct ublk_param_basic *p = &ub->params.basic;
@@ -321,7 +345,7 @@ static int ublk_report_zones(struct gendisk *disk, sector_t sector,unsigned int zones_in_request = min_t(unsigned int, remaining_zones, max_zones_per_request);struct request *req; -struct ublk_rq_data *pdu; +struct ublk_zoned_report_desc desc;blk_status_t status;memset (buffer,0 , buffer_length);
@@ -332,20 +356,23 @@ static int ublk_report_zones(struct gendisk *disk, sector_t sector, goto out; } - pdu =blk_mq_rq_to_pdu (req); - pdu->operation =UBLK_IO_OP_REPORT_ZONES ; - pdu->sector = sector; - pdu->nr_zones = zones_in_request; + desc.operation =UBLK_IO_OP_REPORT_ZONES ; + desc.sector = sector; + desc.nr_zones = zones_in_request; + ret =ublk_zoned_insert_report_desc (req, &desc); +if (ret) + goto free_req; ret =blk_rq_map_kern (disk->queue, req, buffer, buffer_length,GFP_KERNEL ); -if (ret) { -blk_mq_free_request (req); - goto out; - } +if (ret) + goto erase_desc; status =blk_execute_rq (req,0 ); ret =blk_status_to_errno (status); +erase_desc: +ublk_zoned_erase_report_desc (req); +free_req:blk_mq_free_request (req);if (ret) goto out;
@@ -379,7 +406,7 @@ static blk_status_t ublk_setup_iod_zoned(struct ublk_queue *ubq, {struct ublksrv_io_desc *iod =ublk_get_iod (ubq, req->tag);struct ublk_io *io = &ubq->ios[req->tag]; -struct ublk_rq_data *pdu =blk_mq_rq_to_pdu (req); +struct ublk_zoned_report_desc *desc;u32 ublk_op;switch (req_op (req)) {
@@ -402,12 +429,15 @@ static blk_status_t ublk_setup_iod_zoned(struct ublk_queue *ubq, ublk_op =UBLK_IO_OP_ZONE_RESET_ALL ;break ;case REQ_OP_DRV_IN : - ublk_op = pdu->operation; + desc =ublk_zoned_get_report_desc (req); +if (!desc) +return BLK_STS_IOERR ; + ublk_op = desc->operation;switch (ublk_op) {case UBLK_IO_OP_REPORT_ZONES : iod->op_flags = ublk_op |ublk_req_build_flags (req); - iod->nr_zones = pdu->nr_zones; - iod->start_sector = pdu->sector; + iod->nr_zones = desc->nr_zones; + iod->start_sector = desc->sector;return BLK_STS_OK ;default :return BLK_STS_IOERR ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/538 nbd: fix race between timeout and normal completion
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit c9ea57c91f03bcad415e1a20113bdb2077bcf990 ]
If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered.
Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime make sure that cmd->lock is grabbed for clearing the flag and the requeue.
--- drivers/block/nbd.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/block/nbd.c +12 -1
@@ -181,6 +181,17 @@ static void nbd_requeue_cmd(struct nbd_cmd *cmd) {struct request *req =blk_mq_rq_from_pdu (cmd); +lockdep_assert_held (&cmd->lock); + +/* +* Clear INFLIGHT flag so that this cmd won't be completed in +* normal completion path +* +* INFLIGHT flag will be set when the cmd is queued to nbd next +* time. +*/ +__clear_bit (NBD_CMD_INFLIGHT , &cmd->flags); +if (!test_and_set_bit (NBD_CMD_REQUEUED , &cmd->flags))blk_mq_requeue_request (req, true); }
@@ -461,8 +472,8 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req)nbd_mark_nsock_dead (nbd, nsock,1 );mutex_unlock (&nsock->tx_lock); } -mutex_unlock (&cmd->lock);nbd_requeue_cmd (cmd); +mutex_unlock (&cmd->lock);nbd_config_put (nbd);return BLK_EH_DONE ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/538 block, bfq: fix possible UAF for bfqq->bic with merge chain
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 18ad4df091dd5d067d2faa8fce1180b79f7041a7 ]
1) initial state, three tasks:
Process 1 Process 2 Process 3
(BIC1) (BIC2) (BIC3)
| Λ | Λ | Λ
| | | | | |
V | V | V |
bfqq1 bfqq2 bfqq3
process ref: 1 1 1
2) bfqq1 merged to bfqq2:
Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) | | | Λ \--------------\| | | V V | bfqq1--------->bfqq2 bfqq3
process ref: 0 2 1
3) bfqq2 merged to bfqq3:
Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) here -> Λ | | \--------------\ \-------------\| V V bfqq1--------->bfqq2---------->bfqq3
process ref: 0 1 3
In this case, IO from Process 1 will get bfqq2 from BIC1 first, and then get bfqq3 through merge chain, and finially handle IO by bfqq3. Howerver, current code will think bfqq2 is owned by BIC1, like initial state, and set bfqq2->bic to BIC1.
bfq_insert_request
-> by Process 1
bfqq = bfq_init_rq(rq)
bfqq = bfq_get_bfqq_handle_split
bfqq = bic_to_bfqq
-> get bfqq2 from BIC1
bfqq->ref++
rq->elv.priv[0] = bic
rq->elv.priv[1] = bfqq
if (bfqq_process_refs(bfqq) == 1)
bfqq->bic = bic
-> record BIC1 to bfqq2
__bfq_insert_request
new_bfqq = bfq_setup_cooperator
-> get bfqq3 from bfqq2->new_bfqq
bfqq_request_freed(bfqq)
new_bfqq->ref++
rq->elv.priv[1] = new_bfqq
-> handle IO by bfqq3
Fix the problem by checking bfqq is from merge chain fist. And this might fix a following problem reported by our syzkaller(unreproducible):
==================================================================
BUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] BUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] BUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 Write of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595 CPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G L 6.6.0-07439-gba2303cacfda #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Workqueue: kblockd blk_mq_requeue_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0x10d/0x610 mm/kasan/report.c:475 kasan_report+0x8e/0xc0 mm/kasan/report.c:588 bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757 bfq_init_rq block/bfq-iosched.c:6876 [inline] bfq_insert_request block/bfq-iosched.c:6254 [inline] bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304 blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593 blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 </TASK> Allocated by task 20776: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3458 [inline] kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503 ioc_create_icq block/blk-ioc.c:370 [inline] ioc_find_get_icq+0x180/0xaa0 block/blk-ioc.c:436 bfq_prepare_request+0x39/0xf0 block/bfq-iosched.c:6812 blk_mq_rq_ctx_init.isra.7+0x6ac/0xa00 block/blk-mq.c:403 __blk_mq_alloc_requests+0xcc0/0x1070 block/blk-mq.c:517 blk_mq_get_new_requests block/blk-mq.c:2940 [inline] blk_mq_submit_bio+0x624/0x27c0 block/blk-mq.c:3042 __submit_bio+0x331/0x6f0 block/blk-core.c:624 __submit_bio_noacct_mq block/blk-core.c:703 [inline] submit_bio_noacct_nocheck+0x816/0xb40 block/blk-core.c:732 submit_bio_noacct+0x7a6/0x1b50 block/blk-core.c:826 xlog_write_iclog+0x7d5/0xa00 fs/xfs/xfs_log.c:1958 xlog_state_release_iclog+0x3b8/0x720 fs/xfs/xfs_log.c:619 xlog_cil_push_work+0x19c5/0x2270 fs/xfs/xfs_log_cil.c:1330 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 Freed by task 946: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] __kasan_slab_free+0x12c/0x1c0 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1815 [inline] slab_free_freelist_hook mm/slub.c:1841 [inline] slab_free mm/slub.c:3786 [inline] kmem_cache_free+0x118/0x6f0 mm/slub.c:3808 rcu_do_batch+0x35c/0xe30 kernel/rcu/tree.c:2189 rcu_core+0x819/0xd90 kernel/rcu/tree.c:2462 __do_softirq+0x1b0/0x7a2 kernel/softirq.c:553 Last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492 __call_rcu_common kernel/rcu/tree.c:2712 [inline] call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826 ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105 ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492 __call_rcu_common kernel/rcu/tree.c:2712 [inline] call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826 ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105 ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 The buggy address belongs to the object at ffff888123839d68 which belongs to the cache bfq_io_cq of size 1360
The buggy address is located 336 bytes inside of
freed 1360-byte region [ffff888123839d68, ffff88812383a2b8)
The buggy address belongs to the physical page:
page:ffffea00048e0e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88812383f588 pfn:0x123838 head:ffffea00048e0e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x17ffffc0000a40(workingset|slab|head|node=0|zone=2|lastcpupid=0x1fffff)page_type: 0xffffffff()
raw: 0017ffffc0000a40 ffff88810588c200 ffffea00048ffa10 ffff888105889488
raw: ffff88812383f588 0000000000150006 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888123839d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888123839e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888123839e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888123839f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888123839f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================--- block/bfq-iosched.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/bfq-iosched.c +2 -1
@@ -6932,7 +6932,8 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)* addition, if the queue has also just been split, we have to * resume its state. */ -if (likely (bfqq != &bfqd->oom_bfqq) &&bfqq_process_refs (bfqq) ==1 ) { +if (likely (bfqq != &bfqd->oom_bfqq) && !bfqq->new_bfqq && +bfqq_process_refs (bfqq) ==1 ) { bfqq->bic = bic;if (split) {/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/538 block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 0e456dba86c7f9a19792204a044835f1ca2c8dbb ]
Consider the following merge chain:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\--------------\ \-------------\ \-------------\|
V V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
IO from Process 1 will get bfqf2 from BIC1 first, then bfq_setup_cooperator() will found bfqq2 already merged to bfqq3 and then handle this IO from bfqq3. However, the merge chain can be much deeper and bfqq3 can be merged to other bfqq as well.
Fix this problem by iterating to the last bfqq inbfq_setup_cooperator().
--- block/bfq-iosched.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
block/bfq-iosched.c +6 -2
@@ -2911,8 +2911,12 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,struct bfq_iocq_bfqq_data *bfqq_data = &bic->bfqq_data[a_idx];/* if a merge has already been setup, then proceed with that first */ -if (bfqq->new_bfqq) -return bfqq->new_bfqq; + new_bfqq = bfqq->new_bfqq; +if (new_bfqq) { +while (new_bfqq->new_bfqq) + new_bfqq = new_bfqq->new_bfqq; +return new_bfqq; + }/* * Check delayed stable merge for rotational or non-queueing
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/538 block, bfq: dont break merge chain in bfq_split_bfqq()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 42c306ed723321af4003b2a41bb73728cab54f85 ]
Consider the following scenario:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\-------------\ \-------------\ \--------------\|
V V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 1 2 4
If Process 1 issue a new IO and bfqq2 is found, and then bfq_init_rq() decide to spilt bfqq2 by bfq_split_bfqq(). Howerver, procress reference of bfqq2 is 1 and bfq_split_bfqq() just clear the coop flag, which will break the merge chain.
Expected result: caller will allocate a new bfqq for BIC1
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
| | |
\-------------\ \--------------\|
V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 0 1 3
Since the condition is only used for the last bfqq4 when the previous bfqq2 and bfqq3 are already splited. Fix the problem by checking if bfqq is the last one in the merge chain as well.
--- block/bfq-iosched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/bfq-iosched.c +1 -1
@@ -6725,7 +6725,7 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq) {bfq_log_bfqq (bfqq->bfqd, bfqq,"splitting queue" ); -if (bfqq_process_refs (bfqq) ==1 ) { +if (bfqq_process_refs (bfqq) ==1 && !bfqq->new_bfqq) { bfqq->pid = current->pid;bfq_clear_bfqq_coop (bfqq);bfq_clear_bfqq_split_coop (bfqq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/538 cachefiles: Fix non-taking of sb_writers around set/removexattr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 80887f31672970abae3aaa9cf62ac72a124e7c89 ]
Unlike other vfs_xxxx() calls, vfs_setxattr() and vfs_removexattr() don't take the sb_writers lock, so the caller should do it for them.
Fix cachefiles to do this.
--- fs/cachefiles/xattr.c | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-)
fs/cachefiles/xattr.c +26 -8
@@ -64,9 +64,15 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)memcpy (buf->data,fscache_get_aux (object->cookie), len); ret =cachefiles_inject_write_error (); -if (ret ==0 ) - ret =vfs_setxattr (&nop_mnt_idmap, dentry, cachefiles_xattr_cache, - buf,sizeof (struct cachefiles_xattr ) + len,0 ); +if (ret ==0 ) { + ret =mnt_want_write_file (file); +if (ret ==0 ) { + ret =vfs_setxattr (&nop_mnt_idmap, dentry, + cachefiles_xattr_cache, buf, +sizeof (struct cachefiles_xattr ) + len,0 ); +mnt_drop_write_file (file); + } + }if (ret <0 ) {trace_cachefiles_vfs_error (object,file_inode (file), ret, cachefiles_trace_setxattr_error);
@@ -151,8 +157,14 @@ int cachefiles_remove_object_xattr(struct cachefiles_cache *cache,int ret; ret =cachefiles_inject_remove_error (); -if (ret ==0 ) - ret =vfs_removexattr (&nop_mnt_idmap, dentry, cachefiles_xattr_cache); +if (ret ==0 ) { + ret =mnt_want_write (cache->mnt); +if (ret ==0 ) { + ret =vfs_removexattr (&nop_mnt_idmap, dentry, + cachefiles_xattr_cache); +mnt_drop_write (cache->mnt); + } + }if (ret <0 ) {trace_cachefiles_vfs_error (object,d_inode (dentry), ret, cachefiles_trace_remxattr_error);
@@ -208,9 +220,15 @@ bool cachefiles_set_volume_xattr(struct cachefiles_volume *volume)memcpy (buf->data, p, volume->vcookie->coherency_len); ret =cachefiles_inject_write_error (); -if (ret ==0 ) - ret =vfs_setxattr (&nop_mnt_idmap, dentry, cachefiles_xattr_cache, - buf, len,0 ); +if (ret ==0 ) { + ret =mnt_want_write (volume->cache->mnt); +if (ret ==0 ) { + ret =vfs_setxattr (&nop_mnt_idmap, dentry, + cachefiles_xattr_cache, + buf, len,0 ); +mnt_drop_write (volume->cache->mnt); + } + }if (ret <0 ) {trace_cachefiles_vfs_error (NULL ,d_inode (dentry), ret, cachefiles_trace_setxattr_error);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/538 erofs: fix incorrect symlink detection in fast symlink
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit 9ed50b8231e37b1ae863f5dec8153b98d9f389b4 ]
Fast symlink can be used if the on-disk symlink data is stored in the same block as the on-disk inode, so we don’t need to trigger another I/O for symlink data. However, currently fs correction could be reported _incorrectly_ if inode xattrs are too large.
In fact, these should be valid images although they cannot be handled as fast symlinks.
Many thanks to Colin for reporting this!
--- fs/erofs/inode.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-)
fs/erofs/inode.c +6 -14
@@ -205,12 +205,14 @@ static int erofs_fill_symlink(struct inode *inode, void *kaddr, unsigned int m_pofs) {struct erofs_inode *vi =EROFS_I (inode); -unsigned int bsz =i_blocksize (inode); +loff_t off;char *lnk; -/* if it cannot be handled with fast symlink scheme */ -if (vi->datalayout !=EROFS_INODE_FLAT_INLINE || - inode->i_size >= bsz || inode->i_size <0 ) { + m_pofs += vi->xattr_isize; +/* check if it cannot be handled with fast symlink scheme */ +if (vi->datalayout !=EROFS_INODE_FLAT_INLINE || inode->i_size <0 || +check_add_overflow (m_pofs, inode->i_size, &off) || + off >i_blocksize (inode)) { inode->i_op = &erofs_symlink_iops;return 0 ; }
@@ -219,16 +221,6 @@ static int erofs_fill_symlink(struct inode *inode, void *kaddr,if (!lnk)return -ENOMEM ; - m_pofs += vi->xattr_isize; -/* inline symlink data shouldn't cross block boundary */ -if (m_pofs + inode->i_size > bsz) { -kfree (lnk); -erofs_err (inode->i_sb, -"inline data cross block boundary @ nid %llu" , - vi->nid); -DBG_BUGON (1 ); -return -EFSCORRUPTED ; - }memcpy (lnk, kaddr + m_pofs, inode->i_size); lnk[inode->i_size] ='\0' ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/538 block, bfq: fix uaf for accessing waker_bfqq after splitting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 1ba0403ac6447f2d63914fb760c44a3b19c44eaf ]
After commit 42c306ed7233 ("block, bfq: don't break merge chain in bfq_split_bfqq()"), if the current procress is the last holder of bfqq, the bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and then access bfqq->waker_bfqq may trigger UAF. What's more, the waker_bfqq may in the merge chain of bfqq, hence just recored waker_bfqq is still not safe.
Fix the problem by adding a helper bfq_waker_bfqq() to check if bfqq->waker_bfqq is in the merge chain, and current procress is the only holder.
--- block/bfq-iosched.c | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-)
block/bfq-iosched.c +28 -3
@@ -6823,6 +6823,31 @@ static void bfq_prepare_request(struct request *rq) rq->elv.priv[0 ] = rq->elv.priv[1 ] =NULL ; } +static struct bfq_queue *bfq_waker_bfqq (struct bfq_queue *bfqq) +{ +struct bfq_queue *new_bfqq = bfqq->new_bfqq; +struct bfq_queue *waker_bfqq = bfqq->waker_bfqq; + +if (!waker_bfqq) +return NULL ; + +while (new_bfqq) { +if (new_bfqq == waker_bfqq) { +/* +* If waker_bfqq is in the merge chain, and current +* is the only procress. +*/ +if (bfqq_process_refs (waker_bfqq) ==1 ) +return NULL ; +break ; + } + + new_bfqq = new_bfqq->new_bfqq; + } + +return waker_bfqq; +} +/* * If needed, init rq, allocate bfq data structures associated with * rq, and increment reference counters in the destination bfq_queue
@@ -6884,7 +6909,7 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)/* If the queue was seeky for too long, break it apart. */ if (bfq_bfqq_coop (bfqq) &&bfq_bfqq_split_coop (bfqq) && !bic->bfqq_data[a_idx].stably_merged) { -struct bfq_queue *old_bfqq = bfqq; +struct bfq_queue *waker_bfqq =bfq_waker_bfqq (bfqq);/* Update bic before losing reference to bfqq */ if (bfq_bfqq_in_large_burst (bfqq))
@@ -6904,7 +6929,7 @@ static struct bfq_queue *bfq_init_rq(struct request *rq) bfqq_already_existing = true;if (!bfqq_already_existing) { - bfqq->waker_bfqq = old_bfqq->waker_bfqq; + bfqq->waker_bfqq = waker_bfqq; bfqq->tentative_waker_bfqq =NULL ;/*
@@ -6914,7 +6939,7 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)* woken_list of the waker. See * bfq_check_waker for details. */ -if (bfqq->waker_bfqq) +if (waker_bfqq)hlist_add_head (&bfqq->woken_list_node, &bfqq->waker_bfqq->woken_list); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/538 block, bfq: fix procress reference leakage for bfqq in merge chain
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 73aeab373557fa6ee4ae0b742c6211ccd9859280 ]
Original state:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\--------------\ \-------------\ \-------------\|
V V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 1 2 4
After commit 0e456dba86c7 ("block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()"), if P1 issues a new IO:
Without the patch:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\------------------------------\ \-------------\|
V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 0 2 4
bfqq3 will be used to handle IO from P1, this is not expected, IO should be redirected to bfqq4;
With the patch:
-------------------------------------------
| |
Process 1 Process 2 Process 3 | Process 4
(BIC1) (BIC2) (BIC3) | (BIC4)
| | | |
\-------------\ \-------------\|
V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 0 2 4
IO is redirected to bfqq4, however, procress reference of bfqq3 is still 2, while there is only P2 using it.
Fix the problem by calling bfq_merge_bfqqs() for each bfqq in the merge chain. Also change bfqq_merge_bfqqs() to return new_bfqq to simplify code.
--- block/bfq-iosched.c | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-)
block/bfq-iosched.c +17 -20
@@ -3129,10 +3129,12 @@ void bfq_release_process_ref(struct bfq_data *bfqd, struct bfq_queue *bfqq)bfq_put_queue (bfqq); } -static void -bfq_merge_bfqqs (struct bfq_data *bfqd,struct bfq_io_cq *bic, -struct bfq_queue *bfqq,struct bfq_queue *new_bfqq) +static struct bfq_queue *bfq_merge_bfqqs (struct bfq_data *bfqd, +struct bfq_io_cq *bic, +struct bfq_queue *bfqq) { +struct bfq_queue *new_bfqq = bfqq->new_bfqq; +bfq_log_bfqq (bfqd, bfqq,"merging with queue %lu" , (unsigned long )new_bfqq->pid);/* Save weight raising and idle window of the merged queues */
@@ -3226,6 +3228,8 @@ bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic,bfq_reassign_last_bfqq (bfqq, new_bfqq);bfq_release_process_ref (bfqd, bfqq); + +return new_bfqq; } static bool bfq_allow_bio_merge(struct request_queue *q, struct request *rq,
@@ -3261,14 +3265,8 @@ static bool bfq_allow_bio_merge(struct request_queue *q, struct request *rq,* fulfilled, i.e., bic can be redirected to new_bfqq * and bfqq can be put. */ -bfq_merge_bfqqs (bfqd, bfqd->bio_bic, bfqq, - new_bfqq); -/* -* If we get here, bio will be queued into new_queue, -* so use new_bfqq to decide whether bio and rq can be -* merged. -*/ - bfqq = new_bfqq; +while (bfqq != new_bfqq) + bfqq =bfq_merge_bfqqs (bfqd, bfqd->bio_bic, bfqq);/* * Change also bqfd->bio_bfqq, as
@@ -5703,9 +5701,7 @@ bfq_do_early_stable_merge(struct bfq_data *bfqd, struct bfq_queue *bfqq,* state before killing it. */ bfqq->bic = bic; -bfq_merge_bfqqs (bfqd, bic, bfqq, new_bfqq); - -return new_bfqq; +return bfq_merge_bfqqs (bfqd, bic, bfqq); }/*
@@ -6160,6 +6156,7 @@ static bool __bfq_insert_request(struct bfq_data *bfqd, struct request *rq)bool waiting, idle_timer_disabled = false;if (new_bfqq) { +struct bfq_queue *old_bfqq = bfqq;/* * Release the request's reference to the old bfqq * and make sure one is taken to the shared queue.
@@ -6176,18 +6173,18 @@ static bool __bfq_insert_request(struct bfq_data *bfqd, struct request *rq)* new_bfqq. */ if (bic_to_bfqq (RQ_BIC (rq), true, -bfq_actuator_index (bfqd, rq->bio)) == bfqq) -bfq_merge_bfqqs (bfqd,RQ_BIC (rq), - bfqq, new_bfqq); +bfq_actuator_index (bfqd, rq->bio)) == bfqq) { +while (bfqq != new_bfqq) + bfqq =bfq_merge_bfqqs (bfqd,RQ_BIC (rq), bfqq); + } -bfq_clear_bfqq_just_created (bfqq); +bfq_clear_bfqq_just_created (old_bfqq);/* * rq is about to be enqueued into new_bfqq, * release rq reference on bfqq */ -bfq_put_queue (bfqq); +bfq_put_queue (old_bfqq); rq->elv.priv[1 ] = new_bfqq; - bfqq = new_bfqq; }bfq_update_io_thinktime (bfqd, bfqq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/538 io_uring/io-wq: do not allow pinning outside of cpuset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Moessbauer <[email protected]>
[ Upstream commit 0997aa5497c714edbb349ca366d28bd550ba3408 ]
The io worker threads are userland threads that just never exit to the userland. By that, they are also assigned to a cgroup (the group of the creating task).
When changing the affinity of the io_wq thread via syscall, we must only allow cpumasks within the limits defined by the cpuset controller of the cgroup (if enabled).
--- io_uring/io-wq.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
io_uring/io-wq.c +18 -5
@@ -13,6 +13,7 @@#include <linux/slab.h> #include <linux/rculist_nulls.h> #include <linux/cpu.h> +#include <linux/cpuset.h> #include <linux/task_work.h> #include <linux/audit.h> #include <linux/mmu_context.h>
@@ -1324,17 +1325,29 @@ static int io_wq_cpu_offline(unsigned int cpu, struct hlist_node *node)int io_wq_cpu_affinity (struct io_uring_task *tctx,cpumask_var_t mask) { +cpumask_var_t allowed_mask; +int ret =0 ; +if (!tctx || !tctx->io_wq)return -EINVAL ; +if (!alloc_cpumask_var (&allowed_mask,GFP_KERNEL )) +return -ENOMEM ; +rcu_read_lock (); -if (mask) -cpumask_copy (tctx->io_wq->cpu_mask, mask); -else -cpumask_copy (tctx->io_wq->cpu_mask, cpu_possible_mask); +cpuset_cpus_allowed (tctx->io_wq->task, allowed_mask); +if (mask) { +if (cpumask_subset (mask, allowed_mask)) +cpumask_copy (tctx->io_wq->cpu_mask, mask); +else + ret = -EINVAL ; + }else { +cpumask_copy (tctx->io_wq->cpu_mask, allowed_mask); + }rcu_read_unlock (); -return 0 ; +free_cpumask_var (allowed_mask); +return ret; }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/538 io_uring/io-wq: inherit cpuset of cgroup in io worker
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Moessbauer <[email protected]>
[ Upstream commit 84eacf177faa605853c58e5b1c0d9544b88c16fd ]
The io worker threads are userland threads that just never exit to the userland. By that, they are also assigned to a cgroup (the group of the creating task).
When creating a new io worker, this worker should inherit the cpuset of the cgroup.
--- io_uring/io-wq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/io-wq.c +1 -1
@@ -1170,7 +1170,7 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data)if (!alloc_cpumask_var (&wq->cpu_mask,GFP_KERNEL )) goto err; -cpumask_copy (wq->cpu_mask, cpu_possible_mask); +cpuset_cpus_allowed (data->task, wq->cpu_mask); wq->acct[IO_WQ_ACCT_BOUND ].max_workers = bounded; wq->acct[IO_WQ_ACCT_UNBOUND ].max_workers =task_rlimit (current,RLIMIT_NPROC );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/538 block: print symbolic error name instead of error code
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Heusel <[email protected]>
[ Upstream commit 25c1772a0493463408489b1fae65cf77fe46cac1 ]
Utilize the %pe print specifier to get the symbolic error name as a string (i.e "-ENOMEM") in the log message instead of the error code to increase its readablility.
This change was suggested in
https://lore.kernel.org/all/[email protected]/
Stable-dep-of: 26e197b7f924 ("block: fix potential invalid pointer dereference in blk_add_partition")
--- block/partitions/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
block/partitions/core.c +2 -2
@@ -575,8 +575,8 @@ static bool blk_add_partition(struct gendisk *disk, part =add_partition (disk, p, from, size, state->parts[p].flags, &state->parts[p].info);if (IS_ERR (part) &&PTR_ERR (part) != -ENXIO ) { -printk (KERN_ERR " %s: p%d could not be added: %ld\n" , - disk->disk_name, p, -PTR_ERR (part)); +printk (KERN_ERR " %s: p%d could not be added: %pe\n" , + disk->disk_name, p, part);return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/538 block: fix potential invalid pointer dereference in blk_add_partition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Riyan Dhiman <[email protected]>
[ Upstream commit 26e197b7f9240a4ac301dd0ad520c0c697c2ea7d ]
The blk_add_partition() function initially used a single if-condition (IS_ERR(part)) to check for errors when adding a partition. This was modified to handle the specific case of -ENXIO separately, allowing the function to proceed without logging the error in this case. However, this change unintentionally left a path where md_autodetect_dev() could be called without confirming that part is a valid pointer.
This commit separates the error handling logic by splitting the initial if-condition, improving code readability and handling specific error scenarios explicitly. The function now distinguishes the general error case from -ENXIO without altering the existing behavior of md_autodetect_dev() calls.
--- block/partitions/core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
block/partitions/core.c +5 -3
@@ -574,9 +574,11 @@ static bool blk_add_partition(struct gendisk *disk, part =add_partition (disk, p, from, size, state->parts[p].flags, &state->parts[p].info); -if (IS_ERR (part) &&PTR_ERR (part) != -ENXIO ) { -printk (KERN_ERR " %s: p%d could not be added: %pe\n" , - disk->disk_name, p, part); +if (IS_ERR (part)) { +if (PTR_ERR (part) != -ENXIO ) { +printk (KERN_ERR " %s: p%d could not be added: %pe\n" , + disk->disk_name, p, part); + }return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/538 spi: ppc4xx: handle irq_of_parse_and_map() errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 0f245463b01ea254ae90e1d0389e90b0e7d8dc75 ]
Zero and negative number is not a valid IRQ for in-kernel code and the irq_of_parse_and_map() function returns zero on error. So this check for valid IRQs should only accept values > 0.
--- drivers/spi/spi-ppc4xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi-ppc4xx.c +3 -0
@@ -411,6 +411,9 @@ static int spi_ppc4xx_of_probe(struct platform_device *op)/* Request IRQ */ hw->irqnum =irq_of_parse_and_map (np,0 ); +if (hw->irqnum <=0 ) + goto free_host; + ret =request_irq (hw->irqnum, spi_ppc4xx_int,0 ,"spi_ppc4xx_of" , (void *)hw);if (ret) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/538 arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Virag <[email protected]>
[ Upstream commit d281814b8f7a710a75258da883fb0dfe1329c031 ]
All known jackpotlte variants have 4GB of RAM, let's use it all. RAM was set to 3GB from a mistake in the vendor provided DTS file.
--- arch/arm64/boot/dts/exynos/exynos7885-jackpotlte.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/exynos/exynos7885-jackpotlte.dts +1 -1
@@ -32,7 +32,7 @@ memory@80000000 { device_type = "memory"; reg = <0x0 0x80000000 0x3da00000>, <0x0 0xc0000000 0x40000000>, - <0x8 0x80000000 0x40000000>; + <0x8 0x80000000 0x80000000>; }; gpio-keys {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/538 arm64: dts: mediatek: mt8186: Fix supported-hw mask for GPU OPPs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 2317d018b835842df0501d8f9e9efa843068a101 ]
The speedbin eFuse reads a value 'x' from 0 to 7 and, in order to make that compatible with opp-supported-hw, it gets post processed as BIT(x).
Change all of the 0x30 supported-hw to 0x20 to avoid getting duplicate OPPs for speedbin 4, and also change all of the 0x8 to 0xcf because speedbins different from 4 and 5 do support 900MHz, 950MHz, 1000MHz with the higher voltage of 850mV, 900mV, 950mV respectively.
--- arch/arm64/boot/dts/mediatek/mt8186.dtsi | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/mediatek/mt8186.dtsi +6 -6
@@ -731,7 +731,7 @@ opp-850000000 { opp-900000000-3 { opp-hz = /bits/ 64 <900000000>; opp-microvolt = <850000>; - opp-supported-hw = <0x8>; + opp-supported-hw = <0xcf>; }; opp-900000000-4 {
@@ -743,13 +743,13 @@ opp-900000000-4 { opp-900000000-5 { opp-hz = /bits/ 64 <900000000>; opp-microvolt = <825000>; - opp-supported-hw = <0x30>; + opp-supported-hw = <0x20>; }; opp-950000000-3 { opp-hz = /bits/ 64 <950000000>; opp-microvolt = <900000>; - opp-supported-hw = <0x8>; + opp-supported-hw = <0xcf>; }; opp-950000000-4 {
@@ -761,13 +761,13 @@ opp-950000000-4 { opp-950000000-5 { opp-hz = /bits/ 64 <950000000>; opp-microvolt = <850000>; - opp-supported-hw = <0x30>; + opp-supported-hw = <0x20>; }; opp-1000000000-3 { opp-hz = /bits/ 64 <1000000000>; opp-microvolt = <950000>; - opp-supported-hw = <0x8>; + opp-supported-hw = <0xcf>; }; opp-1000000000-4 {
@@ -779,7 +779,7 @@ opp-1000000000-4 { opp-1000000000-5 { opp-hz = /bits/ 64 <1000000000>; opp-microvolt = <875000>; - opp-supported-hw = <0x30>; + opp-supported-hw = <0x20>; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/538 firmware: arm_scmi: Fix double free in OPTEE transport
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <[email protected]>
[ Upstream commit e98dba934b2fc587eafb83f47ad64d9053b18ae0 ]
Channels can be shared between protocols, avoid freeing the same channel descriptors twice when unloading the stack.
Message-Id: <[email protected]>
--- drivers/firmware/arm_scmi/optee.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/firmware/arm_scmi/optee.c +7 -0
@@ -467,6 +467,13 @@ static int scmi_optee_chan_free(int id, void *p, void *data)struct scmi_chan_info *cinfo = p;struct scmi_optee_channel *channel = cinfo->transport_info; +/* +* Different protocols might share the same chan info, so a previous +* call might have already freed the structure. +*/ +if (!channel) +return 0 ; +mutex_lock (&scmi_optee_private->mu);list_del (&channel->link);mutex_unlock (&scmi_optee_private->mu);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/538 spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 7781f1d120fec8624fc654eda900fc8748262082 ]
0 is incorrect error code when failed to parse and map IRQ. Replace OF specific old API for IRQ retrieval with a generic one to fix this issue.
--- drivers/spi/spi-ppc4xx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/spi/spi-ppc4xx.c +3 -3
@@ -26,7 +26,6 @@#include <linux/errno.h> #include <linux/wait.h> #include <linux/of_address.h> -#include <linux/of_irq.h> #include <linux/of_platform.h> #include <linux/interrupt.h> #include <linux/delay.h>
@@ -410,9 +409,10 @@ static int spi_ppc4xx_of_probe(struct platform_device *op) }/* Request IRQ */ - hw->irqnum =irq_of_parse_and_map (np,0 ); -if (hw->irqnum <=0 ) + ret =platform_get_irq (op,0 ); +if (ret <0 ) goto free_host; + hw->irqnum = ret; ret =request_irq (hw->irqnum, spi_ppc4xx_int,0 ,"spi_ppc4xx_of" , (void *)hw);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/538 regulator: Return actual error in of_regulator_bulk_get_all()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 395a41a1d3e377462f3eea8a205ee72be8885ff6 ]
If regulator_get() in of_regulator_bulk_get_all() returns an error, that error gets overridden and -EINVAL is always passed out. This masks probe deferral requests and likely won't work properly in all cases.
Fix this by letting of_regulator_bulk_get_all() return the original error code.
--- drivers/regulator/of_regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/of_regulator.c +1 -1
@@ -768,7 +768,7 @@ int of_regulator_bulk_get_all(struct device *dev, struct device_node *np, name[i] ='\0' ; tmp =regulator_get (dev, name);if (IS_ERR (tmp)) { - ret = -EINVAL ; + ret =PTR_ERR (tmp); goto error; } (*consumers)[n].consumer = tmp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/538 arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit ab39547f739236e7f16b8b0a51fdca95cc9cadd3 ]
The RZ/G2UL SoC is equipped with the GIC-600. The GICD is 64KiB + 64KiB for the MBI alias (in total 128KiB), and the GICR is 128KiB per CPU.
Despite the RZ/G2UL SoC being single-core, it has two instances of GICR.
--- arch/arm64/boot/dts/renesas/r9a07g043u.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/renesas/r9a07g043u.dtsi +2 -2
@@ -145,8 +145,8 @@ gic: interrupt-controller@11900000 { #interrupt-cells = <3>; #address-cells = <0>; interrupt-controller; - reg = <0x0 0x11900000 0 0x40000>, - <0x0 0x11940000 0 0x60000>; + reg = <0x0 0x11900000 0 0x20000>, + <0x0 0x11940000 0 0x40000>; interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/538 arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit 45afa9eacb59b258d2e53c7f63430ea1e8344803 ]
The RZ/V2L SoC is equipped with the GIC-600. The GICD is 64KiB + 64KiB for the MBI alias (in total 128KiB), and the GICR is 128KiB per CPU.
--- arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/renesas/r9a07g054.dtsi +2 -2
@@ -1004,8 +1004,8 @@ gic: interrupt-controller@11900000 { #interrupt-cells = <3>; #address-cells = <0>; interrupt-controller; - reg = <0x0 0x11900000 0 0x40000>, - <0x0 0x11940000 0 0x60000>; + reg = <0x0 0x11900000 0 0x20000>, + <0x0 0x11940000 0 0x40000>; interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/538 arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit 833948fb2b63155847ab691a54800f801555429b ]
The RZ/G2L(C) SoC is equipped with the GIC-600. The GICD is 64KiB + 64KiB for the MBI alias (in total 128KiB), and the GICR is 128KiB per CPU.
--- arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/renesas/r9a07g044.dtsi +2 -2
@@ -997,8 +997,8 @@ gic: interrupt-controller@11900000 { #interrupt-cells = <3>; #address-cells = <0>; interrupt-controller; - reg = <0x0 0x11900000 0 0x40000>, - <0x0 0x11940000 0 0x60000>; + reg = <0x0 0x11900000 0 0x20000>, + <0x0 0x11940000 0 0x40000>; interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/538 ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Dahl <[email protected]>
[ Upstream commit d355c895fa4ddd8bec15569eee540baeed7df8c5 ]
The RTC and RTT peripherals use the timing domain slow clock (TD_SLCK), sourced from the 32.768 kHz crystal oscillator or slow rc oscillator.
The previously used Monitoring domain slow clock (MD_SLCK) is sourced from an internal RC oscillator which is most probably not precise enough for real time clock purposes.
[claudiu.beznea: removed () around the last commit description paragraph,
removed " in front of "timing domain slow clock", described that TD_SLCK can also be sourced from slow rc oscillator]
--- arch/arm/boot/dts/microchip/sam9x60.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/microchip/sam9x60.dtsi +2 -2
@@ -1312,7 +1312,7 @@ rtt: rtc@fffffe20 { compatible = "microchip,sam9x60-rtt", "atmel,at91sam9260-rtt"; reg = <0xfffffe20 0x20>; interrupts = <1 IRQ_TYPE_LEVEL_HIGH 7>; - clocks = <&clk32k 0>; + clocks = <&clk32k 1>; }; pit: timer@fffffe40 {
@@ -1338,7 +1338,7 @@ rtc: rtc@fffffea8 { compatible = "microchip,sam9x60-rtc", "atmel,at91sam9x5-rtc"; reg = <0xfffffea8 0x100>; interrupts = <1 IRQ_TYPE_LEVEL_HIGH 7>; - clocks = <&clk32k 0>; + clocks = <&clk32k 1>; }; watchdog: watchdog@ffffff80 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/538 arm64: dts: rockchip: Correct vendor prefix for Hardkernel ODROID-M1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 735065e774dcfc62e38df01a535862138b6c92ed ]
The vendor prefix for Hardkernel ODROID-M1 is incorrectly listed as rockchip. Use the proper hardkernel vendor prefix for this board, while at it also drop the redundant soc prefix.
--- arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts +1 -1
@@ -13,7 +13,7 @@ / { model = "Hardkernel ODROID-M1"; - compatible = "rockchip,rk3568-odroid-m1", "rockchip,rk3568"; + compatible = "hardkernel,odroid-m1", "rockchip,rk3568"; aliases { ethernet0 = &gmac0;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/538 arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit 9f3814a7c06b7c7296cf8c1622078ad71820454b ]
The DMA carveout for the C6x core 0 is at 0xa6000000 and core 1 is at 0xa7000000. These are reversed in DT. While both C6x can access either region, so this is not normally a problem, but if we start restricting the memory each core can access (such as with firewalls) the cores accessing the regions for the wrong core will not work. Fix this here.
--- arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/ti/k3-j721e-sk.dts +2 -2
@@ -119,7 +119,7 @@ main_r5fss1_core1_memory_region: r5f-memory@a5100000 { no-map; }; - c66_1_dma_memory_region: c66-dma-memory@a6000000 { + c66_0_dma_memory_region: c66-dma-memory@a6000000 { compatible = "shared-dma-pool"; reg = <0x00 0xa6000000 0x00 0x100000>; no-map;
@@ -131,7 +131,7 @@ c66_0_memory_region: c66-memory@a6100000 { no-map; }; - c66_0_dma_memory_region: c66-dma-memory@a7000000 { + c66_1_dma_memory_region: c66-dma-memory@a7000000 { compatible = "shared-dma-pool"; reg = <0x00 0xa7000000 0x00 0x100000>; no-map;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/538 arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit 1a314099b7559690fe23cdf3300dfff6e830ecb1 ]
The DMA carveout for the C6x core 0 is at 0xa6000000 and core 1 is at 0xa7000000. These are reversed in DT. While both C6x can access either region, so this is not normally a problem, but if we start restricting the memory each core can access (such as with firewalls) the cores accessing the regions for the wrong core will not work. Fix this here.
--- arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts +2 -2
@@ -123,7 +123,7 @@ main_r5fss1_core1_memory_region: r5f-memory@a5100000 { no-map; }; - c66_1_dma_memory_region: c66-dma-memory@a6000000 { + c66_0_dma_memory_region: c66-dma-memory@a6000000 { compatible = "shared-dma-pool"; reg = <0x00 0xa6000000 0x00 0x100000>; no-map;
@@ -135,7 +135,7 @@ c66_0_memory_region: c66-memory@a6100000 { no-map; }; - c66_0_dma_memory_region: c66-dma-memory@a7000000 { + c66_1_dma_memory_region: c66-dma-memory@a7000000 { compatible = "shared-dma-pool"; reg = <0x00 0xa7000000 0x00 0x100000>; no-map;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/538 spi: bcmbca-hsspi: Fix missing pm_runtime_disable()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 4439a2e92cb89028b22c5d7ba1b99e75d7d889f6 ]
The pm_runtime_disable() is missing in remove function, use devm_pm_runtime_enable() to fix it. So the pm_runtime_disable() in the probe error path can also be removed.
--- drivers/spi/spi-bcmbca-hsspi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/spi/spi-bcmbca-hsspi.c +4 -4
@@ -546,12 +546,14 @@ static int bcmbca_hsspi_probe(struct platform_device *pdev) goto out_put_host; } -pm_runtime_enable (&pdev->dev); + ret =devm_pm_runtime_enable (&pdev->dev); +if (ret) + goto out_put_host; ret =sysfs_create_group (&pdev->dev.kobj, &bcmbca_hsspi_group);if (ret) {dev_err (&pdev->dev,"couldn't register sysfs group\n" ); - goto out_pm_disable; + goto out_put_host; }/* register and we are done */
@@ -565,8 +567,6 @@ static int bcmbca_hsspi_probe(struct platform_device *pdev) out_sysgroup_disable:sysfs_remove_group (&pdev->dev.kobj, &bcmbca_hsspi_group); -out_pm_disable: -pm_runtime_disable (&pdev->dev); out_put_host:spi_controller_put (host); out_disable_pll_clk:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/538 ARM: dts: microchip: sama7g5: Fix RTT clock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit 867bf1923200e6ad82bad0289f43bf20b4ac7ff9 ]
According to datasheet, Chapter 34. Clock Generator, section 34.2, Embedded characteristics, source clock for RTT is the TD_SLCK, registered with ID 1 by the slow clock controller driver. Fix RTT clock.
--- arch/arm/boot/dts/microchip/sama7g5.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/microchip/sama7g5.dtsi +1 -1
@@ -272,7 +272,7 @@ rtt: rtc@e001d020 { compatible = "microchip,sama7g5-rtt", "microchip,sam9x60-rtt", "atmel,at91sam9260-rtt"; reg = <0xe001d020 0x30>; interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&clk32k 0>; + clocks = <&clk32k 1>; }; clk32k: clock-controller@e001d050 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/538 ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 0e49cfe364dea4345551516eb2fe53135a10432b ]
There is no "fsl,phy" property in pin controller pincfg nodes:
imx7d-zii-rmu2.dtb: pinctrl@302c0000: enet1phyinterruptgrp: 'fsl,pins' is a required property imx7d-zii-rmu2.dtb: pinctrl@302c0000: enet1phyinterruptgrp: 'fsl,phy' does not match any of the regexes: 'pinctrl-[0-9]+'
--- arch/arm/boot/dts/nxp/imx/imx7d-zii-rmu2.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/nxp/imx/imx7d-zii-rmu2.dts +1 -1
@@ -350,7 +350,7 @@ MX7D_PAD_SD3_RESET_B__SD3_RESET_B 0x59 &iomuxc_lpsr { pinctrl_enet1_phy_interrupt: enet1phyinterruptgrp { - fsl,phy = < + fsl,pins = < MX7D_PAD_LPSR_GPIO1_IO02__GPIO1_IO2 0x08 >; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/538 ARM: versatile: fix OF node leak in CPUs prepare
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f2642d97f2105ed17b2ece0c597450f2ff95d704 ]
Machine code is leaking OF node reference from of_find_matching_node() in realview_smp_prepare_cpus().
--- arch/arm/mach-versatile/platsmp-realview.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-versatile/platsmp-realview.c +1 -0
@@ -66,6 +66,7 @@ static void __init realview_smp_prepare_cpus(unsigned int max_cpus)return ; } map =syscon_node_to_regmap (np); +of_node_put (np);if (IS_ERR (map)) {pr_err ("PLATSMP: No syscon regmap\n" );return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/538 reset: berlin: fix OF node leak in probe() error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5f58a88cc91075be38cec69b7cb70aaa4ba69e8b ]
Driver is leaking OF node reference on memory allocation failure. Acquire the OF node reference after memory allocation to fix this and keep it simple.
--- drivers/reset/reset-berlin.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/reset/reset-berlin.c +2 -1
@@ -68,13 +68,14 @@ static int berlin_reset_xlate(struct reset_controller_dev *rcdev,static int berlin2_reset_probe (struct platform_device *pdev) { -struct device_node *parent_np =of_get_parent (pdev->dev.of_node); +struct device_node *parent_np;struct berlin_reset_priv *priv; priv =devm_kzalloc (&pdev->dev,sizeof (*priv),GFP_KERNEL );if (!priv)return -ENOMEM ; + parent_np =of_get_parent (pdev->dev.of_node); priv->regmap =syscon_node_to_regmap (parent_np);of_node_put (parent_np);if (IS_ERR (priv->regmap))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/538 reset: k210: fix OF node leak in probe() error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit b14e40f5dc7cd0dd7e958010e6ca9ad32ff2ddad ]
Driver is leaking OF node reference on memory allocation failure. Acquire the OF node reference after memory allocation to fix this and keep it simple.
--- drivers/reset/reset-k210.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/reset/reset-k210.c +2 -1
@@ -90,7 +90,7 @@ static const struct reset_control_ops k210_rst_ops = {static int k210_rst_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev; -struct device_node *parent_np =of_get_parent (dev->of_node); +struct device_node *parent_np;struct k210_rst *ksr;dev_info (dev,"K210 reset controller\n" );
@@ -99,6 +99,7 @@ static int k210_rst_probe(struct platform_device *pdev)if (!ksr)return -ENOMEM ; + parent_np =of_get_parent (dev->of_node); ksr->map =syscon_node_to_regmap (parent_np);of_node_put (parent_np);if (IS_ERR (ksr->map))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/538 clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ankit Agrawal <[email protected]>
[ Upstream commit ca140a0dc0a18acd4653b56db211fec9b2339986 ]
Add the missing iounmap() when clock frequency fails to get read by the of_property_read_u32() call, or if the call to msm_timer_init() fails.
--- drivers/clocksource/timer-qcom.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/clocksource/timer-qcom.c +6 -1
@@ -233,6 +233,7 @@ static int __init msm_dt_timer_init(struct device_node *np) }if (of_property_read_u32 (np,"clock-frequency" , &freq)) { +iounmap (cpu0_base);pr_err ("Unknown frequency\n" );return -EINVAL ; }
@@ -243,7 +244,11 @@ static int __init msm_dt_timer_init(struct device_node *np) freq /=4 ;writel_relaxed (DGT_CLK_CTL_DIV_4 , source_base +DGT_CLK_CTL ); -return msm_timer_init (freq,32 , irq, !!percpu_offset); + ret =msm_timer_init (freq,32 , irq, !!percpu_offset); +if (ret) +iounmap (cpu0_base); + +return ret; }TIMER_OF_DECLARE (kpss_timer,"qcom,kpss-timer" , msm_dt_timer_init);TIMER_OF_DECLARE (scss_timer,"qcom,scss-timer" , msm_dt_timer_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/538 arm64: dts: mediatek: mt8195: Correct clock order for dp_intf*
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 51bc68debab9e30b50c6352315950f3cfc309b32 ]
The clocks for dp_intf* device nodes are given in the wrong order, causing the binding validation to fail.
--- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/mediatek/mt8195.dtsi +6 -6
@@ -2766,10 +2766,10 @@ dp_intf0: dp-intf@1c015000 { compatible = "mediatek,mt8195-dp-intf"; reg = <0 0x1c015000 0 0x1000>; interrupts = <GIC_SPI 657 IRQ_TYPE_LEVEL_HIGH 0>; - clocks = <&vdosys0 CLK_VDO0_DP_INTF0>, - <&vdosys0 CLK_VDO0_DP_INTF0_DP_INTF>, + clocks = <&vdosys0 CLK_VDO0_DP_INTF0_DP_INTF>, + <&vdosys0 CLK_VDO0_DP_INTF0>, <&apmixedsys CLK_APMIXED_TVDPLL1>; - clock-names = "engine", "pixel", "pll"; + clock-names = "pixel", "engine", "pll"; status = "disabled"; };
@@ -3036,10 +3036,10 @@ dp_intf1: dp-intf@1c113000 { reg = <0 0x1c113000 0 0x1000>; interrupts = <GIC_SPI 513 IRQ_TYPE_LEVEL_HIGH 0>; power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>; - clocks = <&vdosys1 CLK_VDO1_DP_INTF0_MM>, - <&vdosys1 CLK_VDO1_DPINTF>, + clocks = <&vdosys1 CLK_VDO1_DPINTF>, + <&vdosys1 CLK_VDO1_DP_INTF0_MM>, <&apmixedsys CLK_APMIXED_TVDPLL2>; - clock-names = "engine", "pixel", "pll"; + clock-names = "pixel", "engine", "pll"; status = "disabled"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/538 x86/mm: Use IPIs to synchronize LAM enablement
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yosry Ahmed <[email protected]>
[ Upstream commit 3b299b99556c1753923f8d9bbd9304bcd139282f ]
LAM can only be enabled when a process is single-threaded. But _kernel_ threads can temporarily use a single-threaded process's mm.
If LAM is enabled by a userspace process while a kthread is using its mm, the kthread will not observe LAM enablement (i.e. LAM will be disabled in CR3). This could be fine for the kthread itself, as LAM only affects userspace addresses. However, if the kthread context switches to a thread in the same userspace process, CR3 may or may not be updated because the mm_struct doesn't change (based on pending TLB flushes). If CR3 is not updated, the userspace thread will run incorrectly with LAM disabled, which may cause page faults when using tagged addresses. Example scenario:
CPU 1 CPU 2
/* kthread */kthread_use_mm()
/* user thread */
prctl_enable_tagged_addr()
/* LAM enabled on CPU 2 */
/* LAM disabled on CPU 1 */
context_switch() /* to CPU 1 *//* Switching to user thread */switch_mm_irqs_off()
/* CR3 not updated */
/* LAM is still disabled on CPU 1 */
Synchronize LAM enablement by sending an IPI to all CPUs running with the mm_struct to enable LAM. This makes sure LAM is enabled on CPU 1 in the above scenario before prctl_enable_tagged_addr() returns and userspace starts using tagged addresses, and before it's possible to run the userspace process on CPU 1.
In switch_mm_irqs_off(), move reading the LAM mask until after mm_cpumask() is updated. This ensures that if an outdated LAM mask is written to CR3, an IPI is received to update it right after IRQs are re-enabled.
[ dhansen: Add a LAM enabling helper and comment it ]
--- arch/x86/kernel/process_64.c | 29 ++++++++++++++++++++++++++--- arch/x86/mm/tlb.c | 7 +++---- 2 files changed, 29 insertions(+), 7 deletions(-)
arch/x86/kernel/process_64.c +26 -3
@@ -750,6 +750,27 @@ static long prctl_map_vdso(const struct vdso_image *image, unsigned long addr)#define LAM_U57_BITS 6 +static void enable_lam_func (void *__mm) +{ +struct mm_struct *mm = __mm; + +if (this_cpu_read (cpu_tlbstate.loaded_mm) == mm) { +write_cr3 (__read_cr3 () | mm->context.lam_cr3_mask); +set_tlbstate_lam_mode (mm); + } +} + +static void mm_enable_lam (struct mm_struct *mm) +{ +/* +* Even though the process must still be single-threaded at this +* point, kernel threads may be using the mm. IPI those kernel +* threads if they exist. +*/ +on_each_cpu_mask (mm_cpumask (mm), enable_lam_func, mm, true); +set_bit (MM_CONTEXT_LOCK_LAM , &mm->context.flags); +} +static int prctl_enable_tagged_addr (struct mm_struct *mm,unsigned long nr_bits) {if (!cpu_feature_enabled (X86_FEATURE_LAM ))
@@ -766,6 +787,10 @@ static int prctl_enable_tagged_addr(struct mm_struct *mm, unsigned long nr_bits)if (mmap_write_lock_killable (mm))return -EINTR ; +/* +* MM_CONTEXT_LOCK_LAM is set on clone. Prevent LAM from +* being enabled unless the process is single threaded: +*/ if (test_bit (MM_CONTEXT_LOCK_LAM , &mm->context.flags)) {mmap_write_unlock (mm);return -EBUSY ;
@@ -782,9 +807,7 @@ static int prctl_enable_tagged_addr(struct mm_struct *mm, unsigned long nr_bits)return -EINVAL ; } -write_cr3 (__read_cr3 () | mm->context.lam_cr3_mask); -set_tlbstate_lam_mode (mm); -set_bit (MM_CONTEXT_LOCK_LAM , &mm->context.flags); +mm_enable_lam (mm);mmap_write_unlock (mm);
arch/x86/mm/tlb.c +3 -4
@@ -497,9 +497,9 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, {struct mm_struct *real_prev =this_cpu_read (cpu_tlbstate.loaded_mm);u16 prev_asid =this_cpu_read (cpu_tlbstate.loaded_mm_asid); -unsigned long new_lam =mm_lam_cr3_mask (next);bool was_lazy =this_cpu_read (cpu_tlbstate_shared.is_lazy);unsigned cpu =smp_processor_id (); +unsigned long new_lam;u64 next_tlb_gen;bool need_flush;u16 new_asid;
@@ -622,9 +622,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,cpumask_clear_cpu (cpu,mm_cpumask (real_prev)); } -/* -* Start remote flushes and then read tlb_gen. -*/ +/* Start receiving IPIs and then read tlb_gen (and LAM below) */ if (next != &init_mm)cpumask_set_cpu (cpu,mm_cpumask (next)); next_tlb_gen =atomic64_read (&next->context.tlb_gen);
@@ -636,6 +634,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,barrier (); } + new_lam =mm_lam_cr3_mask (next);set_tlbstate_lam_mode (next);if (need_flush) {this_cpu_write (cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/538 ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 3ff810b9bebe5578a245cfa97c252ab602e703f1 ]
Return devm_of_clk_add_hw_provider() in order to transfer the error, if it fails due to resource allocation failure or device tree clock provider registration failure.
--- sound/soc/codecs/rt5682s.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/codecs/rt5682s.c +3 -1
@@ -2828,7 +2828,9 @@ static int rt5682s_register_dai_clks(struct snd_soc_component *component) }if (dev->of_node) { -devm_of_clk_add_hw_provider (dev, of_clk_hw_simple_get, dai_clk_hw); + ret =devm_of_clk_add_hw_provider (dev, of_clk_hw_simple_get, dai_clk_hw); +if (ret) +return ret; }else { ret =devm_clk_hw_register_clkdev (dev, dai_clk_hw, init.name,dev_name (dev));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/538 ASoC: tas2781: remove unused acpi_subysystem_id
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <[email protected]>
[ Upstream commit 4089d82e67a9967fc5bf2b4e5ef820d67fe73924 ]
The acpi_subysystem_id is only written and freed, not read, so unnecessary.
Stable-dep-of: c2c0b67dca3c ("ASoC: tas2781-i2c: Drop weird GPIO code")
--- include/sound/tas2781.h | 1 - sound/pci/hda/tas2781_hda_i2c.c | 12 ------------ sound/soc/codecs/tas2781-comlib.c | 1 - 3 files changed, 14 deletions(-)
include/sound/tas2781.h +0 -1
@@ -101,7 +101,6 @@ struct tasdevice_priv {struct tm tm;enum device_catlog_id catlog_id; -const char *acpi_subsystem_id;unsigned char cal_binaryname[TASDEVICE_MAX_CHANNELS ][64 ];unsigned char crc8_lkp_tbl[CRC8_TABLE_SIZE ];unsigned char coef_binaryname[64 ];
sound/pci/hda/tas2781_hda_i2c.c +0 -12
@@ -95,9 +95,7 @@ static int tas2781_get_i2c_res(struct acpi_resource *ares, void *data)static int tas2781_read_acpi (struct tasdevice_priv *p,const char *hid) {struct acpi_device *adev; -struct device *physdev;LIST_HEAD (resources); -const char *sub;int ret; adev =acpi_dev_get_first_match_dev (hid,NULL ,-1 );
@@ -113,18 +111,8 @@ static int tas2781_read_acpi(struct tasdevice_priv *p, const char *hid)acpi_dev_free_resource_list (&resources);strscpy (p->dev_name, hid,sizeof (p->dev_name)); - physdev =get_device (acpi_get_first_physical_node (adev));acpi_dev_put (adev); -/* No side-effect to the playback even if subsystem_id is NULL*/ - sub =acpi_get_subsystem_id (ACPI_HANDLE (physdev)); -if (IS_ERR (sub)) - sub =NULL ; - - p->acpi_subsystem_id = sub; - -put_device (physdev); -return 0 ; err:
sound/soc/codecs/tas2781-comlib.c +0 -1
@@ -408,7 +408,6 @@ void tasdevice_remove(struct tasdevice_priv *tas_priv) {if (gpio_is_valid (tas_priv->irq_info.irq_gpio))gpio_free (tas_priv->irq_info.irq_gpio); -kfree (tas_priv->acpi_subsystem_id);mutex_destroy (&tas_priv->codec_lock); }EXPORT_SYMBOL_GPL (tasdevice_remove);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/538 ASoC: tas2781: Use of_property_read_reg()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
[ Upstream commit 31a45f9190b5b4f5cd8cdec8471babd5215eee04 ]
Replace the open-coded parsing of "reg" with of_property_read_reg(). The #ifdef is also easily replaced with IS_ENABLED().
Stable-dep-of: c2c0b67dca3c ("ASoC: tas2781-i2c: Drop weird GPIO code")
--- sound/soc/codecs/tas2781-i2c.c | 34 +++++++++++----------------------- 1 file changed, 11 insertions(+), 23 deletions(-)
sound/soc/codecs/tas2781-i2c.c +11 -23
@@ -21,6 +21,7 @@#include <linux/interrupt.h> #include <linux/module.h> #include <linux/of.h> +#include <linux/of_address.h> #include <linux/of_gpio.h> #include <linux/of_irq.h> #include <linux/regmap.h>
@@ -633,33 +634,20 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) tas_priv->irq_info.irq_gpio =acpi_dev_gpio_irq_get (ACPI_COMPANION (&client->dev),0 ); - }else { + }else if (IS_ENABLED (CONFIG_OF )) {struct device_node *np = tas_priv->dev->of_node; -#ifdef CONFIG_OF -const __be32 *reg, *reg_end; -int len, sw, aw; - - aw =of_n_addr_cells (np); - sw =of_n_size_cells (np); -if (sw ==0 ) { - reg = (const __be32 *)of_get_property (np, -"reg" , &len); - reg_end = reg + len/sizeof (*reg); - ndev =0 ; -do { - dev_addrs[ndev] =of_read_number (reg, aw); - reg += aw; - ndev++; - }while (reg < reg_end); - }else { - ndev =1 ; - dev_addrs[0 ] = client->addr; +u64 addr; + +for (i =0 ; i <TASDEVICE_MAX_CHANNELS ; i++) { +if (of_property_read_reg (np, i, &addr,NULL )) +break ; + dev_addrs[ndev++] = addr; } -#else + + tas_priv->irq_info.irq_gpio =of_irq_get (np,0 ); + }else { ndev =1 ; dev_addrs[0 ] = client->addr; -#endif - tas_priv->irq_info.irq_gpio =of_irq_get (np,0 ); } tas_priv->ndev = ndev;for (i =0 ; i < ndev; i++)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/538 ASoC: tas2781-i2c: Drop weird GPIO code
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit c2c0b67dca3cb3b3cea0dd60075a1c5ba77e2fcd ]
The tas2781-i2c driver gets an IRQ from either ACPI or device tree, then proceeds to check if the IRQ has a corresponding GPIO and in case it does enforce the GPIO as input and set a label on it.
This is abuse of the API:
- First we cannot guarantee that the numberspaces of the GPIOs and the IRQs are the same, i.e that an IRQ number corresponds to a GPIO number like that.
- Second, GPIO chips and IRQ chips should be treated as orthogonal APIs, the irqchip needs to ascertain that the backing GPIO line is set to input etc just using the irqchip.
- Third it is using the legacy <linux/gpio.h> API which should not be used in new code yet this was added just a year ago.
Delete the offending code.
If this creates problems the GPIO and irqchip maintainers can help to fix the issues.
It *should* not create any problems, because the irq isn't used anywhere in the driver, it's just obtained and then left unused.
--- include/sound/tas2781.h | 7 +------ sound/pci/hda/tas2781_hda_i2c.c | 2 +- sound/soc/codecs/tas2781-comlib.c | 3 --- sound/soc/codecs/tas2781-fmwlib.c | 1 - sound/soc/codecs/tas2781-i2c.c | 24 +++--------------------- 5 files changed, 5 insertions(+), 32 deletions(-)
include/sound/tas2781.h +1 -6
@@ -78,11 +78,6 @@ struct tasdevice {bool is_loaderr; }; -struct tasdevice_irqinfo { -int irq_gpio; -int irq; -}; -struct calidata {unsigned char *data;unsigned long total_sz;
@@ -90,7 +85,6 @@ struct calidata {struct tasdevice_priv {struct tasdevice tasdevice[TASDEVICE_MAX_CHANNELS ]; -struct tasdevice_irqinfo irq_info;struct tasdevice_rca rcabin;struct calidata cali_data;struct tasdevice_fw *fmw;
@@ -111,6 +105,7 @@ struct tasdevice_priv {unsigned int chip_id;unsigned int sysclk; +int irq;int cur_prog;int cur_conf;int fw_state;
sound/pci/hda/tas2781_hda_i2c.c +1 -1
@@ -710,7 +710,7 @@ static int tas2781_hda_i2c_probe(struct i2c_client *clt) }else return -ENODEV ; - tas_hda->priv->irq_info.irq = clt->irq; + tas_hda->priv->irq = clt->irq; ret =tas2781_read_acpi (tas_hda->priv, device_name);if (ret) return dev_err_probe(tas_hda->dev, ret,
sound/soc/codecs/tas2781-comlib.c +0 -3
@@ -14,7 +14,6 @@#include <linux/interrupt.h> #include <linux/module.h> #include <linux/of.h> -#include <linux/of_gpio.h> #include <linux/of_irq.h> #include <linux/regmap.h> #include <linux/slab.h>
@@ -406,8 +405,6 @@ EXPORT_SYMBOL_GPL(tasdevice_dsp_remove);void tasdevice_remove (struct tasdevice_priv *tas_priv) { -if (gpio_is_valid (tas_priv->irq_info.irq_gpio)) -gpio_free (tas_priv->irq_info.irq_gpio);mutex_destroy (&tas_priv->codec_lock); }EXPORT_SYMBOL_GPL (tasdevice_remove);
sound/soc/codecs/tas2781-fmwlib.c +0 -1
@@ -13,7 +13,6 @@#include <linux/interrupt.h> #include <linux/module.h> #include <linux/of.h> -#include <linux/of_gpio.h> #include <linux/of_irq.h> #include <linux/regmap.h> #include <linux/slab.h>
sound/soc/codecs/tas2781-i2c.c +3 -21
@@ -22,7 +22,6 @@#include <linux/module.h> #include <linux/of.h> #include <linux/of_address.h> -#include <linux/of_gpio.h> #include <linux/of_irq.h> #include <linux/regmap.h> #include <linux/slab.h>
@@ -617,7 +616,7 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) {struct i2c_client *client = (struct i2c_client *)tas_priv->client;unsigned int dev_addrs[TASDEVICE_MAX_CHANNELS ]; -int rc, i, ndev =0 ; +int i, ndev =0 ;if (tas_priv->isacpi) { ndev = device_property_read_u32_array(&client->dev,
@@ -632,7 +631,7 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) "ti,audio-slots", dev_addrs, ndev); } - tas_priv->irq_info.irq_gpio = + tas_priv->irq =acpi_dev_gpio_irq_get (ACPI_COMPANION (&client->dev),0 ); }else if (IS_ENABLED (CONFIG_OF )) {struct device_node *np = tas_priv->dev->of_node;
@@ -644,7 +643,7 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) dev_addrs[ndev++] = addr; } - tas_priv->irq_info.irq_gpio =of_irq_get (np,0 ); + tas_priv->irq =of_irq_get (np,0 ); }else { ndev =1 ; dev_addrs[0 ] = client->addr;
@@ -660,23 +659,6 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) __func__);strcpy (tas_priv->dev_name, tasdevice_id[tas_priv->chip_id].name); - -if (gpio_is_valid (tas_priv->irq_info.irq_gpio)) { - rc =gpio_request (tas_priv->irq_info.irq_gpio, -"AUDEV-IRQ" ); -if (!rc) { -gpio_direction_input ( - tas_priv->irq_info.irq_gpio); - - tas_priv->irq_info.irq = -gpio_to_irq (tas_priv->irq_info.irq_gpio); - }else -dev_err (tas_priv->dev,"%s: GPIO %d request error\n" , - __func__, tas_priv->irq_info.irq_gpio); - }else -dev_err (tas_priv->dev, -"Looking up irq-gpio property failed %d\n" , - tas_priv->irq_info.irq_gpio); }static int tasdevice_i2c_probe (struct i2c_client *i2c)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/538 ASoC: tas2781-i2c: Get the right GPIO line
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit 1c4b509edad15192bfb64c81d3c305bbae8070db ]
The code is obtaining a GPIO reset using the reset GPIO name "reset-gpios", but the gpiolib is already adding the suffix "-gpios" to anything passed to this function and will be looking for "reset-gpios-gpios" which is most certainly not what the author desired.
Fix it up.
--- sound/soc/codecs/tas2781-i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/tas2781-i2c.c +1 -1
@@ -653,7 +653,7 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) tas_priv->tasdevice[i].dev_addr = dev_addrs[i]; tas_priv->reset =devm_gpiod_get_optional (&client->dev, -"reset-gpios" ,GPIOD_OUT_HIGH ); +"reset" ,GPIOD_OUT_HIGH );if (IS_ERR (tas_priv->reset))dev_err (tas_priv->dev,"%s Can't get reset GPIO\n" , __func__);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/538 selftests/ftrace: Add required dependency for kprobe tests
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit 41f37c852ac3fbfd072a00281b60dc7ba056be8c ]
kprobe_args_{char,string}.tc are using available_filter_functions file which is provided by function tracer. Thus if function tracer is disabled, these tests are failed on recent kernels because tracefs_create_dir is not raised events by adding a dynamic event.
Add available_filter_functions to requires line.
--- .../testing/selftests/ftrace/test.d/kprobe/kprobe_args_char.tc | 2 +- .../selftests/ftrace/test.d/kprobe/kprobe_args_string.tc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_char.tc +1 -1
@@ -1,7 +1,7 @@ #!/bin/sh # SPDX-License-Identifier: GPL-2.0 # description: Kprobe event char type argument -# requires: kprobe_events +# requires: kprobe_events available_filter_functions case `uname -m` in x86_64)
tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc +1 -1
@@ -1,7 +1,7 @@ #!/bin/sh # SPDX-License-Identifier: GPL-2.0 # description: Kprobe event string type argument -# requires: kprobe_events +# requires: kprobe_events available_filter_functions case `uname -m` in x86_64)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/538 ALSA: hda: cs35l41: fix module autoloading
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Liu <[email protected]>
[ Upstream commit 48f1434a4632c7da1a6a94e159512ebddbe13392 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from spi_device_id table.
--- sound/pci/hda/cs35l41_hda_spi.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/cs35l41_hda_spi.c +1 -0
@@ -38,6 +38,7 @@ static const struct spi_device_id cs35l41_hda_spi_id[] = { { "cs35l41-hda", 0 }, {} }; +MODULE_DEVICE_TABLE (spi, cs35l41_hda_spi_id);static const struct acpi_device_id cs35l41_acpi_hda_match[] = { { "CSC3551", 0 },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/538 m68k: Fix kernel_clone_args.flags in m68k_clone()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 09b3d870faa7bc3e96c0978ab3cf4e96e4b15571 ]
Stan Johnson recently reported a failure from the 'dump' command:
DUMP: Date of this level 0 dump: Fri Aug 9 23:37:15 2024
DUMP: Dumping /dev/sda (an unlisted file system) to /dev/null
DUMP: Label: none
DUMP: Writing 10 Kilobyte records
DUMP: mapping (Pass I) [regular files]
DUMP: mapping (Pass II) [directories]
DUMP: estimated 3595695 blocks.
DUMP: Context save fork fails in parent 671
The dump program uses the clone syscall with the CLONE_IO flag, that is, flags == 0x80000000. When that value is promoted from long int to u64 by m68k_clone(), it undergoes sign-extension. The new value includes CLONE_INTO_CGROUP so the validation in cgroup_css_set_fork() fails and the syscall returns -EBADF. Avoid sign-extension by casting to u32.
--- arch/m68k/kernel/process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/kernel/process.c +1 -1
@@ -116,7 +116,7 @@ asmlinkage int m68k_clone(struct pt_regs *regs) {/* regs will be equal to current_pt_regs() */ struct kernel_clone_args args = { - .flags = regs->d1 & ~CSIGNAL , + .flags = (u32)(regs->d1) & ~CSIGNAL , .pidfd = (int __user *)regs->d3, .child_tid = (int __user *)regs->d4, .parent_tid = (int __user *)regs->d3,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/538 ASoC: loongson: fix error release
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: tangbin <[email protected]>
[ Upstream commit 97688a9c5b1fd2b826c682cdfa36d411a5c99828 ]
In function loongson_card_parse_of(), when get device_node 'codec' failed, the function of_node_put(codec) should not be invoked, thus fix error release.
--- sound/soc/loongson/loongson_card.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/loongson/loongson_card.c +2 -2
@@ -127,8 +127,8 @@ static int loongson_card_parse_of(struct loongson_card_data *data) codec =of_get_child_by_name (dev->of_node,"codec" );if (!codec) {dev_err (dev,"audio-codec property missing or invalid\n" ); - ret = -EINVAL ; - goto err; +of_node_put (cpu); +return -EINVAL ; }for (i =0 ; i < card->num_links; i++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/538 hwmon: (max16065) Fix overflows seen when writing limits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 744ec4477b11c42e2c8de9eb8364675ae7a0bd81 ]
Writing large limits resulted in overflows as reported by module tests.
in0_lcrit: Suspected overflow: [max=5538, read 0, written 2147483647]in0_crit: Suspected overflow: [max=5538, read 0, written 2147483647]in0_min: Suspected overflow: [max=5538, read 0, written 2147483647]
Fix the problem by clamping prior to multiplications and the use of DIV_ROUND_CLOSEST, and by using consistent variable types.
--- drivers/hwmon/max16065.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/hwmon/max16065.c +3 -2
@@ -114,9 +114,10 @@ static inline int LIMIT_TO_MV(int limit, int range)return limit * range /256 ; } -static inline int MV_TO_LIMIT (int mv,int range) +static inline int MV_TO_LIMIT (unsigned long mv,int range) { -return clamp_val (DIV_ROUND_CLOSEST (mv *256 , range),0 ,255 ); + mv =clamp_val (mv,0 ,ULONG_MAX /256 ); +return DIV_ROUND_CLOSEST (clamp_val (mv *256 ,0 , range *255 ), range); }static inline int ADC_TO_CURR (int adc,int gain)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/538 hwmon: (max16065) Remove use of i2c_match_id()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit 5a71654b398e3471f0169c266a3587cf09e1200c ]
The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data().
This helper has a couple other benefits:
* It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove those or move the i2c_device_id table down to its more natural spot with the other module info.
* It also checks for device match data, which allows for OF and ACPI based probing. That means we do not have to manually check those first and can remove those checks.
Stable-dep-of: 119abf7d1815 ("hwmon: (max16065) Fix alarm attributes")
--- drivers/hwmon/max16065.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/hwmon/max16065.c +4 -6
@@ -494,8 +494,6 @@ static const struct attribute_group max16065_max_group = { .is_visible = max16065_secondary_is_visible, }; -static const struct i2c_device_id max16065_id[]; -static int max16065_probe (struct i2c_client *client) {struct i2c_adapter *adapter = client->adapter;
@@ -506,7 +504,7 @@ static int max16065_probe(struct i2c_client *client)bool have_secondary;/* true if chip has secondary limits */ bool secondary_is_max = false;/* secondary limits reflect max */ int groups =0 ; -const struct i2c_device_id *id =i2c_match_id (max16065_id, client); +enum chips chip = (uintptr_t )i2c_get_match_data (client);if (!i2c_check_functionality (adapter,I2C_FUNC_SMBUS_BYTE_DATA |I2C_FUNC_SMBUS_READ_WORD_DATA ))
@@ -519,9 +517,9 @@ static int max16065_probe(struct i2c_client *client) data->client = client;mutex_init (&data->update_lock); - data->num_adc = max16065_num_adc[id->driver_data]; - data->have_current = max16065_have_current[id->driver_data]; - have_secondary = max16065_have_secondary[id->driver_data]; + data->num_adc = max16065_num_adc[chip]; + data->have_current = max16065_have_current[chip]; + have_secondary = max16065_have_secondary[chip];if (have_secondary) { val =i2c_smbus_read_byte_data (client,MAX16065_SW_ENABLE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/538 hwmon: (max16065) Fix alarm attributes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 119abf7d1815f098f7f91ae7abc84324a19943d7 ]
Chips reporting overcurrent alarms report it in the second alarm register. That means the second alarm register has to be read, even if the chip only supports 8 or fewer ADC channels.
MAX16067 and MAX16068 report undervoltage and overvoltage alarms in separate registers. Fold register contents together to report both with the existing alarm attribute. This requires actually storing the chip type in struct max16065_data. Rename the variable 'chip' to match the variable name used in the probe function.
--- drivers/hwmon/max16065.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/hwmon/max16065.c +10 -2
@@ -79,7 +79,7 @@ static const bool max16065_have_current[] = { };struct max16065_data { -enum chips type; +enum chips chip;struct i2c_client *client;const struct attribute_group *groups[4 ];struct mutex update_lock;
@@ -162,10 +162,17 @@ static struct max16065_data *max16065_update_device(struct device *dev) MAX16065_CURR_SENSE); } -for (i =0 ; i <DIV_ROUND_UP (data->num_adc,8 ); i++) +for (i =0 ; i <2 ; i++) data->fault[i] =i2c_smbus_read_byte_data (client,MAX16065_FAULT (i)); +/* +* MAX16067 and MAX16068 have separate undervoltage and +* overvoltage alarm bits. Squash them together. +*/ +if (data->chip == max16067 || data->chip == max16068) + data->fault[0 ] |= data->fault[1 ]; + data->last_updated = jiffies; data->valid = true; }
@@ -514,6 +521,7 @@ static int max16065_probe(struct i2c_client *client)if (unlikely (!data))return -ENOMEM ; + data->chip = chip; data->client = client;mutex_init (&data->update_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/538 mtd: slram: insert break after errors in parsing the map
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mirsad Todorovac <[email protected]>
[ Upstream commit 336c218dd7f0588ed8a7345f367975a00a4f003f ]
GCC 12.3.0 compiler on linux-next next-20240709 tree found the execution path in which, due to lazy evaluation, devlength isn't initialised with the parsed string:
289 while (map) {
290 devname = devstart = devlength = NULL;
291
292 if (!(devname = strsep(&map, ","))) {
293 E("slram: No devicename specified.\n");
294 break;
295 }
296 T("slram: devname = %s\n", devname);
297 if ((!map) || (!(devstart = strsep(&map, ",")))) {
298 E("slram: No devicestart specified.\n");
299 }
300 T("slram: devstart = %s\n", devstart);
→ 301 if ((!map) || (!(devlength = strsep(&map, ",")))) {
302 E("slram: No devicelength / -end specified.\n");
303 }
→ 304 T("slram: devlength = %s\n", devlength);
305 if (parse_cmdline(devname, devstart, devlength) != 0) {
306 return(-EINVAL);
307 }
Parsing should be finished after map == NULL, so a break is best inserted after each E("slram: ... \n") error message.
--- drivers/mtd/devices/slram.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mtd/devices/slram.c +2 -0
@@ -296,10 +296,12 @@ static int __init init_slram(void)T ("slram: devname = %s\n" , devname);if ((!map) || (!(devstart =strsep (&map,"," )))) {E ("slram: No devicestart specified.\n" ); +break ; }T ("slram: devstart = %s\n" , devstart);if ((!map) || (!(devlength =strsep (&map,"," )))) {E ("slram: No devicelength / -end specified.\n" ); +break ; }T ("slram: devlength = %s\n" , devlength);if (parse_cmdline (devname, devstart, devlength) !=0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/538 hwmon: (ntc_thermistor) fix module autoloading
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Liu <[email protected]>
[ Upstream commit b6964d66a07a9003868e428a956949e17ab44d7e ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
Message-ID: <[email protected]>
--- drivers/hwmon/ntc_thermistor.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/ntc_thermistor.c +1 -0
@@ -62,6 +62,7 @@ static const struct platform_device_id ntc_thermistor_id[] = { [NTC_SSG1404001221] = { "ssg1404_001221", TYPE_NCPXXWB473 }, [NTC_LAST ] = { }, }; +MODULE_DEVICE_TABLE (platform ,ntc_thermistor_id );/* * A compensation table should be sorted by the values of .ohm
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/538 power: supply: axp20x_battery: Remove design from min and max voltage
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Morgan <[email protected]>
[ Upstream commit 61978807b00f8a1817b0e5580981af1cd2f428a5 ]
The POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN and POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN values should be immutable properties of the battery, but for this driver they are writable values and used as the minimum and maximum values for charging. Remove the DESIGN designation from these values.
--- drivers/power/supply/axp20x_battery.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/power/supply/axp20x_battery.c +8 -8
@@ -303,11 +303,11 @@ static int axp20x_battery_get_prop(struct power_supply *psy, val->intval = reg &AXP209_FG_PERCENT ;break ; -case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MAX :return axp20x_batt->data->get_max_voltage (axp20x_batt, &val->intval); -case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MIN : ret =regmap_read (axp20x_batt->regmap,AXP20X_V_OFF , ®);if (ret)return ret;
@@ -455,10 +455,10 @@ static int axp20x_battery_set_prop(struct power_supply *psy,struct axp20x_batt_ps *axp20x_batt =power_supply_get_drvdata (psy);switch (psp) { -case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MIN :return axp20x_set_voltage_min_design (axp20x_batt, val->intval); -case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MAX :return axp20x_batt->data->set_max_voltage (axp20x_batt, val->intval);case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT :
@@ -493,8 +493,8 @@ static enum power_supply_property axp20x_battery_props[] = {POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT ,POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX ,POWER_SUPPLY_PROP_HEALTH , -POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN , -POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN , +POWER_SUPPLY_PROP_VOLTAGE_MAX , +POWER_SUPPLY_PROP_VOLTAGE_MIN , POWER_SUPPLY_PROP_CAPACITY, };
@@ -502,8 +502,8 @@ static int axp20x_battery_prop_writeable(struct power_supply *psy, enum power_supply_property psp) {return psp ==POWER_SUPPLY_PROP_STATUS || - psp ==POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN || - psp ==POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN || + psp ==POWER_SUPPLY_PROP_VOLTAGE_MIN || + psp ==POWER_SUPPLY_PROP_VOLTAGE_MAX || psp ==POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT || psp ==POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/538 power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 3a3acf839b2cedf092bdd1ff65b0e9895df1656b ]
Commit 223a3b82834f ("power: supply: max17042_battery: use VFSOC for capacity when no rsns") made it so that capacity on systems without current sensing would be read from VFSOC instead of RepSOC. However, the SOC threshold calculation still read RepSOC to get the SOC regardless of the current sensing option state.
Fix this by applying the same conditional to determine which register should be read.
This also seems to be the intended behavior as per the datasheet - SOC alert config value in MiscCFG on setups without current sensing is set to a value of 0b11, indicating SOC alerts being generated based on VFSOC, instead of 0b00 which indicates SOC alerts being generated based on RepSOC.
This fixes an issue on the Galaxy S3/Midas boards, where the alert interrupt would be constantly retriggered, causing high CPU usage on idle (around ~12%-15%).
--- drivers/power/supply/max17042_battery.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/power/supply/max17042_battery.c +4 -1
@@ -853,7 +853,10 @@ static void max17042_set_soc_threshold(struct max17042_chip *chip, u16 off)/* program interrupt thresholds such that we should * get interrupt for every 'off' perc change in the soc */ -regmap_read (map, MAX17042_RepSOC, &soc); +if (chip->pdata->enable_current_sense) +regmap_read (map, MAX17042_RepSOC, &soc); +else +regmap_read (map,MAX17042_VFSOC , &soc); soc >>=8 ; soc_tr = (soc + off) <<8 ;if (off < soc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/538 fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit aa578e897520f32ae12bec487f2474357d01ca9c ]
If an error occurs after request_mem_region(), a corresponding release_mem_region() should be called, as already done in the remove function.
--- drivers/video/fbdev/hpfb.c | 1 + 1 file changed, 1 insertion(+)
drivers/video/fbdev/hpfb.c +1 -0
@@ -343,6 +343,7 @@ static int hpfb_dio_probe(struct dio_dev *d, const struct dio_device_id *ent)if (hpfb_init_one (paddr, vaddr)) {if (d->scode >=DIOII_SCBASE )iounmap ((void *)vaddr); +release_mem_region (d->resource.start,resource_size (&d->resource));return -ENOMEM ; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/538 iommu/amd: Do not set the D bit on AMD v2 table entries
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit 2910a7fa1be090fc7637cef0b2e70bcd15bf5469 ]
The manual says that bit 6 is IGN for all Page-Table Base Address pointers, don't set it.
--- drivers/iommu/amd/io_pgtable_v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd/io_pgtable_v2.c +1 -1
@@ -50,7 +50,7 @@ static inline u64 set_pgtable_attr(u64 *page)u64 prot; prot =IOMMU_PAGE_PRESENT |IOMMU_PAGE_RW |IOMMU_PAGE_USER ; - prot |=IOMMU_PAGE_ACCESS |IOMMU_PAGE_DIRTY ; + prot |=IOMMU_PAGE_ACCESS ;return (iommu_virt_to_phys (page) | prot); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/538 mtd: powernv: Add check devm_kasprintf() returned value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Han <[email protected]>
[ Upstream commit 395999829880a106bb95f0ce34e6e4c2b43c6a5d ]
devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked.
--- drivers/mtd/devices/powernv_flash.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mtd/devices/powernv_flash.c +3 -0
@@ -207,6 +207,9 @@ static int powernv_flash_set_driver_info(struct device *dev,* get them */ mtd->name =devm_kasprintf (dev,GFP_KERNEL ,"%pOFP" , dev->of_node); +if (!mtd->name) +return -ENOMEM ; + mtd->type =MTD_NORFLASH ; mtd->flags =MTD_WRITEABLE ; mtd->size = size;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/538 rcu/nocb: Fix RT throttling hrtimer armed from offline CPU
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <[email protected]>
[ Upstream commit 9139f93209d1ffd7f489ab19dee01b7c3a1a43d2 ]
After a CPU is marked offline and until it reaches its final trip to idle, rcuo has several opportunities to be woken up, either because a callback has been queued in the meantime or because rcutree_report_cpu_dead() has issued the final deferred NOCB wake up.
If RCU-boosting is enabled, RCU kthreads are set to SCHED_FIFO policy. And if RT-bandwidth is enabled, the related hrtimer might be armed. However this then happens after hrtimers have been migrated at the CPUHP_AP_HRTIMERS_DYING stage, which is broken as reported by the following warning:
Call trace: enqueue_hrtimer+0x7c/0xf8 hrtimer_start_range_ns+0x2b8/0x300 enqueue_task_rt+0x298/0x3f0 enqueue_task+0x94/0x188 ttwu_do_activate+0xb4/0x27c try_to_wake_up+0x2d8/0x79c wake_up_process+0x18/0x28 __wake_nocb_gp+0x80/0x1a0 do_nocb_deferred_wakeup_common+0x3c/0xcc rcu_report_dead+0x68/0x1ac cpuhp_report_idle_dead+0x48/0x9c do_idle+0x288/0x294 cpu_startup_entry+0x34/0x3c secondary_start_kernel+0x138/0x158
Fix this with waking up rcuo using an IPI if necessary. Since the existing API to deal with this situation only handles swait queue, rcuo is only woken up from offline CPUs if it's not already waiting on a grace period. In the worst case some callbacks will just wait for a grace period to complete before being assigned to a subsequent one.
--- kernel/rcu/tree_nocb.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/rcu/tree_nocb.h +4 -1
@@ -220,7 +220,10 @@ static bool __wake_nocb_gp(struct rcu_data *rdp_gp,raw_spin_unlock_irqrestore (&rdp_gp->nocb_gp_lock, flags);if (needwake) {trace_rcu_nocb_wake (rcu_state.name, rdp->cpu,TPS ("DoWake" )); -wake_up_process (rdp_gp->nocb_gp_kthread); +if (cpu_is_offline (raw_smp_processor_id ())) +swake_up_one_online (&rdp_gp->nocb_gp_wq); +else +wake_up_process (rdp_gp->nocb_gp_kthread); }return needwake;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/538 mtd: rawnand: mtk: Use for_each_child_of_node_scoped()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 8795952679494b111b7b2ba08bb54ac408daca3b ]
Avoids the need for manual cleanup of_node_put() in early exits from the loop.
Stable-dep-of: 2073ae37d550 ("mtd: rawnand: mtk: Fix init error path")
--- drivers/mtd/nand/raw/mtk_nand.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/mtd/nand/raw/mtk_nand.c +2 -5
@@ -1432,15 +1432,12 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,static int mtk_nfc_nand_chips_init (struct device *dev,struct mtk_nfc *nfc) {struct device_node *np = dev->of_node; -struct device_node *nand_np;int ret; -for_each_child_of_node (np, nand_np) { +for_each_child_of_node_scoped (np, nand_np) { ret =mtk_nfc_nand_chip_init (dev, nfc, nand_np); -if (ret) { -of_node_put (nand_np); +if (ret)return ret; - } }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/538 mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit 81cb3be3261e766a1f8efab9e3154a4f4fd9d03d ]
There are some un-freed resources in one of the error path which would benefit from a helper going through all the registered mtk chips one by one and perform all the necessary cleanup. This is precisely what the remove path does, so let's extract the logic in a helper.
There is no functional change.
Stable-dep-of: 2073ae37d550 ("mtd: rawnand: mtk: Fix init error path")
--- drivers/mtd/nand/raw/mtk_nand.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
drivers/mtd/nand/raw/mtk_nand.c +18 -13
@@ -1429,6 +1429,23 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,return 0 ; } +static void mtk_nfc_nand_chips_cleanup (struct mtk_nfc *nfc) +{ +struct mtk_nfc_nand_chip *mtk_chip; +struct nand_chip *chip; +int ret; + +while (!list_empty (&nfc->chips)) { + mtk_chip =list_first_entry (&nfc->chips, + struct mtk_nfc_nand_chip, node); + chip = &mtk_chip->nand; + ret =mtd_device_unregister (nand_to_mtd (chip)); +WARN_ON (ret); +nand_cleanup (chip); +list_del (&mtk_chip->node); + } +} +static int mtk_nfc_nand_chips_init (struct device *dev,struct mtk_nfc *nfc) {struct device_node *np = dev->of_node;
@@ -1567,20 +1584,8 @@ static int mtk_nfc_probe(struct platform_device *pdev)static void mtk_nfc_remove (struct platform_device *pdev) {struct mtk_nfc *nfc =platform_get_drvdata (pdev); -struct mtk_nfc_nand_chip *mtk_chip; -struct nand_chip *chip; -int ret; - -while (!list_empty (&nfc->chips)) { - mtk_chip =list_first_entry (&nfc->chips, - struct mtk_nfc_nand_chip, node); - chip = &mtk_chip->nand; - ret =mtd_device_unregister (nand_to_mtd (chip)); -WARN_ON (ret); -nand_cleanup (chip); -list_del (&mtk_chip->node); - } +mtk_nfc_nand_chips_cleanup (nfc);mtk_ecc_release (nfc->ecc); }
Signature · 1 line
2.43.0