6.11.2-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.11.2-rc1 review
This is the start of the stable review cycle for the 6.11.2 release. There are 695 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 04 Oct 2024 12:56:13 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.11.2-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.11.2-rc1
Oleg Nesterov <[email protected]>
bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
Paolo Bonzini <[email protected]>
Documentation: KVM: fix warning in "make htmldocs"
Robert Hancock <[email protected]>
i2c: xiic: Try re-initialization on bus busy timeout
Andy Shevchenko <[email protected]>
i2c: isch: Add missed 'else'
Tommy Huang <[email protected]>
i2c: aspeed: Update the stop sw state when the bus recovery occurs
Liam R. Howlett <[email protected]>
mm/damon/vaddr: protect vma traversal in __damon_va_thre_regions() with rcu read lock
Vishal Moola (Oracle) <[email protected]>
mm: change vmf_anon_prepare() to __vmf_anon_prepare()
Miaohe Lin <[email protected]>
mm/huge_memory: ensure huge_zero_folio won't have large_rmappable flag set
Vishal Moola (Oracle) <[email protected]>
mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway
Kexy Biscuit <[email protected]>
tpm: export tpm2_sessions_init() to fix ibmvtpm building
Jason Andryuk <[email protected]>
fbdev: xen-fbfront: Assign fb_info->device
Dmitry Vyukov <[email protected]>
module: Fix KCOV-ignored file name
Haibo Chen <[email protected]>
spi: fspi: add support for imx8ulp
David Gow <[email protected]>
mm: only enforce minimum stack gap size if it's sensible
Jeff Xu <[email protected]>
selftest mm/mseal: fix test_seal_mremap_move_dontunmap_anyaddr
Vasily Gorbik <[email protected]>
s390/ftrace: Avoid calling unwinder in ftrace_return_address()
Yu Zhao <[email protected]>
mm/hugetlb_vmemmap: batch HVO work when demoting
Daniel Yang <[email protected]>
exfat: resolve memory leak from exfat_create_upcase_table()
Zhiguo Niu <[email protected]>
lockdep: fix deadlock issue between lockdep and rcu
Tiezhu Yang <[email protected]>
compiler.h: specify correct attribute for .rodata..c_jump_table
Mikulas Patocka <[email protected]>
dm-verity: restart or panic on an I/O error
Song Liu <[email protected]>
bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0
Casey Schaufler <[email protected]>
lsm: infrastructure management of the sock security
Rafael J. Wysocki <[email protected]>
thermal: sysfs: Add sanity checks for trip temperature and hysteresis
Rafael J. Wysocki <[email protected]>
thermal: sysfs: Refine the handling of trip hysteresis changes
Rafael J. Wysocki <[email protected]>
thermal: sysfs: Get to trips via attribute pointers
Rafael J. Wysocki <[email protected]>
thermal: core: Store trip sysfs attributes in thermal_trip_desc
Johan Hovold <[email protected]>
serial: qcom-geni: fix console corruption
Douglas Anderson <[email protected]>
serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield()
Douglas Anderson <[email protected]>
serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit()
Douglas Anderson <[email protected]>
soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Fix busy loop on ASUS VivoBooks
Heikki Krogerus <[email protected]>
usb: typec: ucsi: Call CANCEL from single location
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix soc_dev leak during device remove
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix memory leak during device remove
Thomas Weißschuh <[email protected]>
tools/nolibc: include arch.h from string.h
Krzysztof Kozlowski <[email protected]>
ARM: dts: imx6ull-seeed-npi: fix fsl,pins property in tscgrp pinctrl
Krzysztof Kozlowski <[email protected]>
ARM: dts: imx6ul-geam: fix fsl,pins property in tscgrp pinctrl
Haibo Chen <[email protected]>
dt-bindings: spi: nxp-fspi: add imx8ulp support
Haibo Chen <[email protected]>
spi: fspi: involve lut_num for struct nxp_fspi_devtype_data
Paul Moore <[email protected]>
lsm: add the inode_free_security_rcu() LSM implementation hook
VanGiang Nguyen <[email protected]>
padata: use integer wrap around to prevent deadlock on seq_nr overflow
Krzysztof Kozlowski <[email protected]>
cpuidle: riscv-sbi: Use scoped device node handling to fix missing of_node_put
Yu Kuai <[email protected]>
md: Don't flush sync_work in md_write_start()
Martin Karsten <[email protected]>
eventpoll: Annotate data-race of busy_poll_usecs
Eric Dumazet <[email protected]>
icmp: change the order of rate limits
Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix conversion of system address to physical memory address
Li Lingfeng <[email protected]>
nfs: fix memory leak in error path of nfs4_do_reclaim
Mickaël Salaün <[email protected]>
fs: Fix file_set_fowner LSM hook inconsistencies
Baokun Li <[email protected]>
netfs: Delete subtree of 'fs/netfs' when netfs module exits
Julian Sun <[email protected]>
vfs: fix race between evice_inodes() and find_inode()&iput()
Dragan Simic <[email protected]>
arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity
Qingqing Zhou <[email protected]>
arm64: dts: qcom: sa8775p: Mark APPS and PCIe SMMUs as DMA coherent
Dragan Simic <[email protected]>
arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8186-corsola: Disable DPI display interface
D Scott Phillips <[email protected]>
arm64: errata: Enable the AC03_CPU_38 workaround for ampere1a
Anastasia Belova <[email protected]>
arm64: esr: Define ESR_ELx_EC_* constants as UL
Gaosheng Cui <[email protected]>
hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume
Gaosheng Cui <[email protected]>
hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init
Guoqing Jiang <[email protected]>
hwrng: mtk - Use devm_pm_runtime_enable
Chao Yu <[email protected]>
f2fs: fix to check atomic_file in f2fs ioctl interfaces
Shin'ichiro Kawasaki <[email protected]>
f2fs: check discard support for conventional zones
Jann Horn <[email protected]>
f2fs: Require FMODE_WRITE for atomic write ioctls
Nikita Zhandarovich <[email protected]>
f2fs: avoid potential int overflow in sanity_check_area_boundary()
Nikita Zhandarovich <[email protected]>
f2fs: prevent possible int overflow in dir_block_index()
Nikita Zhandarovich <[email protected]>
f2fs: fix several potential integer overflows in file offsets
Chao Yu <[email protected]>
f2fs: fix to wait dio completion
Luca Stefani <[email protected]>
btrfs: always update fstrim_range on failure in FITRIM ioctl
Qu Wenruo <[email protected]>
btrfs: tree-checker: fix the wrong output of data backref objectid
Filipe Manana <[email protected]>
btrfs: fix race setting file private on concurrent lseek using same fd
Zhen Lei <[email protected]>
debugobjects: Fix conditions in fill_pool()
Marc Aurèle La France <[email protected]>
debugfs show actual source in /proc/mounts
Michael Lo <[email protected]>
wifi: mt76: mt7925: fix a potential association failure upon resuming
Ma Ke <[email protected]>
wifi: mt76: mt7615: check devm_kasprintf() returned value
Bitterblue Smith <[email protected]>
wifi: rtw88: 8703b: Fix reported RX band width
Bitterblue Smith <[email protected]>
wifi: rtw88: 8822c: Fix reported RX band width
Nick Morrow <[email protected]>
wifi: rtw88: 8821cu: Remove VID/PID 0bda:c82c
Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc
Michal Kubiak <[email protected]>
idpf: fix netdev Tx queue stop/wake
Ma Ke <[email protected]>
wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he
Ma Ke <[email protected]>
wifi: mt76: mt7915: check devm_kasprintf() returned value
Ma Ke <[email protected]>
wifi: mt76: mt7921: Check devm_kasprintf() returned value
Qu Wenruo <[email protected]>
btrfs: subpage: fix the bitmap dump which can cause bitmap corruption
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix sampling synchronization
Kan Liang <[email protected]>
perf/x86/intel: Allow to setup LBR for counting event for BPF
Dmitry Vyukov <[email protected]>
x86/entry: Remove unwanted instrumentation in common_interrupt()
Artem Bityutskiy <[email protected]>
intel_idle: fix ACPI _CST matching for newer Xeon platforms
Artem Bityutskiy <[email protected]>
intel_idle: add Granite Rapids Xeon support
Ard Biesheuvel <[email protected]>
efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
Werner Sembach <[email protected]>
ACPI: resource: Add another DMI match for the TongFang GMxXGxx
Li Chen <[email protected]>
ACPI: resource: Do IRQ override on MECHREV GM7XG0M
Thomas Weißschuh <[email protected]>
ACPI: sysfs: validate return type of _STR method
Mikhail Lobanov <[email protected]>
drbd: Add NULL check for net_conf to prevent dereference in state validation
Qiu-ji Chen <[email protected]>
drbd: Fix atomicity violation in drbd_uuid_set_bm()
Pavan Kumar Paluri <[email protected]>
crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure
Brian Masney <[email protected]>
crypto: qcom-rng - fix support for ACPI-based systems
Johan Hovold <[email protected]>
serial: qcom-geni: fix false console tx restart
Johan Hovold <[email protected]>
serial: qcom-geni: fix fifo polling timeout
Mathias Nyman <[email protected]>
xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
Jiri Slaby (SUSE) <[email protected]>
serial: don't use uninitialized value in uart_poll_init()
Ma Ke <[email protected]>
pps: add an error check in parport_attach
Florian Fainelli <[email protected]>
tty: rp2: Fix reset with non forgiving PCIe host bridges
Jann Horn <[email protected]>
firmware_loader: Block path traversal
Fabio Porcedda <[email protected]>
bus: mhi: host: pci_generic: Fix the name for the Telit FE990A
Slark Xiao <[email protected]>
bus: mhi: host: pci_generic: Update EDL firmware path for Foxconn modems
Krzysztof Kozlowski <[email protected]>
bus: integrator-lm: fix OF node leak in probe()
Tomas Marek <[email protected]>
usb: dwc2: drd: fix clock gating on USB role switch
Andrey Konovalov <[email protected]>
usb: gadget: dummy_hcd: execute hrtimer callback in softirq context
WangYuli <[email protected]>
usb: xHCI: add XHCI_RESET_ON_RESUME quirk for Phytium xHCI host
Pawel Laszczak <[email protected]>
usb: cdnsp: Fix incorrect usb_request status
Pawel Laszczak <[email protected]>
usb: xhci: fix loss of data on Cadence xHC
Oliver Neukum <[email protected]>
USB: misc: yurex: fix race between read and write
Oliver Neukum <[email protected]>
USB: class: CDC-ACM: fix race between get_serial and set_serial
Oliver Neukum <[email protected]>
USB: misc: cypress_cy7c63: check for short transfer
Oliver Neukum <[email protected]>
USB: appledisplay: close race between probe and completion handler
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8395-nio-12l: Mark USB 3.0 on xhci1 as disabled
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled
Oliver Neukum <[email protected]>
usbnet: fix cyclical race on disconnect with work queue
Bitterblue Smith <[email protected]>
wifi: rtw88: Fix USB/SDIO devices not transmitting beacons
Stefan Mätje <[email protected]>
can: esd_usb: Remove CAN_CTRLMODE_3_SAMPLES for CAN-USB/3-FD
Finn Thain <[email protected]>
scsi: mac_scsi: Disallow bus errors during PDMA send
Finn Thain <[email protected]>
scsi: mac_scsi: Refactor polling loop
Finn Thain <[email protected]>
scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messages
Justin Tee <[email protected]>
scsi: lpfc: Restrict support for 32 byte CDBs to specific HBAs
Manish Pandey <[email protected]>
scsi: ufs: qcom: Update MODE_MAX cfg_bw value
Martin Wilck <[email protected]>
scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
Damien Le Moal <[email protected]>
ata: libata-scsi: Fix ata_msense_control() CDL page reporting
Namjae Jeon <[email protected]>
ksmbd: handle caseless file creation
Namjae Jeon <[email protected]>
ksmbd: allow write with FILE_APPEND_DATA
Hobin Woo <[email protected]>
ksmbd: make __dir_empty() compatible with POSIX
Michael Ellerman <[email protected]>
powerpc/atomic: Use YZ constraints for DS-form instructions
Roman Smirnov <[email protected]>
KEYS: prevent NULL pointer dereference in find_asymmetric_key()
Alexey Gladkov (Intel) <[email protected]>
x86/tdx: Fix "in-kernel MMIO" check
Tiezhu Yang <[email protected]>
objtool: Handle frame pointer related instructions
Roman Li <[email protected]>
drm/amd/display: Update IPS default mode for DCN35/DCN351
Aurabindo Pillai <[email protected]>
drm/amd/display: Fix underflow when setting underscan on DCN401
Zhikai Zhai <[email protected]>
drm/amd/display: Skip to enable dsc if it has been off
Yihan Zhu <[email protected]>
drm/amd/display: Enable DML2 override_det_buffer_size_kbytes
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Block dynamic IPS2 on DCN35 for incompatible FW versions
Sung Joon Kim <[email protected]>
drm/amd/display: Disable SYMCLK32_LE root clock gating
Mario Limonciello <[email protected]>
drm/amd/display: Validate backlight caps are sane
Dillon Varone <[email protected]>
drm/amd/display: Block timing sync for different output formats in pmo
Martin Tsai <[email protected]>
drm/amd/display: Clean up dsc blocks in accelerated mode
Robin Chen <[email protected]>
drm/amd/display: Round calculated vtotal
Leo Ma <[email protected]>
drm/amd/display: Add HDMI DSC native YCbCr422 support
David Belanger <[email protected]>
drm/amdgpu: Fix selfring initialization sequence on soc24
Jack Xiao <[email protected]>
drm/amdgpu/mes12: switch SET_SHADER_DEBUGGER pkt to mes schq pipe
Alex Deucher <[email protected]>
drm/amdgpu: bump driver version for cleared VRAM
Frank Min <[email protected]>
drm/amdgpu: fix PTE copy corruption for sdma 7
Kenneth Feng <[email protected]>
drm/amd/pm: update workload mask after the setting
Saleemkhan Jamadar <[email protected]>
drm/amdgpu/vcn: enable AV1 on both instances
Jack Xiao <[email protected]>
drm/amdgpu/mes12: set enable_level_process_quantum_check
Frank Min <[email protected]>
drm/amdgpu: update golden regs for gfx12
Sreekant Somasekharan <[email protected]>
drm/amdkfd: Add SDMA queue quantum support for GFX12
Alex Deucher <[email protected]>
drm/amdgpu/mes11: reduce timeout
Alex Deucher <[email protected]>
drm/amdgpu/mes12: reduce timeout
Fangzhi Zuo <[email protected]>
drm/amd/display: Skip Recompute DSC Params if no Stream on Link
Sean Christopherson <[email protected]>
KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock
Sean Christopherson <[email protected]>
KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC)
Sean Christopherson <[email protected]>
KVM: x86: Move x2APIC ICR helper above kvm_apic_write_nodecode()
Sean Christopherson <[email protected]>
KVM: x86: Enforce x2APIC's must-be-zero reserved ICR bits
Snehal Koukuntla <[email protected]>
KVM: arm64: Add memory length checks and remove inline in do_ffa_mem_xfer
Werner Sembach <[email protected]>
Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
Nuno Sa <[email protected]>
Input: adp5588-keys - fix check on return code
Jason Gunthorpe <[email protected]>
iommufd: Protect against overflow of ALIGN() during iova allocation
Eliav Bar-ilan <[email protected]>
iommu/amd: Fix argument order in amd_iommu_dev_flush_pasid_all()
Roman Smirnov <[email protected]>
Revert "media: tuners: fix error return code of hybrid_tuner_request_state()"
Krzysztof Kozlowski <[email protected]>
soc: versatile: integrator: fix OF node leak in probe() error path
Herve Codina <[email protected]>
soc: fsl: cpm1: tsa: Fix tsa_write8()
Herve Codina <[email protected]>
soc: fsl: cpm1: qmc: Update TRNSYNC only in transparent mode
Ma Ke <[email protected]>
ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
Dmitry Baryshkov <[email protected]>
Revert "soc: qcom: smd-rpm: Match rpmsg channel instead of compatible"
Siddharth Vadapalli <[email protected]>
PCI: dra7xx: Fix error handling when IRQ request fails in probe
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
Maciej W. Rozycki <[email protected]>
PCI: Use an error code with PCIe failed link retraining
Maciej W. Rozycki <[email protected]>
PCI: Correct error reporting with PCIe failed link retraining
Richard Zhu <[email protected]>
PCI: imx6: Fix i.MX8MP PCIe EP's occasional failure to trigger MSI
Richard Zhu <[email protected]>
PCI: imx6: Fix establish link failure in EP mode for i.MX8MM and i.MX8MP
Frank Li <[email protected]>
PCI: imx6: Fix missing call to phy_power_off() in error handling
Siddharth Vadapalli <[email protected]>
PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main" IRQ
Maciej W. Rozycki <[email protected]>
PCI: Clear the LBMS bit after a link retrain
Maciej W. Rozycki <[email protected]>
PCI: Revert to the original speed after PCIe failed link retraining
Laurent Pinchart <[email protected]>
Remove *.orig pattern from .gitignore
Eduard Zingerman <[email protected]>
selftests/bpf: correctly move 'log' upon successful match
Felix Moessbauer <[email protected]>
io_uring/sqpoll: do not put cpumask on stack
Matthew Auld <[email protected]>
drm/xe: fix engine_class bounds check again
Alex Hung <[email protected]>
drm/amd/display: disable_hpo_dp_link_output: Check link_res->hpo_dp_link_enc before using it
Jens Axboe <[email protected]>
io_uring/sqpoll: retain test for whether the CPU is valid
Juergen Gross <[email protected]>
xen: allow mapping ACPI data using a different physical address
Juergen Gross <[email protected]>
xen: move checks for e820 conflicts further up
Fangzhi Zuo <[email protected]>
drm/amdgpu/display: Fix a mistake in revert commit
Fangzhi Zuo <[email protected]>
drm/amd/display: Add DSC Debug Log
Fangzhi Zuo <[email protected]>
drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
Shu Han <[email protected]>
mm: call the security_mmap_file() LSM hook in remap_file_pages()
Jeongjun Park <[email protected]>
mm: migrate: annotate data-race in migrate_folio_unmap()
yangyun <[email protected]>
fuse: use exclusive lock when FUSE_I_CACHE_IO_MODE is set
Jens Axboe <[email protected]>
io_uring: check for presence of task_work rather than TIF_NOTIFY_SIGNAL
Jens Axboe <[email protected]>
io_uring/rw: treat -EOPNOTSUPP for IOCB_NOWAIT like -EAGAIN
Felix Moessbauer <[email protected]>
io_uring/sqpoll: do not allow pinning outside of cpuset
Phil Sutter <[email protected]>
selftests: netfilter: Avoid hanging ipvs.sh
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: missing objects with no memcg accounting
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path
Simon Horman <[email protected]>
netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
Phil Sutter <[email protected]>
netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
Furong Xu <[email protected]>
net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled
Wenbo Li <[email protected]>
virtio_net: Fix mismatched buf address when unmapping for small packets
Jiwon Kim <[email protected]>
bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()
Paul Barker <[email protected]>
net: ravb: Fix R-Car RX frame size limit
Paul Barker <[email protected]>
net: ravb: Fix maximum TX frame size for GbEth devices
Daniel Golle <[email protected]>
net: phy: aquantia: fix applying active_low bit after reset
Daniel Golle <[email protected]>
net: phy: aquantia: fix setting active_low bit
Youssef Samir <[email protected]>
net: qrtr: Update packets cloning when broadcasting
Josh Hunt <[email protected]>
tcp: check skb is non-NULL in tcp_rto_delta_us()
Thomas Weißschuh <[email protected]>
net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
Kaixin Wang <[email protected]>
net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
Eric Dumazet <[email protected]>
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
Sean Anderson <[email protected]>
net: xilinx: axienet: Fix packet counting
Sean Anderson <[email protected]>
net: xilinx: axienet: Schedule NAPI in two steps
Vladimir Oltean <[email protected]>
net: phy: aquantia: fix -ETIMEDOUT PHY probe failure when firmware not present
Mikulas Patocka <[email protected]>
Revert "dm: requeue IO if mapping table not yet available"
Johannes Berg <[email protected]>
um: remove ARCH_NO_PREEMPT_DYNAMIC
Dan Carpenter <[email protected]>
ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
Jason Wang <[email protected]>
vhost_vdpa: assign irq bypass producer token correctly
Dragos Tatulea <[email protected]>
vdpa/mlx5: Fix invalid mr resource destroy
Yanfei Xu <[email protected]>
cxl/pci: Fix to record only non-zero ranges
Mikulas Patocka <[email protected]>
dm integrity: fix gcc 5 warning
Dmitry Baryshkov <[email protected]>
interconnect: qcom: sm8250: Enable sync_state
Kees Cook <[email protected]>
interconnect: icc-clk: Add missed num_nodes initialization
Suzuki K Poulose <[email protected]>
coresight: tmc: sg: Do not leak sg_table
Jie Gan <[email protected]>
Coresight: Set correct cs_mode for dummy source to fix disable issue
Jie Gan <[email protected]>
Coresight: Set correct cs_mode for TPDM to fix disable issue
Markus Schneider-Pargmann <[email protected]>
serial: 8250: omap: Cleanup on error in request_irq
Jinjie Ruan <[email protected]>
driver core: Fix a potential null-ptr-deref in module_add_driver()
Krzysztof Kozlowski <[email protected]>
dt-bindings: iio: asahi-kasei,ak8975: drop incorrect AK09116 compatible
Krzysztof Kozlowski <[email protected]>
iio: magnetometer: ak8975: drop incorrect AK09116 compatible
Vasileios Amoiridis <[email protected]>
iio: chemical: bme680: Fix read/write ops to device by adding mutexes
Antoniu Miclaus <[email protected]>
ABI: testing: fix admv8818 attr description
Zijun Hu <[email protected]>
driver core: Fix error handling in driver API device_rename()
Guillaume Stols <[email protected]>
iio: adc: ad7606: fix standby gpio state to match the documentation
Guillaume Stols <[email protected]>
iio: adc: ad7606: fix oversampling gpio array
Hannes Reinecke <[email protected]>
nvme-multipath: system fails to create generic nvme device
Roi Azarzar <[email protected]>
NFSv4.2: Fix detection of "Proxying of Times" server support
Alexander Dahl <[email protected]>
spi: atmel-quadspi: Avoid overwriting delay register settings
Lorenzo Bianconi <[email protected]>
spi: airoha: remove read cache in airoha_snand_dirmap_read()
Ming Lei <[email protected]>
lib/sbitmap: define swap_lock as raw_spinlock_t
Jinjie Ruan <[email protected]>
spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
Jinjie Ruan <[email protected]>
spi: atmel-quadspi: Undo runtime PM changes at driver exit time
Lorenzo Bianconi <[email protected]>
spi: airoha: fix airoha_snand_{write,read}_data data_len estimation
Lorenzo Bianconi <[email protected]>
spi: airoha: fix dirmap_{read,write} operations
Chao Yu <[email protected]>
f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error()
Chao Yu <[email protected]>
f2fs: get rid of online repaire on corrupted directory
Daeho Jeong <[email protected]>
f2fs: prevent atomic file from being dirtied before commit
Yeongjin Gil <[email protected]>
f2fs: compress: don't redirty sparse cluster during {,de}compress
Chao Yu <[email protected]>
f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
Chao Yu <[email protected]>
f2fs: atomic: fix to truncate pagecache before on-disk metadata truncation
Chao Yu <[email protected]>
f2fs: fix to wait page writeback before setting gcing flag
Yeongjin Gil <[email protected]>
f2fs: Create COW inode from parent dentry for atomic write
Chao Yu <[email protected]>
f2fs: fix to avoid racing in between read and OPU dio write
Chao Yu <[email protected]>
f2fs: reduce expensive checkpoint trigger frequency
Chao Yu <[email protected]>
f2fs: atomic: fix to avoid racing w/ GC
Danny Tsen <[email protected]>
crypto: powerpc/p10-aes-gcm - Disable CRYPTO_AES_GCM_P10
Herbert Xu <[email protected]>
crypto: caam - Pad SG length when allocating hash edesc
Jeff Layton <[email protected]>
nfsd: fix initial getattr on write delegation
NeilBrown <[email protected]>
nfsd: untangle code in nfsd4_deleg_getattr_conflict()
Li Lingfeng <[email protected]>
nfsd: return -EINVAL when namelen is 0
Guoqing Jiang <[email protected]>
nfsd: call cache_put if xdr_reserve_space returns NULL
Dave Jiang <[email protected]>
ntb: Force physically contiguous allocation of rx ring buffers
Max Hawking <[email protected]>
ntb_perf: Fix printk format
Jinjie Ruan <[email protected]>
ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
Vitaliy Shevtsov <[email protected]>
RDMA/irdma: fix error message in irdma_modify_qp_roce()
Mikhail Lobanov <[email protected]>
RDMA/cxgb4: Added NULL check for lookup_atid
Junxian Huang <[email protected]>
RDMA/hns: Fix ah error counter in sw stat not increasing
Jinjie Ruan <[email protected]>
riscv: Fix fp alignment bug in perf_callchain_user()
Manivannan Sadhasivam <[email protected]>
PCI: qcom-ep: Enable controller resources like PHY only after refclk is available
Mark Bloch <[email protected]>
RDMA/mlx5: Obtain upper net device only when needed
David Lechner <[email protected]>
Input: ims-pcu - fix calling interruptible mutex
Junxian Huang <[email protected]>
RDMA/hns: Fix restricted __le16 degrades to integer issue
Junxian Huang <[email protected]>
RDMA/hns: Optimize hem allocation performance
Chengchang Tang <[email protected]>
RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS
Junxian Huang <[email protected]>
RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler
Chengchang Tang <[email protected]>
RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
wenglianfa <[email protected]>
RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
wenglianfa <[email protected]>
RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
Junxian Huang <[email protected]>
RDMA/hns: Don't modify rq next block addr in HIP09 QPC
Jonas Blixt <[email protected]>
watchdog: imx_sc_wdt: Don't disable WDT in suspend
Michael Guralnik <[email protected]>
RDMA/mlx5: Fix MR cache temp entries cleanup
Michael Guralnik <[email protected]>
RDMA/mlx5: Drop redundant work canceling from clean_keys()
Michael Guralnik <[email protected]>
RDMA/mlx5: Limit usage of over-sized mkeys from the MR cache
Michael Guralnik <[email protected]>
RDMA/mlx5: Fix counter update on MR cache mkey creation
Cheng Xu <[email protected]>
RDMA/erdma: Return QP state in erdma_query_qp
Alexandra Diupina <[email protected]>
PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
Jason Gunthorpe <[email protected]>
iommufd: Check the domain owner of the parent before creating a nesting domain
Frank Li <[email protected]>
dt-bindings: PCI: layerscape-pci: Replace fsl,lx2160a-pcie with fsl,lx2160ar2-pcie
Patrisious Haddad <[email protected]>
IB/core: Fix ib_cache_setup_one error flow cleanup
Chris Mi <[email protected]>
IB/mlx5: Fix UMR pd cleanup on error flow of driver init
Wang Jianzheng <[email protected]>
pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
Jeff Layton <[email protected]>
nfsd: fix refcount leak when file is unhashed after being found
Jeff Layton <[email protected]>
nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
Alexander Shiyan <[email protected]>
clk: rockchip: rk3588: Fix 32k clock name for pmu_24m_32k_100m_src_p
Yuntao Liu <[email protected]>
clk: starfive: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage
David Lechner <[email protected]>
clk: ti: dra7-atl: Fix leak of of_nodes
Md Haris Iqbal <[email protected]>
RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
Jack Wang <[email protected]>
RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer
Geert Uytterhoeven <[email protected]>
media: imagination: VIDEO_E5010_JPEG_ENC should depend on ARCH_K3
Yunfei Dong <[email protected]>
media: mediatek: vcodec: Fix H264 stateless decoder smatch warning
Yunfei Dong <[email protected]>
media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning
Yunfei Dong <[email protected]>
media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning
Selvin Xavier <[email protected]>
RDMA/bnxt_re: Fix the table size for PSN/MSN entries
Jason Gunthorpe <[email protected]>
iommufd/selftest: Fix buffer read overrrun in the dirty test
Claudiu Beznea <[email protected]>
clk: at91: sama7g5: Allocate only the needed amount of memory for PLLs
Yang Yingliang <[email protected]>
pinctrl: single: fix missing error code in pcs_probe()
Zhu Yanjun <[email protected]>
RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
Biju Das <[email protected]>
media: platform: rzg2l-cru: rzg2l-csi2: Add missing MODULE_DEVICE_TABLE
Kees Cook <[email protected]>
leds: gpio: Set num_leds after allocation
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Clean up clock on probe failure/removal
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix register misspelling
Li Zhijian <[email protected]>
nvdimm: Fix devs leaks in scan_labels()
Samasth Norway Ananda <[email protected]>
x86/PCI: Check pcie_find_root_port() return for NULL
Javier Carrasco <[email protected]>
leds: pca995x: Fix device child node usage in pca995x_probe()
Javier Carrasco <[email protected]>
leds: pca995x: Use device_for_each_child_node() to access device child nodes
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8250: use special function for Lucid 5LPE PLL
Varadarajan Narayanan <[email protected]>
clk: qcom: ipq5332: Register gcc_qdss_tsctr_clk_src
Uwe Kleine-König <[email protected]>
media: staging: media: starfive: camss: Drop obsolete return value documentation
Dan Carpenter <[email protected]>
PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
Takashi Sakamoto <[email protected]>
firewire: core: correct range of block for case of switch statement
Ilpo Järvinen <[email protected]>
PCI: Wait for Link before restoring Downstream Buses
Geert Uytterhoeven <[email protected]>
media: raspberrypi: VIDEO_RASPBERRYPI_PISP_BE should depend on ARCH_BCM2835
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
Emanuele Ghidoli <[email protected]>
Input: ilitek_ts_i2c - add report id message validation
Emanuele Ghidoli <[email protected]>
Input: ilitek_ts_i2c - avoid wrong input subsystem sync
Cristian Ciocaltea <[email protected]>
phy: phy-rockchip-samsung-hdptx: Explicitly include pm_runtime.h
Christophe JAILLET <[email protected]>
pinctrl: ti: ti-iodelay: Fix some error handling paths
Lad Prabhakar <[email protected]>
pinctrl: renesas: rzg2l: Return -EINVAL if the pin doesn't support PIN_CFG_OEN
Javier Carrasco <[email protected]>
leds: bd2606mvv: Fix device child node usage in bd2606mvv_probe()
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8550: use rcg2_shared_ops for ESC RCGs
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8650: Update the GDSC flags
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8550: use rcg2_ops for mdss_dptx1_aux_clk_src
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8550: fix several supposed typos
Jonas Karlman <[email protected]>
clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
Peng Fan <[email protected]>
remoteproc: imx_rproc: Initialize workqueue earlier
Peng Fan <[email protected]>
remoteproc: imx_rproc: Correct ddr alias for i.MX8M
Kemeng Shi <[email protected]>
quota: avoid missing put_quota_format when DQUOT_SUSPENDED is passed
Peng Fan <[email protected]>
clk: imx: imx8qxp: Parent should be initialized earlier than the clock
Peng Fan <[email protected]>
clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk
Zhipeng Wang <[email protected]>
clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
Pengfei Li <[email protected]>
clk: imx: fracn-gppll: fix fractional part of PLL getting lost
Ye Li <[email protected]>
clk: imx: composite-7ulp: Check the PCC present bit
Jacky Bai <[email protected]>
clk: imx: composite-93: keep root clock on when mcore enabled
Peng Fan <[email protected]>
clk: imx: composite-8m: Enable gate clk with mcore_booted
Sebastien Laveze <[email protected]>
clk: imx: imx6ul: fix default parent for enet*_ref_sel
Shengjiu Wang <[email protected]>
clk: imx: clk-audiomix: Correct parent clock for earc_phy and audpll
Kan Liang <[email protected]>
perf mem: Fix missed p-core mem events on ADL and RPL
Kan Liang <[email protected]>
perf mem: Check mem_events for all eligible PMUs
Ian Rogers <[email protected]>
perf time-utils: Fix 32-bit nsec parsing
Yang Jihong <[email protected]>
perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
Kan Liang <[email protected]>
perf hist: Don't set hpp_fmt_value for members in --no-group
Namhyung Kim <[email protected]>
perf dwarf-aux: Handle bitfield members from pointer access
Namhyung Kim <[email protected]>
perf annotate-data: Fix off-by-one in location range check
Namhyung Kim <[email protected]>
perf dwarf-aux: Check allowed location expressions when collecting variables
Yicong Yang <[email protected]>
perf stat: Display iostat headers correctly
Yang Jihong <[email protected]>
perf sched timehist: Fix missing free of session in perf_sched__timehist()
Arnaldo Carvalho de Melo <[email protected]>
perf build: Fix up broken capstone feature detection fast path
Kan Liang <[email protected]>
perf report: Fix --total-cycles --stdio output error
Ian Rogers <[email protected]>
perf inject: Fix leader sampling inserting additional samples
Ian Rogers <[email protected]>
perf vendor events: SKX, CLX, SNR uncore cache event fixes
Namhyung Kim <[email protected]>
perf lock contention: Change stack_id type to s32
Ian Rogers <[email protected]>
perf callchain: Fix stitch LBR memory leaks
Namhyung Kim <[email protected]>
perf mem: Free the allocated sort string, fixing a leak
Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Move BPF disassembly routines to separate file to avoid clash with capstone bpf headers
James Clark <[email protected]>
perf scripts python cs-etm: Restore first sample log in verbose mode
Daniel Borkmann <[email protected]>
bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
Daniel Borkmann <[email protected]>
bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
Daniel Borkmann <[email protected]>
bpf: Fix helper writes to read-only maps
Daniel Borkmann <[email protected]>
bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
Chen Yu <[email protected]>
sched/pelt: Use rq_clock_task() for hw_pressure
Ryusuke Konishi <[email protected]>
nilfs2: fix potential oob read in nilfs_btree_check_delete()
Ryusuke Konishi <[email protected]>
nilfs2: determine empty node blocks as corrupted
Ryusuke Konishi <[email protected]>
nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
Yujie Liu <[email protected]>
sched/numa: Fix the vma scan starving issue
Ojaswin Mujoo <[email protected]>
ext4: check stripe size compatibility on remount as well
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: avoid OOB when system.data xattr changes underneath the filesystem
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: return error on ext4_find_inline_entry
Kemeng Shi <[email protected]>
ext4: avoid negative min_clusters in find_group_orlov()
Kemeng Shi <[email protected]>
ext4: avoid potential buffer_head leak in __ext4_new_inode()
Kemeng Shi <[email protected]>
ext4: avoid buffer_head leak in ext4_mark_inode_used()
Jiawei Ye <[email protected]>
smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
Huang Shijie <[email protected]>
sched/deadline: Fix schedstats vs deadline servers
Mykyta Yatsenko <[email protected]>
bpftool: Fix handling enum64 in btf dump sorting
yangerkun <[email protected]>
ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
Chen Yu <[email protected]>
kthread: fix task state in kthread worker if being frozen
Lasse Collin <[email protected]>
xz: cleanup CRC32 edits from 2018
Tony Ambardar <[email protected]>
libbpf: Ensure new BTF objects inherit input endianness
Harald Freudenberger <[email protected]>
s390/ap: Fix deadlock caused by recursive lock of the AP bus scan mutex
Andrii Nakryiko <[email protected]>
libbpf: Fix bpf_object__open_skeleton()'s mishandling of options
Hao Ge <[email protected]>
selftests/bpf: Fix incorrect parameters in NULL pointer checking
Eduard Zingerman <[email protected]>
bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
Eduard Zingerman <[email protected]>
selftests/bpf: fix to avoid __msg tag de-duplication by clang
Eduard Zingerman <[email protected]>
selftests/bpf: __arch_* macro to limit test cases to specific archs
Eduard Zingerman <[email protected]>
selftests/bpf: allow checking xlated programs in verifier_* tests
Eduard Zingerman <[email protected]>
selftests/bpf: extract test_loader->expect_msgs as a data structure
Eduard Zingerman <[email protected]>
selftests/bpf: no need to track next_match_pos in struct test_loader
Jiangshan Yi <[email protected]>
samples/bpf: Fix compilation errors with cf-protection option
Alan Maguire <[email protected]>
libbpf: Fix license for btf_relocate.c
Heiko Carstens <[email protected]>
s390/entry: Make early program check handler relocated lowcore aware
Heiko Carstens <[email protected]>
s390/entry: Move early program check handler to entry.S
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling tc_redirect.c with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compile if backtrace support missing in libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix redefinition errors compiling lwt_reroute.c
Tony Ambardar <[email protected]>
selftests/bpf: Fix C++ compile error from missing _Bool type
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling test_lru_map.c
Tony Ambardar <[email protected]>
selftests/bpf: Fix arg parsing in veristat, test_progs
David Vernet <[email protected]>
libbpf: Don't take direct pointers into BTF data from st_ops
Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling crypto_sanity.c with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling decap_sanity.c with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling core_reloc.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling flow_dissector.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling kfree_skb.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix include of <sys/fcntl.h>
Tony Ambardar <[email protected]>
selftests/bpf: Fix missing BUILD_BUG_ON() declaration
Tony Ambardar <[email protected]>
selftests/bpf: Fix missing UINT_MAX definitions in benchmarks
Tony Ambardar <[email protected]>
selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
Tony Ambardar <[email protected]>
selftests/bpf: Drop unneeded error.h includes
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
Tony Ambardar <[email protected]>
selftests/bpf: Use pid_t consistently in test_progs.c
Yonghong Song <[email protected]>
bpf: Fail verification for sign-extension of packet data/data_end/data_meta
Tony Ambardar <[email protected]>
tools/runqslower: Fix LDFLAGS and add LDLIBS support
Tony Ambardar <[email protected]>
selftests/bpf: Fix wrong binary in Makefile log output
Tony Ambardar <[email protected]>
selftests/bpf: Fix error linking uprobe_multi on mips
Alexei Starovoitov <[email protected]>
selftests/bpf: Workaround strict bpf_lsm return value check.
Xu Kuohai <[email protected]>
bpf: Fix compare error in function retval_range_within
Xu Kuohai <[email protected]>
bpf, lsm: Add check for BPF LSM return value
Leon Hwang <[email protected]>
bpf, arm64: Fix tailcall hierarchy
Leon Hwang <[email protected]>
bpf, x64: Fix tailcall hierarchy
Tianchen Ding <[email protected]>
sched/fair: Make SCHED_IDLE entity be preempted in strict hierarchy
Jonathan McDowell <[email protected]>
tpm: Clean up TPM space after command failure
Juergen Gross <[email protected]>
xen/swiotlb: fix allocated size
Juergen Gross <[email protected]>
xen/swiotlb: add alignment check for dma buffers
Dafna Hirschfeld <[email protected]>
drm/xe: fix missing 'xe_vm_put'
Juergen Gross <[email protected]>
xen: tolerate ACPI NVS memory overlapping with Xen allocated memory
Juergen Gross <[email protected]>
xen: add capability to remap non-RAM pages to different PFNs
Juergen Gross <[email protected]>
xen: move max_pfn in xen_memory_setup() out of function scope
Juergen Gross <[email protected]>
xen: introduce generic helper checking for memory map conflicts
Niklas Cassel <[email protected]>
ata: libata: Clear DID_TIME_OUT for ATA PT commands with sense data
Jason Gerecke <[email protected]>
HID: wacom: Do not warn about dropped packets for first packet
Jason Gerecke <[email protected]>
HID: wacom: Support sequence numbers smaller than 16-bit
Juergen Gross <[email protected]>
xen: use correct end address of kernel for conflict checking
Lang Yu <[email protected]>
drm/amdgpu: fix invalid fence handling in amdgpu_vm_tlb_flush
Yuesong Li <[email protected]>
drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
Nícolas F. R. A. Prado <[email protected]>
kselftest: dt: Ignore nodes that have ancestors disabled
Andy Shevchenko <[email protected]>
platform/x86: ideapad-laptop: Make the scope_guard() clear of its scope
Sherry Yang <[email protected]>
drm/msm: fix %s null argument error
Dmitry Baryshkov <[email protected]>
drm/msm/dsi: correct programming sequence for SM8350 / SM8450
Abhinav Kumar <[email protected]>
drm/msm/dp: enable widebus on all relevant chipsets
Wolfram Sang <[email protected]>
ipmi: docs: don't advertise deprecated sysfs entries
Vladimir Lypak <[email protected]>
drm/msm/a5xx: workaround early ring-buffer emptiness check
Vladimir Lypak <[email protected]>
drm/msm/a5xx: fix races in preemption evaluation stage
Vladimir Lypak <[email protected]>
drm/msm/a5xx: properly clear preemption records on resume
Vladimir Lypak <[email protected]>
drm/msm/a5xx: disable preemption in submits by default
Aleksandr Mishin <[email protected]>
drm/msm: Fix incorrect file name output in adreno_request_fw()
Connor Abbott <[email protected]>
drm/msm: Fix CP_BV_DRAW_STATE_ADDR name
Connor Abbott <[email protected]>
drm/msm: Dump correct dbgahb clusters on a750
Connor Abbott <[email protected]>
drm/msm: Use a7xx family directly in gpu_state
Christophe Leroy <[email protected]>
powerpc/vdso: Inconditionally use CFUNC macro
Christophe Leroy <[email protected]>
powerpc/8xx: Fix kernel vs user address comparison
Christophe Leroy <[email protected]>
powerpc/8xx: Fix initial memory mapping
Fei Shao <[email protected]>
drm/mediatek: Use spin_lock_irqsave() for CRTC event lock
Jason-JH.Lin <[email protected]>
drm/mediatek: Fix missing configuration flags in mtk_crtc_ddp_config()
Jeongjun Park <[email protected]>
jfs: fix out-of-bounds in dbNextAG() and diAlloc()
Dan Carpenter <[email protected]>
scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
Stefan Wahren <[email protected]>
drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get
Liu Ying <[email protected]>
drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid()
Matthew Brost <[email protected]>
drm/xe: Use reserved copy engine for user binds on faulting devices
Dominik Grzegorzek <[email protected]>
drm/xe: Move and export xe_hw_engine lookup.
Nikita Zhandarovich <[email protected]>
drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
Jonas Karlman <[email protected]>
drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
Alex Bee <[email protected]>
drm/rockchip: vop: Allow 4096px width scaling
Rodrigo Siqueira <[email protected]>
drm/amd/display: Improve FAM control for DCN401
WangYuli <[email protected]>
drm/amd/amdgpu: Properly tune the size of struct
Finn Thain <[email protected]>
scsi: NCR5380: Check for phase match during PDMA fixup
John Garry <[email protected]>
scsi: block: Don't check REQ_ATOMIC for reads
John Garry <[email protected]>
scsi: sd: Don't check if a write for REQ_ATOMIC
Gilbert Wu <[email protected]>
scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quickly
Tom Chung <[email protected]>
drm/amd/display: Reset VRR config during resume
Alex Deucher <[email protected]>
drm/radeon: properly handle vbios fake edid sizing
Alex Deucher <[email protected]>
drm/amdgpu: properly handle vbios fake edid sizing
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
Alex Hung <[email protected]>
drm/amd/display: Check link_res->hpo_dp_link_enc before using it
Aurabindo Pillai <[email protected]>
drm/amd/display: free bo used for dmub bounding box
Claudiu Beznea <[email protected]>
drm/stm: ltdc: check memory returned by devm_kzalloc()
Christophe JAILLET <[email protected]>
drm/stm: Fix an error handling path in stm_drm_platform_probe()
Geert Uytterhoeven <[email protected]>
pmdomain: core: Fix "managed by" alignment in debug summary
Geert Uytterhoeven <[email protected]>
pmdomain: core: Harden inter-column space in debug summary
Dmitry Baryshkov <[email protected]>
iommu/arm-smmu-qcom: apply num_context_bank fixes for SDM630 / SDM660
Konrad Dybcio <[email protected]>
iommu/arm-smmu-qcom: Work around SDM845 Adreno SMMU w/ 16K pages
Marc Gonzalez <[email protected]>
iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
Miquel Raynal <[email protected]>
mtd: rawnand: mtk: Fix init error path
Miquel Raynal <[email protected]>
mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips
Jinjie Ruan <[email protected]>
mtd: rawnand: mtk: Use for_each_child_of_node_scoped()
Frederic Weisbecker <[email protected]>
rcu/nocb: Fix RT throttling hrtimer armed from offline CPU
Charles Han <[email protected]>
mtd: powernv: Add check devm_kasprintf() returned value
Jason Gunthorpe <[email protected]>
iommu/amd: Do not set the D bit on AMD v2 table entries
Jason Gunthorpe <[email protected]>
iommu/amd: Set the pgsize_bitmap correctly
Jason Gunthorpe <[email protected]>
iommu/amd: Move allocation of the top table into v1_alloc_pgtable
Jason Gunthorpe <[email protected]>
iommu/amd: Allocate the page table root using GFP_KERNEL
Vasant Hegde <[email protected]>
iommu/amd: Handle error path in amd_iommu_probe_device()
Christophe JAILLET <[email protected]>
fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
Artur Weber <[email protected]>
power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
Chris Morgan <[email protected]>
power: supply: axp20x_battery: Remove design from min and max voltage
Yuntao Liu <[email protected]>
hwmon: (ntc_thermistor) fix module autoloading
Mirsad Todorovac <[email protected]>
mtd: slram: insert break after errors in parsing the map
Dan Carpenter <[email protected]>
iommu/arm-smmu-v3: Fix a NULL vs IS_ERR() check
Rob Clark <[email protected]>
iommu/arm-smmu: Un-demote unhandled-fault msg
Guenter Roeck <[email protected]>
hwmon: (max16065) Fix alarm attributes
Guenter Roeck <[email protected]>
hwmon: (max16065) Fix overflows seen when writing limits
Xiu Jianfeng <[email protected]>
cgroup/pids: Avoid spurious event notification
Shuah Khan <[email protected]>
selftests:resctrl: Fix build failure on archs without __cpuid_count()
Masami Hiramatsu (Google) <[email protected]>
selftests/ftrace: Fix eventfs ownership testcase to find mount point
tangbin <[email protected]>
ASoC: loongson: fix error release
Finn Thain <[email protected]>
m68k: Fix kernel_clone_args.flags in m68k_clone()
Uros Bizjak <[email protected]>
x86/boot/64: Strip percpu address space when setting up GDT descriptors
Steven Rostedt (Google) <[email protected]>
selftests/ftrace: Fix test to handle both old and new kernels
Yuntao Liu <[email protected]>
ALSA: hda: cs35l41: fix module autoloading
Masami Hiramatsu (Google) <[email protected]>
selftests/ftrace: Add required dependency for kprobe tests
Linus Walleij <[email protected]>
ASoC: tas2781-i2c: Get the right GPIO line
Linus Walleij <[email protected]>
ASoC: tas2781-i2c: Drop weird GPIO code
Shenghao Ding <[email protected]>
ASoC: tas2781: Fix a compiling warning reported by robot kernel test due to adding tas2563_dvc_table
Ma Ke <[email protected]>
ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the error
Yosry Ahmed <[email protected]>
x86/mm: Use IPIs to synchronize LAM enablement
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8195: Correct clock order for dp_intf*
Ankit Agrawal <[email protected]>
clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
Dan Carpenter <[email protected]>
platform: cznic: turris-omnia-mcu: Fix error check in omnia_mcu_register_trng()
Krzysztof Kozlowski <[email protected]>
reset: k210: fix OF node leak in probe() error path
Krzysztof Kozlowski <[email protected]>
reset: berlin: fix OF node leak in probe() error path
Krzysztof Kozlowski <[email protected]>
ARM: versatile: fix OF node leak in CPUs prepare
MD Danish Anwar <[email protected]>
arm64: dts: ti: k3-am654-idk: Fix dtbs_check warning in ICSSG dmas
Krzysztof Kozlowski <[email protected]>
ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
Claudiu Beznea <[email protected]>
ARM: dts: microchip: sama7g5: Fix RTT clock
Abel Vesa <[email protected]>
arm64: dts: qcom: x1e80100: Fix PHY for DP2
Jinjie Ruan <[email protected]>
spi: bcmbca-hsspi: Fix missing pm_runtime_disable()
Andrew Davis <[email protected]>
arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations
Andrew Davis <[email protected]>
arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Correct vendor prefix for Hardkernel ODROID-M1
Jon Hunter <[email protected]>
arm64: tegra: Correct location of power-sensors for IGX Orin
Alexander Dahl <[email protected]>
ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes
Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes
Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes
Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a08g045: Correct GICD and GICR sizes
Chen-Yu Tsai <[email protected]>
regulator: Return actual error in of_regulator_bulk_get_all()
Mukesh Ojha <[email protected]>
firmware: qcom: scm: Disable SDI and write no dump to dump mode
Andy Shevchenko <[email protected]>
spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
Cristian Marussi <[email protected]>
firmware: arm_scmi: Fix double free in OPTEE transport
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8186: Fix supported-hw mask for GPU OPPs
David Virag <[email protected]>
arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB
Ma Ke <[email protected]>
spi: ppc4xx: handle irq_of_parse_and_map() errors
Riyan Dhiman <[email protected]>
block: fix potential invalid pointer dereference in blk_add_partition
Felix Moessbauer <[email protected]>
io_uring/io-wq: inherit cpuset of cgroup in io worker
Felix Moessbauer <[email protected]>
io_uring/io-wq: do not allow pinning outside of cpuset
Yu Kuai <[email protected]>
block, bfq: fix procress reference leakage for bfqq in merge chain
Yu Kuai <[email protected]>
block, bfq: fix uaf for accessing waker_bfqq after splitting
Gao Xiang <[email protected]>
erofs: handle overlapped pclusters out of crafted images properly
Sandeep Dhavale <[email protected]>
erofs: fix error handling in z_erofs_init_decompressor
Gao Xiang <[email protected]>
erofs: fix incorrect symlink detection in fast symlink
Wouter Verhelst <[email protected]>
nbd: correct the maximum value for discard sectors
David Howells <[email protected]>
cachefiles: Fix non-taking of sb_writers around set/removexattr
Yu Kuai <[email protected]>
block, bfq: don't break merge chain in bfq_split_bfqq()
Yu Kuai <[email protected]>
block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
Yu Kuai <[email protected]>
block, bfq: fix possible UAF for bfqq->bic with merge chain
Ming Lei <[email protected]>
nbd: fix race between timeout and normal completion
Ming Lei <[email protected]>
ublk: move zone report data out of request pdu
Eric Dumazet <[email protected]>
ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
Su Hui <[email protected]>
net: tipc: avoid possible garbage value
Brett Creeley <[email protected]>
fbnic: Set napi irq value after calling netif_napi_add
Justin Iurman <[email protected]>
net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
Heiner Kallweit <[email protected]>
r8169: disable ALDPS per default for RTL8125
Breno Leitao <[email protected]>
netkit: Assign missing bpf_net_context
Maciej Fijalkowski <[email protected]>
xsk: fix batch alloc API on non-coherent systems
Herbert Xu <[email protected]>
crypto: n2 - Set err to EINVAL if snprintf fails for hmac
Jinjie Ruan <[email protected]>
net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
Guillaume Nault <[email protected]>
bareudp: Pull inner IP header on xmit.
Guillaume Nault <[email protected]>
bareudp: Pull inner IP header in bareudp_udp_encap_recv().
Luiz Augusto von Dentz <[email protected]>
Bluetooth: btusb: Fix not handling ZPL/short-transfer
Marc Kleine-Budde <[email protected]>
can: m_can: m_can_close(): stop clocks after device has been shut down
Jake Hamby <[email protected]>
can: m_can: enable NAPI before enabling interrupts
Kuniyuki Iwashima <[email protected]>
can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
Eric Dumazet <[email protected]>
sock_map: Add a cond_resched() in sock_hash_free()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
Kuniyuki Iwashima <[email protected]>
af_unix: Don't return OOB skb in manage_oob().
Kuniyuki Iwashima <[email protected]>
af_unix: Move spin_lock() in manage_oob().
Kuniyuki Iwashima <[email protected]>
af_unix: Rename unlinked_skb in manage_oob().
Kuniyuki Iwashima <[email protected]>
af_unix: Remove single nest in manage_oob().
Kuniyuki Iwashima <[email protected]>
af_unix: Don't call skb_get() for OOB skb.
Jiawei Ye <[email protected]>
wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
Dmitry Antipov <[email protected]>
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
Felix Fietkau <[email protected]>
wifi: mt76: mt7996: fix uninitialized TLV data
Howard Hsu <[email protected]>
wifi: mt76: mt7915: fix rx filter setting for bfee functionality
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
Felix Fietkau <[email protected]>
wifi: mt76: mt7603: fix mixed declarations and code
Peter Chiu <[email protected]>
wifi: mt76: connac: fix checksum offload fields of connac3 RXD
Rex Lu <[email protected]>
wifi: mt76: mt7996: fix handling mbss enable/disable
Weili Qian <[email protected]>
crypto: hisilicon/qm - inject error before stopping queue
Weili Qian <[email protected]>
crypto: hisilicon/qm - reset device before enabling it
Weili Qian <[email protected]>
crypto: hisilicon/hpre - mask cluster timeout error
Amit Shah <[email protected]>
crypto: ccp - do not request interrupt on cmd completion when irqs disabled
John B. Wyatt IV <[email protected]>
pm:cpupower: Add missing powercap_set_enabled() stub function
Aaron Lu <[email protected]>
x86/sgx: Fix deadlock in SGX NUMA node search
Howard Hsu <[email protected]>
wifi: mt76: mt7996: fix EHT beamforming capability check
Howard Hsu <[email protected]>
wifi: mt76: mt7996: fix HE and EHT beamforming capabilities
Peter Chiu <[email protected]>
wifi: mt76: mt7996: fix wmm set of station interface to 3
Peter Chiu <[email protected]>
wifi: mt76: mt7996: fix traffic delay when switching back to working channel
Peter Chiu <[email protected]>
wifi: mt76: mt7996: use hweight16 to get correct tx antenna
Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7921: fix wrong UNII-4 freq range check for the channel usage
Bjørn Mork <[email protected]>
wifi: mt76: mt7915: fix oops on non-dbdc mt7986
Rafael J. Wysocki <[email protected]>
thermal: gov_bang_bang: Adjust states of all uninitialized instances
Nishanth Menon <[email protected]>
cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
Robin Murphy <[email protected]>
perf/arm-cmn: Ensure dtm_idx is big enough
Robin Murphy <[email protected]>
perf/arm-cmn: Fix CCLA register offset
Robin Murphy <[email protected]>
perf/arm-cmn: Refactor node ID handling. Again.
Pablo Neira Ayuso <[email protected]>
netfilter: nft_dynset: annotate data-races around set timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: remove annotation to access set timeout while holding lock
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject expiration higher than timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject element expiration with no timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
Clément Léger <[email protected]>
ACPI: CPPC: Fix MASK_VAL() usage
Zong-Zhe Yang <[email protected]>
wifi: rtw89: wow: fix wait condition for AOAC report request
Zhang Changzhong <[email protected]>
can: j1939: use correct function name in comment
Mark Brown <[email protected]>
kselftest/arm64: Actually test SME vector length changes via sigreturn
Yicong Yang <[email protected]>
drivers/perf: hisi_pcie: Fix TLP headers bandwidth counting
Yicong Yang <[email protected]>
drivers/perf: hisi_pcie: Record hardware counts correctly
Kamlesh Gurudasani <[email protected]>
padata: Honor the caller's alignment in case of chunk_size 0
Vasily Khoruzhick <[email protected]>
ACPICA: executer/exsystem: Don't nag user about every Stall() violating the spec
Vasily Khoruzhick <[email protected]>
ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
Ilan Peer <[email protected]>
wifi: mac80211: Check for missing VHT elements only for 5 GHz
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: allow ESR when we the ROC expires
Emmanuel Grumbach <[email protected]>
wifi: mac80211: fix the comeback long retry times
hhorace <[email protected]>
wifi: cfg80211: fix bug of mapping AF3x to incorrect User Priority
Avraham Stern <[email protected]>
wifi: iwlwifi: mvm: increase the time between ranging measurements
Avraham Stern <[email protected]>
wifi: iwlwifi: mvm: set the cipher for secured NDP ranging
Johannes Berg <[email protected]>
wifi: iwlwifi: config: label 'gl' devices as discrete
Ping-Ke Shih <[email protected]>
wifi: mac80211: don't use rate mask for offchannel TX either
Zong-Zhe Yang <[email protected]>
wifi: mac80211_hwsim: correct MODULE_PARM_DESC of multi_radio
Esther Shimanovich <[email protected]>
ACPI: video: force native for Apple MacbookPro9,2
Svyatoslav Pankratov <[email protected]>
crypto: qat - fix "Full Going True" macro definition
Krishna chaitanya chundru <[email protected]>
perf/dwc_pcie: Always register for PCIe bus notifier
Krishna chaitanya chundru <[email protected]>
perf/dwc_pcie: Fix registration issue in multi PCIe controller instances
Jing Zhang <[email protected]>
drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
Rafael J. Wysocki <[email protected]>
thermal: core: Fix rounding of delay jiffies
Rafael J. Wysocki <[email protected]>
thermal: core: Fold two functions into their respective callers
Douglas Anderson <[email protected]>
arm64: smp: smp_send_stop() and crash_smp_send_stop() should try non-NMI first
Andre Przywara <[email protected]>
kselftest/arm64: signal: fix/refactor SVE vector length enumeration
Chia-Yuan Li <[email protected]>
wifi: rtw89: limit the PPDU length for VHT rate to 0x40000
Dan Carpenter <[email protected]>
powercap: intel_rapl: Fix off by one in get_rpi()
Calvin Owens <[email protected]>
ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros
Florian Westphal <[email protected]>
netfilter: nf_tables: store new sets in dedicated list
Aleksa Sarai <[email protected]>
autofs: fix missing fput for FSCONFIG_SET_FD
Olaf Hering <[email protected]>
mount: handle OOM on mnt_warn_timestamp_expiry
Atish Patra <[email protected]>
RISC-V: KVM: Fix to allow hpmcounter31 from the guest
Atish Patra <[email protected]>
RISC-V: KVM: Allow legacy PMU access from guest
Anup Patel <[email protected]>
RISC-V: KVM: Don't zero-out PMU snapshot area before freeing data
Andrew Jones <[email protected]>
RISC-V: KVM: Fix sbiret init before forwarding to userspace
Dmitry Kandybka <[email protected]>
wifi: rtw88: remove CPT execution branch never used
Ping-Ke Shih <[email protected]>
wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading
Dave Martin <[email protected]>
arm64: signal: Fix some under-bracketed UAPI macros
Jason Wang <[email protected]>
virtio-net: synchronize probe with ndo_set_features
Jason Wang <[email protected]>
virtio-net: synchronize operstate with admin state on up/down
Jason Wang <[email protected]>
virtio: allow driver to disable the configure change notification
Jason Wang <[email protected]>
virtio: rename virtio_config_enabled to virtio_config_core_enabled
Yanteng Si <[email protected]>
net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
Eric Biggers <[email protected]>
crypto: x86/aes-gcm - fix PREEMPT_RT issue in gcm_crypt()
Francesco Dolcini <[email protected]>
hwrng: cn10k - Enable by default CN10K driver if Thunder SoC is enabled
Baochen Qiang <[email protected]>
wifi: ath12k: fix invalid AMPDU factor calculation in ath12k_peer_assoc_h_he()
P Praneesh <[email protected]>
wifi: ath12k: match WMI BSS chan info structure with firmware definition
P Praneesh <[email protected]>
wifi: ath12k: fix BSS chan info request WMI command
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k: Remove error checks when creating debugfs entries
Arend van Spriel <[email protected]>
wifi: brcmfmac: introducing fwil query functions
Simon Horman <[email protected]>
eth: fbnic: select DEVLINK and PAGE_POOL
Aleksandr Mishin <[email protected]>
ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
Dan Carpenter <[email protected]>
crypto: iaa - Fix potential use after free bug
Michal Witwicki <[email protected]>
crypto: qat - ensure correct order in VF restarting handler
Michal Witwicki <[email protected]>
crypto: qat - fix recovery flow for VFs
Michal Witwicki <[email protected]>
crypto: qat - disable IOV in adf_dev_stop()
Helge Deller <[email protected]>
crypto: xor - fix template benchmarking
Dmitry Antipov <[email protected]>
wifi: rtw88: always wait for both firmware loading attempts
Shubhrajyoti Datta <[email protected]>
EDAC/synopsys: Fix error injection on Zynq UltraScale+
Kang Yang <[email protected]>
wifi: ath11k: use work queue to process beacon tx event
-------------
Diffstat:
.gitignore | 1 - .../ABI/testing/sysfs-bus-iio-filter-admv8818 | 2 +- Documentation/arch/arm64/silicon-errata.rst | 2 + .../iio/magnetometer/asahi-kasei,ak8975.yaml | 1 - .../bindings/pci/fsl,layerscape-pcie.yaml | 26 +- .../devicetree/bindings/spi/spi-nxp-fspi.yaml | 1 + Documentation/driver-api/ipmi.rst | 2 +- Documentation/virt/kvm/locking.rst | 33 ++- Makefile | 4 +- arch/arm/boot/dts/microchip/sam9x60.dtsi | 4 +- arch/arm/boot/dts/microchip/sama7g5.dtsi | 2 +- arch/arm/boot/dts/nxp/imx/imx6ul-geam.dts | 2 +- .../dts/nxp/imx/imx6ull-seeed-npi-dev-board.dtsi | 12 +- arch/arm/boot/dts/nxp/imx/imx7d-zii-rmu2.dts | 2 +- arch/arm/mach-ep93xx/clock.c | 2 +- arch/arm/mach-versatile/platsmp-realview.c | 1 + arch/arm/vfp/vfpinstr.h | 44 ++-- arch/arm64/Kconfig | 2 +- .../boot/dts/exynos/exynos7885-jackpotlte.dts | 2 +- arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 3 +- arch/arm64/boot/dts/mediatek/mt8186.dtsi | 12 +- arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 1 + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 12 +- .../boot/dts/mediatek/mt8395-radxa-nio-12l.dts | 1 + .../arm64/boot/dts/nvidia/tegra234-p3701-0008.dtsi | 33 --- .../arm64/boot/dts/nvidia/tegra234-p3740-0002.dtsi | 33 +++ arch/arm64/boot/dts/qcom/sa8775p.dtsi | 2 + arch/arm64/boot/dts/qcom/x1e80100.dtsi | 10 +- arch/arm64/boot/dts/renesas/r9a07g043u.dtsi | 4 +- arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 4 +- arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 4 +- arch/arm64/boot/dts/renesas/r9a08g045.dtsi | 4 +- .../boot/dts/rockchip/rk3399-pinebook-pro.dts | 4 +- arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 +- arch/arm64/boot/dts/ti/k3-am654-idk.dtso | 8 +- arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts | 4 +- arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 4 +- arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/esr.h | 88 +++---- arch/arm64/include/uapi/asm/sigcontext.h | 6 +- arch/arm64/kernel/cpu_errata.c | 10 +- arch/arm64/kernel/smp.c | 164 +++++++----- arch/arm64/kvm/hyp/nvhe/ffa.c | 21 +- arch/arm64/net/bpf_jit_comp.c | 57 +++-- arch/m68k/kernel/process.c | 2 +- arch/powerpc/crypto/Kconfig | 1 + arch/powerpc/include/asm/asm-compat.h | 6 + arch/powerpc/include/asm/atomic.h | 5 +- arch/powerpc/include/asm/uaccess.h | 7 +- arch/powerpc/kernel/head_8xx.S | 6 +- arch/powerpc/kernel/vdso/gettimeofday.S | 4 - arch/powerpc/mm/nohash/8xx.c | 4 +- arch/riscv/include/asm/kvm_vcpu_pmu.h | 21 +- arch/riscv/kernel/perf_callchain.c | 2 +- arch/riscv/kvm/vcpu_pmu.c | 14 +- arch/riscv/kvm/vcpu_sbi.c | 4 +- arch/s390/include/asm/ftrace.h | 17 +- arch/s390/kernel/Makefile | 2 +- arch/s390/kernel/early.c | 7 +- arch/s390/kernel/earlypgm.S | 23 -- arch/s390/kernel/entry.S | 16 ++ arch/s390/kernel/stacktrace.c | 19 -- arch/um/Kconfig | 1 - arch/x86/coco/tdx/tdx.c | 6 + arch/x86/crypto/aesni-intel_glue.c | 59 +++-- arch/x86/events/intel/core.c | 8 +- arch/x86/events/intel/pt.c | 15 +- arch/x86/include/asm/acpi.h | 8 + arch/x86/include/asm/hardirq.h | 8 +- arch/x86/include/asm/idtentry.h | 6 +- arch/x86/include/asm/kvm_host.h | 2 + arch/x86/kernel/acpi/boot.c | 11 + arch/x86/kernel/cpu/sgx/main.c | 27 +- arch/x86/kernel/head64.c | 3 +- arch/x86/kernel/jailhouse.c | 1 + arch/x86/kernel/mmconf-fam10h_64.c | 1 + arch/x86/kernel/process_64.c | 29 ++- arch/x86/kernel/smpboot.c | 1 + arch/x86/kernel/x86_init.c | 1 + arch/x86/kvm/lapic.c | 73 ++++-- arch/x86/kvm/svm/svm.c | 2 + arch/x86/kvm/vmx/main.c | 2 + arch/x86/mm/tlb.c | 7 +- arch/x86/net/bpf_jit_comp.c | 107 +++++--- arch/x86/pci/fixup.c | 4 +- arch/x86/xen/mmu_pv.c | 5 +- arch/x86/xen/p2m.c | 98 ++++++++ arch/x86/xen/setup.c | 202 +++++++++++---- arch/x86/xen/xen-ops.h | 6 +- block/bfq-iosched.c | 81 ++++-- block/blk-core.c | 1 + block/partitions/core.c | 8 +- crypto/asymmetric_keys/asymmetric_type.c | 7 +- crypto/xor.c | 31 ++- drivers/acpi/acpica/exsystem.c | 11 +- drivers/acpi/cppc_acpi.c | 43 +++- drivers/acpi/device_sysfs.c | 5 +- drivers/acpi/pmic/tps68470_pmic.c | 6 +- drivers/acpi/resource.c | 12 + drivers/acpi/video_detect.c | 8 + drivers/ata/libata-eh.c | 8 + drivers/ata/libata-scsi.c | 5 +- drivers/base/core.c | 15 +- drivers/base/firmware_loader/main.c | 30 +++ drivers/base/module.c | 14 +- drivers/block/drbd/drbd_main.c | 8 +- drivers/block/drbd/drbd_state.c | 2 +- drivers/block/nbd.c | 15 +- drivers/block/ublk_drv.c | 62 +++-- drivers/bluetooth/btusb.c | 5 +- drivers/bus/arm-integrator-lm.c | 1 + drivers/bus/mhi/host/pci_generic.c | 26 +- drivers/char/hw_random/Kconfig | 1 + drivers/char/hw_random/bcm2835-rng.c | 4 +- drivers/char/hw_random/cctrng.c | 1 + drivers/char/hw_random/mtk-rng.c | 2 +- drivers/char/tpm/tpm-dev-common.c | 2 + drivers/char/tpm/tpm2-sessions.c | 1 + drivers/char/tpm/tpm2-space.c | 3 + drivers/clk/at91/sama7g5.c | 5 +- drivers/clk/imx/clk-composite-7ulp.c | 7 + drivers/clk/imx/clk-composite-8m.c | 51 +++- drivers/clk/imx/clk-composite-93.c | 15 +- drivers/clk/imx/clk-fracn-gppll.c | 4 + drivers/clk/imx/clk-imx6ul.c | 4 +- drivers/clk/imx/clk-imx8mp-audiomix.c | 13 +- drivers/clk/imx/clk-imx8mp.c | 4 +- drivers/clk/imx/clk-imx8qxp.c | 10 +- drivers/clk/qcom/clk-alpha-pll.c | 52 ++++ drivers/clk/qcom/clk-alpha-pll.h | 2 + drivers/clk/qcom/dispcc-sm8250.c | 9 +- drivers/clk/qcom/dispcc-sm8550.c | 14 +- drivers/clk/qcom/gcc-ipq5332.c | 1 + drivers/clk/rockchip/clk-rk3228.c | 2 +- drivers/clk/rockchip/clk-rk3588.c | 2 +- drivers/clk/starfive/clk-starfive-jh7110-vout.c | 2 +- drivers/clk/ti/clk-dra7-atl.c | 1 + drivers/clocksource/timer-qcom.c | 7 +- drivers/cpufreq/ti-cpufreq.c | 10 +- drivers/cpuidle/cpuidle-riscv-sbi.c | 21 +- drivers/crypto/caam/caamhash.c | 1 + drivers/crypto/ccp/sev-dev.c | 15 +- drivers/crypto/hisilicon/hpre/hpre_main.c | 54 ++-- drivers/crypto/hisilicon/qm.c | 151 +++++++---- drivers/crypto/hisilicon/sec2/sec_main.c | 16 +- drivers/crypto/hisilicon/zip/zip_main.c | 23 +- drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 +- .../crypto/intel/qat/qat_common/adf_gen4_hw_data.h | 2 +- drivers/crypto/intel/qat/qat_common/adf_init.c | 4 +- .../crypto/intel/qat/qat_common/adf_pfvf_pf_msg.c | 9 +- .../crypto/intel/qat/qat_common/adf_pfvf_vf_msg.c | 14 ++ .../crypto/intel/qat/qat_common/adf_pfvf_vf_msg.h | 1 + drivers/crypto/intel/qat/qat_common/adf_vf_isr.c | 2 + drivers/crypto/n2_core.c | 1 + drivers/crypto/qcom-rng.c | 4 +- drivers/cxl/core/pci.c | 8 +- drivers/edac/igen6_edac.c | 2 +- drivers/edac/synopsys_edac.c | 35 ++- drivers/firewire/core-cdev.c | 2 +- drivers/firmware/arm_scmi/optee.c | 7 + drivers/firmware/efi/libstub/tpm.c | 2 +- drivers/firmware/qcom/qcom_scm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h | 4 +- drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 29 ++- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 14 +- drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 14 +- drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 7 +- drivers/gpu/drm/amd/amdgpu/soc24.c | 23 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 165 ------------ drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c | 4 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 94 +++++-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 18 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 146 ++++++++--- .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 6 + drivers/gpu/drm/amd/display/dc/dc_dsc.h | 3 +- .../dc/dml2/dml21/dml21_translation_helper.c | 4 +- .../dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c | 8 +- drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c | 5 +- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 50 ++++ .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 6 +- .../drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 27 +- .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 13 + .../amd/display/dc/link/hwss/link_hwss_hpo_dp.c | 12 + .../amd/display/dc/resource/dcn35/dcn35_resource.c | 1 + .../display/dc/resource/dcn351/dcn351_resource.c | 3 +- .../drm/amd/display/modules/freesync/freesync.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 6 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 3 + .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 6 +- drivers/gpu/drm/bridge/lontium-lt8912b.c | 35 +-- drivers/gpu/drm/exynos/exynos_drm_gsc.c | 2 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 32 ++- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 12 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.h | 2 + drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 30 ++- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 46 ++-- .../gpu/drm/msm/adreno/adreno_gen7_9_0_snapshot.h | 2 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c | 2 +- drivers/gpu/drm/msm/dp/dp_display.c | 10 +- drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 12 +- drivers/gpu/drm/radeon/evergreen_cs.c | 62 ++--- drivers/gpu/drm/radeon/radeon_atombios.c | 29 ++- drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 2 + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 4 +- drivers/gpu/drm/stm/drv.c | 4 +- drivers/gpu/drm/stm/ltdc.c | 2 + drivers/gpu/drm/vc4/vc4_hdmi.c | 8 +- drivers/gpu/drm/xe/xe_exec_queue.c | 157 +++++------- drivers/gpu/drm/xe/xe_exec_queue.h | 6 +- drivers/gpu/drm/xe/xe_hw_engine.c | 31 +++ drivers/gpu/drm/xe/xe_hw_engine.h | 7 + drivers/gpu/drm/xe/xe_migrate.c | 2 +- drivers/gpu/drm/xe/xe_vm.c | 8 +- drivers/hid/wacom_wac.c | 13 +- drivers/hid/wacom_wac.h | 2 +- drivers/hwmon/max16065.c | 17 +- drivers/hwmon/ntc_thermistor.c | 1 + drivers/hwtracing/coresight/coresight-dummy.c | 4 + drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +- drivers/hwtracing/coresight/coresight-tpdm.c | 6 + drivers/i2c/busses/i2c-aspeed.c | 16 +- drivers/i2c/busses/i2c-isch.c | 3 +- drivers/i2c/busses/i2c-xiic.c | 41 +-- drivers/idle/intel_idle.c | 79 +++++- drivers/iio/adc/ad7606.c | 8 +- drivers/iio/adc/ad7606_spi.c | 5 +- drivers/iio/chemical/bme680_core.c | 7 + drivers/iio/magnetometer/ak8975.c | 1 - drivers/infiniband/core/cache.c | 4 +- drivers/infiniband/core/iwcm.c | 2 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 + drivers/infiniband/hw/cxgb4/cm.c | 5 + drivers/infiniband/hw/erdma/erdma_verbs.c | 25 +- drivers/infiniband/hw/hns/hns_roce_ah.c | 14 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 22 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 33 +-- drivers/infiniband/hw/hns/hns_roce_qp.c | 16 +- drivers/infiniband/hw/irdma/verbs.c | 2 +- drivers/infiniband/hw/mlx5/main.c | 2 +- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- drivers/infiniband/hw/mlx5/mr.c | 99 ++++---- drivers/infiniband/hw/mlx5/umr.c | 3 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 9 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 1 + drivers/input/keyboard/adp5588-keys.c | 2 +- drivers/input/misc/ims-pcu.c | 2 +- drivers/input/serio/i8042-acpipnpio.h | 37 +++ drivers/input/touchscreen/ilitek_ts_i2c.c | 18 +- drivers/interconnect/icc-clk.c | 3 +- drivers/interconnect/qcom/sm8350.c | 1 + drivers/iommu/amd/io_pgtable.c | 8 +- drivers/iommu/amd/io_pgtable_v2.c | 4 +- drivers/iommu/amd/iommu.c | 57 +---- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 4 +- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 28 +++ drivers/iommu/arm/arm-smmu/arm-smmu.c | 2 +- drivers/iommu/iommufd/hw_pagetable.c | 3 +- drivers/iommu/iommufd/io_pagetable.c | 8 + drivers/iommu/iommufd/selftest.c | 9 +- drivers/leds/leds-bd2606mvv.c | 23 +- drivers/leds/leds-gpio.c | 9 +- drivers/leds/leds-pca995x.c | 21 +- drivers/md/dm-integrity.c | 15 +- drivers/md/dm-rq.c | 4 +- drivers/md/dm-verity-target.c | 23 +- drivers/md/dm.c | 11 +- drivers/md/md.c | 1 - drivers/media/dvb-frontends/rtl2830.c | 2 +- drivers/media/dvb-frontends/rtl2832.c | 2 +- drivers/media/platform/imagination/Kconfig | 1 + .../vcodec/decoder/vdec/vdec_h264_req_if.c | 9 +- .../vcodec/decoder/vdec/vdec_h264_req_multi_if.c | 9 +- .../mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c | 10 +- drivers/media/platform/raspberrypi/pisp_be/Kconfig | 1 + .../media/platform/renesas/rzg2l-cru/rzg2l-csi2.c | 1 + drivers/media/tuners/tuner-i2c.h | 4 +- drivers/mtd/devices/powernv_flash.c | 3 + drivers/mtd/devices/slram.c | 2 + drivers/mtd/nand/raw/mtk_nand.c | 36 +-- drivers/net/bareudp.c | 26 +- drivers/net/bonding/bond_main.c | 6 +- drivers/net/can/m_can/m_can.c | 14 +- drivers/net/can/usb/esd_usb.c | 6 +- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +- .../net/ethernet/intel/idpf/idpf_singleq_txrx.c | 4 + drivers/net/ethernet/intel/idpf/idpf_txrx.c | 35 +-- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 9 +- drivers/net/ethernet/meta/Kconfig | 2 + drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 8 +- drivers/net/ethernet/realtek/r8169_phy_config.c | 2 + drivers/net/ethernet/renesas/ravb.h | 1 + drivers/net/ethernet/renesas/ravb_main.c | 18 +- drivers/net/ethernet/seeq/ether3.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 37 +-- drivers/net/netkit.c | 3 + drivers/net/phy/aquantia/aquantia_firmware.c | 40 +-- drivers/net/phy/aquantia/aquantia_leds.c | 3 +- drivers/net/phy/aquantia/aquantia_main.c | 24 +- drivers/net/usb/usbnet.c | 37 ++- drivers/net/virtio_net.c | 88 ++++--- drivers/net/wireless/ath/ath11k/core.h | 1 + drivers/net/wireless/ath/ath11k/mac.c | 12 + drivers/net/wireless/ath/ath11k/wmi.c | 4 +- drivers/net/wireless/ath/ath12k/mac.c | 5 +- drivers/net/wireless/ath/ath12k/wmi.c | 1 + drivers/net/wireless/ath/ath12k/wmi.h | 3 +- drivers/net/wireless/ath/ath9k/debug.c | 2 - drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 - .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 2 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 30 +-- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/feature.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/fwil.h | 40 ++- drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 11 + drivers/net/wireless/intel/iwlwifi/iwl-config.h | 1 + drivers/net/wireless/intel/iwlwifi/mvm/constants.h | 2 +- .../net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 1 + .../net/wireless/intel/iwlwifi/mvm/time-event.c | 14 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 4 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7603/dma.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7615/init.c | 3 + .../net/wireless/mediatek/mt76/mt76_connac3_mac.h | 4 +- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 2 + drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7921/init.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 5 +- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 15 ++ drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h | 1 + drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 2 + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 65 +++-- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 13 +- drivers/net/wireless/microchip/wilc1000/hif.c | 4 +- drivers/net/wireless/realtek/rtw88/coex.c | 38 +-- drivers/net/wireless/realtek/rtw88/fw.c | 13 +- drivers/net/wireless/realtek/rtw88/main.c | 7 +- drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 - drivers/net/wireless/realtek/rtw88/rtw8822c.c | 12 +- drivers/net/wireless/realtek/rtw88/rx.h | 2 +- drivers/net/wireless/realtek/rtw89/core.c | 1 + drivers/net/wireless/realtek/rtw89/core.h | 3 + drivers/net/wireless/realtek/rtw89/fw.c | 6 +- drivers/net/wireless/realtek/rtw89/fw.h | 7 +- drivers/net/wireless/realtek/rtw89/mac.c | 13 +- drivers/net/wireless/realtek/rtw89/mac.h | 1 - drivers/net/wireless/realtek/rtw89/reg.h | 4 + drivers/net/wireless/virtual/mac80211_hwsim.c | 2 +- drivers/ntb/hw/intel/ntb_hw_gen1.c | 2 +- drivers/ntb/ntb_transport.c | 23 +- drivers/ntb/test/ntb_perf.c | 2 +- drivers/nvdimm/namespace_devs.c | 34 +-- drivers/nvme/host/multipath.c | 2 +- drivers/pci/controller/dwc/pci-dra7xx.c | 11 +- drivers/pci/controller/dwc/pci-imx6.c | 15 +- drivers/pci/controller/dwc/pci-keystone.c | 2 +- drivers/pci/controller/dwc/pcie-kirin.c | 4 +- drivers/pci/controller/dwc/pcie-qcom-ep.c | 14 +- drivers/pci/controller/pcie-xilinx-nwl.c | 39 ++- drivers/pci/pci.c | 20 +- drivers/pci/pci.h | 6 +- drivers/pci/quirks.c | 31 ++- drivers/perf/alibaba_uncore_drw_pmu.c | 2 +- drivers/perf/arm-cmn.c | 109 ++++---- drivers/perf/dwc_pcie_pmu.c | 21 +- drivers/perf/hisilicon/hisi_pcie_pmu.c | 16 +- drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 1 + drivers/pinctrl/mvebu/pinctrl-dove.c | 42 +++- drivers/pinctrl/pinctrl-single.c | 3 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 8 +- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 52 ++-- drivers/platform/cznic/turris-omnia-mcu-trng.c | 4 +- drivers/platform/x86/ideapad-laptop.c | 48 ++-- drivers/pmdomain/core.c | 6 +- drivers/power/supply/axp20x_battery.c | 16 +- drivers/power/supply/max17042_battery.c | 5 +- drivers/powercap/intel_rapl_common.c | 2 +- drivers/pps/clients/pps_parport.c | 8 +- drivers/regulator/of_regulator.c | 2 +- drivers/remoteproc/imx_rproc.c | 6 +- drivers/reset/reset-berlin.c | 3 +- drivers/reset/reset-k210.c | 3 +- drivers/s390/crypto/ap_bus.c | 17 ++ drivers/scsi/NCR5380.c | 78 +++--- drivers/scsi/elx/libefc/efc_nport.c | 2 +- drivers/scsi/lpfc/lpfc_hw4.h | 3 + drivers/scsi/lpfc/lpfc_init.c | 21 +- drivers/scsi/lpfc/lpfc_scsi.c | 2 +- drivers/scsi/mac_scsi.c | 166 ++++++------ drivers/scsi/sd.c | 4 +- drivers/scsi/smartpqi/smartpqi_init.c | 20 +- drivers/soc/fsl/qe/qmc.c | 24 +- drivers/soc/fsl/qe/tsa.c | 2 +- drivers/soc/qcom/smd-rpm.c | 35 ++- drivers/soc/versatile/soc-integrator.c | 1 + drivers/soc/versatile/soc-realview.c | 20 +- drivers/spi/atmel-quadspi.c | 15 +- drivers/spi/spi-airoha-snfi.c | 43 ++-- drivers/spi/spi-bcmbca-hsspi.c | 8 +- drivers/spi/spi-fsl-lpspi.c | 1 + drivers/spi/spi-nxp-fspi.c | 54 ++-- drivers/spi/spi-ppc4xx.c | 7 +- drivers/staging/media/starfive/camss/stf-camss.c | 2 - drivers/thermal/gov_bang_bang.c | 14 +- drivers/thermal/thermal_core.c | 78 +++--- drivers/thermal/thermal_core.h | 27 +- drivers/thermal/thermal_sysfs.c | 207 +++++++-------- drivers/thermal/thermal_trip.c | 6 +- drivers/tty/serial/8250/8250_omap.c | 2 +- drivers/tty/serial/qcom_geni_serial.c | 101 ++++---- drivers/tty/serial/rp2.c | 2 +- drivers/tty/serial/serial_core.c | 13 +- drivers/ufs/host/ufs-qcom.c | 2 +- drivers/usb/cdns3/cdnsp-ring.c | 6 +- drivers/usb/cdns3/host.c | 4 +- drivers/usb/class/cdc-acm.c | 2 + drivers/usb/dwc2/drd.c | 9 + drivers/usb/gadget/udc/dummy_hcd.c | 14 +- drivers/usb/host/xhci-pci.c | 24 +- drivers/usb/host/xhci-ring.c | 14 ++ drivers/usb/host/xhci.h | 1 + drivers/usb/misc/appledisplay.c | 15 +- drivers/usb/misc/cypress_cy7c63.c | 4 + drivers/usb/misc/yurex.c | 10 +- drivers/usb/typec/ucsi/ucsi.c | 35 ++- drivers/vdpa/mlx5/core/mr.c | 3 + drivers/vhost/vdpa.c | 16 +- drivers/video/fbdev/hpfb.c | 1 + drivers/video/fbdev/xen-fbfront.c | 1 + drivers/virtio/virtio.c | 59 ++++- drivers/watchdog/imx_sc_wdt.c | 24 -- drivers/xen/swiotlb-xen.c | 10 +- fs/autofs/inode.c | 3 +- fs/btrfs/btrfs_inode.h | 1 + fs/btrfs/ctree.h | 2 + fs/btrfs/extent-tree.c | 4 +- fs/btrfs/file.c | 34 ++- fs/btrfs/ioctl.c | 4 +- fs/btrfs/subpage.c | 10 +- fs/btrfs/tree-checker.c | 2 +- fs/cachefiles/xattr.c | 34 ++- fs/debugfs/inode.c | 8 + fs/erofs/decompressor.c | 2 +- fs/erofs/inode.c | 20 +- fs/erofs/zdata.c | 71 +++--- fs/eventpoll.c | 2 +- fs/exfat/nls.c | 5 +- fs/ext4/ialloc.c | 14 +- fs/ext4/inline.c | 35 ++- fs/ext4/mballoc.c | 10 +- fs/ext4/super.c | 29 ++- fs/f2fs/compress.c | 36 ++- fs/f2fs/data.c | 10 +- fs/f2fs/dir.c | 3 +- fs/f2fs/extent_cache.c | 4 +- fs/f2fs/f2fs.h | 37 +-- fs/f2fs/file.c | 114 ++++++--- fs/f2fs/inode.c | 5 + fs/f2fs/namei.c | 68 ----- fs/f2fs/segment.c | 15 ++ fs/f2fs/super.c | 16 +- fs/f2fs/xattr.c | 14 +- fs/fcntl.c | 14 +- fs/fuse/file.c | 2 +- fs/inode.c | 4 + fs/jfs/jfs_dmap.c | 4 +- fs/jfs/jfs_imap.c | 2 +- fs/namespace.c | 14 +- fs/netfs/main.c | 4 +- fs/nfs/nfs4proc.c | 16 +- fs/nfs/nfs4state.c | 1 + fs/nfsd/filecache.c | 3 +- fs/nfsd/nfs4idmap.c | 13 +- fs/nfsd/nfs4recover.c | 8 + fs/nfsd/nfs4state.c | 170 +++++++------ fs/nilfs2/btree.c | 12 +- fs/quota/dquot.c | 3 +- fs/smb/server/vfs.c | 19 +- include/acpi/acoutput.h | 5 + include/acpi/cppc_acpi.h | 2 + include/linux/bpf.h | 9 +- include/linux/bpf_lsm.h | 8 + include/linux/compiler.h | 2 +- include/linux/f2fs_fs.h | 2 +- include/linux/lsm_hook_defs.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/sbitmap.h | 2 +- include/linux/soc/qcom/geni-se.h | 9 + include/linux/usb/usbnet.h | 15 ++ include/linux/virtio.h | 11 +- include/net/bluetooth/hci_core.h | 4 +- include/net/ip.h | 2 + include/net/mac80211.h | 7 +- include/net/netfilter/nf_tables.h | 2 + include/net/tcp.h | 21 +- include/sound/tas2563-tlv.h | 279 +++++++++++++++++++++ include/sound/tas2781-tlv.h | 260 ------------------- include/sound/tas2781.h | 7 +- include/trace/events/f2fs.h | 3 +- io_uring/io-wq.c | 25 +- io_uring/io_uring.c | 4 +- io_uring/rw.c | 8 + io_uring/sqpoll.c | 12 + kernel/bpf/bpf_lsm.c | 34 ++- kernel/bpf/btf.c | 13 +- kernel/bpf/helpers.c | 12 +- kernel/bpf/syscall.c | 4 +- kernel/bpf/verifier.c | 134 ++++++---- kernel/cgroup/pids.c | 18 +- kernel/kthread.c | 10 +- kernel/locking/lockdep.c | 50 ++-- kernel/module/Makefile | 2 +- kernel/padata.c | 6 +- kernel/rcu/tree_nocb.h | 5 +- kernel/sched/deadline.c | 38 ++- kernel/sched/fair.c | 34 +-- kernel/trace/bpf_trace.c | 15 +- lib/debugobjects.c | 5 +- lib/sbitmap.c | 4 +- lib/xz/xz_crc32.c | 2 +- lib/xz/xz_private.h | 4 - mm/damon/vaddr.c | 2 + mm/huge_memory.c | 2 + mm/hugetlb.c | 206 +++++++++------ mm/internal.h | 11 +- mm/memory.c | 8 +- mm/migrate.c | 2 +- mm/mmap.c | 4 + mm/util.c | 2 +- net/bluetooth/hci_conn.c | 6 +- net/bluetooth/hci_sync.c | 5 +- net/bluetooth/mgmt.c | 13 +- net/can/bcm.c | 4 +- net/can/j1939/transport.c | 8 +- net/core/filter.c | 71 +++--- net/core/sock_map.c | 1 + net/ipv4/icmp.c | 103 ++++---- net/ipv6/Kconfig | 1 + net/ipv6/icmp.c | 28 ++- net/ipv6/netfilter/nf_reject_ipv6.c | 14 +- net/ipv6/route.c | 2 +- net/ipv6/rpl_iptunnel.c | 12 +- net/mac80211/iface.c | 17 +- net/mac80211/mlme.c | 30 ++- net/mac80211/offchannel.c | 1 + net/mac80211/rate.c | 2 +- net/mac80211/scan.c | 2 +- net/mac80211/tx.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 7 +- net/netfilter/nf_tables_api.c | 47 ++-- net/netfilter/nft_compat.c | 6 +- net/netfilter/nft_dynset.c | 6 +- net/netfilter/nft_log.c | 2 +- net/netfilter/nft_meta.c | 2 +- net/netfilter/nft_numgen.c | 2 +- net/netfilter/nft_set_pipapo.c | 13 +- net/netfilter/nft_tunnel.c | 5 +- net/qrtr/af_qrtr.c | 2 +- net/tipc/bcast.c | 2 +- net/unix/af_unix.c | 92 +++---- net/unix/garbage.c | 16 +- net/wireless/nl80211.c | 3 +- net/wireless/scan.c | 6 +- net/wireless/sme.c | 3 +- net/wireless/util.c | 10 +- net/xdp/xsk_buff_pool.c | 29 ++- samples/bpf/Makefile | 6 +- security/apparmor/include/net.h | 3 +- security/apparmor/lsm.c | 17 +- security/apparmor/net.c | 2 +- security/bpf/hooks.c | 1 - security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_iint.c | 20 +- security/integrity/ima/ima_main.c | 2 +- security/landlock/fs.c | 9 +- security/security.c | 68 +++-- security/selinux/hooks.c | 80 +++--- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 70 +++--- security/smack/smack_netfilter.c | 4 +- security/smack/smackfs.c | 2 +- sound/pci/hda/cs35l41_hda_spi.c | 1 + sound/pci/hda/tas2781_hda_i2c.c | 2 +- sound/soc/codecs/rt5682.c | 4 +- sound/soc/codecs/rt5682s.c | 4 +- sound/soc/codecs/tas2781-comlib.c | 3 - sound/soc/codecs/tas2781-fmwlib.c | 1 - sound/soc/codecs/tas2781-i2c.c | 27 +- sound/soc/loongson/loongson_card.c | 4 +- tools/bpf/bpftool/btf.c | 7 +- tools/bpf/runqslower/Makefile | 3 +- tools/build/feature/test-all.c | 4 - tools/include/nolibc/string.h | 1 + tools/lib/bpf/btf.c | 4 + tools/lib/bpf/btf_relocate.c | 2 +- tools/lib/bpf/libbpf.c | 75 +++--- tools/objtool/arch/loongarch/decode.c | 11 +- tools/objtool/check.c | 23 +- tools/objtool/include/objtool/elf.h | 1 + tools/perf/builtin-c2c.c | 14 +- tools/perf/builtin-inject.c | 1 + tools/perf/builtin-mem.c | 20 +- tools/perf/builtin-report.c | 3 +- tools/perf/builtin-sched.c | 8 +- .../arch/x86/cascadelakex/uncore-cache.json | 60 ++--- .../pmu-events/arch/x86/skylakex/uncore-cache.json | 60 ++--- .../arch/x86/snowridgex/uncore-cache.json | 57 ----- tools/perf/scripts/python/arm-cs-trace-disasm.py | 9 +- tools/perf/ui/hist.c | 10 +- tools/perf/util/Build | 1 + tools/perf/util/annotate-data.c | 2 +- tools/perf/util/bpf_skel/lock_data.h | 4 +- tools/perf/util/bpf_skel/vmlinux/vmlinux.h | 1 + tools/perf/util/disasm.c | 187 +------------- tools/perf/util/disasm_bpf.c | 195 ++++++++++++++ tools/perf/util/disasm_bpf.h | 12 + tools/perf/util/dwarf-aux.c | 16 +- tools/perf/util/machine.c | 17 +- tools/perf/util/mem-events.c | 20 +- tools/perf/util/mem-events.h | 4 +- tools/perf/util/session.c | 3 + tools/perf/util/stat-display.c | 3 +- tools/perf/util/thread.c | 4 + tools/perf/util/thread.h | 1 + tools/perf/util/time-utils.c | 4 +- tools/perf/util/tool.h | 1 + tools/power/cpupower/lib/powercap.c | 8 + tools/testing/selftests/arm64/signal/Makefile | 2 +- tools/testing/selftests/arm64/signal/sve_helpers.c | 56 +++++ tools/testing/selftests/arm64/signal/sve_helpers.h | 21 ++ .../testcases/fake_sigreturn_sme_change_vl.c | 46 ++-- .../testcases/fake_sigreturn_sve_change_vl.c | 30 +-- .../selftests/arm64/signal/testcases/ssve_regs.c | 36 +-- .../arm64/signal/testcases/ssve_za_regs.c | 36 +-- .../selftests/arm64/signal/testcases/sve_regs.c | 32 +-- .../selftests/arm64/signal/testcases/za_no_regs.c | 32 +-- .../selftests/arm64/signal/testcases/za_regs.c | 36 +-- tools/testing/selftests/bpf/Makefile | 13 +- tools/testing/selftests/bpf/bench.c | 1 + tools/testing/selftests/bpf/bench.h | 1 + .../selftests/bpf/map_tests/sk_storage_map.c | 2 +- .../selftests/bpf/prog_tests/bpf_iter_setsockopt.c | 2 +- .../testing/selftests/bpf/prog_tests/core_reloc.c | 1 + .../selftests/bpf/prog_tests/crypto_sanity.c | 1 - .../selftests/bpf/prog_tests/decap_sanity.c | 1 - .../selftests/bpf/prog_tests/flow_dissector.c | 2 +- tools/testing/selftests/bpf/prog_tests/kfree_skb.c | 1 + .../selftests/bpf/prog_tests/lwt_redirect.c | 1 - .../testing/selftests/bpf/prog_tests/lwt_reroute.c | 1 + .../selftests/bpf/prog_tests/ns_current_pid_tgid.c | 2 +- .../selftests/bpf/prog_tests/parse_tcp_hdr_opt.c | 1 + tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 1 - .../testing/selftests/bpf/prog_tests/tc_redirect.c | 12 +- tools/testing/selftests/bpf/prog_tests/tcp_rtt.c | 1 + .../selftests/bpf/prog_tests/user_ringbuf.c | 1 + tools/testing/selftests/bpf/progs/bpf_misc.h | 24 +- .../testing/selftests/bpf/progs/cg_storage_multi.h | 2 - .../bpf/progs/test_libbpf_get_fd_by_id_opts.c | 1 + .../selftests/bpf/progs/verifier_spill_fill.c | 8 +- tools/testing/selftests/bpf/test_cpp.cpp | 4 + tools/testing/selftests/bpf/test_loader.c | 258 ++++++++++++++----- tools/testing/selftests/bpf/test_lru_map.c | 3 +- tools/testing/selftests/bpf/test_progs.c | 18 +- tools/testing/selftests/bpf/test_progs.h | 1 - tools/testing/selftests/bpf/testing_helpers.c | 6 +- tools/testing/selftests/bpf/unpriv_helpers.c | 1 - tools/testing/selftests/bpf/veristat.c | 8 +- .../testing/selftests/dt/test_unprobed_devices.sh | 15 +- .../ftrace/test.d/00basic/test_ownership.tc | 12 + .../ftrace/test.d/ftrace/func_set_ftrace_file.tc | 9 +- .../ftrace/test.d/kprobe/kprobe_args_char.tc | 2 +- .../ftrace/test.d/kprobe/kprobe_args_string.tc | 2 +- tools/testing/selftests/kselftest.h | 2 + tools/testing/selftests/mm/mseal_test.c | 57 +++-- tools/testing/selftests/net/af_unix/msg_oob.c | 23 ++ tools/testing/selftests/net/netfilter/ipvs.sh | 2 +- tools/testing/selftests/resctrl/cat_test.c | 7 +- virt/kvm/kvm_main.c | 31 +-- 688 files changed, 7249 insertions(+), 4720 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/695 wifi: ath11k: use work queue to process beacon tx event
6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kang Yang <[email protected]>
[ Upstream commit 177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3 ]
Commit 3a415daa3e8b ("wifi: ath11k: add P2P IE in beacon template") from Feb 28, 2024 (linux-next), leads to the following Smatch static checker warning:
drivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie()
warn: sleeping in atomic context
The reason is that ath11k_bcn_tx_status_event() will directly call might sleep function ath11k_wmi_cmd_send() during RCU read-side critical sections. The call trace is like:
ath11k_bcn_tx_status_event()
-> rcu_read_lock()
-> ath11k_mac_bcn_tx_event()
-> ath11k_mac_setup_bcn_tmpl() …… -> ath11k_wmi_bcn_tmpl() -> ath11k_wmi_cmd_send()
-> rcu_read_unlock()
Commit 886433a98425 ("ath11k: add support for BSS color change") added the ath11k_mac_bcn_tx_event(), commit 01e782c89108 ("ath11k: fix warning of RCU usage for ath11k_mac_get_arvif_by_vdev_id()") added the RCU lock to avoid warning but also introduced this BUG.
Use work queue to avoid directly calling ath11k_mac_bcn_tx_event() during RCU critical sections. No need to worry about the deletion of vif because cancel_work_sync() will drop the work if it doesn't start or block vif deletion until the running work is done.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
--- drivers/net/wireless/ath/ath11k/core.h | 1 + drivers/net/wireless/ath/ath11k/mac.c | 12 ++++++++++++ drivers/net/wireless/ath/ath11k/wmi.c | 4 +++- 3 files changed, 16 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/core.h +1 -0
@@ -399,6 +399,7 @@ struct ath11k_vif {u8 bssid[ETH_ALEN ];struct cfg80211_bitrate_mask bitrate_mask;struct delayed_work connection_loss_work; +struct work_struct bcn_tx_work;int num_legacy_stations;int rtscts_prot_mode;int txpower;
drivers/net/wireless/ath/ath11k/mac.c +12 -0
@@ -6599,6 +6599,16 @@ static int ath11k_mac_vdev_delete(struct ath11k *ar, struct ath11k_vif *arvif)return ret; } +static void ath11k_mac_bcn_tx_work (struct work_struct *work) +{ + struct ath11k_vif *arvif = container_of(work, struct ath11k_vif, + bcn_tx_work); + +mutex_lock (&arvif->ar->conf_mutex); +ath11k_mac_bcn_tx_event (arvif); +mutex_unlock (&arvif->ar->conf_mutex); +} +static int ath11k_mac_op_add_interface (struct ieee80211_hw *hw,struct ieee80211_vif *vif) {
@@ -6637,6 +6647,7 @@ static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw, arvif->vif = vif;INIT_LIST_HEAD (&arvif->list); +INIT_WORK (&arvif->bcn_tx_work, ath11k_mac_bcn_tx_work);INIT_DELAYED_WORK (&arvif->connection_loss_work, ath11k_mac_vif_sta_connection_loss_work);
@@ -6879,6 +6890,7 @@ static void ath11k_mac_op_remove_interface(struct ieee80211_hw *hw,int i;cancel_delayed_work_sync (&arvif->connection_loss_work); +cancel_work_sync (&arvif->bcn_tx_work);mutex_lock (&ar->conf_mutex);
drivers/net/wireless/ath/ath11k/wmi.c +3 -1
@@ -7404,7 +7404,9 @@ static void ath11k_bcn_tx_status_event(struct ath11k_base *ab, struct sk_buff *srcu_read_unlock ();return ; } -ath11k_mac_bcn_tx_event (arvif); + +queue_work (ab->workqueue, &arvif->bcn_tx_work); +rcu_read_unlock (); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/695 EDAC/synopsys: Fix error injection on Zynq UltraScale+
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubhrajyoti Datta <[email protected]>
[ Upstream commit 35e6dbfe1846caeafabb49b7575adb36b0aa2269 ]
The Zynq UltraScale+ MPSoC DDR has a disjoint memory from 2GB to 32GB. The DDR host interface has a contiguous memory so while injecting errors, the driver should remove the hole else the injection fails as the address translation is incorrect.
Introduce a get_mem_info() function pointer and set it for Zynq UltraScale+ platform to return host address.
--- drivers/edac/synopsys_edac.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-)
drivers/edac/synopsys_edac.c +34 -1
@@ -10,6 +10,7 @@#include <linux/module.h> #include <linux/platform_device.h> #include <linux/spinlock.h> +#include <linux/sizes.h> #include <linux/interrupt.h> #include <linux/of.h>
@@ -337,6 +338,7 @@ struct synps_edac_priv {* @get_mtype: Get mtype. * @get_dtype: Get dtype. * @get_ecc_state: Get ECC state. +* @get_mem_info: Get EDAC memory info * @quirks: To differentiate IPs. */ struct synps_platform_data {
@@ -344,6 +346,9 @@ struct synps_platform_data {enum mem_type (*get_mtype)(const void __iomem *base);enum dev_type (*get_dtype)(const void __iomem *base);bool (*get_ecc_state)(void __iomem *base); +#ifdef CONFIG_EDAC_DEBUG +u64 (*get_mem_info)(struct synps_edac_priv *priv); +#endif int quirks; };
@@ -402,6 +407,25 @@ static int zynq_get_error_info(struct synps_edac_priv *priv)return 0 ; } +#ifdef CONFIG_EDAC_DEBUG +/** +* zynqmp_get_mem_info - Get the current memory info. +* @priv: DDR memory controller private instance data. +* +* Return: host interface address. +*/ +static u64 zynqmp_get_mem_info (struct synps_edac_priv *priv) +{ +u64 hif_addr =0 , linear_addr; + + linear_addr = priv->poison_addr; +if (linear_addr >=SZ_32G ) + linear_addr = linear_addr -SZ_32G +SZ_2G ; + hif_addr = linear_addr >>3 ; +return hif_addr; +} +#endif +/** * zynqmp_get_error_info - Get the current ECC error info. * @priv: DDR memory controller private instance data.
@@ -922,6 +946,9 @@ static const struct synps_platform_data zynqmp_edac_def = { .get_mtype = zynqmp_get_mtype, .get_dtype = zynqmp_get_dtype, .get_ecc_state = zynqmp_get_ecc_state, +#ifdef CONFIG_EDAC_DEBUG + .get_mem_info = zynqmp_get_mem_info, +#endif .quirks = (DDR_ECC_INTR_SUPPORT #ifdef CONFIG_EDAC_DEBUG | DDR_ECC_DATA_POISON_SUPPORT
@@ -975,10 +1002,16 @@ MODULE_DEVICE_TABLE(of, synps_edac_match);static void ddr_poison_setup (struct synps_edac_priv *priv) {int col =0 , row =0 , bank =0 , bankgrp =0 , rank =0 , regval; +const struct synps_platform_data *p_data;int index;ulong hif_addr =0 ; - hif_addr = priv->poison_addr >>3 ; + p_data = priv->p_data; + +if (p_data->get_mem_info) + hif_addr = p_data->get_mem_info (priv); +else + hif_addr = priv->poison_addr >>3 ;for (index =0 ; index <DDR_MAX_ROW_SHIFT ; index++) {if (priv->row_shift[index])
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/695 wifi: rtw88: always wait for both firmware loading attempts
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d ]
In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.
--- drivers/net/wireless/realtek/rtw88/main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/realtek/rtw88/main.c +4 -3
@@ -1313,20 +1313,21 @@ static int rtw_wait_firmware_completion(struct rtw_dev *rtwdev) {const struct rtw_chip_info *chip = rtwdev->chip;struct rtw_fw_state *fw; +int ret =0 ; fw = &rtwdev->fw;wait_for_completion (&fw->completion);if (!fw->firmware) -return -EINVAL ; + ret = -EINVAL ;if (chip->wow_fw_name) { fw = &rtwdev->wow_fw;wait_for_completion (&fw->completion);if (!fw->firmware) -return -EINVAL ; + ret = -EINVAL ; } -return 0 ; +return ret; } static enum rtw_lps_deep_mode rtw_update_lps_deep_mode(struct rtw_dev *rtwdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/695 crypto: xor - fix template benchmarking
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit ab9a244c396aae4aaa34b2399b82fc15ec2df8c1 ]
Commit c055e3eae0f1 ("crypto: xor - use ktime for template benchmarking") switched from using jiffies to ktime-based performance benchmarking.
This works nicely on machines which have a fine-grained ktime() clocksource as e.g. x86 machines with TSC.
But other machines, e.g. my 4-way HP PARISC server, don't have such fine-grained clocksources, which is why it seems that 800 xor loops take zero seconds, which then shows up in the logs as:
xor: measuring software checksum speed
8regs : -1018167296 MB/sec
8regs_prefetch : -1018167296 MB/sec
32regs : -1018167296 MB/sec
32regs_prefetch : -1018167296 MB/secFix this with some small modifications to the existing code to improve the algorithm to always produce correct results without introducing major delays for architectures with a fine-grained ktime() clocksource:
a) Delay start of the timing until ktime() just advanced. On machines with a fast ktime() this should be just one additional ktime() call.
b) Count the number of loops. Run at minimum 800 loops and finish earliest when the ktime() counter has progressed.
With that the throughput can now be calculated more accurately under all conditions.
v2:
- clean up coding style (noticed & suggested by Herbert Xu)
- rephrased & fixed typo in commit message
--- crypto/xor.c | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-)
crypto/xor.c +14 -17
@@ -83,33 +83,30 @@ static void __init do_xor_speed(struct xor_block_template *tmpl, void *b1, void *b2) { int speed; -int i, j; -ktime_t min, start, diff; +unsigned long reps; +ktime_t min, start, t0; tmpl->next = template_list; template_list = tmpl;preempt_disable (); - min = (ktime_t )S64_MAX ; -for (i =0 ; i <3 ; i++) { - start =ktime_get (); -for (j =0 ; j <REPS ; j++) { -mb ();/* prevent loop optimization */ - tmpl->do_2 (BENCH_SIZE , b1, b2); -mb (); - } - diff =ktime_sub (ktime_get (), start); -if (diff < min) - min = diff; - } + reps =0 ; + t0 =ktime_get (); +/* delay start until time has advanced */ +while ((start =ktime_get ()) == t0) +cpu_relax (); +do { +mb ();/* prevent loop optimization */ + tmpl->do_2 (BENCH_SIZE , b1, b2); +mb (); + }while (reps++ <REPS || (t0 =ktime_get ()) == start); + min =ktime_sub (t0, start);preempt_enable ();// bytes/ns == GB/s, multiply by 1000 to get MB/s [not MiB/s] -if (!min) - min =1 ; - speed = (1000 *REPS *BENCH_SIZE ) / (unsigned int )ktime_to_ns (min); + speed = (1000 * reps *BENCH_SIZE ) / (unsigned int )ktime_to_ns (min); tmpl->speed = speed;pr_info (" %-16s: %5d MB/sec\n" , tmpl->name, speed);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/695 crypto: qat - disable IOV in adf_dev_stop()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Witwicki <[email protected]>
[ Upstream commit b6c7d36292d50627dbe6a57fa344f87c776971e6 ]
Disabling IOV has the side effect of re-enabling the AEs that might attempt to do DMAs into the heartbeat buffers.
Move the disable_iov() function in adf_dev_stop() before the AEs are stopped.
--- drivers/crypto/intel/qat/qat_common/adf_init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/intel/qat/qat_common/adf_init.c +2 -2
@@ -323,6 +323,8 @@ static void adf_dev_stop(struct adf_accel_dev *accel_dev)if (hw_data->stop_timer) hw_data->stop_timer (accel_dev); + hw_data->disable_iov (accel_dev); +if (wait)msleep (100 );
@@ -386,8 +388,6 @@ static void adf_dev_shutdown(struct adf_accel_dev *accel_dev)adf_tl_shutdown (accel_dev); - hw_data->disable_iov (accel_dev); -if (test_bit (ADF_STATUS_IRQ_ALLOCATED , &accel_dev->status)) { hw_data->free_irq (accel_dev);clear_bit (ADF_STATUS_IRQ_ALLOCATED , &accel_dev->status);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/695 crypto: qat - fix recovery flow for VFs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Witwicki <[email protected]>
[ Upstream commit 6f1b5236348fced7e7691a933327694b4106bc39 ]
When the PFVF protocol was updated to support version 5, i.e. ADF_PFVF_COMPAT_FALLBACK, the compatibility version for the VF was updated without supporting the message RESTARTING_COMPLETE required for such version.
Add support for the ADF_VF2PF_MSGTYPE_RESTARTING_COMPLETE message in the VF drivers. This message is sent by the VF driver to the PF to notify the completion of the shutdown flow.
--- .../crypto/intel/qat/qat_common/adf_pfvf_vf_msg.c | 14 ++++++++++++++ .../crypto/intel/qat/qat_common/adf_pfvf_vf_msg.h | 1 + drivers/crypto/intel/qat/qat_common/adf_vf_isr.c | 2 ++ 3 files changed, 17 insertions(+)
drivers/crypto/intel/qat/qat_common/adf_pfvf_vf_msg.c +14 -0
@@ -48,6 +48,20 @@ void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev) }EXPORT_SYMBOL_GPL (adf_vf2pf_notify_shutdown); +void adf_vf2pf_notify_restart_complete (struct adf_accel_dev *accel_dev) +{ +struct pfvf_message msg = { .type =ADF_VF2PF_MSGTYPE_RESTARTING_COMPLETE }; + +/* Check compatibility version */ +if (accel_dev->vf.pf_compat_ver <ADF_PFVF_COMPAT_FALLBACK ) +return ; + +if (adf_send_vf2pf_msg (accel_dev, msg)) +dev_err (&GET_DEV (accel_dev), +"Failed to send Restarting complete event to PF\n" ); +} +EXPORT_SYMBOL_GPL (adf_vf2pf_notify_restart_complete); +int adf_vf2pf_request_version (struct adf_accel_dev *accel_dev) {u8 pf_version;
drivers/crypto/intel/qat/qat_common/adf_pfvf_vf_msg.h +1 -0
@@ -6,6 +6,7 @@#if defined(CONFIG_PCI_IOV )int adf_vf2pf_notify_init (struct adf_accel_dev *accel_dev);void adf_vf2pf_notify_shutdown (struct adf_accel_dev *accel_dev); +void adf_vf2pf_notify_restart_complete (struct adf_accel_dev *accel_dev);int adf_vf2pf_request_version (struct adf_accel_dev *accel_dev);int adf_vf2pf_get_capabilities (struct adf_accel_dev *accel_dev);int adf_vf2pf_get_ring_to_svc (struct adf_accel_dev *accel_dev);
drivers/crypto/intel/qat/qat_common/adf_vf_isr.c +2 -0
@@ -13,6 +13,7 @@#include "adf_cfg.h" #include "adf_cfg_strings.h" #include "adf_cfg_common.h" +#include "adf_pfvf_vf_msg.h" #include "adf_transport_access_macros.h" #include "adf_transport_internal.h"
@@ -75,6 +76,7 @@ static void adf_dev_stop_async(struct work_struct *work)/* Re-enable PF2VF interrupts */ adf_enable_pf2vf_interrupts (accel_dev); +adf_vf2pf_notify_restart_complete (accel_dev);kfree (stop_data); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/695 crypto: qat - ensure correct order in VF restarting handler
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Witwicki <[email protected]>
[ Upstream commit cd8d2d74292c199b433ef77762bb1d28a4821784 ]
In the process of sending the ADF_PF2VF_MSGTYPE_RESTARTING message to Virtual Functions (VFs), the Physical Function (PF) should set the vf->restarting flag to true before dispatching the message. This change is necessary to prevent a race condition where the handling of the ADF_VF2PF_MSGTYPE_RESTARTING_COMPLETE message (which sets the vf->restarting flag to false) runs immediately after the message is sent, but before the flag is set to true.
Set the vf->restarting to true before sending the message ADF_PF2VF_MSGTYPE_RESTARTING, if supported by the version of the protocol and if the VF is started.
--- drivers/crypto/intel/qat/qat_common/adf_pfvf_pf_msg.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/crypto/intel/qat/qat_common/adf_pfvf_pf_msg.c +6 -3
@@ -18,14 +18,17 @@ void adf_pf2vf_notify_restarting(struct adf_accel_dev *accel_dev)dev_dbg (&GET_DEV (accel_dev),"pf2vf notify restarting\n" );for (i =0 , vf = accel_dev->pf.vf_info; i < num_vfs; i++, vf++) { - vf->restarting = false; +if (vf->init && vf->vf_compat_ver >=ADF_PFVF_COMPAT_FALLBACK ) + vf->restarting = true; +else + vf->restarting = false; +if (!vf->init)continue ; +if (adf_send_pf2vf_msg (accel_dev, i, msg))dev_err (&GET_DEV (accel_dev),"Failed to send restarting msg to VF%d\n" , i); -else if (vf->vf_compat_ver >=ADF_PFVF_COMPAT_FALLBACK ) - vf->restarting = true; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/695 crypto: iaa - Fix potential use after free bug
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209 ]
The free_device_compression_mode(iaa_device, device_mode) function frees "device_mode" but it iss passed to iaa_compression_modes[i]->free() a few lines later resulting in a use after free.
The good news is that, so far as I can tell, nothing implements the ->free() function and the use after free happens in dead code. But, with this fix, when something does implement it, we'll be ready. :)
--- drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/intel/iaa/iaa_crypto_main.c +2 -2
@@ -495,10 +495,10 @@ static void remove_device_compression_modes(struct iaa_device *iaa_device)if (!device_mode)continue ; -free_device_compression_mode (iaa_device, device_mode); - iaa_device->compression_modes[i] =NULL ;if (iaa_compression_modes[i]->free) iaa_compression_modes[i]->free (device_mode); +free_device_compression_mode (iaa_device, device_mode); + iaa_device->compression_modes[i] =NULL ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/695 ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 07442c46abad1d50ac82af5e0f9c5de2732c4592 ]
In tps68470_pmic_opregion_probe() pointer 'dev' is compared to NULL which is useless.
Fix this issue by removing unneeded check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/pmic/tps68470_pmic.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/acpi/pmic/tps68470_pmic.c +2 -4
@@ -376,10 +376,8 @@ static int tps68470_pmic_opregion_probe(struct platform_device *pdev)struct tps68470_pmic_opregion *opregion;acpi_status status; -if (!dev || !tps68470_regmap) { -dev_warn (dev,"dev or regmap is NULL\n" ); -return -EINVAL ; - } +if (!tps68470_regmap) +return dev_err_probe (dev, -EINVAL ,"regmap is missing\n" );if (!handle) {dev_warn (dev,"acpi handle is NULL\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/695 eth: fbnic: select DEVLINK and PAGE_POOL
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 9a95b7a89dffae5f1e99dd73748f144fec820292 ]
Build bot reports undefined references to devlink functions. And local testing revealed undefined references to page_pool functions.
Based on a patch by Jakub Kicinski <[email protected]>
--- drivers/net/ethernet/meta/Kconfig | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/meta/Kconfig +2 -0
@@ -23,6 +23,8 @@ config FBNIC depends on !S390 depends on MAX_SKB_FRAGS < 22 depends on PCI_MSI + select NET_DEVLINK + select PAGE_POOL select PHYLINK help This driver supports Meta Platforms Host Network Interface.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/695 wifi: brcmfmac: introducing fwil query functions
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arend van Spriel <[email protected]>
[ Upstream commit c6002b6c05f3edfa12fd25990cc637281f200442 ]
When the firmware interface layer was refactored it provided various "get" and "set" functions. For the "get" in some cases a parameter needed to be passed down to firmware as a key indicating what to "get" turning the output parameter of the "get" function into an input parameter as well. To accommodate this the "get" function blindly copies the parameter which in some places resulted in an uninitialized warnings from the compiler. These have been fixed by initializing the input parameter in the past. Recently another batch of similar fixes were submitted to address clang static checker warnings [1].
Proposing another solution by introducing a "query" variant which is used when the (input) parameter is needed by firmware. The "get" variant will only fill the (output) parameter with the result received from firmware taking care of proper endianess conversion.
[1] https://lore.kernel.org/all/[email protected]/
--- .../broadcom/brcm80211/brcmfmac/btcoex.c | 2 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 30 +++++++------- .../broadcom/brcm80211/brcmfmac/core.c | 2 +- .../broadcom/brcm80211/brcmfmac/feature.c | 2 +- .../broadcom/brcm80211/brcmfmac/fwil.h | 40 ++++++++++++++----- 5 files changed, 48 insertions(+), 28 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c +1 -1
@@ -123,7 +123,7 @@ static s32 brcmf_btcoex_params_read(struct brcmf_if *ifp, u32 addr, u32 *data) { *data = addr; -return brcmf_fil_iovar_int_get (ifp,"btc_params" , data); +return brcmf_fil_iovar_int_query (ifp,"btc_params" , data); }/**
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +15 -15
@@ -663,8 +663,8 @@ static int brcmf_cfg80211_request_sta_if(struct brcmf_if *ifp, u8 *macaddr)/* interface_create version 3+ */ /* get supported version from firmware side */ iface_create_ver =0 ; - err =brcmf_fil_bsscfg_int_get (ifp,"interface_create" , - &iface_create_ver); + err =brcmf_fil_bsscfg_int_query (ifp,"interface_create" , + &iface_create_ver);if (err) {brcmf_err ("fail to get supported version, err=%d\n" , err);return -EOPNOTSUPP ;
@@ -756,8 +756,8 @@ static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)/* interface_create version 3+ */ /* get supported version from firmware side */ iface_create_ver =0 ; - err =brcmf_fil_bsscfg_int_get (ifp,"interface_create" , - &iface_create_ver); + err =brcmf_fil_bsscfg_int_query (ifp,"interface_create" , + &iface_create_ver);if (err) {brcmf_err ("fail to get supported version, err=%d\n" , err);return -EOPNOTSUPP ;
@@ -2101,7 +2101,8 @@ brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)if (!sme->crypto.n_akm_suites)return 0 ; - err =brcmf_fil_bsscfg_int_get (netdev_priv (ndev),"wpa_auth" , &val); + err =brcmf_fil_bsscfg_int_get (netdev_priv (ndev), +"wpa_auth" , &val);if (err) {bphy_err (drvr,"could not get wpa_auth (%d)\n" , err);return err;
@@ -2680,7 +2681,7 @@ brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,struct brcmf_cfg80211_info *cfg =wiphy_to_cfg (wiphy);struct brcmf_cfg80211_vif *vif =wdev_to_vif (wdev);struct brcmf_pub *drvr = cfg->pub; -s32 qdbm =0 ; +s32 qdbm;s32 err;brcmf_dbg (TRACE ,"Enter\n" );
@@ -3067,7 +3068,7 @@ brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,struct brcmf_scb_val_le scbval;struct brcmf_pktcnt_le pktcnt;s32 err; -u32 rate =0 ; +u32 rate;u32 rssi;/* Get the current tx rate */
@@ -7046,8 +7047,8 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg, ch.bw =BRCMU_CHAN_BW_20 ; cfg->d11inf.encchspec (&ch); chaninfo = ch.chspec; - err =brcmf_fil_bsscfg_int_get (ifp,"per_chan_info" , - &chaninfo); + err =brcmf_fil_bsscfg_int_query (ifp,"per_chan_info" , + &chaninfo);if (!err) {if (chaninfo &WL_CHAN_RADAR ) channel->flags |=
@@ -7081,7 +7082,7 @@ static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)/* verify support for bw_cap command */ val =WLC_BAND_5G ; - err =brcmf_fil_iovar_int_get (ifp,"bw_cap" , &val); + err =brcmf_fil_iovar_int_query (ifp,"bw_cap" , &val);if (!err) {/* only set 2G bandwidth using bw_cap command */
@@ -7157,11 +7158,11 @@ static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])int err; band =WLC_BAND_2G ; - err =brcmf_fil_iovar_int_get (ifp,"bw_cap" , &band); + err =brcmf_fil_iovar_int_query (ifp,"bw_cap" , &band);if (!err) { bw_cap[NL80211_BAND_2GHZ ] = band; band =WLC_BAND_5G ; - err =brcmf_fil_iovar_int_get (ifp,"bw_cap" , &band); + err =brcmf_fil_iovar_int_query (ifp,"bw_cap" , &band);if (!err) { bw_cap[NL80211_BAND_5GHZ ] = band;return ;
@@ -7170,7 +7171,6 @@ static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])return ; }brcmf_dbg (INFO ,"fallback to mimo_bw_cap info\n" ); - mimo_bwcap =0 ; err =brcmf_fil_iovar_int_get (ifp,"mimo_bw_cap" , &mimo_bwcap);if (err)/* assume 20MHz if firmware does not give a clue */
@@ -7266,10 +7266,10 @@ static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)struct brcmf_pub *drvr = cfg->pub;struct brcmf_if *ifp =brcmf_get_ifp (drvr,0 );struct wiphy *wiphy =cfg_to_wiphy (cfg); -u32 nmode =0 ; +u32 nmode;u32 vhtmode =0 ;u32 bw_cap[2 ] = {WLC_BW_20MHZ_BIT ,WLC_BW_20MHZ_BIT }; -u32 rxchain =0 ; +u32 rxchain;u32 nchain;int err;s32 i;
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +1 -1
@@ -691,7 +691,7 @@ static int brcmf_net_mon_open(struct net_device *ndev) {struct brcmf_if *ifp =netdev_priv (ndev);struct brcmf_pub *drvr = ifp->drvr; -u32 monitor =0 ; +u32 monitor;int err;brcmf_dbg (TRACE ,"Enter\n" );
drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c +1 -1
@@ -184,7 +184,7 @@ static void brcmf_feat_wlc_version_overrides(struct brcmf_pub *drv)static void brcmf_feat_iovar_int_get (struct brcmf_if *ifp,enum brcmf_feat_id id,char *name) { -u32 data =0 ; +u32 data;int err;/* we need to know firmware error */
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h +30 -10
@@ -96,15 +96,22 @@ static inlines32 brcmf_fil_cmd_int_get (struct brcmf_if *ifp,u32 cmd,u32 *data) {s32 err; -__le32 data_le =cpu_to_le32 (*data); - err =brcmf_fil_cmd_data_get (ifp, cmd, &data_le,sizeof (data_le)); + err =brcmf_fil_cmd_data_get (ifp, cmd, data,sizeof (*data));if (err ==0 ) - *data =le32_to_cpu (data_le); + *data =le32_to_cpu (*(__le32 *)data);brcmf_dbg (FIL ,"ifidx=%d, cmd=%d, value=%d\n" , ifp->ifidx, cmd, *data);return err; } +static inline +s32 brcmf_fil_cmd_int_query (struct brcmf_if *ifp,u32 cmd,u32 *data) +{ +__le32 *data_le = (__le32 *)data; + + *data_le =cpu_to_le32 (*data); +return brcmf_fil_cmd_int_get (ifp, cmd, data); +}s32 brcmf_fil_iovar_data_set (struct brcmf_if *ifp,const char *name,const void *data,u32 len);
@@ -120,14 +127,21 @@ s32 brcmf_fil_iovar_int_set(struct brcmf_if *ifp, const char *name, u32 data)static inline s32 brcmf_fil_iovar_int_get (struct brcmf_if *ifp,const char *name,u32 *data) { -__le32 data_le =cpu_to_le32 (*data);s32 err; - err =brcmf_fil_iovar_data_get (ifp, name, &data_le,sizeof (data_le)); + err =brcmf_fil_iovar_data_get (ifp, name, data,sizeof (*data));if (err ==0 ) - *data =le32_to_cpu (data_le); + *data =le32_to_cpu (*(__le32 *)data);return err; } +static inline +s32 brcmf_fil_iovar_int_query (struct brcmf_if *ifp,const char *name,u32 *data) +{ +__le32 *data_le = (__le32 *)data; + + *data_le =cpu_to_le32 (*data); +return brcmf_fil_iovar_int_get (ifp, name, data); +} s32 brcmf_fil_bsscfg_data_set(struct brcmf_if *ifp, const char *name,
@@ -145,15 +159,21 @@ s32 brcmf_fil_bsscfg_int_set(struct brcmf_if *ifp, const char *name, u32 data)static inline s32 brcmf_fil_bsscfg_int_get (struct brcmf_if *ifp,const char *name,u32 *data) { -__le32 data_le =cpu_to_le32 (*data);s32 err; - err =brcmf_fil_bsscfg_data_get (ifp, name, &data_le, -sizeof (data_le)); + err =brcmf_fil_bsscfg_data_get (ifp, name, data,sizeof (*data));if (err ==0 ) - *data =le32_to_cpu (data_le); + *data =le32_to_cpu (*(__le32 *)data);return err; } +static inline +s32 brcmf_fil_bsscfg_int_query (struct brcmf_if *ifp,const char *name,u32 *data) +{ +__le32 *data_le = (__le32 *)data; + + *data_le =cpu_to_le32 (*data); +return brcmf_fil_bsscfg_int_get (ifp, name, data); +}s32 brcmf_fil_xtlv_data_set (struct brcmf_if *ifp,const char *name,u16 id,void *data,u32 len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/695 wifi: ath9k: Remove error checks when creating debugfs entries
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit f6ffe7f0184792c2f99aca6ae5b916683973d7d3 ]
We should not be checking the return values from debugfs creation at all: the debugfs functions are designed to handle errors of previously called functions and just transparently abort the creation of debugfs entries when debugfs is disabled. If we check the return value and abort driver initialisation, we break the driver if debugfs is disabled (such as when booting with debugfs=off).
Earlier versions of ath9k accidentally did the right thing by checking the return value, but only for NULL, not for IS_ERR(). This was "fixed" by the two commits referenced below, breaking ath9k with debugfs=off starting from the 6.6 kernel (as reported in the Bugzilla linked below).
Restore functionality by just getting rid of the return value check entirely.
--- drivers/net/wireless/ath/ath9k/debug.c | 2 -- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 -- 2 files changed, 4 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +0 -2
@@ -1380,8 +1380,6 @@ int ath9k_init_debug(struct ath_hw *ah) sc->debug.debugfs_phy =debugfs_create_dir ("ath9k" , sc->hw->wiphy->debugfsdir); -if (IS_ERR (sc->debug.debugfs_phy)) -return -ENOMEM ;#ifdef CONFIG_ATH_DEBUG debugfs_create_file("debug", 0600, sc->debug.debugfs_phy,
drivers/net/wireless/ath/ath9k/htc_drv_debug.c +0 -2
@@ -486,8 +486,6 @@ int ath9k_htc_init_debug(struct ath_hw *ah) priv->debug.debugfs_phy =debugfs_create_dir (KBUILD_MODNAME , priv->hw->wiphy->debugfsdir); -if (IS_ERR (priv->debug.debugfs_phy)) -return -ENOMEM ;ath9k_cmn_spectral_init_debug (&priv->spec_priv, priv->debug.debugfs_phy);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/695 wifi: ath12k: fix BSS chan info request WMI command
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: P Praneesh <[email protected]>
[ Upstream commit 59529c982f85047650fd473db903b23006a796c6 ]
Currently, the firmware returns incorrect pdev_id information in WMI_PDEV_BSS_CHAN_INFO_EVENTID, leading to incorrect filling of the pdev's survey information.
To prevent this issue, when requesting BSS channel information through WMI_PDEV_BSS_CHAN_INFO_REQUEST_CMDID, firmware expects pdev_id as one of the arguments in this WMI command.
Add pdev_id to the struct wmi_pdev_bss_chan_info_req_cmd and fill it during ath12k_wmi_pdev_bss_chan_info_request(). This resolves the issue of sending the correct pdev_id in WMI_PDEV_BSS_CHAN_INFO_EVENTID.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/wmi.c | 1 + drivers/net/wireless/ath/ath12k/wmi.h | 1 + 2 files changed, 2 insertions(+)
drivers/net/wireless/ath/ath12k/wmi.c +1 -0
@@ -1538,6 +1538,7 @@ int ath12k_wmi_pdev_bss_chan_info_request(struct ath12k *ar, cmd->tlv_header =ath12k_wmi_tlv_cmd_hdr (WMI_TAG_PDEV_BSS_CHAN_INFO_REQUEST ,sizeof (*cmd)); cmd->req_type =cpu_to_le32 (type); + cmd->pdev_id =cpu_to_le32 (ar->pdev->pdev_id);ath12k_dbg (ar->ab,ATH12K_DBG_WMI ,"WMI bss chan info req type %d\n" , type);
drivers/net/wireless/ath/ath12k/wmi.h +1 -0
@@ -3121,6 +3121,7 @@ struct wmi_pdev_bss_chan_info_req_cmd {__le32 tlv_header;/* ref wmi_bss_chan_info_req_type */ __le32 req_type; +__le32 pdev_id; } __packed;struct wmi_ap_ps_peer_cmd {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/695 wifi: ath12k: match WMI BSS chan info structure with firmware definition
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: P Praneesh <[email protected]>
[ Upstream commit dd98d54db29fb553839f43ade5f547baa93392c8 ]
struct wmi_pdev_bss_chan_info_event is not similar to the firmware struct definition, this will cause some random failures.
Fix by matching the struct wmi_pdev_bss_chan_info_event with the firmware structure definition.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/wmi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/wmi.h +1 -1
@@ -4086,7 +4086,6 @@ struct wmi_vdev_stopped_event { } __packed;struct wmi_pdev_bss_chan_info_event { -__le32 pdev_id;__le32 freq;/* Units in MHz */ __le32 noise_floor;/* units are dBm */ /* rx clear - how often the channel was unused */
@@ -4104,6 +4103,7 @@ struct wmi_pdev_bss_chan_info_event {/*rx_cycle cnt for my bss in 64bits format */ __le32 rx_bss_cycle_count_low;__le32 rx_bss_cycle_count_high; +__le32 pdev_id; } __packed;#define WMI_VDEV_INSTALL_KEY_COMPL_STATUS_SUCCESS 0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/695 wifi: ath12k: fix invalid AMPDU factor calculation in ath12k_peer_assoc_h_he()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit a66de2d0f22b1740f3f9777776ad98c4bee62dff ]
Currently ampdu_factor is wrongly calculated in ath12k_peer_assoc_h_he(), fix it.
This is found during code review.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4
--- drivers/net/wireless/ath/ath12k/mac.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath12k/mac.c +2 -3
@@ -2196,9 +2196,8 @@ static void ath12k_peer_assoc_h_he(struct ath12k *ar,* request, then use MAX_AMPDU_LEN_FACTOR as 16 to calculate max_ampdu * length. */ - ampdu_factor = (he_cap->he_cap_elem.mac_cap_info[3 ] & -IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK ) >> -IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK ; + ampdu_factor =u8_get_bits (he_cap->he_cap_elem.mac_cap_info[3 ], +IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK );if (ampdu_factor) {if (sta->deflink.vht_cap.vht_supported)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/695 hwrng: cn10k - Enable by default CN10K driver if Thunder SoC is enabled
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
[ Upstream commit 9d3a7ff2ce1781a77ad6f8896e1256875c17631e ]
Before commit addea5858b66 ("hwrng: Kconfig - Do not enable by default CN10K driver") the Marvell CN10K Random Number Generator was always enabled when HW_RANDOM was enabled.
This was changed with that commit to prevent having this driver being always enabled on arm64. To prevent introducing regression with some old defconfig enable the driver when ARCH_THUNDER is enabled.
--- drivers/char/hw_random/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/char/hw_random/Kconfig +1 -0
@@ -555,6 +555,7 @@ config HW_RANDOM_ARM_SMCCC_TRNG config HW_RANDOM_CN10K tristate "Marvell CN10K Random Number Generator support" depends on HW_RANDOM && PCI && (ARM64 || (64BIT && COMPILE_TEST)) + default HW_RANDOM if ARCH_THUNDER help This driver provides support for the True Random Number generator available in Marvell CN10K SoCs.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/695 crypto: x86/aes-gcm - fix PREEMPT_RT issue in gcm_crypt()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
[ Upstream commit 001412493e74d89166d2441b622eeaea00511bdc ]
On PREEMPT_RT, kfree() takes sleeping locks and must not be called with preemption disabled. Therefore, on PREEMPT_RT skcipher_walk_done() must not be called from within a kernel_fpu_{begin,end}() pair, even when it's the last call which is guaranteed to not allocate memory.
Therefore, move the last skcipher_walk_done() in gcm_crypt() to the end of the function so that it goes after the kernel_fpu_end(). To make this work cleanly, rework the data processing loop to handle only non-last data segments.
--- arch/x86/crypto/aesni-intel_glue.c | 59 ++++++++++++++---------------- 1 file changed, 28 insertions(+), 31 deletions(-)
arch/x86/crypto/aesni-intel_glue.c +28 -31
@@ -1366,6 +1366,8 @@ gcm_crypt(struct aead_request *req, int flags) err =skcipher_walk_aead_encrypt (&walk, req, false); else err =skcipher_walk_aead_decrypt (&walk, req, false); +if (err) +return err;/* * Since the AES-GCM assembly code requires that at least three assembly
@@ -1381,37 +1383,31 @@ gcm_crypt(struct aead_request *req, int flags)gcm_process_assoc (key, ghash_acc, req->src, assoclen, flags);/* En/decrypt the data and pass the ciphertext through GHASH. */ -while ((nbytes = walk.nbytes) !=0 ) { -if (unlikely (nbytes < walk.total)) { -/* -* Non-last segment. In this case, the assembly -* function requires that the length be a multiple of 16 -* (AES_BLOCK_SIZE) bytes. The needed buffering of up -* to 16 bytes is handled by the skcipher_walk. Here we -* just need to round down to a multiple of 16. -*/ - nbytes =round_down (nbytes,AES_BLOCK_SIZE ); -aes_gcm_update (key, le_ctr, ghash_acc, - walk.src.virt.addr, walk.dst.virt.addr, - nbytes, flags); - le_ctr[0 ] += nbytes /AES_BLOCK_SIZE ; -kernel_fpu_end (); - err =skcipher_walk_done (&walk, walk.nbytes - nbytes); -kernel_fpu_begin (); - }else { -/* Last segment: process all remaining data. */ -aes_gcm_update (key, le_ctr, ghash_acc, - walk.src.virt.addr, walk.dst.virt.addr, - nbytes, flags); - err =skcipher_walk_done (&walk,0 ); -/* -* The low word of the counter isn't used by the -* finalize, so there's no need to increment it here. -*/ - } +while (unlikely ((nbytes = walk.nbytes) < walk.total)) { +/* +* Non-last segment. In this case, the assembly function +* requires that the length be a multiple of 16 (AES_BLOCK_SIZE) +* bytes. The needed buffering of up to 16 bytes is handled by +* the skcipher_walk. Here we just need to round down to a +* multiple of 16. +*/ + nbytes =round_down (nbytes,AES_BLOCK_SIZE ); +aes_gcm_update (key, le_ctr, ghash_acc, walk.src.virt.addr, + walk.dst.virt.addr, nbytes, flags); + le_ctr[0 ] += nbytes /AES_BLOCK_SIZE ; +kernel_fpu_end (); + err =skcipher_walk_done (&walk, walk.nbytes - nbytes); +if (err) +return err; +kernel_fpu_begin (); } -if (err) - goto out; +/* Last segment: process all remaining data. */ +aes_gcm_update (key, le_ctr, ghash_acc, walk.src.virt.addr, + walk.dst.virt.addr, nbytes, flags); +/* +* The low word of the counter isn't used by the finalize, so there's no +* need to increment it here. +*/ /* Finalize */ taglen =crypto_aead_authsize (tfm);
@@ -1439,8 +1435,9 @@ gcm_crypt(struct aead_request *req, int flags) datalen, tag, taglen, flags)) err = -EBADMSG ; } -out:kernel_fpu_end (); +if (nbytes) +skcipher_walk_done (&walk,0 );return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/695 net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanteng Si <[email protected]>
[ Upstream commit c70f3163681381c15686bdd2fe56bf4af9b8aaaa ]
Reference and PTP clocks rate of the Loongson GMAC devices is 125MHz. (So is in the GNET devices which support is about to be added.) Set the respective plat_stmmacenet_data field up in accordance with that so to have the coalesce command and timestamping work correctly.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +3 -0
@@ -35,6 +35,9 @@ static int loongson_default_data(struct plat_stmmacenet_data *plat)/* Disable RX queues routing by default */ plat->rx_queues_cfg[0 ].pkt_route =0x0 ; + plat->clk_ref_rate =125000000 ; + plat->clk_ptp_rate =125000000 ; +/* Default to phy auto-detection */ plat->phy_addr =-1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/695 virtio: rename virtio_config_enabled to virtio_config_core_enabled
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
[ Upstream commit 0cb70ee4a6ee6b0a4b0e0f70a64a094c6fe05944 ]
Following patch will allow the config interrupt to be disabled by a specific driver via another boolean. So this patch renames virtio_config_enabled and relevant helpers to virtio_config_core_enabled.
Stable-dep-of: c392d6019398 ("virtio-net: synchronize probe with ndo_set_features")
--- drivers/virtio/virtio.c | 22 +++++++++++----------- include/linux/virtio.h | 4 ++-- 2 files changed, 13 insertions(+), 13 deletions(-)
drivers/virtio/virtio.c +11 -11
@@ -127,7 +127,7 @@ static void __virtio_config_changed(struct virtio_device *dev) {struct virtio_driver *drv =drv_to_virtio (dev->dev.driver); -if (!dev->config_enabled) +if (!dev->config_core_enabled) dev->config_change_pending = true;else if (drv && drv->config_changed) drv->config_changed (dev);
@@ -143,17 +143,17 @@ void virtio_config_changed(struct virtio_device *dev) }EXPORT_SYMBOL_GPL (virtio_config_changed); -static void virtio_config_disable (struct virtio_device *dev) +static void virtio_config_core_disable (struct virtio_device *dev) {spin_lock_irq (&dev->config_lock); - dev->config_enabled = false; + dev->config_core_enabled = false;spin_unlock_irq (&dev->config_lock); } -static void virtio_config_enable (struct virtio_device *dev) +static void virtio_config_core_enable (struct virtio_device *dev) {spin_lock_irq (&dev->config_lock); - dev->config_enabled = true; + dev->config_core_enabled = true;if (dev->config_change_pending)__virtio_config_changed (dev); dev->config_change_pending = false;
@@ -316,7 +316,7 @@ static int virtio_dev_probe(struct device *_d)if (drv->scan) drv->scan (dev); -virtio_config_enable (dev); +virtio_config_core_enable (dev);return 0 ;
@@ -331,7 +331,7 @@ static void virtio_dev_remove(struct device *_d)struct virtio_device *dev =dev_to_virtio (_d);struct virtio_driver *drv =drv_to_virtio (dev->dev.driver); -virtio_config_disable (dev); +virtio_config_core_disable (dev); drv->remove (dev);
@@ -443,7 +443,7 @@ int register_virtio_device(struct virtio_device *dev) goto out_ida_remove;spin_lock_init (&dev->config_lock); - dev->config_enabled = false; + dev->config_core_enabled = false; dev->config_change_pending = false;INIT_LIST_HEAD (&dev->vqs);
@@ -500,14 +500,14 @@ int virtio_device_freeze(struct virtio_device *dev)struct virtio_driver *drv =drv_to_virtio (dev->dev.driver);int ret; -virtio_config_disable (dev); +virtio_config_core_disable (dev); dev->failed = dev->config->get_status (dev) &VIRTIO_CONFIG_S_FAILED ;if (drv && drv->freeze) { ret = drv->freeze (dev);if (ret) { -virtio_config_enable (dev); +virtio_config_core_enable (dev);return ret; } }
@@ -557,7 +557,7 @@ int virtio_device_restore(struct virtio_device *dev)if (!(dev->config->get_status (dev) &VIRTIO_CONFIG_S_DRIVER_OK ))virtio_device_ready (dev); -virtio_config_enable (dev); +virtio_config_core_enable (dev);return 0 ;
include/linux/virtio.h +2 -2
@@ -118,7 +118,7 @@ struct virtio_admin_cmd {* struct virtio_device - representation of a device using virtio * @index: unique position on the virtio bus * @failed: saved value for VIRTIO_CONFIG_S_FAILED bit (for restore) -* @config_enabled: configuration change reporting enabled +* @config_core_enabled: configuration change reporting enabled by core * @config_change_pending: configuration change reported while disabled * @config_lock: protects configuration change reporting * @vqs_list_lock: protects @vqs.
@@ -135,7 +135,7 @@ struct virtio_admin_cmd {struct virtio_device {int index;bool failed; -bool config_enabled; +bool config_core_enabled;bool config_change_pending;spinlock_t config_lock;spinlock_t vqs_list_lock;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/695 virtio: allow driver to disable the configure change notification
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
[ Upstream commit 224de6f886f8184fd448700a6d78f216694de948 ]
Sometime, it would be useful to disable the configure change notification from the driver. So this patch allows this by introducing a variable config_change_driver_disabled and only allow the configure change notification callback to be triggered when it is allowed by both the virtio core and the driver. It is set to false by default to hold the current semantic so we don't need to change any drivers.
The first user for this would be virtio-net.
Stable-dep-of: c392d6019398 ("virtio-net: synchronize probe with ndo_set_features")
--- drivers/virtio/virtio.c | 39 ++++++++++++++++++++++++++++++++++++--- include/linux/virtio.h | 7 +++++++ 2 files changed, 43 insertions(+), 3 deletions(-)
drivers/virtio/virtio.c +36 -3
@@ -127,10 +127,12 @@ static void __virtio_config_changed(struct virtio_device *dev) {struct virtio_driver *drv =drv_to_virtio (dev->dev.driver); -if (!dev->config_core_enabled) +if (!dev->config_core_enabled || dev->config_driver_disabled) dev->config_change_pending = true; -else if (drv && drv->config_changed) +else if (drv && drv->config_changed) { drv->config_changed (dev); + dev->config_change_pending = false; + } }void virtio_config_changed (struct virtio_device *dev)
@@ -143,6 +145,38 @@ void virtio_config_changed(struct virtio_device *dev) }EXPORT_SYMBOL_GPL (virtio_config_changed); +/** +* virtio_config_driver_disable - disable config change reporting by drivers +* @dev: the device to reset +* +* This is only allowed to be called by a driver and disabling can't +* be nested. +*/ +void virtio_config_driver_disable (struct virtio_device *dev) +{ +spin_lock_irq (&dev->config_lock); + dev->config_driver_disabled = true; +spin_unlock_irq (&dev->config_lock); +} +EXPORT_SYMBOL_GPL (virtio_config_driver_disable); + +/** +* virtio_config_driver_enable - enable config change reporting by drivers +* @dev: the device to reset +* +* This is only allowed to be called by a driver and enabling can't +* be nested. +*/ +void virtio_config_driver_enable (struct virtio_device *dev) +{ +spin_lock_irq (&dev->config_lock); + dev->config_driver_disabled = false; +if (dev->config_change_pending) +__virtio_config_changed (dev); +spin_unlock_irq (&dev->config_lock); +} +EXPORT_SYMBOL_GPL (virtio_config_driver_enable); +static void virtio_config_core_disable (struct virtio_device *dev) {spin_lock_irq (&dev->config_lock);
@@ -156,7 +190,6 @@ static void virtio_config_core_enable(struct virtio_device *dev) dev->config_core_enabled = true;if (dev->config_change_pending)__virtio_config_changed (dev); - dev->config_change_pending = false;spin_unlock_irq (&dev->config_lock); }
include/linux/virtio.h +7 -0
@@ -119,6 +119,8 @@ struct virtio_admin_cmd {* @index: unique position on the virtio bus * @failed: saved value for VIRTIO_CONFIG_S_FAILED bit (for restore) * @config_core_enabled: configuration change reporting enabled by core +* @config_driver_disabled: configuration change reporting disabled by +* a driver * @config_change_pending: configuration change reported while disabled * @config_lock: protects configuration change reporting * @vqs_list_lock: protects @vqs.
@@ -136,6 +138,7 @@ struct virtio_device {int index;bool failed;bool config_core_enabled; +bool config_driver_disabled;bool config_change_pending;spinlock_t config_lock;spinlock_t vqs_list_lock;
@@ -166,6 +169,10 @@ void __virtqueue_break(struct virtqueue *_vq);void __virtqueue_unbreak (struct virtqueue *_vq);void virtio_config_changed (struct virtio_device *dev); + +void virtio_config_driver_disable (struct virtio_device *dev); +void virtio_config_driver_enable (struct virtio_device *dev); +#ifdef CONFIG_PM_SLEEP int virtio_device_freeze (struct virtio_device *dev);int virtio_device_restore (struct virtio_device *dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/695 virtio-net: synchronize operstate with admin state on up/down
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
[ Upstream commit df28de7b00502761eba62490f413c65c9b175ed9 ]
This patch synchronizes operstate with admin state per RFC2863.
This is done by trying to toggle the carrier upon open/close and synchronize with the config change work. This allows to propagate status correctly to stacked devices like:
ip link add link enp0s3 macvlan0 type macvlan
ip link set link enp0s3 down
ip link show
Before this patch:
3: enp0s3: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
link/ether 00:00:05:00:00:09 brd ff:ff:ff:ff:ff:ff
......
5: macvlan0@enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether b2:a9:c5:04:da:53 brd ff:ff:ff:ff:ff:ffAfter this patch:
3: enp0s3: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
link/ether 00:00:05:00:00:09 brd ff:ff:ff:ff:ff:ff
...
5: macvlan0@enp0s3: <NO-CARRIER,BROADCAST,MULTICAST,UP,M-DOWN> mtu 1500 qdisc noqueue state LOWERLAYERDOWN mode DEFAULT group default qlen 1000
link/ether b2:a9:c5:04:da:53 brd ff:ff:ff:ff:ff:ffStable-dep-of: c392d6019398 ("virtio-net: synchronize probe with ndo_set_features")
--- drivers/net/virtio_net.c | 78 +++++++++++++++++++++++++--------------- 1 file changed, 50 insertions(+), 28 deletions(-)
drivers/net/virtio_net.c +50 -28
@@ -2884,6 +2884,25 @@ static void virtnet_cancel_dim(struct virtnet_info *vi, struct dim *dim)net_dim_work_cancel (dim); } +static void virtnet_update_settings (struct virtnet_info *vi) +{ +u32 speed; +u8 duplex; + +if (!virtio_has_feature (vi->vdev,VIRTIO_NET_F_SPEED_DUPLEX )) +return ; + + virtio_cread_le(vi->vdev, struct virtio_net_config, speed, &speed); + +if (ethtool_validate_speed (speed)) + vi->speed = speed; + + virtio_cread_le(vi->vdev, struct virtio_net_config, duplex, &duplex); + +if (ethtool_validate_duplex (duplex)) + vi->duplex = duplex; +} +static int virtnet_open (struct net_device *dev) {struct virtnet_info *vi =netdev_priv (dev);
@@ -2902,6 +2921,15 @@ static int virtnet_open(struct net_device *dev) goto err_enable_qp; } +if (virtio_has_feature (vi->vdev,VIRTIO_NET_F_STATUS )) { +if (vi->status &VIRTIO_NET_S_LINK_UP ) +netif_carrier_on (vi->dev); +virtio_config_driver_enable (vi->vdev); + }else { + vi->status =VIRTIO_NET_S_LINK_UP ; +netif_carrier_on (dev); + } +return 0 ; err_enable_qp:
@@ -3380,12 +3408,22 @@ static int virtnet_close(struct net_device *dev)disable_delayed_refill (vi);/* Make sure refill_work doesn't re-enable napi! */ cancel_delayed_work_sync (&vi->refill); +/* Prevent the config change callback from changing carrier +* after close +*/ +virtio_config_driver_disable (vi->vdev); +/* Stop getting status/speed updates: we don't care until next +* open +*/ +cancel_work_sync (&vi->config_work);for (i =0 ; i < vi->max_queue_pairs; i++) {virtnet_disable_queue_pair (vi, i);virtnet_cancel_dim (vi, &vi->rq[i].dim); } +netif_carrier_off (dev); +return 0 ; }
@@ -5094,25 +5132,6 @@ static void virtnet_init_settings(struct net_device *dev) vi->duplex =DUPLEX_UNKNOWN ; } -static void virtnet_update_settings (struct virtnet_info *vi) -{ -u32 speed; -u8 duplex; - -if (!virtio_has_feature (vi->vdev,VIRTIO_NET_F_SPEED_DUPLEX )) -return ; - - virtio_cread_le(vi->vdev, struct virtio_net_config, speed, &speed); - -if (ethtool_validate_speed (speed)) - vi->speed = speed; - - virtio_cread_le(vi->vdev, struct virtio_net_config, duplex, &duplex); - -if (ethtool_validate_duplex (duplex)) - vi->duplex = duplex; -} -static u32 virtnet_get_rxfh_key_size (struct net_device *dev) {return ((struct virtnet_info *)netdev_priv (dev))->rss_key_size;
@@ -6521,6 +6540,9 @@ static int virtnet_probe(struct virtio_device *vdev) goto free_failover; } +/* Disable config change notification until ndo_open. */ +virtio_config_driver_disable (vi->vdev); +virtio_device_ready (vdev);virtnet_set_queues (vi, vi->curr_queue_pairs);
@@ -6570,25 +6592,25 @@ static int virtnet_probe(struct virtio_device *vdev) vi->device_stats_cap =le64_to_cpu (v); } -rtnl_unlock (); - - err =virtnet_cpu_notif_add (vi); -if (err) { -pr_debug ("virtio_net: registering cpu notifier failed\n" ); - goto free_unregister_netdev; - } -/* Assume link up if device can't report link status, otherwise get link status from config. */ netif_carrier_off (dev);if (virtio_has_feature (vi->vdev,VIRTIO_NET_F_STATUS )) { -schedule_work (&vi->config_work); +virtnet_config_changed_work (&vi->config_work); }else { vi->status =VIRTIO_NET_S_LINK_UP ;virtnet_update_settings (vi);netif_carrier_on (dev); } +rtnl_unlock (); + + err =virtnet_cpu_notif_add (vi); +if (err) { +pr_debug ("virtio_net: registering cpu notifier failed\n" ); + goto free_unregister_netdev; + } +for (i =0 ; i <ARRAY_SIZE (guest_offloads); i++)if (virtio_has_feature (vi->vdev, guest_offloads[i]))set_bit (guest_offloads[i], &vi->guest_offloads);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/695 virtio-net: synchronize probe with ndo_set_features
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
[ Upstream commit c392d6019398315526b0b508282f87c7b2318c72 ]
We calculate guest offloads during probe without the protection of rtnl_lock. This lead to race between probe and ndo_set_features. Fix this by moving the calculation under the rtnl_lock.
--- drivers/net/virtio_net.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/virtio_net.c +5 -5
@@ -6603,6 +6603,11 @@ static int virtnet_probe(struct virtio_device *vdev)netif_carrier_on (dev); } +for (i =0 ; i <ARRAY_SIZE (guest_offloads); i++) +if (virtio_has_feature (vi->vdev, guest_offloads[i])) +set_bit (guest_offloads[i], &vi->guest_offloads); + vi->guest_offloads_capable = vi->guest_offloads; +rtnl_unlock (); err =virtnet_cpu_notif_add (vi);
@@ -6611,11 +6616,6 @@ static int virtnet_probe(struct virtio_device *vdev) goto free_unregister_netdev; } -for (i =0 ; i <ARRAY_SIZE (guest_offloads); i++) -if (virtio_has_feature (vi->vdev, guest_offloads[i])) -set_bit (guest_offloads[i], &vi->guest_offloads); - vi->guest_offloads_capable = vi->guest_offloads; -pr_debug ("virtnet: registered device %s with %d RX and TX vq's\n" , dev->name, max_queue_pairs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/695 arm64: signal: Fix some under-bracketed UAPI macros
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Martin <[email protected]>
[ Upstream commit fc2220c9b15828319b09384e68399b4afc6276d9 ]
A few SME-related sigcontext UAPI macros leave an argument unprotected from misparsing during macro expansion.
Add parentheses around references to macro arguments where appropriate.
--- arch/arm64/include/uapi/asm/sigcontext.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/include/uapi/asm/sigcontext.h +3 -3
@@ -320,10 +320,10 @@ struct zt_context { ((sizeof (struct za_context ) + (__SVE_VQ_BYTES -1 )) \ / __SVE_VQ_BYTES * __SVE_VQ_BYTES) -#define ZA_SIG_REGS_SIZE (vq) ((vq * __SVE_VQ_BYTES) * (vq * __SVE_VQ_BYTES)) +#define ZA_SIG_REGS_SIZE (vq) (((vq) * __SVE_VQ_BYTES) * ((vq) * __SVE_VQ_BYTES))#define ZA_SIG_ZAV_OFFSET (vq, n) (ZA_SIG_REGS_OFFSET + \ - (SVE_SIG_ZREG_SIZE(vq) * n)) + (SVE_SIG_ZREG_SIZE(vq) * (n)))#define ZA_SIG_CONTEXT_SIZE (vq) \ (ZA_SIG_REGS_OFFSET + ZA_SIG_REGS_SIZE(vq))
@@ -334,7 +334,7 @@ struct zt_context {#define ZT_SIG_REGS_OFFSET sizeof(struct zt_context) -#define ZT_SIG_REGS_SIZE (n) (ZT_SIG_REG_BYTES * n) +#define ZT_SIG_REGS_SIZE (n) (ZT_SIG_REG_BYTES * (n))#define ZT_SIG_CONTEXT_SIZE (n) \ (sizeof(struct zt_context) + ZT_SIG_REGS_SIZE(n))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/695 wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit 56310ddb50b190b3390fdc974aec455d0a516bd2 ]
The handler of firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM isn't implemented, but driver expects number of handlers is NUM_OF_RTW89_MAC_C2H_FUNC_WOW causing out-of-bounds access. Fix it by removing ID.
Addresses-Coverity-ID: 1598775 ("Out-of-bounds read")
--- drivers/net/wireless/realtek/rtw89/mac.h | 1 - 1 file changed, 1 deletion(-)
drivers/net/wireless/realtek/rtw89/mac.h +0 -1
@@ -421,7 +421,6 @@ enum rtw89_mac_c2h_mrc_func {enum rtw89_mac_c2h_wow_func {RTW89_MAC_C2H_FUNC_AOAC_REPORT , -RTW89_MAC_C2H_FUNC_READ_WOW_CAM ,NUM_OF_RTW89_MAC_C2H_FUNC_WOW , };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/695 wifi: rtw88: remove CPT execution branch never used
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
[ Upstream commit 77c977327dfaa9ae2e154964cdb89ceb5c7b7cf1 ]
In 'rtw_coex_action_bt_a2dp_pan', 'wl_cpt_test' and 'bt_cpt_test' are hardcoded to false, so corresponding 'table_case' and 'tdma_case' assignments are never met.
Also 'rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[1])' is never executed. Assuming that CPT was never fully implemented, remove lookalike leftovers. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/realtek/rtw88/coex.c | 38 ++++++----------------- 1 file changed, 10 insertions(+), 28 deletions(-)
drivers/net/wireless/realtek/rtw88/coex.c +10 -28
@@ -2194,7 +2194,6 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)struct rtw_coex_stat *coex_stat = &coex->stat;struct rtw_efuse *efuse = &rtwdev->efuse;u8 table_case, tdma_case; -bool wl_cpt_test = false, bt_cpt_test = false;rtw_dbg (rtwdev,RTW_DBG_COEX ,"[BTCoex], %s()\n" , __func__);
@@ -2202,29 +2201,16 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]);if (efuse->share_ant) {/* Shared-Ant */ -if (wl_cpt_test) { -if (coex_stat->wl_gl_busy) { - table_case =20 ; - tdma_case =17 ; - }else { - table_case =10 ; - tdma_case =15 ; - } - }else if (bt_cpt_test) { - table_case =26 ; - tdma_case =26 ; - }else { -if (coex_stat->wl_gl_busy && - coex_stat->wl_noisy_level ==0 ) - table_case =14 ; -else - table_case =10 ; +if (coex_stat->wl_gl_busy && + coex_stat->wl_noisy_level ==0 ) + table_case =14 ; +else + table_case =10 ; -if (coex_stat->wl_gl_busy) - tdma_case =15 ; -else - tdma_case =20 ; - } +if (coex_stat->wl_gl_busy) + tdma_case =15 ; +else + tdma_case =20 ; }else {/* Non-Shared-Ant */ table_case =112 ;
@@ -2235,11 +2221,7 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev) tdma_case =120 ; } -if (wl_cpt_test) -rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[1 ]); -else -rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]); - +rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]);rtw_coex_table (rtwdev, false, table_case);rtw_coex_tdma (rtwdev, false, tdma_case); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/695 RISC-V: KVM: Fix sbiret init before forwarding to userspace
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Jones <[email protected]>
[ Upstream commit 6b7b282e6baea06ba65b55ae7d38326ceb79cebf ]
When forwarding SBI calls to userspace ensure sbiret.error is initialized to SBI_ERR_NOT_SUPPORTED first, in case userspace neglects to set it to anything. If userspace neglects it then we can't be sure it did anything else either, so we just report it didn't do or try anything. Just init sbiret.value to zero, which is the preferred value to return when nothing special is specified.
KVM was already initializing both sbiret.error and sbiret.value, but the values used appear to come from a copy+paste of the __sbi_ecall() implementation, i.e. a0 and a1, which don't apply prior to the call being executed, nor at all when forwarding to userspace.
--- arch/riscv/kvm/vcpu_sbi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/kvm/vcpu_sbi.c +2 -2
@@ -127,8 +127,8 @@ void kvm_riscv_vcpu_sbi_forward(struct kvm_vcpu *vcpu, struct kvm_run *run) run->riscv_sbi.args[3 ] = cp->a3; run->riscv_sbi.args[4 ] = cp->a4; run->riscv_sbi.args[5 ] = cp->a5; - run->riscv_sbi.ret[0 ] = cp->a0; - run->riscv_sbi.ret[1 ] = cp->a1; + run->riscv_sbi.ret[0 ] =SBI_ERR_NOT_SUPPORTED ; + run->riscv_sbi.ret[1 ] =0 ; } void kvm_riscv_vcpu_sbi_system_reset(struct kvm_vcpu *vcpu,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/695 RISC-V: KVM: Dont zero-out PMU snapshot area before freeing data
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Patel <[email protected]>
[ Upstream commit 47d40d93292d9cff8dabb735bed83d930fa03950 ]
With the latest Linux-6.11-rc3, the below NULL pointer crash is observed when SBI PMU snapshot is enabled for the guest and the guest is forcefully powered-off.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000508 Oops [#1] Modules linked in: kvm CPU: 0 UID: 0 PID: 61 Comm: term-poll Not tainted 6.11.0-rc3-00018-g44d7178dd77a #3 Hardware name: riscv-virtio,qemu (DT) epc : __kvm_write_guest_page+0x94/0xa6 [kvm] ra : __kvm_write_guest_page+0x54/0xa6 [kvm] epc : ffffffff01590e98 ra : ffffffff01590e58 sp : ffff8f80001f39b0 gp : ffffffff81512a60 tp : ffffaf80024872c0 t0 : ffffaf800247e000 t1 : 00000000000007e0 t2 : 0000000000000000 s0 : ffff8f80001f39f0 s1 : 00007fff89ac4000 a0 : ffffffff015dd7e8 a1 : 0000000000000086 a2 : 0000000000000000 a3 : ffffaf8000000000 a4 : ffffaf80024882c0 a5 : 0000000000000000 a6 : ffffaf800328d780 a7 : 00000000000001cc s2 : ffffaf800197bd00 s3 : 00000000000828c4 s4 : ffffaf800248c000 s5 : ffffaf800247d000 s6 : 0000000000001000 s7 : 0000000000001000 s8 : 0000000000000000 s9 : 00007fff861fd500 s10: 0000000000000001 s11: 0000000000800000 t3 : 00000000000004d3 t4 : 00000000000004d3 t5 : ffffffff814126e0 t6 : ffffffff81412700 status: 0000000200000120 badaddr: 0000000000000508 cause: 000000000000000d [<ffffffff01590e98>] __kvm_write_guest_page+0x94/0xa6 [kvm] [<ffffffff015943a6>] kvm_vcpu_write_guest+0x56/0x90 [kvm] [<ffffffff015a175c>] kvm_pmu_clear_snapshot_area+0x42/0x7e [kvm] [<ffffffff015a1972>] kvm_riscv_vcpu_pmu_deinit.part.0+0xe0/0x14e [kvm] [<ffffffff015a2ad0>] kvm_riscv_vcpu_pmu_deinit+0x1a/0x24 [kvm] [<ffffffff0159b344>] kvm_arch_vcpu_destroy+0x28/0x4c [kvm] [<ffffffff0158e420>] kvm_destroy_vcpus+0x5a/0xda [kvm] [<ffffffff0159930c>] kvm_arch_destroy_vm+0x14/0x28 [kvm] [<ffffffff01593260>] kvm_destroy_vm+0x168/0x2a0 [kvm] [<ffffffff015933d4>] kvm_put_kvm+0x3c/0x58 [kvm] [<ffffffff01593412>] kvm_vm_release+0x22/0x2e [kvm]
Clearly, the kvm_vcpu_write_guest() function is crashing because it is being called from kvm_pmu_clear_snapshot_area() upon guest tear down.
To address the above issue, simplify the kvm_pmu_clear_snapshot_area() to not zero-out PMU snapshot area from kvm_pmu_clear_snapshot_area() because the guest is anyway being tore down.
The kvm_pmu_clear_snapshot_area() is also called when guest changes PMU snapshot area of a VCPU but even in this case the previous PMU snaphsot area must not be zeroed-out because the guest might have reclaimed the pervious PMU snapshot area for some other purpose.
--- arch/riscv/kvm/vcpu_pmu.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
arch/riscv/kvm/vcpu_pmu.c +2 -12
@@ -391,19 +391,9 @@ int kvm_riscv_vcpu_pmu_read_hpm(struct kvm_vcpu *vcpu, unsigned int csr_num,static void kvm_pmu_clear_snapshot_area (struct kvm_vcpu *vcpu) {struct kvm_pmu *kvpmu =vcpu_to_pmu (vcpu); -int snapshot_area_size =sizeof (struct riscv_pmu_snapshot_data ); -if (kvpmu->sdata) { -if (kvpmu->snapshot_addr !=INVALID_GPA ) { -memset (kvpmu->sdata,0 , snapshot_area_size); -kvm_vcpu_write_guest (vcpu, kvpmu->snapshot_addr, - kvpmu->sdata, snapshot_area_size); - }else { -pr_warn ("snapshot address invalid\n" ); - } -kfree (kvpmu->sdata); - kvpmu->sdata =NULL ; - } +kfree (kvpmu->sdata); + kvpmu->sdata =NULL ; kvpmu->snapshot_addr =INVALID_GPA ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/695 RISC-V: KVM: Allow legacy PMU access from guest
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <[email protected]>
[ Upstream commit 7d1ffc8b087e97dbe1985912c7a2d00e53cea169 ]
Currently, KVM traps & emulates PMU counter access only if SBI PMU is available as the guest can only configure/read PMU counters via SBI only. However, if SBI PMU is not enabled in the host, the guest will fallback to the legacy PMU which will try to access cycle/instret and result in an illegal instruction trap which is not desired.
KVM can allow dummy emulation of cycle/instret only for the guest if SBI PMU is not enabled in the host. The dummy emulation will still return zero as we don't to expose the host counter values from a guest using legacy PMU.
--- arch/riscv/include/asm/kvm_vcpu_pmu.h | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
arch/riscv/include/asm/kvm_vcpu_pmu.h +14 -1
@@ -10,6 +10,7 @@#define __KVM_VCPU_RISCV_PMU_H#include <linux/perf/riscv_pmu.h> +#include <asm/kvm_vcpu_insn.h> #include <asm/sbi.h> #ifdef CONFIG_RISCV_PMU_SBI
@@ -104,8 +105,20 @@ void kvm_riscv_vcpu_pmu_reset(struct kvm_vcpu *vcpu);struct kvm_pmu { }; +static inline int kvm_riscv_vcpu_pmu_read_legacy (struct kvm_vcpu *vcpu,unsigned int csr_num, +unsigned long *val,unsigned long new_val, +unsigned long wr_mask) +{ +if (csr_num ==CSR_CYCLE || csr_num ==CSR_INSTRET ) { + *val =0 ; +return KVM_INSN_CONTINUE_NEXT_SEPC ; + }else { +return KVM_INSN_ILLEGAL_TRAP ; + } +} +#define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \ -{.base = 0, .count = 0, .func = NULL }, +{.base = CSR_CYCLE, .count = 3, .func = kvm_riscv_vcpu_pmu_read_legacy },static inline void kvm_riscv_vcpu_pmu_init (struct kvm_vcpu *vcpu) {}static inline int kvm_riscv_vcpu_pmu_incr_fw (struct kvm_vcpu *vcpu,unsigned long fid)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/695 RISC-V: KVM: Fix to allow hpmcounter31 from the guest
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <[email protected]>
[ Upstream commit 5aa09297a3dcc798d038bd7436f8c90f664045a6 ]
The csr_fun defines a count parameter which defines the total number CSRs emulated in KVM starting from the base. This value should be equal to total number of counters possible for trap/emulation (32).
--- arch/riscv/include/asm/kvm_vcpu_pmu.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/riscv/include/asm/kvm_vcpu_pmu.h +3 -3
@@ -65,11 +65,11 @@ struct kvm_pmu {#if defined(CONFIG_32BIT )#define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \ -{.base = CSR_CYCLEH, .count = 31, .func = kvm_riscv_vcpu_pmu_read_hpm }, \ -{.base = CSR_CYCLE, .count = 31, .func = kvm_riscv_vcpu_pmu_read_hpm }, +{.base = CSR_CYCLEH, .count = 32, .func = kvm_riscv_vcpu_pmu_read_hpm }, \ +{.base = CSR_CYCLE, .count = 32, .func = kvm_riscv_vcpu_pmu_read_hpm },#else #define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \ -{.base = CSR_CYCLE, .count = 31, .func = kvm_riscv_vcpu_pmu_read_hpm }, +{.base = CSR_CYCLE, .count = 32, .func = kvm_riscv_vcpu_pmu_read_hpm },#endif int kvm_riscv_vcpu_pmu_incr_fw (struct kvm_vcpu *vcpu,unsigned long fid);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/695 mount: handle OOM on mnt_warn_timestamp_expiry
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olaf Hering <[email protected]>
[ Upstream commit 4bcda1eaf184e308f07f9c61d3a535f9ce477ce8 ]
If no page could be allocated, an error pointer was used as format string in pr_warn.
Rearrange the code to return early in case of OOM. Also add a check for the return value of d_path.
--- fs/namespace.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/namespace.c +11 -3
@@ -2921,8 +2921,15 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *if (!__mnt_is_readonly (mnt) && (!(sb->s_iflags &SB_I_TS_EXPIRY_WARNED )) && (ktime_get_real_seconds () +TIME_UPTIME_SEC_MAX > sb->s_time_max)) { -char *buf = (char *)__get_free_page (GFP_KERNEL ); -char *mntpath = buf ?d_path (mountpoint, buf,PAGE_SIZE ) :ERR_PTR (-ENOMEM ); +char *buf, *mntpath; + + buf = (char *)__get_free_page (GFP_KERNEL ); +if (buf) + mntpath =d_path (mountpoint, buf,PAGE_SIZE ); +else + mntpath =ERR_PTR (-ENOMEM ); +if (IS_ERR (mntpath)) + mntpath ="(unknown)" ; pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n", sb->s_type->name,
@@ -2930,8 +2937,9 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount * mntpath, &sb->s_time_max, (unsigned long long)sb->s_time_max); -free_page ((unsigned long )buf); sb->s_iflags |=SB_I_TS_EXPIRY_WARNED ; +if (buf) +free_page ((unsigned long )buf); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/695 autofs: fix missing fput for FSCONFIG_SET_FD
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Sarai <[email protected]>
[ Upstream commit 6a64c5220c5df235448b846aeff3c0660d4cc83e ]
If you pass an fd using FSCONFIG_SET_FD, autofs_parse_fd() "steals" the param->file and so the fs_context infrastructure will not do fput() for us.
--- fs/autofs/inode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/autofs/inode.c +1 -2
@@ -172,8 +172,7 @@ static int autofs_parse_fd(struct fs_context *fc, struct autofs_sb_info *sbi, ret =autofs_check_pipe (pipe);if (ret <0 ) {errorf (fc,"Invalid/unusable pipe" ); -if (param->type != fs_value_is_file) -fput (pipe); +fput (pipe);return -EBADF ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/695 netfilter: nf_tables: store new sets in dedicated list
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit c1aa38866b9c58dc6cf7a5fc6a3e1ca75565169e ]
nft_set_lookup_byid() is very slow when transaction becomes large, due to walk of the transaction list.
Add a dedicated list that contains only the new sets.
Before: nft -f ruleset 0.07s user 0.00s system 0% cpu 1:04.84 total
After: nft -f ruleset 0.07s user 0.00s system 0% cpu 30.115 total
.. where ruleset contains ~10 sets with ~100k elements. The above number is for a combined flush+reload of the ruleset.
With previous flush, even the first NEWELEM has to walk through a few hundred thousands of DELSET(ELEM) transactions before the first NEWSET object. To cope with random-order-newset-newsetelem we'd need to replace commit_set_list with a hashtable.
Expectation is that a NEWELEM operation refers to the most recently added set, so last entry of the dedicated list should be the set we want.
NB: This is not a bug fix per se (functionality is fine), but with larger transaction batches list search takes forever, so it would be nice to speed this up for -stable too, hence adding a "fixes" tag.
--- include/net/netfilter/nf_tables.h | 2 ++ net/netfilter/nf_tables_api.c | 29 ++++++++++++++++++++--------- 2 files changed, 22 insertions(+), 9 deletions(-)
include/net/netfilter/nf_tables.h +2 -0
@@ -1674,6 +1674,7 @@ struct nft_trans_rule {struct nft_trans_set {struct nft_trans_binding nft_trans_binding; +struct list_head list_trans_newset;struct nft_set *set;u32 set_id;u32 gc_int;
@@ -1875,6 +1876,7 @@ static inline int nft_request_module(struct net *net, const char *fmt, ...) { restruct nftables_pernet {struct list_head tables;struct list_head commit_list; +struct list_head commit_set_list;struct list_head binding_list;struct list_head module_list;struct list_head notify_list;
net/netfilter/nf_tables_api.c +20 -9
@@ -393,6 +393,7 @@ static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *tr {struct nftables_pernet *nft_net =nft_pernet (net);struct nft_trans_binding *binding; +struct nft_trans_set *trans_set;list_add_tail (&trans->list, &nft_net->commit_list);
@@ -402,9 +403,13 @@ static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trswitch (trans->msg_type) {case NFT_MSG_NEWSET : + trans_set =nft_trans_container_set (trans); +if (!nft_trans_set_update (trans) &&nft_set_is_anonymous (nft_trans_set (trans)))list_add_tail (&binding->binding_list, &nft_net->binding_list); + +list_add_tail (&trans_set->list_trans_newset, &nft_net->commit_set_list);break ;case NFT_MSG_NEWCHAIN : if (!nft_trans_chain_update(trans) &&
@@ -611,6 +616,7 @@ static int __nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, trans_set =nft_trans_container_set (trans);INIT_LIST_HEAD (&trans_set->nft_trans_binding.binding_list); +INIT_LIST_HEAD (&trans_set->list_trans_newset);if (msg_type ==NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID ] && !desc) { nft_trans_set_id(trans) =
@@ -4485,17 +4491,16 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, {struct nftables_pernet *nft_net =nft_pernet (net);u32 id =ntohl (nla_get_be32 (nla)); -struct nft_trans *trans; +struct nft_trans_set *trans; -list_for_each_entry (trans, &nft_net->commit_list, list) { -if (trans->msg_type ==NFT_MSG_NEWSET ) { -struct nft_set *set =nft_trans_set (trans); +/* its likely the id we need is at the tail, not at start */ +list_for_each_entry_reverse (trans, &nft_net->commit_set_list, list_trans_newset) { +struct nft_set *set = trans->set; -if (id ==nft_trans_set_id (trans) && - set->table == table && -nft_active_genmask (set, genmask)) -return set; - } +if (id == trans->set_id && + set->table == table && +nft_active_genmask (set, genmask)) +return set; }return ERR_PTR (-ENOENT ); }
@@ -10447,6 +10452,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)nft_flow_rule_destroy (nft_trans_flow_rule (trans));break ;case NFT_MSG_NEWSET : +list_del (&nft_trans_container_set (trans)->list_trans_newset);if (nft_trans_set_update (trans)) {struct nft_set *set =nft_trans_set (trans);
@@ -10755,6 +10761,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)nft_trans_destroy (trans);break ;case NFT_MSG_NEWSET : +list_del (&nft_trans_container_set (trans)->list_trans_newset);if (nft_trans_set_update (trans)) {nft_trans_destroy (trans);break ;
@@ -10850,6 +10857,8 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) } } +WARN_ON_ONCE (!list_empty (&nft_net->commit_set_list)); +nft_set_abort_update (&set_update_list);synchronize_rcu ();
@@ -11519,6 +11528,7 @@ static int __net_init nf_tables_init_net(struct net *net)INIT_LIST_HEAD (&nft_net->tables);INIT_LIST_HEAD (&nft_net->commit_list); +INIT_LIST_HEAD (&nft_net->commit_set_list);INIT_LIST_HEAD (&nft_net->binding_list);INIT_LIST_HEAD (&nft_net->module_list);INIT_LIST_HEAD (&nft_net->notify_list);
@@ -11549,6 +11559,7 @@ static void __net_exit nf_tables_exit_net(struct net *net) gc_seq =nft_gc_seq_begin (nft_net);WARN_ON_ONCE (!list_empty (&nft_net->commit_list)); +WARN_ON_ONCE (!list_empty (&nft_net->commit_set_list));if (!list_empty (&nft_net->module_list))nf_tables_module_autoload_cleanup (net);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/695 ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Calvin Owens <[email protected]>
[ Upstream commit 89a906dfa8c3b21b3e5360f73c49234ac1eb885b ]
Floating point instructions in userspace can crash some arm kernels built with clang/LLD 17.0.6:
BUG: unsupported FP instruction in kernel mode
FPEXC == 0xc0000780
Internal error: Oops - undefined instruction: 0 [#1] ARM
CPU: 0 PID: 196 Comm: vfp-reproducer Not tainted 6.10.0 #1
Hardware name: BCM2835
PC is at vfp_support_entry+0xc8/0x2cc
LR is at do_undefinstr+0xa8/0x250
pc : [<c0101d50>] lr : [<c010a80c>] psr: a0000013
sp : dc8d1f68 ip : 60000013 fp : bedea19c
r10: ec532b17 r9 : 00000010 r8 : 0044766c
r7 : c0000780 r6 : ec532b17 r5 : c1c13800 r4 : dc8d1fb0
r3 : c10072c4 r2 : c0101c88 r1 : ec532b17 r0 : 0044766c
Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 00c5387d Table: 0251c008 DAC: 00000051
Register r0 information: non-paged memory
Register r1 information: vmalloc memory
Register r2 information: non-slab/vmalloc memory
Register r3 information: non-slab/vmalloc memory
Register r4 information: 2-page vmalloc region
Register r5 information: slab kmalloc-cg-2k
Register r6 information: vmalloc memory
Register r7 information: non-slab/vmalloc memory
Register r8 information: non-paged memory
Register r9 information: zero-size pointer
Register r10 information: vmalloc memory
Register r11 information: non-paged memory
Register r12 information: non-paged memory
Process vfp-reproducer (pid: 196, stack limit = 0x61aaaf8b)
Stack: (0xdc8d1f68 to 0xdc8d2000)
1f60: 0000081f b6f69300 0000000f c10073f4 c10072c4 dc8d1fb0
1f80: ec532b17 0c532b17 0044766c b6f9ccd8 00000000 c010a80c 00447670 60000010
1fa0: ffffffff c1c13800 00c5387d c0100f10 b6f68af8 00448fc0 00000000 bedea188
1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c
1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff 00000000 00000000
Call trace:
[<c0101d50>] (vfp_support_entry) from [<c010a80c>] (do_undefinstr+0xa8/0x250)
[<c010a80c>] (do_undefinstr) from [<c0100f10>] (__und_usr+0x70/0x80)
Exception stack(0xdc8d1fb0 to 0xdc8d1ff8)
1fa0: b6f68af8 00448fc0 00000000 bedea188
1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c
1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff
Code: 0a000061 e3877202 e594003c e3a09010 (eef16a10)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Fatal exception in interrupt
---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---This is a minimal userspace reproducer on a Raspberry Pi Zero W:
#include <stdio.h>
#include <math.h>
int main(void)
{
double v = 1.0;
printf("%fn", NAN + *(volatile double *)&v);
return 0;
}Another way to consistently trigger the oops is:
calvin@raspberry-pi-zero-w ~$ python -c "import json"
The bug reproduces only when the kernel is built with DYNAMIC_DEBUG=n, because the pr_debug() calls act as barriers even when not activated.
This is the output from the same kernel source built with the same compiler and DYNAMIC_DEBUG=y, where the userspace reproducer works as expected:
VFP: bounce: trigger ec532b17 fpexc c0000780
VFP: emulate: INST=0xee377b06 SCR=0x00000000
VFP: bounce: trigger eef1fa10 fpexc c0000780
VFP: emulate: INST=0xeeb40b40 SCR=0x00000000
VFP: raising exceptions 30000000
calvin@raspberry-pi-zero-w ~$ ./vfp-reproducer
nanCrudely grepping for vmsr/vmrs instructions in the otherwise nearly idential text for vfp_support_entry() makes the problem obvious:
vmlinux.llvm.good [0xc0101cb8] <+48>: vmrs r7, fpexc
vmlinux.llvm.good [0xc0101cd8] <+80>: vmsr fpexc, r0
vmlinux.llvm.good [0xc0101d20] <+152>: vmsr fpexc, r7
vmlinux.llvm.good [0xc0101d38] <+176>: vmrs r4, fpexc
vmlinux.llvm.good [0xc0101d6c] <+228>: vmrs r0, fpscr
vmlinux.llvm.good [0xc0101dc4] <+316>: vmsr fpexc, r0
vmlinux.llvm.good [0xc0101dc8] <+320>: vmrs r0, fpsid
vmlinux.llvm.good [0xc0101dcc] <+324>: vmrs r6, fpscr
vmlinux.llvm.good [0xc0101e10] <+392>: vmrs r10, fpinst
vmlinux.llvm.good [0xc0101eb8] <+560>: vmrs r10, fpinst2 vmlinux.llvm.bad [0xc0101cb8] <+48>: vmrs r7, fpexc
vmlinux.llvm.bad [0xc0101cd8] <+80>: vmsr fpexc, r0
vmlinux.llvm.bad [0xc0101d20] <+152>: vmsr fpexc, r7
vmlinux.llvm.bad [0xc0101d30] <+168>: vmrs r0, fpscr
vmlinux.llvm.bad [0xc0101d50] <+200>: vmrs r6, fpscr <== BOOM!
vmlinux.llvm.bad [0xc0101d6c] <+228>: vmsr fpexc, r0
vmlinux.llvm.bad [0xc0101d70] <+232>: vmrs r0, fpsid
vmlinux.llvm.bad [0xc0101da4] <+284>: vmrs r10, fpinst
vmlinux.llvm.bad [0xc0101df8] <+368>: vmrs r4, fpexc
vmlinux.llvm.bad [0xc0101e5c] <+468>: vmrs r10, fpinst2I think LLVM's reordering is valid as the code is currently written: the compiler doesn't know the instructions have side effects in hardware.
Fix by using "asm volatile" in fmxr() and fmrx(), so they cannot be reordered with respect to each other. The original compiler now produces working kernels on my hardware with DYNAMIC_DEBUG=n.
This is the relevant piece of the diff of the vfp_support_entry() text, from the original oopsing kernel to a working kernel with this patch:
vmrs r0, fpscr
tst r0, #4096
bne 0xc0101d48
tst r0, #458752
beq 0xc0101ecc
orr r7, r7, #536870912
ldr r0, [r4, #0x3c]
mov r9, #16
-vmrs r6, fpscr
orr r9, r9, #251658240
add r0, r0, #4
str r0, [r4, #0x3c]
mvn r0, #159
sub r0, r0, #-1207959552
and r0, r7, r0
vmsr fpexc, r0
vmrs r0, fpsid
+vmrs r6, fpscr
and r0, r0, #983040
cmp r0, #65536
bne 0xc0101d88--- arch/arm/vfp/vfpinstr.h | 48 ++++++++++++++++++++++------------------- 1 file changed, 26 insertions(+), 22 deletions(-)
arch/arm/vfp/vfpinstr.h +26 -22
@@ -64,33 +64,37 @@#ifdef CONFIG_AS_VFP_VMRS_FPINST -#define fmrx (_vfp_) ({ \ - u32 __v; \ - asm(".fpu vfpv2\n" \ - "vmrs %0, " #_vfp_ \ - : "=r" (__v) : : "cc"); \ - __v; \ - }) - -#define fmxr (_vfp_,_var_) \ - asm(".fpu vfpv2\n" \ - "vmsr " #_vfp_ ", %0" \ - : : "r" (_var_) : "cc") +#define fmrx (_vfp_) ({ \ + u32 __v; \ + asm volatile (".fpu vfpv2\n" \ + "vmrs %0, " #_vfp_ \ + : "=r" (__v) : : "cc"); \ + __v; \ +}) + +#define fmxr (_vfp_, _var_) ({ \ + asm volatile (".fpu vfpv2\n" \ + "vmsr " #_vfp_ ", %0" \ + : : "r" (_var_) : "cc"); \ +})#else #define vfpreg (_vfp_) #_vfp_ -#define fmrx (_vfp_) ({ \ - u32 __v; \ - asm("mrc p10, 7, %0, " vfpreg(_vfp_) ", cr0, 0 @ fmrx %0, " #_vfp_ \ - : "=r" (__v) : : "cc"); \ - __v; \ - }) - -#define fmxr (_vfp_,_var_) \ - asm("mcr p10, 7, %0, " vfpreg(_vfp_) ", cr0, 0 @ fmxr " #_vfp_ ", %0" \ - : : "r" (_var_) : "cc") +#define fmrx (_vfp_) ({ \ + u32 __v; \ + asm volatile ("mrc p10, 7, %0, " vfpreg(_vfp_) "," \ + "cr0, 0 @ fmrx %0, " #_vfp_ \ + : "=r" (__v) : : "cc"); \ + __v; \ +}) + +#define fmxr (_vfp_, _var_) ({ \ + asm volatile ("mcr p10, 7, %0, " vfpreg(_vfp_) "," \ + "cr0, 0 @ fmxr " #_vfp_ ", %0" \ + : : "r" (_var_) : "cc"); \ +})#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/695 powercap: intel_rapl: Fix off by one in get_rpi()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 95f6580352a7225e619551febb83595bcb77ab17 ]
The rp->priv->rpi array is either rpi_msr or rpi_tpmi which have NR_RAPL_PRIMITIVES number of elements. Thus the > needs to be >= to prevent an off by one access.
--- drivers/powercap/intel_rapl_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/powercap/intel_rapl_common.c +1 -1
@@ -740,7 +740,7 @@ static struct rapl_primitive_info *get_rpi(struct rapl_package *rp, int prim) {struct rapl_primitive_info *rpi = rp->priv->rpi; -if (prim <0 || prim >NR_RAPL_PRIMITIVES || !rpi) +if (prim <0 || prim >=NR_RAPL_PRIMITIVES || !rpi)return NULL ;return &rpi[prim];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/695 wifi: rtw89: limit the PPDU length for VHT rate to 0x40000
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chia-Yuan Li <[email protected]>
[ Upstream commit 124410976bf807e76c45e36685ed8bf959229545 ]
If the PPDU length for VHT rate exceeds 0x40000, calculating the PSDU length will overflow. TMAC will determine the length to be too small and as a result, all packets will be sent as ZLD (Zero Length Delimiter).
--- drivers/net/wireless/realtek/rtw89/mac.c | 7 +++++++ drivers/net/wireless/realtek/rtw89/reg.h | 4 ++++ 2 files changed, 11 insertions(+)
drivers/net/wireless/realtek/rtw89/mac.c +7 -0
@@ -2728,6 +2728,7 @@ bool rtw89_mac_is_qta_dbcc(struct rtw89_dev *rtwdev, enum rtw89_qta_mode mode)static int ptcl_init_ax (struct rtw89_dev *rtwdev,u8 mac_idx) { +enum rtw89_core_chip_id chip_id = rtwdev->chip->chip_id;u32 val, reg;int ret;
@@ -2766,6 +2767,12 @@ static int ptcl_init_ax(struct rtw89_dev *rtwdev, u8 mac_idx) B_AX_SPE_RPT_PATH_MASK, FWD_TO_WLCPU); } +if (chip_id ==RTL8852A ||rtw89_is_rtl885xb (rtwdev)) { + reg =rtw89_mac_reg_by_idx (rtwdev,R_AX_AGG_LEN_VHT_0 , mac_idx); +rtw89_write32_mask (rtwdev, reg, +B_AX_AMPDU_MAX_LEN_VHT_MASK ,0x3FF80 ); + } +return 0 ; }
drivers/net/wireless/realtek/rtw89/reg.h +4 -0
@@ -2440,6 +2440,10 @@#define B_AX_RTS_TXTIME_TH_MASK GENMASK(15, 8)#define B_AX_RTS_LEN_TH_MASK GENMASK(7, 0) +#define R_AX_AGG_LEN_VHT_0 0xC618 +#define R_AX_AGG_LEN_VHT_0_C1 0xE618 +#define B_AX_AMPDU_MAX_LEN_VHT_MASK GENMASK(19, 0) +#define S_AX_CTS2S_TH_SEC_256B 1#define R_AX_SIFS_SETTING 0xC624#define R_AX_SIFS_SETTING_C1 0xE624
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/695 kselftest/arm64: signal: fix/refactor SVE vector length enumeration
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <[email protected]>
[ Upstream commit 5225b6562b9a7dc808d5a1e465aaf5e2ebb220cd ]
Currently a number of SVE/SME related tests have almost identical functions to enumerate all supported vector lengths. However over time the copy&pasted code has diverged, allowing some bugs to creep in:
- fake_sigreturn_sme_change_vl reports a failure, not a SKIP if only one vector length is supported (but the SVE version is fine)
- fake_sigreturn_sme_change_vl tries to set the SVE vector length, not the SME one (but the other SME tests are fine)
- za_no_regs keeps iterating forever if only one vector length is supported (but za_regs is correct)
Since those bugs seem to be mostly copy&paste ones, let's consolidate the enumeration loop into one shared function, and just call that from each test. That should fix the above bugs, and prevent similar issues from happening again.
--- tools/testing/selftests/arm64/signal/Makefile | 2 +- .../selftests/arm64/signal/sve_helpers.c | 56 +++++++++++++++++++ .../selftests/arm64/signal/sve_helpers.h | 21 +++++++ .../testcases/fake_sigreturn_sme_change_vl.c | 32 +++-------- .../testcases/fake_sigreturn_sve_change_vl.c | 30 ++-------- .../arm64/signal/testcases/ssve_regs.c | 36 +++--------- .../arm64/signal/testcases/ssve_za_regs.c | 36 +++--------- .../arm64/signal/testcases/sve_regs.c | 32 +++-------- .../arm64/signal/testcases/za_no_regs.c | 32 +++-------- .../arm64/signal/testcases/za_regs.c | 36 +++--------- 10 files changed, 132 insertions(+), 181 deletions(-) create mode 100644 tools/testing/selftests/arm64/signal/sve_helpers.c create mode 100644 tools/testing/selftests/arm64/signal/sve_helpers.h
tools/testing/selftests/arm64/signal/Makefile +1 -1
@@ -23,7 +23,7 @@ $(TEST_GEN_PROGS): $(PROGS) # Common test-unit targets to build common-layout test-cases executables # Needs secondary expansion to properly include the testcase c-file in pre-reqs COMMON_SOURCES := test_signals.c test_signals_utils.c testcases/testcases.c \ - signals.S + signals.S sve_helpers.c COMMON_HEADERS := test_signals.h test_signals_utils.h testcases/testcases.h .SECONDEXPANSION:
tools/testing/selftests/arm64/signal/sve_helpers.c new file +56 -0
56 lines not on this page · raw message
tools/testing/selftests/arm64/signal/sve_helpers.h new file +21 -0
@@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* +* Copyright (C) 2024 ARM Limited +* +* Common helper functions for SVE and SME functionality. +*/ + +#ifndef __SVE_HELPERS_H__ +#define __SVE_HELPERS_H__ + +#include <stdbool.h> + +#define VLS_USE_SVE false +#define VLS_USE_SME true + +extern unsigned int vls[]; +extern unsigned int nvls; + +int sve_fill_vls (bool use_sme,int min_vls); + +#endif
tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c +8 -24
@@ -6,44 +6,28 @@* handler, this is not supported and is expected to segfault. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" struct fake_sigframe sf; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,2 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SVE_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; +if (!res) +return true; - vl &=PR_SME_VL_LEN_MASK ; +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least two VLs */ -if (nvls <2 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } - -return true; +return false; } static int fake_sigreturn_ssve_change_vl(struct tdescr *td,
tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sve_change_vl.c +6 -24
@@ -12,40 +12,22 @@#include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" struct fake_sigframe sf; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sve_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SVE ,2 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SVE_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; +if (!res) +return true; - vl &=PR_SVE_VL_LEN_MASK ; - -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least two VLs */ -if (nvls <2 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); +if (res ==KSFT_SKIP ) td->result =KSFT_SKIP ; -return false; - } -return true; +return false; } static int fake_sigreturn_sve_change_vl(struct tdescr *td,
tools/testing/selftests/arm64/signal/testcases/ssve_regs.c +8 -28
@@ -6,51 +6,31 @@* set up as expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *64 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Did we find the lowest supported VL? */ -if (vq <sve_vq_from_vl (vl)) -break ; +if (!res) +return true; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_ssve_regs (void )
tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c +8 -28
@@ -6,51 +6,31 @@* signal frames is set up as expected when enabled simultaneously. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *128 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Did we find the lowest supported VL? */ -if (vq <sve_vq_from_vl (vl)) -break ; +if (!res) +return true; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_regs (void )
tools/testing/selftests/arm64/signal/testcases/sve_regs.c +8 -24
@@ -6,47 +6,31 @@* expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *64 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sve_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SVE ,1 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SVE_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SVE_VL_LEN_MASK ; - -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); +if (!res) +return true; - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_sve_regs (void )
tools/testing/selftests/arm64/signal/testcases/za_no_regs.c +8 -24
@@ -6,47 +6,31 @@* expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *128 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SME_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); +if (!res) +return true; - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; } static int do_one_sme_vl(struct tdescr *td, siginfo_t *si, ucontext_t *uc,
tools/testing/selftests/arm64/signal/testcases/za_regs.c +8 -28
@@ -6,51 +6,31 @@* expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *128 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SME_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Did we find the lowest supported VL? */ -if (vq <sve_vq_from_vl (vl)) -break ; +if (!res) +return true; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_za_regs (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/695 arm64: smp: smp_send_stop() and crash_smp_send_stop() should try non-NMI first
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit fdfa588124b6356cd08e5d3f0c3643c4ec3d6887 ]
When testing hard lockup handling on my sc7180-trogdor-lazor device with pseudo-NMI enabled, with serial console enabled and with kgdb disabled, I found that the stack crawls printed to the serial console ended up as a jumbled mess. After rebooting, the pstore-based console looked fine though. Also, enabling kgdb to trap the panic made the console look fine and avoided the mess.
After a bit of tracking down, I came to the conclusion that this was what was happening:
1. The panic path was stopping all other CPUs with panic_other_cpus_shutdown().
2. At least one of those other CPUs was in the middle of printing to the serial console and holding the console port's lock, which is grabbed with "irqsave". ...but since we were stopping with an NMI we didn't care about the "irqsave" and interrupted anyway.
3. Since we stopped the CPU while it was holding the lock it would never release it.
4. All future calls to output to the console would end up failing to get the lock in qcom_geni_serial_console_write(). This isn't _totally_ unexpected at panic time but it's a code path that's not well tested, hard to get right, and apparently doesn't work terribly well on the Qualcomm geni serial driver.
The Qualcomm geni serial driver was fixed to be a bit better in commit 9e957a155005 ("serial: qcom-geni: Don't cancel/abort if we can't get the port lock") but it's nice not to get into this situation in the first place.
Taking a page from what x86 appears to do in native_stop_other_cpus(), do this:
1. First, try to stop other CPUs with a normal IPI and wait a second. This gives them a chance to leave critical sections.
2. If CPUs fail to stop then retry with an NMI, but give a much lower timeout since there's no good reason for a CPU not to react quickly to a NMI.
This works well and avoids the corrupted console and (presumably) could help avoid other similar issues.
In order to do this, we need to do a little re-organization of our IPIs since we don't have any more free IDs. Do what was suggested in previous conversations and combine "stop" and "crash stop". That frees up an IPI so now we can have a "stop" and "stop NMI".
In order to do this we also need a slight change in the way we keep track of which CPUs still need to be stopped. We need to know specifically which CPUs haven't stopped yet when we fall back to NMI but in the "crash stop" case the "cpu_online_mask" isn't updated as CPUs go down. This is why that code path had an atomic of the number of CPUs left. Solve this by also updating the "cpu_online_mask" for crash stops.
All of the above lets us combine the logic for "stop" and "crash stop" code, which appeared to have a bunch of arbitrary implementation differences.
Aside from the above change where we try a normal IPI and then an NMI, the combined function has a few subtle differences:
* In the normal smp_send_stop(), if we fail to stop one or more CPUs then we won't include the current CPU (the one running smp_send_stop()) in the error message.
* In crash_smp_send_stop(), if we fail to stop some CPUs we'll print the CPUs that we failed to stop instead of printing all _but_ the current running CPU.
* In crash_smp_send_stop(), we will now only print "SMP: stopping secondary CPUs" if (system_state <= SYSTEM_RUNNING).
--- arch/arm64/kernel/smp.c | 160 ++++++++++++++++++++++++---------------- 1 file changed, 97 insertions(+), 63 deletions(-)
arch/arm64/kernel/smp.c +97 -63
@@ -68,7 +68,7 @@ enum ipi_msg_type {IPI_RESCHEDULE ,IPI_CALL_FUNC ,IPI_CPU_STOP , -IPI_CPU_CRASH_STOP , +IPI_CPU_STOP_NMI ,IPI_TIMER ,IPI_IRQ_WORK , NR_IPI,
@@ -85,6 +85,8 @@ static int ipi_irq_base __ro_after_init;static int nr_ipi__ro_after_init =NR_IPI ;static struct irq_desc *ipi_desc[MAX_IPI ]__ro_after_init ; +static bool crash_stop; +static void ipi_setup (int cpu);#ifdef CONFIG_HOTPLUG_CPU
@@ -823,7 +825,7 @@ static const char *ipi_types[MAX_IPI] __tracepoint_string = { [IPI_RESCHEDULE] = "Rescheduling interrupts", [IPI_CALL_FUNC] = "Function call interrupts", [IPI_CPU_STOP] = "CPU stop interrupts", - [IPI_CPU_CRASH_STOP] = "CPU stop (for crash dump) interrupts", + [IPI_CPU_STOP_NMI] = "CPU stop NMIs", [IPI_TIMER] = "Timer broadcast interrupts", [IPI_IRQ_WORK] = "IRQ work interrupts", [IPI_CPU_BACKTRACE] = "CPU backtrace interrupts",
@@ -867,9 +869,9 @@ void arch_irq_work_raise(void) }#endif -static void __noreturn local_cpu_stop (void ) +static void __noreturn local_cpu_stop (unsigned int cpu) { -set_cpu_online (smp_processor_id (), false); +set_cpu_online (cpu, false);local_daif_mask ();sdei_mask_local_cpu ();
@@ -883,21 +885,26 @@ static void __noreturn local_cpu_stop(void)*/ void __noreturn panic_smp_self_stop (void ) { -local_cpu_stop (); +local_cpu_stop (smp_processor_id ()); } -#ifdef CONFIG_KEXEC_CORE -static atomic_t waiting_for_crash_ipi =ATOMIC_INIT (0 ); -#endif -static void __noreturn ipi_cpu_crash_stop (unsigned int cpu,struct pt_regs *regs) {#ifdef CONFIG_KEXEC_CORE +/* +* Use local_daif_mask() instead of local_irq_disable() to make sure +* that pseudo-NMIs are disabled. The "crash stop" code starts with +* an IRQ and falls back to NMI (which might be pseudo). If the IRQ +* finally goes through right as we're timing out then the NMI could +* interrupt us. It's better to prevent the NMI and let the IRQ +* finish since the pt_regs will be better. +*/ +local_daif_mask (); +crash_save_cpu (regs, cpu); -atomic_dec (&waiting_for_crash_ipi); +set_cpu_online (cpu, false); -local_irq_disable ();sdei_mask_local_cpu ();if (IS_ENABLED (CONFIG_HOTPLUG_CPU ))
@@ -962,14 +969,12 @@ static void do_handle_IPI(int ipinr)break ;case IPI_CPU_STOP : -local_cpu_stop (); -break ; - -case IPI_CPU_CRASH_STOP : -if (IS_ENABLED (CONFIG_KEXEC_CORE )) { +case IPI_CPU_STOP_NMI : +if (IS_ENABLED (CONFIG_KEXEC_CORE ) && crash_stop) {ipi_cpu_crash_stop (cpu,get_irq_regs ()); -unreachable (); + }else { +local_cpu_stop (cpu); }break ;
@@ -1024,8 +1029,7 @@ static bool ipi_should_be_nmi(enum ipi_msg_type ipi)return false;switch (ipi) { -case IPI_CPU_STOP : -case IPI_CPU_CRASH_STOP : +case IPI_CPU_STOP_NMI :case IPI_CPU_BACKTRACE :case IPI_KGDB_ROUNDUP :return true;
@@ -1138,79 +1142,109 @@ static inline unsigned int num_other_online_cpus(void)void smp_send_stop (void ) { +static unsigned long stop_in_progress; +cpumask_t mask;unsigned long timeout; -if (num_other_online_cpus ()) { -cpumask_t mask; +/* +* If this cpu is the only one alive at this point in time, online or +* not, there are no stop messages to be sent around, so just back out. +*/ +if (num_other_online_cpus () ==0 ) + goto skip_ipi; -cpumask_copy (&mask, cpu_online_mask); -cpumask_clear_cpu (smp_processor_id (), &mask); +/* Only proceed if this is the first CPU to reach this code */ +if (test_and_set_bit (0 , &stop_in_progress)) +return ; -if (system_state <=SYSTEM_RUNNING ) -pr_crit ("SMP: stopping secondary CPUs\n" ); -smp_cross_call (&mask,IPI_CPU_STOP ); - } +/* +* Send an IPI to all currently online CPUs except the CPU running +* this code. +* +* NOTE: we don't do anything here to prevent other CPUs from coming +* online after we snapshot `cpu_online_mask`. Ideally, the calling code +* should do something to prevent other CPUs from coming up. This code +* can be called in the panic path and thus it doesn't seem wise to +* grab the CPU hotplug mutex ourselves. Worst case: +* - If a CPU comes online as we're running, we'll likely notice it +* during the 1 second wait below and then we'll catch it when we try +* with an NMI (assuming NMIs are enabled) since we re-snapshot the +* mask before sending an NMI. +* - If we leave the function and see that CPUs are still online we'll +* at least print a warning. Especially without NMIs this function +* isn't foolproof anyway so calling code will just have to accept +* the fact that there could be cases where a CPU can't be stopped. +*/ +cpumask_copy (&mask, cpu_online_mask); +cpumask_clear_cpu (smp_processor_id (), &mask); -/* Wait up to one second for other CPUs to stop */ +if (system_state <=SYSTEM_RUNNING ) +pr_crit ("SMP: stopping secondary CPUs\n" ); + +/* +* Start with a normal IPI and wait up to one second for other CPUs to +* stop. We do this first because it gives other processors a chance +* to exit critical sections / drop locks and makes the rest of the +* stop process (especially console flush) more robust. +*/ +smp_cross_call (&mask,IPI_CPU_STOP ); timeout =USEC_PER_SEC ;while (num_other_online_cpus () && timeout--)udelay (1 ); -if (num_other_online_cpus ()) +/* +* If CPUs are still online, try an NMI. There's no excuse for this to +* be slow, so we only give them an extra 10 ms to respond. +*/ +if (num_other_online_cpus () &&ipi_should_be_nmi (IPI_CPU_STOP_NMI )) { +smp_rmb (); +cpumask_copy (&mask, cpu_online_mask); +cpumask_clear_cpu (smp_processor_id (), &mask); + +pr_info ("SMP: retry stop with NMI for CPUs %*pbl\n" , +cpumask_pr_args (&mask)); + +smp_cross_call (&mask,IPI_CPU_STOP_NMI ); + timeout =USEC_PER_MSEC *10 ; +while (num_other_online_cpus () && timeout--) +udelay (1 ); + } + +if (num_other_online_cpus ()) { +smp_rmb (); +cpumask_copy (&mask, cpu_online_mask); +cpumask_clear_cpu (smp_processor_id (), &mask); +pr_warn ("SMP: failed to stop secondary CPUs %*pbl\n" , -cpumask_pr_args (cpu_online_mask)); +cpumask_pr_args (&mask)); + } +skip_ipi:sdei_mask_local_cpu (); }#ifdef CONFIG_KEXEC_CORE void crash_smp_send_stop (void ) { -static int cpus_stopped; -cpumask_t mask; -unsigned long timeout; -/* * This function can be called twice in panic path, but obviously * we execute this only once. +* +* We use this same boolean to tell whether the IPI we send was a +* stop or a "crash stop". */ -if (cpus_stopped) +if (crash_stop)return ; + crash_stop =1 ; - cpus_stopped =1 ; +smp_send_stop (); -/* -* If this cpu is the only one alive at this point in time, online or -* not, there are no stop messages to be sent around, so just back out. -*/ -if (num_other_online_cpus () ==0 ) - goto skip_ipi; - -cpumask_copy (&mask, cpu_online_mask); -cpumask_clear_cpu (smp_processor_id (), &mask); - -atomic_set (&waiting_for_crash_ipi,num_other_online_cpus ()); - -pr_crit ("SMP: stopping secondary CPUs\n" ); -smp_cross_call (&mask,IPI_CPU_CRASH_STOP ); - -/* Wait up to one second for other CPUs to stop */ - timeout =USEC_PER_SEC ; -while ((atomic_read (&waiting_for_crash_ipi) >0 ) && timeout--) -udelay (1 ); - -if (atomic_read (&waiting_for_crash_ipi) >0 ) -pr_warn ("SMP: failed to stop secondary CPUs %*pbl\n" , -cpumask_pr_args (&mask)); - -skip_ipi: -sdei_mask_local_cpu ();sdei_handler_abort (); }bool smp_crash_stop_failed (void ) { -return (atomic_read (&waiting_for_crash_ipi) >0 ); +return num_other_online_cpus () !=0 ; }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/695 thermal: core: Fold two functions into their respective callers
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit a8bbe6f10f78f85243ff821432c5d798a6d99ed4 ]
Fold bind_cdev() into __thermal_cooling_device_register() and bind_tz() into thermal_zone_device_register_with_trips() to reduce code bloat and make it somewhat easier to follow the code flow.
No intentional functional impact.
Stable-dep-of: 8144dbe68c49 ("thermal: core: Fix rounding of delay jiffies")
--- drivers/thermal/thermal_core.c | 55 ++++++++++++---------------------- 1 file changed, 19 insertions(+), 36 deletions(-)
drivers/thermal/thermal_core.c +19 -36
@@ -991,20 +991,6 @@ void print_bind_err_msg(struct thermal_zone_device *tz, tz->type, cdev->type, ret); } -static void bind_cdev (struct thermal_cooling_device *cdev) -{ -int ret; -struct thermal_zone_device *pos =NULL ; - -list_for_each_entry (pos, &thermal_tz_list, node) { -if (pos->ops.bind) { - ret = pos->ops.bind (pos, cdev); -if (ret) -print_bind_err_msg (pos, cdev, ret); - } - } -} -/** * __thermal_cooling_device_register() - register a new thermal cooling device * @np: a pointer to a device tree node.
@@ -1100,7 +1086,13 @@ __thermal_cooling_device_register(struct device_node *np,list_add (&cdev->node, &thermal_cdev_list);/* Update binding information for 'this' new cdev */ -bind_cdev (cdev); +list_for_each_entry (pos, &thermal_tz_list, node) { +if (pos->ops.bind) { + ret = pos->ops.bind (pos, cdev); +if (ret) +print_bind_err_msg (pos, cdev, ret); + } + }list_for_each_entry (pos, &thermal_tz_list, node)if (atomic_cmpxchg (&pos->need_update,1 ,0 ))
@@ -1338,25 +1330,6 @@ void thermal_cooling_device_unregister(struct thermal_cooling_device *cdev) }EXPORT_SYMBOL_GPL (thermal_cooling_device_unregister); -static void bind_tz (struct thermal_zone_device *tz) -{ -int ret; -struct thermal_cooling_device *pos =NULL ; - -if (!tz->ops.bind) -return ; - -mutex_lock (&thermal_list_lock); - -list_for_each_entry (pos, &thermal_cdev_list, node) { - ret = tz->ops.bind (tz, pos); -if (ret) -print_bind_err_msg (tz, pos, ret); - } - -mutex_unlock (&thermal_list_lock); -} -static void thermal_set_delay_jiffies (unsigned long *delay_jiffies,int delay_ms) { *delay_jiffies =msecs_to_jiffies (delay_ms);
@@ -1554,13 +1527,23 @@ thermal_zone_device_register_with_trips(const char *type, }mutex_lock (&thermal_list_lock); +mutex_lock (&tz->lock);list_add_tail (&tz->node, &thermal_tz_list);mutex_unlock (&tz->lock); -mutex_unlock (&thermal_list_lock);/* Bind cooling devices for this zone */ -bind_tz (tz); +if (tz->ops.bind) { +struct thermal_cooling_device *cdev; + +list_for_each_entry (cdev, &thermal_cdev_list, node) { + result = tz->ops.bind (tz, cdev); +if (result) +print_bind_err_msg (tz, cdev, result); + } + } + +mutex_unlock (&thermal_list_lock);thermal_zone_device_init (tz);/* Update the new thermal zone and mark it as already updated. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/695 thermal: core: Fix rounding of delay jiffies
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 8144dbe68c493baa412d78f41a57e90a6461f6c3 ]
Using round_jiffies() in thermal_set_delay_jiffies() is invalid because its argument should be time in the future in absolute jiffies and it computes the result with respect to the current jiffies value at the invocation time. Fortunately, in the majority of cases it does not make any difference due to the time_is_after_jiffies() check in round_jiffies_common().
While using round_jiffies_relative() instead of round_jiffies() might reflect the intent a bit better, it still would not be defensible because that function should be called when the timer is about to be set and it is not suitable for pre-computation of delay values.
Accordingly, drop thermal_set_delay_jiffies() altogether, simply convert polling_delay and passive_delay to jiffies during thermal zone initialization and make thermal_zone_device_set_polling() call round_jiffies_relative() on the delay if it is greather than 1 second.
--- drivers/thermal/thermal_core.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
drivers/thermal/thermal_core.c +10 -13
@@ -323,11 +323,15 @@ static void thermal_zone_broken_disable(struct thermal_zone_device *tz)static void thermal_zone_device_set_polling (struct thermal_zone_device *tz,unsigned long delay) { -if (delay) -mod_delayed_work (system_freezable_power_efficient_wq, - &tz->poll_queue, delay); -else +if (!delay) {cancel_delayed_work (&tz->poll_queue); +return ; + } + +if (delay >HZ ) + delay =round_jiffies_relative (delay); + +mod_delayed_work (system_freezable_power_efficient_wq, &tz->poll_queue, delay); }static void thermal_zone_recheck (struct thermal_zone_device *tz,int error)
@@ -1330,13 +1334,6 @@ void thermal_cooling_device_unregister(struct thermal_cooling_device *cdev) }EXPORT_SYMBOL_GPL (thermal_cooling_device_unregister); -static void thermal_set_delay_jiffies (unsigned long *delay_jiffies,int delay_ms) -{ - *delay_jiffies =msecs_to_jiffies (delay_ms); -if (delay_ms >1000 ) - *delay_jiffies =round_jiffies (*delay_jiffies); -} -int thermal_zone_get_crit_temp (struct thermal_zone_device *tz,int *temp) {const struct thermal_trip_desc *td;
@@ -1482,8 +1479,8 @@ thermal_zone_device_register_with_trips(const char *type, td->threshold =INT_MAX ; } -thermal_set_delay_jiffies (&tz->passive_delay_jiffies, passive_delay); -thermal_set_delay_jiffies (&tz->polling_delay_jiffies, polling_delay); + tz->polling_delay_jiffies =msecs_to_jiffies (polling_delay); + tz->passive_delay_jiffies =msecs_to_jiffies (passive_delay); tz->recheck_delay_jiffies =THERMAL_RECHECK_DELAY ;/* sys I/F */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/695 drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jing Zhang <[email protected]>
[ Upstream commit a3dd920977dccc453c550260c4b7605b280b79c3 ]
The alibaba_uncore_pmu driver forgot to clear all interrupt status in the interrupt processing function. After the PMU counter overflow interrupt occurred, an interrupt storm occurred, causing the system to hang.
Therefore, clear the correct interrupt status in the interrupt handling function to fix it.
--- drivers/perf/alibaba_uncore_drw_pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/perf/alibaba_uncore_drw_pmu.c +1 -1
@@ -400,7 +400,7 @@ static irqreturn_t ali_drw_pmu_isr(int irq_num, void *data) }/* clear common counter intr status */ - clr_status =FIELD_PREP (ALI_DRW_PMCOM_CNT_OV_INTR_MASK ,1 ); + clr_status =FIELD_PREP (ALI_DRW_PMCOM_CNT_OV_INTR_MASK , status);writel (clr_status, drw_pmu->cfg_base +ALI_DRW_PMU_OV_INTR_CLR ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/695 perf/dwc_pcie: Fix registration issue in multi PCIe controller instances
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna chaitanya chundru <[email protected]>
[ Upstream commit e669388537c472142804eb5a0449cc23d5409694 ]
When there are multiple of instances of PCIe controllers, registration to perf driver fails with this error.
sysfs: cannot create duplicate filename '/devices/platform/dwc_pcie_pmu.0'
CPU: 0 PID: 166 Comm: modprobe Not tainted 6.10.0-rc2-next-20240607-dirty Hardware name: Qualcomm SA8775P Ride (DT) Call trace: dump_backtrace.part.8+0x98/0xf0 show_stack+0x14/0x1c dump_stack_lvl+0x74/0x88 dump_stack+0x14/0x1c sysfs_warn_dup+0x60/0x78 sysfs_create_dir_ns+0xe8/0x100 kobject_add_internal+0x94/0x224 kobject_add+0xa8/0x118 device_add+0x298/0x7b4 platform_device_add+0x1a0/0x228 platform_device_register_full+0x11c/0x148 dwc_pcie_register_dev+0x74/0xf0 [dwc_pcie_pmu] dwc_pcie_pmu_init+0x7c/0x1000 [dwc_pcie_pmu] do_one_initcall+0x58/0x1c0 do_init_module+0x58/0x208 load_module+0x1804/0x188c __do_sys_init_module+0x18c/0x1f0 __arm64_sys_init_module+0x14/0x1c invoke_syscall+0x40/0xf8 el0_svc_common.constprop.1+0x70/0xf4 do_el0_svc+0x18/0x20 el0_svc+0x28/0xb0 el0t_64_sync_handler+0x9c/0xc0 el0t_64_sync+0x160/0x164
kobject: kobject_add_internal failed for dwc_pcie_pmu.0 with -EEXIST, don't try to register things with the same name in the same directory.
This is because of having same bdf value for devices under two different controllers.
Update the logic to use sbdf which is a unique number in case of multi instance also.
--- drivers/perf/dwc_pcie_pmu.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/perf/dwc_pcie_pmu.c +8 -8
@@ -556,10 +556,10 @@ static int dwc_pcie_register_dev(struct pci_dev *pdev) {struct platform_device *plat_dev;struct dwc_pcie_dev_info *dev_info; -u32 bdf; +u32 sbdf; - bdf =PCI_DEVID (pdev->bus->number, pdev->devfn); - plat_dev =platform_device_register_data (NULL ,"dwc_pcie_pmu" , bdf, + sbdf = (pci_domain_nr (pdev->bus) <<16 ) |PCI_DEVID (pdev->bus->number, pdev->devfn); + plat_dev =platform_device_register_data (NULL ,"dwc_pcie_pmu" , sbdf, pdev,sizeof (*pdev));if (IS_ERR (plat_dev))
@@ -611,15 +611,15 @@ static int dwc_pcie_pmu_probe(struct platform_device *plat_dev)struct pci_dev *pdev = plat_dev->dev.platform_data;struct dwc_pcie_pmu *pcie_pmu;char *name; -u32 bdf, val; +u32 sbdf, val;u16 vsec;int ret; vsec =pci_find_vsec_capability (pdev, pdev->vendor,DWC_PCIE_VSEC_RAS_DES_ID );pci_read_config_dword (pdev, vsec +PCI_VNDR_HEADER , &val); - bdf =PCI_DEVID (pdev->bus->number, pdev->devfn); - name =devm_kasprintf (&plat_dev->dev,GFP_KERNEL ,"dwc_rootport_%x" , bdf); + sbdf = plat_dev->id; + name =devm_kasprintf (&plat_dev->dev,GFP_KERNEL ,"dwc_rootport_%x" , sbdf);if (!name)return -ENOMEM ;
@@ -650,7 +650,7 @@ static int dwc_pcie_pmu_probe(struct platform_device *plat_dev) ret =cpuhp_state_add_instance (dwc_pcie_pmu_hp_state, &pcie_pmu->cpuhp_node);if (ret) { -pci_err (pdev,"Error %d registering hotplug @%x\n" , ret, bdf); +pci_err (pdev,"Error %d registering hotplug @%x\n" , ret, sbdf);return ret; }
@@ -663,7 +663,7 @@ static int dwc_pcie_pmu_probe(struct platform_device *plat_dev) ret =perf_pmu_register (&pcie_pmu->pmu, name,-1 );if (ret) { -pci_err (pdev,"Error %d registering PMU @%x\n" , ret, bdf); +pci_err (pdev,"Error %d registering PMU @%x\n" , ret, sbdf);return ret; } ret = devm_add_action_or_reset(&plat_dev->dev, dwc_pcie_unregister_pmu,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/695 perf/dwc_pcie: Always register for PCIe bus notifier
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna chaitanya chundru <[email protected]>
[ Upstream commit b94b05478fb6a09033bf70c6edd03f8930a0fe24 ]
When the PCIe devices are discovered late, the driver can't find the PCIe devices and returns in the init without registering with the bus notifier. Due to that the devices which are discovered late the driver can't register for this.
Register for bus notifier & driver even if the device is not found as part of init.
--- drivers/perf/dwc_pcie_pmu.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/perf/dwc_pcie_pmu.c +0 -5
@@ -726,7 +726,6 @@ static struct platform_driver dwc_pcie_pmu_driver = {static int __init dwc_pcie_pmu_init (void ) {struct pci_dev *pdev =NULL ; -bool found = false;int ret;for_each_pci_dev (pdev) {
@@ -738,11 +737,7 @@ static int __init dwc_pcie_pmu_init(void)pci_dev_put (pdev);return ret; } - - found = true; } -if (!found) -return -ENODEV ; ret = cpuhp_setup_state_multi(CPUHP_AP_ONLINE_DYN, "perf/dwc_pcie_pmu:online",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/695 crypto: qat - fix "Full Going True" macro definition
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Pankratov <[email protected]>
[ Upstream commit 694a6f594817462942acbb1a35b1f7d61e2d49e7 ]
The macro ADF_RP_INT_SRC_SEL_F_RISE_MASK is currently set to the value 0100b which means "Empty Going False". This might cause an incorrect restore of the bank state during live migration.
Fix the definition of the macro to properly represent the "Full Going True" state which is encoded as 0011b.
--- drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.h +1 -1
@@ -83,7 +83,7 @@#define ADF_WQM_CSR_RPRESETSTS (bank) (ADF_WQM_CSR_RPRESETCTL(bank) + 4)/* Ring interrupt */ -#define ADF_RP_INT_SRC_SEL_F_RISE_MASK BIT(2) +#define ADF_RP_INT_SRC_SEL_F_RISE_MASK GENMASK(1, 0)#define ADF_RP_INT_SRC_SEL_F_FALL_MASK GENMASK(2, 0)#define ADF_RP_INT_SRC_SEL_RANGE_WIDTH 4#define ADF_COALESCED_POLL_TIMEOUT_US (1 * USEC_PER_SEC)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/695 ACPI: video: force native for Apple MacbookPro9,2
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esther Shimanovich <[email protected]>
[ Upstream commit 7dc918daaf2994963690171584ba423f28724df5 ]
It used to be that the MacbookPro9,2 used its native intel backlight device until the following commit was introduced:
commit b1d36e73cc1c ("drm/i915: Don't register backlight when another backlight should be used (v2)")
This commit forced this model to use its firmware acpi_video backlight device instead.
That worked fine until an additional commit was added:
commit 92714006eb4d ("drm/i915/backlight: Do not bump min brightness to max on enable")
That commit uncovered a bug in the MacbookPro 9,2's acpi_video backlight firmware; the backlight does not come back up after resume.
Add DMI quirk to select the working native intel interface instead so that the backlight successfully comes back up after resume.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -549,6 +549,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"), }, }, + { + .callback = video_detect_force_native, +/* Apple MacBook Pro 9,2 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Apple Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro9,2"), + }, + }, {/* https://bugzilla.redhat.com/show_bug.cgi?id=1217249 */ .callback = video_detect_force_native,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/695 wifi: mac80211_hwsim: correct MODULE_PARM_DESC of multi_radio
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 7c24c5bdf489c8f3a9c701a950126da871ebdaca ]
Correct the name field in multi_radio's MODULE_PARM_DESC.
--- drivers/net/wireless/virtual/mac80211_hwsim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/virtual/mac80211_hwsim.c +1 -1
@@ -71,7 +71,7 @@ MODULE_PARM_DESC(mlo, "Support MLO");static bool multi_radio;module_param (multi_radio, bool,0444 ); -MODULE_PARM_DESC (mlo,"Support Multiple Radios per wiphy" ); +MODULE_PARM_DESC (multi_radio,"Support Multiple Radios per wiphy" );/** * enum hwsim_regtest - the type of regulatory tests we offer
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/695 wifi: mac80211: dont use rate mask for offchannel TX either
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit e7a7ef9a0742dbd0818d5b15fba2c5313ace765b ]
Like the commit ab9177d83c04 ("wifi: mac80211: don't use rate mask for scanning"), ignore incorrect settings to avoid no supported rate warning reported by syzbot.
The syzbot did bisect and found cause is commit 9df66d5b9f45 ("cfg80211:
fix default HE tx bitrate mask in 2G band"), which however corrects bitmask of HE MCS and recognizes correctly settings of empty legacy rate plus HE MCS rate instead of returning -EINVAL.
As suggestions [1], follow the change of SCAN TX to consider this case of offchannel TX as well.
--- include/net/mac80211.h | 7 ++++--- net/mac80211/offchannel.c | 1 + net/mac80211/rate.c | 2 +- net/mac80211/scan.c | 2 +- net/mac80211/tx.c | 2 +- 5 files changed, 8 insertions(+), 6 deletions(-)
include/net/mac80211.h +4 -3
@@ -994,8 +994,9 @@ enum mac80211_tx_info_flags {* of their QoS TID or other priority field values. * @IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX: first MLO TX, used mostly internally * for sequence number assignment -* @IEEE80211_TX_CTRL_SCAN_TX: Indicates that this frame is transmitted -* due to scanning, not in normal operation on the interface. +* @IEEE80211_TX_CTRL_DONT_USE_RATE_MASK: Don't use rate mask for this frame +* which is transmitted due to scanning or offchannel TX, not in normal +* operation on the interface. * @IEEE80211_TX_CTRL_MLO_LINK: If not @IEEE80211_LINK_UNSPECIFIED, this * frame should be transmitted on the specific link. This really is * only relevant for frames that do not have data present, and is
@@ -1016,7 +1017,7 @@ enum mac80211_tx_control_flags {IEEE80211_TX_CTRL_NO_SEQNO =BIT (7 ),IEEE80211_TX_CTRL_DONT_REORDER =BIT (8 ),IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX =BIT (9 ), -IEEE80211_TX_CTRL_SCAN_TX =BIT (10 ), +IEEE80211_TX_CTRL_DONT_USE_RATE_MASK =BIT (10 ), IEEE80211_TX_CTRL_MLO_LINK = 0xf0000000, };
net/mac80211/offchannel.c +1 -0
@@ -997,6 +997,7 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, }IEEE80211_SKB_CB (skb)->flags = flags; +IEEE80211_SKB_CB (skb)->control.flags |=IEEE80211_TX_CTRL_DONT_USE_RATE_MASK ; skb->dev = sdata->dev;
net/mac80211/rate.c +1 -1
@@ -890,7 +890,7 @@ void ieee80211_get_tx_rates(struct ieee80211_vif *vif,if (ieee80211_is_tx_data (skb))rate_control_apply_mask (sdata, sta, sband, dest, max_rates); -if (!(info->control.flags &IEEE80211_TX_CTRL_SCAN_TX )) +if (!(info->control.flags &IEEE80211_TX_CTRL_DONT_USE_RATE_MASK )) mask = sdata->rc_rateidx_mask[info->band];if (dest[0 ].idx <0 )
net/mac80211/scan.c +1 -1
@@ -649,7 +649,7 @@ static void ieee80211_send_scan_probe_req(struct ieee80211_sub_if_data *sdata,cpu_to_le16 (IEEE80211_SN_TO_SEQ (sn)); }IEEE80211_SKB_CB (skb)->flags |= tx_flags; -IEEE80211_SKB_CB (skb)->control.flags |=IEEE80211_TX_CTRL_SCAN_TX ; +IEEE80211_SKB_CB (skb)->control.flags |=IEEE80211_TX_CTRL_DONT_USE_RATE_MASK ;ieee80211_tx_skb_tid_band (sdata, skb,7 , channel->band); } }
net/mac80211/tx.c +1 -1
@@ -699,7 +699,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx) txrc.skb = tx->skb; txrc.reported_rate.idx =-1 ; -if (unlikely (info->control.flags &IEEE80211_TX_CTRL_SCAN_TX )) { +if (unlikely (info->control.flags &IEEE80211_TX_CTRL_DONT_USE_RATE_MASK )) { txrc.rate_idx_mask = ~0 ; }else { txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/695 wifi: iwlwifi: config: label gl devices as discrete
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 8131dd52810dfcdb49fcdc78f5e18e1538b6c441 ]
The 'gl' devices are in the bz family, but they're not, integrated, so should have their own trans config struct. Fix that, also necessitating the removal of LTR config, and while at it remove 0x2727 and 0x272D IDs that were only used for test chips.
--- drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 11 +++++++++++ drivers/net/wireless/intel/iwlwifi/iwl-config.h | 1 + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 4 +--- 3 files changed, 13 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/cfg/bz.c +11 -0
@@ -148,6 +148,17 @@ const struct iwl_cfg_trans_params iwl_bz_trans_cfg = { .ltr_delay = IWL_CFG_TRANS_LTR_DELAY_2500US, }; +const struct iwl_cfg_trans_params iwl_gl_trans_cfg = { + .device_family =IWL_DEVICE_FAMILY_BZ , + .base_params = &iwl_bz_base_params, + .mq_rx_supported = true, + .rf_id = true, + .gen2 = true, + .umac_prph_offset =0x300000 , + .xtal_latency =12000 , + .low_latency_xtal = true, +}; +const char iwl_bz_name[] ="Intel(R) TBD Bz device" ;const char iwl_fm_name[] ="Intel(R) Wi-Fi 7 BE201 320MHz" ;const char iwl_gl_name[] ="Intel(R) Wi-Fi 7 BE200 320MHz" ;
drivers/net/wireless/intel/iwlwifi/iwl-config.h +1 -0
@@ -504,6 +504,7 @@ extern const struct iwl_cfg_trans_params iwl_so_long_latency_trans_cfg;extern const struct iwl_cfg_trans_params iwl_so_long_latency_imr_trans_cfg;extern const struct iwl_cfg_trans_params iwl_ma_trans_cfg;extern const struct iwl_cfg_trans_params iwl_bz_trans_cfg; +extern const struct iwl_cfg_trans_params iwl_gl_trans_cfg;extern const struct iwl_cfg_trans_params iwl_sc_trans_cfg;extern const char iwl9162_name[];extern const char iwl9260_name[];
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +1 -3
@@ -500,9 +500,7 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct pci_device_id iwl_hw_card_ids[] = { {IWL_PCI_DEVICE(0x7E40, PCI_ANY_ID, iwl_ma_trans_cfg)},/* Bz devices */ - {IWL_PCI_DEVICE(0x2727, PCI_ANY_ID, iwl_bz_trans_cfg)}, - {IWL_PCI_DEVICE(0x272D, PCI_ANY_ID, iwl_bz_trans_cfg)}, - {IWL_PCI_DEVICE(0x272b, PCI_ANY_ID, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0x272b, PCI_ANY_ID, iwl_gl_trans_cfg)}, {IWL_PCI_DEVICE(0xA840, 0x0000, iwl_bz_trans_cfg)}, {IWL_PCI_DEVICE(0xA840, 0x0090, iwl_bz_trans_cfg)}, {IWL_PCI_DEVICE(0xA840, 0x0094, iwl_bz_trans_cfg)},
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/695 wifi: iwlwifi: mvm: set the cipher for secured NDP ranging
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit a949075d4bbf1ca83ccdeaa6ef4ac2ce7526c5f4 ]
The cipher pointer is not set, but is derefereced trying to set its content, which leads to a NULL pointer dereference.
Fix it by pointing to the cipher parameter before dereferencing.
--- drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c +1 -0
@@ -772,6 +772,7 @@ iwl_mvm_ftm_set_secured_ranging(struct iwl_mvm *mvm, struct ieee80211_vif *vif,struct iwl_mvm_ftm_iter_data target; target.bssid = bssid; + target.cipher = cipher;ieee80211_iter_keys (mvm->hw, vif, iter, &target); }else {memcpy (tk, entry->tk,sizeof (entry->tk));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/695 wifi: iwlwifi: mvm: increase the time between ranging measurements
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit 3a7ee94559dfd640604d0265739e86dec73b64e8 ]
The algo running in fw may take a little longer than 5 milliseconds, (e.g. measurement on 80MHz while associated). Increase the minimum time between measurements to 7 milliseconds.
--- drivers/net/wireless/intel/iwlwifi/mvm/constants.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/constants.h +1 -1
@@ -109,7 +109,7 @@#define IWL_MVM_FTM_INITIATOR_SECURE_LTF false#define IWL_MVM_FTM_RESP_NDP_SUPPORT true#define IWL_MVM_FTM_RESP_LMR_FEEDBACK_SUPPORT true -#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR 5 +#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR 7#define IWL_MVM_FTM_NON_TB_MAX_TIME_BETWEEN_MSR 1000#define IWL_MVM_D3_DEBUG false#define IWL_MVM_USE_TWT true
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/695 wifi: cfg80211: fix bug of mapping AF3x to incorrect User Priority
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: hhorace <[email protected]>
[ Upstream commit a68b22e2905b04f376e2fa116be5e48b948f81c8 ]
According to RFC8325 4.3, Multimedia Streaming: AF31(011010, 26), AF32(011100, 28), AF33(011110, 30) maps to User Priority = 4 and AC_VI (Video).
However, the original code remain the default three Most Significant Bits (MSBs) of the DSCP, which makes AF3x map to User Priority = 3 and AC_BE (Best Effort).
--- net/wireless/util.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/wireless/util.c +6 -4
@@ -998,10 +998,10 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,* Diffserv Service Classes no update is needed: * - Standard: DF * - Low Priority Data: CS1 -* - Multimedia Streaming: AF31, AF32, AF33 * - Multimedia Conferencing: AF41, AF42, AF43 * - Network Control Traffic: CS7 * - Real-Time Interactive: CS4 +* - Signaling: CS5 */ switch (dscp >>2 ) {case 10 :
@@ -1026,9 +1026,11 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,/* Broadcasting video: CS3 */ ret =4 ;break ; -case 40 : -/* Signaling: CS5 */ - ret =5 ; +case 26 : +case 28 : +case 30 : +/* Multimedia Streaming: AF31, AF32, AF33 */ + ret =4 ;break ;case 44 :/* Voice Admit: VA */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/695 wifi: mac80211: fix the comeback long retry times
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 1524173a3745899612c71d9e83ff8fe29dbb2cfb ]
When we had a comeback, we will never use the default timeout values again because comeback is never cleared.
Clear comeback if we send another association request which will allow to start a default timer after Tx status.
The problem was seen with iwlwifi where the tx_status on the association request is handled before the association response frame (which is the usual case).
1) Tx assoc request 1/3
2) Rx assoc response (comeback, timeout = 1 second)
3) wait 1 second
4) Tx assoc request 2/3
5) Set timer to IEEE80211_ASSOC_TIMEOUT_LONG = 500ms (1 second after round_up)
6) tx_status on frame sent in 4) is ignored because comeback is still true
7) AP does not reply with assoc response
8) wait 1s <= This is where the bug is felt
9) Tx assoc request 3/3
With this fix, in step 6 we will reset the timer to IEEE80211_ASSOC_TIMEOUT_SHORT = 100ms and we will wait only 100ms in step 8.
--- net/mac80211/mlme.c | 1 + 1 file changed, 1 insertion(+)
net/mac80211/mlme.c +1 -0
@@ -7660,6 +7660,7 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)lockdep_assert_wiphy (sdata->local->hw.wiphy); assoc_data->tries++; + assoc_data->comeback = false;if (assoc_data->tries >IEEE80211_ASSOC_MAX_TRIES ) {sdata_info (sdata,"association with %pM timed out\n" , assoc_data->ap_addr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/695 wifi: iwlwifi: mvm: allow ESR when we the ROC expires
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 76364f3edfde60aa2fa20b578ba9b96797d7bff5 ]
We forgot to release the ROC reason for ESR prevention when the remain on channel expires.
Add this.
--- .../net/wireless/intel/iwlwifi/mvm/time-event.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +6 -8
@@ -114,16 +114,14 @@ static void iwl_mvm_cleanup_roc(struct iwl_mvm *mvm)iwl_mvm_flush_sta (mvm, mvm->aux_sta.sta_id, mvm->aux_sta.tfd_queue_msk); -if (mvm->mld_api_is_used) { -iwl_mvm_mld_rm_aux_sta (mvm); -mutex_unlock (&mvm->mutex); -return ; - } -/* In newer version of this command an aux station is added only * in cases of dedicated tx queue and need to be removed in end -* of use */ -if (iwl_mvm_has_new_station_api (mvm->fw)) +* of use. For the even newer mld api, use the appropriate +* function. +*/ +if (mvm->mld_api_is_used) +iwl_mvm_mld_rm_aux_sta (mvm); +else if (iwl_mvm_has_new_station_api (mvm->fw))iwl_mvm_rm_aux_sta (mvm); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/695 wifi: mac80211: Check for missing VHT elements only for 5 GHz
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <[email protected]>
[ Upstream commit 67bb124cd9ae38870667e4f9c876ef8e0f82ec44 ]
Check for missing VHT Capabilities and VHT Operation elements in association response frame only for 5 GHz links.
--- net/mac80211/mlme.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-)
net/mac80211/mlme.c +16 -13
@@ -4715,7 +4715,7 @@ static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link, ((assoc_data->wmm && !elems->wmm_param) || (link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT && (!elems->ht_cap_elem || !elems->ht_operation)) || - (link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT && + (is_5ghz && link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT && (!elems->vht_cap_elem || !elems->vht_operation)))) {const struct cfg80211_bss_ies *ies;struct ieee802_11_elems *bss_elems;
@@ -4763,19 +4763,22 @@ static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link,sdata_info (sdata,"AP bug: HT operation missing from AssocResp\n" ); } -if (!elems->vht_cap_elem && bss_elems->vht_cap_elem && - link->u.mgd.conn.mode >=IEEE80211_CONN_MODE_VHT ) { - elems->vht_cap_elem = bss_elems->vht_cap_elem; -sdata_info (sdata, -"AP bug: VHT capa missing from AssocResp\n" ); - } -if (!elems->vht_operation && bss_elems->vht_operation && - link->u.mgd.conn.mode >=IEEE80211_CONN_MODE_VHT ) { - elems->vht_operation = bss_elems->vht_operation; -sdata_info (sdata, -"AP bug: VHT operation missing from AssocResp\n" ); - } +if (is_5ghz) { +if (!elems->vht_cap_elem && bss_elems->vht_cap_elem && + link->u.mgd.conn.mode >=IEEE80211_CONN_MODE_VHT ) { + elems->vht_cap_elem = bss_elems->vht_cap_elem; +sdata_info (sdata, +"AP bug: VHT capa missing from AssocResp\n" ); + } + +if (!elems->vht_operation && bss_elems->vht_operation && + link->u.mgd.conn.mode >=IEEE80211_CONN_MODE_VHT ) { + elems->vht_operation = bss_elems->vht_operation; +sdata_info (sdata, +"AP bug: VHT operation missing from AssocResp\n" ); + } + }kfree (bss_elems); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/695 ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Khoruzhick <[email protected]>
[ Upstream commit 632b746b108e3c62e0795072d00ed597371c738a ]
ACPICA commit 2ad4e6e7c4118f4cdfcad321c930b836cec77406
In some cases it is not practical nor useful to nag user about some firmware errors that they cannot fix. Add a macro that will print a warning or error only once to be used in these cases.
Stable-dep-of: c82c507126c9 ("ACPICA: executer/exsystem: Don't nag user about every Stall() violating the spec")
--- include/acpi/acoutput.h | 5 +++++ 1 file changed, 5 insertions(+)
include/acpi/acoutput.h +5 -0
@@ -193,6 +193,7 @@*/ #ifndef ACPI_NO_ERROR_MESSAGES #define AE_INFO _acpi_module_name, __LINE__ +#define ACPI_ONCE (_fn, _plist) { static char _done; if (!_done) { _done = 1; _fn _plist; } }/* * Error reporting. Callers module and line number are inserted by AE_INFO,
@@ -201,8 +202,10 @@*/ #define ACPI_INFO (plist) acpi_info plist#define ACPI_WARNING (plist) acpi_warning plist +#define ACPI_WARNING_ONCE (plist) ACPI_ONCE(acpi_warning, plist)#define ACPI_EXCEPTION (plist) acpi_exception plist#define ACPI_ERROR (plist) acpi_error plist +#define ACPI_ERROR_ONCE (plist) ACPI_ONCE(acpi_error, plist)#define ACPI_BIOS_WARNING (plist) acpi_bios_warning plist#define ACPI_BIOS_EXCEPTION (plist) acpi_bios_exception plist#define ACPI_BIOS_ERROR (plist) acpi_bios_error plist
@@ -214,8 +217,10 @@#define ACPI_INFO (plist)#define ACPI_WARNING (plist) +#define ACPI_WARNING_ONCE (plist)#define ACPI_EXCEPTION (plist)#define ACPI_ERROR (plist) +#define ACPI_ERROR_ONCE (plist)#define ACPI_BIOS_WARNING (plist)#define ACPI_BIOS_EXCEPTION (plist)#define ACPI_BIOS_ERROR (plist)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/695 ACPICA: executer/exsystem: Dont nag user about every Stall() violating the spec
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Khoruzhick <[email protected]>
[ Upstream commit c82c507126c9c9db350be28f14c83fad1c7969ae ]
ACPICA commit 129b75516fc49fe1fd6b8c5798f86c13854630b3
Stop nagging user about every Stall() that violates the spec
On my Dell XPS 15 7590 I get hundreds of these warnings after few hours of uptime:
$ dmesg | grep "fix the firmware" | wc -l 261
I cannot fix the firmware and I doubt that Dell cares about 4 year old laptop either
--- drivers/acpi/acpica/exsystem.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/acpi/acpica/exsystem.c +6 -5
@@ -133,14 +133,15 @@ acpi_status acpi_ex_system_do_stall(u32 how_long_us)* (ACPI specifies 100 usec as max, but this gives some slack in * order to support existing BIOSs) */ -ACPI_ERROR ((AE_INFO , -"Time parameter is too large (%u)" , how_long_us)); +ACPI_ERROR_ONCE ((AE_INFO , +"Time parameter is too large (%u)" , + how_long_us)); status =AE_AML_OPERAND_VALUE ; }else {if (how_long_us >100 ) { -ACPI_WARNING ((AE_INFO , -"Time parameter %u us > 100 us violating ACPI spec, please fix the firmware." , - how_long_us)); +ACPI_WARNING_ONCE ((AE_INFO , +"Time parameter %u us > 100 us violating ACPI spec, please fix the firmware." , + how_long_us)); }acpi_os_stall (how_long_us); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/695 padata: Honor the callers alignment in case of chunk_size 0
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamlesh Gurudasani <[email protected]>
[ Upstream commit 24cc57d8faaa4060fd58adf810b858fcfb71a02f ]
In the case where we are forcing the ps.chunk_size to be at least 1, we are ignoring the caller's alignment.
Move the forcing of ps.chunk_size to be at least 1 before rounding it up to caller's alignment, so that caller's alignment is honored.
While at it, use max() to force the ps.chunk_size to be at least 1 to improve readability.
--- kernel/padata.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/padata.c +3 -0
@@ -512,9 +512,12 @@ void __init padata_do_multithreaded(struct padata_mt_job *job)* thread function. Load balance large jobs between threads by * increasing the number of chunks, guarantee at least the minimum * chunk size from the caller, and honor the caller's alignment. +* Ensure chunk_size is at least 1 to prevent divide-by-0 +* panic in padata_mt_helper(). */ ps.chunk_size = job->size / (ps.nworks * load_balance_factor); ps.chunk_size =max (ps.chunk_size, job->min_chunk); + ps.chunk_size =max (ps.chunk_size,1ul ); ps.chunk_size =roundup (ps.chunk_size, job->align);/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/695 drivers/perf: hisi_pcie: Record hardware counts correctly
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <[email protected]>
[ Upstream commit daecd3373a16a039ad241086e30a1ec46fc9d61f ]
Currently we set the period and record it as the initial value of the counter without checking it's set to the hardware successfully or not. However the counter maybe unwritable if the target event is unsupported by the device. In such case we will pass user a wrong count:
[start counts when setting the period]hwc->prev_count = 0x8000000000000000 device.counter_value = 0 // the counter is not set as the period [when user reads the counter]event->count = device.counter_value - hwc->prev_count
= 0x8000000000000000 // wrong. should be 0.
Fix this by record the hardware counter counts correctly when setting the period.
--- drivers/perf/hisilicon/hisi_pcie_pmu.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/perf/hisilicon/hisi_pcie_pmu.c +14 -0
@@ -452,10 +452,24 @@ static void hisi_pcie_pmu_set_period(struct perf_event *event)struct hisi_pcie_pmu *pcie_pmu =to_pcie_pmu (event->pmu);struct hw_perf_event *hwc = &event->hw;int idx = hwc->idx; +u64 orig_cnt, cnt; + + orig_cnt =hisi_pcie_pmu_read_counter (event);local64_set (&hwc->prev_count,HISI_PCIE_INIT_VAL );hisi_pcie_pmu_writeq (pcie_pmu,HISI_PCIE_CNT , idx,HISI_PCIE_INIT_VAL );hisi_pcie_pmu_writeq (pcie_pmu,HISI_PCIE_EXT_CNT , idx,HISI_PCIE_INIT_VAL ); + +/* +* The counter maybe unwritable if the target event is unsupported. +* Check this by comparing the counts after setting the period. If +* the counts stay unchanged after setting the period then update +* the hwc->prev_count correctly. Otherwise the final counts user +* get maybe totally wrong. +*/ + cnt =hisi_pcie_pmu_read_counter (event); +if (orig_cnt == cnt) +local64_set (&hwc->prev_count, cnt); }static void hisi_pcie_pmu_enable_counter (struct hisi_pcie_pmu *pcie_pmu,struct hw_perf_event *hwc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/695 drivers/perf: hisi_pcie: Fix TLP headers bandwidth counting
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <[email protected]>
[ Upstream commit 17bf68aeb3642221e3e770399b5a52f370747ac1 ]
We make the initial value of event ctrl register as HISI_PCIE_INIT_SET and modify according to the user options. This will make TLP headers bandwidth only counting never take effect since HISI_PCIE_INIT_SET configures to count the TLP payloads bandwidth. Fix this by making the initial value of event ctrl register as 0.
--- drivers/perf/hisilicon/hisi_pcie_pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/perf/hisilicon/hisi_pcie_pmu.c +1 -1
@@ -208,7 +208,7 @@ static void hisi_pcie_pmu_writeq(struct hisi_pcie_pmu *pcie_pmu, u32 reg_offset,static u64 hisi_pcie_pmu_get_event_ctrl_val (struct perf_event *event) {u64 port, trig_len, thr_len, len_mode; -u64 reg =HISI_PCIE_INIT_SET ; +u64 reg =0 ;/* Config HISI_PCIE_EVENT_CTRL according to event. */ reg |=FIELD_PREP (HISI_PCIE_EVENT_M ,hisi_pcie_get_real_event (event));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/695 kselftest/arm64: Actually test SME vector length changes via sigreturn
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 6f0315330af7a57c1c00587fdfb69c7778bf1c50 ]
The test case for SME vector length changes via sigreturn use a bit too much cut'n'paste and only actually changed the SVE vector length in the test itself. Andre's recent factoring out of the initialisation code caused this to be exposed and the test to start failing. Fix the test to actually cover the thing it's supposed to test.
--- .../testcases/fake_sigreturn_sme_change_vl.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c +7 -7
@@ -35,30 +35,30 @@ static int fake_sigreturn_ssve_change_vl(struct tdescr *td, {size_t resv_sz, offset;struct _aarch64_ctx *head =GET_SF_RESV_HEAD (sf); -struct sve_context *sve; +struct za_context *za;/* Get a signal context with a SME ZA frame in it */ if (!get_current_context (td, &sf.uc,sizeof (sf.uc)))return 1 ; resv_sz =GET_SF_RESV_SIZE (sf); - head =get_header (head,SVE_MAGIC , resv_sz, &offset); + head =get_header (head,ZA_MAGIC , resv_sz, &offset);if (!head) { -fprintf (stderr,"No SVE context\n" ); +fprintf (stderr,"No ZA context\n" );return 1 ; } -if (head->size !=sizeof (struct sve_context )) { +if (head->size !=sizeof (struct za_context )) {fprintf (stderr,"Register data present, aborting\n" );return 1 ; } - sve = (struct sve_context *)head; + za = (struct za_context *)head;/* No changes are supported; init left us at minimum VL so go to max */ fprintf (stderr,"Attempting to change VL from %d to %d\n" , - sve->vl, vls[0 ]); - sve->vl = vls[0 ]; + za->vl, vls[0 ]); + za->vl = vls[0 ];fake_sigreturn (&sf,sizeof (sf),0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/695 can: j1939: use correct function name in comment
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Changzhong <[email protected]>
[ Upstream commit dc2ddcd136fe9b6196a7dd01f75f824beb02d43f ]
The function j1939_cancel_all_active_sessions() was renamed to j1939_cancel_active_session() but name in comment wasn't updated.
--- net/can/j1939/transport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/can/j1939/transport.c +4 -4
@@ -1179,10 +1179,10 @@ static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer)break ;case -ENETDOWN :/* In this case we should get a netdev_event(), all active -* sessions will be cleared by -* j1939_cancel_all_active_sessions(). So handle this as an -* error, but let j1939_cancel_all_active_sessions() do the -* cleanup including propagation of the error to user space. +* sessions will be cleared by j1939_cancel_active_session(). +* So handle this as an error, but let +* j1939_cancel_active_session() do the cleanup including +* propagation of the error to user space. */ break ;case -EOVERFLOW :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/695 wifi: rtw89: wow: fix wait condition for AOAC report request
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit d9dd3ac77cf7cabd35732893f3aefba1daa1c2e1 ]
Each condition binding to the same wait should be unique. AOAC code misused the wait of FW offload series and broke the above rule. It added another macro to generate wait condition of WoWLAN/AOAC, but the results conflict to the ones of FW offload series. It means that we might be completed wrongly in logic. We don't want things work/read like this and should have avoided this.
Fix this by adding another wait which aims for WoWLAN functions.
--- drivers/net/wireless/realtek/rtw89/core.c | 1 + drivers/net/wireless/realtek/rtw89/core.h | 3 +++ drivers/net/wireless/realtek/rtw89/fw.c | 6 ++---- drivers/net/wireless/realtek/rtw89/fw.h | 7 +++++-- drivers/net/wireless/realtek/rtw89/mac.c | 6 ++---- 5 files changed, 13 insertions(+), 10 deletions(-)
drivers/net/wireless/realtek/rtw89/core.c +1 -0
@@ -4278,6 +4278,7 @@ int rtw89_core_init(struct rtw89_dev *rtwdev)rtw89_init_wait (&rtwdev->mcc.wait);rtw89_init_wait (&rtwdev->mac.fw_ofld_wait); +rtw89_init_wait (&rtwdev->wow.wait);INIT_WORK (&rtwdev->c2h_work, rtw89_fw_c2h_work);INIT_WORK (&rtwdev->ips_work, rtw89_ips_work);
drivers/net/wireless/realtek/rtw89/core.h +3 -0
@@ -5293,6 +5293,9 @@ struct rtw89_wow_param {u8 gtk_alg;u8 ptk_keyidx;u8 akm; + +/* see RTW89_WOW_WAIT_COND series for wait condition */ +struct rtw89_wait_info wait; };struct rtw89_mcc_limit {
drivers/net/wireless/realtek/rtw89/fw.c +2 -4
@@ -6825,11 +6825,10 @@ int rtw89_fw_h2c_wow_gtk_ofld(struct rtw89_dev *rtwdev,int rtw89_fw_h2c_wow_request_aoac (struct rtw89_dev *rtwdev) { -struct rtw89_wait_info *wait = &rtwdev->mac.fw_ofld_wait; +struct rtw89_wait_info *wait = &rtwdev->wow.wait;struct rtw89_h2c_wow_aoac *h2c;u32 len =sizeof (*h2c);struct sk_buff *skb; -unsigned int cond; skb =rtw89_fw_h2c_alloc_skb_with_hdr (rtwdev, len);if (!skb) {
@@ -6848,8 +6847,7 @@ int rtw89_fw_h2c_wow_request_aoac(struct rtw89_dev *rtwdev)H2C_FUNC_AOAC_REPORT_REQ ,1 ,0 , len); - cond =RTW89_WOW_WAIT_COND (H2C_FUNC_AOAC_REPORT_REQ ); -return rtw89_h2c_tx_and_wait (rtwdev, skb, wait, cond); +return rtw89_h2c_tx_and_wait (rtwdev, skb, wait,RTW89_WOW_WAIT_COND_AOAC ); }/* Return < 0, if failures happen during waiting for the condition.
drivers/net/wireless/realtek/rtw89/fw.h +5 -2
@@ -3942,8 +3942,11 @@ enum rtw89_wow_h2c_func { NUM_OF_RTW89_WOW_H2C_FUNC, }; -#define RTW89_WOW_WAIT_COND (func) \ - (NUM_OF_RTW89_WOW_H2C_FUNC + (func)) +#define RTW89_WOW_WAIT_COND (tag, func) \ + ((tag) * NUM_OF_RTW89_WOW_H2C_FUNC + (func)) + +#define RTW89_WOW_WAIT_COND_AOAC \ + RTW89_WOW_WAIT_COND(0 /* don't care */, H2C_FUNC_AOAC_REPORT_REQ)/* CLASS 2 - PS */ #define H2C_CL_MAC_PS 0x2
drivers/net/wireless/realtek/rtw89/mac.c +2 -4
@@ -5151,11 +5151,10 @@ rtw89_mac_c2h_wow_aoac_rpt(struct rtw89_dev *rtwdev, struct sk_buff *skb, u32 le {struct rtw89_wow_param *rtw_wow = &rtwdev->wow;struct rtw89_wow_aoac_report *aoac_rpt = &rtw_wow->aoac_rpt; -struct rtw89_wait_info *wait = &rtwdev->mac.fw_ofld_wait; +struct rtw89_wait_info *wait = &rtw_wow->wait;const struct rtw89_c2h_wow_aoac_report *c2h = (const struct rtw89_c2h_wow_aoac_report *)skb->data;struct rtw89_completion_data data = {}; -unsigned int cond; aoac_rpt->rpt_ver = c2h->rpt_ver; aoac_rpt->sec_type = c2h->sec_type;
@@ -5173,8 +5172,7 @@ rtw89_mac_c2h_wow_aoac_rpt(struct rtw89_dev *rtwdev, struct sk_buff *skb, u32 le aoac_rpt->igtk_ipn =le64_to_cpu (c2h->igtk_ipn);memcpy (aoac_rpt->igtk, c2h->igtk,sizeof (aoac_rpt->igtk)); - cond =RTW89_WOW_WAIT_COND (H2C_FUNC_AOAC_REPORT_REQ ); -rtw89_complete_cond (wait, cond, &data); +rtw89_complete_cond (wait,RTW89_WOW_WAIT_COND_AOAC , &data); } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/695 ACPI: CPPC: Fix MASK_VAL() usage
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Léger <[email protected]>
[ Upstream commit 60949b7b805424f21326b450ca4f1806c06d982e ]
MASK_VAL() was added as a way to handle bit_offset and bit_width for registers located in system memory address space. However, while suited for reading, it does not work for writing and result in corrupted registers when writing values with bit_offset > 0. Moreover, when a register is collocated with another one at the same address but with a different mask, the current code results in the other registers being overwritten with 0s. The write procedure for SYSTEM_MEMORY registers should actually read the value, mask it, update it and write it with the updated value. Moreover, since registers can be located in the same word, we must take care of locking the access before doing it. We should potentially use a global lock since we don't know in if register addresses aren't shared with another _CPC package but better not encourage vendors to do so. Assume that registers can use the same word inside a _CPC package and thus, use a per _CPC package lock.
--- drivers/acpi/cppc_acpi.c | 43 ++++++++++++++++++++++++++++++++++++---- include/acpi/cppc_acpi.h | 2 ++ 2 files changed, 41 insertions(+), 4 deletions(-)
drivers/acpi/cppc_acpi.c +39 -4
@@ -171,8 +171,11 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);#define GET_BIT_WIDTH (reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width)/* Shift and apply the mask for CPC reads/writes */ -#define MASK_VAL (reg, val) (((val) >> (reg)->bit_offset) & \ +#define MASK_VAL_READ (reg, val) (((val) >> (reg)->bit_offset) & \ GENMASK(((reg)->bit_width) - 1, 0)) +#define MASK_VAL_WRITE (reg, prev_val, val) \ + ((((val) & GENMASK(((reg)->bit_width) - 1, 0)) << (reg)->bit_offset) | \ + ((prev_val) & ~(GENMASK(((reg)->bit_width) - 1, 0) << (reg)->bit_offset))) \static ssize_t show_feedback_ctrs (struct kobject *kobj,struct kobj_attribute *attr,char *buf)
@@ -859,6 +862,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)/* Store CPU Logical ID */ cpc_ptr->cpu_id = pr->id; +spin_lock_init (&cpc_ptr->rmw_lock);/* Parse PSD data for this CPU */ ret =acpi_get_psd (cpc_ptr, handle);
@@ -1064,7 +1068,7 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) }if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) - *val =MASK_VAL (reg, *val); + *val =MASK_VAL_READ (reg, *val);return 0 ; }
@@ -1073,9 +1077,11 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val) {int ret_val =0 ;int size; +u64 prev_val;void __iomem *vaddr =NULL ;int pcc_ss_id =per_cpu (cpu_pcc_subspace_idx, cpu);struct cpc_reg *reg = ®_res->cpc_entry.reg; +struct cpc_desc *cpc_desc; size =GET_BIT_WIDTH (reg);
@@ -1108,8 +1114,34 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)return acpi_os_write_memory ((acpi_physical_address )reg->address, val, size); -if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) - val =MASK_VAL (reg, val); +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) { + cpc_desc =per_cpu (cpc_desc_ptr, cpu); +if (!cpc_desc) { +pr_debug ("No CPC descriptor for CPU:%d\n" , cpu); +return -ENODEV ; + } + +spin_lock (&cpc_desc->rmw_lock); +switch (size) { +case 8 : + prev_val =readb_relaxed (vaddr); +break ; +case 16 : + prev_val =readw_relaxed (vaddr); +break ; +case 32 : + prev_val =readl_relaxed (vaddr); +break ; +case 64 : + prev_val =readq_relaxed (vaddr); +break ; +default : +spin_unlock (&cpc_desc->rmw_lock); +return -EFAULT ; + } + val =MASK_VAL_WRITE (reg, prev_val, val); + val |= prev_val; + }switch (size) {case 8 :
@@ -1136,6 +1168,9 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)break ; } +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) +spin_unlock (&cpc_desc->rmw_lock); +return ret_val; }
include/acpi/cppc_acpi.h +2 -0
@@ -64,6 +64,8 @@ struct cpc_desc {int cpu_id;int write_cmd_status;int write_cmd_id; +/* Lock used for RMW operations in cpc_write() */ +spinlock_t rmw_lock;struct cpc_register_resource cpc_regs[MAX_CPC_REG_ENT ];struct acpi_psd_package domain_info;struct kobject kobj;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/695 netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e0c47281723f301894c14e6f5cd5884fdfb813f9 ]
Element timeout that is below CONFIG_HZ never expires because the timeout extension is not allocated given that nf_msecs_to_jiffies64() returns 0. Set timeout to the minimum value to honor timeout.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -4592,7 +4592,7 @@ int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)return -ERANGE ; ms *=NSEC_PER_MSEC ; - *result =nsecs_to_jiffies64 (ms); + *result =nsecs_to_jiffies64 (ms) ? : !!ms;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/695 netfilter: nf_tables: reject element expiration with no timeout
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit d2dc429ecb4e79ad164028d965c00f689e6f6d06 ]
If element timeout is unset and set provides no default timeout, the element expiration is silently ignored, reject this instead to let user know this is unsupported.
Also prepare for supporting timeout that never expire, where zero timeout and expiration must be also rejected.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -6922,6 +6922,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (nla[NFTA_SET_ELEM_EXPIRATION ] !=NULL ) {if (!(set->flags &NFT_SET_TIMEOUT ))return -EINVAL ; +if (timeout ==0 ) +return -EOPNOTSUPP ; + err =nf_msecs_to_jiffies64 (nla[NFTA_SET_ELEM_EXPIRATION ], &expiration);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/695 netfilter: nf_tables: reject expiration higher than timeout
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit c0f38a8c60174368aed1d0f9965d733195f15033 ]
Report ERANGE to userspace if user specifies an expiration larger than the timeout.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -6929,6 +6929,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, &expiration);if (err)return err; + +if (expiration > timeout) +return -ERANGE ; }if (nla[NFTA_SET_ELEM_EXPR ]) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/695 netfilter: nf_tables: remove annotation to access set timeout while holding lock
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 15d8605c0cf4fc9cf4386cae658c68a0fd4bdb92 ]
Mutex is held when adding an element, no need for READ_ONCE, remove it.
--- net/netfilter/nf_tables_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +2 -2
@@ -6915,7 +6915,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,return err; }else if (set->flags &NFT_SET_TIMEOUT && !(flags &NFT_SET_ELEM_INTERVAL_END )) { - timeout =READ_ONCE (set->timeout); + timeout = set->timeout; } expiration =0 ;
@@ -7022,7 +7022,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (err <0 ) goto err_parse_key_end; -if (timeout !=READ_ONCE (set->timeout)) { +if (timeout != set->timeout) { err =nft_set_ext_add (&tmpl,NFT_SET_EXT_TIMEOUT );if (err <0 ) goto err_parse_key_end;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/695 netfilter: nft_dynset: annotate data-races around set timeout
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit c5ad8ed61fa8410b272c077ec167c593602b4542 ]
set timeout can be read locklessly while being updated from control plane, add annotation.
--- net/netfilter/nft_dynset.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/netfilter/nft_dynset.c +3 -3
@@ -56,7 +56,7 @@ static struct nft_elem_priv *nft_dynset_new(struct nft_set *set,if (!atomic_add_unless (&set->nelems,1 , set->size))return NULL ; - timeout = priv->timeout ? : set->timeout; + timeout = priv->timeout ? :READ_ONCE (set->timeout); elem_priv = nft_set_elem_init(set, &priv->tmpl, ®s->data[priv->sreg_key], NULL, ®s->data[priv->sreg_data],
@@ -95,7 +95,7 @@ void nft_dynset_eval(const struct nft_expr *expr, expr, regs, &ext)) {if (priv->op ==NFT_DYNSET_OP_UPDATE &&nft_set_ext_exists (ext,NFT_SET_EXT_EXPIRATION )) { - timeout = priv->timeout ? : set->timeout; + timeout = priv->timeout ? :READ_ONCE (set->timeout); *nft_set_ext_expiration (ext) =get_jiffies_64 () + timeout; }
@@ -313,7 +313,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx,nft_dynset_ext_add_expr (priv);if (set->flags &NFT_SET_TIMEOUT ) { -if (timeout || set->timeout) { +if (timeout ||READ_ONCE (set->timeout)) {nft_set_ext_add (&priv->tmpl,NFT_SET_EXT_TIMEOUT );nft_set_ext_add (&priv->tmpl,NFT_SET_EXT_EXPIRATION ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/695 perf/arm-cmn: Refactor node ID handling. Again.
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit e79634b53e398966c49f803c49701bc74dc3ccf8 ]
The scope of the "extra device ports" configuration is not made clear by the CMN documentation - so far we've assumed it applies globally, based on the sole example which suggests as much. However it transpires that this is incorrect, and the format does in fact vary based on each individual XP's port configuration. As a consequence, we're currenly liable to decode the port/device indices from a node ID incorrectly, thus program the wrong event source in the DTM leading to bogus event counts, and also show device topology on the wrong ports in debugfs.
To put this right, rework node IDs yet again to carry around the additional data necessary to decode them properly per-XP. At this point the notion of fully decomposing an ID becomes more impractical than it's worth, so unabstracting the XY mesh coordinates (where 2/3 users were just debug anyway) ends up leaving things a bit simpler overall.
--- drivers/perf/arm-cmn.c | 94 ++++++++++++++++++------------------------ 1 file changed, 40 insertions(+), 54 deletions(-)
drivers/perf/arm-cmn.c +40 -54
@@ -24,14 +24,6 @@#define CMN_NI_NODE_ID GENMASK_ULL(31, 16)#define CMN_NI_LOGICAL_ID GENMASK_ULL(47, 32) -#define CMN_NODEID_DEVID (reg) ((reg) & 3) -#define CMN_NODEID_EXT_DEVID (reg) ((reg) & 1) -#define CMN_NODEID_PID (reg) (((reg) >> 2) & 1) -#define CMN_NODEID_EXT_PID (reg) (((reg) >> 1) & 3) -#define CMN_NODEID_1x1_PID (reg) (((reg) >> 2) & 7) -#define CMN_NODEID_X (reg, bits) ((reg) >> (3 + (bits))) -#define CMN_NODEID_Y (reg, bits) (((reg) >> 3) & ((1U << (bits)) - 1)) -#define CMN_CHILD_INFO 0x0080#define CMN_CI_CHILD_COUNT GENMASK_ULL(15, 0)#define CMN_CI_CHILD_PTR_OFFSET GENMASK_ULL(31, 16)
@@ -280,8 +272,11 @@ struct arm_cmn_node {u16 id, logid;enum cmn_node_type type; +/* XP properties really, but replicated to children for convenience */ u8 dtm;s8 dtc; + u8 portid_bits:4; + u8 deviceid_bits:4;/* DN/HN-F/CXHA */ struct {u8 val :4 ;
@@ -357,49 +352,33 @@ struct arm_cmn {static int arm_cmn_hp_state;struct arm_cmn_nodeid { -u8 x; -u8 y;u8 port;u8 dev; };static int arm_cmn_xyidbits (const struct arm_cmn *cmn) { -return fls ((cmn->mesh_x -1 ) | (cmn->mesh_y -1 ) |2 ); +return fls ((cmn->mesh_x -1 ) | (cmn->mesh_y -1 )); } -static struct arm_cmn_nodeid arm_cmn_nid (const struct arm_cmn *cmn,u16 id) +static struct arm_cmn_nodeid arm_cmn_nid (const struct arm_cmn_node *dn) {struct arm_cmn_nodeid nid; -if (cmn->num_xps ==1 ) { - nid.x =0 ; - nid.y =0 ; - nid.port =CMN_NODEID_1x1_PID (id); - nid.dev =CMN_NODEID_DEVID (id); - }else { -int bits =arm_cmn_xyidbits (cmn); - - nid.x =CMN_NODEID_X (id, bits); - nid.y =CMN_NODEID_Y (id, bits); -if (cmn->ports_used &0xc ) { - nid.port =CMN_NODEID_EXT_PID (id); - nid.dev =CMN_NODEID_EXT_DEVID (id); - }else { - nid.port =CMN_NODEID_PID (id); - nid.dev =CMN_NODEID_DEVID (id); - } - } + nid.dev = dn->id & ((1U << dn->deviceid_bits) -1 ); + nid.port = (dn->id >> dn->deviceid_bits) & ((1U << dn->portid_bits) -1 );return nid; }static struct arm_cmn_node *arm_cmn_node_to_xp (const struct arm_cmn *cmn,const struct arm_cmn_node *dn) { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id); -int xp_idx = cmn->mesh_x * nid.y + nid.x; +int id = dn->id >> (dn->portid_bits + dn->deviceid_bits); +int bits =arm_cmn_xyidbits (cmn); +int x = id >> bits; +int y = id & ((1U << bits) -1 ); -return cmn->xps + xp_idx; +return cmn->xps + cmn->mesh_x * y + x; }static struct arm_cmn_node *arm_cmn_node (const struct arm_cmn *cmn,enum cmn_node_type type)
@@ -485,13 +464,13 @@ static const char *arm_cmn_device_type(u8 type) } } -static void arm_cmn_show_logid (struct seq_file *s,int x,int y,int p,int d) +static void arm_cmn_show_logid (struct seq_file *s,const struct arm_cmn_node *xp,int p,int d) {struct arm_cmn *cmn = s->private;struct arm_cmn_node *dn; +u16 id = xp->id | d | (p << xp->deviceid_bits);for (dn = cmn->dns; dn->type; dn++) { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id);int pad = dn->logid <10 ;if (dn->type ==CMN_TYPE_XP )
@@ -500,7 +479,7 @@ static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)if (dn->type <CMN_TYPE_HNI )continue ; -if (nid.x != x || nid.y != y || nid.port != p || nid.dev != d) +if (dn->id != id)continue ;seq_printf (s," %*c#%-*d |" , pad +1 ,' ' ,3 - pad, dn->logid);
@@ -521,6 +500,7 @@ static int arm_cmn_map_show(struct seq_file *s, void *data) y = cmn->mesh_y;while (y--) {int xp_base = cmn->mesh_x * y; +struct arm_cmn_node *xp = cmn->xps + xp_base;u8 port[CMN_MAX_PORTS ][CMN_MAX_DIMENSION ];for (x =0 ; x < cmn->mesh_x; x++)
@@ -528,16 +508,14 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)seq_printf (s,"\n%-2d |" , y);for (x =0 ; x < cmn->mesh_x; x++) { -struct arm_cmn_node *xp = cmn->xps + xp_base + x; -for (p =0 ; p <CMN_MAX_PORTS ; p++) - port[p][x] =arm_cmn_device_connect_info (cmn, xp, p); + port[p][x] =arm_cmn_device_connect_info (cmn, xp + x, p);seq_printf (s," XP #%-3d|" , xp_base + x); }seq_puts (s,"\n |" );for (x =0 ; x < cmn->mesh_x; x++) { -s8 dtc = cmn->xps[xp_base + x].dtc; +s8 dtc = xp[x].dtc;if (dtc <0 )seq_puts (s," DTC ?? |" );
@@ -554,10 +532,10 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)seq_puts (s,arm_cmn_device_type (port[p][x]));seq_puts (s,"\n 0|" );for (x =0 ; x < cmn->mesh_x; x++) -arm_cmn_show_logid (s, x, y, p,0 ); +arm_cmn_show_logid (s, xp + x, p,0 );seq_puts (s,"\n 1|" );for (x =0 ; x < cmn->mesh_x; x++) -arm_cmn_show_logid (s, x, y, p,1 ); +arm_cmn_show_logid (s, xp + x, p,1 ); }seq_puts (s,"\n-----+" ); }
@@ -1815,10 +1793,7 @@ static int arm_cmn_event_init(struct perf_event *event) }if (!hw->num_dns) { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, nodeid); - -dev_dbg (cmn->dev,"invalid node 0x%x (%d,%d,%d,%d) type 0x%x\n" , - nodeid, nid.x, nid.y, nid.port, nid.dev, type); +dev_dbg (cmn->dev,"invalid node 0x%x type 0x%x\n" , nodeid, type);return -EINVAL ; }
@@ -1921,7 +1896,7 @@ static int arm_cmn_event_add(struct perf_event *event, int flags)arm_cmn_claim_wp_idx (dtm, event, d, wp_idx, i);writel_relaxed (cfg, dtm->base +CMN_DTM_WPn_CONFIG (wp_idx)); }else { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id); +struct arm_cmn_nodeid nid =arm_cmn_nid (dn);if (cmn->multi_dtm) nid.port %=2 ;
@@ -2168,10 +2143,12 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn)continue ; xp =arm_cmn_node_to_xp (cmn, dn); + dn->portid_bits = xp->portid_bits; + dn->deviceid_bits = xp->deviceid_bits; dn->dtc = xp->dtc; dn->dtm = xp->dtm;if (cmn->multi_dtm) - dn->dtm +=arm_cmn_nid (cmn, dn->id).port /2 ; + dn->dtm +=arm_cmn_nid (dn).port /2 ;if (dn->type ==CMN_TYPE_DTC ) {int err =arm_cmn_init_dtc (cmn, dn, dtc_idx++);
@@ -2341,18 +2318,27 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)arm_cmn_init_dtm (dtm++, xp,0 );/* * Keeping track of connected ports will let us filter out -* unnecessary XP events easily. We can also reliably infer the -* "extra device ports" configuration for the node ID format -* from this, since in that case we will see at least one XP -* with port 2 connected, for the HN-D. +* unnecessary XP events easily, and also infer the per-XP +* part of the node ID format. */ for (int p =0 ; p <CMN_MAX_PORTS ; p++)if (arm_cmn_device_connect_info (cmn, xp, p)) xp_ports |=BIT (p); -if (cmn->multi_dtm && (xp_ports &0xc )) +if (cmn->num_xps ==1 ) { + xp->portid_bits =3 ; + xp->deviceid_bits =2 ; + }else if (xp_ports >0x3 ) { + xp->portid_bits =2 ; + xp->deviceid_bits =1 ; + }else { + xp->portid_bits =1 ; + xp->deviceid_bits =2 ; + } + +if (cmn->multi_dtm && (xp_ports >0x3 ))arm_cmn_init_dtm (dtm++, xp,1 ); -if (cmn->multi_dtm && (xp_ports &0x30 )) +if (cmn->multi_dtm && (xp_ports >0xf ))arm_cmn_init_dtm (dtm++, xp,2 ); cmn->ports_used |= xp_ports;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/695 perf/arm-cmn: Fix CCLA register offset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit 88b63a82c84ed9bbcbdefb10cb6f75dd1dd04887 ]
Apparently pmu_event_sel is offset by 8 for all CCLA nodes, not just the CCLA_RNI combination type.
--- drivers/perf/arm-cmn.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/perf/arm-cmn.c +7 -3
@@ -70,7 +70,8 @@/* Technically this is 4 bits wide on DNs, but we only use 2 there anyway */ #define CMN__PMU_OCCUP1_ID GENMASK_ULL(34, 32) -/* HN-Ps are weird... */ +/* Some types are designed to coexist with another device in the same node */ +#define CMN_CCLA_PMU_EVENT_SEL 0x008#define CMN_HNP_PMU_EVENT_SEL 0x008/* DTMs live in the PMU space of XP registers */
@@ -2393,10 +2394,13 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)case CMN_TYPE_CXHA :case CMN_TYPE_CCRA :case CMN_TYPE_CCHA : -case CMN_TYPE_CCLA :case CMN_TYPE_HNS : dn++;break ; +case CMN_TYPE_CCLA : + dn->pmu_base +=CMN_CCLA_PMU_EVENT_SEL ; + dn++; +break ;/* Nothing to see here */ case CMN_TYPE_MPAM_S :case CMN_TYPE_MPAM_NS :
@@ -2414,7 +2418,7 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)case CMN_TYPE_HNP :case CMN_TYPE_CCLA_RNI : dn[1 ] = dn[0 ]; - dn[0 ].pmu_base +=CMN_HNP_PMU_EVENT_SEL ; + dn[0 ].pmu_base +=CMN_CCLA_PMU_EVENT_SEL ; dn[1 ].type =arm_cmn_subtype (dn->type); dn +=2 ;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/695 perf/arm-cmn: Ensure dtm_idx is big enough
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit 359414b33e00bae91e4eabf3e4ef8e76024c7673 ]
While CMN_MAX_DIMENSION was bumped to 12 for CMN-650, that only supports up to a 10x10 mesh, so bumping dtm_idx to 256 bits at the time worked out OK in practice. However CMN-700 did finally support up to 144 XPs, and thus needs a worst-case 288 bits of dtm_idx for an aggregated XP event on a maxed-out config. Oops.
--- drivers/perf/arm-cmn.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/perf/arm-cmn.c +4 -1
@@ -35,6 +35,9 @@#define CMN_MAX_XPS (CMN_MAX_DIMENSION * CMN_MAX_DIMENSION)#define CMN_MAX_DTMS (CMN_MAX_XPS + (CMN_MAX_DIMENSION - 1) * 4) +/* Currently XPs are the node type we can have most of; others top out at 128 */ +#define CMN_MAX_NODES_PER_EVENT CMN_MAX_XPS +/* The CFG node has various info besides the discovery tree */ #define CMN_CFGM_PERIPH_ID_01 0x0008#define CMN_CFGM_PID0_PART_0 GENMASK_ULL(7, 0)
@@ -564,7 +567,7 @@ static void arm_cmn_debugfs_init(struct arm_cmn *cmn, int id) {}struct arm_cmn_hw_event {struct arm_cmn_node *dn; -u64 dtm_idx[4 ]; +u64 dtm_idx[DIV_ROUND_UP (CMN_MAX_NODES_PER_EVENT *2 ,64 )];s8 dtc_idx[CMN_MAX_DTCS ];u8 num_dns;u8 dtm_offset;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/695 cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
[ Upstream commit abc00ffda43bd4ba85896713464c7510c39f8165 ]
Commit b4bc9f9e27ed ("cpufreq: ti-cpufreq: add support for omap34xx and omap36xx") introduced special handling for OMAP3 class devices where syscon node may not be present. However, this also creates a bug where the syscon node is present, however the offset used to read is beyond the syscon defined range.
Fix this by providing a quirk option that is populated when such special handling is required. This allows proper failure for all other platforms when the syscon node and efuse offsets are mismatched.
--- drivers/cpufreq/ti-cpufreq.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/cpufreq/ti-cpufreq.c +8 -2
@@ -90,6 +90,9 @@ struct ti_cpufreq_soc_data {unsigned long efuse_shift;unsigned long rev_offset;bool multi_regulator; +/* Backward compatibility hack: Might have missing syscon */ +#define TI_QUIRK_SYSCON_MAY_BE_MISSING 0x1 +u8 quirks; };struct ti_cpufreq_data {
@@ -254,6 +257,7 @@ static struct ti_cpufreq_soc_data omap34xx_soc_data = { .efuse_mask = BIT(3), .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = false, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };/*
@@ -281,6 +285,7 @@ static struct ti_cpufreq_soc_data omap36xx_soc_data = { .efuse_mask = BIT(9), .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = true, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };/*
@@ -295,6 +300,7 @@ static struct ti_cpufreq_soc_data am3517_soc_data = { .efuse_mask = 0, .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = false, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };static struct ti_cpufreq_soc_data am625_soc_data = {
@@ -340,7 +346,7 @@ static int ti_cpufreq_get_efuse(struct ti_cpufreq_data *opp_data, ret =regmap_read (opp_data->syscon, opp_data->soc_data->efuse_offset, &efuse); -if (ret == -EIO ) { +if (opp_data->soc_data->quirks &TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO ) {/* not a syscon register! */ void __iomem *regs =ioremap (OMAP3_SYSCON_BASE + opp_data->soc_data->efuse_offset,4 );
@@ -381,7 +387,7 @@ static int ti_cpufreq_get_rev(struct ti_cpufreq_data *opp_data, ret =regmap_read (opp_data->syscon, opp_data->soc_data->rev_offset, &revision); -if (ret == -EIO ) { +if (opp_data->soc_data->quirks &TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO ) {/* not a syscon register! */ void __iomem *regs =ioremap (OMAP3_SYSCON_BASE + opp_data->soc_data->rev_offset,4 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/695 thermal: gov_bang_bang: Adjust states of all uninitialized instances
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 15cb56bd529868d9242b22812fc69bd144bfdc94 ]
If a cooling device is registered after a thermal zone it should be bound to and the trip point it should be bound to has already been crossed by the zone temperature on the way up, the cooling device's state may need to be adjusted, but the Bang-bang governor will not do that because its .manage() callback only looks at thermal instances for trip points whose thresholds are below or at the zone temperature.
Address this by updating bang_bang_manage() to look at all of the uninitialized thermal instances and setting their target states in accordance with the position of the zone temperature with respect to the threshold of the given trip point.
--- drivers/thermal/gov_bang_bang.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/thermal/gov_bang_bang.c +6 -8
@@ -92,23 +92,21 @@ static void bang_bang_manage(struct thermal_zone_device *tz)for_each_trip_desc (tz, td) {const struct thermal_trip *trip = &td->trip; +bool turn_on; -if (tz->temperature >= td->threshold || - trip->temperature ==THERMAL_TEMP_INVALID || +if (trip->temperature ==THERMAL_TEMP_INVALID || trip->type ==THERMAL_TRIP_CRITICAL || trip->type ==THERMAL_TRIP_HOT )continue ;/* -* If the initial cooling device state is "on", but the zone -* temperature is not above the trip point, the core will not -* call bang_bang_control() until the zone temperature reaches -* the trip point temperature which may be never. In those -* cases, set the initial state of the cooling device to 0. +* Adjust the target states for uninitialized thermal instances +* to the thermal zone temperature and the trip point threshold. */ + turn_on = tz->temperature >= td->threshold;list_for_each_entry (instance, &tz->thermal_instances, tz_node) {if (!instance->initialized && instance->trip == trip) -bang_bang_set_instance_target (instance,0 ); +bang_bang_set_instance_target (instance, turn_on); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/695 wifi: mt76: mt7915: fix oops on non-dbdc mt7986
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <[email protected]>
[ Upstream commit 862bf7cbd772c2bad570ef0c5b5556a1330656dd ]
mt7915_band_config() sets band_idx = 1 on the main phy for mt7986 with MT7975_ONE_ADIE or MT7976_ONE_ADIE.
Commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status") introduced a dereference of the phys array indirectly indexed by band_idx via wcid->phy_idx in mt76_wcid_cleanup(). This caused the following Oops on affected mt7986 devices:
Unable to handle kernel read from unreadable memory at virtual address 0000000000000024 Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005 CM = 0, WnR = 0 user pgtable: 4k pages, 39-bit VAs, pgdp=0000000042545000 [0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 Internal error: Oops: 0000000096000005 [#1] SMP Modules linked in: ... mt7915e mt76_connac_lib mt76 mac80211 cfg80211 ... CPU: 2 PID: 1631 Comm: hostapd Not tainted 5.15.150 #0 Hardware name: ZyXEL EX5700 (Telenor) (DT) pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mt76_wcid_cleanup+0x84/0x22c [mt76] lr : mt76_wcid_cleanup+0x64/0x22c [mt76] sp : ffffffc00a803700 x29: ffffffc00a803700 x28: ffffff80008f7300 x27: ffffff80003f3c00 x26: ffffff80000a7880 x25: ffffffc008c26e00 x24: 0000000000000001 x23: ffffffc000a68114 x22: 0000000000000000 x21: ffffff8004172cc8 x20: ffffffc00a803748 x19: ffffff8004152020 x18: 0000000000000000 x17: 00000000000017c0 x16: ffffffc008ef5000 x15: 0000000000000be0 x14: ffffff8004172e28 x13: ffffff8004172e28 x12: 0000000000000000 x11: 0000000000000000 x10: ffffff8004172e30 x9 : ffffff8004172e28 x8 : 0000000000000000 x7 : ffffff8004156020 x6 : 0000000000000000 x5 : 0000000000000031 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000000 x1 : ffffff80008f7300 x0 : 0000000000000024 Call trace: mt76_wcid_cleanup+0x84/0x22c [mt76] __mt76_sta_remove+0x70/0xbc [mt76] mt76_sta_state+0x8c/0x1a4 [mt76] mt7915_eeprom_get_power_delta+0x11e4/0x23a0 [mt7915e] drv_sta_state+0x144/0x274 [mac80211] sta_info_move_state+0x1cc/0x2a4 [mac80211] sta_set_sinfo+0xaf8/0xc24 [mac80211] sta_info_destroy_addr_bss+0x4c/0x6c [mac80211] ieee80211_color_change_finish+0x1c08/0x1e70 [mac80211] cfg80211_check_station_change+0x1360/0x4710 [cfg80211] genl_family_rcv_msg_doit+0xb4/0x110 genl_rcv_msg+0xd0/0x1bc netlink_rcv_skb+0x58/0x120 genl_rcv+0x34/0x50 netlink_unicast+0x1f0/0x2ec netlink_sendmsg+0x198/0x3d0 ____sys_sendmsg+0x1b0/0x210 ___sys_sendmsg+0x80/0xf0 __sys_sendmsg+0x44/0xa0 __arm64_sys_sendmsg+0x20/0x30 invoke_syscall.constprop.0+0x4c/0xe0 do_el0_svc+0x40/0xd0 el0_svc+0x14/0x4c el0t_64_sync_handler+0x100/0x110 el0t_64_sync+0x15c/0x160 Code: d2800002 910092c0 52800023 f9800011 (885f7c01) ---[ end trace 7e42dd9a39ed2281 ]---
Fix by using mt76_dev_phy() which will map band_idx to the correct phy for all hardware combinations.
--- drivers/net/wireless/mediatek/mt76/mac80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mac80211.c +1 -1
@@ -1529,7 +1529,7 @@ EXPORT_SYMBOL_GPL(mt76_wcid_init);void mt76_wcid_cleanup (struct mt76_dev *dev,struct mt76_wcid *wcid) { -struct mt76_phy *phy = dev->phys[wcid->phy_idx]; +struct mt76_phy *phy =mt76_dev_phy (dev, wcid->phy_idx);struct ieee80211_hw *hw;struct sk_buff_head list;struct sk_buff *skb;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/695 wifi: mt76: mt7921: fix wrong UNII-4 freq range check for the channel usage
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Yen Hsieh <[email protected]>
[ Upstream commit 723762a7a7e6fdb3cc6953f127a3fe9c5162beb7 ]
The check should start from 5845 to 5925, which includes channels 169, 173, and 177.
--- drivers/net/wireless/mediatek/mt76/mt7921/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7921/init.c +1 -1
@@ -83,7 +83,7 @@ mt7921_regd_channel_update(struct wiphy *wiphy, struct mt792x_dev *dev) }/* UNII-4 */ -if (IS_UNII_INVALID (0 ,5850 ,5925 )) +if (IS_UNII_INVALID (0 ,5845 ,5925 )) ch->flags |=IEEE80211_CHAN_DISABLED ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/695 wifi: mt76: mt7996: use hweight16 to get correct tx antenna
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chiu <[email protected]>
[ Upstream commit f98c3de92bb05dac4a4969df8a4595ed380b4604 ]
The chainmask is u16 so using hweight8 cannot get correct tx_ant. Without this patch, the tx_ant of band 2 would be -1 and lead to the following issue:
BUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]
--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +1 -1
@@ -1653,7 +1653,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb, {struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;struct mt7996_phy *phy = mvif->phy; -int tx_ant =hweight8 (phy->mt76->chainmask) -1 ; +int tx_ant =hweight16 (phy->mt76->chainmask) -1 ;struct sta_rec_bf *bf;struct tlv *tlv;static const u8 matrix[4 ][4 ] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/695 wifi: mt76: mt7996: fix traffic delay when switching back to working channel
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chiu <[email protected]>
[ Upstream commit 376200f095d0c3a7096199b336204698d7086279 ]
During scanning, UNI_CHANNEL_RX_PATH tag is necessary for the firmware to properly stop and resume MAC TX queue. Without this tag, HW needs more time to resume traffic when switching back to working channel.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +4 -0
@@ -307,6 +307,10 @@ int mt7996_set_channel(struct mt7996_phy *phy)if (ret) goto out; + ret =mt7996_mcu_set_chan_info (phy,UNI_CHANNEL_RX_PATH ); +if (ret) + goto out; + ret =mt7996_dfs_init_radar_detector (phy);mt7996_mac_cca_stats_reset (phy);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/695 wifi: mt76: mt7996: fix wmm set of station interface to 3
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chiu <[email protected]>
[ Upstream commit 9265397caacf5c0c2d10c40b2958a474664ebd9e ]
According to connac3 HW design, the WMM index of AP and STA interface should be 0 and 3, respectively.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +1 -1
@@ -206,7 +206,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw, mvif->mt76.omac_idx = idx; mvif->phy = phy; mvif->mt76.band_idx = band_idx; - mvif->mt76.wmm_idx = vif->type !=NL80211_IFTYPE_AP ; + mvif->mt76.wmm_idx = vif->type ==NL80211_IFTYPE_AP ?0 :3 ; ret =mt7996_mcu_add_dev_info (phy, vif, true);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/695 wifi: mt76: mt7996: fix HE and EHT beamforming capabilities
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Howard Hsu <[email protected]>
[ Upstream commit e1f4847fdbdf5d44ae60e035c131920e5ab88598 ]
Fix HE and EHT beamforming capabilities for different bands and interface types.
--- .../net/wireless/mediatek/mt76/mt7996/init.c | 65 ++++++++++++------- 1 file changed, 43 insertions(+), 22 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/init.c +43 -22
@@ -1011,8 +1011,6 @@ mt7996_set_stream_he_txbf_caps(struct mt7996_phy *phy,return ; elem->phy_cap_info[3 ] |=IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER ; -if (vif ==NL80211_IFTYPE_AP ) - elem->phy_cap_info[4 ] |=IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER ; c =FIELD_PREP (IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK , sts - 1) |
@@ -1020,6 +1018,11 @@ mt7996_set_stream_he_txbf_caps(struct mt7996_phy *phy, sts - 1); elem->phy_cap_info[5 ] |= c; +if (vif !=NL80211_IFTYPE_AP ) +return ; + + elem->phy_cap_info[4 ] |=IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER ; + c =IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB ; elem->phy_cap_info[6 ] |= c;
@@ -1179,7 +1182,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,IEEE80211_EHT_MAC_CAP0_OM_CONTROL ; eht_cap_elem->phy_cap_info[0 ] = -IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE ;
@@ -1193,30 +1195,36 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,u8_encode_bits (u8_get_bits (val,GENMASK (2 ,1 )),IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK ) |u8_encode_bits (val, -IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK ) | -u8_encode_bits (val, -IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK ); +IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK ); eht_cap_elem->phy_cap_info[2 ] =u8_encode_bits (sts -1 ,IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK ) | -u8_encode_bits (sts -1 ,IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK ) | -u8_encode_bits (sts -1 ,IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK ); +u8_encode_bits (sts -1 ,IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK ); + +if (band ==NL80211_BAND_6GHZ ) { + eht_cap_elem->phy_cap_info[0 ] |= +IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ ; + + eht_cap_elem->phy_cap_info[1 ] |= +u8_encode_bits (val, +IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK ); + + eht_cap_elem->phy_cap_info[2 ] |= +u8_encode_bits (sts -1 , +IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK ); + } eht_cap_elem->phy_cap_info[3 ] =IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK | -IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK | -IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK | -IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK | -IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK ; +IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK ; eht_cap_elem->phy_cap_info[4 ] =u8_encode_bits (min_t (int, sts -1 ,2 ),IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK ); eht_cap_elem->phy_cap_info[5 ] = -IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |u8_encode_bits (IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US ,IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK ) | u8_encode_bits(u8_get_bits(0x11, GENMASK(1, 0)),
@@ -1230,14 +1238,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band, IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK) |u8_encode_bits (val,IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK ); - eht_cap_elem->phy_cap_info[7 ] = -IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ | -IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ | -IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ | -IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ | -IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ | -IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ ; - val =u8_encode_bits (nss,IEEE80211_EHT_MCS_NSS_RX ) |u8_encode_bits (nss,IEEE80211_EHT_MCS_NSS_TX );#define SET_EHT_MAX_NSS (_bw, _val) do { \
@@ -1248,8 +1248,29 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,SET_EHT_MAX_NSS (80 , val);SET_EHT_MAX_NSS (160 , val); -SET_EHT_MAX_NSS (320 , val); +if (band ==NL80211_BAND_6GHZ ) +SET_EHT_MAX_NSS (320 , val);#undef SET_EHT_MAX_NSS + +if (iftype !=NL80211_IFTYPE_AP ) +return ; + + eht_cap_elem->phy_cap_info[3 ] |= +IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK | +IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK ; + + eht_cap_elem->phy_cap_info[7 ] = +IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ | +IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ | +IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ | +IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ ; + +if (band !=NL80211_BAND_6GHZ ) +return ; + + eht_cap_elem->phy_cap_info[7 ] |= +IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ | +IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ ; } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/695 wifi: mt76: mt7996: fix EHT beamforming capability check
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Howard Hsu <[email protected]>
[ Upstream commit 9ca65757f0a5b393a7737d37f377d5daf91716af ]
If a VIF acts as a beamformer, it should check peer's beamformee capability, and vice versa.
--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +2 -2
@@ -1429,10 +1429,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,if (bfee)return vif->bss_conf.eht_su_beamformee && -EHT_PHY (CAP0_SU_BEAMFORMEE , pe->phy_cap_info[0 ]); +EHT_PHY (CAP0_SU_BEAMFORMER , pe->phy_cap_info[0 ]);else return vif->bss_conf.eht_su_beamformer && -EHT_PHY (CAP0_SU_BEAMFORMER , pe->phy_cap_info[0 ]); +EHT_PHY (CAP0_SU_BEAMFORMEE , pe->phy_cap_info[0 ]); }if (sta->deflink.he_cap.has_he) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/695 x86/sgx: Fix deadlock in SGX NUMA node search
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Lu <[email protected]>
[ Upstream commit 9c936844010466535bd46ea4ce4656ef17653644 ]
When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask.
Also worth mentioning is that it's perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality.
Rework the loop to start and end on *a* node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.
--- arch/x86/kernel/cpu/sgx/main.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
arch/x86/kernel/cpu/sgx/main.c +14 -13
@@ -475,24 +475,25 @@ struct sgx_epc_page *__sgx_alloc_epc_page(void) {struct sgx_epc_page *page;int nid_of_current =numa_node_id (); -int nid = nid_of_current; +int nid_start, nid; -if (node_isset (nid_of_current, sgx_numa_mask)) { - page =__sgx_alloc_epc_page_from_node (nid_of_current); -if (page) -return page; - } - -/* Fall back to the non-local NUMA nodes: */ -while (true) { - nid =next_node_in (nid, sgx_numa_mask); -if (nid == nid_of_current) -break ; +/* +* Try local node first. If it doesn't have an EPC section, +* fall back to the non-local NUMA nodes. +*/ +if (node_isset (nid_of_current, sgx_numa_mask)) + nid_start = nid_of_current; +else + nid_start =next_node_in (nid_of_current, sgx_numa_mask); + nid = nid_start; +do { page =__sgx_alloc_epc_page_from_node (nid);if (page)return page; - } + + nid =next_node_in (nid, sgx_numa_mask); + }while (nid != nid_start);return ERR_PTR (-ENOMEM ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/695 pm:cpupower: Add missing powercap_set_enabled() stub function
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: John B. Wyatt IV <[email protected]>
[ Upstream commit 4b80294fb53845dc5c98cca0c989da09150f2ca9 ]
There was a symbol listed in the powercap.h file that was not implemented. Implement it with a stub return of 0.
Programs like SWIG require that functions that are defined in the headers be implemented.
--- tools/power/cpupower/lib/powercap.c | 8 ++++++++ 1 file changed, 8 insertions(+)
tools/power/cpupower/lib/powercap.c +8 -0
@@ -77,6 +77,14 @@ int powercap_get_enabled(int *mode)return sysfs_get_enabled (path, mode); } +/* +* TODO: implement function. Returns dummy 0 for now. +*/ +int powercap_set_enabled (int mode) +{ +return 0 ; +} +/* * Hardcoded, because rapl is the only powercap implementation - * this needs to get more generic if more powercap implementations
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/695 crypto: ccp - do not request interrupt on cmd completion when irqs disabled
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Shah <[email protected]>
[ Upstream commit 3401f63e72596dcb7d912a5b67b4291643cc1034 ]
While sending a command to the PSP, we always requested an interrupt from the PSP after command completion. This worked for most cases. For the special case of irqs being disabled -- e.g. when running within crashdump or kexec contexts, we should not set the SEV_CMDRESP_IOC flag, so the PSP knows to not attempt interrupt delivery.
--- drivers/crypto/ccp/sev-dev.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/crypto/ccp/sev-dev.c +12 -1
@@ -910,7 +910,18 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret) sev->int_rcvd =0 ; - reg =FIELD_PREP (SEV_CMDRESP_CMD , cmd) |SEV_CMDRESP_IOC ; + reg =FIELD_PREP (SEV_CMDRESP_CMD , cmd); + +/* +* If invoked during panic handling, local interrupts are disabled so +* the PSP command completion interrupt can't be used. +* sev_wait_cmd_ioc() already checks for interrupts disabled and +* polls for PSP command completion. Ensure we do not request an +* interrupt from the PSP if irqs disabled. +*/ +if (!irqs_disabled ()) + reg |=SEV_CMDRESP_IOC ; +iowrite32 (reg, sev->io_regs + sev->vdata->cmdresp_reg);/* wait for command completion */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/695 crypto: hisilicon/hpre - mask cluster timeout error
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit 145013f723947c83b1a5f76a0cf6e7237d59e973 ]
The timeout threshold of the hpre cluster is 16ms. When the CPU and device share virtual address, page fault processing time may exceed the threshold.
In the current test, there is a high probability that the cluster times out. However, the cluster is waiting for the completion of memory access, which is not an error, the device does not need to be reset. If an error occurs in the cluster, qm also reports the error. Therefore, the cluster timeout error of hpre can be masked.
--- drivers/crypto/hisilicon/hpre/hpre_main.c | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-)
drivers/crypto/hisilicon/hpre/hpre_main.c +6 -16
@@ -13,9 +13,7 @@#include <linux/uacce.h> #include "hpre.h" -#define HPRE_QM_ABNML_INT_MASK 0x100004#define HPRE_CTRL_CNT_CLR_CE_BIT BIT(0) -#define HPRE_COMM_CNT_CLR_CE 0x0#define HPRE_CTRL_CNT_CLR_CE 0x301000#define HPRE_FSM_MAX_CNT 0x301008#define HPRE_VFG_AXQOS 0x30100c
@@ -42,7 +40,6 @@#define HPRE_HAC_INT_SET 0x301500#define HPRE_RNG_TIMEOUT_NUM 0x301A34#define HPRE_CORE_INT_ENABLE 0 -#define HPRE_CORE_INT_DISABLE GENMASK(21, 0)#define HPRE_RDCHN_INI_ST 0x301a00#define HPRE_CLSTR_BASE 0x302000#define HPRE_CORE_EN_OFFSET 0x04
@@ -66,7 +63,6 @@#define HPRE_CLSTR_ADDR_INTRVL 0x1000#define HPRE_CLUSTER_INQURY 0x100#define HPRE_CLSTR_ADDR_INQRY_RSLT 0x104 -#define HPRE_TIMEOUT_ABNML_BIT 6#define HPRE_PASID_EN_BIT 9#define HPRE_REG_RD_INTVRL_US 10#define HPRE_REG_RD_TMOUT_US 1000
@@ -203,9 +199,9 @@ static const struct hisi_qm_cap_info hpre_basic_info[] = { {HPRE_QM_RESET_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0xC37, 0x6C37}, {HPRE_QM_OOO_SHUTDOWN_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0x4, 0x6C37}, {HPRE_QM_CE_MASK_CAP, 0x312C, 0, GENMASK(31, 0), 0x0, 0x8, 0x8}, - {HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFFFE}, - {HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFFFE}, - {HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFFFE}, + {HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFC3E}, + {HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFC3E}, + {HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFC3E}, {HPRE_CE_MASK_CAP, 0x3138, 0, GENMASK(31, 0), 0x0, 0x1, 0x1}, {HPRE_CLUSTER_NUM_CAP, 0x313c, 20, GENMASK(3, 0), 0x0, 0x4, 0x1}, {HPRE_CORE_TYPE_NUM_CAP, 0x313c, 16, GENMASK(3, 0), 0x0, 0x2, 0x2},
@@ -654,11 +650,6 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)writel (HPRE_QM_USR_CFG_MASK , qm->io_base +QM_AWUSER_M_CFG_ENABLE );writel_relaxed (HPRE_QM_AXI_CFG_MASK , qm->io_base +QM_AXI_M_CFG ); -/* HPRE need more time, we close this interrupt */ - val =readl_relaxed (qm->io_base +HPRE_QM_ABNML_INT_MASK ); - val |=BIT (HPRE_TIMEOUT_ABNML_BIT ); -writel_relaxed (val, qm->io_base +HPRE_QM_ABNML_INT_MASK ); -if (qm->ver >=QM_HW_V3 )writel (HPRE_RSA_ENB |HPRE_ECC_ENB , qm->io_base +HPRE_TYPES_ENB );
@@ -667,9 +658,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)writel (HPRE_QM_VFG_AX_MASK , qm->io_base +HPRE_VFG_AXCACHE );writel (0x0 , qm->io_base +HPRE_BD_ENDIAN ); -writel (0x0 , qm->io_base +HPRE_INT_MASK );writel (0x0 , qm->io_base +HPRE_POISON_BYPASS ); -writel (0x0 , qm->io_base +HPRE_COMM_CNT_CLR_CE );writel (0x0 , qm->io_base +HPRE_ECC_BYPASS );writel (HPRE_BD_USR_MASK , qm->io_base +HPRE_BD_ARUSR_CFG );
@@ -759,7 +748,7 @@ static void hpre_hw_error_disable(struct hisi_qm *qm)static void hpre_hw_error_enable (struct hisi_qm *qm) { -u32 ce, nfe; +u32 ce, nfe, err_en; ce =hisi_qm_get_hw_info (qm, hpre_basic_info,HPRE_CE_MASK_CAP , qm->cap_ver); nfe =hisi_qm_get_hw_info (qm, hpre_basic_info,HPRE_NFE_MASK_CAP , qm->cap_ver);
@@ -776,7 +765,8 @@ static void hpre_hw_error_enable(struct hisi_qm *qm)hpre_master_ooo_ctrl (qm, true);/* enable hpre hw error interrupts */ -writel (HPRE_CORE_INT_ENABLE , qm->io_base +HPRE_INT_MASK ); + err_en = ce | nfe |HPRE_HAC_RAS_FE_ENABLE ; +writel (~err_en, qm->io_base +HPRE_INT_MASK ); }static inline struct hisi_qm *hpre_file_to_qm (struct hpre_debugfs_file *file)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/695 crypto: hisilicon/qm - reset device before enabling it
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit 5d2d1ee0874c26b8010ddf7f57e2f246e848af38 ]
Before the device is enabled again, the device may still store the previously processed data. If an error occurs in the previous task, the device may fail to be enabled again. Therefore, before enabling device, reset the device to restore the initial state.
Stable-dep-of: b04f06fc0243 ("crypto: hisilicon/qm - inject error before stopping queue")
--- drivers/crypto/hisilicon/hpre/hpre_main.c | 32 +++--- drivers/crypto/hisilicon/qm.c | 114 +++++++++++++++------- drivers/crypto/hisilicon/sec2/sec_main.c | 16 ++- drivers/crypto/hisilicon/zip/zip_main.c | 23 +++-- 4 files changed, 121 insertions(+), 64 deletions(-)
drivers/crypto/hisilicon/hpre/hpre_main.c +19 -13
@@ -354,6 +354,8 @@ static struct dfx_diff_registers hpre_diff_regs[] = { }, }; +static const struct hisi_qm_err_ini hpre_err_ini; +bool hpre_check_alg_support (struct hisi_qm *qm,u32 alg) {u32 cap_val;
@@ -1151,6 +1153,7 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) qm->qp_num = pf_q_num; qm->debug.curr_qm_qp_num = pf_q_num; qm->qm_list = &hpre_devices; + qm->err_ini = &hpre_err_ini;if (pf_q_num_flag)set_bit (QM_MODULE_PARAM , &qm->misc_ctl); }
@@ -1340,8 +1343,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)hpre_open_sva_prefetch (qm); - qm->err_ini = &hpre_err_ini; - qm->err_ini->err_info_init (qm);hisi_qm_dev_err_init (qm); ret =hpre_show_last_regs_init (qm);if (ret)
@@ -1370,6 +1371,18 @@ static int hpre_probe_init(struct hpre *hpre)return 0 ; } +static void hpre_probe_uninit (struct hisi_qm *qm) +{ +if (qm->fun_type ==QM_HW_VF ) +return ; + +hpre_cnt_regs_clear (qm); + qm->debug.curr_qm_qp_num =0 ; +hpre_show_last_regs_uninit (qm); +hpre_close_sva_prefetch (qm); +hisi_qm_dev_err_uninit (qm); +} +static int hpre_probe (struct pci_dev *pdev,const struct pci_device_id *id) {struct hisi_qm *qm;
@@ -1395,7 +1408,7 @@ static int hpre_probe(struct pci_dev *pdev, const struct pci_device_id *id) ret =hisi_qm_start (qm);if (ret) - goto err_with_err_init; + goto err_with_probe_init; ret =hpre_debugfs_init (qm);if (ret)
@@ -1434,9 +1447,8 @@ static int hpre_probe(struct pci_dev *pdev, const struct pci_device_id *id)hpre_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -err_with_err_init: -hpre_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); +err_with_probe_init: +hpre_probe_uninit (qm); err_with_qm_init:hisi_qm_uninit (qm);
@@ -1458,13 +1470,7 @@ static void hpre_remove(struct pci_dev *pdev)hpre_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -if (qm->fun_type ==QM_HW_PF ) { -hpre_cnt_regs_clear (qm); - qm->debug.curr_qm_qp_num =0 ; -hpre_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); - } - +hpre_probe_uninit (qm);hisi_qm_uninit (qm); }
drivers/crypto/hisilicon/qm.c +80 -34
183 lines not on this page · raw message
drivers/crypto/hisilicon/sec2/sec_main.c +7 -9
@@ -1065,9 +1065,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)struct hisi_qm *qm = &sec->qm;int ret; - qm->err_ini = &sec_err_ini; - qm->err_ini->err_info_init (qm); - ret =sec_set_user_domain_and_cache (qm);if (ret)return ret;
@@ -1122,6 +1119,7 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) qm->qp_num = pf_q_num; qm->debug.curr_qm_qp_num = pf_q_num; qm->qm_list = &sec_devices; + qm->err_ini = &sec_err_ini;if (pf_q_num_flag)set_bit (QM_MODULE_PARAM , &qm->misc_ctl); }else if (qm->fun_type ==QM_HW_VF && qm->ver ==QM_HW_V1 ) {
@@ -1186,6 +1184,12 @@ static int sec_probe_init(struct sec_dev *sec)static void sec_probe_uninit (struct hisi_qm *qm) { +if (qm->fun_type ==QM_HW_VF ) +return ; + +sec_debug_regs_clear (qm); +sec_show_last_regs_uninit (qm); +sec_close_sva_prefetch (qm);hisi_qm_dev_err_uninit (qm); }
@@ -1274,7 +1278,6 @@ static int sec_probe(struct pci_dev *pdev, const struct pci_device_id *id)sec_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); err_probe_uninit: -sec_show_last_regs_uninit (qm);sec_probe_uninit (qm); err_qm_uninit:sec_qm_uninit (qm);
@@ -1296,11 +1299,6 @@ static void sec_remove(struct pci_dev *pdev)sec_debugfs_exit (qm); (void )hisi_qm_stop (qm,QM_NORMAL ); - -if (qm->fun_type ==QM_HW_PF ) -sec_debug_regs_clear (qm); -sec_show_last_regs_uninit (qm); -sec_probe_uninit (qm);sec_qm_uninit (qm);
drivers/crypto/hisilicon/zip/zip_main.c +15 -8
@@ -1141,8 +1141,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) hisi_zip->ctrl = ctrl; ctrl->hisi_zip = hisi_zip; - qm->err_ini = &hisi_zip_err_ini; - qm->err_ini->err_info_init (qm); ret =hisi_zip_set_user_domain_and_cache (qm);if (ret)
@@ -1203,6 +1201,7 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) qm->qp_num = pf_q_num; qm->debug.curr_qm_qp_num = pf_q_num; qm->qm_list = &zip_devices; + qm->err_ini = &hisi_zip_err_ini;if (pf_q_num_flag)set_bit (QM_MODULE_PARAM , &qm->misc_ctl); }else if (qm->fun_type ==QM_HW_VF && qm->ver ==QM_HW_V1 ) {
@@ -1269,6 +1268,16 @@ static int hisi_zip_probe_init(struct hisi_zip *hisi_zip)return 0 ; } +static void hisi_zip_probe_uninit (struct hisi_qm *qm) +{ +if (qm->fun_type ==QM_HW_VF ) +return ; + +hisi_zip_show_last_regs_uninit (qm); +hisi_zip_close_sva_prefetch (qm); +hisi_qm_dev_err_uninit (qm); +} +static int hisi_zip_probe (struct pci_dev *pdev,const struct pci_device_id *id) {struct hisi_zip *hisi_zip;
@@ -1295,7 +1304,7 @@ static int hisi_zip_probe(struct pci_dev *pdev, const struct pci_device_id *id) ret =hisi_qm_start (qm);if (ret) - goto err_dev_err_uninit; + goto err_probe_uninit; ret =hisi_zip_debugfs_init (qm);if (ret)
@@ -1334,9 +1343,8 @@ static int hisi_zip_probe(struct pci_dev *pdev, const struct pci_device_id *id)hisi_zip_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -err_dev_err_uninit: -hisi_zip_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); +err_probe_uninit: +hisi_zip_probe_uninit (qm); err_qm_uninit:hisi_zip_qm_uninit (qm);
@@ -1358,8 +1366,7 @@ static void hisi_zip_remove(struct pci_dev *pdev)hisi_zip_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -hisi_zip_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); +hisi_zip_probe_uninit (qm);hisi_zip_qm_uninit (qm); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/695 crypto: hisilicon/qm - inject error before stopping queue
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit b04f06fc0243600665b3b50253869533b7938468 ]
The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.
--- drivers/crypto/hisilicon/qm.c | 47 ++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 23 deletions(-)
drivers/crypto/hisilicon/qm.c +24 -23
@@ -4015,6 +4015,28 @@ static int qm_set_vf_mse(struct hisi_qm *qm, bool set)return -ETIMEDOUT ; } +static void qm_dev_ecc_mbit_handle (struct hisi_qm *qm) +{ +u32 nfe_enb =0 ; + +/* Kunpeng930 hardware automatically close master ooo when NFE occurs */ +if (qm->ver >=QM_HW_V3 ) +return ; + +if (!qm->err_status.is_dev_ecc_mbit && + qm->err_status.is_qm_ecc_mbit && + qm->err_ini->close_axi_master_ooo) { + qm->err_ini->close_axi_master_ooo (qm); + }else if (qm->err_status.is_dev_ecc_mbit && + !qm->err_status.is_qm_ecc_mbit && + !qm->err_ini->close_axi_master_ooo) { + nfe_enb =readl (qm->io_base +QM_RAS_NFE_ENABLE ); +writel (nfe_enb &QM_RAS_NFE_MBIT_DISABLE , + qm->io_base +QM_RAS_NFE_ENABLE ); +writel (QM_ECC_MBIT , qm->io_base +QM_ABNORMAL_INT_SET ); + } +} +static int qm_vf_reset_prepare (struct hisi_qm *qm,enum qm_stop_reason stop_reason) {
@@ -4079,6 +4101,8 @@ static int qm_controller_reset_prepare(struct hisi_qm *qm)return ret; } +qm_dev_ecc_mbit_handle (qm); +/* PF obtains the information of VF by querying the register. */ qm_cmd_uninit (qm);
@@ -4125,28 +4149,6 @@ static int qm_master_ooo_check(struct hisi_qm *qm)return ret; } -static void qm_dev_ecc_mbit_handle (struct hisi_qm *qm) -{ -u32 nfe_enb =0 ; - -/* Kunpeng930 hardware automatically close master ooo when NFE occurs */ -if (qm->ver >=QM_HW_V3 ) -return ; - -if (!qm->err_status.is_dev_ecc_mbit && - qm->err_status.is_qm_ecc_mbit && - qm->err_ini->close_axi_master_ooo) { - qm->err_ini->close_axi_master_ooo (qm); - }else if (qm->err_status.is_dev_ecc_mbit && - !qm->err_status.is_qm_ecc_mbit && - !qm->err_ini->close_axi_master_ooo) { - nfe_enb =readl (qm->io_base +QM_RAS_NFE_ENABLE ); -writel (nfe_enb &QM_RAS_NFE_MBIT_DISABLE , - qm->io_base +QM_RAS_NFE_ENABLE ); -writel (QM_ECC_MBIT , qm->io_base +QM_ABNORMAL_INT_SET ); - } -} -static int qm_soft_reset_prepare (struct hisi_qm *qm) {struct pci_dev *pdev = qm->pdev;
@@ -4171,7 +4173,6 @@ static int qm_soft_reset_prepare(struct hisi_qm *qm)return ret; } -qm_dev_ecc_mbit_handle (qm); ret =qm_master_ooo_check (qm);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/695 wifi: mt76: mt7996: fix handling mbss enable/disable
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Lu <[email protected]>
[ Upstream commit ded1a6d9e13a32d4e8bef0c63accf49b9415ff5f ]
When mbss was previously enabled, the TLV needs to be included when disabling it again, in order to clear the firmware state.
--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +1 -1
@@ -822,7 +822,7 @@ mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,struct bss_info_uni_mbssid *mbssid;struct tlv *tlv; -if (!vif->bss_conf.bssid_indicator) +if (!vif->bss_conf.bssid_indicator && enable)return ; tlv =mt7996_mcu_add_uni_tlv (skb,UNI_BSS_INFO_11V_MBSSID ,sizeof (*mbssid));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/695 wifi: mt76: connac: fix checksum offload fields of connac3 RXD
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chiu <[email protected]>
[ Upstream commit a04b920fbc707deb699292cdae47006e8ea57d87 ]
Fix incorrect RXD offset and bitfield related to RX checksum offload.
--- drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h | 4 ++-- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 5 ++--- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4 ++-- 3 files changed, 6 insertions(+), 7 deletions(-)
drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h +2 -2
@@ -28,8 +28,6 @@ enum {#define MT_RXD0_MESH BIT(18)#define MT_RXD0_MHCP BIT(19)#define MT_RXD0_NORMAL_ETH_TYPE_OFS GENMASK(22, 16) -#define MT_RXD0_NORMAL_IP_SUM BIT(23) -#define MT_RXD0_NORMAL_UDP_TCP_SUM BIT(24)#define MT_RXD0_SW_PKT_TYPE_MASK GENMASK(31, 16)#define MT_RXD0_SW_PKT_TYPE_MAP 0x380F
@@ -80,6 +78,8 @@ enum {#define MT_RXD3_NORMAL_BEACON_UC BIT(21)#define MT_RXD3_NORMAL_CO_ANT BIT(22)#define MT_RXD3_NORMAL_FCS_ERR BIT(24) +#define MT_RXD3_NORMAL_IP_SUM BIT(26) +#define MT_RXD3_NORMAL_UDP_TCP_SUM BIT(27)#define MT_RXD3_NORMAL_VLAN2ETH BIT(31)/* RXD DW4 */
drivers/net/wireless/mediatek/mt76/mt7925/mac.c +2 -3
@@ -352,7 +352,7 @@ mt7925_mac_fill_rx_rate(struct mt792x_dev *dev,static int mt7925_mac_fill_rx (struct mt792x_dev *dev,struct sk_buff *skb) { -u32 csum_mask =MT_RXD0_NORMAL_IP_SUM |MT_RXD0_NORMAL_UDP_TCP_SUM ; +u32 csum_mask =MT_RXD3_NORMAL_IP_SUM |MT_RXD3_NORMAL_UDP_TCP_SUM ;struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;bool hdr_trans, unicast, insert_ccmp_hdr = false;u8 chfreq, qos_ctl =0 , remove_pad, amsdu_info;
@@ -362,7 +362,6 @@ mt7925_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)struct mt792x_phy *phy = &dev->phy;struct ieee80211_supported_band *sband;u32 csum_status = *(u32 *)skb->cb; -u32 rxd0 =le32_to_cpu (rxd[0 ]);u32 rxd1 =le32_to_cpu (rxd[1 ]);u32 rxd2 =le32_to_cpu (rxd[2 ]);u32 rxd3 =le32_to_cpu (rxd[3 ]);
@@ -420,7 +419,7 @@ mt7925_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)if (!sband->channels)return -EINVAL ; -if (mt76_is_mmio (&dev->mt76) && (rxd0 & csum_mask) == csum_mask && +if (mt76_is_mmio (&dev->mt76) && (rxd3 & csum_mask) == csum_mask && !(csum_status & (BIT (0 ) |BIT (2 ) |BIT (3 )))) skb->ip_summed =CHECKSUM_UNNECESSARY ;
drivers/net/wireless/mediatek/mt76/mt7996/mac.c +2 -2
@@ -435,7 +435,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,u32 rxd2 =le32_to_cpu (rxd[2 ]);u32 rxd3 =le32_to_cpu (rxd[3 ]);u32 rxd4 =le32_to_cpu (rxd[4 ]); -u32 csum_mask =MT_RXD0_NORMAL_IP_SUM |MT_RXD0_NORMAL_UDP_TCP_SUM ; +u32 csum_mask =MT_RXD3_NORMAL_IP_SUM |MT_RXD3_NORMAL_UDP_TCP_SUM ;u32 csum_status = *(u32 *)skb->cb;u32 mesh_mask =MT_RXD0_MESH |MT_RXD0_MHCP ;bool is_mesh = (rxd0 & mesh_mask) == mesh_mask;
@@ -497,7 +497,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,if (!sband->channels)return -EINVAL ; -if ((rxd0 & csum_mask) == csum_mask && +if ((rxd3 & csum_mask) == csum_mask && !(csum_status & (BIT (0 ) |BIT (2 ) |BIT (3 )))) skb->ip_summed =CHECKSUM_UNNECESSARY ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/695 wifi: mt76: mt7603: fix mixed declarations and code
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 9b8d932053b8b45d650360b36f701cf0f9b6470e ]
Move the qid variable declaration further up
--- drivers/net/wireless/mediatek/mt76/mt7603/dma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7603/dma.c +2 -2
@@ -29,7 +29,7 @@ mt7603_rx_loopback_skb(struct mt7603_dev *dev, struct sk_buff *skb)struct ieee80211_sta *sta;struct mt7603_sta *msta;struct mt76_wcid *wcid; -u8 tid =0 , hwq =0 ; +u8 qid, tid =0 , hwq =0 ;void *priv;int idx;u32 val;
@@ -57,7 +57,7 @@ mt7603_rx_loopback_skb(struct mt7603_dev *dev, struct sk_buff *skb)if (ieee80211_is_data_qos (hdr->frame_control)) { tid = *ieee80211_get_qos_ctl (hdr) &IEEE80211_QOS_CTL_TAG1D_MASK ; -u8 qid = tid_to_ac[tid]; + qid = tid_to_ac[tid]; hwq = wmm_queue_map[qid];skb_set_queue_mapping (skb, qid); }else if (ieee80211_is_data (hdr->frame_control)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/695 wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit a26a5107bc52922cf5f67361e307ad66547b51c7 ]
Looking at https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819
and running reproducer with CONFIG_UBSAN_BOUNDS, I've noticed the following:
[ T4985] UBSAN: array-index-out-of-bounds in net/wireless/scan.c:3479:25 [ T4985] index 164 is out of range for type 'struct ieee80211_channel *[]' <...skipped...>
[ T4985] Call Trace:
[ T4985] <TASK> [ T4985] dump_stack_lvl+0x1c2/0x2a0 [ T4985] ? __pfx_dump_stack_lvl+0x10/0x10 [ T4985] ? __pfx__printk+0x10/0x10 [ T4985] __ubsan_handle_out_of_bounds+0x127/0x150 [ T4985] cfg80211_wext_siwscan+0x11a4/0x1260
<...the rest is not too useful...>
Even if we do 'creq->n_channels = n_channels' before 'creq->ssids = (void *)&creq->channels[n_channels]', UBSAN treats the latter as off-by-one error. Fix this by using pointer arithmetic rather than an expression with explicit array indexing and use convenient 'struct_size()' to simplify the math here and in 'kzalloc()' above.
--- net/wireless/scan.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/wireless/scan.c +3 -3
@@ -3467,8 +3467,8 @@ int cfg80211_wext_siwscan(struct net_device *dev, n_channels =ieee80211_get_num_supported_channels (wiphy); } - creq =kzalloc (sizeof (*creq) +sizeof (struct cfg80211_ssid ) + - n_channels *sizeof (void *), + creq =kzalloc (struct_size (creq, channels, n_channels) + +sizeof (struct cfg80211_ssid ),GFP_ATOMIC );if (!creq)return -ENOMEM ;
@@ -3476,7 +3476,7 @@ int cfg80211_wext_siwscan(struct net_device *dev, creq->wiphy = wiphy; creq->wdev = dev->ieee80211_ptr;/* SSIDs come after channels */ - creq->ssids = (void *)&creq->channels[n_channels]; + creq->ssids = (void *)creq +struct_size (creq, channels, n_channels); creq->n_channels = n_channels; creq->n_ssids =1 ; creq->scan_start = jiffies;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/695 wifi: mt76: mt7915: fix rx filter setting for bfee functionality
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Howard Hsu <[email protected]>
[ Upstream commit 6ac80fce713e875a316a58975b830720a3e27721 ]
Fix rx filter setting to prevent dropping NDPA frames. Without this change, bfee functionality may behave abnormally.
--- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/main.c +1 -2
@@ -564,8 +564,7 @@ static void mt7915_configure_filter(struct ieee80211_hw *hw,MT76_FILTER (CONTROL ,MT_WF_RFCR_DROP_CTS |MT_WF_RFCR_DROP_RTS | -MT_WF_RFCR_DROP_CTL_RSV | -MT_WF_RFCR_DROP_NDPA ); +MT_WF_RFCR_DROP_CTL_RSV ); *total_flags = flags; rxfilter = phy->rxfilter;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/695 wifi: mt76: mt7996: fix uninitialized TLV data
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 9e461f4a2329109571f4b10f9bcad28d07e6ebb3 ]
Use skb_put_zero instead of skb_put
--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +1 -1
@@ -735,7 +735,7 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb)static struct tlv *mt7996_mcu_add_uni_tlv (struct sk_buff *skb,u16 tag,u16 len) { -struct tlv *ptlv =skb_put (skb, len); +struct tlv *ptlv =skb_put_zero (skb, len); ptlv->tag =cpu_to_le16 (tag); ptlv->len =cpu_to_le16 (len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/695 wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 15ea13b1b1fbf6364d4cd568e65e4c8479632999 ]
Although not reproduced in practice, these two cases may be considered by UBSAN as off-by-one errors. So fix them in the same way as in commit a26a5107bc52 ("wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()").
--- net/wireless/nl80211.c | 3 ++- net/wireless/sme.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/wireless/nl80211.c +2 -1
@@ -9778,7 +9778,8 @@ nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,return ERR_PTR (-ENOMEM );if (n_ssids) - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids = n_ssids;if (ie_len) {if (n_ssids)
net/wireless/sme.c +2 -1
@@ -115,7 +115,8 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev) n_channels = i; } request->n_channels = n_channels; - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids =1 ; memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/695 wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 9d301de12da6e1bb069a9835c38359b8e8135121 ]
Since '__dev_queue_xmit()' should be called with interrupts enabled, the following backtrace:
ieee80211_do_stop()
...
spin_lock_irqsave(&local->queue_stop_reason_lock, flags)
...
ieee80211_free_txskb()
ieee80211_report_used_skb()
ieee80211_report_ack_skb()
cfg80211_mgmt_tx_status_ext()
nl80211_frame_tx_status()
genlmsg_multicast_netns()
genlmsg_multicast_netns_filtered()
nlmsg_multicast_filtered()
netlink_broadcast_filtered()
do_one_broadcast()
netlink_broadcast_deliver()
__netlink_sendskb()
netlink_deliver_tap()
__netlink_deliver_tap_skb()
dev_queue_xmit()
__dev_queue_xmit() ; with IRQS disabled ...
spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)
issues the warning (as reported by syzbot reproducer):
WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120
Fix this by implementing a two-phase skb reclamation in 'ieee80211_do_stop()', where actual work is performed outside of a section with interrupts disabled.
--- net/mac80211/iface.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
net/mac80211/iface.c +16 -1
@@ -462,6 +462,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do {struct ieee80211_local *local = sdata->local;unsigned long flags; +struct sk_buff_head freeq;struct sk_buff *skb, *tmp;u32 hw_reconf_flags =0 ;int i, flushed;
@@ -637,18 +638,32 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_doskb_queue_purge (&sdata->status_queue); } +/* +* Since ieee80211_free_txskb() may issue __dev_queue_xmit() +* which should be called with interrupts enabled, reclamation +* is done in two phases: +*/ +__skb_queue_head_init (&freeq); + +/* unlink from local queues... */ spin_lock_irqsave (&local->queue_stop_reason_lock, flags);for (i =0 ; i <IEEE80211_MAX_QUEUES ; i++) { skb_queue_walk_safe(&local->pending[i], skb, tmp) {struct ieee80211_tx_info *info =IEEE80211_SKB_CB (skb);if (info->control.vif == &sdata->vif) {__skb_unlink (skb, &local->pending[i]); -ieee80211_free_txskb (&local->hw, skb); +__skb_queue_tail (&freeq, skb); } } }spin_unlock_irqrestore (&local->queue_stop_reason_lock, flags); +/* ... and perform actual reclamation with interrupts enabled. */ + skb_queue_walk_safe(&freeq, skb, tmp) { +__skb_unlink (skb, &freeq); +ieee80211_free_txskb (&local->hw, skb); + } +if (sdata->vif.type ==NL80211_IFTYPE_AP_VLAN )ieee80211_txq_remove_vlan (local, sdata);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/695 wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawei Ye <[email protected]>
[ Upstream commit 6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8 ]
In the wilc_parse_join_bss_param function, the TSF field of the ies structure is accessed after the RCU read-side critical section is unlocked. According to RCU usage rules, this is illegal. Reusing this pointer can lead to unpredictable behavior, including accessing memory that has been updated or causing use-after-free issues.
This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues.
To address this, the TSF value is now stored in a local variable ies_tsf before the RCU lock is released. The param->tsf_lo field is then assigned using this local variable, ensuring that the TSF value is safely accessed.
--- drivers/net/wireless/microchip/wilc1000/hif.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/microchip/wilc1000/hif.c +3 -1
@@ -384,6 +384,7 @@ wilc_parse_join_bss_param(struct cfg80211_bss *bss,struct wilc_join_bss_param *param;u8 rates_len =0 ;int ies_len; +u64 ies_tsf;int ret; param =kzalloc (sizeof (*param),GFP_KERNEL );
@@ -399,6 +400,7 @@ wilc_parse_join_bss_param(struct cfg80211_bss *bss,return NULL ; } ies_len = ies->len; + ies_tsf = ies->tsf;rcu_read_unlock (); param->beacon_period =cpu_to_le16 (bss->beacon_interval);
@@ -454,7 +456,7 @@ wilc_parse_join_bss_param(struct cfg80211_bss *bss,IEEE80211_P2P_ATTR_ABSENCE_NOTICE , (u8 *)&noa_attr, sizeof(noa_attr));if (ret >0 ) { - param->tsf_lo =cpu_to_le32 (ies->tsf); + param->tsf_lo =cpu_to_le32 (ies_tsf); param->noa_enabled =1 ; param->idx = noa_attr.index;if (noa_attr.oppps_ctwindow &IEEE80211_P2P_OPPPS_ENABLE_BIT ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/695 af_unix: Dont call skb_get() for OOB skb.
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 8594d9b85c07f05e431bd07e895c2a3ad9b85d6f ]
Since introduced, OOB skb holds an additional reference count with no special reason and caused many issues.
Also, kfree_skb() and consume_skb() are used to decrement the count, which is confusing.
Let's drop the unnecessary skb_get() in queue_oob() and corresponding kfree_skb(), consume_skb(), and skb_unref().
Now unix_sk(sk)->oob_skb is just a pointer to skb in the receive queue, so special handing is no longer needed in GC.
Stable-dep-of: 5aa57d9f2d53 ("af_unix: Don't return OOB skb in manage_oob().")
--- net/unix/af_unix.c | 27 +++++---------------------- net/unix/garbage.c | 16 ++-------------- 2 files changed, 7 insertions(+), 36 deletions(-)
net/unix/af_unix.c +5 -22
@@ -693,10 +693,7 @@ static void unix_release_sock(struct sock *sk, int embrion)unix_state_unlock (sk);#if IS_ENABLED (CONFIG_AF_UNIX_OOB ) -if (u->oob_skb) { -kfree_skb (u->oob_skb); - u->oob_skb =NULL ; - } + u->oob_skb =NULL ;#endif wake_up_interruptible_all (&u->peer_wait);
@@ -2226,13 +2223,9 @@ static int queue_oob(struct socket *sock, struct msghdr *msg, struct sock *other }maybe_add_creds (skb, sock, other); -skb_get (skb); -scm_stat_add (other, skb);spin_lock (&other->sk_receive_queue.lock); -if (ousk->oob_skb) -consume_skb (ousk->oob_skb);WRITE_ONCE (ousk->oob_skb, skb);__skb_queue_tail (&other->sk_receive_queue, skb);spin_unlock (&other->sk_receive_queue.lock);
@@ -2640,8 +2633,6 @@ static int unix_stream_recv_urg(struct unix_stream_read_state *state)if (!(state->flags &MSG_PEEK ))WRITE_ONCE (u->oob_skb,NULL ); -else -skb_get (oob_skb);spin_unlock (&sk->sk_receive_queue.lock);unix_state_unlock (sk);
@@ -2651,8 +2642,6 @@ static int unix_stream_recv_urg(struct unix_stream_read_state *state)if (!(state->flags &MSG_PEEK ))UNIXCB (oob_skb).consumed +=1 ; -consume_skb (oob_skb); -mutex_unlock (&u->iolock);if (chunk <0 )
@@ -2694,12 +2683,10 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,if (copied) { skb =NULL ; }else if (!(flags &MSG_PEEK )) { -if (sock_flag (sk,SOCK_URGINLINE )) { -WRITE_ONCE (u->oob_skb,NULL ); -consume_skb (skb); - }else { +WRITE_ONCE (u->oob_skb,NULL ); + +if (!sock_flag (sk,SOCK_URGINLINE )) {__skb_unlink (skb, &sk->sk_receive_queue); -WRITE_ONCE (u->oob_skb,NULL ); unlinked_skb = skb; skb =skb_peek (&sk->sk_receive_queue); }
@@ -2710,10 +2697,7 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,spin_unlock (&sk->sk_receive_queue.lock); -if (unlinked_skb) { -WARN_ON_ONCE (skb_unref (unlinked_skb)); -kfree_skb (unlinked_skb); - } +kfree_skb (unlinked_skb); }return skb; }
@@ -2756,7 +2740,6 @@ static int unix_stream_read_skb(struct sock *sk, skb_read_actor_t recv_actor)unix_state_unlock (sk);if (drop) { -WARN_ON_ONCE (skb_unref (skb));kfree_skb (skb);return -EAGAIN ; }
net/unix/garbage.c +2 -14
@@ -337,18 +337,6 @@ static bool unix_vertex_dead(struct unix_vertex *vertex)return true; } -static void unix_collect_queue (struct unix_sock *u,struct sk_buff_head *hitlist) -{ -skb_queue_splice_init (&u->sk.sk_receive_queue, hitlist); - -#if IS_ENABLED (CONFIG_AF_UNIX_OOB ) -if (u->oob_skb) { -WARN_ON_ONCE (skb_unref (u->oob_skb)); - u->oob_skb =NULL ; - } -#endif -} -static void unix_collect_skb (struct list_head *scc,struct sk_buff_head *hitlist) {struct unix_vertex *vertex;
@@ -371,11 +359,11 @@ static void unix_collect_skb(struct list_head *scc, struct sk_buff_head *hitliststruct sk_buff_head *embryo_queue = &skb->sk->sk_receive_queue;spin_lock (&embryo_queue->lock); -unix_collect_queue (unix_sk (skb->sk), hitlist); +skb_queue_splice_init (embryo_queue, hitlist);spin_unlock (&embryo_queue->lock); } }else { -unix_collect_queue (u, hitlist); +skb_queue_splice_init (queue, hitlist); }spin_unlock (&queue->lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/695 af_unix: Remove single nest in manage_oob().
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 579770dd89855915096db8364261543c37ed34ef ]
This is a prep for the later fix.
No functional change intended.
Stable-dep-of: 5aa57d9f2d53 ("af_unix: Don't return OOB skb in manage_oob().")
--- net/unix/af_unix.c | 45 +++++++++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 22 deletions(-)
net/unix/af_unix.c +23 -22
@@ -2654,11 +2654,10 @@ static int unix_stream_recv_urg(struct unix_stream_read_state *state)static struct sk_buff *manage_oob (struct sk_buff *skb,struct sock *sk,int flags,int copied) { +struct sk_buff *unlinked_skb =NULL ;struct unix_sock *u =unix_sk (sk);if (!unix_skb_len (skb)) { -struct sk_buff *unlinked_skb =NULL ; -spin_lock (&sk->sk_receive_queue.lock);if (copied && (!u->oob_skb || skb == u->oob_skb)) {
@@ -2674,31 +2673,33 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,spin_unlock (&sk->sk_receive_queue.lock);consume_skb (unlinked_skb); - }else { -struct sk_buff *unlinked_skb =NULL ; +return skb; + } -spin_lock (&sk->sk_receive_queue.lock); +spin_lock (&sk->sk_receive_queue.lock); -if (skb == u->oob_skb) { -if (copied) { - skb =NULL ; - }else if (!(flags &MSG_PEEK )) { -WRITE_ONCE (u->oob_skb,NULL ); - -if (!sock_flag (sk,SOCK_URGINLINE )) { -__skb_unlink (skb, &sk->sk_receive_queue); - unlinked_skb = skb; - skb =skb_peek (&sk->sk_receive_queue); - } - }else if (!sock_flag (sk,SOCK_URGINLINE )) { - skb =skb_peek_next (skb, &sk->sk_receive_queue); - } - } +if (skb != u->oob_skb) + goto unlock; -spin_unlock (&sk->sk_receive_queue.lock); +if (copied) { + skb =NULL ; + }else if (!(flags &MSG_PEEK )) { +WRITE_ONCE (u->oob_skb,NULL ); -kfree_skb (unlinked_skb); +if (!sock_flag (sk,SOCK_URGINLINE )) { +__skb_unlink (skb, &sk->sk_receive_queue); + unlinked_skb = skb; + skb =skb_peek (&sk->sk_receive_queue); + } + }else if (!sock_flag (sk,SOCK_URGINLINE )) { + skb =skb_peek_next (skb, &sk->sk_receive_queue); } + +unlock: +spin_unlock (&sk->sk_receive_queue.lock); + +kfree_skb (unlinked_skb); +return skb; }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/695 af_unix: Rename unlinked_skb in manage_oob().
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit beb2c5f19b6ab033b187e770a659c730c3bd05ca ]
When OOB skb has been already consumed, manage_oob() returns the next skb if exists. In such a case, we need to fall back to the else branch below.
Then, we need to keep two skbs and free them later with consume_skb() and kfree_skb().
Let's rename unlinked_skb accordingly.
Stable-dep-of: 5aa57d9f2d53 ("af_unix: Don't return OOB skb in manage_oob().")
--- net/unix/af_unix.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
net/unix/af_unix.c +6 -6
@@ -2654,7 +2654,7 @@ static int unix_stream_recv_urg(struct unix_stream_read_state *state)static struct sk_buff *manage_oob (struct sk_buff *skb,struct sock *sk,int flags,int copied) { -struct sk_buff *unlinked_skb =NULL ; +struct sk_buff *read_skb =NULL , *unread_skb =NULL ;struct unix_sock *u =unix_sk (sk);if (!unix_skb_len (skb)) {
@@ -2665,14 +2665,14 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk, }else if (flags &MSG_PEEK ) { skb =skb_peek_next (skb, &sk->sk_receive_queue); }else { - unlinked_skb = skb; + read_skb = skb; skb =skb_peek_next (skb, &sk->sk_receive_queue); -__skb_unlink (unlinked_skb, &sk->sk_receive_queue); +__skb_unlink (read_skb, &sk->sk_receive_queue); }spin_unlock (&sk->sk_receive_queue.lock); -consume_skb (unlinked_skb); +consume_skb (read_skb);return skb; }
@@ -2688,7 +2688,7 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,if (!sock_flag (sk,SOCK_URGINLINE )) {__skb_unlink (skb, &sk->sk_receive_queue); - unlinked_skb = skb; + unread_skb = skb; skb =skb_peek (&sk->sk_receive_queue); } }else if (!sock_flag (sk,SOCK_URGINLINE )) {
@@ -2698,7 +2698,7 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk, unlock:spin_unlock (&sk->sk_receive_queue.lock); -kfree_skb (unlinked_skb); +kfree_skb (unread_skb);return skb; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/695 af_unix: Move spin_lock() in manage_oob().
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit a0264a9f51fe0d196f22efd7538eb749e3448c2d ]
When OOB skb has been already consumed, manage_oob() returns the next skb if exists. In such a case, we need to fall back to the else branch below.
Then, we want to keep holding spin_lock(&sk->sk_receive_queue.lock).
Let's move it out of if-else branch and add lightweight check before spin_lock() for major use cases without OOB skb.
Stable-dep-of: 5aa57d9f2d53 ("af_unix: Don't return OOB skb in manage_oob().")
--- net/unix/af_unix.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
net/unix/af_unix.c +7 -8
@@ -2657,9 +2657,12 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,struct sk_buff *read_skb =NULL , *unread_skb =NULL ;struct unix_sock *u =unix_sk (sk); -if (!unix_skb_len (skb)) { -spin_lock (&sk->sk_receive_queue.lock); +if (likely (unix_skb_len (skb) && skb !=READ_ONCE (u->oob_skb))) +return skb; +spin_lock (&sk->sk_receive_queue.lock); + +if (!unix_skb_len (skb)) {if (copied && (!u->oob_skb || skb == u->oob_skb)) { skb =NULL ; }else if (flags &MSG_PEEK ) {
@@ -2670,14 +2673,9 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,__skb_unlink (read_skb, &sk->sk_receive_queue); } -spin_unlock (&sk->sk_receive_queue.lock); - -consume_skb (read_skb); -return skb; + goto unlock; } -spin_lock (&sk->sk_receive_queue.lock); -if (skb != u->oob_skb) goto unlock;
@@ -2698,6 +2696,7 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk, unlock:spin_unlock (&sk->sk_receive_queue.lock); +consume_skb (read_skb);kfree_skb (unread_skb);return skb;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/695 af_unix: Dont return OOB skb in manage_oob().
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 5aa57d9f2d5311f19434d95b2a81610aa263e23b ]
syzbot reported use-after-free in unix_stream_recv_urg(). [0]
The scenario is
1. send(MSG_OOB)
2. recv(MSG_OOB)
-> The consumed OOB remains in recv queue
3. send(MSG_OOB)
4. recv()
-> manage_oob() returns the next skb of the consumed OOB
-> This is also OOB, but unix_sk(sk)->oob_skb is not cleared
5. recv(MSG_OOB)
-> unix_sk(sk)->oob_skb is used but already freedThe recent commit 8594d9b85c07 ("af_unix: Don't call skb_get() for OOB skb.") uncovered the issue.
If the OOB skb is consumed and the next skb is peeked in manage_oob(), we still need to check if the skb is OOB.
Let's do so by falling back to the following checks in manage_oob() and add the test case in selftest.
Note that we need to add a similar check for SIOCATMARK.
[0]:
BUG: KASAN: slab-use-after-free in unix_stream_read_actor+0xa6/0xb0 net/unix/af_unix.c:2959 Read of size 4 at addr ffff8880326abcc4 by task syz-executor178/5235 CPU: 0 UID: 0 PID: 5235 Comm: syz-executor178 Not tainted 6.11.0-rc5-syzkaller-00742-gfbdaffe41adc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 unix_stream_read_actor+0xa6/0xb0 net/unix/af_unix.c:2959 unix_stream_recv_urg+0x1df/0x320 net/unix/af_unix.c:2640 unix_stream_read_generic+0x2456/0x2520 net/unix/af_unix.c:2778 unix_stream_recvmsg+0x22b/0x2c0 net/unix/af_unix.c:2996 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x22f/0x280 net/socket.c:1068 ____sys_recvmsg+0x1db/0x470 net/socket.c:2816 ___sys_recvmsg net/socket.c:2858 [inline] __sys_recvmsg+0x2f0/0x3e0 net/socket.c:2888 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5360d6b4e9 Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff29b3a458 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 00007fff29b3a638 RCX: 00007f5360d6b4e9 RDX: 0000000000002001 RSI: 0000000020000640 RDI: 0000000000000003 RBP: 00007f5360dde610 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fff29b3a628 R14: 0000000000000001 R15: 0000000000000001 </TASK> Allocated by task 5235: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_node_noprof+0x16b/0x320 mm/slub.c:4080 __alloc_skb+0x1c3/0x440 net/core/skbuff.c:667 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_skb_with_frags+0xc3/0x770 net/core/skbuff.c:6528 sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2815 sock_alloc_send_skb include/net/sock.h:1778 [inline] queue_oob+0x108/0x680 net/unix/af_unix.c:2198 unix_stream_sendmsg+0xd24/0xf80 net/unix/af_unix.c:2351 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5235: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4548 unix_stream_read_generic+0x1ef6/0x2520 net/unix/af_unix.c:2917 unix_stream_recvmsg+0x22b/0x2c0 net/unix/af_unix.c:2996 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x22f/0x280 net/socket.c:1068 __sys_recvfrom+0x256/0x3e0 net/socket.c:2255 __do_sys_recvfrom net/socket.c:2273 [inline] __se_sys_recvfrom net/socket.c:2269 [inline] __x64_sys_recvfrom+0xde/0x100 net/socket.c:2269 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff8880326abc80 which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 68 bytes inside of
freed 240-byte region [ffff8880326abc80, ffff8880326abd70)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x326ab
ksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000000 ffff88801eaee780 ffffea0000b7dc80 dead000000000003
raw: 0000000000000000 00000000800c000c 00000001fdffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 4686, tgid 4686 (udevadm), ts 32357469485, free_ts 28829011109
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493
prep_new_page mm/page_alloc.c:1501 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2321
allocate_slab+0x5a/0x2f0 mm/slub.c:2484
new_slab mm/slub.c:2537 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3723
__slab_alloc+0x58/0xa0 mm/slub.c:3813
__slab_alloc_node mm/slub.c:3866 [inline]
slab_alloc_node mm/slub.c:4025 [inline]
kmem_cache_alloc_node_noprof+0x1fe/0x320 mm/slub.c:4080
__alloc_skb+0x1c3/0x440 net/core/skbuff.c:667
alloc_skb include/linux/skbuff.h:1320 [inline]
alloc_uevent_skb+0x74/0x230 lib/kobject_uevent.c:289
uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline]
kobject_uevent_net_broadcast+0x2fd/0x580 lib/kobject_uevent.c:410
kobject_uevent_env+0x57d/0x8e0 lib/kobject_uevent.c:608
kobject_synth_uevent+0x4ef/0xae0 lib/kobject_uevent.c:207
uevent_store+0x4b/0x70 drivers/base/bus.c:633
kernfs_fop_write_iter+0x3a1/0x500 fs/kernfs/file.c:334
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa72/0xc90 fs/read_write.c:590
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1094 [inline]
free_unref_page+0xd22/0xea0 mm/page_alloc.c:2612
kasan_depopulate_vmalloc_pte+0x74/0x90 mm/kasan/shadow.c:408
apply_to_pte_range mm/memory.c:2797 [inline]
apply_to_pmd_range mm/memory.c:2841 [inline]
apply_to_pud_range mm/memory.c:2877 [inline]
apply_to_p4d_range mm/memory.c:2913 [inline]
__apply_to_page_range+0x8a8/0xe50 mm/memory.c:2947
kasan_release_vmalloc+0x9a/0xb0 mm/kasan/shadow.c:525
purge_vmap_node+0x3e3/0x770 mm/vmalloc.c:2208
__purge_vmap_area_lazy+0x708/0xae0 mm/vmalloc.c:2290
_vm_unmap_aliases+0x79d/0x840 mm/vmalloc.c:2885
change_page_attr_set_clr+0x2fe/0xdb0 arch/x86/mm/pat/set_memory.c:1881
change_page_attr_set arch/x86/mm/pat/set_memory.c:1922 [inline]
set_memory_nx+0xf2/0x130 arch/x86/mm/pat/set_memory.c:2110
free_init_pages arch/x86/mm/init.c:924 [inline]
free_kernel_image_pages arch/x86/mm/init.c:943 [inline]
free_initmem+0x79/0x110 arch/x86/mm/init.c:970
kernel_init+0x31/0x2b0 init/main.c:1476
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Memory state around the buggy address:
ffff8880326abb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880326abc00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
>ffff8880326abc80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880326abd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
ffff8880326abd80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb--- net/unix/af_unix.c | 9 ++++++-- tools/testing/selftests/net/af_unix/msg_oob.c | 23 +++++++++++++++++++ 2 files changed, 30 insertions(+), 2 deletions(-)
net/unix/af_unix.c +7 -2
@@ -2673,7 +2673,8 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,__skb_unlink (read_skb, &sk->sk_receive_queue); } - goto unlock; +if (!skb) + goto unlock; }if (skb != u->oob_skb)
@@ -3175,9 +3176,13 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) skb =skb_peek (&sk->sk_receive_queue);if (skb) {struct sk_buff *oob_skb =READ_ONCE (u->oob_skb); +struct sk_buff *next_skb; + + next_skb =skb_peek_next (skb, &sk->sk_receive_queue);if (skb == oob_skb || - (!oob_skb && !unix_skb_len (skb))) + (!unix_skb_len (skb) && + (!oob_skb || next_skb == oob_skb))) answ =1 ; }
tools/testing/selftests/net/af_unix/msg_oob.c +23 -0
@@ -525,6 +525,29 @@ TEST_F(msg_oob, ex_oob_drop_2) } } +TEST_F(msg_oob, ex_oob_oob) +{ +sendpair ("x" ,1 ,MSG_OOB ); +epollpair (true); +siocatmarkpair (true); + +recvpair ("x" ,1 ,1 ,MSG_OOB ); +epollpair (false); +siocatmarkpair (true); + +sendpair ("y" ,1 ,MSG_OOB ); +epollpair (true); +siocatmarkpair (true); + +recvpair ("" , -EAGAIN ,1 ,0 ); +epollpair (false); +siocatmarkpair (false); + +recvpair ("" , -EINVAL ,1 ,MSG_OOB ); +epollpair (false); +siocatmarkpair (false); +} + TEST_F(msg_oob, ex_oob_ahead_break) {sendpair ("hello" ,5 ,MSG_OOB );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/695 Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit d47da6bd4cfa982fe903f33423b9e2ec541e9496 ]
If HCI_CONN_MGMT_CONNECTED has been set then the event shall be HCI_CONN_MGMT_DISCONNECTED.
--- include/net/bluetooth/hci_core.h | 4 ++-- net/bluetooth/hci_conn.c | 6 ++---- net/bluetooth/mgmt.c | 13 +++++++++---- 3 files changed, 13 insertions(+), 10 deletions(-)
include/net/bluetooth/hci_core.h +2 -2
@@ -2257,8 +2257,8 @@ void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, bool mgmt_connected);void mgmt_disconnect_failed (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 link_type,u8 addr_type,u8 status); -void mgmt_connect_failed (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 link_type, -u8 addr_type,u8 status); +void mgmt_connect_failed (struct hci_dev *hdev,struct hci_conn *conn, +u8 status);void mgmt_pin_code_request (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 secure);void mgmt_pin_code_reply_complete (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 status);
net/bluetooth/hci_conn.c +2 -4
@@ -106,8 +106,7 @@ void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)* where a timeout + cancel does indicate an actual failure. */ if (status && status !=HCI_ERROR_UNKNOWN_CONN_ID ) -mgmt_connect_failed (hdev, &conn->dst, conn->type, - conn->dst_type, status); +mgmt_connect_failed (hdev, conn, status);/* The connection attempt was doing scan for new RPA, and is * in scan phase. If params are not associated with any other
@@ -1250,8 +1249,7 @@ void hci_conn_failed(struct hci_conn *conn, u8 status)hci_le_conn_failed (conn, status);break ;case ACL_LINK : -mgmt_connect_failed (hdev, &conn->dst, conn->type, - conn->dst_type, status); +mgmt_connect_failed (hdev, conn, status);break ; }
net/bluetooth/mgmt.c +9 -4
@@ -9779,13 +9779,18 @@ void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,mgmt_pending_remove (cmd); } -void mgmt_connect_failed (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 link_type, -u8 addr_type,u8 status) +void mgmt_connect_failed (struct hci_dev *hdev,struct hci_conn *conn,u8 status) {struct mgmt_ev_connect_failed ev; -bacpy (&ev.addr.bdaddr, bdaddr); - ev.addr.type =link_to_bdaddr (link_type, addr_type); +if (test_and_clear_bit (HCI_CONN_MGMT_CONNECTED , &conn->flags)) { +mgmt_device_disconnected (hdev, &conn->dst, conn->type, + conn->dst_type, status, true); +return ; + } + +bacpy (&ev.addr.bdaddr, &conn->dst); + ev.addr.type =link_to_bdaddr (conn->type, conn->dst_type); ev.status =mgmt_status (status);mgmt_event (MGMT_EV_CONNECT_FAILED , hdev, &ev,sizeof (ev),NULL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/695 Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit cfbfeee61582e638770a1a10deef866c9adb38f5 ]
This ignores errors from HCI_OP_REMOTE_NAME_REQ_CANCEL since it shouldn't interfere with the stopping of discovery and in certain conditions it seems to be failing.
--- net/bluetooth/hci_sync.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/bluetooth/hci_sync.c +4 -1
@@ -5380,7 +5380,10 @@ int hci_stop_discovery_sync(struct hci_dev *hdev)if (!e)return 0 ; -return hci_remote_name_cancel_sync (hdev, &e->data.bdaddr); +/* Ignore cancel errors since it should interfere with stopping +* of the discovery. +*/ +hci_remote_name_cancel_sync (hdev, &e->data.bdaddr); }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/695 sock_map: Add a cond_resched() in sock_hash_free()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b1339be951ad31947ae19bc25cb08769bf255100 ]
Several syzbot soft lockup reports all have in common sock_hash_free()
If a map with a large number of buckets is destroyed, we need to yield the cpu when needed.
--- net/core/sock_map.c | 1 + 1 file changed, 1 insertion(+)
net/core/sock_map.c +1 -0
@@ -1183,6 +1183,7 @@ static void sock_hash_free(struct bpf_map *map)sock_put (elem->sk);sock_hash_free_elem (htab, elem); } +cond_resched (); }/* wait for psock readers accessing its map link */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/695 can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 94b0818fa63555a65f6ba107080659ea6bcca63e ]
syzbot reported a warning in bcm_release(). [0]
The blamed change fixed another warning that is triggered when connect() is issued again for a socket whose connect()ed device has been unregistered.
However, if the socket is just close()d without the 2nd connect(), the remaining bo->bcm_proc_read triggers unnecessary remove_proc_entry() in bcm_release().
Let's clear bo->bcm_proc_read after remove_proc_entry() in bcm_notify().
[0]
name '4986'
WARNING: CPU: 0 PID: 5234 at fs/proc/generic.c:711 remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Modules linked in: CPU: 0 UID: 0 PID: 5234 Comm: syz-executor606 Not tainted 6.11.0-rc5-syzkaller-00178-g5517ae241919 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Code: ff eb 05 e8 cb 1e 5e ff 48 8b 5c 24 10 48 c7 c7 e0 f7 aa 8e e8 2a 38 8e 09 90 48 c7 c7 60 3a 1b 8c 48 89 de e8 da 42 20 ff 90 <0f> 0b 90 90 48 8b 44 24 18 48 c7 44 24 40 0e 36 e0 45 49 c7 04 07 RSP: 0018:ffffc9000345fa20 EFLAGS: 00010246 RAX: 2a2d0aee2eb64600 RBX: ffff888032f1f548 RCX: ffff888029431e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000345fb08 R08: ffffffff8155b2f2 R09: 1ffff1101710519a R10: dffffc0000000000 R11: ffffed101710519b R12: ffff888011d38640 R13: 0000000000000004 R14: 0000000000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcfb52722f0 CR3: 000000000e734000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> bcm_release+0x250/0x880 net/can/bcm.c:1578 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcfb51ee969 Code: Unable to access opcode bytes at 0x7fcfb51ee93f. RSP: 002b:00007ffce0109ca8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fcfb51ee969 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 00007fcfb526f3b0 R08: ffffffffffffffb8 R09: 0000555500000000 R10: 0000555500000000 R11: 0000000000000246 R12: 00007fcfb526f3b0 R13: 0000000000000000 R14: 00007fcfb5271ee0 R15: 00007fcfb51bf160 </TASK>
--- net/can/bcm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/can/bcm.c +3 -1
@@ -1471,8 +1471,10 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,/* remove device reference, if this is our bound device */ if (bo->bound && bo->ifindex == dev->ifindex) {#if IS_ENABLED (CONFIG_PROC_FS ) -if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) +if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) {remove_proc_entry (bo->procname,sock_net (sk)->can.bcmproc_dir); + bo->bcm_proc_read =NULL ; + }#endif bo->bound =0 ; bo->ifindex =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/695 can: m_can: enable NAPI before enabling interrupts
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jake Hamby <[email protected]>
[ Upstream commit 801ad2f87b0c6d0c34a75a4efd6bfd3a2d9f9298 ]
If an interrupt (RX-complete or error flag) is set when bringing up the CAN device, e.g. due to CAN bus traffic before initializing the device, when m_can_start() is called and interrupts are enabled, m_can_isr() is called immediately, which disables all CAN interrupts and calls napi_schedule().
Because napi_enable() isn't called until later in m_can_open(), the call to napi_schedule() never schedules the m_can_poll() callback and the device is left with interrupts disabled and can't receive any CAN packets until rebooted.
This can be verified by running "cansend" from another device before setting the bitrate and calling "ip link set up can0" on the test device. Adding debug lines to m_can_isr() shows it's called with flags (IR_EP | IR_EW | IR_CRCE), which calls m_can_disable_all_interrupts() and napi_schedule(), and then m_can_poll() is never called.
Move the call to napi_enable() above the call to m_can_start() to enable any initial interrupt flags to be handled by m_can_poll() so that interrupts are reenabled. Add a call to napi_disable() in the error handling section of m_can_open(), to handle the case where later functions return errors.
Also, in m_can_close(), move the call to napi_disable() below the call to m_can_stop() to ensure all interrupts are handled when bringing down the device. This race condition is much less likely to occur.
Tested on a Microchip SAMA7G54 MPU. The fix should be applicable to any SoC with a Bosch M_CAN controller.
--- drivers/net/can/m_can/m_can.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/can/m_can/m_can.c +6 -6
@@ -1763,9 +1763,6 @@ static int m_can_close(struct net_device *dev)netif_stop_queue (dev); -if (!cdev->is_peripheral) -napi_disable (&cdev->napi); -m_can_stop (dev);m_can_clk_stop (cdev);free_irq (dev->irq, dev);
@@ -1776,6 +1773,8 @@ static int m_can_close(struct net_device *dev)destroy_workqueue (cdev->tx_wq); cdev->tx_wq =NULL ;can_rx_offload_disable (&cdev->offload); + }else { +napi_disable (&cdev->napi); }close_candev (dev);
@@ -2030,6 +2029,8 @@ static int m_can_open(struct net_device *dev)if (cdev->is_peripheral)can_rx_offload_enable (&cdev->offload); +else +napi_enable (&cdev->napi);/* register interrupt handler */ if (cdev->is_peripheral) {
@@ -2063,9 +2064,6 @@ static int m_can_open(struct net_device *dev)if (err) goto exit_start_fail; -if (!cdev->is_peripheral) -napi_enable (&cdev->napi); -netif_start_queue (dev);return 0 ;
@@ -2079,6 +2077,8 @@ static int m_can_open(struct net_device *dev) out_wq_fail:if (cdev->is_peripheral)can_rx_offload_disable (&cdev->offload); +else +napi_disable (&cdev->napi);close_candev (dev); exit_disable_clks:m_can_clk_stop (cdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/695 can: m_can: m_can_close(): stop clocks after device has been shut down
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 2c09b50efcad985cf920ca88baa9aa52b1999dcc ]
After calling m_can_stop() an interrupt may be pending or NAPI might still be executed. This means the driver might still touch registers of the IP core after the clocks have been disabled. This is not good practice and might lead to aborts depending on the SoC integration.
To avoid these potential problems, make m_can_close() symmetric to m_can_open(), i.e. stop the clocks at the end, right before shutting down the transceiver.
--- drivers/net/can/m_can/m_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/m_can/m_can.c +1 -1
@@ -1764,7 +1764,6 @@ static int m_can_close(struct net_device *dev)netif_stop_queue (dev);m_can_stop (dev); -m_can_clk_stop (cdev);free_irq (dev->irq, dev);m_can_clean (dev);
@@ -1779,6 +1778,7 @@ static int m_can_close(struct net_device *dev)close_candev (dev); +m_can_clk_stop (cdev);phy_power_off (cdev->transceiver);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/695 Bluetooth: btusb: Fix not handling ZPL/short-transfer
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 7b05933340f4490ef5b09e84d644d12484b05fdf ]
Requesting transfers of the exact same size of wMaxPacketSize may result in ZPL/short-transfer since the USB stack cannot handle it as we are limiting the buffer size to be the same as wMaxPacketSize.
Also, in terms of throughput this change has the same effect to interrupt endpoint as 290ba200815f "Bluetooth: Improve USB driver throughput by increasing the frame size" had for the bulk endpoint, so users of the advertisement bearer (e.g. BT Mesh) may benefit from this change.
--- drivers/bluetooth/btusb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +4 -1
@@ -1397,7 +1397,10 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)if (!urb)return -ENOMEM ; - size =le16_to_cpu (data->intr_ep->wMaxPacketSize); +/* Use maximum HCI Event size so the USB stack handles +* ZPL/short-transfer automatically. +*/ + size =HCI_MAX_EVENT_SIZE ; buf =kmalloc (size, mem_flags);if (!buf) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/695 bareudp: Pull inner IP header in bareudp_udp_encap_recv().
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 45fa29c85117170b0508790f878b13ec6593c888 ]
Bareudp reads the inner IP header to get the ECN value. Therefore, it needs to ensure that it's part of the skb's linear data.
This is similar to the vxlan and geneve fixes for that same problem:
* commit f7789419137b ("vxlan: Pull inner IP header in vxlan_rcv().")
* commit 1ca1ba465e55 ("geneve: make sure to pull inner header in
geneve_rx()")
--- drivers/net/bareudp.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
drivers/net/bareudp.c +18 -2
@@ -68,6 +68,7 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)__be16 proto;void *oiph;int err; +int nh; bareudp =rcu_dereference_sk_user_data (sk);if (!bareudp)
@@ -148,10 +149,25 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb) }skb_dst_set (skb, &tun_dst->dst); skb->dev = bareudp->dev; - oiph =skb_network_header (skb); -skb_reset_network_header (skb);skb_reset_mac_header (skb); +/* Save offset of outer header relative to skb->head, +* because we are going to reset the network header to the inner header +* and might change skb->head. +*/ + nh =skb_network_header (skb) - skb->head; + +skb_reset_network_header (skb); + +if (!pskb_inet_may_pull (skb)) { +DEV_STATS_INC (bareudp->dev, rx_length_errors); +DEV_STATS_INC (bareudp->dev, rx_errors); + goto drop; + } + +/* Get the outer header. */ + oiph = skb->head + nh; +if (!ipv6_mod_enabled () || family ==AF_INET ) err =IP_ECN_decapsulate (oiph, skb);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/695 bareudp: Pull inner IP header on xmit.
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit c471236b2359e6b27388475dd04fff0a5e2bf922 ]
Both bareudp_xmit_skb() and bareudp6_xmit_skb() read their skb's inner IP header to get its ECN value (with ip_tunnel_ecn_encap()). Therefore we need to ensure that the inner IP header is part of the skb's linear data.
--- drivers/net/bareudp.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/bareudp.c +6 -0
@@ -317,6 +317,9 @@ static int bareudp_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be32 saddr;int err; +if (!skb_vlan_inet_prepare (skb, skb->protocol !=htons (ETH_P_TEB ))) +return -EINVAL ; +if (!sock)return -ESHUTDOWN ;
@@ -384,6 +387,9 @@ static int bareudp6_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; +if (!skb_vlan_inet_prepare (skb, skb->protocol !=htons (ETH_P_TEB ))) +return -EINVAL ; +if (!sock)return -ESHUTDOWN ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/695 net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 799a9225997799f7b1b579bc50a93b78b4fb2a01 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.c +1 -2
@@ -2305,12 +2305,11 @@ static int enetc_setup_irqs(struct enetc_ndev_priv *priv)snprintf (v->name,sizeof (v->name),"%s-rxtx%d" , priv->ndev->name, i); - err =request_irq (irq, enetc_msix,0 , v->name, v); + err =request_irq (irq, enetc_msix,IRQF_NO_AUTOEN , v->name, v);if (err) {dev_err (priv->dev,"request_irq() failed!\n" ); goto irq_err; } -disable_irq (irq); v->tbier_base = hw->reg +ENETC_BDR (TX ,0 ,ENETC_TBIER ); v->rbier = hw->reg +ENETC_BDR (RX , i,ENETC_RBIER );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/695 crypto: n2 - Set err to EINVAL if snprintf fails for hmac
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit ce212d2afca47acd366a2e74c76fe82c31f785ab ]
Return EINVAL if the snprintf check fails when constructing the algorithm names.
--- drivers/crypto/n2_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/crypto/n2_core.c +1 -0
@@ -1353,6 +1353,7 @@ static int __n2_register_one_hmac(struct n2_ahash_alg *n2ahash) ahash->setkey = n2_hmac_async_setkey; base = &ahash->halg.base; + err = -EINVAL ;if (snprintf (base->cra_name,CRYPTO_MAX_ALG_NAME ,"hmac(%s)" , p->child_alg) >=CRYPTO_MAX_ALG_NAME ) goto out_free_p;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/695 xsk: fix batch alloc API on non-coherent systems
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <[email protected]>
[ Upstream commit 4144a1059b47e821c82c3c82eb23a4c7312dce3a ]
In cases when synchronizing DMA operations is necessary, xsk_buff_alloc_batch() returns a single buffer instead of the requested count. This puts the pressure on drivers that use batch API as they have to check for this corner case on their side and take care of allocations by themselves, which feels counter productive. Let us improve the core by looping over xp_alloc() @max times when slow path needs to be taken.
Another issue with current interface, as spotted and fixed by Dries, was that when driver called xsk_buff_alloc_batch() with @max == 0, for slow path case it still allocated and returned a single buffer, which should not happen. By introducing the logic from first paragraph we kill two birds with one stone and address this problem as well.
--- net/xdp/xsk_buff_pool.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
net/xdp/xsk_buff_pool.c +18 -7
@@ -623,20 +623,31 @@ static u32 xp_alloc_reused(struct xsk_buff_pool *pool, struct xdp_buff **xdp, u3return nb_entries; } -u32 xp_alloc_batch (struct xsk_buff_pool *pool,struct xdp_buff **xdp,u32 max) +static u32 xp_alloc_slow (struct xsk_buff_pool *pool,struct xdp_buff **xdp, +u32 max) { -u32 nb_entries1 =0 , nb_entries2; +int i; -if (unlikely (pool->dev &&dma_dev_need_sync (pool->dev))) { +for (i =0 ; i < max; i++) {struct xdp_buff *buff; -/* Slow path */ buff =xp_alloc (pool); -if (buff) - *xdp = buff; -return !!buff; +if (unlikely (!buff)) +return i; + *xdp = buff; + xdp++; } +return max; +} + +u32 xp_alloc_batch (struct xsk_buff_pool *pool,struct xdp_buff **xdp,u32 max) +{ +u32 nb_entries1 =0 , nb_entries2; + +if (unlikely (pool->dev &&dma_dev_need_sync (pool->dev))) +return xp_alloc_slow (pool, xdp, max); +if (unlikely (pool->free_list_cnt)) { nb_entries1 =xp_alloc_reused (pool, xdp, max);if (nb_entries1 == max)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/695 netkit: Assign missing bpf_net_context
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 157f29152b61ca41809dd7ead29f5733adeced19 ]
During the introduction of struct bpf_net_context handling for XDP-redirect, the netkit driver has been missed, which also requires it because NETKIT_REDIRECT invokes skb_do_redirect() which is accessing the per-CPU variables. Otherwise we see the following crash:
BUG: kernel NULL pointer dereference, address: 0000000000000038 bpf_redirect() netkit_xmit() dev_hard_start_xmit()
Set the bpf_net_context before invoking netkit_xmit() program within the netkit driver.
--- drivers/net/netkit.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/netkit.c +3 -0
@@ -65,6 +65,7 @@ static struct netkit *netkit_priv(const struct net_device *dev)static netdev_tx_t netkit_xmit (struct sk_buff *skb,struct net_device *dev) { +struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;struct netkit *nk =netkit_priv (dev);enum netkit_action ret =READ_ONCE (nk->policy);netdev_tx_t ret_dev =NET_XMIT_SUCCESS ;
@@ -72,6 +73,7 @@ static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev)struct net_device *peer;int len = skb->len; + bpf_net_ctx =bpf_net_ctx_set (&__bpf_net_ctx);rcu_read_lock (); peer =rcu_dereference (nk->peer); if (unlikely(!peer || !(peer->flags & IFF_UP) ||
@@ -110,6 +112,7 @@ static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev)break ; }rcu_read_unlock (); +bpf_net_ctx_clear (bpf_net_ctx);return ret_dev; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/695 r8169: disable ALDPS per default for RTL8125
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit b9c7ac4fe22c608acf6153a3329df2b6b6cd416c ]
En-Wei reported that traffic breaks if cable is unplugged for more than 3s and then re-plugged. This was supposed to be fixed by 621735f59064 ("r8169: fix rare issue with broken rx after link-down on RTL8125"). But apparently this didn't fix the issue for everybody. The 3s threshold rang a bell, as this is the delay after which ALDPS kicks in. And indeed disabling ALDPS fixes the issue for this user. Maybe this fixes the issue in general. In a follow-up step we could remove the first fix attempt and see whether anybody complains.
--- drivers/net/ethernet/realtek/r8169_phy_config.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/realtek/r8169_phy_config.c +2 -0
@@ -1060,6 +1060,7 @@ static void rtl8125a_2_hw_phy_config(struct rtl8169_private *tp,phy_modify_paged (phydev,0xa86 ,0x15 ,0x0001 ,0x0000 );rtl8168g_enable_gphy_10m (phydev); +rtl8168g_disable_aldps (phydev);rtl8125a_config_eee_phy (phydev); }
@@ -1099,6 +1100,7 @@ static void rtl8125b_hw_phy_config(struct rtl8169_private *tp,phy_modify_paged (phydev,0xbf8 ,0x12 ,0xe000 ,0xa000 );rtl8125_legacy_force_mode (phydev); +rtl8168g_disable_aldps (phydev);rtl8125b_config_eee_phy (phydev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/695 net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Iurman <[email protected]>
[ Upstream commit 2c84b0aa28b9e73e8c4b4ce038269469434ae372 ]
Free the skb before returning from rpl_input when skb_cow_head() fails. Use a "drop" label and goto instructions.
--- net/ipv6/rpl_iptunnel.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/ipv6/rpl_iptunnel.c +7 -5
@@ -263,10 +263,8 @@ static int rpl_input(struct sk_buff *skb) rlwt =rpl_lwt_lwtunnel (orig_dst->lwtstate); err =rpl_do_srh (skb, rlwt); -if (unlikely (err)) { -kfree_skb (skb); -return err; - } +if (unlikely (err)) + goto drop;local_bh_disable (); dst =dst_cache_get (&rlwt->cache);
@@ -286,9 +284,13 @@ static int rpl_input(struct sk_buff *skb) err =skb_cow_head (skb,LL_RESERVED_SPACE (dst->dev));if (unlikely (err)) -return err; + goto drop;return dst_input (skb); + +drop: +kfree_skb (skb); +return err; } static int nla_put_rpl_srh(struct sk_buff *skb, int attrtype,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/695 fbnic: Set napi irq value after calling netif_napi_add
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brett Creeley <[email protected]>
[ Upstream commit 9f3e7f11f21ac83cd99428390165177d4953b005 ]
The driver calls netif_napi_set_irq() and then calls netif_napi_add(), which calls netif_napi_add_weight(). At the end of netif_napi_add_weight() is a call to netif_napi_set_irq(napi, -1), which clears the previously set napi->irq value. Fix this by calling netif_napi_set_irq() after calling netif_napi_add().
This was found when reviewing another patch and I have no way to test this, but the fix seemed relatively straight forward.
--- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/meta/fbnic/fbnic_txrx.c +4 -4
@@ -1012,14 +1012,14 @@ static int fbnic_alloc_napi_vector(struct fbnic_dev *fbd, struct fbnic_net *fbn, nv->fbd = fbd; nv->v_idx = v_idx; -/* Record IRQ to NAPI struct */ -netif_napi_set_irq (&nv->napi, -pci_irq_vector (to_pci_dev (fbd->dev), nv->v_idx)); -/* Tie napi to netdev */ list_add (&nv->napis, &fbn->napis);netif_napi_add (fbn->netdev, &nv->napi, fbnic_poll); +/* Record IRQ to NAPI struct */ +netif_napi_set_irq (&nv->napi, +pci_irq_vector (to_pci_dev (fbd->dev), nv->v_idx)); +/* Tie nv back to PCIe dev */ nv->dev = fbd->dev;
Signature · 1 line
2.43.0